@vibesdotdev/account 0.0.0-stage → 1.0.0-rc.3

package/dist/schemas/user-forms.js

@@ -0,0 +1,68 @@
+import * as z from 'zod/v4';
+// User creation schema — built from scratch to match the users table fields,
+// excluding auto-generated fields (id, createdAt, updatedAt, deletedAt).
+export const createUserSchema = z.object({
+    email: z.email().transform((v) => v.toLowerCase()),
+    name: z.string().min(1).max(100).optional(),
+    displayName: z.string().min(1).max(100).optional(),
+    slug: z.string().max(100).optional(),
+    emailVerified: z.boolean().optional(),
+    image: z.url().optional(),
+    isSuperuser: z.boolean().optional(),
+    twoFactorEnabled: z.boolean().optional(),
+    phoneNumber: z
+        .string()
+        .regex(/^\+[1-9]\d{1,14}$/, 'Invalid phone number format')
+        .optional(),
+    phoneNumberVerified: z.boolean().optional(),
+    phoneNumberVerifiedAt: z.date().optional(),
+    stripeCustomerId: z.string().optional(),
+    status: z.enum(['pending', 'active', 'suspended', 'banned']).optional(),
+    statusChangedAt: z.date().optional(),
+    statusChangedBy: z.string().optional(),
+    statusReason: z.string().optional(),
+    queuePosition: z.number().int().positive().optional(),
+    queueJoinedAt: z.date().optional()
+});
+// User update schema — all fields optional except ID
+export const updateUserSchema = createUserSchema.partial().extend({
+    id: z.uuid()
+});
+// User registration schema with additional fields
+export const registerUserSchema = createUserSchema.extend({
+    acceptTerms: z.boolean().refine((val) => val === true, {
+        message: 'You must accept the terms of service'
+    })
+});
+// User login schema
+export const loginUserSchema = z.object({
+    email: z.email('Please enter a valid email address'),
+    password: z.string().min(1, 'Password is required')
+});
+// Password reset request schema
+export const resetPasswordRequestSchema = z.object({
+    email: z.email('Please enter a valid email address')
+});
+// Password reset schema
+export const resetPasswordSchema = z
+    .object({
+    token: z.string().min(1, 'Reset token is required'),
+    password: z.string().min(8, 'Password must be at least 8 characters'),
+    confirmPassword: z.string()
+})
+    .refine((data) => data.password === data.confirmPassword, {
+    message: "Passwords don't match",
+    path: ['confirmPassword']
+});
+// Change password schema
+export const changePasswordSchema = z
+    .object({
+    currentPassword: z.string().min(1, 'Current password is required'),
+    newPassword: z.string().min(8, 'Password must be at least 8 characters'),
+    confirmPassword: z.string()
+})
+    .refine((data) => data.newPassword === data.confirmPassword, {
+    message: "Passwords don't match",
+    path: ['confirmPassword']
+});
+//# sourceMappingURL=user-forms.js.map

package/dist/schemas/user-forms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-forms.js","sourceRoot":"","sources":["../../src/schemas/user-forms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,EAAE,6BAA6B,CAAC;SACzD,QAAQ,EAAE;IACZ,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,qBAAqB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC;IACjE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;CACZ,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,EAAE;QACtD,OAAO,EAAE,sCAAsC;KAC/C,CAAC;CACF,CAAC,CAAC;AAEH,oBAAoB;AACpB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;CACnD,CAAC,CAAC;AAEH,gCAAgC;AAChC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC;CACpD,CAAC,CAAC;AAEH,wBAAwB;AACxB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAClC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACrE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,eAAe,EAAE;IACzD,OAAO,EAAE,uBAAuB;IAChC,IAAI,EAAE,CAAC,iBAAiB,CAAC;CACzB,CAAC,CAAC;AAEJ,yBAAyB;AACzB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KACnC,MAAM,CAAC;IACP,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACxE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE;IAC5D,OAAO,EAAE,uBAAuB;IAChC,IAAI,EAAE,CAAC,iBAAiB,CAAC;CACzB,CAAC,CAAC"}

package/dist/schemas/user-types.d.ts

@@ -0,0 +1,2 @@
+export type { UpdateUserProfileInput, UpdateUserSettingsInput, User, UserProfile, UserSettings, UserStatus } from './user-common.ts';
+//# sourceMappingURL=user-types.d.ts.map

