@de-otio/trellis 0.7.1 → 0.9.0

package/dist/lib/graph/postgres/entity-relationships.js

@@ -0,0 +1,304 @@
+import { getCurrentTenantId } from "@de-otio/saas-foundation/tenant";
+import { GraphAuthorizationError, GraphConflictError, GraphNotFoundError, } from "../errors.js";
+/**
+ * Symmetric relationship types — confirming A→B materializes a same-type B→A
+ * edge. Mirrors SYMMETRIC_TYPES in neo4j-graph-service.confirmEntityRelationship.
+ */
+const SYMMETRIC_TYPES = new Set([
+    "PACK_MATE",
+    "SIBLING",
+    "PLAYMATE",
+    "WALK_BUDDY",
+]);
+/**
+ * Asymmetric pairs — confirming A→B materializes a complementary-type B→A edge.
+ * Mirrors ASYMMETRIC_PAIRS in neo4j-graph-service.confirmEntityRelationship.
+ */
+const ASYMMETRIC_PAIRS = {
+    PARENT: "OFFSPRING",
+    OFFSPRING: "PARENT",
+};
+export class EntityRelationshipOps {
+    prisma;
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    /**
+     * Tenant filter for reads/lookups — applied when an ambient tenant context
+     * exists, absent otherwise (matches B1/B2/B4/B5 and the Neo4j no-tenant path).
+     */
+    tenantScope() {
+        const t = getCurrentTenantId();
+        return t ? { tenantId: t } : {};
+    }
+    async createEntityRelationship(input) {
+        const { entityId, relatedEntityId, type, proposedByUserId } = input;
+        const scope = this.tenantScope();
+        // 1. Verify proposing user actively owns the source entity.
+        const ownership = await this.prisma.entityOwnership.findFirst({
+            where: { ...scope, entityId, userId: proposedByUserId, status: "ACTIVE" },
+            select: { role: true },
+        });
+        if (!ownership) {
+            throw new GraphAuthorizationError(`User ${proposedByUserId} does not own entity ${entityId}`);
+        }
+        // 2. Verify both entity nodes exist. Keyed by the globally-unique cuid PK,
+        // so no tenant scope is needed for an existence check.
+        const [sourceEntity, targetEntity] = await Promise.all([
+            this.prisma.entity.findUnique({ where: { id: entityId }, select: { id: true } }),
+            this.prisma.entity.findUnique({ where: { id: relatedEntityId }, select: { id: true } }),
+        ]);
+        if (!sourceEntity || !targetEntity) {
+            throw new GraphNotFoundError(`One or both entities not found: ${entityId}, ${relatedEntityId}`);
+        }
+        // 3. Check for an existing relationship of this type (A→B).
+        const existing = await this.prisma.entityRelationship.findFirst({
+            where: { ...scope, entityId, relatedEntityId, type },
+            select: { id: true },
+        });
+        if (existing) {
+            throw new GraphConflictError(`Entity relationship of type ${type} already exists between ${entityId} and ${relatedEntityId}`);
+        }
+        // 4. Determine if auto-confirm applies.
+        // PACK_MATE where a single user holds PRIMARY_OWNER or CO_OWNER on BOTH
+        // entities auto-confirms. CARETAKER is excluded per security rules.
+        let status = "PENDING";
+        if (type === "PACK_MATE") {
+            const sourceOwners = await this.prisma.entityOwnership.findMany({
+                where: { ...scope, entityId, status: "ACTIVE", role: { in: ["PRIMARY_OWNER", "CO_OWNER"] } },
+                select: { userId: true },
+            });
+            const sourceOwnerIds = new Set(sourceOwners.map((o) => o.userId));
+            if (sourceOwnerIds.size > 0) {
+                const sharedOwner = await this.prisma.entityOwnership.findFirst({
+                    where: {
+                        ...scope,
+                        entityId: relatedEntityId,
+                        status: "ACTIVE",
+                        role: { in: ["PRIMARY_OWNER", "CO_OWNER"] },
+                        userId: { in: Array.from(sourceOwnerIds) },
+                    },
+                    select: { userId: true },
+                });
+                if (sharedOwner) {
+                    status = "CONFIRMED";
+                }
+            }
+        }
+        const now = new Date();
+        const tenantId = this.requireTenantId();
+        if (status === "CONFIRMED") {
+            // Auto-confirmed PACK_MATE: create bidirectional edges immediately.
