wip

.env.example

@@ -0,0 +1,17 @@
+# PostgreSQL
+POSTGRES_USER=kratos
+POSTGRES_PASSWORD=change_me_to_a_secure_password
+POSTGRES_DB=kratos
+
+# Kratos Secrets (generate with: openssl rand -base64 32)
+KRATOS_SECRETS_COOKIE=change_me_32_char_secret_key_here_1234
+KRATOS_SECRETS_CIPHER=change_me_32_char_cipher_key_here_123
+
+# Kratos Mode
+KRATOS_DEV_MODE=true
+
+# URLs
+KRATOS_PUBLIC_URL=http://localhost:4433
+KRATOS_ADMIN_URL=http://localhost:4434
+NEXT_PUBLIC_KRATOS_PUBLIC_URL=http://localhost:4433
+NEXT_PUBLIC_APP_URL=http://localhost:3000

.gitignore

@@ -1 +1,19 @@
 node_modules
+.turbo
+out
+
+# Environment files
+.env
+.env.local
+.env.*.local
+
+# Next.js
+.next
+*.tsbuildinfo
+
+# IDE
+.idea
+.vscode
+
+# OS
+.DS_Store

Dockerfile

@@ -0,0 +1,33 @@
+# 1. Build stage
+FROM node:22-slim AS builder
+
+ENV NVM_DIR=/root/.nvm
+ENV NODE_VERSION=22
+
+# Install dependencies for Node
+RUN apt-get update &&  apt-get dist-upgrade -y && apt-get install -y ca-certificates build-essential 
+
+# Enable corepack and prepare pnpm
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
+WORKDIR /app
+
+COPY . .
+
+RUN yes | pnpm install
+
+RUN pnpm turbo run build --filter=lightsaver_user_client...
+
+#debugging
+RUN ls -al /app/apps/lightsaver_user_client
+
+# 2. Production stage
+FROM node:22-slim
+
+WORKDIR /app
+
+COPY --from=builder /app/apps/lightsaver_user_client ./
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/packages ./packages
+
+EXPOSE 3000

LICENSE.txt

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for
+the specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.md

@@ -0,0 +1,117 @@
+# LightSaver
+
+## Technologies Used
+
+- **Next.js 15**: React 19-based framework for building server-side rendered web applications
+- **GraphQL**: API query language for flexible and efficient data fetching
+- **Express.js**: Fast, unopinionated web framework for Node.js, powering the backend API
+- **Ory Kratos**: Open-source identity and user management system for authentication
+- **PostgreSQL 18**: Relational database for persistent storage
+- **Podman Compose**: Container orchestration for local development and deployment
+- **Turborepo**: Monorepo build system for managing multiple packages
+- **OpenTofu**: FOSS fork of Terraform
+- **RabbitMQ**: Message broker for asynchronous communication and background processing
+
+## Project Structure
+
+```text
+lightsaver/
+├── apps/
+│   └── lightsaver_user_client/    # Next.js frontend
+├── services/                       # GraphQL API backend
+├── infrastructure/
+│   └── kratos/                    # Ory Kratos configuration
+├── podman-compose.yaml            # Container orchestration
+└── .env.example                   # Environment variables template
+```
+
+## Getting Started
+
+### Prerequisites
+
+- Node.js 22+
+- pnpm
+- Podman and Podman Compose
+
+### Setup
+
+1. Clone the repository and install dependencies:
+
+   ```sh
+   pnpm install
+   ```
+
+1. Copy the environment file and configure it:
+
+   ```sh
+   cp .env.example .env
+   # Edit .env and set secure values for:
+   # - POSTGRES_PASSWORD
+   # - KRATOS_SECRETS_COOKIE
+   # - KRATOS_SECRETS_CIPHER
+   ```
+
+1. Start all services with Podman Compose:
+
+```sh
+podman-compose up
+```
+
+### Services
+
+| Service | URL | Description |
+|---------|-----|-------------|
+| Frontend | http://localhost:3000 | Next.js user interface |
+| GraphQL API | http://localhost:4000/graphql | Express + Apollo Server |
+| Kratos Public | http://localhost:4433 | Authentication API |
+| Kratos Admin | http://localhost:4434 | Kratos admin API |
+| Mailhog | http://localhost:8025 | Dev email testing UI |
+
+### Authentication
+
+The app uses Ory Kratos for authentication with the following flows:
+
+- **Registration**: `/auth/registration` - Create a new account
+- **Login**: `/auth/login` - Sign in to your account
+- **Recovery**: `/auth/recovery` - Reset forgotten password
+- **Verification**: `/auth/verification` - Verify email address
+- **Settings**: `/auth/settings` - Update account settings
+- **Dashboard**: `/dashboard` - Protected user dashboard
+
+### Development
+
+Run individual services locally:
+
+```sh
+# Frontend (Next.js)
+pnpm --filter lightsaver_user_client dev
+
+# Backend (GraphQL API)
+pnpm --filter api dev
+```
+
+## Docker/Podman Commands
+
+Build and run all services:
+
+```sh
+podman-compose up --build
+```
+
+Run in detached mode:
+
+```sh
+podman-compose up -d
+```
+
+Stop all services:
+
+```sh
+podman-compose down
+```
+
+View logs:
+
+```sh
+podman-compose logs -f
+```

apps/lightsaver_user_client/next.config.ts

@@ -0,0 +1,18 @@
+import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {
+  output: "standalone",
+
+  async rewrites() {
+    const kratosUrl =
+      process.env.KRATOS_PUBLIC_URL || "http://localhost:4433";
+    return [
+      {
+        source: "/api/kratos/:path*",
+        destination: `${kratosUrl}/:path*`,
+      },
+    ];
+  },
+};
+
+export default nextConfig;

apps/lightsaver_user_client/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "web",
+  "name": "lightsaver_user_client",
   "version": "0.1.0",
   "private": true,
   "scripts": {
@@ -9,19 +9,22 @@
     "lint": "next lint"
   },
   "dependencies": {
+    "@apollo/client": "^3.13.8",
+    "@ory/client": "^1.15.0",
+    "graphql": "^16.11.0",
+    "next": "15.3.5",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "next": "15.3.5"
+    "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "typescript": "^5",
+    "@eslint/eslintrc": "^3",
+    "@tailwindcss/postcss": "^4",
     "@types/node": "^20",
     "@types/react": "^19",
     "@types/react-dom": "^19",
-    "@tailwindcss/postcss": "^4",
-    "tailwindcss": "^4",
     "eslint": "^9",
     "eslint-config-next": "15.3.5",
-    "@eslint/eslintrc": "^3"
+    "tailwindcss": "^4",
+    "typescript": "^5"
   }
 }

apps/lightsaver_user_client/src/app/auth/error/page.tsx

@@ -0,0 +1,89 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useSearchParams } from "next/navigation";
+import { FlowError } from "@ory/client";
+import { kratosClient } from "@/lib/kratos/client";
+import Link from "next/link";
+
+export default function ErrorPage() {
+  const [error, setError] = useState<FlowError | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+  const searchParams = useSearchParams();
+
+  const errorId = searchParams.get("id");
+
+  useEffect(() => {
+    if (!errorId) {
+      setIsLoading(false);
+      return;
+    }
+
+    kratosClient
+      .getFlowError({ id: errorId })
+      .then(({ data }) => {
+        setError(data);
+      })
+      .catch((err) => {
+        console.error("Failed to fetch error:", err);
+      })
+      .finally(() => {
+        setIsLoading(false);
+      });
+  }, [errorId]);
+
+  if (isLoading) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Loading...
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-gray-50">
+      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
+        <h1 className="text-2xl font-bold text-center text-red-600">
+          An Error Occurred
+        </h1>
+
+        {error ? (
+          <div className="space-y-4">
+            <div className="p-4 bg-red-50 border border-red-200 rounded-md">
+              <p className="text-sm text-red-700">
+                {typeof error.error === "object" && error.error !== null
+                  ? JSON.stringify(error.error, null, 2)
+                  : String(error.error)}
+              </p>
+            </div>
+
+            {errorId && (
+              <p className="text-xs text-gray-500 text-center">
+                Error ID: {errorId}
+              </p>
+            )}
+          </div>
+        ) : (
+          <p className="text-center text-gray-600">
+            An unknown error occurred. Please try again.
+          </p>
+        )}
+
+        <div className="flex flex-col gap-2">
+          <Link
+            href="/auth/login"
+            className="w-full py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700 text-center"
+          >
+            Go to Login
+          </Link>
+          <Link
+            href="/"
+            className="w-full py-2 px-4 border border-gray-300 text-gray-700 rounded-md hover:bg-gray-50 text-center"
+          >
+            Go to Home
+          </Link>
+        </div>
+      </div>
+    </div>
+  );
+}

