Wave 2 (M1): InterlinedDomain slice — models, MessagesService, SessionService, EntitlementsService

- Domain models (Message/UserSummary/CurrentUser/Visibility/TimelineScope) + DTO mappers; no DTO leaks, no SwiftUI.
- MessagesService: timeline(scope/tag/paging) + stream (stale-while-revalidate), message(id), replies; consumes Paginated via PaginatedDecoder.
- SessionService: restore/signIn/register/reset/signOut over AuthService + GET /api/user; SessionState stream.
- EntitlementsService: customerStatus -> Feature gating switch.
- MessageStore cache port + InMemoryMessageStore default. 50 BDD tests passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Adron

Packages/InterlinedDomain/Sources/InterlinedDomain/Caching/InMemoryMessageStore.swift

@@ -0,0 +1,48 @@
+import Foundation
+
+/// An in-memory `MessageStore`, used as the default cache in tests and in any
+/// context that has no persistence layer wired up yet. The real, durable
+/// implementation is the SwiftData store in `InterlinedPersistence`.
+///
+/// Implemented as an `actor` so its mutable state is safe under Swift 6 strict
+/// concurrency without manual locking.
+public actor InMemoryMessageStore: MessageStore {
+
+    /// Cache key for a timeline slice: a scope combined with an optional tag.
+    /// The two together identify a distinct cached feed.
+    private struct TimelineKey: Hashable {
+        let scope: TimelineScope
+        let tag: String?
+    }
+
+    private var timelines: [TimelineKey: [Message]] = [:]
+    private var messagesByID: [String: Message] = [:]
+
+    public init() {}
+
+    public func cachedTimeline(scope: TimelineScope, tag: String?) async -> [Message] {
+        timelines[TimelineKey(scope: scope, tag: tag)] ?? []
+    }
+
+    public func replaceTimeline(_ messages: [Message], scope: TimelineScope, tag: String?) async {
+        timelines[TimelineKey(scope: scope, tag: tag)] = messages
+        for message in messages {
+            messagesByID[message.id] = message
+        }
+    }
+
+    public func cachedMessage(id: String) async -> Message? {
+        messagesByID[id]
+    }
+
+    public func upsert(_ messages: [Message]) async {
+        for message in messages {
+            messagesByID[message.id] = message
+        }
+    }
+
+    public func clear() async {
+        timelines.removeAll()
+        messagesByID.removeAll()
+    }
+}

Packages/InterlinedDomain/Sources/InterlinedDomain/Caching/MessageStore.swift

@@ -0,0 +1,28 @@
+import Foundation
+
+/// The cache port the persistence layer implements (PLAN.md §5 — timeline and
+/// lists read from a SwiftData cache with stale-while-revalidate). The
+/// SwiftData-backed conformance lives in `InterlinedPersistence`; the domain
+/// layer depends only on this protocol so its services can be tested without a
+/// database and run cache-less when no store is injected.
+///
+/// All methods are `async` so a real implementation can hop to a database
+/// actor; they are non-throwing because a cache miss or write failure must
+/// never break a live fetch — the service treats the cache as best-effort.
+public protocol MessageStore: Sendable {
+    /// The cached messages for a given timeline scope + tag filter, or `[]`
+    /// when nothing is cached.
+    func cachedTimeline(scope: TimelineScope, tag: String?) async -> [Message]
+
+    /// Replaces the cached messages for a scope + tag with a fresh page.
+    func replaceTimeline(_ messages: [Message], scope: TimelineScope, tag: String?) async
+
+    /// A single cached message by id, or `nil` when not cached.
+    func cachedMessage(id: String) async -> Message?
+
+    /// Inserts or updates messages in the by-id cache.
+    func upsert(_ messages: [Message]) async
+
+    /// Clears all cached state. Called on sign-out.
+    func clear() async
+}