package/dist/schemas/user-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-types.d.ts","sourceRoot":"","sources":["../../src/schemas/user-types.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,sBAAsB,EACtB,uBAAuB,EACvB,IAAI,EACJ,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,kBAAkB,CAAC"}

package/dist/schemas/user-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=user-types.js.map

package/dist/schemas/user-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-types.js","sourceRoot":"","sources":["../../src/schemas/user-types.ts"],"names":[],"mappings":""}

package/dist/server/account-service-binding.d.ts

@@ -0,0 +1,11 @@
+import * as z from 'zod/v4';
+/** The `ACCOUNT_SERVICE` service binding a calling worker declares: a worker-to-worker fetcher. */
+export interface AccountServiceBinding {
+    fetch: typeof globalThis.fetch;
+}
+/**
+ * The `ACCOUNT_SERVICE` binding's owning schema for `runtime.getBinding`. It
+ * admits the native binding itself, never a copy, so `fetch` keeps its receiver.
+ */
+export declare const AccountServiceBindingSchema: z.ZodCustom<AccountServiceBinding, AccountServiceBinding>;
+//# sourceMappingURL=account-service-binding.d.ts.map

package/dist/server/account-service-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-service-binding.d.ts","sourceRoot":"","sources":["../../src/server/account-service-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAID;;;GAGG;AACH,eAAO,MAAM,2BAA2B,2DAEvC,CAAC"}

package/dist/server/account-service-binding.js

@@ -0,0 +1,8 @@
+import * as z from 'zod/v4';
+const AccountServiceBindingMethodsSchema = z.object({ fetch: z.function() });
+/**
+ * The `ACCOUNT_SERVICE` binding's owning schema for `runtime.getBinding`. It
+ * admits the native binding itself, never a copy, so `fetch` keeps its receiver.
+ */
+export const AccountServiceBindingSchema = z.custom((value) => AccountServiceBindingMethodsSchema.safeParse(value).success);
+//# sourceMappingURL=account-service-binding.js.map

package/dist/server/account-service-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-service-binding.js","sourceRoot":"","sources":["../../src/server/account-service-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAO5B,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE7E;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAClD,CAAC,KAAK,EAAE,EAAE,CAAC,kCAAkC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACtE,CAAC"}

package/dist/server/internal-service-token.d.ts

@@ -0,0 +1,56 @@
+/**
+ * THE canonical internal-service-token guard for `@vibesdotdev` web apps.
+ *
+ * Every `/api/internal/*` bearer check across the app fleet (chat-web, ai-web,
+ * account-web, hq-web, platform-web) validates `Authorization: Bearer
+ * <VIBES_INTERNAL_SERVICE_TOKEN>`. This module is the single implementation;
+ * apps keep at most a thin re-export or error-mapping wrapper.
+ *
+ * Token resolution uses the invoking runtime's canonical credential reference.
+ * There is no ambient runtime, environment precedence or cross-store fallback.
+ * Only credential-not-set means unconfigured; provider failures propagate.
+ * Comparison is
+ * constant-time (`constantTimeEqual`) — no length oracle. Unconfigured means
+ * fail closed: `requireInternalServiceToken` throws 500, the boolean variants
+ * return false.
+ */
+import { CapabilityError, type RuntimeRef } from '@vibesdotdev/kernel';
+/**
+ * Status-carrying failure thrown by the guard. Deliberately NOT SvelteKit's
+ * `error()` — this package's public server exports must not import
+ * `@sveltejs/kit` (framework boundary law); consuming apps map this to their
+ * framework's error type at their own module boundary.
+ */
+export declare class InternalServiceTokenError extends CapabilityError {
+    readonly status: 401 | 500;
+    constructor(status: 401 | 500, message: string);
+}
+export declare const INTERNAL_SERVICE_TOKEN_ENV = "VIBES_INTERNAL_SERVICE_TOKEN";
+/** Extract the Bearer credential from an Authorization header ('' when absent). */
+export declare function extractInternalServiceBearer(authHeader: string | null): string;
+/**
+ * Resolve on the handed runtime. Only an absent credential becomes ''.
+ */
+export declare function resolveInternalServiceToken(runtime: Pick<RuntimeRef, 'resolveCredential'>): Promise<string>;
+/** Constant-time match with the fail-closed empty-expected guard baked in. */
+export declare function matchesInternalServiceToken(provided: string, expected: string): boolean;
+/**
+ * Returns false when unconfigured or on mismatch; credential failures propagate.
+ */
+export declare function isInternalServiceBearerValid(runtime: Pick<RuntimeRef, 'resolveCredential'>, authHeader: string | null): Promise<boolean>;
+/**
+ * Pure comparison against a token already resolved by the owning runtime.
+ */
+export declare function isInternalServiceBearerValidSync(authHeader: string | null, expected: string): boolean;
+/**
+ * Require a valid `Authorization: Bearer <VIBES_INTERNAL_SERVICE_TOKEN>`
+ * header. Throws 500 when the token is unconfigured, 401 when it doesn't
+ * match. Returns the resolved token so callers can forward it to downstream
+ * internal service clients (e.g. the account source-policy client).
+ */
+export declare function requireInternalServiceToken(runtime: Pick<RuntimeRef, 'resolveCredential'>, request: Request): Promise<string>;
+/**
+ * Pure throwing variant after explicit credential resolution by the caller.
+ */
+export declare function requireInternalServiceTokenSync(request: Request, configured: string): void;
+//# sourceMappingURL=internal-service-token.d.ts.map