apps/lightsaver_user_client/src/app/auth/login/page.tsx

@@ -0,0 +1,112 @@
+"use client";
+
+import { useEffect, useState, useCallback } from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { LoginFlow, UpdateLoginFlowBody } from "@ory/client";
+import { kratosClient } from "@/lib/kratos/client";
+import { AuthForm } from "@/components/auth/AuthForm";
+import Link from "next/link";
+
+export default function LoginPage() {
+  const [flow, setFlow] = useState<LoginFlow | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+  const router = useRouter();
+  const searchParams = useSearchParams();
+
+  const flowId = searchParams.get("flow");
+  const returnTo = searchParams.get("return_to");
+
+  const initializeFlow = useCallback(async () => {
+    try {
+      if (flowId) {
+        const { data } = await kratosClient.getLoginFlow({ id: flowId });
+        setFlow(data);
+      } else {
+        const { data } = await kratosClient.createBrowserLoginFlow({
+          returnTo: returnTo || undefined,
+        });
+        window.history.replaceState(null, "", `?flow=${data.id}`);
+        setFlow(data);
+      }
+    } catch (error: unknown) {
+      const err = error as { response?: { status?: number } };
+      if (err.response?.status === 410) {
+        window.location.href = "/auth/login";
+        return;
+      }
+      console.error("Failed to initialize login flow:", error);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [flowId, returnTo]);
+
+  useEffect(() => {
+    initializeFlow();
+  }, [initializeFlow]);
+
+  const handleSubmit = async (values: Record<string, unknown>) => {
+    if (!flow) return;
+
+    try {
+      await kratosClient.updateLoginFlow({
+        flow: flow.id,
+        updateLoginFlowBody: values as UpdateLoginFlowBody,
+      });
+
+      router.push(returnTo || "/dashboard");
+    } catch (error: unknown) {
+      const err = error as { response?: { status?: number; data?: LoginFlow } };
+      if (err.response?.status === 400 && err.response.data) {
+        setFlow(err.response.data);
+      } else if (err.response?.status === 410) {
+        window.location.href = "/auth/login";
+      } else {
+        console.error("Login error:", error);
+      }
+    }
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Loading...
+      </div>
+    );
+  }
+
+  if (!flow) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Error loading login flow
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-gray-50">
+      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
+        <h1 className="text-2xl font-bold text-center">Sign In</h1>
+        <AuthForm flow={flow} onSubmit={handleSubmit} submitLabel="Sign In" />
+        <div className="text-center text-sm text-gray-600 space-y-2">
+          <p>
+            Don&apos;t have an account?{" "}
+            <Link
+              href="/auth/registration"
+              className="text-blue-600 hover:underline"
+            >
+              Sign up
+            </Link>
+          </p>
+          <p>
+            <Link
+              href="/auth/recovery"
+              className="text-blue-600 hover:underline"
+            >
+              Forgot your password?
+            </Link>
+          </p>
+        </div>
+      </div>
+    </div>
+  );
+}

apps/lightsaver_user_client/src/app/auth/logout/route.ts

@@ -0,0 +1,21 @@
+import { NextRequest, NextResponse } from "next/server";
+import { kratosClient } from "@/lib/kratos/client";
+
+export async function GET(request: NextRequest) {
+  const cookie = request.headers.get("cookie") || "";
+
+  try {
+    const { data } = await kratosClient.createBrowserLogoutFlow({
+      cookie,
+    });
+
+    return NextResponse.redirect(data.logout_url);
+  } catch (error) {
+    console.error("Logout error:", error);
+    return NextResponse.redirect(new URL("/", request.url));
+  }
+}
+
+export async function POST(request: NextRequest) {
+  return GET(request);
+}

apps/lightsaver_user_client/src/app/auth/recovery/page.tsx

@@ -0,0 +1,128 @@
+"use client";
+
+import { useEffect, useState, useCallback } from "react";
+import { useSearchParams } from "next/navigation";
+import { RecoveryFlow, UpdateRecoveryFlowBody } from "@ory/client";
+import { kratosClient } from "@/lib/kratos/client";
+import { AuthForm } from "@/components/auth/AuthForm";
+import Link from "next/link";
+
+export default function RecoveryPage() {
+  const [flow, setFlow] = useState<RecoveryFlow | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+  const [success, setSuccess] = useState(false);
+  const searchParams = useSearchParams();
+
+  const flowId = searchParams.get("flow");
+
+  const initializeFlow = useCallback(async () => {
+    try {
+      if (flowId) {
+        const { data } = await kratosClient.getRecoveryFlow({ id: flowId });
+        setFlow(data);
+      } else {
+        const { data } = await kratosClient.createBrowserRecoveryFlow();
+        window.history.replaceState(null, "", `?flow=${data.id}`);
+        setFlow(data);
+      }
+    } catch (error: unknown) {
+      const err = error as { response?: { status?: number } };
+      if (err.response?.status === 410) {
+        window.location.href = "/auth/recovery";
+        return;
+      }
+      console.error("Failed to initialize recovery flow:", error);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [flowId]);
+
+  useEffect(() => {
+    initializeFlow();
+  }, [initializeFlow]);
+
+  const handleSubmit = async (values: Record<string, unknown>) => {
+    if (!flow) return;
+
+    try {
+      const { data } = await kratosClient.updateRecoveryFlow({
+        flow: flow.id,
+        updateRecoveryFlowBody: values as UpdateRecoveryFlowBody,
+      });
+
+      setFlow(data);
+
+      if (data.state === "passed_challenge") {
+        setSuccess(true);
+      }
+    } catch (error: unknown) {
+      const err = error as {
+        response?: { status?: number; data?: RecoveryFlow };
+      };
+      if (err.response?.status === 400 && err.response.data) {
+        setFlow(err.response.data);
+      } else if (err.response?.status === 410) {
+        window.location.href = "/auth/recovery";
+      } else {
+        console.error("Recovery error:", error);
+      }
+    }
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Loading...
+      </div>
+    );
+  }
+
+  if (!flow) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Error loading recovery flow
+      </div>
+    );
+  }
+
+  if (success) {
+    return (
+      <div className="min-h-screen flex items-center justify-center bg-gray-50">
+        <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md text-center">
+          <h1 className="text-2xl font-bold">Recovery Successful</h1>
+          <p className="text-gray-600">
+            You can now set a new password in your account settings.
+          </p>
+          <Link
+            href="/auth/settings"
+            className="inline-block py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700"
+          >
+            Go to Settings
+          </Link>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-gray-50">
+      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
+        <h1 className="text-2xl font-bold text-center">Recover Your Account</h1>
+        <p className="text-center text-gray-600">
+          Enter your email address and we&apos;ll send you a recovery code.
+        </p>
+        <AuthForm
+          flow={flow}
+          onSubmit={handleSubmit}
+          submitLabel="Send Recovery Code"
+        />
+        <p className="text-center text-sm text-gray-600">
+          Remember your password?{" "}
+          <Link href="/auth/login" className="text-blue-600 hover:underline">
+            Sign in
+          </Link>
+        </p>
+      </div>
+    </div>
+  );
+}

apps/lightsaver_user_client/src/app/auth/registration/page.tsx

@@ -0,0 +1,105 @@
+"use client";
+
+import { useEffect, useState, useCallback } from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { RegistrationFlow, UpdateRegistrationFlowBody } from "@ory/client";
+import { kratosClient } from "@/lib/kratos/client";
+import { AuthForm } from "@/components/auth/AuthForm";
+import Link from "next/link";
+
+export default function RegistrationPage() {
+  const [flow, setFlow] = useState<RegistrationFlow | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+  const router = useRouter();
+  const searchParams = useSearchParams();
+
+  const flowId = searchParams.get("flow");
+  const returnTo = searchParams.get("return_to");
+
+  const initializeFlow = useCallback(async () => {
+    try {
+      if (flowId) {
+        const { data } = await kratosClient.getRegistrationFlow({ id: flowId });
+        setFlow(data);
+      } else {
+        const { data } = await kratosClient.createBrowserRegistrationFlow({
+          returnTo: returnTo || undefined,
+        });
+        window.history.replaceState(null, "", `?flow=${data.id}`);
+        setFlow(data);
+      }
+    } catch (error: unknown) {
+      const err = error as { response?: { status?: number } };
+      if (err.response?.status === 410) {
+        window.location.href = "/auth/registration";
+        return;
+      }
+      console.error("Failed to initialize registration flow:", error);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [flowId, returnTo]);
+
+  useEffect(() => {
+    initializeFlow();
+  }, [initializeFlow]);
+
+  const handleSubmit = async (values: Record<string, unknown>) => {
+    if (!flow) return;
+
+    try {
+      await kratosClient.updateRegistrationFlow({
+        flow: flow.id,
+        updateRegistrationFlowBody: values as UpdateRegistrationFlowBody,
+      });
+
+      router.push(returnTo || "/dashboard");
+    } catch (error: unknown) {
+      const err = error as {
+        response?: { status?: number; data?: RegistrationFlow };
+      };
+      if (err.response?.status === 400 && err.response.data) {
+        setFlow(err.response.data);
+      } else if (err.response?.status === 410) {
+        window.location.href = "/auth/registration";
+      } else {
+        console.error("Registration error:", error);
+      }
+    }
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Loading...
+      </div>
+    );
+  }
+
+  if (!flow) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Error loading registration flow
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-gray-50">
+      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
+        <h1 className="text-2xl font-bold text-center">Create Account</h1>
+        <AuthForm
+          flow={flow}
+          onSubmit={handleSubmit}
+          submitLabel="Create Account"
+        />
+        <p className="text-center text-sm text-gray-600">
+          Already have an account?{" "}
+          <Link href="/auth/login" className="text-blue-600 hover:underline">
+            Sign in
+          </Link>
+        </p>
+      </div>
+    </div>
+  );
+}

