@de-otio/trellis 0.7.1 → 0.10.0

package/dist/lib/graph/postgres/discovery.js

@@ -0,0 +1,579 @@
+import { getCurrentTenantId } from "@de-otio/saas-foundation/tenant";
+/**
+ * Entity-edge labels traversed during discovery. Mirrors the fixed Cypher label
+ * set `PLAYMATE|PACK_MATE|SIBLING|PARENT|OFFSPRING|WALK_BUDDY`. Hard-coded (not
+ * user input) so it is safe to bind as a single `= ANY($n)` array parameter.
+ */
+const TRAVERSAL_EDGE_TYPES = [
+    "PACK_MATE",
+    "SIBLING",
+    "PLAYMATE",
+    "PARENT",
+    "OFFSPRING",
+    "WALK_BUDDY",
+];
+/** Radius (m) for the recommendations nearby signal. Mirrors the Neo4j constant. */
+const NEARBY_RECO_RADIUS_METERS = 5000;
+/**
+ * Discovery ranking version — increment whenever the recommendation signals,
+ * their weights, the merge/dedup semantics, or the diversity cap change.
+ *
+ * Mirrors `FEED_RANKING_VERSION` (feed-pagination.ts): a version change is a new
+ * experimental condition for `/api/discovery/recommendations` and must be
+ * audited accordingly. The discovery surface is engagement-adjacent (signals are
+ * derived from the relationship graph), so the same provenance discipline applies.
+ *
+ * Current version 1: shared-connections (count/10) + same-breed (0.6 fixed) +
+ * nearby ((1 − d/10 000) × 0.5, 5 km) signals, dedup-by-entity-keep-highest, and
+ * the per-owner diversity cap (`MAX_RECOMMENDATIONS_PER_OWNER`) with a single
+ * relaxation pass. Version 1 is the FIRST version ever served, so the cap is part
+ * of it — not a bump from an uncapped predecessor (no recommendation has been
+ * served without the cap).
+ */
+export const DISCOVERY_RANKING_VERSION = 1;
+/**
+ * Maximum recommendations a single owner may contribute to one page. The cap is
+ * per-OWNER (entity dedup is handled separately): a multi-owner entity counts
+ * against EVERY active owner and is admitted only if all its owners are under the
+ * cap. Ownerless candidates (empty `ownerIds`) are exempt. See SCORING-CODEBOOK.md
+ * "Discovery Recommendation Signals".
+ */
+export const MAX_RECOMMENDATIONS_PER_OWNER = 2;
+/**
+ * Pure merge for the recommendation signals (no I/O — business logic isolated for
+ * verification). Three bounded steps, no loop on external state:
+ *
+ *  1. Dedup by entity, keeping the highest-scoring entry per entity (preserves the
+ *     pre-cap semantics the tests pin).
+ *  2. Capped round-robin fill across the signal sources IN ORDER (shared → breed →
+ *     nearby), each source pre-sorted by score desc. A candidate is admitted iff
+ *     every owner in `ownerIds` is below `MAX_RECOMMENDATIONS_PER_OWNER`; on admit
+ *     all its owners' counts increment. Ownerless candidates are always admissible.
+ *     One full cycle over all candidates.
+ *  3. Relaxation: if still under `limit` after the capped pass, admit the remaining
+ *     skipped candidates by GLOBAL score desc, ignoring the cap (fill beats starve).
+ *
+ * Hard bound: exactly two passes (capped, then relaxation). The dedup map and the
+ * cap-count map are the only mutable state; neither can grow unbounded.
+ *
+ * @param signals per-source candidate arrays in fill order: [shared, breed, nearby]
+ * @param limit   maximum page size
+ */
+export function mergeRecommendations(signals, limit) {
+    if (limit <= 0)
+        return [];
+    // Step 1: dedup by entity, keeping the highest score. Track which source the
+    // surviving candidate came from so the round-robin order is stable.
+    const winnerByEntity = new Map();
+    signals.forEach((source, sourceIndex) => {
+        for (const candidate of source) {
+            const existing = winnerByEntity.get(candidate.entityId);
+            if (!existing || candidate.score > existing.candidate.score) {
+                winnerByEntity.set(candidate.entityId, { candidate, source: sourceIndex });
+            }
+        }
+    });
+    // Re-bucket the de-duplicated winners back into their source lists, each sorted
+    // by score desc, so the round-robin cycles shared → breed → nearby deterministically.