+            await this.prisma.entityRelationship.createMany({
+                data: [
+                    { tenantId, entityId, relatedEntityId, type, status: "CONFIRMED", proposedByUserId, since: now },
+                    { tenantId, entityId: relatedEntityId, relatedEntityId: entityId, type, status: "CONFIRMED", proposedByUserId, since: now },
+                ],
+            });
+        }
+        else {
+            // Single PENDING edge from source to target.
+            await this.prisma.entityRelationship.create({
+                data: { tenantId, entityId, relatedEntityId, type, status: "PENDING", proposedByUserId, since: now },
+            });
+        }
+        return { entityId, relatedEntityId, type, status, proposedByUserId, since: now };
+    }
+    async confirmEntityRelationship(entityId, relatedEntityId, confirmingUserId) {
+        const scope = this.tenantScope();
+        // 1. Verify confirming user actively owns the target (related) entity.
+        const ownership = await this.prisma.entityOwnership.findFirst({
+            where: { ...scope, entityId: relatedEntityId, userId: confirmingUserId, status: "ACTIVE" },
+            select: { role: true },
+        });
+        if (!ownership) {
+            throw new GraphAuthorizationError(`User ${confirmingUserId} does not own entity ${relatedEntityId}`);
+        }
+        // 2. Find the relationship (A→B).
+        const rel = await this.prisma.entityRelationship.findFirst({
+            where: { ...scope, entityId, relatedEntityId },
+            select: { id: true, type: true, status: true, proposedByUserId: true, since: true, tenantId: true },
+        });
+        if (!rel) {
+            throw new GraphNotFoundError(`Entity relationship not found between ${entityId} and ${relatedEntityId}`);
+        }
+        if (rel.status !== "PENDING") {
+            throw new GraphConflictError(`Entity relationship is already ${rel.status}`);
+        }
+        const relType = rel.type;
+        const { proposedByUserId, since, tenantId } = rel;
+        // 3. Confirm the existing edge.
+        await this.prisma.entityRelationship.update({
+            where: { id: rel.id },
+            data: { status: "CONFIRMED" },
+        });
+        // 4. Create or confirm the reciprocal edge based on relationship symmetry.
+        const reciprocalType = SYMMETRIC_TYPES.has(relType)
+            ? relType
+            : ASYMMETRIC_PAIRS[relType];
+        if (reciprocalType) {
+            const reverse = await this.prisma.entityRelationship.findFirst({
+                where: { ...scope, entityId: relatedEntityId, relatedEntityId: entityId, type: reciprocalType },
+                select: { id: true },
+            });
+            if (reverse) {
+                await this.prisma.entityRelationship.update({
+                    where: { id: reverse.id },
+                    data: { status: "CONFIRMED" },
+                });
+            }
+            else {
+                await this.prisma.entityRelationship.create({
+                    data: {
+                        tenantId,
+                        entityId: relatedEntityId,
+                        relatedEntityId: entityId,
+                        type: reciprocalType,
+                        status: "CONFIRMED",
+                        proposedByUserId,
+                        since,
+                    },
+                });
+            }
+        }
+        return {
+            entityId,
+            relatedEntityId,
+            type: relType,
+            status: "CONFIRMED",
+            proposedByUserId,
+            since,
+        };
+    }
+    async rejectEntityRelationship(entityId, relatedEntityId, rejectingUserId) {
+        const scope = this.tenantScope();
+        // 1. Verify rejecting user actively owns the target (related) entity.
+        const ownership = await this.prisma.entityOwnership.findFirst({
+            where: { ...scope, entityId: relatedEntityId, userId: rejectingUserId, status: "ACTIVE" },
+            select: { role: true },
+        });
+        if (!ownership) {
+            throw new GraphAuthorizationError(`User ${rejectingUserId} does not own entity ${relatedEntityId}`);
+        }
+        // 2. Find the relationship (A→B).
+        const rel = await this.prisma.entityRelationship.findFirst({
+            where: { ...scope, entityId, relatedEntityId },
+            select: { id: true },
+        });
+        if (!rel) {
+            throw new GraphNotFoundError(`Entity relationship not found between ${entityId} and ${relatedEntityId}`);
+        }
+        // 3. Set status to REJECTED.