apps/lightsaver_user_client/src/app/auth/settings/page.tsx

@@ -0,0 +1,118 @@
+"use client";
+
+import { useEffect, useState, useCallback } from "react";
+import { useSearchParams } from "next/navigation";
+import { SettingsFlow, UpdateSettingsFlowBody } from "@ory/client";
+import { kratosClient } from "@/lib/kratos/client";
+import { AuthForm } from "@/components/auth/AuthForm";
+import Link from "next/link";
+
+export default function SettingsPage() {
+  const [flow, setFlow] = useState<SettingsFlow | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+  const [success, setSuccess] = useState(false);
+  const searchParams = useSearchParams();
+
+  const flowId = searchParams.get("flow");
+
+  const initializeFlow = useCallback(async () => {
+    try {
+      if (flowId) {
+        const { data } = await kratosClient.getSettingsFlow({ id: flowId });
+        setFlow(data);
+      } else {
+        const { data } = await kratosClient.createBrowserSettingsFlow();
+        window.history.replaceState(null, "", `?flow=${data.id}`);
+        setFlow(data);
+      }
+    } catch (error: unknown) {
+      const err = error as { response?: { status?: number } };
+      if (err.response?.status === 410) {
+        window.location.href = "/auth/settings";
+        return;
+      }
+      if (err.response?.status === 401) {
+        window.location.href = "/auth/login?return_to=/auth/settings";
+        return;
+      }
+      console.error("Failed to initialize settings flow:", error);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [flowId]);
+
+  useEffect(() => {
+    initializeFlow();
+  }, [initializeFlow]);
+
+  const handleSubmit = async (values: Record<string, unknown>) => {
+    if (!flow) return;
+
+    try {
+      const { data } = await kratosClient.updateSettingsFlow({
+        flow: flow.id,
+        updateSettingsFlowBody: values as UpdateSettingsFlowBody,
+      });
+
+      setFlow(data);
+      setSuccess(true);
+
+      setTimeout(() => setSuccess(false), 3000);
+    } catch (error: unknown) {
+      const err = error as {
+        response?: { status?: number; data?: SettingsFlow };
+      };
+      if (err.response?.status === 400 && err.response.data) {
+        setFlow(err.response.data);
+      } else if (err.response?.status === 410) {
+        window.location.href = "/auth/settings";
+      } else if (err.response?.status === 401) {
+        window.location.href = "/auth/login?return_to=/auth/settings";
+      } else {
+        console.error("Settings error:", error);
+      }
+    }
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Loading...
+      </div>
+    );
+  }
+
+  if (!flow) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Error loading settings flow
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-gray-50">
+      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
+        <h1 className="text-2xl font-bold text-center">Account Settings</h1>
+
+        {success && (
+          <div className="p-3 bg-green-50 text-green-700 border border-green-200 rounded-md text-sm">
+            Settings updated successfully!
+          </div>
+        )}
+
+        <AuthForm
+          flow={flow}
+          onSubmit={handleSubmit}
+          submitLabel="Update Settings"
+        />
+
+        <p className="text-center text-sm text-gray-600">
+          <Link href="/dashboard" className="text-blue-600 hover:underline">
+            Back to Dashboard
+          </Link>
+        </p>
+      </div>
+    </div>
+  );
+}

apps/lightsaver_user_client/src/app/auth/verification/page.tsx

@@ -0,0 +1,130 @@
+"use client";
+
+import { useEffect, useState, useCallback } from "react";
+import { useSearchParams } from "next/navigation";
+import { VerificationFlow, UpdateVerificationFlowBody } from "@ory/client";
+import { kratosClient } from "@/lib/kratos/client";
+import { AuthForm } from "@/components/auth/AuthForm";
+import Link from "next/link";
+
+export default function VerificationPage() {
+  const [flow, setFlow] = useState<VerificationFlow | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+  const [success, setSuccess] = useState(false);
+  const searchParams = useSearchParams();
+
+  const flowId = searchParams.get("flow");
+
+  const initializeFlow = useCallback(async () => {
+    try {
+      if (flowId) {
+        const { data } = await kratosClient.getVerificationFlow({ id: flowId });
+        setFlow(data);
+
+        if (data.state === "passed_challenge") {
+          setSuccess(true);
+        }
+      } else {
+        const { data } = await kratosClient.createBrowserVerificationFlow();
+        window.history.replaceState(null, "", `?flow=${data.id}`);
+        setFlow(data);
+      }
+    } catch (error: unknown) {
+      const err = error as { response?: { status?: number } };
+      if (err.response?.status === 410) {
+        window.location.href = "/auth/verification";
+        return;
+      }
+      console.error("Failed to initialize verification flow:", error);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [flowId]);
+
+  useEffect(() => {
+    initializeFlow();
+  }, [initializeFlow]);
+
+  const handleSubmit = async (values: Record<string, unknown>) => {
+    if (!flow) return;
+
+    try {
+      const { data } = await kratosClient.updateVerificationFlow({
+        flow: flow.id,
+        updateVerificationFlowBody: values as UpdateVerificationFlowBody,
+      });
+
+      setFlow(data);
+
+      if (data.state === "passed_challenge") {
+        setSuccess(true);
+      }
+    } catch (error: unknown) {
+      const err = error as {
+        response?: { status?: number; data?: VerificationFlow };
+      };
+      if (err.response?.status === 400 && err.response.data) {
+        setFlow(err.response.data);
+      } else if (err.response?.status === 410) {
+        window.location.href = "/auth/verification";
+      } else {
+        console.error("Verification error:", error);
+      }
+    }
+  };
+
+  if (isLoading) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Loading...
+      </div>
+    );
+  }
+
+  if (!flow) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Error loading verification flow
+      </div>
+    );
+  }
+
+  if (success) {
+    return (
+      <div className="min-h-screen flex items-center justify-center bg-gray-50">
+        <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md text-center">
+          <h1 className="text-2xl font-bold text-green-600">Email Verified!</h1>
+          <p className="text-gray-600">
+            Your email address has been successfully verified.
+          </p>
+          <Link
+            href="/dashboard"
+            className="inline-block py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700"
+          >
+            Go to Dashboard
+          </Link>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-gray-50">
+      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
+        <h1 className="text-2xl font-bold text-center">Verify Your Email</h1>
+        <p className="text-center text-gray-600">
+          Enter the verification code sent to your email address.
+        </p>
+        <AuthForm flow={flow} onSubmit={handleSubmit} submitLabel="Verify" />
+        <p className="text-center text-sm text-gray-600">
+          <Link
+            href="/dashboard"
+            className="text-blue-600 hover:underline"
+          >
+            Skip for now
+          </Link>
+        </p>
+      </div>
+    </div>
+  );
+}

apps/lightsaver_user_client/src/app/dashboard/page.tsx

@@ -0,0 +1,113 @@
+"use client";
+
+import { useSession } from "@/lib/hooks/useSession";
+import Link from "next/link";
+
+export default function DashboardPage() {
+  const { session, identity, isLoading, isAuthenticated } = useSession();
+
+  if (isLoading) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        Loading...
+      </div>
+    );
+  }
+
+  if (!isAuthenticated || !identity) {
+    return (
+      <div className="flex justify-center items-center min-h-screen">
+        <div className="text-center">
+          <p className="mb-4">You need to be logged in to view this page.</p>
+          <Link
+            href="/auth/login"
+            className="text-blue-600 hover:underline"
+          >
+            Go to Login
+          </Link>
+        </div>
+      </div>
+    );
+  }
+
+  const traits = identity.traits as {
+    email?: string;
+    name?: { first?: string; last?: string };
+  };
+
+  return (
+    <div className="min-h-screen bg-gray-50">
+      <header className="bg-white shadow">
+        <div className="max-w-7xl mx-auto px-4 py-6 sm:px-6 lg:px-8 flex justify-between items-center">
+          <h1 className="text-3xl font-bold text-gray-900">Dashboard</h1>
+          <div className="flex items-center gap-4">
+            <Link
+              href="/auth/settings"
+              className="text-gray-600 hover:text-gray-900"
+            >
+              Settings
+            </Link>
+            <Link
+              href="/auth/logout"
+              className="py-2 px-4 bg-gray-200 text-gray-700 rounded-md hover:bg-gray-300"
+            >
+              Logout
+            </Link>
+          </div>
+        </div>
+      </header>
+
+      <main className="max-w-7xl mx-auto px-4 py-6 sm:px-6 lg:px-8">
+        <div className="bg-white rounded-lg shadow p-6">
+          <h2 className="text-xl font-semibold mb-4">
+            Welcome, {traits.name?.first || "User"}!
+          </h2>
+
+          <div className="space-y-4">
+            <div>
+              <h3 className="text-sm font-medium text-gray-500">Email</h3>
+              <p className="text-gray-900">{traits.email}</p>
+            </div>
+
+            <div>
+              <h3 className="text-sm font-medium text-gray-500">Full Name</h3>
+              <p className="text-gray-900">
+                {traits.name?.first} {traits.name?.last}
+              </p>
+            </div>
+
+            <div>
+              <h3 className="text-sm font-medium text-gray-500">User ID</h3>
+              <p className="text-gray-900 font-mono text-sm">{identity.id}</p>
+            </div>
+
+            <div>
+              <h3 className="text-sm font-medium text-gray-500">
+                Session Expires
+              </h3>
+              <p className="text-gray-900">
+                {session?.expires_at
+                  ? new Date(session.expires_at).toLocaleString()
+                  : "N/A"}
+              </p>
+            </div>
+
+            {!identity.verifiable_addresses?.[0]?.verified && (
+              <div className="p-4 bg-yellow-50 border border-yellow-200 rounded-md">
+                <p className="text-yellow-700 text-sm">
+                  Your email is not verified.{" "}
+                  <Link
+                    href="/auth/verification"
+                    className="font-medium underline"
+                  >
+                    Verify now
+                  </Link>
+                </p>
+              </div>
+            )}
+          </div>
+        </div>
+      </main>
+    </div>
+  );
+}

