obsidian docs

* Fixed GraphQL codegen

.env.example

@@ -1,17 +0,0 @@
-# PostgreSQL
-POSTGRES_USER=kratos
-POSTGRES_PASSWORD=change_me_to_a_secure_password
-POSTGRES_DB=kratos
-
-# Kratos Secrets (generate with: openssl rand -base64 32)
-KRATOS_SECRETS_COOKIE=change_me_32_char_secret_key_here_1234
-KRATOS_SECRETS_CIPHER=change_me_32_char_cipher_key_here_123
-
-# Kratos Mode
-KRATOS_DEV_MODE=true
-
-# URLs
-KRATOS_PUBLIC_URL=http://localhost:4433
-KRATOS_ADMIN_URL=http://localhost:4434
-NEXT_PUBLIC_KRATOS_PUBLIC_URL=http://localhost:4433
-NEXT_PUBLIC_APP_URL=http://localhost:3000

.gitignore

@@ -1,19 +1,4 @@
 node_modules
 .turbo
 out
-
-# Environment files
-.env
-.env.local
-.env.*.local
-
-# Next.js
-.next
-*.tsbuildinfo
-
-# IDE
-.idea
-.vscode
-
-# OS
-.DS_Store
+.env.*

.npmrc

@@ -0,0 +1 @@
+auto-install-peers=true

LICENSE.txt

@@ -1,661 +0,0 @@
-                    GNU AFFERO GENERAL PUBLIC LICENSE
-                       Version 3, 19 November 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU Affero General Public License is a free, copyleft license for
-software and other kinds of works, specifically designed to ensure
-cooperation with the community in the case of network server software.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-our General Public Licenses are intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  Developers that use our General Public Licenses protect your rights
-with two steps: (1) assert copyright on the software, and (2) offer
-you this License which gives you legal permission to copy, distribute
-and/or modify the software.
-
-  A secondary benefit of defending all users' freedom is that
-improvements made in alternate versions of the program, if they
-receive widespread use, become available for other developers to
-incorporate.  Many developers of free software are heartened and
-encouraged by the resulting cooperation.  However, in the case of
-software used on network servers, this result may fail to come about.
-The GNU General Public License permits making a modified version and
-letting the public access it on a server without ever releasing its
-source code to the public.
-
-  The GNU Affero General Public License is designed specifically to
-ensure that, in such cases, the modified source code becomes available
-to the community.  It requires the operator of a network server to
-provide the source code of the modified version running there to the
-users of that server.  Therefore, public use of a modified version, on
-a publicly accessible server, gives the public access to the source
-code of the modified version.
-
-  An older license, called the Affero General Public License and
-published by Affero, was designed to accomplish similar goals.  This is
-a different license, not a version of the Affero GPL, but Affero has
-released a new version of the Affero GPL which permits relicensing under
-this license.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU Affero General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Remote Network Interaction; Use with the GNU General Public License.
-
-  Notwithstanding any other provision of this License, if you modify the
-Program, your modified version must prominently offer all users
-interacting with it remotely through a computer network (if your version
-supports such interaction) an opportunity to receive the Corresponding
-Source of your version by providing access to the Corresponding Source
-from a network server at no charge, through some standard or customary
-means of facilitating copying of software.  This Corresponding Source
-shall include the Corresponding Source for any work covered by version 3
-of the GNU General Public License that is incorporated pursuant to the
-following paragraph.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the work with which it is combined will remain governed by version
-3 of the GNU General Public License.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU Affero General Public License from time to time.  Such new versions
-will be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU Affero General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU Affero General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU Affero General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU Affero General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU Affero General Public License for more details.
-
-    You should have received a copy of the GNU Affero General Public License
-    along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If your software can interact with users remotely through a computer
-network, you should also make sure that it provides a way for users to
-get its source.  For example, if your program is a web application, its
-interface could display a "Source" link that leads users to an archive
-of the code.  There are many ways you could offer source, and different
-solutions will be better for different programs; see section 13 for
-the specific requirements.
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU AGPL, see
-<https://www.gnu.org/licenses/>.

README.md

@@ -2,116 +2,24 @@
 
 ## Technologies Used
 
-- **Next.js 15**: React 19-based framework for building server-side rendered web applications
-- **GraphQL**: API query language for flexible and efficient data fetching
-- **Express.js**: Fast, unopinionated web framework for Node.js, powering the backend API
-- **Ory Kratos**: Open-source identity and user management system for authentication
-- **PostgreSQL 18**: Relational database for persistent storage
-- **Podman Compose**: Container orchestration for local development and deployment
-- **Turborepo**: Monorepo build system for managing multiple packages
-- **OpenTofu**: FOSS fork of Terraform
-- **RabbitMQ**: Message broker for asynchronous communication and background processing
+- **Next.js**: React-based framework for building server-side rendered and statically generated web applications.
+- **GraphQL**: API query language for flexible and efficient data fetching.
+- **Express.js**: Fast, unopinionated web framework for Node.js, powering the backend API.
+- **PostgreSQL**: Relational database for persistent storage.
+- **Docker**: Containerization for consistent deployment.
+- **Terraform CDKTF**: Infrastructure as Code (IaC) using the Cloud Development Kit for Terraform.
+- **RabbitMQ**: Message broker for asynchronous communication and background processing.
 
-## Project Structure
+## Docker Commands
 
-```text
-lightsaver/
-├── apps/
-│   └── lightsaver_user_client/    # Next.js frontend
-├── services/                       # GraphQL API backend
-├── infrastructure/
-│   └── kratos/                    # Ory Kratos configuration
-├── podman-compose.yaml            # Container orchestration
-└── .env.example                   # Environment variables template
-```
-
-## Getting Started
-
-### Prerequisites
-
-- Node.js 22+
-- pnpm
-- Podman and Podman Compose
-
-### Setup
-
-1. Clone the repository and install dependencies:
-
-   ```sh
-   pnpm install
-   ```
-
-1. Copy the environment file and configure it:
-
-   ```sh
-   cp .env.example .env
-   # Edit .env and set secure values for:
-   # - POSTGRES_PASSWORD
-   # - KRATOS_SECRETS_COOKIE
-   # - KRATOS_SECRETS_CIPHER
-   ```
-
-1. Start all services with Podman Compose:
+To build the Docker image:
 
 ```sh
-podman-compose up
+docker build -t lightsaver-app .
 ```
 
-### Services
-
-| Service | URL | Description |
-|---------|-----|-------------|
-| Frontend | http://localhost:3000 | Next.js user interface |
-| GraphQL API | http://localhost:4000/graphql | Express + Apollo Server |
-| Kratos Public | http://localhost:4433 | Authentication API |
-| Kratos Admin | http://localhost:4434 | Kratos admin API |
-| Mailhog | http://localhost:8025 | Dev email testing UI |
-
-### Authentication
-
-The app uses Ory Kratos for authentication with the following flows:
-
-- **Registration**: `/auth/registration` - Create a new account
-- **Login**: `/auth/login` - Sign in to your account
-- **Recovery**: `/auth/recovery` - Reset forgotten password
-- **Verification**: `/auth/verification` - Verify email address
-- **Settings**: `/auth/settings` - Update account settings
-- **Dashboard**: `/dashboard` - Protected user dashboard
-
-### Development
-
-Run individual services locally:
+To run the container:
 
 ```sh
-# Frontend (Next.js)
-pnpm --filter lightsaver_user_client dev
-
-# Backend (GraphQL API)
-pnpm --filter api dev
-```
-
-## Docker/Podman Commands
-
-Build and run all services:
-
-```sh
-podman-compose up --build
-```
-
-Run in detached mode:
-
-```sh
-podman-compose up -d
-```
-
-Stop all services:
-
-```sh
-podman-compose down
-```
-
-View logs:
-
-```sh
-podman-compose logs -f
+docker run -p 3000:3000 lightsaver-app
 ```

apps/lightsaver_user_client/next.config.ts

@@ -1,18 +1,7 @@
 import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
-  output: "standalone",
-
-  async rewrites() {
-    const kratosUrl =
-      process.env.KRATOS_PUBLIC_URL || "http://localhost:4433";
-    return [
-      {
-        source: "/api/kratos/:path*",
-        destination: `${kratosUrl}/:path*`,
-      },
-    ];
-  },
+  /* config options here */
 };
 
 export default nextConfig;

apps/lightsaver_user_client/package.json

@@ -10,7 +10,6 @@
   },
   "dependencies": {
     "@apollo/client": "^3.13.8",
-    "@ory/client": "^1.15.0",
     "graphql": "^16.11.0",
     "next": "15.3.5",
     "react": "^19.0.0",
@@ -18,6 +17,7 @@
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3",
+    "@eslint/plugin-kit": "^0.3.4",
     "@tailwindcss/postcss": "^4",
     "@types/node": "^20",
     "@types/react": "^19",

apps/lightsaver_user_client/src/app/auth/error/page.tsx

@@ -1,89 +0,0 @@
-"use client";
-
-import { useEffect, useState } from "react";
-import { useSearchParams } from "next/navigation";
-import { FlowError } from "@ory/client";
-import { kratosClient } from "@/lib/kratos/client";
-import Link from "next/link";
-
-export default function ErrorPage() {
-  const [error, setError] = useState<FlowError | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const searchParams = useSearchParams();
-
-  const errorId = searchParams.get("id");
-
-  useEffect(() => {
-    if (!errorId) {
-      setIsLoading(false);
-      return;
-    }
-
-    kratosClient
-      .getFlowError({ id: errorId })
-      .then(({ data }) => {
-        setError(data);
-      })
-      .catch((err) => {
-        console.error("Failed to fetch error:", err);
-      })
-      .finally(() => {
-        setIsLoading(false);
-      });
-  }, [errorId]);
-
-  if (isLoading) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Loading...
-      </div>
-    );
-  }
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-gray-50">
-      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
-        <h1 className="text-2xl font-bold text-center text-red-600">
-          An Error Occurred
-        </h1>
-
-        {error ? (
-          <div className="space-y-4">
-            <div className="p-4 bg-red-50 border border-red-200 rounded-md">
-              <p className="text-sm text-red-700">
-                {typeof error.error === "object" && error.error !== null
-                  ? JSON.stringify(error.error, null, 2)
-                  : String(error.error)}
-              </p>
-            </div>
-
-            {errorId && (
-              <p className="text-xs text-gray-500 text-center">
-                Error ID: {errorId}
-              </p>
-            )}
-          </div>
-        ) : (
-          <p className="text-center text-gray-600">
-            An unknown error occurred. Please try again.
-          </p>
-        )}
-
-        <div className="flex flex-col gap-2">
-          <Link
-            href="/auth/login"
-            className="w-full py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700 text-center"
-          >
-            Go to Login
-          </Link>
-          <Link
-            href="/"
-            className="w-full py-2 px-4 border border-gray-300 text-gray-700 rounded-md hover:bg-gray-50 text-center"
-          >
-            Go to Home
-          </Link>
-        </div>
-      </div>
-    </div>
-  );
-}

apps/lightsaver_user_client/src/app/auth/login/page.tsx

@@ -1,112 +0,0 @@
-"use client";
-
-import { useEffect, useState, useCallback } from "react";
-import { useRouter, useSearchParams } from "next/navigation";
-import { LoginFlow, UpdateLoginFlowBody } from "@ory/client";
-import { kratosClient } from "@/lib/kratos/client";
-import { AuthForm } from "@/components/auth/AuthForm";
-import Link from "next/link";
-
-export default function LoginPage() {
-  const [flow, setFlow] = useState<LoginFlow | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const router = useRouter();
-  const searchParams = useSearchParams();
-
-  const flowId = searchParams.get("flow");
-  const returnTo = searchParams.get("return_to");
-
-  const initializeFlow = useCallback(async () => {
-    try {
-      if (flowId) {
-        const { data } = await kratosClient.getLoginFlow({ id: flowId });
-        setFlow(data);
-      } else {
-        const { data } = await kratosClient.createBrowserLoginFlow({
-          returnTo: returnTo || undefined,
-        });
-        window.history.replaceState(null, "", `?flow=${data.id}`);
-        setFlow(data);
-      }
-    } catch (error: unknown) {
-      const err = error as { response?: { status?: number } };
-      if (err.response?.status === 410) {
-        window.location.href = "/auth/login";
-        return;
-      }
-      console.error("Failed to initialize login flow:", error);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [flowId, returnTo]);
-
-  useEffect(() => {
-    initializeFlow();
-  }, [initializeFlow]);
-
-  const handleSubmit = async (values: Record<string, unknown>) => {
-    if (!flow) return;
-
-    try {
-      await kratosClient.updateLoginFlow({
-        flow: flow.id,
-        updateLoginFlowBody: values as UpdateLoginFlowBody,
-      });
-
-      router.push(returnTo || "/dashboard");
-    } catch (error: unknown) {
-      const err = error as { response?: { status?: number; data?: LoginFlow } };
-      if (err.response?.status === 400 && err.response.data) {
-        setFlow(err.response.data);
-      } else if (err.response?.status === 410) {
-        window.location.href = "/auth/login";
-      } else {
-        console.error("Login error:", error);
-      }
-    }
-  };
-
-  if (isLoading) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Loading...
-      </div>
-    );
-  }
-
-  if (!flow) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Error loading login flow
-      </div>
-    );
-  }
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-gray-50">
-      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
-        <h1 className="text-2xl font-bold text-center">Sign In</h1>
-        <AuthForm flow={flow} onSubmit={handleSubmit} submitLabel="Sign In" />
-        <div className="text-center text-sm text-gray-600 space-y-2">
-          <p>
-            Don&apos;t have an account?{" "}
-            <Link
-              href="/auth/registration"
-              className="text-blue-600 hover:underline"
-            >
-              Sign up
-            </Link>
-          </p>
-          <p>
-            <Link
-              href="/auth/recovery"
-              className="text-blue-600 hover:underline"
-            >
-              Forgot your password?
-            </Link>
-          </p>
-        </div>
-      </div>
-    </div>
-  );
-}

apps/lightsaver_user_client/src/app/auth/logout/route.ts

@@ -1,21 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { kratosClient } from "@/lib/kratos/client";
-
-export async function GET(request: NextRequest) {
-  const cookie = request.headers.get("cookie") || "";
-
-  try {
-    const { data } = await kratosClient.createBrowserLogoutFlow({
-      cookie,
-    });
-
-    return NextResponse.redirect(data.logout_url);
-  } catch (error) {
-    console.error("Logout error:", error);
-    return NextResponse.redirect(new URL("/", request.url));
-  }
-}
-
-export async function POST(request: NextRequest) {
-  return GET(request);
-}