+    const sourceCount = signals.length;
+    const buckets = Array.from({ length: sourceCount }, () => []);
+    for (const { candidate, source } of winnerByEntity.values()) {
+        buckets[source].push(candidate);
+    }
+    for (const bucket of buckets)
+        bucket.sort((a, b) => b.score - a.score);
+    const results = [];
+    const ownerCounts = new Map();
+    const admitted = new Set();
+    const skipped = [];
+    const ownersUnderCap = (c) => c.ownerIds.every((owner) => (ownerCounts.get(owner) ?? 0) < MAX_RECOMMENDATIONS_PER_OWNER);
+    const admit = (c) => {
+        results.push(c);
+        admitted.add(c.entityId);
+        for (const owner of c.ownerIds) {
+            ownerCounts.set(owner, (ownerCounts.get(owner) ?? 0) + 1);
+        }
+    };
+    // Step 2: capped round-robin. One pointer per bucket; cycle through buckets in
+    // order until every bucket is exhausted. The loop is bounded by the total
+    // candidate count (each iteration advances exactly one pointer).
+    const pointers = new Array(sourceCount).fill(0);
+    const totalCandidates = buckets.reduce((n, b) => n + b.length, 0);
+    let processed = 0;
+    while (processed < totalCandidates && results.length < limit) {
+        for (let s = 0; s < sourceCount && results.length < limit; s++) {
+            const bucket = buckets[s];
+            if (pointers[s] >= bucket.length)
+                continue;
+            const candidate = bucket[pointers[s]];
+            pointers[s]++;
+            processed++;
+            if (ownersUnderCap(candidate)) {
+                admit(candidate);
+            }
+            else {
+                skipped.push(candidate);
+            }
+        }
+    }
+    // Step 3: single relaxation pass — admit remaining skipped candidates (the ones
+    // a cap turned away, plus any never reached because the page filled) by global
+    // score desc, cap ignored. No new state beyond the already-bounded `skipped`
+    // list and the buckets' untouched tails.
+    if (results.length < limit) {
+        const remaining = [...skipped];
+        for (let s = 0; s < sourceCount; s++) {
+            for (let i = pointers[s]; i < buckets[s].length; i++) {
+                remaining.push(buckets[s][i]);
+            }
+        }
+        remaining.sort((a, b) => b.score - a.score);
+        for (const candidate of remaining) {
+            if (results.length >= limit)
+                break;
+            if (admitted.has(candidate.entityId))
+                continue;
+            admit(candidate);
+        }
+    }
+    return results;
+}
+export class DiscoveryOps {
+    prisma;
+    geoLookup;
+    constructor(prisma, geoLookup) {
+        this.prisma = prisma;
+        this.geoLookup = geoLookup;
+    }
+    /**
+     * Discover entities through ≤2-hop UNDIRECTED entity-to-entity traversal.
+     *
+     * Starts from the user's owned entities, walks CONFIRMED typed edges (the fixed
+     * label set), and returns entities the user does NOT already relate to and that
+     * are discoverable. Recursive CTE bounded at the (server-clamped) hop count.
+     *
+     * SECURITY: hops are hard-capped at 2 regardless of input — a 3-hop traversal
+     * can visit 100^3 nodes on a popular entity (graph DoS). The hop cap is a
+     * numeric literal derived from clamped input; all other values are bound
+     * parameters ($queryRawUnsafe with positional $n). Tenant-scoped on every table.
+     */
+    async discoverByGraph(userId, hops, filters) {
+        const tenantId = getCurrentTenantId();
+        if (!tenantId)
+            return [];
+        // Hard-cap at 2 regardless of caller input (DoS guard). 1 or 2 only.
+        const maxHops = hops <= 1 ? 1 : 2;
+        const limit = filters?.limit ?? 20;
+        // Positional params. Order matters and is referenced by $n below.
+        //   $1 userId   $2 tenant   $3 edgeTypes[]   $4 limit   then optional filters.
+        const params = [userId, tenantId, TRAVERSAL_EDGE_TYPES, limit];
+        const filterClauses = [];
+        if (filters?.entityType) {
+            params.push(filters.entityType);
+            filterClauses.push(`d.entity_type = $${params.length}`);
+        }
+        if (filters?.breed) {
+            params.push(filters.breed);
+            filterClauses.push(`d.metadata->>'breed' = $${params.length}`);
+        }
+        if (filters?.lifeStage) {
+            params.push(filters.lifeStage);
+            filterClauses.push(`d.life_stage = $${params.length}`);
+        }
+        const extraFilters = filterClauses.length > 0 ? `\n        AND ${filterClauses.join("\n        AND ")}` : "";
+        // maxHops is a clamped numeric literal (1 or 2), never user string data.