apps/lightsaver_user_client/src/components/auth/AuthForm.tsx

@@ -0,0 +1,146 @@
+"use client";
+
+import { UiNode, UiNodeInputAttributes, UiText } from "@ory/client";
+import { useState } from "react";
+
+interface FlowUI {
+  nodes: UiNode[];
+  action: string;
+  method: string;
+  messages?: UiText[];
+}
+
+interface AuthFormProps {
+  flow: { ui: FlowUI };
+  onSubmit: (values: Record<string, unknown>) => Promise<void>;
+  submitLabel: string;
+}
+
+function getInputType(attrs: UiNodeInputAttributes): string {
+  if (attrs.type === "hidden") return "hidden";
+  if (attrs.type === "submit") return "submit";
+  if (attrs.type === "email") return "email";
+  if (attrs.type === "password") return "password";
+  return attrs.type || "text";
+}
+
+export function AuthForm({ flow, onSubmit, submitLabel }: AuthFormProps) {
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
+    e.preventDefault();
+    setIsSubmitting(true);
+
+    const formData = new FormData(e.currentTarget);
+    const values: Record<string, unknown> = {};
+
+    formData.forEach((value, key) => {
+      values[key] = value;
+    });
+
+    try {
+      await onSubmit(values);
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const renderNode = (node: UiNode, index: number) => {
+    if (node.type !== "input") return null;
+
+    const attrs = node.attributes as UiNodeInputAttributes;
+    const inputType = getInputType(attrs);
+
+    if (inputType === "hidden") {
+      return (
+        <input
+          key={index}
+          type="hidden"
+          name={attrs.name}
+          value={(attrs.value as string) ?? ""}
+        />
+      );
+    }
+
+    if (inputType === "submit") {
+      return (
+        <button
+          key={index}
+          type="submit"
+          name={attrs.name}
+          value={(attrs.value as string) ?? ""}
+          disabled={isSubmitting || attrs.disabled}
+          className="w-full py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+        >
+          {isSubmitting ? "Loading..." : submitLabel}
+        </button>
+      );
+    }
+
+    const hasError = node.messages?.some((m) => m.type === "error");
+
+    return (
+      <div key={index} className="space-y-1">
+        <label htmlFor={attrs.name} className="block text-sm font-medium">
+          {node.meta.label?.text || attrs.name}
+        </label>
+        <input
+          id={attrs.name}
+          type={inputType}
+          name={attrs.name}
+          defaultValue={(attrs.value as string) ?? ""}
+          required={attrs.required}
+          disabled={attrs.disabled || isSubmitting}
+          autoComplete={attrs.autocomplete}
+          className={`w-full px-3 py-2 border rounded-md focus:outline-none focus:ring-2 disabled:opacity-50 ${
+            hasError
+              ? "border-red-500 focus:ring-red-500"
+              : "border-gray-300 focus:ring-blue-500"
+          }`}
+        />
+        {node.messages?.map((message, msgIndex) => (
+          <p
+            key={msgIndex}
+            className={`text-sm ${
+              message.type === "error" ? "text-red-600" : "text-gray-600"
+            }`}
+          >
+            {message.text}
+          </p>
+        ))}
+      </div>
+    );
+  };
+
+  const inputNodes = flow.ui.nodes.filter(
+    (node) =>
+      node.type === "input" &&
+      (node.group === "default" || node.group === "password")
+  );
+
+  const submitNodes = flow.ui.nodes.filter(
+    (node) =>
+      node.type === "input" &&
+      (node.attributes as UiNodeInputAttributes).type === "submit"
+  );
+
+  return (
+    <form onSubmit={handleSubmit} className="space-y-4">
+      {flow.ui.messages?.map((message, index) => (
+        <div
+          key={index}
+          className={`p-3 rounded-md text-sm ${
+            message.type === "error"
+              ? "bg-red-50 text-red-700 border border-red-200"
+              : "bg-blue-50 text-blue-700 border border-blue-200"
+          }`}
+        >
+          {message.text}
+        </div>
+      ))}
+
+      {inputNodes.map(renderNode)}
+      {submitNodes.map(renderNode)}
+    </form>
+  );
+}

apps/lightsaver_user_client/src/lib/hooks/useSession.ts

@@ -0,0 +1,49 @@
+"use client";
+
+import { useEffect, useState, useCallback } from "react";
+import { Session, Identity } from "@ory/client";
+import { kratosClient } from "@/lib/kratos/client";
+
+interface UseSessionResult {
+  session: Session | null;
+  identity: Identity | null;
+  isLoading: boolean;
+  error: Error | null;
+  isAuthenticated: boolean;
+  refetch: () => Promise<void>;
+}
+
+export function useSession(): UseSessionResult {
+  const [session, setSession] = useState<Session | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState<Error | null>(null);
+
+  const fetchSession = useCallback(async () => {
+    try {
+      setIsLoading(true);
+      const { data } = await kratosClient.toSession();
+      setSession(data);
+      setError(null);
+    } catch (err) {
+      setSession(null);
+      if (err instanceof Error) {
+        setError(err);
+      }
+    } finally {
+      setIsLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    fetchSession();
+  }, [fetchSession]);
+
+  return {
+    session,
+    identity: session?.identity ?? null,
+    isLoading,
+    error,
+    isAuthenticated: !!session,
+    refetch: fetchSession,
+  };
+}

apps/lightsaver_user_client/src/lib/kratos/client.ts

@@ -0,0 +1,22 @@
+import { Configuration, FrontendApi } from "@ory/client";
+
+const kratosPublicUrl =
+  process.env.NEXT_PUBLIC_KRATOS_PUBLIC_URL || "http://localhost:4433";
+
+export const kratosClient = new FrontendApi(
+  new Configuration({
+    basePath: kratosPublicUrl,
+    baseOptions: {
+      withCredentials: true,
+    },
+  })
+);
+
+export function createServerKratosClient(baseUrl?: string) {
+  const url = baseUrl || process.env.KRATOS_ADMIN_URL || "http://localhost:4434";
+  return new FrontendApi(
+    new Configuration({
+      basePath: url,
+    })
+  );
+}

apps/lightsaver_user_client/src/middleware.ts

@@ -0,0 +1,70 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+
+const protectedRoutes = ["/dashboard", "/auth/settings"];
+const authRoutes = ["/auth/login", "/auth/registration"];
+
+export async function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  const sessionCookie = request.cookies.get("lightsaver_session");
+
+  if (protectedRoutes.some((route) => pathname.startsWith(route))) {
+    if (!sessionCookie) {
+      const loginUrl = new URL("/auth/login", request.url);
+      loginUrl.searchParams.set("return_to", pathname);
+      return NextResponse.redirect(loginUrl);
+    }
+
+    try {
+      const kratosUrl =
+        process.env.KRATOS_PUBLIC_URL || "http://localhost:4433";
+      const response = await fetch(`${kratosUrl}/sessions/whoami`, {
+        headers: {
+          Cookie: `lightsaver_session=${sessionCookie.value}`,
+        },
+      });
+
+      if (!response.ok) {
+        const loginUrl = new URL("/auth/login", request.url);
+        loginUrl.searchParams.set("return_to", pathname);
+        return NextResponse.redirect(loginUrl);
+      }
+    } catch (error) {
+      console.error("Session verification failed:", error);
+      const loginUrl = new URL("/auth/login", request.url);
+      return NextResponse.redirect(loginUrl);
+    }
+  }
+
+  if (authRoutes.some((route) => pathname.startsWith(route))) {
+    if (sessionCookie) {
+      try {
+        const kratosUrl =
+          process.env.KRATOS_PUBLIC_URL || "http://localhost:4433";
+        const response = await fetch(`${kratosUrl}/sessions/whoami`, {
+          headers: {
+            Cookie: `lightsaver_session=${sessionCookie.value}`,
+          },
+        });
+
+        if (response.ok) {
+          return NextResponse.redirect(new URL("/dashboard", request.url));
+        }
+      } catch {
+        // Session invalid, allow access to auth pages
+      }
+    }
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: [
+    "/dashboard/:path*",
+    "/auth/settings/:path*",
+    "/auth/login",
+    "/auth/registration",
+  ],
+};