apps/lightsaver_user_client/src/app/auth/recovery/page.tsx

@@ -1,128 +0,0 @@
-"use client";
-
-import { useEffect, useState, useCallback } from "react";
-import { useSearchParams } from "next/navigation";
-import { RecoveryFlow, UpdateRecoveryFlowBody } from "@ory/client";
-import { kratosClient } from "@/lib/kratos/client";
-import { AuthForm } from "@/components/auth/AuthForm";
-import Link from "next/link";
-
-export default function RecoveryPage() {
-  const [flow, setFlow] = useState<RecoveryFlow | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const [success, setSuccess] = useState(false);
-  const searchParams = useSearchParams();
-
-  const flowId = searchParams.get("flow");
-
-  const initializeFlow = useCallback(async () => {
-    try {
-      if (flowId) {
-        const { data } = await kratosClient.getRecoveryFlow({ id: flowId });
-        setFlow(data);
-      } else {
-        const { data } = await kratosClient.createBrowserRecoveryFlow();
-        window.history.replaceState(null, "", `?flow=${data.id}`);
-        setFlow(data);
-      }
-    } catch (error: unknown) {
-      const err = error as { response?: { status?: number } };
-      if (err.response?.status === 410) {
-        window.location.href = "/auth/recovery";
-        return;
-      }
-      console.error("Failed to initialize recovery flow:", error);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [flowId]);
-
-  useEffect(() => {
-    initializeFlow();
-  }, [initializeFlow]);
-
-  const handleSubmit = async (values: Record<string, unknown>) => {
-    if (!flow) return;
-
-    try {
-      const { data } = await kratosClient.updateRecoveryFlow({
-        flow: flow.id,
-        updateRecoveryFlowBody: values as UpdateRecoveryFlowBody,
-      });
-
-      setFlow(data);
-
-      if (data.state === "passed_challenge") {
-        setSuccess(true);
-      }
-    } catch (error: unknown) {
-      const err = error as {
-        response?: { status?: number; data?: RecoveryFlow };
-      };
-      if (err.response?.status === 400 && err.response.data) {
-        setFlow(err.response.data);
-      } else if (err.response?.status === 410) {
-        window.location.href = "/auth/recovery";
-      } else {
-        console.error("Recovery error:", error);
-      }
-    }
-  };
-
-  if (isLoading) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Loading...
-      </div>
-    );
-  }
-
-  if (!flow) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Error loading recovery flow
-      </div>
-    );
-  }
-
-  if (success) {
-    return (
-      <div className="min-h-screen flex items-center justify-center bg-gray-50">
-        <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md text-center">
-          <h1 className="text-2xl font-bold">Recovery Successful</h1>
-          <p className="text-gray-600">
-            You can now set a new password in your account settings.
-          </p>
-          <Link
-            href="/auth/settings"
-            className="inline-block py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700"
-          >
-            Go to Settings
-          </Link>
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-gray-50">
-      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
-        <h1 className="text-2xl font-bold text-center">Recover Your Account</h1>
-        <p className="text-center text-gray-600">
-          Enter your email address and we&apos;ll send you a recovery code.
-        </p>
-        <AuthForm
-          flow={flow}
-          onSubmit={handleSubmit}
-          submitLabel="Send Recovery Code"
-        />
-        <p className="text-center text-sm text-gray-600">
-          Remember your password?{" "}
-          <Link href="/auth/login" className="text-blue-600 hover:underline">
-            Sign in
-          </Link>
-        </p>
-      </div>
-    </div>
-  );
-}

apps/lightsaver_user_client/src/app/auth/registration/page.tsx

@@ -1,105 +0,0 @@
-"use client";
-
-import { useEffect, useState, useCallback } from "react";
-import { useRouter, useSearchParams } from "next/navigation";
-import { RegistrationFlow, UpdateRegistrationFlowBody } from "@ory/client";
-import { kratosClient } from "@/lib/kratos/client";
-import { AuthForm } from "@/components/auth/AuthForm";
-import Link from "next/link";
-
-export default function RegistrationPage() {
-  const [flow, setFlow] = useState<RegistrationFlow | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const router = useRouter();
-  const searchParams = useSearchParams();
-
-  const flowId = searchParams.get("flow");
-  const returnTo = searchParams.get("return_to");
-
-  const initializeFlow = useCallback(async () => {
-    try {
-      if (flowId) {
-        const { data } = await kratosClient.getRegistrationFlow({ id: flowId });
-        setFlow(data);
-      } else {
-        const { data } = await kratosClient.createBrowserRegistrationFlow({
-          returnTo: returnTo || undefined,
-        });
-        window.history.replaceState(null, "", `?flow=${data.id}`);
-        setFlow(data);
-      }
-    } catch (error: unknown) {
-      const err = error as { response?: { status?: number } };
-      if (err.response?.status === 410) {
-        window.location.href = "/auth/registration";
-        return;
-      }
-      console.error("Failed to initialize registration flow:", error);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [flowId, returnTo]);
-
-  useEffect(() => {
-    initializeFlow();
-  }, [initializeFlow]);
-
-  const handleSubmit = async (values: Record<string, unknown>) => {
-    if (!flow) return;
-
-    try {
-      await kratosClient.updateRegistrationFlow({
-        flow: flow.id,
-        updateRegistrationFlowBody: values as UpdateRegistrationFlowBody,
-      });
-
-      router.push(returnTo || "/dashboard");
-    } catch (error: unknown) {
-      const err = error as {
-        response?: { status?: number; data?: RegistrationFlow };
-      };
-      if (err.response?.status === 400 && err.response.data) {
-        setFlow(err.response.data);
-      } else if (err.response?.status === 410) {
-        window.location.href = "/auth/registration";
-      } else {
-        console.error("Registration error:", error);
-      }
-    }
-  };
-
-  if (isLoading) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Loading...
-      </div>
-    );
-  }
-
-  if (!flow) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Error loading registration flow
-      </div>
-    );
-  }
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-gray-50">
-      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
-        <h1 className="text-2xl font-bold text-center">Create Account</h1>
-        <AuthForm
-          flow={flow}
-          onSubmit={handleSubmit}
-          submitLabel="Create Account"
-        />
-        <p className="text-center text-sm text-gray-600">
-          Already have an account?{" "}
-          <Link href="/auth/login" className="text-blue-600 hover:underline">
-            Sign in
-          </Link>
-        </p>
-      </div>
-    </div>
-  );
-}

apps/lightsaver_user_client/src/app/auth/settings/page.tsx

@@ -1,118 +0,0 @@
-"use client";
-
-import { useEffect, useState, useCallback } from "react";
-import { useSearchParams } from "next/navigation";
-import { SettingsFlow, UpdateSettingsFlowBody } from "@ory/client";
-import { kratosClient } from "@/lib/kratos/client";
-import { AuthForm } from "@/components/auth/AuthForm";
-import Link from "next/link";
-
-export default function SettingsPage() {
-  const [flow, setFlow] = useState<SettingsFlow | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const [success, setSuccess] = useState(false);
-  const searchParams = useSearchParams();
-
-  const flowId = searchParams.get("flow");
-
-  const initializeFlow = useCallback(async () => {
-    try {
-      if (flowId) {
-        const { data } = await kratosClient.getSettingsFlow({ id: flowId });
-        setFlow(data);
-      } else {
-        const { data } = await kratosClient.createBrowserSettingsFlow();
-        window.history.replaceState(null, "", `?flow=${data.id}`);
-        setFlow(data);
-      }
-    } catch (error: unknown) {
-      const err = error as { response?: { status?: number } };
-      if (err.response?.status === 410) {
-        window.location.href = "/auth/settings";
-        return;
-      }
-      if (err.response?.status === 401) {
-        window.location.href = "/auth/login?return_to=/auth/settings";
-        return;
-      }
-      console.error("Failed to initialize settings flow:", error);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [flowId]);
-
-  useEffect(() => {
-    initializeFlow();
-  }, [initializeFlow]);
-
-  const handleSubmit = async (values: Record<string, unknown>) => {
-    if (!flow) return;
-
-    try {
-      const { data } = await kratosClient.updateSettingsFlow({
-        flow: flow.id,
-        updateSettingsFlowBody: values as UpdateSettingsFlowBody,
-      });
-
-      setFlow(data);
-      setSuccess(true);
-
-      setTimeout(() => setSuccess(false), 3000);
-    } catch (error: unknown) {
-      const err = error as {
-        response?: { status?: number; data?: SettingsFlow };
-      };
-      if (err.response?.status === 400 && err.response.data) {
-        setFlow(err.response.data);
-      } else if (err.response?.status === 410) {
-        window.location.href = "/auth/settings";
-      } else if (err.response?.status === 401) {
-        window.location.href = "/auth/login?return_to=/auth/settings";
-      } else {
-        console.error("Settings error:", error);
-      }
-    }
-  };
-
-  if (isLoading) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Loading...
-      </div>
-    );
-  }
-
-  if (!flow) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Error loading settings flow
-      </div>
-    );
-  }
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-gray-50">
-      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
-        <h1 className="text-2xl font-bold text-center">Account Settings</h1>
-
-        {success && (
-          <div className="p-3 bg-green-50 text-green-700 border border-green-200 rounded-md text-sm">
-            Settings updated successfully!
-          </div>
-        )}
-
-        <AuthForm
-          flow={flow}
-          onSubmit={handleSubmit}
-          submitLabel="Update Settings"
-        />
-
-        <p className="text-center text-sm text-gray-600">
-          <Link href="/dashboard" className="text-blue-600 hover:underline">
-            Back to Dashboard
-          </Link>
-        </p>
-      </div>
-    </div>
-  );
-}

apps/lightsaver_user_client/src/app/auth/verification/page.tsx

@@ -1,130 +0,0 @@
-"use client";
-
-import { useEffect, useState, useCallback } from "react";
-import { useSearchParams } from "next/navigation";
-import { VerificationFlow, UpdateVerificationFlowBody } from "@ory/client";
-import { kratosClient } from "@/lib/kratos/client";
-import { AuthForm } from "@/components/auth/AuthForm";
-import Link from "next/link";
-
-export default function VerificationPage() {
-  const [flow, setFlow] = useState<VerificationFlow | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const [success, setSuccess] = useState(false);
-  const searchParams = useSearchParams();
-
-  const flowId = searchParams.get("flow");
-
-  const initializeFlow = useCallback(async () => {
-    try {
-      if (flowId) {
-        const { data } = await kratosClient.getVerificationFlow({ id: flowId });
-        setFlow(data);
-
-        if (data.state === "passed_challenge") {
-          setSuccess(true);
-        }
-      } else {
-        const { data } = await kratosClient.createBrowserVerificationFlow();
-        window.history.replaceState(null, "", `?flow=${data.id}`);
-        setFlow(data);
-      }
-    } catch (error: unknown) {
-      const err = error as { response?: { status?: number } };
-      if (err.response?.status === 410) {
-        window.location.href = "/auth/verification";
-        return;
-      }
-      console.error("Failed to initialize verification flow:", error);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [flowId]);
-
-  useEffect(() => {
-    initializeFlow();
-  }, [initializeFlow]);
-
-  const handleSubmit = async (values: Record<string, unknown>) => {
-    if (!flow) return;
-
-    try {
-      const { data } = await kratosClient.updateVerificationFlow({
-        flow: flow.id,
-        updateVerificationFlowBody: values as UpdateVerificationFlowBody,
-      });
-
-      setFlow(data);
-
-      if (data.state === "passed_challenge") {
-        setSuccess(true);
-      }
-    } catch (error: unknown) {
-      const err = error as {
-        response?: { status?: number; data?: VerificationFlow };
-      };
-      if (err.response?.status === 400 && err.response.data) {
-        setFlow(err.response.data);
-      } else if (err.response?.status === 410) {
-        window.location.href = "/auth/verification";
-      } else {
-        console.error("Verification error:", error);
-      }
-    }
-  };
-
-  if (isLoading) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Loading...
-      </div>
-    );
-  }
-
-  if (!flow) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Error loading verification flow
-      </div>
-    );
-  }
-
-  if (success) {
-    return (
-      <div className="min-h-screen flex items-center justify-center bg-gray-50">
-        <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md text-center">
-          <h1 className="text-2xl font-bold text-green-600">Email Verified!</h1>
-          <p className="text-gray-600">
-            Your email address has been successfully verified.
-          </p>
-          <Link
-            href="/dashboard"
-            className="inline-block py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700"
-          >
-            Go to Dashboard
-          </Link>
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-gray-50">
-      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
-        <h1 className="text-2xl font-bold text-center">Verify Your Email</h1>
-        <p className="text-center text-gray-600">
-          Enter the verification code sent to your email address.
-        </p>
-        <AuthForm flow={flow} onSubmit={handleSubmit} submitLabel="Verify" />
-        <p className="text-center text-sm text-gray-600">
-          <Link
-            href="/dashboard"
-            className="text-blue-600 hover:underline"
-          >
-            Skip for now
-          </Link>
-        </p>
-      </div>
-    </div>
-  );
-}

apps/lightsaver_user_client/src/app/dashboard/page.tsx

@@ -1,113 +0,0 @@
-"use client";
-
-import { useSession } from "@/lib/hooks/useSession";
-import Link from "next/link";
-
-export default function DashboardPage() {
-  const { session, identity, isLoading, isAuthenticated } = useSession();
-
-  if (isLoading) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        Loading...
-      </div>
-    );
-  }
-
-  if (!isAuthenticated || !identity) {
-    return (
-      <div className="flex justify-center items-center min-h-screen">
-        <div className="text-center">
-          <p className="mb-4">You need to be logged in to view this page.</p>
-          <Link
-            href="/auth/login"
-            className="text-blue-600 hover:underline"
-          >
-            Go to Login
-          </Link>
-        </div>
-      </div>
-    );
-  }
-
-  const traits = identity.traits as {
-    email?: string;
-    name?: { first?: string; last?: string };
-  };
-
-  return (
-    <div className="min-h-screen bg-gray-50">
-      <header className="bg-white shadow">
-        <div className="max-w-7xl mx-auto px-4 py-6 sm:px-6 lg:px-8 flex justify-between items-center">
-          <h1 className="text-3xl font-bold text-gray-900">Dashboard</h1>
-          <div className="flex items-center gap-4">
-            <Link
-              href="/auth/settings"
-              className="text-gray-600 hover:text-gray-900"
-            >
-              Settings
-            </Link>
-            <Link
-              href="/auth/logout"
-              className="py-2 px-4 bg-gray-200 text-gray-700 rounded-md hover:bg-gray-300"
-            >
-              Logout
-            </Link>
-          </div>
-        </div>
-      </header>
-
-      <main className="max-w-7xl mx-auto px-4 py-6 sm:px-6 lg:px-8">
-        <div className="bg-white rounded-lg shadow p-6">
-          <h2 className="text-xl font-semibold mb-4">
-            Welcome, {traits.name?.first || "User"}!
-          </h2>
-
-          <div className="space-y-4">
-            <div>
-              <h3 className="text-sm font-medium text-gray-500">Email</h3>
-              <p className="text-gray-900">{traits.email}</p>
-            </div>
-
-            <div>
-              <h3 className="text-sm font-medium text-gray-500">Full Name</h3>
-              <p className="text-gray-900">
-                {traits.name?.first} {traits.name?.last}
-              </p>
-            </div>
-
-            <div>
-              <h3 className="text-sm font-medium text-gray-500">User ID</h3>
-              <p className="text-gray-900 font-mono text-sm">{identity.id}</p>
-            </div>
-
-            <div>
-              <h3 className="text-sm font-medium text-gray-500">
-                Session Expires
-              </h3>
-              <p className="text-gray-900">
-                {session?.expires_at
-                  ? new Date(session.expires_at).toLocaleString()
-                  : "N/A"}
-              </p>
-            </div>
-
-            {!identity.verifiable_addresses?.[0]?.verified && (
-              <div className="p-4 bg-yellow-50 border border-yellow-200 rounded-md">
-                <p className="text-yellow-700 text-sm">
-                  Your email is not verified.{" "}
-                  <Link
-                    href="/auth/verification"
-                    className="font-medium underline"
-                  >
-                    Verify now
-                  </Link>
-                </p>
-              </div>
-            )}
-          </div>
-        </div>
-      </main>
-    </div>
-  );
-}