Packages/InterlinedDomain/Sources/InterlinedDomain/InterlinedDomain.swift

@@ -1,17 +1,25 @@
 // InterlinedDomain
 //
-// Domain layer for InterlinedList — app-facing models and services that
-// depend on InterlinedKit protocols. M0 placeholder; real services
-// (MessagesService, ListsService, DocumentsService, SocialService,
-// OrgService, NotificationsService, EntitlementsService) are built in
-// later waves per PLAN.md §3 and §6.
+// Business-logic layer for InterlinedList — app-facing models and services that
+// depend on InterlinedKit protocols (PLAN.md §3). UI-agnostic: this package
+// must never import SwiftUI or AppKit. DTOs from InterlinedKit are mapped to
+// domain models at the boundary (`Models/Mappers.swift`) and never escape this
+// package.
+//
+//   Models/   — Message, UserSummary, CurrentUser, Visibility, TimelineScope,
+//               TimelinePage, and the DTO → domain mappers.
+//   Services/ — MessagesService, SessionService, EntitlementsService.
+//   Caching/  — the MessageStore cache port + an in-memory implementation.
+//
+// The login + timeline vertical slice (M1) lives here; Lists / Social / Orgs /
+// Documents services arrive in their later milestones.
 
 import Foundation
 import InterlinedKit
 
 /// Namespace marker for the InterlinedDomain module.
 public enum InterlinedDomain {
-    /// References the underlying kit schema so the domain layer can assert
-    /// it is built against a compatible InterlinedKit version.
-    public static let kitSchemaVersion: String = InterlinedKit.schemaVersion
+    /// The version of the kit this domain layer was built against. Surfaced so
+    /// accidental local-package version skew is visible at a glance.
+    public static let builtAgainstKitVersion: String = InterlinedKit.schemaVersion
 }

Packages/InterlinedDomain/Sources/InterlinedDomain/Models/CurrentUser.swift

@@ -0,0 +1,81 @@
+import Foundation
+
+/// A typed reading of the API's free-form `customerStatus` string.
+///
+/// The wire field is an open `String` (`UserDTO.customerStatus`) so the kit
+/// stays a faithful mirror. The domain layer narrows it to the cases the app
+/// gates on, preserving any unknown value under `.other` so an unexpected
+/// status never silently reads as "free" or crashes a switch.
+public enum CustomerStatus: Sendable, Equatable, Hashable {
+    /// An active paid subscriber.
+    case subscriber
+    /// A free account with no active subscription.
+    case free
+    /// A status string the client does not yet recognise. Treated as
+    /// non-subscriber for gating but preserved for display / telemetry.
+    case other(String)
+
+    /// Maps the raw wire string to a case. The set of "subscriber" values is
+    /// kept deliberately small and explicit; anything else is `.other`.
+    public init(raw: String) {
+        switch raw.lowercased() {
+        case "subscriber", "active", "subscribed", "paid":
+            self = .subscriber
+        case "free", "none", "inactive", "", "canceled", "cancelled":
+            self = .free
+        default:
+            self = .other(raw)
+        }
+    }
+
+    /// Whether this status grants subscriber-only features.
+    public var isSubscriber: Bool {
+        self == .subscriber
+    }
+
+    /// The original wire value, for display or round-tripping.
+    public var rawValue: String {
+        switch self {
+        case .subscriber: return "subscriber"
+        case .free: return "free"
+        case .other(let raw): return raw
+        }
+    }
+}
+
+/// The full signed-in account (PLAN.md §3, §1 "Subscriber gating").
+///
+/// Maps from `UserDTO`. Carries the author identity (`summary`) so the same
+/// projection used on message cards is reused for the current user, plus the
+/// account-only fields the app needs: email, subscriber status, and the
+/// optional counters the API exposes.
+public struct CurrentUser: Sendable, Equatable, Identifiable {
+    /// The author identity (id, username, display name, avatar).
+    public let summary: UserSummary
+    public let email: String
+    public let customerStatus: CustomerStatus
+    public let isEmailVerified: Bool
+    public let isPrivateAccount: Bool
+    public let createdAt: Date
+
+    public var id: String { summary.id }
+    public var username: String { summary.username }
+    public var displayName: String { summary.displayName }
+    public var avatarURL: URL? { summary.avatarURL }
+
+    public init(
+        summary: UserSummary,
+        email: String,
+        customerStatus: CustomerStatus,
+        isEmailVerified: Bool,
+        isPrivateAccount: Bool,
+        createdAt: Date
+    ) {
+        self.summary = summary
+        self.email = email
+        self.customerStatus = customerStatus
+        self.isEmailVerified = isEmailVerified
+        self.isPrivateAccount = isPrivateAccount
+        self.createdAt = createdAt
+    }
+}

