ddd-ts-kit 0.14.0 → 0.16.0

package/templates/init/rules/domain.md.tpl

@@ -10,7 +10,7 @@ paths:
 - Names come from the glossary of `CONTEXT.md`, written first (`language/glossary-term`); no `Manager`, `Helper`, `Data`, `Info`, `Model` (`language/no-technical-name`).
 - Aggregate: private constructor, `create` for birth, `rehydrate` for loading, state changed by methods named after the business intention, no setter, no public mutable property (`domain/aggregate-encapsulation`). One aggregate per transaction; another one is referenced by its id.
 - A status that moves through a lifecycle is declared once as a state machine, `state-machines/<aggregate>.state-machine.ts` (`generate state-machine <context> <Aggregate> --value .. --transition ..`): the aggregate writes its status only from `machine.next(..)` or `machine.start(..)` (`lifecycle/status-through-machine`), and a forbidden transition is refused by a static factory of its error class (`refused`).
-- Value objects are immutable, validated in `create`, compared with `equals` (`domain/value-object-immutability`). An email, an amount, a period are types, not strings.
+- A value object is a class extending `ValueObject` of the kernel, one per `value-objects/*.vo.ts` (`npx ddd-ts-kit generate value-object <context> <Name>`): a private constructor, static factories that check its rules (`create`, or named after what they build: `of`, `between`), its operations as methods that return a new instance. It is immutable and compared with `equals` (`domain/value-object-immutability`). An email, an amount, a period are types, not strings.{{#if values.classes}} A value is never a function that builds a plain object, nor an exported object literal (`domain/value-object-class`): the class compares by value, checks its invariants once and is recognised with `instanceof` by a mapper. A function of `domain/` or of the shared kernel that answers a record of data, `({ amount, currency })`, is reported; one that answers value objects it builds (`Money.of(..)`), derives a record with a spread, or answers functions (a specification) is not, and a decision is a refusal thrown by a factory or a value object.{{/if}}
 {{#if literals.named}}
 - A closed list of values (a status, a kind, a role of the model) is a vocabulary, `npx ddd-ts-kit generate vocabulary <context> <Name> --value <value>...`: code reads `AppointmentStatus.NoShow`, never the string (`language/declared-vocabulary`).
 - No number without a name: 0, 1, -1 and an index only; a duration, a limit or a rate is a constant of the module (`const MINUTES_PER_HOUR = 60;`) or a value object (`clean/no-magic-number`).

package/templates/pipeline/package-scripts.json

@@ -23,7 +23,7 @@
     "@biomejs/biome": "2.5.15",
     "@commitlint/cli": "^21.2.3",
     "@commitlint/config-conventional": "^21.2.3",
-    "@ddd-ts-kit/eslint-plugin": "^0.14.0",
+    "@ddd-ts-kit/eslint-plugin": "^0.16.0",
     "@eslint/js": "^10.0.1",
     "@typescript/native": "npm:typescript@~7.0.2",
     "@vitest/coverage-v8": "5.0.3",

package/templates/presets/identity/context/application/authorization/__context__.permissions.ts.tpl

@@ -0,0 +1,23 @@
+import { definePermissions } from '@ddd-ts-kit/auth';
+
+/**
+ * What a use case of {{context.kebab}} requires. The platform grants them to every signed-in person;
+ * inside an organisation, the policies of this context then decide from the rights of the actor's
+ * role and of the delegations lent to them.
+ */
+export const {{context.camel}}Permissions = definePermissions('{{context.kebab}}', {
+  // ddd-ts-kit:permissions
+  'account.provision': { description: 'Provision or refresh the account of the person who signs in' },
+  'account.deactivate': { description: 'Deactivate the account of the person who asks' },
+  'organisation.open': { description: 'Open an organisation and become its first owner' },
+  'member.invite': { description: 'Invite a person to an organisation, in a role' },
+  'invitation.accept': { description: 'Accept an invitation addressed to oneself' },
+  'invitation.decline': { description: 'Decline an invitation addressed to oneself' },
+  'invitation.revoke': { description: 'Take back an invitation of an organisation' },
+  'member.change-role': { description: 'Change the role of a member of an organisation' },
+  'member.remove': { description: 'Remove a member from an organisation' },
+  'member.search': { description: 'Search the members of an organisation' },
+  'delegation.grant': { description: 'Lend some of the rights of a role to another member, for a period' },
+  'delegation.revoke': { description: 'Revoke a delegation of an organisation' },
+  // /ddd-ts-kit:permissions
+});

