@kernhq/module-inventory 0.2.0 → 0.3.0

package/dist/server/services/custody.js

@@ -0,0 +1,367 @@
+import { KernError, uuidv7 } from '@kernhq/kernel';
+import { and, desc, eq, isNull } from 'drizzle-orm';
+import { assets, custodyPeriods } from '../schema.js';
+import { violated } from './db-errors.js';
+import { awayForRepair, deriveStatus, lockAsset } from './status.js';
+/** The GiST exclusion constraint `0001_rls.sql` added. Two open periods for one asset are it. */
+const NO_OVERLAP = 'inventory_custody_no_overlap';
+/**
+ * One millisecond: the finest a JS `Date` resolves, and therefore the shortest custody period this
+ * module is able to write. See `instant` — it is what keeps two changes in the same millisecond
+ * from recording a period nobody held the item for.
+ */
+const TICK_MS = 1;
+/** The wire shape: drizzle gives Date objects for timestamps, the contract promises ISO strings. */
+export function toCustodyPeriod(row) {
+    return {
+        id: row.id,
+        workspaceId: row.workspaceId,
+        assetId: row.assetId,
+        userId: row.userId,
+        note: row.note,
+        effectiveFrom: row.effectiveFrom.toISOString(),
+        effectiveTo: row.effectiveTo?.toISOString() ?? null,
+        createdBy: row.createdBy,
+        createdAt: row.createdAt.toISOString(),
+    };
+}
+/**
+ * Who is holding what, over time.
+ *
+ * Effective-dated the way HR keeps employments: **nothing is ever updated in place**. A change
+ * closes the open row and inserts a new one, so the answer to "who had this laptop in March" is a
+ * row that still exists rather than a value that was overwritten.
+ *
+ * Three things happen in one transaction on every change, and the whole point of the class is that
+ * they cannot come apart: the period rows move, `assets.custodian_user_id`/`custody_since`/`status`
+ * are brought into step with them, and an `asset_history` entry records it. The denormalised
+ * columns on `assets` are what the list filters and the widget read; they are correct because they
+ * are written here, in the same transaction, and never by a job afterwards.
+ *
+ * **A repair never refuses a handover.** An item at the repairer is still somebody's
+ * responsibility, so none of the three verbs looks at repair state to decide whether it may run —
+ * refusing `assign` would mean refusing `return` as well, and somebody leaving the company while
+ * their laptop is in the workshop has to be able to hand it back. What repair state *does* affect
+ * is the status these three write, which is `deriveStatus`'s job and is argued in `status.ts`.
+ *
+ * **The database is the arbiter of who won, not this file.** There is deliberately no `select … for
+ * update` before the period is inserted. `inventory_custody_no_overlap` — a GiST exclusion
+ * constraint on `(asset_id =, tstzrange(effective_from, effective_to, '[)') &&)` — is what makes two
+ * open periods impossible, so two people pressing *Hand over* on the same laptop in the same instant
+ * both read "nobody has it", both insert, and Postgres refuses exactly one of them. Locking the
+ * asset first would serialise them into two successful handovers, which is a worse answer wearing
+ * the clothes of a safer one. What this file owes the loser is a sentence they can act on rather
+ * than drizzle's "Failed query: insert into mod_inventory.custody_periods …", and that is `refuse()`
+ * below.
+ *
+ * **The asset row *is* locked afterwards, and that is a different job.** `stamp` takes it before it
+ * reads the repair state, because `status` is derived from two facts two services write and the
+ * winner of the race still has to write an answer nobody can overwrite from a stale snapshot. The
+ * distinction is argued at `lockAsset` in `status.ts`: the constraint decides the contest, the lock
+ * orders the bookkeeping that follows it.
+ */
+export class CustodyService {
+    notify;
+    constructor(notify) {
+        this.notify = notify;