+        const sql = `
+      WITH RECURSIVE my_entities AS (
+        SELECT o.entity_id AS id
+        FROM entity_ownerships o
+        WHERE o.user_id = $1
+          AND o.tenant_id = $2
+          AND o.status = 'ACTIVE'
+      ),
+      reachable AS (
+        -- hop 1: neighbours of the user's owned entities (undirected)
+        SELECT
+          CASE WHEN er.entity_id = m.id THEN er.related_entity_id ELSE er.entity_id END AS entity_id,
+          1 AS hops
+        FROM my_entities m
+        JOIN entity_relationships er
+          ON (er.entity_id = m.id OR er.related_entity_id = m.id)
+        WHERE er.tenant_id = $2
+          AND er.status = 'CONFIRMED'
+          AND er.type::text = ANY($3)
+        UNION ALL
+        -- hop 2 (cap): neighbours of reachable, stop at maxHops
+        SELECT
+          CASE WHEN er.entity_id = r.entity_id THEN er.related_entity_id ELSE er.entity_id END,
+          r.hops + 1
+        FROM reachable r
+        JOIN entity_relationships er
+          ON (er.entity_id = r.entity_id OR er.related_entity_id = r.entity_id)
+        WHERE r.hops < ${maxHops}
+          AND er.tenant_id = $2
+          AND er.status = 'CONFIRMED'
+          AND er.type::text = ANY($3)
+      )
+      SELECT
+        d.id          AS entity_id,
+        d.name        AS name,
+        d.entity_type AS entity_type,
+        d.metadata->>'breed' AS breed,
+        MIN(r.hops)   AS hops
+      FROM reachable r
+      JOIN entities d ON d.id = r.entity_id
+      WHERE d.tenant_id = $2
+        AND r.entity_id NOT IN (SELECT id FROM my_entities)
+        AND COALESCE((d.metadata->>'discoverable')::boolean, true) = true
+        AND NOT EXISTS (
+          SELECT 1 FROM relationships rel
+          WHERE rel.user_id = $1
+            AND rel.tenant_id = $2
+            AND rel.target_id = d.id
+        )${extraFilters}
+      GROUP BY d.id, d.name, d.entity_type, d.metadata->>'breed'
+      ORDER BY d.name ASC
+      LIMIT $4
+    `;
+        const rows = await this.prisma.$queryRawUnsafe(sql, ...params);
+        return rows.map((row) => {
+            const discovery = {
+                entityId: row.entity_id,
+                name: row.name,
+                entityType: row.entity_type ?? "",
+                hops: Number(row.hops),
+            };
+            if (row.breed)
+                discovery.breed = row.breed;
+            return discovery;
+        });
+    }
+    /**
+     * Discover entities by geographic proximity.
+     *
+     * Proximity + ranking come from Postgres/PostGIS (`this.geoLookup`); this method
+     * supplies entity fields and filters to discoverable entities the user does NOT
+     * already relate to.
+     *
+     * SECURITY: only a coarse distance band is returned (never exact distance) to
+     * prevent location triangulation (Finding 15). Already-related entities are
+     * excluded, so exact distance is never needed here.
+     */
+    async discoverNearby(userId, lat, lng, radiusMeters, filters) {
+        if (!this.geoLookup)
+            return [];
+        const tenantId = getCurrentTenantId();
+        if (!tenantId)
+            return [];
+        const limit = filters?.limit ?? 20;
+        // Over-fetch so the field/already-related/discoverable filtering still leaves
+        // up to `limit` results. Distance order is preserved from PostGIS.
+        const candidates = await this.geoLookup.findNearby(tenantId, lat, lng, radiusMeters, Math.min(limit * 4, 200));
+        if (candidates.length === 0)
+            return [];
+        const ids = candidates.map((c) => c.entityId);
+        const fieldsById = await this.fetchDiscoverableFields(userId, tenantId, ids, {
+            entityType: filters?.entityType,
+            breed: filters?.breed,
+        });
+        // Preserve PostGIS distance ordering; drop graph-filtered candidates; expose
+        // only a coarse band (never exact distance for unrelated entities).
+        const out = [];
+        for (const c of candidates) {
+            const f = fieldsById.get(c.entityId);
+            if (!f)
+                continue;
+            const discovery = {
+                entityId: c.entityId,
+                name: f.name,
+                entityType: f.entityType,
+                distanceBand: toDistanceBand(c.distanceMeters),
+            };
+            if (f.breed)
+                discovery.breed = f.breed;
+            out.push(discovery);
+            if (out.length >= limit)
+                break;
+        }
+        return out;
+    }
+    /**
+     * Entity recommendations merging four signals: shared-connections (≤2-hop
+     * traversal), same-breed, nearby, and owner-proximity. Dedup by entity, keeping
+     * the highest-scoring reason, then a per-owner DIVERSITY CAP
+     * (`MAX_RECOMMENDATIONS_PER_OWNER`) applied via round-robin fill with a single
+     * relaxation pass (see `mergeRecommendations`). The cap is part of
+     * `DISCOVERY_RANKING_VERSION` 1 — see SCORING-CODEBOOK.md.