package/templates/presets/identity/context/application/authorization/change-member-roles.policy.ts.tpl

@@ -0,0 +1,17 @@
+import { isAuthenticated, type Actor } from '@ddd-ts-kit/kernel';
+import { Policy } from '@ddd-ts-kit/kernel/declarations';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** An account changes the roles of an organisation where it manages the members. */
+@Policy({{context.camel}}Permissions['member.change-role'], { name: '{{context.kebab}}.change-member-roles' })
+export class ChangeMemberRolesPolicy {
+  appliesTo(subject: unknown): subject is OrganisationRights {
+    return subject instanceof OrganisationRights;
+  }
+
+  allows(actor: Actor, rights: OrganisationRights): boolean {
+    return isAuthenticated(actor) && rights.accountId === actor.id && rights.includes(MemberRight.ManageMembers);
+  }
+}

package/templates/presets/identity/context/application/authorization/grant-delegations.policy.ts.tpl

@@ -0,0 +1,17 @@
+import { isAuthenticated, type Actor } from '@ddd-ts-kit/kernel';
+import { Policy } from '@ddd-ts-kit/kernel/declarations';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** An account lends rights in an organisation where its role lets it delegate. */
+@Policy({{context.camel}}Permissions['delegation.grant'], { name: '{{context.kebab}}.grant-delegations' })
+export class GrantDelegationsPolicy {
+  appliesTo(subject: unknown): subject is OrganisationRights {
+    return subject instanceof OrganisationRights;
+  }
+
+  allows(actor: Actor, rights: OrganisationRights): boolean {
+    return isAuthenticated(actor) && rights.accountId === actor.id && rights.includes(MemberRight.GrantDelegations);
+  }
+}

package/templates/presets/identity/context/application/authorization/invite-members.policy.ts.tpl

@@ -0,0 +1,17 @@
+import { isAuthenticated, type Actor } from '@ddd-ts-kit/kernel';
+import { Policy } from '@ddd-ts-kit/kernel/declarations';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** An account invites to an organisation when its role, or a delegation, lets it invite there. */
+@Policy({{context.camel}}Permissions['member.invite'], { name: '{{context.kebab}}.invite-members' })
+export class InviteMembersPolicy {
+  appliesTo(subject: unknown): subject is OrganisationRights {
+    return subject instanceof OrganisationRights;
+  }
+
+  allows(actor: Actor, rights: OrganisationRights): boolean {
+    return isAuthenticated(actor) && rights.accountId === actor.id && rights.includes(MemberRight.InviteMembers);
+  }
+}

package/templates/presets/identity/context/application/authorization/read-members.policy.ts.tpl

@@ -0,0 +1,17 @@
+import { isAuthenticated, type Actor } from '@ddd-ts-kit/kernel';
+import { Policy } from '@ddd-ts-kit/kernel/declarations';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** An account searches the members of an organisation it belongs to. */
+@Policy({{context.camel}}Permissions['member.search'], { name: '{{context.kebab}}.read-members' })
+export class ReadMembersPolicy {
+  appliesTo(subject: unknown): subject is OrganisationRights {
+    return subject instanceof OrganisationRights;
+  }
+
+  allows(actor: Actor, rights: OrganisationRights): boolean {
+    return isAuthenticated(actor) && rights.accountId === actor.id && rights.includes(MemberRight.ReadMembers);
+  }
+}

package/templates/presets/identity/context/application/authorization/remove-members.policy.ts.tpl