Packages/InterlinedDomain/Sources/InterlinedDomain/Models/Mappers.swift

@@ -0,0 +1,85 @@
+import Foundation
+import InterlinedKit
+
+// MARK: - DTO → domain mapping
+//
+// One file owns every kit-DTO → domain-model translation so the boundary is
+// auditable in a single place (PLAN.md §3 "DTOs never cross into the UI;
+// domain models do"). Mappers are pure, total functions implemented as
+// `init(from:)` so call sites read as plain conversions.
+
+extension UserSummary {
+    /// Maps the embedded author summary. Display name falls back to the
+    /// username when the API omits it; the avatar string is parsed into a URL
+    /// and silently dropped if it is not a valid URL.
+    public init(from dto: UserSummaryDTO) {
+        self.init(
+            id: dto.id,
+            username: dto.username,
+            displayName: dto.displayName ?? dto.username,
+            avatarURL: dto.avatar.flatMap(URL.init(string:))
+        )
+    }
+}
+
+extension CurrentUser {
+    /// Maps the full account from the `GET /api/user` payload (the nested
+    /// `UserDTO`). `customerStatus` is narrowed to the typed `CustomerStatus`;
+    /// nullable account flags collapse to `false` defaults.
+    public init(from dto: UserDTO) {
+        self.init(
+            summary: UserSummary(
+                id: dto.id,
+                username: dto.username,
+                displayName: dto.displayName ?? dto.username,
+                avatarURL: dto.avatar.flatMap(URL.init(string:))
+            ),
+            email: dto.email,
+            customerStatus: CustomerStatus(raw: dto.customerStatus),
+            isEmailVerified: dto.emailVerified,
+            isPrivateAccount: dto.isPrivateAccount ?? false,
+            createdAt: dto.createdAt
+        )
+    }
+}
+
+extension Message {
+    /// Maps a message. Nullable `tags` collapses to `[]`; `publiclyVisible`
+    /// becomes a `Visibility`; the nested repost target (when present) is
+    /// mapped recursively. `replyCount` is left `nil` because `MessageDTO`
+    /// carries no reply count — the replies endpoint reports its own total.
+    public init(from dto: MessageDTO) {
+        self.init(
+            id: dto.id,
+            author: UserSummary(from: dto.user),
+            text: dto.content,
+            createdAt: dto.createdAt,
+            updatedAt: dto.updatedAt,
+            tags: dto.tags ?? [],
+            visibility: Visibility(publiclyVisible: dto.publiclyVisible),
+            digCount: dto.digCount,
+            didDig: dto.dugByMe,
+            repostCount: dto.pushCount,
+            replyCount: nil,
+            parentID: dto.parentId,
+            repost: dto.pushedMessage.map { box in
+                Repost.message(Message(from: box.message))
+            },
+            scheduledAt: dto.scheduledAt
+        )
+    }
+}
+
+extension TimelinePage {
+    /// Builds a page from the kit's `Paginated<MessageDTO>` envelope, mapping
+    /// each DTO and deriving the next-page cursor from the pagination block.
+    public init(from paginated: Paginated<MessageDTO>) {
+        let messages = paginated.items.map(Message.init(from:))
+        let info = paginated.pagination
+        self.init(
+            messages: messages,
+            hasMore: info.hasMore,
+            nextOffset: info.hasMore ? info.offset + info.limit : nil
+        )
+    }
+}