+        await this.prisma.entityRelationship.update({
+            where: { id: rel.id },
+            data: { status: "REJECTED" },
+        });
+    }
+    async removeEntityRelationship(entityId, relatedEntityId, removingUserId) {
+        const scope = this.tenantScope();
+        // 1. Verify removing user actively owns either entity.
+        const ownership = await this.prisma.entityOwnership.findFirst({
+            where: {
+                ...scope,
+                userId: removingUserId,
+                status: "ACTIVE",
+                entityId: { in: [entityId, relatedEntityId] },
+            },
+            select: { entityId: true },
+        });
+        if (!ownership) {
+            throw new GraphAuthorizationError(`User ${removingUserId} does not own either entity ${entityId} or ${relatedEntityId}`);
+        }
+        // 2. Check the relationship exists (A→B direction).
+        const rel = await this.prisma.entityRelationship.findFirst({
+            where: { ...scope, entityId, relatedEntityId },
+            select: { id: true },
+        });
+        if (!rel) {
+            throw new GraphNotFoundError(`Entity relationship not found between ${entityId} and ${relatedEntityId}`);
+        }
+        // 3. Delete A→B edge(s) and reciprocal B→A edge(s) if any.
+        await this.prisma.entityRelationship.deleteMany({
+            where: { ...scope, entityId, relatedEntityId },
+        });
+        await this.prisma.entityRelationship.deleteMany({
+            where: { ...scope, entityId: relatedEntityId, relatedEntityId: entityId },
+        });
+    }
+    async getEntityRelationships(entityId, options) {
+        const rows = await this.prisma.entityRelationship.findMany({
+            where: {
+                ...this.tenantScope(),
+                entityId,
+                ...(options?.type ? { type: options.type } : {}),
+                ...(options?.status ? { status: options.status } : {}),
+            },
+            select: {
+                relatedEntityId: true,
+                type: true,
+                status: true,
+                proposedByUserId: true,
+                since: true,
+            },
+            orderBy: { since: "desc" },
+        });
+        return rows.map((r) => ({
+            entityId,
+            relatedEntityId: r.relatedEntityId,
+            type: r.type,
+            status: r.status,
+            proposedByUserId: r.proposedByUserId,
+            since: r.since,
+        }));
+    }
+    async getPendingEntityRelationships(userId) {
+        const scope = this.tenantScope();
+        // Edges that are PENDING and whose TARGET (related) entity is actively
+        // owned by the user.
+        const owned = await this.prisma.entityOwnership.findMany({
+            where: { ...scope, userId, status: "ACTIVE" },
+            select: { entityId: true },
+        });
+        const ownedEntityIds = owned.map((o) => o.entityId);
+        if (ownedEntityIds.length === 0) {
+            return [];
+        }
+        const rows = await this.prisma.entityRelationship.findMany({
+            where: {
+                ...scope,
+                status: "PENDING",
+                relatedEntityId: { in: ownedEntityIds },
+            },
+            select: {
+                entityId: true,
+                relatedEntityId: true,
+                type: true,
+                proposedByUserId: true,
+                since: true,
+            },
+            orderBy: { since: "desc" },
+        });
+        return rows.map((r) => ({
+            entityId: r.entityId,
+            relatedEntityId: r.relatedEntityId,
+            type: r.type,
+            status: "PENDING",
+            proposedByUserId: r.proposedByUserId,
+            since: r.since,
+        }));
+    }
+    /**
+     * Resolve the ambient tenant for writes. The Postgres `entity_relationships`
+     * table has a non-nullable `tenant_id`; Neptune carried no tenant scope, so
+     * this is the one place the Postgres port must source a tenant. The handler
+     * runs inside the tenant ALS context (see saas-foundation/tenant).