@@ -0,0 +1,17 @@
+import { isAuthenticated, type Actor } from '@ddd-ts-kit/kernel';
+import { Policy } from '@ddd-ts-kit/kernel/declarations';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** An account removes members of an organisation where it manages the members. */
+@Policy({{context.camel}}Permissions['member.remove'], { name: '{{context.kebab}}.remove-members' })
+export class RemoveMembersPolicy {
+  appliesTo(subject: unknown): subject is OrganisationRights {
+    return subject instanceof OrganisationRights;
+  }
+
+  allows(actor: Actor, rights: OrganisationRights): boolean {
+    return isAuthenticated(actor) && rights.accountId === actor.id && rights.includes(MemberRight.ManageMembers);
+  }
+}

package/templates/presets/identity/context/application/authorization/revoke-delegations.policy.ts.tpl

@@ -0,0 +1,17 @@
+import { isAuthenticated, type Actor } from '@ddd-ts-kit/kernel';
+import { Policy } from '@ddd-ts-kit/kernel/declarations';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** An account revokes the delegations of an organisation where its role lets it delegate. */
+@Policy({{context.camel}}Permissions['delegation.revoke'], { name: '{{context.kebab}}.revoke-delegations' })
+export class RevokeDelegationsPolicy {
+  appliesTo(subject: unknown): subject is OrganisationRights {
+    return subject instanceof OrganisationRights;
+  }
+
+  allows(actor: Actor, rights: OrganisationRights): boolean {
+    return isAuthenticated(actor) && rights.accountId === actor.id && rights.includes(MemberRight.GrantDelegations);
+  }
+}

package/templates/presets/identity/context/application/authorization/revoke-invitations.policy.ts.tpl

@@ -0,0 +1,17 @@
+import { isAuthenticated, type Actor } from '@ddd-ts-kit/kernel';
+import { Policy } from '@ddd-ts-kit/kernel/declarations';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** An account takes back the invitations of an organisation where it may invite. */
+@Policy({{context.camel}}Permissions['invitation.revoke'], { name: '{{context.kebab}}.revoke-invitations' })
+export class RevokeInvitationsPolicy {
+  appliesTo(subject: unknown): subject is OrganisationRights {
+    return subject instanceof OrganisationRights;
+  }
+
+  allows(actor: Actor, rights: OrganisationRights): boolean {
+    return isAuthenticated(actor) && rights.accountId === actor.id && rights.includes(MemberRight.InviteMembers);
+  }
+}

package/templates/presets/identity/context/application/commands/accept-invitation/accept-invitation.command.ts.tpl

@@ -0,0 +1,14 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** Accepts the invitation of this token, addressed to the actor: the actor becomes a member. */
+@Requires({{context.camel}}Permissions['invitation.accept'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class AcceptInvitationCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly token: string,
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/accept-invitation/accept-invitation.handler.ts.tpl