apps/lightsaver_user_client/src/app/login/login.module.css

@@ -0,0 +1,22 @@
+.heading {
+  font-size: 24px;
+  color: white;
+  margin-bottom: 20px;
+}
+.loginInput {
+  margin-bottom: 12px;
+  border: white 1px solid;
+}
+
+.submitButton {
+  background-color: #4CAF50; /* Green */
+  border: none;
+  color: white;
+  padding: 10px 20px;
+  text-align: center;
+  text-decoration: none;
+  display: inline-block;
+  font-size: 16px;
+  margin: 4px 2px;
+  cursor: pointer;
+}

apps/lightsaver_user_client/src/app/login/page.tsx

@@ -0,0 +1,38 @@
+"use client";
+import styles from "./login.module.css";
+import { useState } from "react";
+
+export default function LoginPage() {
+  const [username, setUsername] = useState("");
+  const [password, setPassword] = useState("");
+
+  function handleSubmit(e: React.MouseEvent<HTMLButtonElement>) {
+      e.preventDefault();
+      
+  };
+
+  return (
+    <div>
+      <h1 className={styles.heading}>Login</h1>
+      <form>
+        <label>
+          Username:
+          <input className={styles.loginInput} type="text" name="username" value={username} onChange={(e) => setUsername(e.target.value)} />
+        </label>
+        <br />
+        <label>
+          Password:
+          <input
+            className={styles.loginInput}
+            type="password"
+                      name="password"
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+          />
+        </label>
+        <br />
+        <button className={styles.submitButton} type="submit" onClick={handleSubmit}>Submit</button>
+      </form>
+    </div>
+  );
+}

apps/lightsaver_user_client/src/components/auth/AuthForm.tsx

@@ -1,146 +0,0 @@
-"use client";
-
-import { UiNode, UiNodeInputAttributes, UiText } from "@ory/client";
-import { useState } from "react";
-
-interface FlowUI {
-  nodes: UiNode[];
-  action: string;
-  method: string;
-  messages?: UiText[];
-}
-
-interface AuthFormProps {
-  flow: { ui: FlowUI };
-  onSubmit: (values: Record<string, unknown>) => Promise<void>;
-  submitLabel: string;
-}
-
-function getInputType(attrs: UiNodeInputAttributes): string {
-  if (attrs.type === "hidden") return "hidden";
-  if (attrs.type === "submit") return "submit";
-  if (attrs.type === "email") return "email";
-  if (attrs.type === "password") return "password";
-  return attrs.type || "text";
-}
-
-export function AuthForm({ flow, onSubmit, submitLabel }: AuthFormProps) {
-  const [isSubmitting, setIsSubmitting] = useState(false);
-
-  const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
-    e.preventDefault();
-    setIsSubmitting(true);
-
-    const formData = new FormData(e.currentTarget);
-    const values: Record<string, unknown> = {};
-
-    formData.forEach((value, key) => {
-      values[key] = value;
-    });
-
-    try {
-      await onSubmit(values);
-    } finally {
-      setIsSubmitting(false);
-    }
-  };
-
-  const renderNode = (node: UiNode, index: number) => {
-    if (node.type !== "input") return null;
-
-    const attrs = node.attributes as UiNodeInputAttributes;
-    const inputType = getInputType(attrs);
-
-    if (inputType === "hidden") {
-      return (
-        <input
-          key={index}
-          type="hidden"
-          name={attrs.name}
-          value={(attrs.value as string) ?? ""}
-        />
-      );
-    }
-
-    if (inputType === "submit") {
-      return (
-        <button
-          key={index}
-          type="submit"
-          name={attrs.name}
-          value={(attrs.value as string) ?? ""}
-          disabled={isSubmitting || attrs.disabled}
-          className="w-full py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-        >
-          {isSubmitting ? "Loading..." : submitLabel}
-        </button>
-      );
-    }
-
-    const hasError = node.messages?.some((m) => m.type === "error");
-
-    return (
-      <div key={index} className="space-y-1">
-        <label htmlFor={attrs.name} className="block text-sm font-medium">
-          {node.meta.label?.text || attrs.name}
-        </label>
-        <input
-          id={attrs.name}
-          type={inputType}
-          name={attrs.name}
-          defaultValue={(attrs.value as string) ?? ""}
-          required={attrs.required}
-          disabled={attrs.disabled || isSubmitting}
-          autoComplete={attrs.autocomplete}
-          className={`w-full px-3 py-2 border rounded-md focus:outline-none focus:ring-2 disabled:opacity-50 ${
-            hasError
-              ? "border-red-500 focus:ring-red-500"
-              : "border-gray-300 focus:ring-blue-500"
-          }`}
-        />
-        {node.messages?.map((message, msgIndex) => (
-          <p
-            key={msgIndex}
-            className={`text-sm ${
-              message.type === "error" ? "text-red-600" : "text-gray-600"
-            }`}
-          >
-            {message.text}
-          </p>
-        ))}
-      </div>
-    );
-  };
-
-  const inputNodes = flow.ui.nodes.filter(
-    (node) =>
-      node.type === "input" &&
-      (node.group === "default" || node.group === "password")
-  );
-
-  const submitNodes = flow.ui.nodes.filter(
-    (node) =>
-      node.type === "input" &&
-      (node.attributes as UiNodeInputAttributes).type === "submit"
-  );
-
-  return (
-    <form onSubmit={handleSubmit} className="space-y-4">
-      {flow.ui.messages?.map((message, index) => (
-        <div
-          key={index}
-          className={`p-3 rounded-md text-sm ${
-            message.type === "error"
-              ? "bg-red-50 text-red-700 border border-red-200"
-              : "bg-blue-50 text-blue-700 border border-blue-200"
-          }`}
-        >
-          {message.text}
-        </div>
-      ))}
-
-      {inputNodes.map(renderNode)}
-      {submitNodes.map(renderNode)}
-    </form>
-  );
-}

apps/lightsaver_user_client/src/lib/hooks/useSession.ts

@@ -1,49 +0,0 @@
-"use client";
-
-import { useEffect, useState, useCallback } from "react";
-import { Session, Identity } from "@ory/client";
-import { kratosClient } from "@/lib/kratos/client";
-
-interface UseSessionResult {
-  session: Session | null;
-  identity: Identity | null;
-  isLoading: boolean;
-  error: Error | null;
-  isAuthenticated: boolean;
-  refetch: () => Promise<void>;
-}
-
-export function useSession(): UseSessionResult {
-  const [session, setSession] = useState<Session | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const [error, setError] = useState<Error | null>(null);
-
-  const fetchSession = useCallback(async () => {
-    try {
-      setIsLoading(true);
-      const { data } = await kratosClient.toSession();
-      setSession(data);
-      setError(null);
-    } catch (err) {
-      setSession(null);
-      if (err instanceof Error) {
-        setError(err);
-      }
-    } finally {
-      setIsLoading(false);
-    }
-  }, []);
-
-  useEffect(() => {
-    fetchSession();
-  }, [fetchSession]);
-
-  return {
-    session,
-    identity: session?.identity ?? null,
-    isLoading,
-    error,
-    isAuthenticated: !!session,
-    refetch: fetchSession,
-  };
-}

apps/lightsaver_user_client/src/lib/kratos/client.ts

@@ -1,22 +0,0 @@
-import { Configuration, FrontendApi } from "@ory/client";
-
-const kratosPublicUrl =
-  process.env.NEXT_PUBLIC_KRATOS_PUBLIC_URL || "http://localhost:4433";
-
-export const kratosClient = new FrontendApi(
-  new Configuration({
-    basePath: kratosPublicUrl,
-    baseOptions: {
-      withCredentials: true,
-    },
-  })
-);
-
-export function createServerKratosClient(baseUrl?: string) {
-  const url = baseUrl || process.env.KRATOS_ADMIN_URL || "http://localhost:4434";
-  return new FrontendApi(
-    new Configuration({
-      basePath: url,
-    })
-  );
-}

apps/lightsaver_user_client/src/middleware.ts

@@ -1,70 +0,0 @@
-import { NextResponse } from "next/server";
-import type { NextRequest } from "next/server";
-
-const protectedRoutes = ["/dashboard", "/auth/settings"];
-const authRoutes = ["/auth/login", "/auth/registration"];
-
-export async function middleware(request: NextRequest) {
-  const { pathname } = request.nextUrl;
-
-  const sessionCookie = request.cookies.get("lightsaver_session");
-
-  if (protectedRoutes.some((route) => pathname.startsWith(route))) {
-    if (!sessionCookie) {
-      const loginUrl = new URL("/auth/login", request.url);
-      loginUrl.searchParams.set("return_to", pathname);
-      return NextResponse.redirect(loginUrl);
-    }
-
-    try {
-      const kratosUrl =
-        process.env.KRATOS_PUBLIC_URL || "http://localhost:4433";
-      const response = await fetch(`${kratosUrl}/sessions/whoami`, {
-        headers: {
-          Cookie: `lightsaver_session=${sessionCookie.value}`,
-        },
-      });
-
-      if (!response.ok) {
-        const loginUrl = new URL("/auth/login", request.url);
-        loginUrl.searchParams.set("return_to", pathname);
-        return NextResponse.redirect(loginUrl);
-      }
-    } catch (error) {
-      console.error("Session verification failed:", error);
-      const loginUrl = new URL("/auth/login", request.url);
-      return NextResponse.redirect(loginUrl);
-    }
-  }
-
-  if (authRoutes.some((route) => pathname.startsWith(route))) {
-    if (sessionCookie) {
-      try {
-        const kratosUrl =
-          process.env.KRATOS_PUBLIC_URL || "http://localhost:4433";
-        const response = await fetch(`${kratosUrl}/sessions/whoami`, {
-          headers: {
-            Cookie: `lightsaver_session=${sessionCookie.value}`,
-          },
-        });
-
-        if (response.ok) {
-          return NextResponse.redirect(new URL("/dashboard", request.url));
-        }
-      } catch {
-        // Session invalid, allow access to auth pages
-      }
-    }
-  }
-
-  return NextResponse.next();
-}
-
-export const config = {
-  matcher: [
-    "/dashboard/:path*",
-    "/auth/settings/:path*",
-    "/auth/login",
-    "/auth/registration",
-  ],
-};

ci_cd/utils/db_docker_config/Dockerfile

@@ -0,0 +1,110 @@
+FROM debian:bookworm-slim
+
+# explicitly set user/group IDs
+RUN set -eux; \
+	groupadd -r postgres --gid=999; \
+	useradd -r -g postgres --uid=999 --home-dir=/var/lib/postgresql --shell=/bin/bash postgres; \
+	install --verbose --directory --owner postgres --group postgres --mode 1777 /var/lib/postgresql
+
+RUN set -ex; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		gnupg \
+		less \
+	; \
+	rm -rf /var/lib/apt/lists/*
+
+# grab gosu for easy step-down from root
+ENV GOSU_VERSION=1.17
+RUN set -eux; \
+	savedAptMark="$(apt-mark showmanual)"; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends ca-certificates wget; \
+	rm -rf /var/lib/apt/lists/*; \
+	dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
+	wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
+	wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
+	export GNUPGHOME="$(mktemp -d)"; \
+	gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
+	gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
+	apt-mark auto '.*' > /dev/null; \
+	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	chmod +x /usr/local/bin/gosu; \
+	gosu --version; \
+	gosu nobody true
+
+# make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default
+RUN set -eux; \
+	if [ -f /etc/dpkg/dpkg.cfg.d/docker ]; then \
+		grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
+		sed -ri '/\/usr\/share\/locale/d' /etc/dpkg/dpkg.cfg.d/docker; \
+		! grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
+	fi; \
+	apt-get update; apt-get install -y --no-install-recommends locales; rm -rf /var/lib/apt/lists/*; \
+	echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen; \
+	locale-gen; \
+	locale -a | grep 'en_US.utf8'
+ENV LANG=en_US.utf8
+
+RUN set -eux; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		libnss-wrapper \
+		xz-utils \
+		zstd \
+	; \
+	rm -rf /var/lib/apt/lists/*
+
+RUN mkdir /docker-entrypoint-initdb.d
+
+RUN set -ex; \
+	key='B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8'; \
+	export GNUPGHOME="$(mktemp -d)"; \
+	mkdir -p /usr/local/share/keyrings/; \
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+	gpg --batch --export --armor "$key" > /usr/local/share/keyrings/postgres.gpg.asc; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME"
+
+ENV PG_MAJOR=17
+ENV PATH=$PATH:/usr/lib/postgresql/17/bin
+ENV PG_VERSION=17.5
+
+RUN set -ex; \
+	dpkgArch="$(dpkg --print-architecture)"; \
+	echo "deb [ signed-by=/usr/local/share/keyrings/postgres.gpg.asc ] http://apt.postgresql.org/pub/repos/apt/ bookworm-pgdg main 17" > /etc/apt/sources.list.d/pgdg.list; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends postgresql-common; \
+	sed -ri 's/#(create_main_cluster) .*$/\1 = false/' /etc/postgresql-common/createcluster.conf; \
+	apt-get install -y --no-install-recommends \
+		"postgresql-17" \
+	; \
+	rm -rf /var/lib/apt/lists/*; \
+	find /usr -name '*.pyc' -type f -exec bash -c 'for pyc; do dpkg -S "$pyc" &> /dev/null || rm -vf "$pyc"; done' -- '{}' +; \
+	postgres --version
+
+# make the sample config easier to munge (and "correct by default")
+RUN set -eux; \
+	dpkg-divert --add --rename --divert "/usr/share/postgresql/postgresql.conf.sample.dpkg" "/usr/share/postgresql/17/postgresql.conf.sample"; \
+	cp -v /usr/share/postgresql/postgresql.conf.sample.dpkg /usr/share/postgresql/postgresql.conf.sample; \
+	ln -sv ../postgresql.conf.sample "/usr/share/postgresql/17/"; \
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" /usr/share/postgresql/postgresql.conf.sample; \
+	grep -F "listen_addresses = '*'" /usr/share/postgresql/postgresql.conf.sample
+
+RUN install --verbose --directory --owner postgres --group postgres --mode 3777 /var/run/postgresql
+
+ENV PGDATA=/var/lib/postgresql/data
+RUN install --verbose --directory --owner postgres --group postgres --mode 1777 "$PGDATA"
+VOLUME /var/lib/postgresql/data
+
+COPY docker-entrypoint.sh docker-ensure-initdb.sh /usr/local/bin/
+RUN ln -sT docker-ensure-initdb.sh /usr/local/bin/docker-enforce-initdb.sh
+ENTRYPOINT ["docker-entrypoint.sh"]
+
+STOPSIGNAL SIGINT
+
+EXPOSE 5432
+CMD ["postgres"]