apps/web/next.config.ts

@@ -1,7 +0,0 @@
-import type { NextConfig } from "next";
-
-const nextConfig: NextConfig = {
-  /* config options here */
-};
-
-export default nextConfig;

infrastructure/kratos/identity.schema.json

@@ -0,0 +1,52 @@
+{
+  "$id": "https://lightsaver.app/schemas/identity.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "LightsaverUser",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string",
+          "format": "email",
+          "title": "Email",
+          "ory.sh/kratos": {
+            "credentials": {
+              "password": {
+                "identifier": true
+              }
+            },
+            "recovery": {
+              "via": "email"
+            },
+            "verification": {
+              "via": "email"
+            }
+          }
+        },
+        "name": {
+          "type": "object",
+          "properties": {
+            "first": {
+              "type": "string",
+              "title": "First Name",
+              "minLength": 1,
+              "maxLength": 100
+            },
+            "last": {
+              "type": "string",
+              "title": "Last Name",
+              "minLength": 1,
+              "maxLength": 100
+            }
+          },
+          "required": ["first", "last"],
+          "additionalProperties": false
+        }
+      },
+      "required": ["email", "name"],
+      "additionalProperties": false
+    }
+  }
+}

infrastructure/kratos/kratos.yaml

@@ -0,0 +1,120 @@
+version: v1.2.0
+
+dsn: memory
+
+serve:
+  public:
+    base_url: http://localhost:4433/
+    cors:
+      enabled: true
+      allowed_origins:
+        - http://localhost:3000
+        - http://127.0.0.1:3000
+      allowed_methods:
+        - POST
+        - GET
+        - PUT
+        - PATCH
+        - DELETE
+      allowed_headers:
+        - Authorization
+        - Content-Type
+        - Cookie
+        - X-Session-Token
+      exposed_headers:
+        - Content-Type
+        - Set-Cookie
+      allow_credentials: true
+  admin:
+    base_url: http://localhost:4434/
+
+selfservice:
+  default_browser_return_url: http://localhost:3000/
+  allowed_return_urls:
+    - http://localhost:3000/
+    - http://localhost:3000/dashboard
+
+  methods:
+    password:
+      enabled: true
+    link:
+      enabled: true
+    code:
+      enabled: true
+      mfa_enabled: false
+
+  flows:
+    error:
+      ui_url: http://localhost:3000/auth/error
+
+    settings:
+      ui_url: http://localhost:3000/auth/settings
+      privileged_session_max_age: 15m
+
+    recovery:
+      enabled: true
+      ui_url: http://localhost:3000/auth/recovery
+      use: code
+
+    verification:
+      enabled: true
+      ui_url: http://localhost:3000/auth/verification
+      use: code
+      after:
+        default_browser_return_url: http://localhost:3000/dashboard
+
+    logout:
+      after:
+        default_browser_return_url: http://localhost:3000/
+
+    login:
+      ui_url: http://localhost:3000/auth/login
+      lifespan: 10m
+      after:
+        password:
+          hooks:
+            - hook: revoke_active_sessions
+
+    registration:
+      ui_url: http://localhost:3000/auth/registration
+      lifespan: 10m
+      after:
+        password:
+          hooks:
+            - hook: session
+
+log:
+  level: debug
+  format: text
+  leak_sensitive_values: false
+
+secrets:
+  cookie:
+    - ${SECRETS_COOKIE}
+  cipher:
+    - ${SECRETS_CIPHER}
+
+ciphers:
+  algorithm: xchacha20-poly1305
+
+hashers:
+  algorithm: bcrypt
+  bcrypt:
+    cost: 12
+
+identity:
+  default_schema_id: default
+  schemas:
+    - id: default
+      url: file:///etc/config/kratos/identity.schema.json
+
+courier:
+  smtp:
+    connection_uri: smtp://mailhog:1025/?disable_starttls=true
+
+session:
+  lifespan: 24h
+  cookie:
+    name: lightsaver_session
+    same_site: Lax
+    domain: localhost

package.json

@@ -4,12 +4,14 @@
   "description": "",
   "main": "index.js",
   "scripts": {
+    "build": "turbo run build",
+    "check-types": "tsc --noEmit",
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "keywords": [],
   "author": "Jason Ross",
   "license": "ISC",
-  "packageManager": "pnpm@10.13.1",
+  "packageManager": "pnpm@10.26.2+sha512.0e308ff2005fc7410366f154f625f6631ab2b16b1d2e70238444dd6ae9d630a8482d92a451144debc492416896ed16f7b114a86ec68b8404b2443869e68ffda6",
   "engines": {
     "node": ">=22.17.0"
   },
@@ -17,6 +19,8 @@
     "lightsaver": "workspace:*"
   },
   "devDependencies": {
-    "pnpm": "^10.13.1"
+    "pnpm": "^10.13.1",
+    "turbo": "^2.5.4",
+    "typescript": "^5.8.3"
   }
 }

pnpm-lock.yaml

@@ -15,9 +15,24 @@ importers:
       pnpm:
         specifier: ^10.13.1
         version: 10.13.1
+      turbo:
+        specifier: ^2.5.4
+        version: 2.5.4
+      typescript:
+        specifier: ^5.8.3
+        version: 5.8.3
 
-  apps/web:
+  apps/lightsaver_user_client:
     dependencies:
+      '@apollo/client':
+        specifier: ^3.13.8
+        version: 3.13.8(@types/react@19.1.8)(graphql@16.11.0)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
+      '@ory/client':
+        specifier: ^1.15.0
+        version: 1.22.15
+      graphql:
+        specifier: ^16.11.0
+        version: 16.11.0
       next:
         specifier: 15.3.5
         version: 15.3.5(react-dom@19.1.0(react@19.1.0))(react@19.1.0)
@@ -66,6 +81,24 @@ packages:
     resolution: {integrity: sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==}
     engines: {node: '>=6.0.0'}
 
+  '@apollo/client@3.13.8':
+    resolution: {integrity: sha512-YM9lQpm0VfVco4DSyKooHS/fDTiKQcCHfxr7i3iL6a0kP/jNO5+4NFK6vtRDxaYisd5BrwOZHLJpPBnvRVpKPg==}
+    peerDependencies:
+      graphql: ^15.0.0 || ^16.0.0
+      graphql-ws: ^5.5.5 || ^6.0.3
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || >=19.0.0-rc
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || >=19.0.0-rc
+      subscriptions-transport-ws: ^0.9.0 || ^0.11.0
+    peerDependenciesMeta:
+      graphql-ws:
+        optional: true
+      react:
+        optional: true
+      react-dom:
+        optional: true
+      subscriptions-transport-ws:
+        optional: true
+
   '@emnapi/core@1.4.4':
     resolution: {integrity: sha512-A9CnAbC6ARNMKcIcrQwq6HeHCjpcBZ5wSx4U01WXCqEKlrzB9F9315WDNHkrs2xbx7YjjSxbUYxuN6EQzpcY2g==}
 
@@ -113,6 +146,11 @@ packages:
     resolution: {integrity: sha512-1+WqvgNMhmlAambTvT3KPtCl/Ibr68VldY2XY40SL1CE0ZXiakFR/cbTspaF5HsnpDMvcYYoJHfl4980NBjGag==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@graphql-typed-document-node/core@3.2.0':
+    resolution: {integrity: sha512-mB9oAsNCm9aM3/SOv4YtBMqZbYj10R7dkq8byBqxGY/ncFwhf2oQzMV+LCRlWoDSEBJ3COiR1yeDvMtsoOsuFQ==}
+    peerDependencies:
+      graphql: ^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0
+
   '@humanfs/core@0.19.1':
     resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==}
     engines: {node: '>=18.18.0'}
@@ -345,6 +383,9 @@ packages:
     resolution: {integrity: sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==}
     engines: {node: '>=12.4.0'}
 
+  '@ory/client@1.22.15':
+    resolution: {integrity: sha512-1JAd4ltj1/LBduDm7hwsyUCXN6PgfknEocK4iWeFYIqK70Mq29mLGmLS3m9Dxe2XbQSJ5dDBeFj0AlMyD5pP6Q==}
+
   '@rtsao/scc@1.1.0':
     resolution: {integrity: sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==}
 