@@ -0,0 +1,56 @@
+import type { Clock, IdGenerator } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import { AccountError } from '{{alias.context}}/domain/errors/account.error{{alias.ext}}';
+import { InvitationError } from '{{alias.context}}/domain/errors/invitation.error{{alias.ext}}';
+import { MemberError } from '{{alias.context}}/domain/errors/member.error{{alias.ext}}';
+import type { AccountRepository } from '{{alias.context}}/domain/repositories/account.repository{{alias.ext}}';
+import type { InvitationRepository } from '{{alias.context}}/domain/repositories/invitation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { AcceptInvitationCommand } from '{{alias.context}}/application/commands/accept-invitation/accept-invitation.command{{alias.ext}}';
+import type { InvitationTokens } from '{{alias.context}}/application/ports/invitation-tokens.port{{alias.ext}}';
+
+@CommandHandler(AcceptInvitationCommand)
+export class AcceptInvitationHandler implements CommandHandler<AcceptInvitationCommand> {
+  constructor(
+    private readonly invitationRepository: InvitationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly accountRepository: AccountRepository,
+    private readonly tokens: InvitationTokens,
+    private readonly ids: IdGenerator,
+    private readonly clock: Clock,
+  ) {}
+
+  /** The person the invitation was sent to, signed in, answers with its token: they join in the role it names. */
+  async execute({ actor, token }: AcceptInvitationCommand): Promise<string> {
+    const invitation = await this.invitationRepository.findByTokenHash(this.tokens.digestOf(token));
+    const account = await this.accountRepository.findById(actor.id);
+
+    if (invitation === undefined) {
+      throw InvitationError.notFound();
+    }
+
+    if (account === undefined) {
+      throw AccountError.notFound(actor.id);
+    }
+
+    account.assertActive();
+
+    const now = this.clock.now();
+    const { organisationId, role } = invitation;
+
+    invitation.accept(account, now);
+
+    if ((await this.memberRepository.findOf(organisationId, account.id)) !== undefined) {
+      throw MemberError.alreadyMember(organisationId, account.id);
+    }
+
+    await this.invitationRepository.save(invitation);
+
+    await this.memberRepository.save(
+      Member.join(this.ids.next(), { organisationId, accountId: account.id, role }, now),
+    );
+
+    return invitation.id;
+  }
+}

package/templates/presets/identity/context/application/commands/change-member-role/change-member-role.command.ts.tpl

@@ -0,0 +1,17 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import type { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+
+/** Changes the role of a member of an organisation. */
+@Requires({{context.camel}}Permissions['member.change-role'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class ChangeMemberRoleCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly accountId: string,
+    readonly role: MemberRole,
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/change-member-role/change-member-role.handler.ts.tpl

@@ -0,0 +1,82 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import type { Organisation } from '{{alias.context}}/domain/aggregates/organisation.aggregate{{alias.ext}}';
+import { MemberError } from '{{alias.context}}/domain/errors/member.error{{alias.ext}}';
+import { OrganisationError } from '{{alias.context}}/domain/errors/organisation.error{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import type { OrganisationRepository } from '{{alias.context}}/domain/repositories/organisation.repository{{alias.ext}}';
+import { RoleRightsService, type HeldRights } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { ChangeMemberRoleCommand } from '{{alias.context}}/application/commands/change-member-role/change-member-role.command{{alias.ext}}';
+
+@CommandHandler(ChangeMemberRoleCommand)
+export class ChangeMemberRoleHandler implements CommandHandler<ChangeMemberRoleCommand> {
+  constructor(
+    private readonly organisationRepository: OrganisationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly delegationRepository: DelegationRepository,
+    private readonly access: Access,
+    private readonly clock: Clock,
+  ) {}
+
+  /**
+   * Within the role of who decides, never on their own role. The organisation is saved with the
+   * change, unchanged, so that its version orders the changes of its owners: two owners who
+   * demote each other at once cannot both commit and leave it without one. The delegations the
+   * member gave end with the role they were granted under: what they lent may no longer be theirs.
+   */
+  async execute({ actor, organisationId, accountId, role }: ChangeMemberRoleCommand): Promise<string> {
+    const now = this.clock.now();
+    const held = await this.heldBy(organisationId, actor.id, now);
+    const rights = new RoleRightsService();
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['member.change-role'], rights.rightsIn(organisationId, actor.id, held));
+
+    const { organisation, member } = await this.membershipIn(organisationId, accountId);
+    const delegationId = rights.delegationUsedFor(MemberRight.ManageMembers, held);
+    const owners = await this.memberRepository.countOwners(organisationId);
+
+    member.changeRole(role, { by: held.member?.role ?? MemberRole.Member, byAccount: actor.id, delegationId, owners }, now);
+    await this.organisationRepository.save(organisation);
+    await this.memberRepository.save(member);
+    await this.endDelegationsGivenBy(organisationId, accountId, now);
+
+    return member.id;
+  }
+
+  private async heldBy(organisationId: string, accountId: string, now: Date): Promise<HeldRights> {
+    const member = await this.memberRepository.findOf(organisationId, accountId);
+
+    return { member, lent: await this.delegationRepository.findUnendedTo(organisationId, accountId), now };
+  }
+
+  /** The organisation, to be saved with the change, and the membership the change is about. */
+  private async membershipIn(organisationId: string, accountId: string): Promise<{ organisation: Organisation; member: Member }> {
+    const organisation = await this.organisationRepository.findById(organisationId);
+    const member = await this.memberRepository.findOf(organisationId, accountId);
+
+    if (organisation === undefined) {
+      throw OrganisationError.notFound(organisationId);
+    }
+
+    if (member === undefined) {
+      throw MemberError.notFound(organisationId, accountId);
+    }
+
+    return { organisation, member };
+  }
+
+  private async endDelegationsGivenBy(organisationId: string, accountId: string, now: Date): Promise<void> {
+    const involving = await this.delegationRepository.findUnendedInvolving(organisationId, accountId);
+
+    for (const delegation of involving.filter((given) => given.delegatorId === accountId)) {
+      delegation.end(now);
+      await this.delegationRepository.save(delegation);
+    }
+  }
+}