+     */
+    requireTenantId() {
+        const tenantId = getCurrentTenantId();
+        if (!tenantId) {
+            throw new GraphConflictError("Cannot create entity relationship without an active tenant context");
+        }
+        return tenantId;
+    }
+}
+//# sourceMappingURL=entity-relationships.js.map

package/dist/lib/graph/postgres/entity-relationships.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-relationships.js","sourceRoot":"","sources":["../../../../src/lib/graph/postgres/entity-relationships.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAOrE,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB;;;GAGG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAyB;IACtD,WAAW;IACX,SAAS;IACT,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,gBAAgB,GAAoE;IACxF,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,QAAQ;CACpB,CAAC;AAEF,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAErD;;;OAGG;IACK,WAAW;QACjB,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,KAAoC;QAEpC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEjC,4DAA4D;QAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC;YAC5D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE;YACzE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,gBAAgB,wBAAwB,QAAQ,EAAE,CAC3D,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YAChF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;SACxF,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,kBAAkB,CAC1B,mCAAmC,QAAQ,KAAK,eAAe,EAAE,CAClE,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC;YAC9D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE;YACpD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAC1B,+BAA+B,IAAI,2BAA2B,QAAQ,QAAQ,eAAe,EAAE,CAChG,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,MAAM,GAA6B,SAAS,CAAC;QAEjD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC;gBAC9D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,EAAE;gBAC5F,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACzB,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC;oBAC9D,KAAK,EAAE;wBACL,GAAG,KAAK;wBACR,QAAQ,EAAE,eAAe;wBACzB,MAAM,EAAE,QAAQ;wBAChB,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE;wBAC3C,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;qBAC3C;oBACD,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACzB,CAAC,CAAC;gBACH,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,GAAG,WAAW,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAExC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,oEAAoE;YACpE,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC;gBAC9C,IAAI,EAAE;oBACJ,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE;oBAChG,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE;iBAC5H;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,6CAA6C;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBAC1C,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE;aACrG,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,QAAgB,EAChB,eAAuB,EACvB,gBAAwB;QAExB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEjC,uEAAuE;QACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC;YAC5D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE;YAC1F,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,gBAAgB,wBAAwB,eAAe,EAAE,CAClE,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC;YACzD,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC9C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SACpG,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,kBAAkB,CAC1B,yCAAyC,QAAQ,QAAQ,eAAe,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,kBAAkB,CAC1B,kCAAkC,GAAG,CAAC,MAAM,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAA8B,CAAC;QACnD,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAElD,gCAAgC;QAChC,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;SAC9B,CAAC,CAAC;QAEH,2EAA2E;QAC3E,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;YACjD,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC;gBAC7D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE;gBAC/F,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;oBAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;oBACzB,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;iBAC9B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;oBAC1C,IAAI,EAAE;wBACJ,QAAQ;wBACR,QAAQ,EAAE,eAAe;wBACzB,eAAe,EAAE,QAAQ;wBACzB,IAAI,EAAE,cAAc;wBACpB,MAAM,EAAE,WAAW;wBACnB,gBAAgB;wBAChB,KAAK;qBACN;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ;YACR,eAAe;YACf,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW;YACnB,gBAAgB;YAChB,KAAK;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,QAAgB,EAChB,eAAuB,EACvB,eAAuB;QAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEjC,sEAAsE;QACtE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC;YAC5D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE;YACzF,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,eAAe,wBAAwB,eAAe,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC;YACzD,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC9C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,kBAAkB,CAC1B,yCAAyC,QAAQ,QAAQ,eAAe,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,QAAgB,EAChB,eAAuB,EACvB,cAAsB;QAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEjC,uDAAuD;QACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC;YAC5D,KAAK,EAAE;gBACL,GAAG,KAAK;gBACR,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE;aAC9C;YACD,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,cAAc,+BAA+B,QAAQ,OAAO,eAAe,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC;YACzD,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE;YAC9C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,kBAAkB,CAC1B,yCAAyC,QAAQ,QAAQ,eAAe,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC;YAC9C,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC;YAC9C,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,QAAQ,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,QAAgB,EAChB,OAA8D;QAE9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YACzD,KAAK,EAAE;gBACL,GAAG,IAAI,CAAC,WAAW,EAAE;gBACrB,QAAQ;gBACR,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAA8B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD;YACD,MAAM,EAAE;gBACN,eAAe,EAAE,IAAI;gBACrB,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,IAAI;gBACZ,gBAAgB,EAAE,IAAI;gBACtB,KAAK,EAAE,IAAI;aACZ;YACD,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,QAAQ;YACR,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,IAAI,EAAE,CAAC,CAAC,IAA8B;YACtC,MAAM,EAAE,CAAC,CAAC,MAAkC;YAC5C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,MAAc;QAEd,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEjC,uEAAuE;QACvE,qBAAqB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC;YACvD,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YAC7C,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YACzD,KAAK,EAAE;gBACL,GAAG,KAAK;gBACR,MAAM,EAAE,SAAS;gBACjB,eAAe,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;aACxC;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI;gBACd,eAAe,EAAE,IAAI;gBACrB,IAAI,EAAE,IAAI;gBACV,gBAAgB,EAAE,IAAI;gBACtB,KAAK,EAAE,IAAI;aACZ;YACD,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,IAAI,EAAE,CAAC,CAAC,IAA8B;YACtC,MAAM,EAAE,SAAqC;YAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACK,eAAe;QACrB,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/lib/graph/postgres/interaction-events.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Append-only InteractionEvent dual-write + retention pruning
+ * (Surveillance-hardening Phase 0, P2 / E1).