package/dist/server/internal-service-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-service-token.d.ts","sourceRoot":"","sources":["../../src/server/internal-service-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGvE;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,eAAe;aAE5C,MAAM,EAAE,GAAG,GAAG,GAAG;gBAAjB,MAAM,EAAE,GAAG,GAAG,GAAG,EACjC,OAAO,EAAE,MAAM;CAWhB;AAED,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAG9E;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAWjH;AAED,8EAA8E;AAC9E,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvF;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9I;AAED;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErG;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAQnI;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAM1F"}

package/dist/server/internal-service-token.js

@@ -0,0 +1,99 @@
+/**
+ * THE canonical internal-service-token guard for `@vibesdotdev` web apps.
+ *
+ * Every `/api/internal/*` bearer check across the app fleet (chat-web, ai-web,
+ * account-web, hq-web, platform-web) validates `Authorization: Bearer
+ * <VIBES_INTERNAL_SERVICE_TOKEN>`. This module is the single implementation;
+ * apps keep at most a thin re-export or error-mapping wrapper.
+ *
+ * Token resolution uses the invoking runtime's canonical credential reference.
+ * There is no ambient runtime, environment precedence or cross-store fallback.
+ * Only credential-not-set means unconfigured; provider failures propagate.
+ * Comparison is
+ * constant-time (`constantTimeEqual`) — no length oracle. Unconfigured means
+ * fail closed: `requireInternalServiceToken` throws 500, the boolean variants
+ * return false.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { constantTimeEqual } from '@vibesdotdev/security';
+/**
+ * Status-carrying failure thrown by the guard. Deliberately NOT SvelteKit's
+ * `error()` — this package's public server exports must not import
+ * `@sveltejs/kit` (framework boundary law); consuming apps map this to their
+ * framework's error type at their own module boundary.
+ */
+export class InternalServiceTokenError extends CapabilityError {
+    status;
+    constructor(status, message) {
+        super(message, status === 401 ? 'AUTH_REQUIRED' : 'UNAVAILABLE', status === 401
+            ? { reason: 'internal-service-token-mismatch' }
+            : { reason: 'internal-service-token-unset', retryable: false });
+        this.status = status;
+        this.name = 'InternalServiceTokenError';
+    }
+}
+export const INTERNAL_SERVICE_TOKEN_ENV = 'VIBES_INTERNAL_SERVICE_TOKEN';
+/** Extract the Bearer credential from an Authorization header ('' when absent). */
+export function extractInternalServiceBearer(authHeader) {
+    const match = authHeader?.match(/^Bearer\s+(.+)$/i);
+    return (match ? match[1] : '').trim();
+}
+/**
+ * Resolve on the handed runtime. Only an absent credential becomes ''.
+ */
+export async function resolveInternalServiceToken(runtime) {
+    const result = await runtime.resolveCredential({ source: 'secret', key: INTERNAL_SERVICE_TOKEN_ENV });
+    if (!result.ok) {
+        if (result.error.reason === 'credential-not-set')
+            return '';
+        throw result.error;
+    }
+    const token = result.value.trim();
+    if (!token)
+        throw new CapabilityError('The internal service credential is blank.', 'INVALID_INPUT', {
+            reason: 'internal-service-token-invalid', retryable: false
+        });
+    return token;
+}
+/** Constant-time match with the fail-closed empty-expected guard baked in. */
+export function matchesInternalServiceToken(provided, expected) {
+    return Boolean(expected) && constantTimeEqual(provided, expected);
+}
+/**
+ * Returns false when unconfigured or on mismatch; credential failures propagate.
+ */
+export async function isInternalServiceBearerValid(runtime, authHeader) {
+    const expected = await resolveInternalServiceToken(runtime);
+    return matchesInternalServiceToken(extractInternalServiceBearer(authHeader), expected);
+}
+/**
+ * Pure comparison against a token already resolved by the owning runtime.
+ */
+export function isInternalServiceBearerValidSync(authHeader, expected) {
+    return matchesInternalServiceToken(extractInternalServiceBearer(authHeader), expected);
+}
+/**
+ * Require a valid `Authorization: Bearer <VIBES_INTERNAL_SERVICE_TOKEN>`
+ * header. Throws 500 when the token is unconfigured, 401 when it doesn't
+ * match. Returns the resolved token so callers can forward it to downstream
+ * internal service clients (e.g. the account source-policy client).
+ */
+export async function requireInternalServiceToken(runtime, request) {
+    const configured = await resolveInternalServiceToken(runtime);
+    if (!configured) {
+        throw new InternalServiceTokenError(500, `${INTERNAL_SERVICE_TOKEN_ENV} is not configured`);
+    }
+    const provided = extractInternalServiceBearer(request.headers.get('authorization'));
+    if (!constantTimeEqual(provided, configured))
+        throw new InternalServiceTokenError(401, 'Unauthorized');
+    return configured;
+}
+/**
+ * Pure throwing variant after explicit credential resolution by the caller.
+ */
+export function requireInternalServiceTokenSync(request, configured) {
+    if (isInternalServiceBearerValidSync(request.headers.get('authorization'), configured))
+        return;
+    throw new InternalServiceTokenError(configured ? 401 : 500, configured ? 'Unauthorized' : `${INTERNAL_SERVICE_TOKEN_ENV} is not configured`);
+}
+//# sourceMappingURL=internal-service-token.js.map