ci_cd/utils/db_docker_config/docker-ensure-initdb.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+#
+# This script is intended for three main use cases:
+#
+#  1. (most importantly) as an example of how to use "docker-entrypoint.sh" to extend/reuse the initialization behavior
+#
+#  2. ("docker-ensure-initdb.sh") as a Kubernetes "init container" to ensure the provided database directory is initialized; see also "startup probes" for an alternative solution
+#       (no-op if database is already initialized)
+#
+#  3. ("docker-enforce-initdb.sh") as part of CI to ensure the database is fully initialized before use
+#       (error if database is already initialized)
+#
+
+source /usr/local/bin/docker-entrypoint.sh
+
+# arguments to this script are assumed to be arguments to the "postgres" server (same as "docker-entrypoint.sh"), and most "docker-entrypoint.sh" functions assume "postgres" is the first argument (see "_main" over there)
+if [ "$#" -eq 0 ] || [ "$1" != 'postgres' ]; then
+	set -- postgres "$@"
+fi
+
+# see also "_main" in "docker-entrypoint.sh"
+
+docker_setup_env
+# setup data directories and permissions (when run as root)
+docker_create_db_directories
+if [ "$(id -u)" = '0' ]; then
+	# then restart script as postgres user
+	exec gosu postgres "$BASH_SOURCE" "$@"
+fi
+
+# only run initialization on an empty data directory
+if [ -z "$DATABASE_ALREADY_EXISTS" ]; then
+	docker_verify_minimum_env
+	docker_error_old_databases
+
+	# check dir permissions to reduce likelihood of half-initialized database
+	ls /docker-entrypoint-initdb.d/ > /dev/null
+
+	docker_init_database_dir
+	pg_setup_hba_conf "$@"
+
+	# PGPASSWORD is required for psql when authentication is required for 'local' connections via pg_hba.conf and is otherwise harmless
+	# e.g. when '--auth=md5' or '--auth-local=md5' is used in POSTGRES_INITDB_ARGS
+	export PGPASSWORD="${PGPASSWORD:-$POSTGRES_PASSWORD}"
+	docker_temp_server_start "$@"
+
+	docker_setup_db
+	docker_process_init_files /docker-entrypoint-initdb.d/*
+
+	docker_temp_server_stop
+	unset PGPASSWORD
+else
+	self="$(basename "$0")"
+	case "$self" in
+		docker-ensure-initdb.sh)
+			echo >&2 "$self: note: database already initialized in '$PGDATA'!"
+			exit 0
+			;;
+
+		docker-enforce-initdb.sh)
+			echo >&2 "$self: error: (unexpected) database found in '$PGDATA'!"
+			exit 1
+			;;
+
+		*)
+			echo >&2 "$self: error: unknown file name: $self"
+			exit 99
+			;;
+	esac
+fi

ci_cd/utils/db_docker_config/docker-entrypoint.sh

@@ -0,0 +1,391 @@
+#!/usr/bin/env bash
+set -Eeo pipefail
+# TODO swap to -Eeuo pipefail above (after handling all potentially-unset variables)
+
+# usage: file_env VAR [DEFAULT]
+#    ie: file_env 'XYZ_DB_PASSWORD' 'example'
+# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
+#  "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
+file_env() {
+	local var="$1"
+	local fileVar="${var}_FILE"
+	local def="${2:-}"
+	if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+		printf >&2 'error: both %s and %s are set (but are exclusive)\n' "$var" "$fileVar"
+		exit 1
+	fi
+	local val="$def"
+	if [ "${!var:-}" ]; then
+		val="${!var}"
+	elif [ "${!fileVar:-}" ]; then
+		val="$(< "${!fileVar}")"
+	fi
+	export "$var"="$val"
+	unset "$fileVar"
+}
+
+# check to see if this file is being run or sourced from another script
+_is_sourced() {
+	# https://unix.stackexchange.com/a/215279
+	[ "${#FUNCNAME[@]}" -ge 2 ] \
+		&& [ "${FUNCNAME[0]}" = '_is_sourced' ] \
+		&& [ "${FUNCNAME[1]}" = 'source' ]
+}
+
+# used to create initial postgres directories and if run as root, ensure ownership to the "postgres" user
+docker_create_db_directories() {
+	local user; user="$(id -u)"
+
+	mkdir -p "$PGDATA"
+	# ignore failure since there are cases where we can't chmod (and PostgreSQL might fail later anyhow - it's picky about permissions of this directory)
+	chmod 00700 "$PGDATA" || :
+
+	# ignore failure since it will be fine when using the image provided directory; see also https://github.com/docker-library/postgres/pull/289
+	mkdir -p /var/run/postgresql || :
+	chmod 03775 /var/run/postgresql || :
+
+	# Create the transaction log directory before initdb is run so the directory is owned by the correct user
+	if [ -n "${POSTGRES_INITDB_WALDIR:-}" ]; then
+		mkdir -p "$POSTGRES_INITDB_WALDIR"
+		if [ "$user" = '0' ]; then
+			find "$POSTGRES_INITDB_WALDIR" \! -user postgres -exec chown postgres '{}' +
+		fi
+		chmod 700 "$POSTGRES_INITDB_WALDIR"
+	fi
+
+	# allow the container to be started with `--user`
+	if [ "$user" = '0' ]; then
+		find "$PGDATA" \! -user postgres -exec chown postgres '{}' +
+		find /var/run/postgresql \! -user postgres -exec chown postgres '{}' +
+	fi
+}
+
+# initialize empty PGDATA directory with new database via 'initdb'
+# arguments to `initdb` can be passed via POSTGRES_INITDB_ARGS or as arguments to this function
+# `initdb` automatically creates the "postgres", "template0", and "template1" dbnames
+# this is also where the database user is created, specified by `POSTGRES_USER` env
+docker_init_database_dir() {
+	# "initdb" is particular about the current user existing in "/etc/passwd", so we use "nss_wrapper" to fake that if necessary
+	# see https://github.com/docker-library/postgres/pull/253, https://github.com/docker-library/postgres/issues/359, https://cwrap.org/nss_wrapper.html
+	local uid; uid="$(id -u)"
+	if ! getent passwd "$uid" &> /dev/null; then
+		# see if we can find a suitable "libnss_wrapper.so" (https://salsa.debian.org/sssd-team/nss-wrapper/-/commit/b9925a653a54e24d09d9b498a2d913729f7abb15)
+		local wrapper
+		for wrapper in {/usr,}/lib{/*,}/libnss_wrapper.so; do
+			if [ -s "$wrapper" ]; then
+				NSS_WRAPPER_PASSWD="$(mktemp)"
+				NSS_WRAPPER_GROUP="$(mktemp)"
+				export LD_PRELOAD="$wrapper" NSS_WRAPPER_PASSWD NSS_WRAPPER_GROUP
+				local gid; gid="$(id -g)"
+				printf 'postgres:x:%s:%s:PostgreSQL:%s:/bin/false\n' "$uid" "$gid" "$PGDATA" > "$NSS_WRAPPER_PASSWD"
+				printf 'postgres:x:%s:\n' "$gid" > "$NSS_WRAPPER_GROUP"
+				break
+			fi
+		done
+	fi
+
+	if [ -n "${POSTGRES_INITDB_WALDIR:-}" ]; then
+		set -- --waldir "$POSTGRES_INITDB_WALDIR" "$@"
+	fi
+
+	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
+	eval 'initdb --username="$POSTGRES_USER" --pwfile=<(printf "%s\n" "$POSTGRES_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
+
+	# unset/cleanup "nss_wrapper" bits
+	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
+		rm -f "$NSS_WRAPPER_PASSWD" "$NSS_WRAPPER_GROUP"
+		unset LD_PRELOAD NSS_WRAPPER_PASSWD NSS_WRAPPER_GROUP
+	fi
+}
+
+# print large warning if POSTGRES_PASSWORD is long
+# error if both POSTGRES_PASSWORD is empty and POSTGRES_HOST_AUTH_METHOD is not 'trust'
+# print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
+# assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
+docker_verify_minimum_env() {
+	case "${PG_MAJOR:-}" in
+		13) # https://github.com/postgres/postgres/commit/67a472d71c98c3d2fa322a1b4013080b20720b98
+			# check password first so we can output the warning before postgres
+			# messes it up
+			if [ "${#POSTGRES_PASSWORD}" -ge 100 ]; then
+				cat >&2 <<-'EOWARN'
+
+					WARNING: The supplied POSTGRES_PASSWORD is 100+ characters.
+
+					  This will not work if used via PGPASSWORD with "psql".
+
+					  https://www.postgresql.org/message-id/flat/E1Rqxp2-0004Qt-PL%40wrigleys.postgresql.org (BUG #6412)
+					  https://github.com/docker-library/postgres/issues/507
+
+				EOWARN
+			fi
+			;;
+	esac
+	if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
+		# The - option suppresses leading tabs but *not* spaces. :)
+		cat >&2 <<-'EOE'
+			Error: Database is uninitialized and superuser password is not specified.
+			       You must specify POSTGRES_PASSWORD to a non-empty value for the
+			       superuser. For example, "-e POSTGRES_PASSWORD=password" on "docker run".
+
+			       You may also use "POSTGRES_HOST_AUTH_METHOD=trust" to allow all
+			       connections without a password. This is *not* recommended.
+
+			       See PostgreSQL documentation about "trust":
+			       https://www.postgresql.org/docs/current/auth-trust.html
+		EOE
+		exit 1
+	fi
+	if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
+		cat >&2 <<-'EOWARN'
+			********************************************************************************
+			WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
+			         anyone with access to the Postgres port to access your database without
+			         a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
+			         documentation about "trust":
+			         https://www.postgresql.org/docs/current/auth-trust.html
+			         In Docker's default configuration, this is effectively any other
+			         container on the same system.
+
+			         It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
+			         it with "-e POSTGRES_PASSWORD=password" instead to set a password in
+			         "docker run".
+			********************************************************************************
+		EOWARN
+	fi
+}
+# similar to the above, but errors if there are any "old" databases detected (usually due to upgrades without pg_upgrade)
+docker_error_old_databases() {
+	if [ -n "${OLD_DATABASES[0]:-}" ]; then
+		cat >&2 <<-EOE
+			Error: in 18+, these Docker images are configured to store database data in a
+			       format which is compatible with "pg_ctlcluster" (specifically, using
+			       major-version-specific directory names).  This better reflects how
+			       PostgreSQL itself works, and how upgrades are to be performed.
+
+			       See also https://github.com/docker-library/postgres/pull/1259
+
+			       Counter to that, there appears to be PostgreSQL data in:
+			         ${OLD_DATABASES[*]}
+
+			       This is usually the result of upgrading the Docker image without upgrading
+			       the underlying database using "pg_upgrade" (which requires both versions).
+
+			       See https://github.com/docker-library/postgres/issues/37 for a (long)
+			       discussion around this process, and suggestions for how to do so.
+		EOE
+		exit 1
+	fi
+}
+
+# usage: docker_process_init_files [file [file [...]]]
+#    ie: docker_process_init_files /always-initdb.d/*
+# process initializer files, based on file extensions and permissions
+docker_process_init_files() {
+	# psql here for backwards compatibility "${psql[@]}"
+	psql=( docker_process_sql )
+
+	printf '\n'
+	local f
+	for f; do
+		case "$f" in
+			*.sh)
+				# https://github.com/docker-library/postgres/issues/450#issuecomment-393167936
+				# https://github.com/docker-library/postgres/pull/452
+				if [ -x "$f" ]; then
+					printf '%s: running %s\n' "$0" "$f"
+					"$f"
+				else
+					printf '%s: sourcing %s\n' "$0" "$f"
+					. "$f"
+				fi
+				;;
+			*.sql)     printf '%s: running %s\n' "$0" "$f"; docker_process_sql -f "$f"; printf '\n' ;;
+			*.sql.gz)  printf '%s: running %s\n' "$0" "$f"; gunzip -c "$f" | docker_process_sql; printf '\n' ;;
+			*.sql.xz)  printf '%s: running %s\n' "$0" "$f"; xzcat "$f" | docker_process_sql; printf '\n' ;;
+			*.sql.zst) printf '%s: running %s\n' "$0" "$f"; zstd -dc "$f" | docker_process_sql; printf '\n' ;;
+			*)         printf '%s: ignoring %s\n' "$0" "$f" ;;
+		esac
+		printf '\n'
+	done
+}
+
+# Execute sql script, passed via stdin (or -f flag of pqsl)
+# usage: docker_process_sql [psql-cli-args]
+#    ie: docker_process_sql --dbname=mydb <<<'INSERT ...'
+#    ie: docker_process_sql -f my-file.sql
+#    ie: docker_process_sql <my-file.sql
+docker_process_sql() {
+	local query_runner=( psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --no-password --no-psqlrc )
+	if [ -n "$POSTGRES_DB" ]; then
+		query_runner+=( --dbname "$POSTGRES_DB" )
+	fi
+
+	PGHOST= PGHOSTADDR= "${query_runner[@]}" "$@"
+}
+
+# create initial database
+# uses environment variables for input: POSTGRES_DB
+docker_setup_db() {
+	local dbAlreadyExists
+	dbAlreadyExists="$(
+		POSTGRES_DB= docker_process_sql --dbname postgres --set db="$POSTGRES_DB" --tuples-only <<-'EOSQL'
+			SELECT 1 FROM pg_database WHERE datname = :'db' ;
+		EOSQL
+	)"
+	if [ -z "$dbAlreadyExists" ]; then
+		POSTGRES_DB= docker_process_sql --dbname postgres --set db="$POSTGRES_DB" <<-'EOSQL'
+			CREATE DATABASE :"db" ;
+		EOSQL
+		printf '\n'
+	fi
+}
+
+# Loads various settings that are used elsewhere in the script
+# This should be called before any other functions
+docker_setup_env() {
+	file_env 'POSTGRES_PASSWORD'
+
+	file_env 'POSTGRES_USER' 'postgres'
+	file_env 'POSTGRES_DB' "$POSTGRES_USER"
+	file_env 'POSTGRES_INITDB_ARGS'
+	: "${POSTGRES_HOST_AUTH_METHOD:=}"
+
+	declare -g DATABASE_ALREADY_EXISTS
+	: "${DATABASE_ALREADY_EXISTS:=}"
+	declare -ag OLD_DATABASES=()
+	# look specifically for PG_VERSION, as it is expected in the DB dir
+	if [ -s "$PGDATA/PG_VERSION" ]; then
+		DATABASE_ALREADY_EXISTS='true'
+	elif [ "$PGDATA" = "/var/lib/postgresql/$PG_MAJOR/docker" ]; then
+		# https://github.com/docker-library/postgres/pull/1259
+		for d in /var/lib/postgresql /var/lib/postgresql/data /var/lib/postgresql/*/docker; do
+			if [ -s "$d/PG_VERSION" ]; then
+				OLD_DATABASES+=( "$d" )
+			fi
+		done
+	fi
+}
+
+# append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
+# all arguments will be passed along as arguments to `postgres` for getting the value of 'password_encryption'
+pg_setup_hba_conf() {
+	# default authentication method is md5 on versions before 14
+	# https://www.postgresql.org/about/news/postgresql-14-released-2318/
+	if [ "$1" = 'postgres' ]; then
+		shift
+	fi
+	local auth
+	# check the default/configured encryption and use that as the auth method
+	auth="$(postgres -C password_encryption "$@")"
+	: "${POSTGRES_HOST_AUTH_METHOD:=$auth}"
+	{
+		printf '\n'
+		if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
+			printf '# warning trust is enabled for all connections\n'
+			printf '# see https://www.postgresql.org/docs/17/auth-trust.html\n'
+		fi
+		printf 'host all all all %s\n' "$POSTGRES_HOST_AUTH_METHOD"
+	} >> "$PGDATA/pg_hba.conf"
+}
+
+# start socket-only postgresql server for setting up or running scripts
+# all arguments will be passed along as arguments to `postgres` (via pg_ctl)
+docker_temp_server_start() {
+	if [ "$1" = 'postgres' ]; then
+		shift
+	fi
+
+	# internal start of server in order to allow setup using psql client
+	# does not listen on external TCP/IP and waits until start finishes
+	set -- "$@" -c listen_addresses='' -p "${PGPORT:-5432}"
+
+	# unset NOTIFY_SOCKET so the temporary server doesn't prematurely notify
+	# any process supervisor.
+	NOTIFY_SOCKET= \
+	PGUSER="${PGUSER:-$POSTGRES_USER}" \
+	pg_ctl -D "$PGDATA" \
+		-o "$(printf '%q ' "$@")" \
+		-w start
+}
+
+# stop postgresql server after done setting up user and running scripts
+docker_temp_server_stop() {
+	PGUSER="${PGUSER:-postgres}" \
+	pg_ctl -D "$PGDATA" -m fast -w stop
+}
+
+# check arguments for an option that would cause postgres to stop
+# return true if there is one
+_pg_want_help() {
+	local arg
+	for arg; do
+		case "$arg" in
+			# postgres --help | grep 'then exit'
+			# leaving out -C on purpose since it always fails and is unhelpful:
+			# postgres: could not access the server configuration file "/var/lib/postgresql/data/postgresql.conf": No such file or directory
+			-'?'|--help|--describe-config|-V|--version)
+				return 0
+				;;
+		esac
+	done
+	return 1
+}
+
+_main() {
+	# if first arg looks like a flag, assume we want to run postgres server
+	if [ "${1:0:1}" = '-' ]; then
+		set -- postgres "$@"
+	fi
+
+	if [ "$1" = 'postgres' ] && ! _pg_want_help "$@"; then
+		docker_setup_env
+		# setup data directories and permissions (when run as root)
+		docker_create_db_directories
+		if [ "$(id -u)" = '0' ]; then
+			# then restart script as postgres user
+			exec gosu postgres "$BASH_SOURCE" "$@"
+		fi
+
+		# only run initialization on an empty data directory
+		if [ -z "$DATABASE_ALREADY_EXISTS" ]; then
+			docker_verify_minimum_env
+			docker_error_old_databases
+
+			# check dir permissions to reduce likelihood of half-initialized database
+			ls /docker-entrypoint-initdb.d/ > /dev/null
+
+			docker_init_database_dir
+			pg_setup_hba_conf "$@"
+
+			# PGPASSWORD is required for psql when authentication is required for 'local' connections via pg_hba.conf and is otherwise harmless
+			# e.g. when '--auth=md5' or '--auth-local=md5' is used in POSTGRES_INITDB_ARGS
+			export PGPASSWORD="${PGPASSWORD:-$POSTGRES_PASSWORD}"
+			docker_temp_server_start "$@"
+
+			docker_setup_db
+			docker_process_init_files /docker-entrypoint-initdb.d/*
+
+			docker_temp_server_stop
+			unset PGPASSWORD
+
+			cat <<-'EOM'
+
+				PostgreSQL init process complete; ready for start up.
+
+			EOM
+		else
+			cat <<-'EOM'
+
+				PostgreSQL Database directory appears to contain a database; Skipping initialization
+
+			EOM
+		fi
+	fi
+
+	exec "$@"
+}
+
+if ! _is_sourced; then
+	_main "$@"
+fi