+ *
+ * Why this table exists: `Relationship.signals` keeps only AGGREGATE per-type
+ * counters — it destroys the temporal signal (who interacted with whom, WHEN)
+ * that Phase 2 coordinated-behavior detection needs. This module preserves that
+ * signal as an append-only log, bounded to a rolling retention window.
+ *
+ * ───────────────────────────────────────────────────────────────────────────
+ * READ-ACCESS INVARIANT (security review blocks on this):
+ *   90+ days of who-interacted-with-whom-when is a behavioral fingerprint — the
+ *   social graph + activity patterns a fusion platform would buy. Phase 0 ships
+ *   ZERO read paths. Any future read is restricted to the Phase 2 detection path
+ *   and moderator surfaces, requires MODERATOR/SUPER_ADMIN, and emits an audit
+ *   event. There is NO general-purpose query helper here, by design — do not add
+ *   one. (doc/02-technical/surveillance-threat-model/03-coordinated-...)
+ * ───────────────────────────────────────────────────────────────────────────
+ *
+ * Posture:
+ *   - Writes are FAIL-OPEN: a failed event insert must never fail or slow the
+ *     user-facing interaction (same posture as audit logging in media-handler).
+ *   - No content payload — type + references only (enforced by the P1 schema;
+ *     do not smuggle content into a metadata column, there isn't one).
+ *   - Pruning is BATCHED with a circuit breaker (CLAUDE.md Infinite Loop
+ *     Prevention) — a single unbounded deleteMany on a mass-expiry backlog
+ *     would lock the table.
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { RecordInteractionInput } from "../types.js";
+/**
+ * Runtime configuration. Per the threshold-secrecy invariant these are env-
+ * driven with conservative defaults — never bare constants at the call site
+ * (the npm tarball is public). Documented + surfaced on `Env.interactionEvents`
+ * in env.ts; this parser is the single source.
+ */
+export interface InteractionEventConfig {
+    /** Master kill-switch for the dual-write (rollback). Default on. */
+    enabled: boolean;
+    /** expiresAt = createdAt + retentionDays. Default 120 — Phase 2 needs a
+     *  60–90-day lookback and retention must exceed the detection window with
+     *  margin (events expiring the day analysis runs are silent signal loss). */
+    retentionDays: number;
+    /** Fraction (0..1) of high-volume low-signal `view` events to record.
+     *  Default 0 — views are skipped entirely. High-signal types (react,
+     *  comment, share, profile_visit, depth_mode, content_creation) are ALWAYS
+     *  recorded regardless of this. */
+    viewSampleRate: number;
+    /** Prune page size (rows per delete batch). Default 1000. */
+    pruneBatchSize: number;
+    /** Circuit breaker: max prune iterations per run. Default 1000. */
+    pruneMaxIterations: number;
+}
+export declare const DEFAULT_INTERACTION_EVENT_CONFIG: InteractionEventConfig;
+/**
+ * Resolve config from a process.env-like record. The graph layer is built
+ * without an `Env` handle, so both env.ts (for documentation/typing) and the
+ * hourly cron (a bare Lambda) call this with `process.env`.