package/templates/presets/identity/context/application/commands/deactivate-account/deactivate-account.command.ts.tpl

@@ -0,0 +1,7 @@
+import { AuthorizedCommand } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** Deactivates the account of the person who asks. */
+@Requires({{context.camel}}Permissions['account.deactivate'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class DeactivateAccountCommand extends AuthorizedCommand<string> {}

package/templates/presets/identity/context/application/commands/deactivate-account/deactivate-account.handler.ts.tpl

@@ -0,0 +1,69 @@
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import { AccountError } from '{{alias.context}}/domain/errors/account.error{{alias.ext}}';
+import { OrganisationError } from '{{alias.context}}/domain/errors/organisation.error{{alias.ext}}';
+import type { AccountRepository } from '{{alias.context}}/domain/repositories/account.repository{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import type { OrganisationRepository } from '{{alias.context}}/domain/repositories/organisation.repository{{alias.ext}}';
+import { DeactivateAccountCommand } from '{{alias.context}}/application/commands/deactivate-account/deactivate-account.command{{alias.ext}}';
+
+@CommandHandler(DeactivateAccountCommand)
+export class DeactivateAccountHandler implements CommandHandler<DeactivateAccountCommand> {
+  constructor(
+    private readonly accountRepository: AccountRepository,
+    private readonly organisationRepository: OrganisationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly delegationRepository: DelegationRepository,
+    private readonly clock: Clock,
+  ) {}
+
+  /**
+   * A person deactivates their own account, which leaves every organisation it belongs to and ends
+   * every delegation it gave or received there, in the same unit of work: a deactivated account
+   * holds no right anywhere, whatever its token says until it expires. The last owner of an
+   * organisation is refused: they appoint another owner first. The provider is asked to disable
+   * the person once it is committed (`application/integration/handlers/`).
+   */
+  async execute({ actor }: DeactivateAccountCommand): Promise<string> {
+    const account = await this.accountRepository.findById(actor.id);
+
+    if (account === undefined) {
+      throw AccountError.notFound(actor.id);
+    }
+
+    const now = this.clock.now();
+
+    account.deactivate(now);
+
+    for (const member of await this.memberRepository.searchCurrentOf(account.id)) {
+      await this.leave(member, now);
+    }
+
+    await this.accountRepository.save(account);
+
+    return account.id;
+  }
+
+  /** As a removal: the organisation saved unchanged orders the changes of its owners. */
+  private async leave(member: Member, now: Date): Promise<void> {
+    const { organisationId, accountId } = member;
+    const organisation = await this.organisationRepository.findById(organisationId);
+
+    if (organisation === undefined) {
+      throw OrganisationError.notFound(organisationId);
+    }
+
+    const owners = await this.memberRepository.countOwners(organisationId);
+
+    member.remove({ by: member.role, byAccount: accountId, delegationId: undefined, owners }, now);
+    await this.organisationRepository.save(organisation);
+    await this.memberRepository.save(member);
+
+    for (const delegation of await this.delegationRepository.findUnendedInvolving(organisationId, accountId)) {
+      delegation.end(now);
+      await this.delegationRepository.save(delegation);
+    }
+  }
+}