codegen.ts

@@ -0,0 +1,14 @@
+import type { CodegenConfig } from "@graphql-codegen/cli";
+
+const config: CodegenConfig = {
+  schema: ["services/auth/schema/schema.graphql"],
+  generates: {
+    "./resolvers-types.ts": {
+      config: {
+        useIndexSignature: true,
+      },
+      plugins: ["typescript", "typescript-resolvers"],
+    },
+  },
+};
+export default config;

docs/lightsaver_docs/.obsidian/.obsidian/app.json

@@ -0,0 +1 @@
+{}

docs/lightsaver_docs/.obsidian/.obsidian/appearance.json

@@ -0,0 +1 @@
+{}

docs/lightsaver_docs/.obsidian/.obsidian/core-plugins.json

@@ -0,0 +1,31 @@
+{
+  "file-explorer": true,
+  "global-search": true,
+  "switcher": true,
+  "graph": true,
+  "backlink": true,
+  "canvas": true,
+  "outgoing-link": true,
+  "tag-pane": true,
+  "properties": false,
+  "page-preview": true,
+  "daily-notes": true,
+  "templates": true,
+  "note-composer": true,
+  "command-palette": true,
+  "slash-command": false,
+  "editor-status": true,
+  "bookmarks": true,
+  "markdown-importer": false,
+  "zk-prefixer": false,
+  "random-note": false,
+  "outline": true,
+  "word-count": true,
+  "slides": false,
+  "audio-recorder": false,
+  "workspaces": false,
+  "file-recovery": true,
+  "publish": false,
+  "sync": true,
+  "webviewer": false
+}

docs/lightsaver_docs/.obsidian/app.json

@@ -0,0 +1 @@
+{}

docs/lightsaver_docs/.obsidian/appearance.json

@@ -0,0 +1,3 @@
+{
+  "theme": "obsidian"
+}

docs/lightsaver_docs/.obsidian/core-plugins.json

@@ -0,0 +1,31 @@
+{
+  "file-explorer": true,
+  "global-search": true,
+  "switcher": true,
+  "graph": true,
+  "backlink": true,
+  "canvas": true,
+  "outgoing-link": true,
+  "tag-pane": true,
+  "properties": false,
+  "page-preview": true,
+  "daily-notes": true,
+  "templates": true,
+  "note-composer": true,
+  "command-palette": true,
+  "slash-command": false,
+  "editor-status": true,
+  "bookmarks": true,
+  "markdown-importer": false,
+  "zk-prefixer": false,
+  "random-note": false,
+  "outline": true,
+  "word-count": true,
+  "slides": false,
+  "audio-recorder": false,
+  "workspaces": false,
+  "file-recovery": true,
+  "publish": false,
+  "sync": true,
+  "webviewer": false
+}

docs/lightsaver_docs/.obsidian/workspace.json

@@ -0,0 +1,166 @@
+{
+  "main": {
+    "id": "a50b81cf00688a7f",
+    "type": "split",
+    "children": [
+      {
+        "id": "2e75bb4ed5a090b4",
+        "type": "tabs",
+        "children": [
+          {
+            "id": "de13abfe2ed99649",
+            "type": "leaf",
+            "state": {
+              "type": "empty",
+              "state": {},
+              "icon": "lucide-file",
+              "title": "New tab"
+            }
+          }
+        ]
+      }
+    ],
+    "direction": "vertical"
+  },
+  "left": {
+    "id": "e7df76c86166bd4f",
+    "type": "split",
+    "children": [
+      {
+        "id": "681e3db73e836177",
+        "type": "tabs",
+        "children": [
+          {
+            "id": "820827387827beba",
+            "type": "leaf",
+            "state": {
+              "type": "file-explorer",
+              "state": {
+                "sortOrder": "alphabetical",
+                "autoReveal": false
+              },
+              "icon": "lucide-folder-closed",
+              "title": "Files"
+            }
+          },
+          {
+            "id": "6f22506e4ef49d80",
+            "type": "leaf",
+            "state": {
+              "type": "search",
+              "state": {
+                "query": "",
+                "matchingCase": false,
+                "explainSearch": false,
+                "collapseAll": false,
+                "extraContext": false,
+                "sortOrder": "alphabetical"
+              },
+              "icon": "lucide-search",
+              "title": "Search"
+            }
+          },
+          {
+            "id": "5fcbd10dd558c03a",
+            "type": "leaf",
+            "state": {
+              "type": "bookmarks",
+              "state": {},
+              "icon": "lucide-bookmark",
+              "title": "Bookmarks"
+            }
+          }
+        ]
+      }
+    ],
+    "direction": "horizontal",
+    "width": 300
+  },
+  "right": {
+    "id": "47d5adcd7f9dbd07",
+    "type": "split",
+    "children": [
+      {
+        "id": "58e6eaa0e1b63f6a",
+        "type": "tabs",
+        "children": [
+          {
+            "id": "6beab8742fcc1585",
+            "type": "leaf",
+            "state": {
+              "type": "backlink",
+              "state": {
+                "collapseAll": false,
+                "extraContext": false,
+                "sortOrder": "alphabetical",
+                "showSearch": false,
+                "searchQuery": "",
+                "backlinkCollapsed": false,
+                "unlinkedCollapsed": true
+              },
+              "icon": "links-coming-in",
+              "title": "Backlinks"
+            }
+          },
+          {
+            "id": "47b716fd376cf8da",
+            "type": "leaf",
+            "state": {
+              "type": "outgoing-link",
+              "state": {
+                "linksCollapsed": false,
+                "unlinkedCollapsed": true
+              },
+              "icon": "links-going-out",
+              "title": "Outgoing links"
+            }
+          },
+          {
+            "id": "f794baa612157193",
+            "type": "leaf",
+            "state": {
+              "type": "tag",
+              "state": {
+                "sortOrder": "frequency",
+                "useHierarchy": true,
+                "showSearch": false,
+                "searchQuery": ""
+              },
+              "icon": "lucide-tags",
+              "title": "Tags"
+            }
+          },
+          {
+            "id": "5790163a24c843d3",
+            "type": "leaf",
+            "state": {
+              "type": "outline",
+              "state": {
+                "followCursor": false,
+                "showSearch": false,
+                "searchQuery": ""
+              },
+              "icon": "lucide-list",
+              "title": "Outline"
+            }
+          }
+        ]
+      }
+    ],
+    "direction": "horizontal",
+    "width": 300,
+    "collapsed": true
+  },
+  "left-ribbon": {
+    "hiddenItems": {
+      "switcher:Open quick switcher": false,
+      "graph:Open graph view": false,
+      "canvas:Create new canvas": false,
+      "daily-notes:Open today's daily note": false,
+      "templates:Insert template": false,
+      "command-palette:Open command palette": false
+    }
+  },
+  "active": "de13abfe2ed99649",
+  "lastOpenFiles": []
+}

infrastructure/kratos/identity.schema.json

@@ -1,52 +0,0 @@
-{
-  "$id": "https://lightsaver.app/schemas/identity.schema.json",
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "LightsaverUser",
-  "type": "object",
-  "properties": {
-    "traits": {
-      "type": "object",
-      "properties": {
-        "email": {
-          "type": "string",
-          "format": "email",
-          "title": "Email",
-          "ory.sh/kratos": {
-            "credentials": {
-              "password": {
-                "identifier": true
-              }
-            },
-            "recovery": {
-              "via": "email"
-            },
-            "verification": {
-              "via": "email"
-            }
-          }
-        },
-        "name": {
-          "type": "object",
-          "properties": {
-            "first": {
-              "type": "string",
-              "title": "First Name",
-              "minLength": 1,
-              "maxLength": 100
-            },
-            "last": {
-              "type": "string",
-              "title": "Last Name",
-              "minLength": 1,
-              "maxLength": 100
-            }
-          },
-          "required": ["first", "last"],
-          "additionalProperties": false
-        }
-      },
-      "required": ["email", "name"],
-      "additionalProperties": false
-    }
-  }
-}