+    }
+    /**
+     * The one error a lost race produces, in every place a race can be lost.
+     *
+     * Actionable rather than apologetic: the reader's screen is now out of date, and the only thing
+     * they can do about it is look again. `reason` is stable so a client could eventually say it in
+     * the reader's own language; the message is the honest fallback until one does.
+     */
+    static refuse() {
+        return KernError.conflict('Somebody changed who is holding this a moment before you did. Reload to see where it is now.', 'inventory.custody.conflict');
+    }
+    async asset(tx, workspaceId, assetId) {
+        const [row] = await tx
+            .select()
+            .from(assets)
+            .where(and(eq(assets.workspaceId, workspaceId), eq(assets.id, assetId)));
+        if (!row)
+            throw KernError.notFound('Asset');
+        // An archived asset is one the workspace has said it no longer tracks. Handing it to somebody
+        // would make them answerable for something that is not in the register, and the timeline would
+        // carry a handover after a retirement.
+        if (row.archivedAt)
+            throw KernError.conflict('This item is archived. Restore it before handing it over.', 'inventory.custody.archived');
+        return row;
+    }
+    /** The period that has not been closed, if there is one. At most one exists, by construction. */
+    async open(tx, workspaceId, assetId) {
+        const [row] = await tx
+            .select()
+            .from(custodyPeriods)
+            .where(and(eq(custodyPeriods.workspaceId, workspaceId), eq(custodyPeriods.assetId, assetId), isNull(custodyPeriods.effectiveTo)))
+            .limit(1);
+        return row;
+    }
+    /**
+     * Every period for one asset, newest first.
+     *
+     * Capped rather than paged: the rows are bounded by how many times one item changed hands, which
+     * is tens over its life. Ordered by `effective_from` and then by id, because a hand-on closes one
+     * row and opens another at the same instant and the two would otherwise have no order between
+     * them — the panel would show the handover before the return it replaced, at random.
+     */
+    async history(tx, workspaceId, assetId, limit) {
+        return tx
+            .select()
+            .from(custodyPeriods)
+            .where(and(eq(custodyPeriods.workspaceId, workspaceId), eq(custodyPeriods.assetId, assetId)))
+            .orderBy(desc(custodyPeriods.effectiveFrom), desc(custodyPeriods.id))
+            .limit(limit);
+    }
+    /**
+     * Close the open period at `at`, or refuse.
+     *
+     * `and effective_to is null` in the predicate is the optimistic guard: under READ COMMITTED a
+     * concurrent close blocks this statement, and when it resumes the row no longer matches, so zero
+     * rows come back rather than a second close silently overwriting the first one's timestamp.
+     */
+    async close(tx, workspaceId, periodId, at) {
+        const [row] = await tx
+            .update(custodyPeriods)
+            .set({ effectiveTo: at })
+            .where(and(eq(custodyPeriods.workspaceId, workspaceId), eq(custodyPeriods.id, periodId), isNull(custodyPeriods.effectiveTo)))
+            .returning();
+        if (!row)
+            throw CustodyService.refuse();
+        return row;
+    }
+    async openPeriod(tx, workspaceId, assetId, userId, note, actorId, at) {
+        try {
+            const [row] = await tx
+                .insert(custodyPeriods)
+                .values({
+                id: uuidv7(),
+                workspaceId,
+                assetId,
+                userId,
+                note,
+                effectiveFrom: at,
+                createdBy: actorId,
+            })
+                .returning();
+            return row;
+        }
+        catch (err) {
+            // The constraint bit: another transaction opened a period for this asset between our read and