Packages/InterlinedDomain/Sources/InterlinedDomain/Models/Message.swift

@@ -0,0 +1,111 @@
+import Foundation
+
+/// A single timeline message (post), as the UI consumes it (PLAN.md §1, §3).
+///
+/// This is the domain projection of `MessageDTO`: optional/nullable wire
+/// fields are resolved into sensible non-optional defaults where the UI always
+/// needs a value (`tags` defaults to `[]`), the `publiclyVisible` boolean
+/// becomes a `Visibility`, and the recursively-nested repost target is carried
+/// as an indirect `repost`. No `MessageDTO` ever escapes this package.
+public struct Message: Sendable, Equatable, Identifiable {
+    public let id: String
+    /// The author identity for the card / thread row.
+    public let author: UserSummary
+    /// The message body. Markdown source is authored inline here; the renderer
+    /// in the App layer turns it into attributed text.
+    public let text: String
+    public let createdAt: Date
+    public let updatedAt: Date
+    public let tags: [String]
+    public let visibility: Visibility
+
+    /// "I Dig!" reaction count and whether the signed-in user has dug it.
+    public let digCount: Int
+    public let didDig: Bool
+
+    /// Repost ("push") count.
+    public let repostCount: Int
+
+    /// Number of direct replies, when the payload carries it. `nil` when the
+    /// message endpoint did not include a reply count (the list endpoint does
+    /// not; the replies endpoint reports its own `total`). Kept optional rather
+    /// than defaulted to `0` so the UI can distinguish "no replies" from
+    /// "unknown".
+    public let replyCount: Int?
+
+    /// The id of the parent message when this is a reply.
+    public let parentID: String?
+
+    /// The original message this post reposted, if any. `indirect` because a
+    /// `Message` can contain another `Message`.
+    public let repost: Repost?
+
+    /// When set, the message is scheduled for future publication at this time.
+    public let scheduledAt: Date?
+
+    public init(
+        id: String,
+        author: UserSummary,
+        text: String,
+        createdAt: Date,
+        updatedAt: Date,
+        tags: [String] = [],
+        visibility: Visibility,
+        digCount: Int,
+        didDig: Bool,
+        repostCount: Int,
+        replyCount: Int? = nil,
+        parentID: String? = nil,
+        repost: Repost? = nil,
+        scheduledAt: Date? = nil
+    ) {
+        self.id = id
+        self.author = author
+        self.text = text
+        self.createdAt = createdAt
+        self.updatedAt = updatedAt
+        self.tags = tags
+        self.visibility = visibility
+        self.digCount = digCount
+        self.didDig = didDig
+        self.repostCount = repostCount
+        self.replyCount = replyCount
+        self.parentID = parentID
+        self.repost = repost
+        self.scheduledAt = scheduledAt
+    }
+}
+
+/// Indirection box for a reposted message. A value type cannot contain itself
+/// by value, so the nested original message is held behind `indirect`.
+public indirect enum Repost: Sendable, Equatable {
+    case message(Message)
+
+    /// The reposted original.
+    public var original: Message {
+        switch self {
+        case .message(let message): return message
+        }
+    }
+}
+
+/// One page of a timeline read: the messages plus the cursor needed to ask for
+/// the next page. Maps the kit's `PaginationInfo` envelope into the two values
+/// the UI's infinite scroll actually needs.
+public struct TimelinePage: Sendable, Equatable {
+    public let messages: [Message]
+    /// Whether the server reports more messages beyond this page.
+    public let hasMore: Bool
+    /// The `offset` to pass for the next page. `nil` when `hasMore` is false.
+    public let nextOffset: Int?
+
+    public init(messages: [Message], hasMore: Bool, nextOffset: Int?) {
+        self.messages = messages
+        self.hasMore = hasMore
+        self.nextOffset = nextOffset
+    }
+
+    /// An empty page with no further results — the boundary value used when a
+    /// scope has no messages.
+    public static let empty = TimelinePage(messages: [], hasMore: false, nextOffset: nil)
+}