+     *
+     * SECURITY: owner_proximity is never surfaced as a client-facing reason — it is
+     * folded into the shared-connections signal and always mapped to
+     * "shared_connections" (exposing it would leak graph topology). See the
+     * RecommendationReason doc comment.
+     */
+    async getRecommendations(userId, limit) {
+        const tenantId = getCurrentTenantId();
+        if (!tenantId)
+            return [];
+        const [sharedRows, breedRows, nearbyRows] = await Promise.all([
+            this.computeSharedConnections(userId, tenantId, limit),
+            this.computeSameBreed(userId, tenantId, limit),
+            this.computeNearbyRecommendations(userId, tenantId, limit),
+        ]);
+        // Merge with dedup-by-entity-keep-highest, then a per-owner diversity cap with
+        // round-robin fill (shared → breed → nearby) and a single relaxation pass.
+        // The merge is a pure function so the cap/fill logic is verified in isolation.
+        const merged = mergeRecommendations([sharedRows, breedRows, nearbyRows], limit);
+        return merged.map((c) => ({
+            entityId: c.entityId,
+            name: c.name,
+            entityType: c.entityType,
+            // owner_proximity is mapped to shared_connections client-side (security).
+            reason: (c.reason === "owner_proximity" ? "shared_connections" : c.reason),
+            confidence: Math.min(1.0, Math.max(0.0, c.score)),
+        }));
+    }
+    // -------------------------------------------------------------------------
+    // Recommendation signals
+    // -------------------------------------------------------------------------
+    /**
+     * Shared-connections signal: same ≤2-hop traversal shape as discoverByGraph,
+     * but anchored from the user's OWNED and RELATED entities, counting distinct
+     * source entities per candidate. score = sharedCount / 10. Excludes entities the
+     * user already owns or relates to, and non-discoverable ones.
+     */
+    async computeSharedConnections(userId, tenantId, limit) {
+        const params = [userId, tenantId, TRAVERSAL_EDGE_TYPES, limit];
+        const sql = `
+      WITH RECURSIVE seed AS (
+        -- the user's owned entities (OWNS) plus entities they relate to (RELATES_TO)
+        SELECT o.entity_id AS id
+        FROM entity_ownerships o
+        WHERE o.user_id = $1 AND o.tenant_id = $2 AND o.status = 'ACTIVE'
+        UNION
+        SELECT rel.target_id AS id
+        FROM relationships rel
+        WHERE rel.user_id = $1 AND rel.tenant_id = $2 AND rel.target_type = 'entity'
+      ),
+      reachable AS (
+        SELECT
+          s.id AS seed_id,
+          CASE WHEN er.entity_id = s.id THEN er.related_entity_id ELSE er.entity_id END AS entity_id,
+          1 AS hops
+        FROM seed s
+        JOIN entity_relationships er
+          ON (er.entity_id = s.id OR er.related_entity_id = s.id)
+        WHERE er.tenant_id = $2 AND er.status = 'CONFIRMED' AND er.type::text = ANY($3)
+        UNION ALL
+        SELECT
+          r.seed_id,
+          CASE WHEN er.entity_id = r.entity_id THEN er.related_entity_id ELSE er.entity_id END,
+          r.hops + 1
+        FROM reachable r
+        JOIN entity_relationships er
+          ON (er.entity_id = r.entity_id OR er.related_entity_id = r.entity_id)
+        WHERE r.hops < 2 AND er.tenant_id = $2 AND er.status = 'CONFIRMED' AND er.type::text = ANY($3)
+      )
+      SELECT
+        d.id          AS entity_id,
+        d.name        AS name,
+        d.entity_type AS entity_type,
+        COUNT(DISTINCT r.seed_id)::float / 10.0 AS score,
+        -- ACTIVE, tenant-scoped owners only (a multi-owner entity counts against
+        -- every active owner under the per-owner diversity cap). LEFT JOIN so an
+        -- ownerless entity yields NULL → coalesced to '{}' (exempt from the cap).