package/templates/presets/identity/context/application/commands/decline-invitation/decline-invitation.command.ts.tpl

@@ -0,0 +1,14 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** Declines the invitation of this token, addressed to the actor. */
+@Requires({{context.camel}}Permissions['invitation.decline'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class DeclineInvitationCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly token: string,
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/decline-invitation/decline-invitation.handler.ts.tpl

@@ -0,0 +1,36 @@
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { AccountError } from '{{alias.context}}/domain/errors/account.error{{alias.ext}}';
+import { InvitationError } from '{{alias.context}}/domain/errors/invitation.error{{alias.ext}}';
+import type { AccountRepository } from '{{alias.context}}/domain/repositories/account.repository{{alias.ext}}';
+import type { InvitationRepository } from '{{alias.context}}/domain/repositories/invitation.repository{{alias.ext}}';
+import { DeclineInvitationCommand } from '{{alias.context}}/application/commands/decline-invitation/decline-invitation.command{{alias.ext}}';
+import type { InvitationTokens } from '{{alias.context}}/application/ports/invitation-tokens.port{{alias.ext}}';
+
+@CommandHandler(DeclineInvitationCommand)
+export class DeclineInvitationHandler implements CommandHandler<DeclineInvitationCommand> {
+  constructor(
+    private readonly invitationRepository: InvitationRepository,
+    private readonly accountRepository: AccountRepository,
+    private readonly tokens: InvitationTokens,
+    private readonly clock: Clock,
+  ) {}
+
+  async execute({ actor, token }: DeclineInvitationCommand): Promise<string> {
+    const invitation = await this.invitationRepository.findByTokenHash(this.tokens.digestOf(token));
+    const account = await this.accountRepository.findById(actor.id);
+
+    if (invitation === undefined) {
+      throw InvitationError.notFound();
+    }
+
+    if (account === undefined) {
+      throw AccountError.notFound(actor.id);
+    }
+
+    invitation.decline(account, this.clock.now());
+    await this.invitationRepository.save(invitation);
+
+    return invitation.id;
+  }
+}

package/templates/presets/identity/context/application/commands/grant-delegation/grant-delegation.command.ts.tpl

@@ -0,0 +1,21 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import type { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+
+/** Lends some of the rights of the actor in an organisation to another of its members, for a period. */
+@Requires({{context.camel}}Permissions['delegation.grant'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class GrantDelegationCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly terms: {
+      readonly delegateId: string;
+      readonly rights: readonly MemberRight[];
+      readonly startsAt: Date;
+      readonly endsAt: Date;
+    },
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/grant-delegation/grant-delegation.handler.ts.tpl