@@ -622,6 +663,22 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@wry/caches@1.0.1':
+    resolution: {integrity: sha512-bXuaUNLVVkD20wcGBWRyo7j9N3TxePEWFZj2Y+r9OoUzfqmavM84+mFykRicNsBqatba5JLay1t48wxaXaWnlA==}
+    engines: {node: '>=8'}
+
+  '@wry/context@0.7.4':
+    resolution: {integrity: sha512-jmT7Sb4ZQWI5iyu3lobQxICu2nC/vbUhP0vIdd6tHC9PTfenmRmuIFqktc6GH9cgi+ZHnsLWPvfSvc4DrYmKiQ==}
+    engines: {node: '>=8'}
+
+  '@wry/equality@0.5.7':
+    resolution: {integrity: sha512-BRFORjsTuQv5gxcXsuDXx6oGRhuVsEGwZy6LOzRRfgu+eSfxbhUQ9L9YtSEIuIjY/o7g3iWFjrc5eSY1GXP2Dw==}
+    engines: {node: '>=8'}
+
+  '@wry/trie@0.5.0':
+    resolution: {integrity: sha512-FNoYzHawTMk/6KMQoEG5O4PuioX19UbwdQKF44yw0nLfOypfQdjtfZzo/UIJWAJ23sNIFbD1Ug9lbaDGMwbqQA==}
+    engines: {node: '>=8'}
+
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
     peerDependencies:
@@ -685,6 +742,9 @@ packages:
     resolution: {integrity: sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
     engines: {node: '>= 0.4'}
 
+  asynckit@0.4.0:
+    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
   available-typed-arrays@1.0.7:
     resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
     engines: {node: '>= 0.4'}
@@ -693,6 +753,9 @@ packages:
     resolution: {integrity: sha512-Xm7bpRXnDSX2YE2YFfBk2FnF0ep6tmG7xPh8iHee8MIcrgq762Nkce856dYtJYLkuIoYZvGfTs/PbZhideTcEg==}
     engines: {node: '>=4'}
 
+  axios@1.13.2:
+    resolution: {integrity: sha512-VPk9ebNqPcy5lRGuSlKx752IlDatOjT9paPlm8A7yOuW2Fbvp4X3JznJtT4f0GzGLLiWE9W8onz51SqLYwzGaA==}
+
   axobject-query@4.1.0:
     resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==}
     engines: {node: '>= 0.4'}
@@ -758,6 +821,10 @@ packages:
     resolution: {integrity: sha512-1rXeuUUiGGrykh+CeBdu5Ie7OJwinCgQY0bc7GCRxy5xVHy+moaqkpL/jqQq0MtQOeYcrqEz4abc5f0KtU7W4A==}
     engines: {node: '>=12.5.0'}
 
+  combined-stream@1.0.8:
+    resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
+    engines: {node: '>= 0.8'}
+
   concat-map@0.0.1:
     resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
 
@@ -811,6 +878,10 @@ packages:
     resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
     engines: {node: '>= 0.4'}
 
+  delayed-stream@1.0.0:
+    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
+    engines: {node: '>=0.4.0'}
+
   detect-libc@2.0.4:
     resolution: {integrity: sha512-3UDv+G9CsCKO1WKMGw9fwq/SWJYbI0c5Y7LU1AXYoDdbhE2AHQ6N6Nb34sG8Fj7T5APy8qXDCKuuIHd1BR0tVA==}
     engines: {node: '>=8'}
@@ -1029,10 +1100,23 @@ packages:
   flatted@3.3.3:
     resolution: {integrity: sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==}
 
+  follow-redirects@1.15.11:
+    resolution: {integrity: sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      debug: '*'
+    peerDependenciesMeta:
+      debug:
+        optional: true
+
   for-each@0.3.5:
     resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
     engines: {node: '>= 0.4'}
 
+  form-data@4.0.5:
+    resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
+    engines: {node: '>= 6'}
+
   function-bind@1.1.2:
     resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
 
@@ -1084,6 +1168,16 @@ packages:
   graphemer@1.4.0:
     resolution: {integrity: sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==}
 
+  graphql-tag@2.12.6:
+    resolution: {integrity: sha512-FdSNcu2QQcWnM2VNvSCCDCVS5PpPqpzgFT8+GXzqJuoDd0CBncxCY278u4mhRO7tMgo2JjgJA5aZ+nWSQ/Z+xg==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      graphql: ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0
+
+  graphql@16.11.0:
+    resolution: {integrity: sha512-mS1lbMsxgQj6hge1XZ6p7GPhbrtFwUFYi3wRzXAC/FmYnyXMTvvI3td3rjmQ2u8ewXueaSvRPWaEcgVVOT9Jnw==}
+    engines: {node: ^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0}
+
   has-bigints@1.1.0:
     resolution: {integrity: sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==}
     engines: {node: '>= 0.4'}
@@ -1111,6 +1205,9 @@ packages:
     resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
     engines: {node: '>= 0.4'}
 
+  hoist-non-react-statics@3.3.2:
+    resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==}
+
   ignore@5.3.2:
     resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
     engines: {node: '>= 4'}
@@ -1379,6 +1476,14 @@ packages:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
 
+  mime-db@1.52.0:
+    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@2.1.35:
+    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+    engines: {node: '>= 0.6'}
+
   minimatch@3.1.2:
     resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
 
@@ -1471,6 +1576,9 @@ packages:
     resolution: {integrity: sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==}
     engines: {node: '>= 0.4'}
 
+  optimism@0.18.1:
+    resolution: {integrity: sha512-mLXNwWPa9dgFyDqkNi54sjDyNJ9/fTI6WGBLgnXku1vdKY/jovHfZT5r+aiVeFFLOz+foPNOm5YJ4mqgld2GBQ==}
+
   optionator@0.9.4:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
@@ -1537,6 +1645,9 @@ packages:
   prop-types@15.8.1:
     resolution: {integrity: sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}
 
+  proxy-from-env@1.1.0:
+    resolution: {integrity: sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==}
+
   punycode@2.3.1:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
@@ -1564,6 +1675,17 @@ packages:
     resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
     engines: {node: '>= 0.4'}
 
+  rehackt@0.1.0:
+    resolution: {integrity: sha512-7kRDOuLHB87D/JESKxQoRwv4DzbIdwkAGQ7p6QKGdVlY1IZheUnVhlk/4UZlNUVxdAXpyxikE3URsG067ybVzw==}
+    peerDependencies:
+      '@types/react': '*'
+      react: '*'
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      react:
+        optional: true
+
   resolve-from@4.0.0:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
@@ -1721,6 +1843,10 @@ packages:
     resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
     engines: {node: '>= 0.4'}
 
+  symbol-observable@4.0.0:
+    resolution: {integrity: sha512-b19dMThMV4HVFynSAM1++gBHAbk2Tc/osgLIBZMKsyqh34jb2e8Os7T6ZW/Bt3pJFdBTd2JwAnAAEQV7rSNvcQ==}
+    engines: {node: '>=0.10'}
+
   tailwindcss@4.1.11:
     resolution: {integrity: sha512-2E9TBm6MDD/xKYe+dvJZAmg3yxIEDNRc0jwlNyDg/4Fil2QcSLjFKGVff0lAf1jjeaArlG/M75Ey/EYr/OJtBA==}
 
@@ -1746,12 +1872,50 @@ packages:
     peerDependencies:
       typescript: '>=4.8.4'
 
+  ts-invariant@0.10.3:
+    resolution: {integrity: sha512-uivwYcQaxAucv1CzRp2n/QdYPo4ILf9VXgH19zEIjFx2EJufV16P0JtJVpYHy89DItG6Kwj2oIUjrcK5au+4tQ==}
+    engines: {node: '>=8'}
+
   tsconfig-paths@3.15.0:
     resolution: {integrity: sha512-2Ac2RgzDe/cn48GvOe3M+o82pEFewD3UPbyoUHHdKasHwJKjds4fLXWf/Ux5kATBKN20oaFGu+jbElp1pos0mg==}
 
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
+  turbo-darwin-64@2.5.4:
+    resolution: {integrity: sha512-ah6YnH2dErojhFooxEzmvsoZQTMImaruZhFPfMKPBq8sb+hALRdvBNLqfc8NWlZq576FkfRZ/MSi4SHvVFT9PQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  turbo-darwin-arm64@2.5.4:
+    resolution: {integrity: sha512-2+Nx6LAyuXw2MdXb7pxqle3MYignLvS7OwtsP9SgtSBaMlnNlxl9BovzqdYAgkUW3AsYiQMJ/wBRb7d+xemM5A==}
+    cpu: [arm64]
+    os: [darwin]
+
+  turbo-linux-64@2.5.4:
+    resolution: {integrity: sha512-5May2kjWbc8w4XxswGAl74GZ5eM4Gr6IiroqdLhXeXyfvWEdm2mFYCSWOzz0/z5cAgqyGidF1jt1qzUR8hTmOA==}
+    cpu: [x64]
+    os: [linux]
+
+  turbo-linux-arm64@2.5.4:
+    resolution: {integrity: sha512-/2yqFaS3TbfxV3P5yG2JUI79P7OUQKOUvAnx4MV9Bdz6jqHsHwc9WZPpO4QseQm+NvmgY6ICORnoVPODxGUiJg==}
+    cpu: [arm64]
+    os: [linux]
+
+  turbo-windows-64@2.5.4:
+    resolution: {integrity: sha512-EQUO4SmaCDhO6zYohxIjJpOKRN3wlfU7jMAj3CgcyTPvQR/UFLEKAYHqJOnJtymbQmiiM/ihX6c6W6Uq0yC7mA==}
+    cpu: [x64]
+    os: [win32]
+
+  turbo-windows-arm64@2.5.4:
+    resolution: {integrity: sha512-oQ8RrK1VS8lrxkLriotFq+PiF7iiGgkZtfLKF4DDKsmdbPo0O9R2mQxm7jHLuXraRCuIQDWMIw6dpcr7Iykf4A==}
+    cpu: [arm64]
+    os: [win32]
+
+  turbo@2.5.4:
+    resolution: {integrity: sha512-kc8ZibdRcuWUG1pbYSBFWqmIjynlD8Lp7IB6U3vIzvOv9VG+6Sp8bzyeBWE3Oi8XV5KsQrznyRTBPvrf99E4mA==}
+    hasBin: true
+
   type-check@0.4.0:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
@@ -1823,6 +1987,12 @@ packages:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
 