+        COALESCE(ARRAY_AGG(DISTINCT own.user_id) FILTER (WHERE own.user_id IS NOT NULL), '{}') AS owner_ids
+      FROM reachable r
+      JOIN entities d ON d.id = r.entity_id
+      LEFT JOIN entity_ownerships own
+        ON own.entity_id = d.id AND own.tenant_id = $2 AND own.status = 'ACTIVE'
+      WHERE d.tenant_id = $2
+        AND r.entity_id NOT IN (SELECT id FROM seed)
+        AND COALESCE((d.metadata->>'discoverable')::boolean, true) = true
+        AND NOT EXISTS (
+          SELECT 1 FROM relationships rel
+          WHERE rel.user_id = $1 AND rel.tenant_id = $2 AND rel.target_id = d.id
+        )
+        AND NOT EXISTS (
+          SELECT 1 FROM entity_ownerships o2
+          WHERE o2.user_id = $1 AND o2.tenant_id = $2 AND o2.entity_id = d.id AND o2.status = 'ACTIVE'
+        )
+      GROUP BY d.id, d.name, d.entity_type
+      ORDER BY score DESC
+      LIMIT $4
+    `;
+        const rows = await this.prisma.$queryRawUnsafe(sql, ...params);
+        return rows.map((row) => ({
+            entityId: row.entity_id,
+            name: row.name,
+            entityType: row.entity_type ?? "",
+            score: Number(row.score),
+            reason: "shared_connections",
+            ownerIds: row.owner_ids ?? [],
+        }));
+    }
+    /**
+     * Same-breed signal: candidates whose breed matches any breed of the user's
+     * owned entities. Fixed score 0.6. Excludes already-owned / already-related /
+     * non-discoverable entities. Breed lives in `entities.metadata->>'breed'`.
+     */
+    async computeSameBreed(userId, tenantId, limit) {
+        const params = [userId, tenantId, limit];
+        const sql = `
+      WITH my_breeds AS (
+        SELECT DISTINCT e.metadata->>'breed' AS breed
+        FROM entity_ownerships o
+        JOIN entities e ON e.id = o.entity_id
+        WHERE o.user_id = $1 AND o.tenant_id = $2 AND o.status = 'ACTIVE'
+          AND e.metadata->>'breed' IS NOT NULL
+      )
+      SELECT
+        d.id          AS entity_id,
+        d.name        AS name,
+        d.entity_type AS entity_type,
+        -- ACTIVE, tenant-scoped owners only (same filter as every other signal).
+        COALESCE(ARRAY_AGG(DISTINCT own.user_id) FILTER (WHERE own.user_id IS NOT NULL), '{}') AS owner_ids
+      FROM entities d
+      LEFT JOIN entity_ownerships own
+        ON own.entity_id = d.id AND own.tenant_id = $2 AND own.status = 'ACTIVE'
+      WHERE d.tenant_id = $2
+        AND d.metadata->>'breed' IN (SELECT breed FROM my_breeds)
+        AND COALESCE((d.metadata->>'discoverable')::boolean, true) = true
+        AND NOT EXISTS (
+          SELECT 1 FROM relationships rel
+          WHERE rel.user_id = $1 AND rel.tenant_id = $2 AND rel.target_id = d.id
+        )
+        AND NOT EXISTS (
+          SELECT 1 FROM entity_ownerships o2
+          WHERE o2.user_id = $1 AND o2.tenant_id = $2 AND o2.entity_id = d.id AND o2.status = 'ACTIVE'
+        )
+      GROUP BY d.id, d.name, d.entity_type
+      LIMIT $3
+    `;
+        const rows = await this.prisma.$queryRawUnsafe(sql, ...params);
+        return rows.map((row) => ({
+            entityId: row.entity_id,
+            name: row.name,
+            entityType: row.entity_type ?? "",
+            score: 0.6,
+            reason: "same_breed",
+            ownerIds: row.owner_ids ?? [],
+        }));
+    }
+    /**
+     * Nearby signal: anchors are the user's owned entities; proximity + ranking come
+     * from PostGIS (`findNearAnchors`). Candidates are filtered against graph facts
+     * (not already related/owned, discoverable). score = (1 - minDist/10000) * 0.5,
+     * nearest first. Empty when geo is unavailable or the user owns no located
+     * entities.