infrastructure/kratos/kratos.yaml

@@ -1,120 +0,0 @@
-version: v1.2.0
-
-dsn: memory
-
-serve:
-  public:
-    base_url: http://localhost:4433/
-    cors:
-      enabled: true
-      allowed_origins:
-        - http://localhost:3000
-        - http://127.0.0.1:3000
-      allowed_methods:
-        - POST
-        - GET
-        - PUT
-        - PATCH
-        - DELETE
-      allowed_headers:
-        - Authorization
-        - Content-Type
-        - Cookie
-        - X-Session-Token
-      exposed_headers:
-        - Content-Type
-        - Set-Cookie
-      allow_credentials: true
-  admin:
-    base_url: http://localhost:4434/
-
-selfservice:
-  default_browser_return_url: http://localhost:3000/
-  allowed_return_urls:
-    - http://localhost:3000/
-    - http://localhost:3000/dashboard
-
-  methods:
-    password:
-      enabled: true
-    link:
-      enabled: true
-    code:
-      enabled: true
-      mfa_enabled: false
-
-  flows:
-    error:
-      ui_url: http://localhost:3000/auth/error
-
-    settings:
-      ui_url: http://localhost:3000/auth/settings
-      privileged_session_max_age: 15m
-
-    recovery:
-      enabled: true
-      ui_url: http://localhost:3000/auth/recovery
-      use: code
-
-    verification:
-      enabled: true
-      ui_url: http://localhost:3000/auth/verification
-      use: code
-      after:
-        default_browser_return_url: http://localhost:3000/dashboard
-
-    logout:
-      after:
-        default_browser_return_url: http://localhost:3000/
-
-    login:
-      ui_url: http://localhost:3000/auth/login
-      lifespan: 10m
-      after:
-        password:
-          hooks:
-            - hook: revoke_active_sessions
-
-    registration:
-      ui_url: http://localhost:3000/auth/registration
-      lifespan: 10m
-      after:
-        password:
-          hooks:
-            - hook: session
-
-log:
-  level: debug
-  format: text
-  leak_sensitive_values: false
-
-secrets:
-  cookie:
-    - ${SECRETS_COOKIE}
-  cipher:
-    - ${SECRETS_CIPHER}
-
-ciphers:
-  algorithm: xchacha20-poly1305
-
-hashers:
-  algorithm: bcrypt
-  bcrypt:
-    cost: 12
-
-identity:
-  default_schema_id: default
-  schemas:
-    - id: default
-      url: file:///etc/config/kratos/identity.schema.json
-
-courier:
-  smtp:
-    connection_uri: smtp://mailhog:1025/?disable_starttls=true
-
-session:
-  lifespan: 24h
-  cookie:
-    name: lightsaver_session
-    same_site: Lax
-    domain: localhost

k8s/overlays/dev/kustomizaton.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+bases:
+- ../../base
+patchesStrategicMerge:
+- dev-config.yaml

k8s/overlays/prod/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- deployment.yaml
+- service.yaml
+- configmap.yaml

package.json

@@ -5,22 +5,47 @@
   "main": "index.js",
   "scripts": {
     "build": "turbo run build",
-    "check-types": "tsc --noEmit",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "check-types": "pnpm -r --filter \"!./apps/**\" exec tsc --noEmit --pretty && pnpm -r --filter \"./apps/**\" exec tsc --noEmit --pretty",
+    "codegen": "graphql-codegen --config ./codegen.ts",
+    "start": "pnpm check-types && pnpm codegen && turbo run build",
+    "test:unit": "echo \"Error: no test specified\" && exit 1"
   },
   "keywords": [],
   "author": "Jason Ross",
   "license": "ISC",
-  "packageManager": "pnpm@10.26.2+sha512.0e308ff2005fc7410366f154f625f6631ab2b16b1d2e70238444dd6ae9d630a8482d92a451144debc492416896ed16f7b114a86ec68b8404b2443869e68ffda6",
+  "module": "esnext",
+  "packageManager": "pnpm@10.13.1",
   "engines": {
-    "node": ">=22.17.0"
+    "node": "^22.17.0"
   },
   "dependencies": {
-    "lightsaver": "workspace:*"
+    "@apollo/client": "^3.13.8",
+    "@cloudamqp/amqp-client": "^3.2.1",
+    "dotenv": "^17.2.1",
+    "graphql": "^16.11.0",
+    "lightsaver": "workspace:*",
+    "next-auth": "^4.24.11"
   },
   "devDependencies": {
+    "@graphql-codegen/cli": "^5.0.7",
+    "@graphql-codegen/typescript": "^4.1.6",
+    "@graphql-codegen/typescript-resolvers": "^4.5.1",
+    "@parcel/watcher": "^2.5.1",
+    "@types/node": "^24.1.0",
     "pnpm": "^10.13.1",
-    "turbo": "^2.5.4",
+    "turbo": "^2.5.5",
     "typescript": "^5.8.3"
+  },
+  "pnpm": {
+    "overrides": {
+      "fetch-blob": "npm:fetch-blob-fixed@^1.0.1"
+    },
+    "onlyBuiltDependencies": [
+      "@apollo/protobufjs",
+      "@parcel/watcher",
+      "@tailwindcss/oxide",
+      "sharp",
+      "unrs-resolver"
+    ]
   }
 }

pnpm-workspace.yaml

@@ -4,6 +4,7 @@ packages:
   - packages/*
 
 onlyBuiltDependencies:
+  - '@parcel/watcher'
   - '@tailwindcss/oxide'
   - sharp
   - unrs-resolver

podman-compose.yaml

@@ -1,115 +0,0 @@
-version: "3.9"
-
-services:
-  postgres:
-    image: postgres:18-alpine
-    container_name: lightsaver_postgres
-    environment:
-      POSTGRES_USER: ${POSTGRES_USER:-kratos}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: ${POSTGRES_DB:-kratos}
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    networks:
-      - lightsaver_network
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-kratos} -d ${POSTGRES_DB:-kratos}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    restart: unless-stopped
-
-  mailhog:
-    image: mailhog/mailhog:latest
-    container_name: lightsaver_mailhog
-    ports:
-      - "8025:8025"
-    networks:
-      - lightsaver_network
-    restart: unless-stopped
-
-  kratos-migrate:
-    image: oryd/kratos:v1.2.0
-    container_name: lightsaver_kratos_migrate
-    environment:
-      DSN: postgres://${POSTGRES_USER:-kratos}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-kratos}?sslmode=disable
-    volumes:
-      - ./infrastructure/kratos:/etc/config/kratos:ro
-    command: migrate sql -e --yes
-    networks:
-      - lightsaver_network
-    depends_on:
-      postgres:
-        condition: service_healthy
-    restart: on-failure
-
-  kratos:
-    image: oryd/kratos:v1.2.0
-    container_name: lightsaver_kratos
-    environment:
-      DSN: postgres://${POSTGRES_USER:-kratos}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-kratos}?sslmode=disable
-      SECRETS_COOKIE: ${KRATOS_SECRETS_COOKIE}
-      SECRETS_CIPHER: ${KRATOS_SECRETS_CIPHER}
-      SERVE_PUBLIC_BASE_URL: ${KRATOS_PUBLIC_URL:-http://localhost:4433}
-      SERVE_ADMIN_BASE_URL: ${KRATOS_ADMIN_URL:-http://localhost:4434}
-      COURIER_SMTP_CONNECTION_URI: smtp://mailhog:1025/?disable_starttls=true
-    volumes:
-      - ./infrastructure/kratos:/etc/config/kratos:ro
-    command: >
-      sh -c "if [ '${KRATOS_DEV_MODE:-true}' = 'true' ]; then
-        kratos serve --config /etc/config/kratos/kratos.yaml --dev --watch-courier;
-      else
-        kratos serve --config /etc/config/kratos/kratos.yaml --watch-courier;
-      fi"
-    ports:
-      - "4433:4433"
-      - "4434:4434"
-    networks:
-      - lightsaver_network
-    depends_on:
-      kratos-migrate:
-        condition: service_completed_successfully
-    restart: unless-stopped
-
-  frontend:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      args:
-        NEXT_PUBLIC_KRATOS_PUBLIC_URL: ${NEXT_PUBLIC_KRATOS_PUBLIC_URL:-http://localhost:4433}
-    container_name: lightsaver_frontend
-    environment:
-      NODE_ENV: production
-      NEXT_PUBLIC_KRATOS_PUBLIC_URL: ${NEXT_PUBLIC_KRATOS_PUBLIC_URL:-http://localhost:4433}
-      KRATOS_ADMIN_URL: http://kratos:4434
-    ports:
-      - "3000:3000"
-    networks:
-      - lightsaver_network
-    depends_on:
-      - kratos
-    restart: unless-stopped
-
-  services:
-    build:
-      context: .
-      dockerfile: services/Dockerfile
-    container_name: lightsaver_services
-    environment:
-      NODE_ENV: production
-      KRATOS_ADMIN_URL: http://kratos:4434
-      PORT: 4000
-    ports:
-      - "4000:4000"
-    networks:
-      - lightsaver_network
-    depends_on:
-      - kratos
-    restart: unless-stopped
-
-networks:
-  lightsaver_network:
-    driver: bridge
-
-volumes:
-  postgres_data:

resolvers-types.ts

@@ -0,0 +1,220 @@
+import { GraphQLResolveInfo } from 'graphql';
+export type Maybe<T> = T | null;
+export type InputMaybe<T> = Maybe<T>;
+export type Exact<T extends { [key: string]: unknown }> = { [K in keyof T]: T[K] };
+export type MakeOptional<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]?: Maybe<T[SubKey]> };
+export type MakeMaybe<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]: Maybe<T[SubKey]> };
+export type MakeEmpty<T extends { [key: string]: unknown }, K extends keyof T> = { [_ in K]?: never };
+export type Incremental<T> = T | { [P in keyof T]?: P extends ' $fragmentName' | '__typename' ? T[P] : never };
+export type RequireFields<T, K extends keyof T> = Omit<T, K> & { [P in K]-?: NonNullable<T[P]> };
+/** All built-in and custom scalars, mapped to their actual values */
+export type Scalars = {
+  ID: { input: string; output: string; }
+  String: { input: string; output: string; }
+  Boolean: { input: boolean; output: boolean; }
+  Int: { input: number; output: number; }
+  Float: { input: number; output: number; }
+};
+
+export type CreateUserInput = {
+  dateOfBirth: Scalars['String']['input'];
+  email: Scalars['String']['input'];
+  firstName: Scalars['String']['input'];
+  lastName: Scalars['String']['input'];
+  password: Scalars['String']['input'];
+};
+
+export type CreateUserResponse = {
+  __typename?: 'CreateUserResponse';
+  error?: Maybe<Scalars['String']['output']>;
+  success: Scalars['Boolean']['output'];
+  token?: Maybe<Scalars['String']['output']>;
+  user?: Maybe<User>;
+};
+
+export type Mutation = {
+  __typename?: 'Mutation';
+  createUser: CreateUserResponse;
+  login: UserLoginResponse;
+  logout: UserLogoutResponse;
+};
+
+
+export type MutationCreateUserArgs = {
+  input: CreateUserInput;
+};
+
+
+export type MutationLoginArgs = {
+  input: UserLoginInput;
+};
+
+export type User = {
+  __typename?: 'User';
+  dateOfBirth: Scalars['String']['output'];
+  email: Scalars['String']['output'];
+  firstName: Scalars['String']['output'];
+  id: Scalars['ID']['output'];
+  lastName: Scalars['String']['output'];
+};
+
+export type UserLoginInput = {
+  email: Scalars['String']['input'];
+  password: Scalars['String']['input'];
+};
+
+export type UserLoginResponse = {
+  __typename?: 'UserLoginResponse';
+  error?: Maybe<Scalars['String']['output']>;
+  success: Scalars['Boolean']['output'];
+  token?: Maybe<Scalars['String']['output']>;
+  user?: Maybe<User>;
+};
+
+export type UserLogoutResponse = {
+  __typename?: 'UserLogoutResponse';
+  success: Scalars['Boolean']['output'];
+};
+
+export type WithIndex<TObject> = TObject & Record<string, any>;
+export type ResolversObject<TObject> = WithIndex<TObject>;
+
+export type ResolverTypeWrapper<T> = Promise<T> | T;
+
+
+export type ResolverWithResolve<TResult, TParent, TContext, TArgs> = {
+  resolve: ResolverFn<TResult, TParent, TContext, TArgs>;
+};
+export type Resolver<TResult, TParent = {}, TContext = {}, TArgs = {}> = ResolverFn<TResult, TParent, TContext, TArgs> | ResolverWithResolve<TResult, TParent, TContext, TArgs>;
+
+export type ResolverFn<TResult, TParent, TContext, TArgs> = (
+  parent: TParent,
+  args: TArgs,
+  context: TContext,
+  info: GraphQLResolveInfo
+) => Promise<TResult> | TResult;
+
+export type SubscriptionSubscribeFn<TResult, TParent, TContext, TArgs> = (
+  parent: TParent,
+  args: TArgs,
+  context: TContext,
+  info: GraphQLResolveInfo
+) => AsyncIterable<TResult> | Promise<AsyncIterable<TResult>>;
+
+export type SubscriptionResolveFn<TResult, TParent, TContext, TArgs> = (
+  parent: TParent,
+  args: TArgs,
+  context: TContext,
+  info: GraphQLResolveInfo
+) => TResult | Promise<TResult>;
+
+export interface SubscriptionSubscriberObject<TResult, TKey extends string, TParent, TContext, TArgs> {
+  subscribe: SubscriptionSubscribeFn<{ [key in TKey]: TResult }, TParent, TContext, TArgs>;
+  resolve?: SubscriptionResolveFn<TResult, { [key in TKey]: TResult }, TContext, TArgs>;
+}
+
+export interface SubscriptionResolverObject<TResult, TParent, TContext, TArgs> {
+  subscribe: SubscriptionSubscribeFn<any, TParent, TContext, TArgs>;
+  resolve: SubscriptionResolveFn<TResult, any, TContext, TArgs>;
+}
+
+export type SubscriptionObject<TResult, TKey extends string, TParent, TContext, TArgs> =
+  | SubscriptionSubscriberObject<TResult, TKey, TParent, TContext, TArgs>
+  | SubscriptionResolverObject<TResult, TParent, TContext, TArgs>;
+
+export type SubscriptionResolver<TResult, TKey extends string, TParent = {}, TContext = {}, TArgs = {}> =
+  | ((...args: any[]) => SubscriptionObject<TResult, TKey, TParent, TContext, TArgs>)
+  | SubscriptionObject<TResult, TKey, TParent, TContext, TArgs>;
+
+export type TypeResolveFn<TTypes, TParent = {}, TContext = {}> = (
+  parent: TParent,
+  context: TContext,
+  info: GraphQLResolveInfo
+) => Maybe<TTypes> | Promise<Maybe<TTypes>>;
+
+export type IsTypeOfResolverFn<T = {}, TContext = {}> = (obj: T, context: TContext, info: GraphQLResolveInfo) => boolean | Promise<boolean>;
+
+export type NextResolverFn<T> = () => Promise<T>;
+
+export type DirectiveResolverFn<TResult = {}, TParent = {}, TContext = {}, TArgs = {}> = (
+  next: NextResolverFn<TResult>,
+  parent: TParent,
+  args: TArgs,
+  context: TContext,
+  info: GraphQLResolveInfo
+) => TResult | Promise<TResult>;
+
+
+
+/** Mapping between all available schema types and the resolvers types */
+export type ResolversTypes = ResolversObject<{
+  Boolean: ResolverTypeWrapper<Scalars['Boolean']['output']>;
+  CreateUserInput: CreateUserInput;
+  CreateUserResponse: ResolverTypeWrapper<CreateUserResponse>;
+  ID: ResolverTypeWrapper<Scalars['ID']['output']>;
+  Mutation: ResolverTypeWrapper<{}>;
+  String: ResolverTypeWrapper<Scalars['String']['output']>;
+  User: ResolverTypeWrapper<User>;
+  UserLoginInput: UserLoginInput;
+  UserLoginResponse: ResolverTypeWrapper<UserLoginResponse>;
+  UserLogoutResponse: ResolverTypeWrapper<UserLogoutResponse>;
+}>;
+
+/** Mapping between all available schema types and the resolvers parents */
+export type ResolversParentTypes = ResolversObject<{
+  Boolean: Scalars['Boolean']['output'];
+  CreateUserInput: CreateUserInput;
+  CreateUserResponse: CreateUserResponse;
+  ID: Scalars['ID']['output'];
+  Mutation: {};
+  String: Scalars['String']['output'];
+  User: User;
+  UserLoginInput: UserLoginInput;
+  UserLoginResponse: UserLoginResponse;
+  UserLogoutResponse: UserLogoutResponse;
+}>;
+
+export type CreateUserResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['CreateUserResponse'] = ResolversParentTypes['CreateUserResponse']> = ResolversObject<{
+  error?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  success?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  token?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  user?: Resolver<Maybe<ResolversTypes['User']>, ParentType, ContextType>;
+  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
+}>;
+
+export type MutationResolvers<ContextType = any, ParentType extends ResolversParentTypes['Mutation'] = ResolversParentTypes['Mutation']> = ResolversObject<{
+  createUser?: Resolver<ResolversTypes['CreateUserResponse'], ParentType, ContextType, RequireFields<MutationCreateUserArgs, 'input'>>;
+  login?: Resolver<ResolversTypes['UserLoginResponse'], ParentType, ContextType, RequireFields<MutationLoginArgs, 'input'>>;
+  logout?: Resolver<ResolversTypes['UserLogoutResponse'], ParentType, ContextType>;
+}>;
+
+export type UserResolvers<ContextType = any, ParentType extends ResolversParentTypes['User'] = ResolversParentTypes['User']> = ResolversObject<{
+  dateOfBirth?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  email?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  firstName?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  lastName?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
+}>;
+
+export type UserLoginResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['UserLoginResponse'] = ResolversParentTypes['UserLoginResponse']> = ResolversObject<{
+  error?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  success?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  token?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  user?: Resolver<Maybe<ResolversTypes['User']>, ParentType, ContextType>;
+  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
+}>;
+
+export type UserLogoutResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['UserLogoutResponse'] = ResolversParentTypes['UserLogoutResponse']> = ResolversObject<{
+  success?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
+}>;
+
+export type Resolvers<ContextType = any> = ResolversObject<{
+  CreateUserResponse?: CreateUserResponseResolvers<ContextType>;
+  Mutation?: MutationResolvers<ContextType>;
+  User?: UserResolvers<ContextType>;
+  UserLoginResponse?: UserLoginResponseResolvers<ContextType>;
+  UserLogoutResponse?: UserLogoutResponseResolvers<ContextType>;
+}>;
+