+ */
+export declare function resolveInteractionEventConfig(source?: Record<string, string | undefined>): InteractionEventConfig;
+export interface RecordResult {
+    /** A row was inserted. */
+    written: boolean;
+    /** The volume guard intentionally skipped this event (e.g. unsampled view). */
+    skipped: boolean;
+}
+export interface PruneResult {
+    deleted: number;
+    iterations: number;
+    /** Hit pruneMaxIterations with rows still expiring — a backlog the next run
+     *  must drain. The caller alarms on this (silent retention failure turns the
+     *  table into the unbounded log the design forbids). */
+    circuitBreakerTripped: boolean;
+}
+/**
+ * Generic batched prune of expired rows with a circuit breaker. Shared by
+ * InteractionEvent (expires_at) and — retrofitted — SecurityEvent
+ * (retention_until). Select-then-delete-by-id because Prisma `deleteMany` has
+ * no LIMIT; the bounded shape mirrors the cron's media cleanup (`take`).
+ */
+export declare function batchedPruneExpired(args: {
+    findExpiredIds: (take: number) => Promise<string[]>;
+    deleteByIds: (ids: string[]) => Promise<number>;
+    batchSize: number;
+    maxIterations: number;
+}): Promise<PruneResult>;
+export declare class InteractionEventOps {
+    private readonly prisma;
+    private readonly config;
+    /** Injectable RNG for deterministic view-sampling tests. */
+    private readonly rng;
+    constructor(prisma: PrismaClient, config?: InteractionEventConfig, 
+    /** Injectable RNG for deterministic view-sampling tests. */
+    rng?: () => number);
+    /** Volume guard: high-signal types always; `view` per sample rate. */
+    private shouldRecord;
+    /**
+     * Append one InteractionEvent for this interaction. FAIL-OPEN: never throws,
+     * never blocks the caller. Returns whether a row was written / skipped so the
+     * caller (or a test) can observe, but the user-facing path ignores it.
+     */
+    record(input: RecordInteractionInput): Promise<RecordResult>;
+    /** Delete rows whose expiresAt < now, in bounded batches. */
+    prune(now?: Date): Promise<PruneResult>;
+}
+//# sourceMappingURL=interaction-events.d.ts.map

package/dist/lib/graph/postgres/interaction-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction-events.d.ts","sourceRoot":"","sources":["../../../../src/lib/graph/postgres/interaction-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAI1D;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB;;iFAE6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB;;;uCAGmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,gCAAgC,EAAE,sBAM9C,CAAC;AAQF;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACvD,sBAAsB,CAiBxB;AAED,MAAM,WAAW,YAAY;IAC3B,0BAA0B;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB;;4DAEwD;IACxD,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,WAAW,CAAC,CAiBvB;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,MAAM,EAAE,YAAY,EACpB,MAAM,GAAE,sBAAyD;IAClF,4DAA4D;IAC3C,GAAG,GAAE,MAAM,MAAoB;IAGlD,sEAAsE;IACtE,OAAO,CAAC,YAAY;IAOpB;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC;IAkClE,6DAA6D;IACvD,KAAK,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;CAoB1D"}

package/dist/lib/graph/postgres/interaction-events.js

@@ -0,0 +1,162 @@
+/**
+ * Append-only InteractionEvent dual-write + retention pruning
+ * (Surveillance-hardening Phase 0, P2 / E1).
+ *
+ * Why this table exists: `Relationship.signals` keeps only AGGREGATE per-type
+ * counters — it destroys the temporal signal (who interacted with whom, WHEN)
+ * that Phase 2 coordinated-behavior detection needs. This module preserves that
+ * signal as an append-only log, bounded to a rolling retention window.
+ *
+ * ───────────────────────────────────────────────────────────────────────────
+ * READ-ACCESS INVARIANT (security review blocks on this):
+ *   90+ days of who-interacted-with-whom-when is a behavioral fingerprint — the
+ *   social graph + activity patterns a fusion platform would buy. Phase 0 ships
+ *   ZERO read paths. Any future read is restricted to the Phase 2 detection path
+ *   and moderator surfaces, requires MODERATOR/SUPER_ADMIN, and emits an audit
+ *   event. There is NO general-purpose query helper here, by design — do not add
+ *   one. (doc/02-technical/surveillance-threat-model/03-coordinated-...)
+ * ───────────────────────────────────────────────────────────────────────────
+ *
+ * Posture:
+ *   - Writes are FAIL-OPEN: a failed event insert must never fail or slow the
+ *     user-facing interaction (same posture as audit logging in media-handler).
+ *   - No content payload — type + references only (enforced by the P1 schema;
+ *     do not smuggle content into a metadata column, there isn't one).