+     */
+    async computeNearbyRecommendations(userId, tenantId, limit) {
+        if (!this.geoLookup)
+            return [];
+        const anchors = await this.prisma.$queryRawUnsafe(`SELECT DISTINCT o.entity_id AS id
+       FROM entity_ownerships o
+       WHERE o.user_id = $1 AND o.tenant_id = $2 AND o.status = 'ACTIVE'`, userId, tenantId);
+        const anchorIds = anchors.map((a) => a.id);
+        if (anchorIds.length === 0)
+            return [];
+        const candidates = await this.geoLookup.findNearAnchors(tenantId, anchorIds, NEARBY_RECO_RADIUS_METERS, Math.min(limit * 4, 200));
+        if (candidates.length === 0)
+            return [];
+        const ids = candidates.map((c) => c.entityId);
+        const fieldsById = await this.fetchDiscoverableFields(userId, tenantId, ids);
+        const rows = [];
+        for (const c of candidates) {
+            const f = fieldsById.get(c.entityId);
+            if (!f)
+                continue;
+            rows.push({
+                entityId: c.entityId,
+                name: f.name,
+                entityType: f.entityType,
+                score: (1.0 - c.distanceMeters / 10000.0) * 0.5,
+                reason: "nearby",
+                // ACTIVE, tenant-scoped owners surfaced by fetchDiscoverableFields (same
+                // ownership filter as the SQL signals — no second source of truth).
+                ownerIds: f.ownerIds,
+            });
+            if (rows.length >= limit)
+                break;
+        }
+        return rows;
+    }
+    // -------------------------------------------------------------------------
+    // Shared helper
+    // -------------------------------------------------------------------------
+    /**
+     * Fetch name/entityType/breed for a PostGIS candidate set, restricted to
+     * discoverable entities the user does NOT already relate to (and, by the
+     * caller's convention, that pass optional entityType/breed equality filters).
+     * The PostGIS candidate ids are the proximity-ranked set; this is the graph-fact
+     * filter that the Neo4j path expressed as a `MATCH … WHERE id IN $ids …` query.
+     */
+    async fetchDiscoverableFields(userId, tenantId, ids, equality) {
+        const out = new Map();
+        if (ids.length === 0)
+            return out;
+        // $1 userId  $2 tenant  $3 ids[]  then optional equality filters.
+        const params = [userId, tenantId, ids];
+        const extra = [];
+        if (equality?.entityType) {
+            params.push(equality.entityType);
+            extra.push(`d.entity_type = $${params.length}`);
+        }
+        if (equality?.breed) {
+            params.push(equality.breed);
+            extra.push(`d.metadata->>'breed' = $${params.length}`);
+        }
+        const extraFilters = extra.length > 0 ? `\n        AND ${extra.join("\n        AND ")}` : "";
+        const sql = `
+      SELECT
+        d.id          AS entity_id,
+        d.name        AS name,
+        d.entity_type AS entity_type,
+        d.metadata->>'breed' AS breed,
+        -- ACTIVE, tenant-scoped owners only (same filter as the SQL signal queries;
+        -- LEFT JOIN + FILTER so ownerless entities yield '{}', not a dropped row).
+        COALESCE(ARRAY_AGG(DISTINCT own.user_id) FILTER (WHERE own.user_id IS NOT NULL), '{}') AS owner_ids
+      FROM entities d
+      LEFT JOIN entity_ownerships own
+        ON own.entity_id = d.id AND own.tenant_id = $2 AND own.status = 'ACTIVE'
+      WHERE d.id = ANY($3)
+        AND d.tenant_id = $2
+        AND COALESCE((d.metadata->>'discoverable')::boolean, true) = true
+        AND NOT EXISTS (
+          SELECT 1 FROM relationships rel
+          WHERE rel.user_id = $1 AND rel.tenant_id = $2 AND rel.target_id = d.id
+        )${extraFilters}
+      GROUP BY d.id, d.name, d.entity_type, d.metadata->>'breed'
+    `;
+        const rows = await this.prisma.$queryRawUnsafe(sql, ...params);
+        for (const row of rows) {
+            out.set(row.entity_id, {
+                name: row.name,
+                entityType: row.entity_type ?? "",
+                breed: row.breed,
+                ownerIds: row.owner_ids ?? [],
+            });
+        }
+        return out;
+    }
+}
+/**
+ * Convert an exact distance in metres to a coarse band string. Values match the
+ * DiscoveryResult.distanceBand union exactly. Mirrors Neo4jGraphService.toDistanceBand.
+ *
+ * SECURITY: used by discoverNearby to prevent location triangulation.