services/Dockerfile

@@ -1,26 +0,0 @@
-FROM node:22-slim AS builder
-
-RUN apt-get update && apt-get dist-upgrade -y && apt-get install -y ca-certificates build-essential
-
-RUN corepack enable && corepack prepare pnpm@latest --activate
-
-WORKDIR /app
-
-COPY . .
-
-RUN pnpm install --filter=api...
-
-RUN pnpm --filter=api run build || true
-
-FROM node:22-slim
-
-WORKDIR /app
-
-COPY --from=builder /app/services ./services
-COPY --from=builder /app/node_modules ./node_modules
-
-WORKDIR /app/services
-
-EXPOSE 4000
-
-CMD ["node", "--import", "tsx", "src/index.ts"]

services/auth/README.md

@@ -0,0 +1,10 @@
+# Auth Service
+This service handles user authentication and authorization using Ory Kratos and integrates with a REST API.
+
+## Technologies Used
+- **Ory Kratos (self-hosted)**: Identity and user management system.
+- **Express.js**: Web framework for building the REST API.
+- **PostgreSQL**: Database for storing user data.
+- **Docker**: Kratos, PostgreSQL, and this service are containerized for easy deployment.
+
+Kratos was chosen for its robust identity management capabilities, including support for multiple authentication methods and self-service flows. It also provides first class support for PostgreSQL, which was my preferred database choice for this project.

services/auth/db_docker_config/Dockerfile

@@ -0,0 +1,232 @@
+FROM debian:{{ env.variant }}-slim
+
+# explicitly set user/group IDs
+RUN set -eux; \
+	groupadd -r postgres --gid=999; \
+# https://salsa.debian.org/postgresql/postgresql-common/blob/997d842ee744687d99a2b2d95c1083a2615c79e8/debian/postgresql-common.postinst#L32-35
+	useradd -r -g postgres --uid=999 --home-dir=/var/lib/postgresql --shell=/bin/bash postgres; \
+# also create the postgres user's home directory with appropriate permissions
+# see https://github.com/docker-library/postgres/issues/274
+	install --verbose --directory --owner postgres --group postgres --mode 1777 /var/lib/postgresql
+
+RUN set -ex; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		gnupg \
+# https://www.postgresql.org/docs/16/app-psql.html#APP-PSQL-META-COMMAND-PSET-PAGER
+# https://github.com/postgres/postgres/blob/REL_16_1/src/include/fe_utils/print.h#L25
+# (if "less" is available, it gets used as the default pager for psql, and it only adds ~1.5MiB to our image size)
+		less \
+	; \
+	rm -rf /var/lib/apt/lists/*
+
+# grab gosu for easy step-down from root
+# https://github.com/tianon/gosu/releases
+ENV GOSU_VERSION 1.17
+RUN set -eux; \
+	savedAptMark="$(apt-mark showmanual)"; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends ca-certificates wget; \
+	rm -rf /var/lib/apt/lists/*; \
+	dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
+	wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
+	wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
+	export GNUPGHOME="$(mktemp -d)"; \
+	gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
+	gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
+	apt-mark auto '.*' > /dev/null; \
+	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	chmod +x /usr/local/bin/gosu; \
+	gosu --version; \
+	gosu nobody true
+
+# make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default
+RUN set -eux; \
+	if [ -f /etc/dpkg/dpkg.cfg.d/docker ]; then \
+# if this file exists, we're likely in "debian:xxx-slim", and locales are thus being excluded so we need to remove that exclusion (since we need locales)
+		grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
+		sed -ri '/\/usr\/share\/locale/d' /etc/dpkg/dpkg.cfg.d/docker; \
+		! grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
+	fi; \
+	apt-get update; apt-get install -y --no-install-recommends locales; rm -rf /var/lib/apt/lists/*; \
+	echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen; \
+	locale-gen; \
+	locale -a | grep 'en_US.utf8'
+ENV LANG en_US.utf8
+
+RUN set -eux; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		libnss-wrapper \
+		xz-utils \
+		zstd \
+	; \
+	rm -rf /var/lib/apt/lists/*
+
+RUN mkdir /docker-entrypoint-initdb.d
+
+RUN set -ex; \
+# pub   4096R/ACCC4CF8 2011-10-13 [expires: 2019-07-02]
+#       Key fingerprint = B97B 0AFC AA1A 47F0 44F2  44A0 7FCC 7D46 ACCC 4CF8
+# uid                  PostgreSQL Debian Repository
+	key='B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8'; \
+	export GNUPGHOME="$(mktemp -d)"; \
+	mkdir -p /usr/local/share/keyrings/; \
+	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+	gpg --batch --export --armor "$key" > /usr/local/share/keyrings/postgres.gpg.asc; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME"
+
+ENV PG_MAJOR {{ env.version }}
+ENV PATH $PATH:/usr/lib/postgresql/$PG_MAJOR/bin
+
+ENV PG_VERSION {{ .[env.variant].version }}
+
+RUN set -ex; \
+	\
+# see note below about "*.pyc" files
+	export PYTHONDONTWRITEBYTECODE=1; \
+	\
+	dpkgArch="$(dpkg --print-architecture)"; \
+	aptRepo="[ signed-by=/usr/local/share/keyrings/postgres.gpg.asc ] http://apt.postgresql.org/pub/repos/apt/ {{ env.variant }}-pgdg main $PG_MAJOR"; \
+	case "$dpkgArch" in \
+		{{ .[env.variant].arches | join(" | ") }}) \
+# arches officialy built by upstream
+			echo "deb $aptRepo" > /etc/apt/sources.list.d/pgdg.list; \
+			apt-get update; \
+			;; \
+		*) \
+# we're on an architecture upstream doesn't officially build for
+# let's build binaries from their published source packages
+			echo "deb-src $aptRepo" > /etc/apt/sources.list.d/pgdg.list; \
+			\
+			savedAptMark="$(apt-mark showmanual)"; \
+			\
+			tempDir="$(mktemp -d)"; \
+			cd "$tempDir"; \
+			\
+# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
+			apt-get update; \
+			apt-get install -y --no-install-recommends dpkg-dev; \
+			echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list; \
+			_update_repo() { \
+				dpkg-scanpackages . > Packages; \
+# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
+#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
+#   ...
+#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
+				apt-get -o Acquire::GzipIndexes=false update; \
+			}; \
+			_update_repo; \
+			\
+# build .deb files from upstream's source packages (which are verified by apt-get)
+			nproc="$(nproc)"; \
+			export DEB_BUILD_OPTIONS="nocheck parallel=$nproc"; \
+# we have to build postgresql-common-dev first because postgresql-$PG_MAJOR shares "debian/rules" logic with it: https://salsa.debian.org/postgresql/postgresql/-/commit/f4338a0d28cf4541956bddb0f4e444ba9dba81b9
+			apt-get build-dep -y postgresql-common-dev; \
+			apt-get source --compile postgresql-common-dev; \
+			_update_repo; \
+{{ if .major == 13 then ( -}}
+# we need DEBIAN_FRONTEND on postgresql-13 for slapd ("Please enter the password for the admin entry in your LDAP directory."); see https://bugs.debian.org/929417
+			DEBIAN_FRONTEND=noninteractive \
+{{ ) else "" end -}}
+			apt-get build-dep -y "postgresql-$PG_MAJOR=$PG_VERSION"; \
+			apt-get source --compile "postgresql-$PG_MAJOR=$PG_VERSION"; \
+			\
+# we don't remove APT lists here because they get re-downloaded and removed later
+			\
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
+			apt-mark showmanual | xargs apt-mark auto > /dev/null; \
+			apt-mark manual $savedAptMark; \
+			\
+			ls -lAFh; \
+			_update_repo; \
+			grep '^Package: ' Packages; \
+			cd /; \
+			;; \
+	esac; \
+	\
+	apt-get install -y --no-install-recommends postgresql-common; \
+	sed -ri 's/#(create_main_cluster) .*$/\1 = false/' /etc/postgresql-common/createcluster.conf; \
+	apt-get install -y --no-install-recommends \
+		"postgresql-$PG_MAJOR=$PG_VERSION" \
+	; \
+{{ if .major >= 18 then ( -}}
+# https://github.com/docker-library/postgres/pull/1344#issuecomment-2936578203 (JIT is a separate package in 18+, but only supported for a subset of architectures)
+	if apt-get install -s "postgresql-$PG_MAJOR-jit" > /dev/null 2>&1; then \
+		apt-get install -y --no-install-recommends "postgresql-$PG_MAJOR-jit=$PG_VERSION"; \
+	fi; \
+{{ ) else "" end -}}
+	\
+	rm -rf /var/lib/apt/lists/*; \
+	\
+	if [ -n "$tempDir" ]; then \
+# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
+		apt-get purge -y --auto-remove; \
+		rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
+	fi; \
+	\
+# some of the steps above generate a lot of "*.pyc" files (and setting "PYTHONDONTWRITEBYTECODE" beforehand doesn't propagate properly for some reason), so we clean them up manually (as long as they aren't owned by a package)
+	find /usr -name '*.pyc' -type f -exec bash -c 'for pyc; do dpkg -S "$pyc" &> /dev/null || rm -vf "$pyc"; done' -- '{}' +; \
+	\
+	postgres --version
+
+# make the sample config easier to munge (and "correct by default")
+RUN set -eux; \
+	dpkg-divert --add --rename --divert "/usr/share/postgresql/postgresql.conf.sample.dpkg" "/usr/share/postgresql/$PG_MAJOR/postgresql.conf.sample"; \
+	cp -v /usr/share/postgresql/postgresql.conf.sample.dpkg /usr/share/postgresql/postgresql.conf.sample; \
+	ln -sv ../postgresql.conf.sample "/usr/share/postgresql/$PG_MAJOR/"; \
+	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" /usr/share/postgresql/postgresql.conf.sample; \
+	grep -F "listen_addresses = '*'" /usr/share/postgresql/postgresql.conf.sample
+
+RUN install --verbose --directory --owner postgres --group postgres --mode 3777 /var/run/postgresql
+
+{{ if .major >= 18 then ( -}}
+#
+# NOTE: in 18+, PGDATA has changed to match the pg_ctlcluster standard directory structure, and the VOLUME has moved from /var/lib/postgresql/data to /var/lib/postgresql
+#
+ENV PGDATA /var/lib/postgresql/{{ .major | tostring }}/docker
+RUN ln -svT . /var/lib/postgresql/data # https://github.com/docker-library/postgres/pull/1259#issuecomment-2215477494
+VOLUME /var/lib/postgresql
+# ("/var/lib/postgresql" is already pre-created with suitably usable permissions above)
+{{ ) else ( -}}
+ENV PGDATA /var/lib/postgresql/data
+# this 1777 will be replaced by 0700 at runtime (allows semi-arbitrary "--user" values)
+RUN install --verbose --directory --owner postgres --group postgres --mode 1777 "$PGDATA"
+VOLUME /var/lib/postgresql/data
+{{ ) end -}}
+
+COPY docker-entrypoint.sh docker-ensure-initdb.sh /usr/local/bin/
+RUN ln -sT docker-ensure-initdb.sh /usr/local/bin/docker-enforce-initdb.sh
+ENTRYPOINT ["docker-entrypoint.sh"]
+
+# We set the default STOPSIGNAL to SIGINT, which corresponds to what PostgreSQL
+# calls "Fast Shutdown mode" wherein new connections are disallowed and any
+# in-progress transactions are aborted, allowing PostgreSQL to stop cleanly and
+# flush tables to disk.
+#
+# See https://www.postgresql.org/docs/current/server-shutdown.html for more details
+# about available PostgreSQL server shutdown signals.
+#
+# See also https://www.postgresql.org/docs/current/server-start.html for further
+# justification of this as the default value, namely that the example (and
+# shipped) systemd service files use the "Fast Shutdown mode" for service
+# termination.
+#
+STOPSIGNAL SIGINT
+#
+# An additional setting that is recommended for all users regardless of this
+# value is the runtime "--stop-timeout" (or your orchestrator/runtime's
+# equivalent) for controlling how long to wait between sending the defined
+# STOPSIGNAL and sending SIGKILL.
+#
+# The default in most runtimes (such as Docker) is 10 seconds, and the
+# documentation at https://www.postgresql.org/docs/current/server-start.html notes
+# that even 90 seconds may not be long enough in many instances.
+
+EXPOSE 5432
+CMD ["postgres"]