package/dist/server/internal-service-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-service-token.js","sourceRoot":"","sources":["../../src/server/internal-service-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IAE5C;IADjB,YACiB,MAAiB,EACjC,OAAe;QAEf,KAAK,CACJ,OAAO,EACP,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,EAChD,MAAM,KAAK,GAAG;YACb,CAAC,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE;YAC/C,CAAC,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,CAC/D,CAAC;QATc,WAAM,GAAN,MAAM,CAAW;QAUjC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IACzC,CAAC;CACD;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;AAEzE,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,UAAyB;IACrE,MAAM,KAAK,GAAG,UAAU,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAA8C;IAC/F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,oBAAoB;YAAE,OAAO,EAAE,CAAC;QAC5D,MAAM,MAAM,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE,eAAe,EAAE;YACnG,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,KAAK;SAC1D,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,2BAA2B,CAAC,QAAgB,EAAE,QAAgB;IAC7E,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAA8C,EAAE,UAAyB;IAC3H,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,2BAA2B,CAAC,4BAA4B,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAAC,UAAyB,EAAE,QAAgB;IAC3F,OAAO,2BAA2B,CAAC,4BAA4B,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAA8C,EAAE,OAAgB;IACjH,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAyB,CAAC,GAAG,EAAE,GAAG,0BAA0B,oBAAoB,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvG,OAAO,UAAU,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAgB,EAAE,UAAkB;IACnF,IAAI,gCAAgC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC;QAAE,OAAO;IAC/F,MAAM,IAAI,yBAAyB,CAClC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EACtB,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,0BAA0B,oBAAoB,CAC/E,CAAC;AACH,CAAC"}