+ *   - Pruning is BATCHED with a circuit breaker (CLAUDE.md Infinite Loop
+ *     Prevention) — a single unbounded deleteMany on a mass-expiry backlog
+ *     would lock the table.
+ */
+import { getCurrentTenantId } from "@de-otio/saas-foundation/tenant";
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+export const DEFAULT_INTERACTION_EVENT_CONFIG = {
+    enabled: true,
+    retentionDays: 120,
+    viewSampleRate: 0,
+    pruneBatchSize: 1000,
+    pruneMaxIterations: 1000,
+};
+function intFromEnv(raw, fallback) {
+    if (raw === undefined || raw === "")
+        return fallback;
+    const n = Number(raw);
+    return Number.isFinite(n) ? n : fallback;
+}
+/**
+ * Resolve config from a process.env-like record. The graph layer is built
+ * without an `Env` handle, so both env.ts (for documentation/typing) and the
+ * hourly cron (a bare Lambda) call this with `process.env`.
+ */
+export function resolveInteractionEventConfig(source = process.env) {
+    const rate = Number(source.INTERACTION_EVENT_VIEW_SAMPLE_RATE);
+    return {
+        // default ON; only the literal "false" disables it
+        enabled: source.INTERACTION_EVENTS_ENABLED !== "false",
+        retentionDays: intFromEnv(source.INTERACTION_EVENT_RETENTION_DAYS, 120),
+        viewSampleRate: Number.isFinite(rate) && rate >= 0 && rate <= 1 ? rate : 0,
+        pruneBatchSize: Math.max(1, intFromEnv(source.INTERACTION_EVENT_PRUNE_BATCH_SIZE, 1000)),
+        pruneMaxIterations: Math.max(1, intFromEnv(source.INTERACTION_EVENT_PRUNE_MAX_ITERATIONS, 1000)),
+    };
+}
+/**
+ * Generic batched prune of expired rows with a circuit breaker. Shared by
+ * InteractionEvent (expires_at) and — retrofitted — SecurityEvent
+ * (retention_until). Select-then-delete-by-id because Prisma `deleteMany` has
+ * no LIMIT; the bounded shape mirrors the cron's media cleanup (`take`).
+ */
+export async function batchedPruneExpired(args) {
+    const { findExpiredIds, deleteByIds, batchSize, maxIterations } = args;
+    let deleted = 0;
+    let iterations = 0;
+    while (iterations < maxIterations) {
+        iterations++;
+        const ids = await findExpiredIds(batchSize);
+        if (ids.length === 0) {
+            return { deleted, iterations: iterations - 1, circuitBreakerTripped: false };
+        }
+        deleted += await deleteByIds(ids);
+        if (ids.length < batchSize) {
+            return { deleted, iterations, circuitBreakerTripped: false };
+        }
+    }
+    // Reached the iteration cap with a full final batch — rows likely remain.
+    return { deleted, iterations, circuitBreakerTripped: true };
+}
+export class InteractionEventOps {
+    prisma;
+    config;
+    rng;
+    constructor(prisma, config = DEFAULT_INTERACTION_EVENT_CONFIG, 
+    /** Injectable RNG for deterministic view-sampling tests. */
+    rng = Math.random) {
+        this.prisma = prisma;
+        this.config = config;
+        this.rng = rng;
+    }
+    /** Volume guard: high-signal types always; `view` per sample rate. */
+    shouldRecord(interactionType) {
+        if (interactionType === "view") {
+            return this.config.viewSampleRate > 0 && this.rng() < this.config.viewSampleRate;
+        }
+        return true;
+    }
+    /**
+     * Append one InteractionEvent for this interaction. FAIL-OPEN: never throws,
+     * never blocks the caller. Returns whether a row was written / skipped so the
+     * caller (or a test) can observe, but the user-facing path ignores it.
+     */
+    async record(input) {
+        if (!this.config.enabled)
+            return { written: false, skipped: false };
+        if (!this.shouldRecord(input.interactionType)) {
+            return { written: false, skipped: true };
+        }
+        try {
+            const tenantId = getCurrentTenantId() ?? null;
+            await this.prisma.interactionEvent.create({
+                data: {
+                    actorUserId: input.userId,
+                    targetType: input.targetType,
+                    targetId: input.targetId,
+                    interactionType: input.interactionType,
+                    tenantId,
+                    expiresAt: new Date(Date.now() + this.config.retentionDays * MS_PER_DAY),
+                },
+            });
+            return { written: true, skipped: false };
+        }
+        catch (err) {
+            // Fail-open: log for observability, swallow. A failed behavioral-event
+            // write must never degrade the interaction itself.