services/auth/index.ts

@@ -0,0 +1 @@
+console.log("Hello World!");

services/auth/kratos/kratos.yml

@@ -0,0 +1,23 @@
+version: v0.11.0
+identity:
+  schemas:
+    - id: default
+      url: file:///etc/config/kratos/identity.schema.json
+dsn: postgres://postgres:secret@kratos-postgres:5432/kratos?sslmode=disable
+serve:
+  public:
+    base_url: http://localhost:4433/
+    cors:
+      enabled: true
+  admin:
+    base_url: http://localhost:4434/
+selfservice:
+  default_browser_return_url: http://localhost:3000/
+  flows:
+    login: {}
+    registration: {}
+  methods:
+    password:
+      enabled: true
+log:
+  level: debug

services/auth/package.json

@@ -1,20 +1,18 @@
 {
-  "name": "api",
+  "name": "auth",
   "version": "1.0.0",
   "description": "",
   "main": "src/index.js",
   "scripts": {
-    "dev": "nodemon --exec tsx src/index.ts",
-    "start": "node --import tsx src/index.ts",
-    "build": "tsc",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "build": "turbo run build"
   },
   "keywords": [],
   "author": "",
   "license": "ISC",
   "packageManager": "pnpm@10.13.1",
   "dependencies": {
-    "@ory/client": "^1.15.0",
+    "@ory/client-fetch": "^1.21.0",
     "apollo-server-express": "^3.13.0",
     "express": "^5.1.0",
     "graphql": "^16.11.0"
@@ -24,7 +22,6 @@
     "@types/node": "^20.19.7",
     "nodemon": "^3.1.10",
     "ts-node": "^10.9.2",
-    "tsx": "^4.19.0",
     "typescript": "^5.8.3"
   }
 }

services/src/auth/index.ts

@@ -1,5 +0,0 @@
-export {
-  kratosSessionMiddleware,
-  requireAuth,
-  type AuthenticatedRequest,
-} from "../middleware/kratosSession";

services/src/index.ts

@@ -1,74 +0,0 @@
-import express from "express";
-import { ApolloServer } from "apollo-server-express";
-import {
-  kratosSessionMiddleware,
-  AuthenticatedRequest,
-} from "./middleware/kratosSession";
-
-const typeDefs = `
-  type User {
-    id: ID!
-    email: String
-    firstName: String
-    lastName: String
-  }
-
-  type Query {
-    me: User
-    hello: String!
-  }
-`;
-
-interface Traits {
-  email?: string;
-  name?: {
-    first?: string;
-    last?: string;
-  };
-}
-
-const resolvers = {
-  Query: {
-    hello: () => "Hello from Lightsaver API!",
-    me: (_: unknown, __: unknown, context: { req: AuthenticatedRequest }) => {
-      const { session } = context.req;
-
-      if (!session || !session.identity) {
-        return null;
-      }
-
-      const traits = session.identity.traits as Traits;
-
-      return {
-        id: session.identity.id,
-        email: traits.email,
-        firstName: traits.name?.first,
-        lastName: traits.name?.last,
-      };
-    },
-  },
-};
-
-async function startServer() {
-  const app = express();
-
-  app.use(kratosSessionMiddleware);
-
-  const server = new ApolloServer({
-    typeDefs,
-    resolvers,
-    context: ({ req }: { req: AuthenticatedRequest }) => ({ req }),
-  });
-
-  await server.start();
-
-  server.applyMiddleware({ app, path: "/graphql" });
-
-  const port = process.env.PORT || 4000;
-
-  app.listen(port, () => {
-    console.log(`Server running at http://localhost:${port}/graphql`);
-  });
-}
-
-startServer().catch(console.error);

services/src/middleware/kratosSession.ts

@@ -1,55 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { Configuration, FrontendApi, Session } from "@ory/client";
-
-const kratosAdminUrl = process.env.KRATOS_ADMIN_URL || "http://localhost:4434";
-
-const kratosClient = new FrontendApi(
-  new Configuration({
-    basePath: kratosAdminUrl,
-  })
-);
-
-export interface AuthenticatedRequest extends Request {
-  session?: Session;
-  userId?: string;
-}
-
-export async function kratosSessionMiddleware(
-  req: AuthenticatedRequest,
-  res: Response,
-  next: NextFunction
-): Promise<void> {
-  const cookie = req.headers.cookie;
-
-  if (!cookie) {
-    next();
-    return;
-  }
-
-  try {
-    const { data: session } = await kratosClient.toSession({
-      cookie,
-    });
-
-    req.session = session;
-    req.userId = session.identity?.id;
-  } catch (error) {
-    // Session invalid or expired - continue without session
-    console.debug("No valid session found:", error);
-  }
-
-  next();
-}
-
-export function requireAuth(
-  req: AuthenticatedRequest,
-  res: Response,
-  next: NextFunction
-): void {
-  if (!req.session || !req.userId) {
-    res.status(401).json({ error: "Unauthorized" });
-    return;
-  }
-
-  next();
-}

tsconfig.json

@@ -0,0 +1,114 @@
+{
+  "compilerOptions": {
+    /* Visit https://aka.ms/tsconfig to read more about this file */
+
+    /* Projects */
+    // "incremental": true,                              /* Save .tsbuildinfo files to allow for incremental compilation of projects. */
+    // "composite": true,                                /* Enable constraints that allow a TypeScript project to be used with project references. */
+    // "tsBuildInfoFile": "./.tsbuildinfo",              /* Specify the path to .tsbuildinfo incremental compilation file. */
+    // "disableSourceOfProjectReferenceRedirect": true,  /* Disable preferring source files instead of declaration files when referencing composite projects. */
+    // "disableSolutionSearching": true,                 /* Opt a project out of multi-project reference checking when editing. */
+    // "disableReferencedProjectLoad": true,             /* Reduce the number of projects loaded automatically by TypeScript. */
+
+    /* Language and Environment */
+    "target": "es2024",                                  /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */
+    // "lib": [],                                        /* Specify a set of bundled library declaration files that describe the target runtime environment. */
+    // "jsx": "preserve",                                /* Specify what JSX code is generated. */
+    // "libReplacement": true,                           /* Enable lib replacement. */
+    // "experimentalDecorators": true,                   /* Enable experimental support for legacy experimental decorators. */
+    // "emitDecoratorMetadata": true,                    /* Emit design-type metadata for decorated declarations in source files. */
+    // "jsxFactory": "",                                 /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h'. */
+    // "jsxFragmentFactory": "",                         /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
+    // "jsxImportSource": "",                            /* Specify module specifier used to import the JSX factory functions when using 'jsx: react-jsx*'. */
+    // "reactNamespace": "",                             /* Specify the object invoked for 'createElement'. This only applies when targeting 'react' JSX emit. */
+    // "noLib": true,                                    /* Disable including any library files, including the default lib.d.ts. */
+    // "useDefineForClassFields": true,                  /* Emit ECMAScript-standard-compliant class fields. */
+    // "moduleDetection": "auto",                        /* Control what method is used to detect module-format JS files. */
+
+    /* Modules */
+    "module": "nodenext",                                /* Specify what module code is generated. */
+    // "rootDir": "./",                                  /* Specify the root folder within your source files. */
+    // "moduleResolution": "node10",                     /* Specify how TypeScript looks up a file from a given module specifier. */
+    // "baseUrl": "./",                                  /* Specify the base directory to resolve non-relative module names. */
+    // "paths": {},                                      /* Specify a set of entries that re-map imports to additional lookup locations. */
+    // "rootDirs": [],                                   /* Allow multiple folders to be treated as one when resolving modules. */
+    // "typeRoots": [],                                  /* Specify multiple folders that act like './node_modules/@types'. */
+    // "types": [],                                      /* Specify type package names to be included without being referenced in a source file. */
+    // "allowUmdGlobalAccess": true,                     /* Allow accessing UMD globals from modules. */
+    // "moduleSuffixes": [],                             /* List of file name suffixes to search when resolving a module. */
+    // "allowImportingTsExtensions": true,               /* Allow imports to include TypeScript file extensions. Requires '--moduleResolution bundler' and either '--noEmit' or '--emitDeclarationOnly' to be set. */
+    // "rewriteRelativeImportExtensions": true,          /* Rewrite '.ts', '.tsx', '.mts', and '.cts' file extensions in relative import paths to their JavaScript equivalent in output files. */
+    // "resolvePackageJsonExports": true,                /* Use the package.json 'exports' field when resolving package imports. */
+    // "resolvePackageJsonImports": true,                /* Use the package.json 'imports' field when resolving imports. */
+    // "customConditions": [],                           /* Conditions to set in addition to the resolver-specific defaults when resolving imports. */
+    // "noUncheckedSideEffectImports": true,             /* Check side effect imports. */
+    // "resolveJsonModule": true,                        /* Enable importing .json files. */
+    // "allowArbitraryExtensions": true,                 /* Enable importing files with any extension, provided a declaration file is present. */
+    // "noResolve": true,                                /* Disallow 'import's, 'require's or '<reference>'s from expanding the number of files TypeScript should add to a project. */
+
+    /* JavaScript Support */
+    // "allowJs": true,                                  /* Allow JavaScript files to be a part of your program. Use the 'checkJS' option to get errors from these files. */
+    // "checkJs": true,                                  /* Enable error reporting in type-checked JavaScript files. */
+    // "maxNodeModuleJsDepth": 1,                        /* Specify the maximum folder depth used for checking JavaScript files from 'node_modules'. Only applicable with 'allowJs'. */
+
+    /* Emit */
+    // "declaration": true,                              /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
+    // "declarationMap": true,                           /* Create sourcemaps for d.ts files. */
+    "moduleResolution": "nodenext",                     /* Specify how TypeScript looks up a file from a given module specifier. */
+    // "emitDeclarationOnly": true,                      /* Only output d.ts files and not JavaScript files. */
+    // "sourceMap": true,                                /* Create source map files for emitted JavaScript files. */
+    // "inlineSourceMap": true,                          /* Include sourcemap files inside the emitted JavaScript. */
+    // "noEmit": true,                                   /* Disable emitting files from a compilation. */
+    // "outFile": "./",                                  /* Specify a file that bundles all outputs into one JavaScript file. If 'declaration' is true, also designates a file that bundles all .d.ts output. */
+    // "outDir": "./",                                   /* Specify an output folder for all emitted files. */
+    // "removeComments": true,                           /* Disable emitting comments. */
+    // "importHelpers": true,                            /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
+    // "downlevelIteration": true,                       /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
+    // "sourceRoot": "",                                 /* Specify the root path for debuggers to find the reference source code. */
+    // "mapRoot": "",                                    /* Specify the location where debugger should locate map files instead of generated locations. */
+    // "inlineSources": true,                            /* Include source code in the sourcemaps inside the emitted JavaScript. */
+    // "emitBOM": true,                                  /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
+    // "newLine": "crlf",                                /* Set the newline character for emitting files. */
+    // "stripInternal": true,                            /* Disable emitting declarations that have '@internal' in their JSDoc comments. */
+    // "noEmitHelpers": true,                            /* Disable generating custom helper functions like '__extends' in compiled output. */
+    // "noEmitOnError": true,                            /* Disable emitting files if any type checking errors are reported. */
+    // "preserveConstEnums": true,                       /* Disable erasing 'const enum' declarations in generated code. */
+    // "declarationDir": "./",                           /* Specify the output directory for generated declaration files. */
+
+    /* Interop Constraints */
+    // "isolatedModules": true,                          /* Ensure that each file can be safely transpiled without relying on other imports. */
+    // "verbatimModuleSyntax": true,                     /* Do not transform or elide any imports or exports not marked as type-only, ensuring they are written in the output file's format based on the 'module' setting. */
+    // "isolatedDeclarations": true,                     /* Require sufficient annotation on exports so other tools can trivially generate declaration files. */
+    // "erasableSyntaxOnly": true,                       /* Do not allow runtime constructs that are not part of ECMAScript. */
+    // "allowSyntheticDefaultImports": true,             /* Allow 'import x from y' when a module doesn't have a default export. */
+    "esModuleInterop": true,                             /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility. */
+    // "preserveSymlinks": true,                         /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
+    "forceConsistentCasingInFileNames": true,            /* Ensure that casing is correct in imports. */
+
+    /* Type Checking */
+    "strict": true,                                      /* Enable all strict type-checking options. */
+    // "noImplicitAny": true,                            /* Enable error reporting for expressions and declarations with an implied 'any' type. */
+    // "strictNullChecks": true,                         /* When type checking, take into account 'null' and 'undefined'. */
+    // "strictFunctionTypes": true,                      /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
+    // "strictBindCallApply": true,                      /* Check that the arguments for 'bind', 'call', and 'apply' methods match the original function. */
+    // "strictPropertyInitialization": true,             /* Check for class properties that are declared but not set in the constructor. */
+    // "strictBuiltinIteratorReturn": true,              /* Built-in iterators are instantiated with a 'TReturn' type of 'undefined' instead of 'any'. */
+    // "noImplicitThis": true,                           /* Enable error reporting when 'this' is given the type 'any'. */
+    // "useUnknownInCatchVariables": true,               /* Default catch clause variables as 'unknown' instead of 'any'. */
+    // "alwaysStrict": true,                             /* Ensure 'use strict' is always emitted. */
+    // "noUnusedLocals": true,                           /* Enable error reporting when local variables aren't read. */
+    // "noUnusedParameters": true,                       /* Raise an error when a function parameter isn't read. */
+    // "exactOptionalPropertyTypes": true,               /* Interpret optional property types as written, rather than adding 'undefined'. */
+    // "noImplicitReturns": true,                        /* Enable error reporting for codepaths that do not explicitly return in a function. */
+    // "noFallthroughCasesInSwitch": true,               /* Enable error reporting for fallthrough cases in switch statements. */
+    // "noUncheckedIndexedAccess": true,                 /* Add 'undefined' to a type when accessed using an index. */
+    // "noImplicitOverride": true,                       /* Ensure overriding members in derived classes are marked with an override modifier. */
+    // "noPropertyAccessFromIndexSignature": true,       /* Enforces using indexed accessors for keys declared using an indexed type. */
+    // "allowUnusedLabels": true,                        /* Disable error reporting for unused labels. */
+    // "allowUnreachableCode": true,                     /* Disable error reporting for unreachable code. */
+
+    /* Completeness */
+    // "skipDefaultLibCheck": true,                      /* Skip type checking .d.ts files that are included with TypeScript. */
+    "skipLibCheck": true                                 /* Skip type checking all .d.ts files. */
+  }
+}