+            // our insert. Anything else is a real fault and must not be disguised as a lost race.
+            if (violated(err, NO_OVERLAP))
+                throw CustodyService.refuse();
+            throw err;
+        }
+    }
+    /**
+     * The three denormalised columns, brought into step inside the same transaction.
+     *
+     * **`status` is not `userId ? 'assigned' : 'in_stock'`, and that line is what this comment is
+     * about.** An item can be at a repairer *and* assigned to somebody — the repair does not release
+     * whoever is answerable for it — so a handover that wrote `assigned` unconditionally would
+     * announce a laptop as back in the office while it was still in the workshop. Both facts are read
+     * and `deriveStatus` decides; the rule is argued in full in `status.ts`.
+     *
+     * **The asset row is locked before the repair state is read, and the order is the point.** Without
+     * it a repair completing in another transaction is invisible here and this handover's status is
+     * derived from a snapshot that has already stopped being true — the two writes then interleave
+     * into a status matching neither. See `lockAsset`.
+     *
+     * The lock is also what makes `assets.archive`'s refusal real rather than advisory. Archiving
+     * reads "nobody is holding it" under the same lock, so a handover racing an archive is ordered
+     * against it: whichever gets the lock second sees what the first committed, and the re-check below
+     * is what turns that into a refusal instead of an archived asset with an open custody period.
+     *
+     * @param repairsOn whether the workspace records repairs, read before the transaction opened.
+     * A workspace that has switched the capability off has no `under_repair`, because the procedure
+     * that would end one answers 404 — `deriveStatus` argues it in full, and this is one of the two
+     * write paths that lets an asset out of a status nothing else could move it out of.
+     */
+    async stamp(tx, workspaceId, assetId, userId, at, repairsOn) {
+        const locked = await lockAsset(tx, workspaceId, assetId);
+        /**
+         * Re-read under the lock, because the check in `asset()` was made against a snapshot an archive
+         * committed a moment later could already have replaced.
+         *
+         * **Only when somebody is being *given* the item, and that is a narrowing rather than an escape
+         * hatch.** A return never reaches this branch with an archived row at all: `return` calls
+         * `asset()` first, and `asset()` refuses an archived asset outright, whichever verb asked. The
+         * condition is here because a *return* has nothing to race — it can only ever leave the asset
+         * unheld — so re-checking it would be a refusal with no state behind it. This comment used to
+         * claim the opposite, that a return on an archived asset is deliberately allowed so an item that
+         * had reached the impossible state could be undone; it is not allowed, it never was, and the
+         * lock in `assets.archive` is what makes that state unreachable rather than merely rare.
+         */
+        if (userId !== null && locked.archivedAt)
+            throw KernError.conflict('This item is archived. Restore it before handing it over.', 'inventory.custody.archived');
+        const status = deriveStatus({
+            custodianUserId: userId,
+            awayForRepair: await awayForRepair(tx, workspaceId, assetId, repairsOn),
+        });
+        const [row] = await tx
+            .update(assets)
+            .set({
+            custodianUserId: userId,
+            custodySince: at,
+            status,
+            updatedAt: new Date(),
+        })
+            .where(and(eq(assets.workspaceId, workspaceId), eq(assets.id, assetId)))
+            .returning();
+        if (!row)
+            throw KernError.notFound('Asset');