+ */
+function toDistanceBand(meters) {
+    if (meters < 500)
+        return "< 500m";
+    if (meters < 1000)
+        return "500m-1km";
+    if (meters < 2000)
+        return "1-2km";
+    if (meters < 5000)
+        return "2-5km";
+    return "> 5km";
+}
+//# sourceMappingURL=discovery.js.map

package/dist/lib/graph/postgres/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../../src/lib/graph/postgres/discovery.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAUrE;;;;GAIG;AACH,MAAM,oBAAoB,GAAG;IAC3B,WAAW;IACX,SAAS;IACT,UAAU;IACV,QAAQ;IACR,WAAW;IACX,YAAY;CACJ,CAAC;AAEX,oFAAoF;AACpF,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAU,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAgB/C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAoC,EACpC,KAAa;IAEb,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1B,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkE,CAAC;IACjG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QACtC,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAC5D,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,sFAAsF;IACtF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IACnC,MAAM,OAAO,GAAgC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3F,KAAK,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAEvE,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAA8B,EAAE,CAAC;IAE9C,MAAM,cAAc,GAAG,CAAC,CAA0B,EAAW,EAAE,CAC7D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,6BAA6B,CAAC,CAAC;IAE7F,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAQ,EAAE;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEF,+EAA+E;IAC/E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,SAAS,GAAG,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM;gBAAE,SAAS;YAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACd,SAAS,EAAE,CAAC;YACZ,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,SAAS,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,+EAA+E;IAC/E,6EAA6E;IAC7E,yCAAyC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC3B,MAAM,SAAS,GAA8B,CAAC,GAAG,OAAO,CAAC,CAAC;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;gBAAE,MAAM;YACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC/C,KAAK,CAAC,SAAS,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAkBD,MAAM,OAAO,YAAY;IAEJ;IACA;IAFnB,YACmB,MAAoB,EACpB,SAA2B;QAD3B,WAAM,GAAN,MAAM,CAAc;QACpB,cAAS,GAAT,SAAS,CAAkB;IAC3C,CAAC;IAEJ;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,IAAY,EACZ,OAA0B;QAE1B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,qEAAqE;QACrE,MAAM,OAAO,GAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QAEnC,kEAAkE;QAClE,+EAA+E;QAC/E,MAAM,MAAM,GAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,oBAA2C,EAAE,KAAK,CAAC,CAAC;QACjG,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/B,aAAa,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7G,yEAAyE;QACzE,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA2BS,OAAO;;;;;;;;;;;;;;;;;;;;;WAqBrB,YAAY;;;;KAIlB,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAiB,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,SAAS,GAAoB;gBACjC,QAAQ,EAAE,GAAG,CAAC,SAAS;gBACvB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBACjC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;aACvB,CAAC;YACF,IAAI,GAAG,CAAC,KAAK;gBAAE,SAAS,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,GAAW,EACX,GAAW,EACX,YAAoB,EACpB,OAAuB;QAEvB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QAEnC,8EAA8E;QAC9E,mEAAmE;QACnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAChD,QAAQ,EACR,GAAG,EACH,GAAG,EACH,YAAY,EACZ,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CACzB,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE9C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE;YAC3E,UAAU,EAAE,OAAO,EAAE,UAAU;YAC/B,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,oEAAoE;QACpE,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,SAAS,GAAoB;gBACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;aAC/C,CAAC;YACF,IAAI,CAAC,CAAC,KAAK;gBAAE,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpB,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK;gBAAE,MAAM;QACjC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,KAAa;QACpD,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5D,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;YACtD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;YAC9C,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;SAC3D,CAAC,CAAC;QAEH,+EAA+E;QAC/E,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QAEhF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,0EAA0E;YAC1E,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAyB;YAClG,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAE5E;;;;;OAKG;IACK,KAAK,CAAC,wBAAwB,CACpC,MAAc,EACd,QAAgB,EAChB,KAAa;QAEb,MAAM,MAAM,GAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,oBAA2C,EAAE,KAAK,CAAC,CAAC;QACjG,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAyDX,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAE5C,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YACjC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,oBAAoB;YAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAC5B,MAAc,EACd,QAAgB,EAChB,KAAa;QAEb,MAAM,MAAM,GAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA8BX,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAE5C,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YACjC,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,4BAA4B,CACxC,MAAc,EACd,QAAgB,EAChB,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAC/C;;yEAEmE,EACnE,MAAM,EACN,QAAQ,CACT,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEtC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CACrD,QAAQ,EACR,SAAS,EACT,yBAAyB,EACzB,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CACzB,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE9C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAE7E,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,CAAC,IAAI,CAAC;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,GAAG;gBAC/C,MAAM,EAAE,QAAQ;gBAChB,yEAAyE;gBACzE,oEAAoE;gBACpE,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK;gBAAE,MAAM;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,gBAAgB;IAChB,4EAA4E;IAE5E;;;;;;OAMG;IACK,KAAK,CAAC,uBAAuB,CACnC,MAAc,EACd,QAAgB,EAChB,GAAa,EACb,QAAkD;QAElD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0F,CAAC;QAC9G,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAEjC,kEAAkE;QAClE,MAAM,MAAM,GAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7F,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;WAkBL,YAAY;;KAElB,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAa,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC3E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBACjC,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,QAAQ,CAAC;IAClC,IAAI,MAAM,GAAG,IAAI;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,MAAM,GAAG,IAAI;QAAE,OAAO,OAAO,CAAC;IAClC,IAAI,MAAM,GAAG,IAAI;QAAE,OAAO,OAAO,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/graph/postgres/entity-relationships.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Typed entity-to-entity edge operations on Postgres (`entity_relationships`).