+  zen-observable-ts@1.2.5:
+    resolution: {integrity: sha512-QZWQekv6iB72Naeake9hS1KxHlotfRpe+WGNbNx5/ta+R3DNjVO2bswf63gXlWDcs+EMd7XY8HfVQyP1X6T4Zg==}
+
+  zen-observable@0.8.15:
+    resolution: {integrity: sha512-PQ2PC7R9rslx84ndNBZB/Dkv8V8fZEpk83RLgXtYd0fwUgEjseMn1Dgajh2x6S8QbZAFa9p2qVCEuYZNgve0dQ==}
+
 snapshots:
 
   '@alloc/quick-lru@5.2.0': {}
@@ -1832,6 +2002,28 @@ snapshots:
       '@jridgewell/gen-mapping': 0.3.12
       '@jridgewell/trace-mapping': 0.3.29
 
+  '@apollo/client@3.13.8(@types/react@19.1.8)(graphql@16.11.0)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)':
+    dependencies:
+      '@graphql-typed-document-node/core': 3.2.0(graphql@16.11.0)
+      '@wry/caches': 1.0.1
+      '@wry/equality': 0.5.7
+      '@wry/trie': 0.5.0
+      graphql: 16.11.0
+      graphql-tag: 2.12.6(graphql@16.11.0)
+      hoist-non-react-statics: 3.3.2
+      optimism: 0.18.1
+      prop-types: 15.8.1
+      rehackt: 0.1.0(@types/react@19.1.8)(react@19.1.0)
+      symbol-observable: 4.0.0
+      ts-invariant: 0.10.3
+      tslib: 2.8.1
+      zen-observable-ts: 1.2.5
+    optionalDependencies:
+      react: 19.1.0
+      react-dom: 19.1.0(react@19.1.0)
+    transitivePeerDependencies:
+      - '@types/react'
+
   '@emnapi/core@1.4.4':
     dependencies:
       '@emnapi/wasi-threads': 1.0.3
@@ -1892,6 +2084,10 @@ snapshots:
       '@eslint/core': 0.15.1
       levn: 0.4.1
 
+  '@graphql-typed-document-node/core@3.2.0(graphql@16.11.0)':
+    dependencies:
+      graphql: 16.11.0
+
   '@humanfs/core@0.19.1': {}
 
   '@humanfs/node@0.16.6':
@@ -2060,6 +2256,12 @@ snapshots:
 
   '@nolyfill/is-core-module@1.0.39': {}
 
+  '@ory/client@1.22.15':
+    dependencies:
+      axios: 1.13.2
+    transitivePeerDependencies:
+      - debug
+
   '@rtsao/scc@1.1.0': {}
 
   '@rushstack/eslint-patch@1.12.0': {}
@@ -2316,6 +2518,22 @@ snapshots:
   '@unrs/resolver-binding-win32-x64-msvc@1.11.1':
     optional: true
 
+  '@wry/caches@1.0.1':
+    dependencies:
+      tslib: 2.8.1
+
+  '@wry/context@0.7.4':
+    dependencies:
+      tslib: 2.8.1
+
+  '@wry/equality@0.5.7':
+    dependencies:
+      tslib: 2.8.1
+
+  '@wry/trie@0.5.0':
+    dependencies:
+      tslib: 2.8.1
+
   acorn-jsx@5.3.2(acorn@8.15.0):
     dependencies:
       acorn: 8.15.0
@@ -2408,12 +2626,22 @@ snapshots:
 
   async-function@1.0.0: {}
 
+  asynckit@0.4.0: {}
+
   available-typed-arrays@1.0.7:
     dependencies:
       possible-typed-array-names: 1.1.0
 
   axe-core@4.10.3: {}
 
+  axios@1.13.2:
+    dependencies:
+      follow-redirects: 1.15.11
+      form-data: 4.0.5
+      proxy-from-env: 1.1.0
+    transitivePeerDependencies:
+      - debug
+
   axobject-query@4.1.0: {}
 
   balanced-match@1.0.2: {}
@@ -2483,6 +2711,10 @@ snapshots:
       color-string: 1.9.1
     optional: true
 
+  combined-stream@1.0.8:
+    dependencies:
+      delayed-stream: 1.0.0
+
   concat-map@0.0.1: {}
 
   cross-spawn@7.0.6:
@@ -2535,6 +2767,8 @@ snapshots:
       has-property-descriptors: 1.0.2
       object-keys: 1.1.1
 
+  delayed-stream@1.0.0: {}
+
   detect-libc@2.0.4: {}
 
   doctrine@2.1.0:
@@ -2904,10 +3138,20 @@ snapshots:
 
   flatted@3.3.3: {}
 
+  follow-redirects@1.15.11: {}
+
   for-each@0.3.5:
     dependencies:
       is-callable: 1.2.7
 
+  form-data@4.0.5:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.2
+      mime-types: 2.1.35
+
   function-bind@1.1.2: {}
 
   function.prototype.name@1.1.8:
@@ -2970,6 +3214,13 @@ snapshots:
 
   graphemer@1.4.0: {}
 
+  graphql-tag@2.12.6(graphql@16.11.0):
+    dependencies:
+      graphql: 16.11.0
+      tslib: 2.8.1
+
+  graphql@16.11.0: {}
+
   has-bigints@1.1.0: {}
 
   has-flag@4.0.0: {}
@@ -2992,6 +3243,10 @@ snapshots:
     dependencies:
       function-bind: 1.1.2
 
+  hoist-non-react-statics@3.3.2:
+    dependencies:
+      react-is: 16.13.1
+
   ignore@5.3.2: {}
 
   ignore@7.0.5: {}
@@ -3244,6 +3499,12 @@ snapshots:
       braces: 3.0.3
       picomatch: 2.3.1
 
+  mime-db@1.52.0: {}
+
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
+
   minimatch@3.1.2:
     dependencies:
       brace-expansion: 1.1.12
@@ -3337,6 +3598,13 @@ snapshots:
       define-properties: 1.2.1
       es-object-atoms: 1.1.1
 
+  optimism@0.18.1:
+    dependencies:
+      '@wry/caches': 1.0.1
+      '@wry/context': 0.7.4
+      '@wry/trie': 0.5.0
+      tslib: 2.8.1
+
   optionator@0.9.4:
     dependencies:
       deep-is: 0.1.4
@@ -3400,6 +3668,8 @@ snapshots:
       object-assign: 4.1.1
       react-is: 16.13.1
 
+  proxy-from-env@1.1.0: {}
+
   punycode@2.3.1: {}
 
   queue-microtask@1.2.3: {}
@@ -3433,6 +3703,11 @@ snapshots:
       gopd: 1.2.0
       set-function-name: 2.0.2
 
+  rehackt@0.1.0(@types/react@19.1.8)(react@19.1.0):
+    optionalDependencies:
+      '@types/react': 19.1.8
+      react: 19.1.0
+
   resolve-from@4.0.0: {}
 
   resolve-pkg-maps@1.0.0: {}
@@ -3647,6 +3922,8 @@ snapshots:
 
   supports-preserve-symlinks-flag@1.0.0: {}
 
+  symbol-observable@4.0.0: {}
+
   tailwindcss@4.1.11: {}
 
   tapable@2.2.2: {}
@@ -3673,6 +3950,10 @@ snapshots:
     dependencies:
       typescript: 5.8.3
 