+        return row;
+    }
+    /**
+     * The latest instant this asset's custody trail already reaches.
+     *
+     * The end of the most recent closed period, or the start of the open one. One row answers it
+     * because the periods for an asset cannot overlap — that is what `inventory_custody_no_overlap`
+     * enforces — so the row that starts last also ends last.
+     */
+    async boundary(tx, workspaceId, assetId) {
+        const [row] = await tx
+            .select({ from: custodyPeriods.effectiveFrom, to: custodyPeriods.effectiveTo })
+            .from(custodyPeriods)
+            .where(and(eq(custodyPeriods.workspaceId, workspaceId), eq(custodyPeriods.assetId, assetId)))
+            .orderBy(desc(custodyPeriods.effectiveFrom), desc(custodyPeriods.id))
+            .limit(1);
+        return row ? (row.to ?? row.from) : null;
+    }
+    /**
+     * The instant this change happens, for both halves of it.
+     *
+     * One value, so the period that closes and the period that opens abut exactly: `'[)'` ranges
+     * `[…, at)` and `[at, …)` do not overlap, where two `now()` calls a microsecond apart would leave
+     * a gap during which the asset was held by nobody.
+     *
+     * **It is a millisecond past the trail's own end, not `now()`, and both halves of that are a
+     * defect this replaced.**
+     *
+     * - `max(now, open.effectiveFrom)` produced a **zero-length period** whenever the two were equal,
+     *   which two handovers inside one millisecond make them — a JS `Date` resolves no finer. `[t, t)`
+     *   is empty, an empty range overlaps nothing, so the exclusion constraint waves it through and
+     *   the trail permanently records somebody holding the item for no time at all. Anybody reading
+     *   "who had this in March" gets a name that was never true. Strictly after the boundary, there
+     *   is no such row to write.
+     * - `assign` used plain `now()`, which a clock that steps backwards puts *before* the end of the
+     *   last closed period — so the new period overlapped a finished one, Postgres refused it with
+     *   `23P01`, and the person was told "somebody changed who is holding this a moment before you
+     *   did. Reload." Nobody had; reloading changes nothing; the handover is refused again every time.
+     *   Reading the trail's own end rather than the clock makes that unreachable instead of merely
+     *   better explained: the next period always starts after the last one ended, whatever the clock
+     *   says.
+     *
+     * `now` still wins whenever it is ahead, which is every ordinary case — this only ever moves the
+     * instant forward, never back, so it cannot manufacture a period that starts before its asset was
+     * bought.
+     */
+    async instant(tx, workspaceId, assetId) {
+        const boundary = await this.boundary(tx, workspaceId, assetId);
+        return new Date(Math.max(Date.now(), boundary ? boundary.getTime() + TICK_MS : 0));
+    }
+    /**
+     * Hand a free item to a member.
+     *
+     * Refuses when somebody already has it, rather than quietly taking it off them: `transfer` is the
+     * procedure that means "hand it on", and collapsing the two would make a mistyped assignment
+     * indistinguishable from a deliberate handover in the timeline everyone reads afterwards.
+     */
+    async assign(tx, workspaceId, actorId, assetId, userId, note, repairsOn) {
+        // Called for its two refusals — a row in another workspace is a 404, an archived one a
+        // conflict — and not for the row, which `stamp` returns below in its post-handover shape.
+        await this.asset(tx, workspaceId, assetId);
+        const open = await this.open(tx, workspaceId, assetId);
+        if (open)
+            throw KernError.conflict(open.userId === userId
+                ? 'They are already holding this item.'
+                : 'Somebody else is holding this item. Hand it on, or take it back first.', 'inventory.custody.already_held');