package/dist/server/resolve-participants.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Batched cross-app participant identity resolver (canonical lift).
+ *
+ * Apps that display rows referencing people by an OPAQUE participant id
+ * (project members, tracking rows: issues, PRs, comments, reviews) use this
+ * helper to turn a set of those ids into display identities via the ONE
+ * batched account-web endpoint `POST /api/internal/users` under the shared
+ * internal service token — NOT the viewer-scoped single-profile route
+ * (`/api/account/profile/[userId]`), which runs friendship sub-queries per id
+ * and would force an N+1.
+ *
+ * Reuse contracts (held by the app copies this replaces — app-web
+ * `src/server/resolve-participants.ts`, platform-web
+ * `src/lib/repositories/server/participants.ts`, chat-web
+ * `src/lib/server/resolve-participants.ts`):
+ *   - The endpoint returns `{ id, name, handle, avatarUrl }` per resolved id
+ *     (unknown ids are simply absent), keyed off the canonical `users` table.
+ *   - The bearer is resolved via `runtime.resolveCredential({source:'secret',key:'VIBES_INTERNAL_SERVICE_TOKEN'})`.
+ *   - Never throws — a missing token / unreachable hub / non-2xx logs a
+ *     SCREAMING_SNAKE code and leaves the id unresolved so callers fall back
+ *     to the raw id rather than 500ing a page load.
+ *
+ * Resolution is memoised per context object (a `WeakMap`), so a load that
+ * resolves the same ids across several surfaces only round-trips account-web
+ * once per request. The id set is de-duped and chunked to the endpoint's
+ * batch cap before sending.
+ *
+ * This module is intentionally server-only: it reads runtime env and performs
+ * the cross-app fetch. The context is the structural `{ fetch }` subset of a
+ * SvelteKit `RequestEvent`/`ServerLoadEvent`, so it can be called from either.
+ */
+import { type RuntimeRef, type ValueFreeFailure } from '@vibesdotdev/kernel';
+import { type AccountResolvedUser } from '../api/account.api-client.schemas.ts';
+/** The minimal display identity returned per resolved participant id. */
+export type ResolvedParticipant = AccountResolvedUser;
+/** Structural subset of a SvelteKit load/request event this helper needs —
+ * satisfied by both `RequestEvent` (`+server.ts`/actions) and
+ * `ServerLoadEvent` (`+page.server.ts` load), so it can be called from either. */
+export interface ParticipantResolutionContext {
+    fetch: typeof globalThis.fetch;
+}
+/** What the fail-soft paths log: a stable code, the id count, and a value-free failure. */
+export type ParticipantResolutionLogContext = {
+    code: 'PARTICIPANTS_TOKEN_MISSING' | 'PARTICIPANTS_RESOLVE_FAILED';
+    requested: number;
+    error?: ValueFreeFailure;
+};
+export interface ResolveParticipantsOptions {
+    /** Canonical account-web origin (serves the internal identity resolver). */
+    accountOrigin: string | (() => string);
+    /** Logger for the fail-soft error paths; defaults to `account.participants`. */
+    logger?: {
+        error: (message: string, context: ParticipantResolutionLogContext) => void;
+    };
+    /** Label included in log messages, e.g. `'app.server'`. */
+    logLabel?: string;
+    /**
+     * Abort budget per chunk (ms). A slow identity hub degrades to the
+     * raw-id fallback rather than stalling the caller's page load.
+     */
+    timeoutMs?: number;
+    /**
+     * Fire chunks concurrently instead of serially, so a caller resolving
+     * many rooms' worth of ids doesn't stack round-trips. Error semantics
+     * are identical either way (fail-soft per chunk).
+     */
+    parallel?: boolean;
+}
+/**
+ * Resolve a set of opaque participant ids to display identities, batched
+ * against account-web `POST /api/internal/users` under the internal service
+ * token.
+ *
+ * - De-dupes + drops blank ids before sending.
+ * - Memoised per context object: already-resolved ids are served from the
+ *   cache and only the unseen remainder is fetched (chunked to the endpoint's
+ *   `ACCOUNT_RESOLVE_USERS_MAX_IDS` cap).
+ * - Never throws: a missing token, an unreachable account hub, or a non-2xx
+ *   response logs (SCREAMING_SNAKE code) and leaves the unseen ids
+ *   unresolved, so callers fall back to the raw id rather than 500ing.
+ *
+ * @returns a `Map<id, ResolvedParticipant>` covering every id that resolved
+ * to a known user. Ids with no matching user are simply absent from the map.
+ */
+export declare function resolveParticipants(runtime: RuntimeRef, context: ParticipantResolutionContext, ids: readonly (string | null | undefined)[], options: ResolveParticipantsOptions): Promise<Map<string, ResolvedParticipant>>;
+//# sourceMappingURL=resolve-participants.d.ts.map