+ *
+ * Phase 1 · B3. PORT from neo4j-graph-service.ts (entity-relationship methods).
+ * Single-hop typed-edge CRUD with a PENDING→CONFIRMED/REJECTED status machine;
+ * ownership checks join `entity_ownerships`.
+ *
+ * Ports the Neo4j authorization + status logic exactly:
+ *  - createEntityRelationship: proposer must OWN the source entity; PACK_MATE
+ *    with a single user holding PRIMARY_OWNER/CO_OWNER on BOTH entities
+ *    auto-confirms (CARETAKER excluded) and writes the reciprocal edge.
+ *  - confirm/reject: caller must OWN the TARGET (related) entity.
+ *  - remove: caller must OWN EITHER entity.
+ *  - getPendingEntityRelationships: PENDING edges where the caller owns the
+ *    target entity.
+ *
+ * Tenancy (graph-db revisit 2026-06): unlike the implicitly-single-tenant
+ * Neptune graph, the Postgres edge/ownership tables carry a `tenant_id`. To
+ * stay consistent with the other Postgres groups (B1/B2/B4/B5) and to keep
+ * tenant isolation defensible under a future audit, every read/lookup is
+ * tenant-scoped via {@link tenantScope} when an ambient tenant context exists.
+ * Ownership lookups also filter `status = ACTIVE`: a removed/left owner no
+ * longer holds the OWNS edge, which is the Postgres equivalent of Neptune
+ * edge-absence (matches the discovery/sync groups).
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { CreateEntityRelationshipInput, EntityRelationship, EntityRelationshipStatus } from "../types.js";
+export declare class EntityRelationshipOps {
+    private readonly prisma;
+    constructor(prisma: PrismaClient);
+    /**
+     * Tenant filter for reads/lookups — applied when an ambient tenant context
+     * exists, absent otherwise (matches B1/B2/B4/B5 and the Neo4j no-tenant path).
+     */
+    private tenantScope;
+    createEntityRelationship(input: CreateEntityRelationshipInput): Promise<EntityRelationship>;
+    confirmEntityRelationship(entityId: string, relatedEntityId: string, confirmingUserId: string): Promise<EntityRelationship>;
+    rejectEntityRelationship(entityId: string, relatedEntityId: string, rejectingUserId: string): Promise<void>;
+    removeEntityRelationship(entityId: string, relatedEntityId: string, removingUserId: string): Promise<void>;
+    getEntityRelationships(entityId: string, options?: {
+        type?: string;
+        status?: EntityRelationshipStatus;
+    }): Promise<EntityRelationship[]>;
+    getPendingEntityRelationships(userId: string): Promise<EntityRelationship[]>;
+    /**
+     * Resolve the ambient tenant for writes. The Postgres `entity_relationships`
+     * table has a non-nullable `tenant_id`; Neptune carried no tenant scope, so
+     * this is the one place the Postgres port must source a tenant. The handler
+     * runs inside the tenant ALS context (see saas-foundation/tenant).
+     */
+    private requireTenantId;
+}
+//# sourceMappingURL=entity-relationships.d.ts.map

package/dist/lib/graph/postgres/entity-relationships.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-relationships.d.ts","sourceRoot":"","sources":["../../../../src/lib/graph/postgres/entity-relationships.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EACV,6BAA6B,EAC7B,kBAAkB,EAClB,wBAAwB,EAEzB,MAAM,aAAa,CAAC;AA2BrB,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;OAGG;IACH,OAAO,CAAC,WAAW;IAKb,wBAAwB,CAC5B,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,kBAAkB,CAAC;IAuFxB,yBAAyB,CAC7B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAgFxB,wBAAwB,CAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IAgCV,wBAAwB,CAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IAuCV,sBAAsB,CAC1B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,wBAAwB,CAAA;KAAE,GAC7D,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA4B1B,6BAA6B,CACjC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAwChC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CASxB"}