@@ -0,0 +1,43 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock, IdGenerator } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { Delegation } from '{{alias.context}}/domain/aggregates/delegation.aggregate{{alias.ext}}';
+import { MemberError } from '{{alias.context}}/domain/errors/member.error{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { RoleRightsService } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { DelegationPeriod } from '{{alias.context}}/domain/value-objects/delegation-period.vo{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { GrantDelegationCommand } from '{{alias.context}}/application/commands/grant-delegation/grant-delegation.command{{alias.ext}}';
+
+@CommandHandler(GrantDelegationCommand)
+export class GrantDelegationHandler implements CommandHandler<GrantDelegationCommand> {
+  constructor(
+    private readonly delegationRepository: DelegationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly access: Access,
+    private readonly ids: IdGenerator,
+    private readonly clock: Clock,
+  ) {}
+
+  /** A member lends what their role grants, never what was lent to them, to another member of the organisation. */
+  async execute({ actor, organisationId, terms }: GrantDelegationCommand): Promise<string> {
+    const now = this.clock.now();
+    const delegator = await this.memberRepository.findOf(organisationId, actor.id);
+    const held = new RoleRightsService().rightsIn(organisationId, actor.id, { member: delegator, lent: [], now });
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['delegation.grant'], held);
+
+    if ((await this.memberRepository.findOf(organisationId, terms.delegateId)) === undefined) {
+      throw MemberError.notFound(organisationId, terms.delegateId);
+    }
+
+    const period = DelegationPeriod.create(terms.startsAt, terms.endsAt);
+    const lent = { organisationId, delegatorId: actor.id, delegateId: terms.delegateId, rights: terms.rights, period };
+    const delegation = Delegation.grant(this.ids.next(), { ...lent, held }, now);
+
+    await this.delegationRepository.save(delegation);
+
+    return delegation.id;
+  }
+}

package/templates/presets/identity/context/application/commands/invite-member/invite-member.command.ts.tpl

@@ -0,0 +1,16 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import type { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+
+/** Invites a person to an organisation by email address, in a role: the answer carries the token to send them, never stored. */
+@Requires({{context.camel}}Permissions['member.invite'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class InviteMemberCommand extends AuthorizedCommand<{ readonly id: string; readonly token: string }> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly invitee: { readonly email: string; readonly role: MemberRole },
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/invite-member/invite-member.handler.ts.tpl

@@ -0,0 +1,53 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock, IdGenerator } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { Invitation } from '{{alias.context}}/domain/aggregates/invitation.aggregate{{alias.ext}}';
+import { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { InvitationRepository } from '{{alias.context}}/domain/repositories/invitation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { RoleRightsService } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { InviteMemberCommand } from '{{alias.context}}/application/commands/invite-member/invite-member.command{{alias.ext}}';
+import type { InvitationTokens } from '{{alias.context}}/application/ports/invitation-tokens.port{{alias.ext}}';
+
+@CommandHandler(InviteMemberCommand)
+export class InviteMemberHandler implements CommandHandler<InviteMemberCommand> {
+  constructor(
+    private readonly invitationRepository: InvitationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly delegationRepository: DelegationRepository,
+    private readonly tokens: InvitationTokens,
+    private readonly access: Access,
+    private readonly ids: IdGenerator,
+    private readonly clock: Clock,
+  ) {}
+
+  /**
+   * Whoever may invite in the organisation invites, in their own role or below (never above it,
+   * whatever a delegation lends them); the delegation used, if any, is named in the fact. The
+   * token leaves in the answer, its digest stays.
+   */
+  async execute({ actor, organisationId, invitee }: InviteMemberCommand): Promise<{ id: string; token: string }> {
+    const now = this.clock.now();
+    const inviter = await this.memberRepository.findOf(organisationId, actor.id);
+    const held = { member: inviter, lent: await this.delegationRepository.findUnendedTo(organisationId, actor.id), now };
+    const rights = new RoleRightsService();
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['member.invite'], rights.rightsIn(organisationId, actor.id, held));
+
+    Member.assertAppointable(organisationId, invitee.role, inviter?.role ?? MemberRole.Member);
+
+    const { token, digest } = this.tokens.issue();
+    const delegationId = rights.delegationUsedFor(MemberRight.InviteMembers, held);
+    const terms = { organisationId, email: EmailAddress.create(invitee.email), role: invitee.role, tokenHash: digest, invitedBy: actor.id };
+    const invitation = Invitation.issue(this.ids.next(), { ...terms, ...(delegationId === undefined ? {} : { delegationId }) }, now);
+
+    await this.invitationRepository.save(invitation);
+
+    return { id: invitation.id, token };
+  }
+}