package/dist/server/resolve-participants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-participants.d.ts","sourceRoot":"","sources":["../../src/server/resolve-participants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAyC,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEpH,OAAO,EAEN,KAAK,mBAAmB,EACxB,MAAM,sCAAsC,CAAC;AAG9C,yEAAyE;AACzE,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD;;kFAEkF;AAClF,MAAM,WAAW,4BAA4B;IAC5C,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAED,2FAA2F;AAC3F,MAAM,MAAM,+BAA+B,GAAG;IAC7C,IAAI,EAAE,4BAA4B,GAAG,6BAA6B,CAAC;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEF,MAAM,WAAW,0BAA0B;IAC1C,4EAA4E;IAC5E,aAAa,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACvC,gFAAgF;IAChF,MAAM,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,+BAA+B,KAAK,IAAI,CAAC;KAC3E,CAAC;IACF,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAqBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,4BAA4B,EACrC,GAAG,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,EAC3C,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAqG3C"}

package/dist/server/resolve-participants.js

@@ -0,0 +1,150 @@
+/**
+ * Batched cross-app participant identity resolver (canonical lift).
+ *
+ * Apps that display rows referencing people by an OPAQUE participant id
+ * (project members, tracking rows: issues, PRs, comments, reviews) use this
+ * helper to turn a set of those ids into display identities via the ONE
+ * batched account-web endpoint `POST /api/internal/users` under the shared
+ * internal service token — NOT the viewer-scoped single-profile route
+ * (`/api/account/profile/[userId]`), which runs friendship sub-queries per id
+ * and would force an N+1.
+ *
+ * Reuse contracts (held by the app copies this replaces — app-web
+ * `src/server/resolve-participants.ts`, platform-web
+ * `src/lib/repositories/server/participants.ts`, chat-web
+ * `src/lib/server/resolve-participants.ts`):
+ *   - The endpoint returns `{ id, name, handle, avatarUrl }` per resolved id
+ *     (unknown ids are simply absent), keyed off the canonical `users` table.
+ *   - The bearer is resolved via `runtime.resolveCredential({source:'secret',key:'VIBES_INTERNAL_SERVICE_TOKEN'})`.
+ *   - Never throws — a missing token / unreachable hub / non-2xx logs a
+ *     SCREAMING_SNAKE code and leaves the id unresolved so callers fall back
+ *     to the raw id rather than 500ing a page load.
+ *
+ * Resolution is memoised per context object (a `WeakMap`), so a load that
+ * resolves the same ids across several surfaces only round-trips account-web
+ * once per request. The id set is de-duped and chunked to the endpoint's
+ * batch cap before sending.
+ *
+ * This module is intentionally server-only: it reads runtime env and performs
+ * the cross-app fetch. The context is the structural `{ fetch }` subset of a
+ * SvelteKit `RequestEvent`/`ServerLoadEvent`, so it can be called from either.
+ */
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { ACCOUNT_RESOLVE_USERS_MAX_IDS } from "../api/account.api-client.schemas.js";
+import { resolveAccountUsers } from "./resolve-users.js";
+/** Per-context memo: one resolution map per context object, never leaked across requests. */
+const memo = new WeakMap();
+async function settleRead(read) {
+    try {
+        return { ok: true, value: await read() };
+    }
+    catch (failure) {
+        return { ok: false, failure };
+    }
+}
+/** Whether the origin option is the lazy form. */
+function isOriginThunk(origin) {
+    return typeof origin === 'function';
+}
+/**
+ * Resolve a set of opaque participant ids to display identities, batched
+ * against account-web `POST /api/internal/users` under the internal service
+ * token.
+ *
+ * - De-dupes + drops blank ids before sending.
+ * - Memoised per context object: already-resolved ids are served from the
+ *   cache and only the unseen remainder is fetched (chunked to the endpoint's
+ *   `ACCOUNT_RESOLVE_USERS_MAX_IDS` cap).
+ * - Never throws: a missing token, an unreachable account hub, or a non-2xx
+ *   response logs (SCREAMING_SNAKE code) and leaves the unseen ids
+ *   unresolved, so callers fall back to the raw id rather than 500ing.
+ *
+ * @returns a `Map<id, ResolvedParticipant>` covering every id that resolved
+ * to a known user. Ids with no matching user are simply absent from the map.
+ */
+export async function resolveParticipants(runtime, context, ids, options) {
+    const logger = options.logger ?? getLogger('account.participants', runtime);
+    const label = options.logLabel ?? 'account.participants';
+    let cache = memo.get(context);
+    if (!cache) {
+        cache = new Map();
+        memo.set(context, cache);
+    }
+    // De-dupe + drop empties so a caller passing repeated/blank ids doesn't
+    // inflate the batch. Only fetch ids not already resolved this request.
+    const unseen = Array.from(new Set(ids
+        .filter((id) => typeof id === 'string')
+        .map((id) => id.trim())
+        .filter((id) => id.length > 0)
+        .filter((id) => !cache.has(id))));
+    if (unseen.length === 0)
+        return cache;
+    const tokenResult = await runtime.resolveCredential({
+        source: 'secret',
+        key: 'VIBES_INTERNAL_SERVICE_TOKEN'
+    });
+    if (!tokenResult.ok) {
+        logger.error(`PARTICIPANTS_TOKEN_MISSING [${label}]`, {
+            code: 'PARTICIPANTS_TOKEN_MISSING',
+            requested: unseen.length,
+            error: valueFreeFailure(CaughtFailureSchema.parse(tokenResult.error))
+        });
+        return cache;
+    }
+    const token = tokenResult.value?.trim();
+    if (!token) {
+        logger.error(`PARTICIPANTS_TOKEN_MISSING [${label}]`, {
+            code: 'PARTICIPANTS_TOKEN_MISSING',
+            requested: unseen.length
+        });
+        return cache;
+    }
+    const origin = (isOriginThunk(options.accountOrigin) ? options.accountOrigin() : options.accountOrigin)
+        ?.replace(/\/+$/, '') ?? '';
+    const chunks = [];
+    for (let i = 0; i < unseen.length; i += ACCOUNT_RESOLVE_USERS_MAX_IDS) {
+        chunks.push(unseen.slice(i, i + ACCOUNT_RESOLVE_USERS_MAX_IDS));
+    }
+    const fetchChunk = (chunk) => {
+        const timeoutMs = options.timeoutMs;
+        if (!timeoutMs) {
+            return resolveAccountUsers({ origin, token, ids: chunk, fetch: context.fetch });
+        }
+        return runtime.lifecycle.wait((signal) => resolveAccountUsers({
+            origin,
+            token,
+            ids: chunk,
+            fetch: (input, init) => context.fetch(input, { ...init, signal })
+        }), { timeoutMs, reason: 'account participant resolution' });
+    };
+    const resolveChunk = async (chunk) => {
+        const settled = await settleRead(() => fetchChunk(chunk));
+        if (!settled.ok) {
+            // Declared fail-soft: the chunk stays unresolved and callers show the raw id.
+            logger.error(`PARTICIPANTS_RESOLVE_FAILED [${label}]`, {
+                code: 'PARTICIPANTS_RESOLVE_FAILED',
+                requested: chunk.length,
+                error: valueFreeFailure(CaughtFailureSchema.parse(settled.failure))
+            });
+            return;
+        }
+        for (const u of settled.value) {
+            cache.set(u.id, {
+                id: u.id,
+                name: u.name ?? null,
+                handle: u.handle ?? null,
+                avatarUrl: u.avatarUrl ?? null
+            });
+        }
+    };
+    if (options.parallel) {
+        await Promise.all(chunks.map(resolveChunk));
+    }
+    else {
+        for (const chunk of chunks)
+            await resolveChunk(chunk);
+    }
+    return cache;
+}
+//# sourceMappingURL=resolve-participants.js.map