+        const at = await this.instant(tx, workspaceId, assetId);
+        const period = await this.openPeriod(tx, workspaceId, assetId, userId, note, actorId, at);
+        const row = await this.stamp(tx, workspaceId, assetId, userId, at, repairsOn);
+        const activity = {
+            workspaceId,
+            assetId,
+            actorId,
+            action: 'assigned',
+            data: { userId, ...(note ? { note } : {}) },
+        };
+        await this.notify.history(tx, activity);
+        return {
+            asset: row,
+            period,
+            userId,
+            previousUserId: null,
+            activity,
+            // Never the person doing the handing: telling somebody what they just did is the notification
+            // everybody switches the type off over.
+            notifyUserId: userId === actorId ? null : userId,
+        };
+    }
+    /**
+     * Hand it straight on. One transaction, not a return followed by an assign.
+     *
+     * Two calls would leave the asset `in_stock` with no custodian in between — visible to anybody
+     * reading the list at that moment, and permanently visible in the timeline as a return nobody
+     * performed and a stock period nobody spent.
+     */
+    async transfer(tx, workspaceId, actorId, assetId, userId, note, repairsOn) {
+        await this.asset(tx, workspaceId, assetId);
+        const open = await this.open(tx, workspaceId, assetId);
+        if (!open)
+            throw KernError.conflict('Nobody is holding this item, so there is nothing to hand on. Assign it instead.', 'inventory.custody.not_held');
+        if (open.userId === userId)
+            throw KernError.conflict('They are already holding this item.', 'inventory.custody.already_held');
+        const at = await this.instant(tx, workspaceId, assetId);
+        await this.close(tx, workspaceId, open.id, at);
+        const period = await this.openPeriod(tx, workspaceId, assetId, userId, note, actorId, at);
+        const row = await this.stamp(tx, workspaceId, assetId, userId, at, repairsOn);
+        const activity = {
+            workspaceId,
+            assetId,
+            actorId,
+            action: 'transferred',
+            data: { userId, previousUserId: open.userId, ...(note ? { note } : {}) },
+        };
+        await this.notify.history(tx, activity);
+        return {
+            asset: row,
+            period,
+            userId,
+            previousUserId: open.userId,
+            activity,
+            notifyUserId: userId === actorId ? null : userId,
+        };
+    }
+    /** Take it back. Closes the open period and puts the item back in stock. */
+    async return(tx, workspaceId, actorId, assetId, note, repairsOn) {
+        await this.asset(tx, workspaceId, assetId);
+        const open = await this.open(tx, workspaceId, assetId);
+        if (!open)
+            throw KernError.conflict('Nobody is holding this item, so there is nothing to take back.', 'inventory.custody.not_held');
+        const at = await this.instant(tx, workspaceId, assetId);
+        await this.close(tx, workspaceId, open.id, at);
+        const row = await this.stamp(tx, workspaceId, assetId, null, null, repairsOn);
+        const activity = {
+            workspaceId,
+            assetId,
+            actorId,
+            action: 'returned',
+            data: { previousUserId: open.userId, ...(note ? { note } : {}) },
+        };
+        await this.notify.history(tx, activity);
+        return {
+            asset: row,
+            period: null,
+            userId: null,
+            previousUserId: open.userId,
+            activity,
+            // A return is not news to anybody: the person who had it knows they handed it back, and the
+            // person taking it back is the one making the call.
+            notifyUserId: null,
+        };
+    }
+}
+//# sourceMappingURL=custody.js.map