+            // eslint-disable-next-line no-console -- ops-grep fail-open line
+            console.error(JSON.stringify({
+                level: "warn",
+                msg: "InteractionEvent write failed (fail-open)",
+                interactionType: input.interactionType,
+                error: err instanceof Error ? err.message : String(err),
+            }));
+            return { written: false, skipped: false };
+        }
+    }
+    /** Delete rows whose expiresAt < now, in bounded batches. */
+    async prune(now = new Date()) {
+        return batchedPruneExpired({
+            findExpiredIds: async (take) => {
+                const rows = await this.prisma.interactionEvent.findMany({
+                    where: { expiresAt: { lt: now } },
+                    select: { id: true },
+                    take,
+                });
+                return rows.map((r) => r.id);
+            },
+            deleteByIds: async (ids) => {
+                const res = await this.prisma.interactionEvent.deleteMany({
+                    where: { id: { in: ids } },
+                });
+                return res.count;
+            },
+            batchSize: this.config.pruneBatchSize,
+            maxIterations: this.config.pruneMaxIterations,
+        });
+    }
+}
+//# sourceMappingURL=interaction-events.js.map

package/dist/lib/graph/postgres/interaction-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction-events.js","sourceRoot":"","sources":["../../../../src/lib/graph/postgres/interaction-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA0BvC,MAAM,CAAC,MAAM,gCAAgC,GAA2B;IACtE,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,CAAC;IACjB,cAAc,EAAE,IAAI;IACpB,kBAAkB,EAAE,IAAI;CACzB,CAAC;AAEF,SAAS,UAAU,CAAC,GAAuB,EAAE,QAAgB;IAC3D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAA6C,OAAO,CAAC,GAAG;IAExD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC/D,OAAO;QACL,mDAAmD;QACnD,OAAO,EAAE,MAAM,CAAC,0BAA0B,KAAK,OAAO;QACtD,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,gCAAgC,EAAE,GAAG,CAAC;QACvE,cAAc,EACZ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5D,cAAc,EAAE,IAAI,CAAC,GAAG,CACtB,CAAC,EACD,UAAU,CAAC,MAAM,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAC5D;QACD,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAC1B,CAAC,EACD,UAAU,CAAC,MAAM,CAAC,sCAAsC,EAAE,IAAI,CAAC,CAChE;KACF,CAAC;AACJ,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAKzC;IACC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACvE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,OAAO,UAAU,GAAG,aAAa,EAAE,CAAC;QAClC,UAAU,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,GAAG,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,OAAO,mBAAmB;IAEX;IACA;IAEA;IAJnB,YACmB,MAAoB,EACpB,SAAiC,gCAAgC;IAClF,4DAA4D;IAC3C,MAAoB,IAAI,CAAC,MAAM;QAH/B,WAAM,GAAN,MAAM,CAAc;QACpB,WAAM,GAAN,MAAM,CAA2D;QAEjE,QAAG,GAAH,GAAG,CAA4B;IAC/C,CAAC;IAEJ,sEAAsE;IAC9D,YAAY,CAAC,eAAuB;QAC1C,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,kBAAkB,EAAE,IAAI,IAAI,CAAC;YAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBACxC,IAAI,EAAE;oBACJ,WAAW,EAAE,KAAK,CAAC,MAAM;oBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,eAAe,EAAE,KAAK,CAAC,eAAe;oBACtC,QAAQ;oBACR,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC;iBACzE;aACF,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,mDAAmD;YACnD,iEAAiE;YACjE,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,MAAM;gBACb,GAAG,EAAE,2CAA2C;gBAChD,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CACH,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,KAAK,CAAC,MAAY,IAAI,IAAI,EAAE;QAChC,OAAO,mBAAmB,CAAC;YACzB,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC;oBACvD,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;oBACjC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;oBACpB,IAAI;iBACL,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;oBACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;iBAC3B,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,KAAK,CAAC;YACnB,CAAC;YACD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SAC9C,CAAC,CAAC;IACL,CAAC;CACF"}