package/dist/server/resolve-participants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-participants.js","sourceRoot":"","sources":["../../src/server/resolve-participants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAA0C,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EACN,6BAA6B,EAE7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAyCzD,6FAA6F;AAC7F,MAAM,IAAI,GAAG,IAAI,OAAO,EAA4C,CAAC;AAKrE,KAAK,UAAU,UAAU,CAAI,IAAsB;IAClD,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;AACF,CAAC;AAED,kDAAkD;AAClD,SAAS,aAAa,CAAC,MAA+B;IACrD,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAmB,EACnB,OAAqC,EACrC,GAA2C,EAC3C,OAAmC;IAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IAEzD,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CACxB,IAAI,GAAG,CACN,GAAG;SACD,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;SACpD,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;SACtB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SAC7B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CACjC,CACD,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC;QACnD,MAAM,EAAE,QAAQ;QAChB,GAAG,EAAE,8BAA8B;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,GAAG,EAAE;YACrD,IAAI,EAAE,4BAA4B;YAClC,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;SACrE,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,GAAG,EAAE;YACrD,IAAI,EAAE,4BAA4B;YAClC,SAAS,EAAE,MAAM,CAAC,MAAM;SACxB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GACX,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QACvF,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,6BAA6B,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,6BAA6B,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,KAAe,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAC5B,CAAC,MAAM,EAAE,EAAE,CACV,mBAAmB,CAAC;YACnB,MAAM;YACN,KAAK;YACL,GAAG,EAAE,KAAK;YACV,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC;SACjE,CAAC,EACH,EAAE,SAAS,EAAE,MAAM,EAAE,gCAAgC,EAAE,CACvD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,KAAe,EAAiB,EAAE;QAC7D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,8EAA8E;YAC9E,MAAM,CAAC,KAAK,CAAC,gCAAgC,KAAK,GAAG,EAAE;gBACtD,IAAI,EAAE,6BAA6B;gBACnC,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACf,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;gBACxB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;aAC9B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/server/resolve-users.d.ts