package/dist/server/services/custody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custody.js","sourceRoot":"","sources":["../../../src/server/services/custody.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAW,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAKpE,iGAAiG;AACjG,MAAM,UAAU,GAAG,8BAA8B,CAAA;AAEjD;;;;GAIG;AACH,MAAM,OAAO,GAAG,CAAC,CAAA;AAEjB,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAAgD;QACjE,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE;QAC9C,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;QACnD,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAA;AACH,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD;;;;;;OAMG;IACK,MAAM,CAAC,MAAM;QACnB,OAAO,SAAS,CAAC,QAAQ,CACvB,8FAA8F,EAC9F,4BAA4B,CAC7B,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe;QAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAC1E,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,8FAA8F;QAC9F,+FAA+F;QAC/F,uCAAuC;QACvC,IAAI,GAAG,CAAC,UAAU;YAChB,MAAM,SAAS,CAAC,QAAQ,CACtB,2DAA2D,EAC3D,4BAA4B,CAC7B,CAAA;QACH,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe;QACrD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAC3C,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,EACnC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe,EAAE,KAAa;QACvE,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;aAC5F,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;aACpE,KAAK,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,KAAK,CAAC,EAAM,EAAE,WAAmB,EAAE,QAAgB,EAAE,EAAQ;QACzE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;aACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAC3C,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,EAC/B,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CACnC,CACF;aACA,SAAS,EAAE,CAAA;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,cAAc,CAAC,MAAM,EAAE,CAAA;QACvC,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,EAAM,EACN,WAAmB,EACnB,OAAe,EACf,MAAc,EACd,IAAmB,EACnB,OAAsB,EACtB,EAAQ;QAER,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,cAAc,CAAC;iBACtB,MAAM,CAAC;gBACN,EAAE,EAAE,MAAM,EAAE;gBACZ,WAAW;gBACX,OAAO;gBACP,MAAM;gBACN,IAAI;gBACJ,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,OAAO;aACnB,CAAC;iBACD,SAAS,EAAE,CAAA;YACd,OAAO,GAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8FAA8F;YAC9F,sFAAsF;YACtF,IAAI,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAAE,MAAM,cAAc,CAAC,MAAM,EAAE,CAAA;YAC5D,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,KAAK,CACjB,EAAM,EACN,WAAmB,EACnB,OAAe,EACf,MAAqB,EACrB,EAAe,EACf,SAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACxD;;;;;;;;;;;;WAYG;QACH,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU;YACtC,MAAM,SAAS,CAAC,QAAQ,CACtB,2DAA2D,EAC3D,4BAA4B,CAC7B,CAAA;QACH,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,MAAM,aAAa,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;SACxE,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,MAAM,CAAC;aACd,GAAG,CAAC;YACH,eAAe,EAAE,MAAM;YACvB,YAAY,EAAE,EAAE;YAChB,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;aACvE,SAAS,EAAE,CAAA;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,QAAQ,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe;QACjE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,aAAa,EAAE,EAAE,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC;aAC9E,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;aAC5F,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;aACpE,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QAC9D,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,OAAsB,EACtB,OAAe,EACf,MAAc,EACd,IAAmB,EACnB,SAAkB;QAElB,uFAAuF;QACvF,0FAA0F;QAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACtD,IAAI,IAAI;YACN,MAAM,SAAS,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,KAAK,MAAM;gBACpB,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,wEAAwE,EAC5E,gCAAgC,CACjC,CAAA;QAEH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACzF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAiB;YAC7B,WAAW;YACX,OAAO;YACP,OAAO;YACP,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC5C,CAAA;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACvC,OAAO;YACL,KAAK,EAAE,GAAG;YACV,MAAM;YACN,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,QAAQ;YACR,8FAA8F;YAC9F,wCAAwC;YACxC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;SACjD,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACZ,EAAM,EACN,WAAmB,EACnB,OAAsB,EACtB,OAAe,EACf,MAAc,EACd,IAAmB,EACnB,SAAkB;QAElB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI;YACP,MAAM,SAAS,CAAC,QAAQ,CACtB,iFAAiF,EACjF,4BAA4B,CAC7B,CAAA;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YACxB,MAAM,SAAS,CAAC,QAAQ,CAAC,qCAAqC,EAAE,gCAAgC,CAAC,CAAA;QAEnG,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACzF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAiB;YAC7B,WAAW;YACX,OAAO;YACP,OAAO;YACP,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACzE,CAAA;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACvC,OAAO;YACL,KAAK,EAAE,GAAG;YACV,MAAM;YACN,MAAM;YACN,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,QAAQ;YACR,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;SACjD,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,OAAsB,EACtB,OAAe,EACf,IAAmB,EACnB,SAAkB;QAElB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI;YACP,MAAM,SAAS,CAAC,QAAQ,CACtB,gEAAgE,EAChE,4BAA4B,CAC7B,CAAA;QAEH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAiB;YAC7B,WAAW;YACX,OAAO;YACP,OAAO;YACP,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACjE,CAAA;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACvC,OAAO;YACL,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;YACZ,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,QAAQ;YACR,4FAA4F;YAC5F,oDAAoD;YACpD,YAAY,EAAE,IAAI;SACnB,CAAA;IACH,CAAC;CACF"}