+  ts-invariant@0.10.3:
+    dependencies:
+      tslib: 2.8.1
+
   tsconfig-paths@3.15.0:
     dependencies:
       '@types/json5': 0.0.29
@@ -3682,6 +3963,33 @@ snapshots:
 
   tslib@2.8.1: {}
 
+  turbo-darwin-64@2.5.4:
+    optional: true
+
+  turbo-darwin-arm64@2.5.4:
+    optional: true
+
+  turbo-linux-64@2.5.4:
+    optional: true
+
+  turbo-linux-arm64@2.5.4:
+    optional: true
+
+  turbo-windows-64@2.5.4:
+    optional: true
+
+  turbo-windows-arm64@2.5.4:
+    optional: true
+
+  turbo@2.5.4:
+    optionalDependencies:
+      turbo-darwin-64: 2.5.4
+      turbo-darwin-arm64: 2.5.4
+      turbo-linux-64: 2.5.4
+      turbo-linux-arm64: 2.5.4
+      turbo-windows-64: 2.5.4
+      turbo-windows-arm64: 2.5.4
+
   type-check@0.4.0:
     dependencies:
       prelude-ls: 1.2.1
@@ -3808,3 +4116,9 @@ snapshots:
   yallist@5.0.0: {}
 
   yocto-queue@0.1.0: {}
+
+  zen-observable-ts@1.2.5:
+    dependencies:
+      zen-observable: 0.8.15
+
+  zen-observable@0.8.15: {}

pnpm-workspace.yaml

@@ -1,5 +1,6 @@
 packages:
   - apps/*
+  - services/*
   - packages/*
 
 onlyBuiltDependencies:

podman-compose.yaml

@@ -0,0 +1,115 @@
+version: "3.9"
+
+services:
+  postgres:
+    image: postgres:18-alpine
+    container_name: lightsaver_postgres
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-kratos}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB:-kratos}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    networks:
+      - lightsaver_network
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-kratos} -d ${POSTGRES_DB:-kratos}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  mailhog:
+    image: mailhog/mailhog:latest
+    container_name: lightsaver_mailhog
+    ports:
+      - "8025:8025"
+    networks:
+      - lightsaver_network
+    restart: unless-stopped
+
+  kratos-migrate:
+    image: oryd/kratos:v1.2.0
+    container_name: lightsaver_kratos_migrate
+    environment:
+      DSN: postgres://${POSTGRES_USER:-kratos}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-kratos}?sslmode=disable
+    volumes:
+      - ./infrastructure/kratos:/etc/config/kratos:ro
+    command: migrate sql -e --yes
+    networks:
+      - lightsaver_network
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: on-failure
+
+  kratos:
+    image: oryd/kratos:v1.2.0
+    container_name: lightsaver_kratos
+    environment:
+      DSN: postgres://${POSTGRES_USER:-kratos}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-kratos}?sslmode=disable
+      SECRETS_COOKIE: ${KRATOS_SECRETS_COOKIE}
+      SECRETS_CIPHER: ${KRATOS_SECRETS_CIPHER}
+      SERVE_PUBLIC_BASE_URL: ${KRATOS_PUBLIC_URL:-http://localhost:4433}
+      SERVE_ADMIN_BASE_URL: ${KRATOS_ADMIN_URL:-http://localhost:4434}
+      COURIER_SMTP_CONNECTION_URI: smtp://mailhog:1025/?disable_starttls=true
+    volumes:
+      - ./infrastructure/kratos:/etc/config/kratos:ro
+    command: >
+      sh -c "if [ '${KRATOS_DEV_MODE:-true}' = 'true' ]; then
+        kratos serve --config /etc/config/kratos/kratos.yaml --dev --watch-courier;
+      else
+        kratos serve --config /etc/config/kratos/kratos.yaml --watch-courier;
+      fi"
+    ports:
+      - "4433:4433"
+      - "4434:4434"
+    networks:
+      - lightsaver_network
+    depends_on:
+      kratos-migrate:
+        condition: service_completed_successfully
+    restart: unless-stopped
+
+  frontend:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        NEXT_PUBLIC_KRATOS_PUBLIC_URL: ${NEXT_PUBLIC_KRATOS_PUBLIC_URL:-http://localhost:4433}
+    container_name: lightsaver_frontend
+    environment:
+      NODE_ENV: production
+      NEXT_PUBLIC_KRATOS_PUBLIC_URL: ${NEXT_PUBLIC_KRATOS_PUBLIC_URL:-http://localhost:4433}
+      KRATOS_ADMIN_URL: http://kratos:4434
+    ports:
+      - "3000:3000"
+    networks:
+      - lightsaver_network
+    depends_on:
+      - kratos
+    restart: unless-stopped
+
+  services:
+    build:
+      context: .
+      dockerfile: services/Dockerfile
+    container_name: lightsaver_services
+    environment:
+      NODE_ENV: production
+      KRATOS_ADMIN_URL: http://kratos:4434
+      PORT: 4000
+    ports:
+      - "4000:4000"
+    networks:
+      - lightsaver_network
+    depends_on:
+      - kratos
+    restart: unless-stopped
+
+networks:
+  lightsaver_network:
+    driver: bridge
+
+volumes:
+  postgres_data:

services/Dockerfile

@@ -0,0 +1,26 @@
+FROM node:22-slim AS builder
+
+RUN apt-get update && apt-get dist-upgrade -y && apt-get install -y ca-certificates build-essential
+
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
+WORKDIR /app
+
+COPY . .
+
+RUN pnpm install --filter=api...
+
+RUN pnpm --filter=api run build || true
+
+FROM node:22-slim
+
+WORKDIR /app
+
+COPY --from=builder /app/services ./services
+COPY --from=builder /app/node_modules ./node_modules
+
+WORKDIR /app/services
+
+EXPOSE 4000
+
+CMD ["node", "--import", "tsx", "src/index.ts"]

services/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "api",
+  "version": "1.0.0",
+  "description": "",
+  "main": "src/index.js",
+  "scripts": {
+    "dev": "nodemon --exec tsx src/index.ts",
+    "start": "node --import tsx src/index.ts",
+    "build": "tsc",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "packageManager": "pnpm@10.13.1",
+  "dependencies": {
+    "@ory/client": "^1.15.0",
+    "apollo-server-express": "^3.13.0",
+    "express": "^5.1.0",
+    "graphql": "^16.11.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.3",
+    "@types/node": "^20.19.7",
+    "nodemon": "^3.1.10",
+    "ts-node": "^10.9.2",
+    "tsx": "^4.19.0",
+    "typescript": "^5.8.3"
+  }
+}

services/src/auth/index.ts

@@ -0,0 +1,5 @@
+export {
+  kratosSessionMiddleware,
+  requireAuth,
+  type AuthenticatedRequest,
+} from "../middleware/kratosSession";

services/src/index.ts

@@ -0,0 +1,74 @@
+import express from "express";
+import { ApolloServer } from "apollo-server-express";
+import {
+  kratosSessionMiddleware,
+  AuthenticatedRequest,
+} from "./middleware/kratosSession";
+
+const typeDefs = `
+  type User {
+    id: ID!
+    email: String
+    firstName: String
+    lastName: String
+  }
+
+  type Query {
+    me: User
+    hello: String!
+  }
+`;
+
+interface Traits {
+  email?: string;
+  name?: {
+    first?: string;
+    last?: string;
+  };
+}
+
+const resolvers = {
+  Query: {
+    hello: () => "Hello from Lightsaver API!",
+    me: (_: unknown, __: unknown, context: { req: AuthenticatedRequest }) => {
+      const { session } = context.req;
+
+      if (!session || !session.identity) {
+        return null;
+      }
+
+      const traits = session.identity.traits as Traits;
+
+      return {
+        id: session.identity.id,
+        email: traits.email,
+        firstName: traits.name?.first,
+        lastName: traits.name?.last,
+      };
+    },
+  },
+};
+
+async function startServer() {
+  const app = express();
+
+  app.use(kratosSessionMiddleware);
+
+  const server = new ApolloServer({
+    typeDefs,
+    resolvers,
+    context: ({ req }: { req: AuthenticatedRequest }) => ({ req }),
+  });
+
+  await server.start();
+
+  server.applyMiddleware({ app, path: "/graphql" });
+
+  const port = process.env.PORT || 4000;
+
+  app.listen(port, () => {
+    console.log(`Server running at http://localhost:${port}/graphql`);
+  });
+}
+
+startServer().catch(console.error);

services/src/middleware/kratosSession.ts

@@ -0,0 +1,55 @@
+import { Request, Response, NextFunction } from "express";
+import { Configuration, FrontendApi, Session } from "@ory/client";
+
+const kratosAdminUrl = process.env.KRATOS_ADMIN_URL || "http://localhost:4434";
+
+const kratosClient = new FrontendApi(
+  new Configuration({
+    basePath: kratosAdminUrl,
+  })
+);
+
+export interface AuthenticatedRequest extends Request {
+  session?: Session;
+  userId?: string;
+}
+
+export async function kratosSessionMiddleware(
+  req: AuthenticatedRequest,
+  res: Response,
+  next: NextFunction
+): Promise<void> {
+  const cookie = req.headers.cookie;
+
+  if (!cookie) {
+    next();
+    return;
+  }
+
+  try {
+    const { data: session } = await kratosClient.toSession({
+      cookie,
+    });
+
+    req.session = session;
+    req.userId = session.identity?.id;
+  } catch (error) {
+    // Session invalid or expired - continue without session
+    console.debug("No valid session found:", error);
+  }
+
+  next();
+}
+
+export function requireAuth(
+  req: AuthenticatedRequest,
+  res: Response,
+  next: NextFunction
+): void {
+  if (!req.session || !req.userId) {
+    res.status(401).json({ error: "Unauthorized" });
+    return;
+  }
+
+  next();
+}

turbo.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://turborepo.com/schema.json",
+  "tasks": {
+    "build": {
+      "dependsOn": ["^build"],
+      "outputs": [".next/**", "!.next/cache/**"]
+    },
+    "check-types": {
+      "dependsOn": ["^check-types"]
+    },
+    "dev": {
+      "persistent": true,
+      "cache": false
+    }
+  }
+}