@@ -0,0 +1,10 @@
+import { type AccountResolvedUser } from '../api/account.api-client.schemas.ts';
+export interface ResolveAccountUsersOptions {
+    origin: string;
+    token: string;
+    ids: readonly string[];
+    fetch: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+}
+/** Request-scoped internal-service identity client with canonical wire validation. */
+export declare function resolveAccountUsers(options: ResolveAccountUsersOptions): Promise<AccountResolvedUser[]>;
+//# sourceMappingURL=resolve-users.d.ts.map

package/dist/server/resolve-users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-users.d.ts","sourceRoot":"","sources":["../../src/server/resolve-users.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,mBAAmB,EACxB,MAAM,sCAAsC,CAAC;AAE9C,MAAM,WAAW,0BAA0B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC3E;AAED,sFAAsF;AACtF,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAkBhC"}

package/dist/server/resolve-users.js

@@ -0,0 +1,20 @@
+import { accountResolveUsersRequestSchema, accountResolveUsersResponseSchema } from "../api/account.api-client.schemas.js";
+/** Request-scoped internal-service identity client with canonical wire validation. */
+export async function resolveAccountUsers(options) {
+    const request = accountResolveUsersRequestSchema.parse({ ids: options.ids });
+    if (request.ids.length === 0)
+        return [];
+    const response = await options.fetch(`${options.origin.replace(/\/+$/, '')}/api/internal/users`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            authorization: `Bearer ${options.token}`
+        },
+        body: JSON.stringify(request)
+    });
+    if (!response.ok) {
+        throw new Error(`Account participant resolution failed with HTTP ${response.status}`);
+    }
+    return accountResolveUsersResponseSchema.parse(await response.json()).users;
+}
+//# sourceMappingURL=resolve-users.js.map

package/dist/server/resolve-users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-users.js","sourceRoot":"","sources":["../../src/server/resolve-users.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,gCAAgC,EAChC,iCAAiC,EAEjC,MAAM,sCAAsC,CAAC;AAS9C,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAmC;IAEnC,MAAM,OAAO,GAAG,gCAAgC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CACnC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,EAC1D;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC7B,CACD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,iCAAiC,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC"}

package/dist/server/validate-org-membership.d.ts

@@ -0,0 +1,24 @@
+import { type AccountOrgMembershipRole } from '../api/account.api-client.schemas.ts';
+export interface ValidateOrgMembershipOptions {
+    origin: string;
+    token: string;
+    userId: string;
+    organizationId: string;
+    fetch: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+}
+export interface ActiveOrgMembership {
+    organizationId: string;
+    userId: string;
+    role: AccountOrgMembershipRole;
+}
+/**
+ * Live org-membership validation against account-web's canonical DB.
+ *
+ * JWT `orgs` claims are a cache minted at token time; a revoked membership
+ * keeps working until the token expires. Mutating boundaries that authorize
+ * through org membership must call this instead of trusting claim-presence.
+ * Throws on transport/wire failure so callers fail CLOSED (503, never a
+ * silent allow); a resolved `null` means "not a member" — deny as revoked.
+ */
+export declare function validateActiveOrgMembership(options: ValidateOrgMembershipOptions): Promise<ActiveOrgMembership | null>;
+//# sourceMappingURL=validate-org-membership.d.ts.map

package/dist/server/validate-org-membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-org-membership.d.ts","sourceRoot":"","sources":["../../src/server/validate-org-membership.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,wBAAwB,EAC7B,MAAM,sCAAsC,CAAC;AAE9C,MAAM,WAAW,4BAA4B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,mBAAmB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,wBAAwB,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,4BAA4B,GACnC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAqBrC"}