package/dist/server/services/db-errors.d.ts

@@ -0,0 +1,7 @@
+/** The constraint's name, if a named one refused the write. */
+export declare const constraintOf: (err: unknown) => string | undefined;
+/** The SQLSTATE, if one reached us. `23P01` is an exclusion violation, `23505` a unique one. */
+export declare const sqlStateOf: (err: unknown) => string | undefined;
+/** Did this write lose to `name`, whichever way Postgres reported it? */
+export declare const violated: (err: unknown, name: string) => boolean;
+//# sourceMappingURL=db-errors.d.ts.map

package/dist/server/services/db-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-errors.d.ts","sourceRoot":"","sources":["../../../src/server/services/db-errors.ts"],"names":[],"mappings":"AAgCA,+DAA+D;AAC/D,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,MAAM,GAAG,SAC4B,CAAA;AAEjF,gGAAgG;AAChG,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,MAAM,GAAG,SACkD,CAAA;AAErG,yEAAyE;AACzE,eAAO,MAAM,QAAQ,GAAI,KAAK,OAAO,EAAE,MAAM,MAAM,KAAG,OAAqC,CAAA"}

package/dist/server/services/db-errors.js

@@ -0,0 +1,32 @@
+/**
+ * Which constraint Postgres refused a write with, dug out of what drizzle hands back.
+ *
+ * A database constraint is only half a feature. `inventory_custody_no_overlap` makes two open
+ * custody periods for one asset impossible — but two people pressing *Hand over* on the same laptop
+ * at the same instant means the loser is shown drizzle's own text, "Failed query: insert into
+ * mod_inventory.custody_periods …", which tells a person nothing they can act on and looks like the
+ * product broke rather than like somebody else got there first.
+ *
+ * So the service catches, asks these two questions, and throws a `KernError.conflict` with a
+ * sentence. Reaching through `cause` rather than reading the top frame is the load-bearing part:
+ * drizzle wraps the driver's error, and the driver's error is the only object carrying `code` and
+ * `constraint`. `src/server/inventory.int.test.ts` walks the same chain for the same reason.
+ */
+const MAX_DEPTH = 5;
+function walk(err, read) {
+    let cursor = err;
+    for (let depth = 0; depth < MAX_DEPTH && cursor; depth++) {
+        const found = read(cursor);
+        if (found)
+            return found;
+        cursor = cursor.cause;
+    }
+    return undefined;
+}
+/** The constraint's name, if a named one refused the write. */
+export const constraintOf = (err) => walk(err, (e) => (typeof e.constraint === 'string' ? e.constraint : undefined));
+/** The SQLSTATE, if one reached us. `23P01` is an exclusion violation, `23505` a unique one. */
+export const sqlStateOf = (err) => walk(err, (e) => (typeof e.code === 'string' && /^[0-9A-Z]{5}$/.test(e.code) ? e.code : undefined));
+/** Did this write lose to `name`, whichever way Postgres reported it? */
+export const violated = (err, name) => constraintOf(err) === name;
+//# sourceMappingURL=db-errors.js.map

package/dist/server/services/db-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-errors.js","sourceRoot":"","sources":["../../../src/server/services/db-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,SAAS,GAAG,CAAC,CAAA;AAQnB,SAAS,IAAI,CAAC,GAAY,EAAE,IAA4C;IACtE,IAAI,MAAM,GAAY,GAAG,CAAA;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,IAAI,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAqB,CAAC,CAAA;QACzC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;QACvB,MAAM,GAAI,MAAsB,CAAC,KAAK,CAAA;IACxC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAsB,EAAE,CAC/D,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AAEjF,gGAAgG;AAChG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAY,EAAsB,EAAE,CAC7D,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AAErG,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA"}

package/dist/server/services/index.d.ts

@@ -1,9 +1,25 @@
 import type { Kernel } from '@kernhq/kernel';
 import { AssetService } from './assets.js';
+import { AttachmentService } from './attachments.js';
+import { CategoryService } from './categories.js';
+import { CustodyService } from './custody.js';
 import { NotifyService } from './notify.js';
+import { OffboardingService } from './offboarding.js';
+import { RepairService } from './repairs.js';
+import { SearchService } from './search.js';
+import { StatsService } from './stats.js';
 export interface InventoryServices {
     notify: NotifyService;
     assets: AssetService;
+    categories: CategoryService;
+    custody: CustodyService;
+    repairs: RepairService;
+    attachments: AttachmentService;
+    stats: StatsService;
+    /** The workspace-wide index, and the documents behind `inventory:asset:<id>`. */
+    search: SearchService;
+    /** Somebody left holding company property. Raises a checklist; never moves custody. */
+    offboarding: OffboardingService;
 }
 /** One service graph per kernel instance; the router, jobs and procedures all share it. */
 export declare function inventoryServices(kernel: Kernel): InventoryServices;

package/dist/server/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/services/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,YAAY,CAAA;CACrB;AAID,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAUnE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/services/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,eAAe,CAAA;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,OAAO,EAAE,aAAa,CAAA;IACtB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,iFAAiF;IACjF,MAAM,EAAE,aAAa,CAAA;IACrB,uFAAuF;IACvF,WAAW,EAAE,kBAAkB,CAAA;CAChC;AAID,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CA2BnE"}

package/dist/server/services/index.js

@@ -1,5 +1,12 @@
 import { AssetService } from './assets.js';
+import { AttachmentService } from './attachments.js';
+import { CategoryService } from './categories.js';
+import { CustodyService } from './custody.js';
 import { NotifyService } from './notify.js';
+import { OffboardingService } from './offboarding.js';
+import { RepairService } from './repairs.js';
+import { SearchService } from './search.js';
+import { StatsService } from './stats.js';
 const cache = new WeakMap();
 /** One service graph per kernel instance; the router, jobs and procedures all share it. */
 export function inventoryServices(kernel) {
@@ -8,7 +15,24 @@ export function inventoryServices(kernel) {
         return existing;
     const notify = new NotifyService(kernel);
     const assets = new AssetService(kernel, notify);
-    const services = { notify, assets };
+    const categories = new CategoryService();
+    const custody = new CustodyService(notify);
+    const repairs = new RepairService(notify);
+    const attachments = new AttachmentService(kernel, notify);
+    const stats = new StatsService();
+    const search = new SearchService(kernel, notify);
+    const offboarding = new OffboardingService(kernel, notify);
+    const services = {
+        notify,
+        assets,
+        categories,
+        custody,
+        repairs,
+        attachments,
+        stats,
+        search,
+        offboarding,
+    };
     cache.set(kernel, services);
     return services;
 }

package/dist/server/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/services/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAO3C,MAAM,KAAK,GAAG,IAAI,OAAO,EAA6B,CAAA;AAEtD,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAClC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAE7B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,MAAM,QAAQ,GAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IACtD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3B,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/services/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAgBzC,MAAM,KAAK,GAAG,IAAI,OAAO,EAA6B,CAAA;AAEtD,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAClC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAE7B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzD,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChD,MAAM,WAAW,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE1D,MAAM,QAAQ,GAAsB;QAClC,MAAM;QACN,MAAM;QACN,UAAU;QACV,OAAO;QACP,OAAO;QACP,WAAW;QACX,KAAK;QACL,MAAM;QACN,WAAW;KACZ,CAAA;IACD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3B,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/server/services/members.d.ts

@@ -0,0 +1,27 @@
+import { type Kernel } from '@kernhq/kernel';
+/**
+ * Is this person somebody this workspace can hand a laptop to?
+ *
+ * **`custody.assign` and `custody.transfer` took any uuid.** The id arrives in the request, nothing
+ * looked it up, and the module then wrote it into `custody_periods.user_id` and
+ * `assets.custodian_user_id` — the two columns that answer "who is answerable for this" for the rest
+ * of the item's life — and sent a notification to it. So a member of one workspace could record a
+ * *stranger* as holding company property, and the product would then chase that stranger about it.
+ * Every screen renders an id it cannot resolve as "a former member", which is the honest thing for a
+ * screen to say and exactly what hides this: the register looks plausible and names nobody real.
+ *
+ * The check is a question for core, because membership is core's fact and this module has no copy of
+ * it. `core.users.principal` answers with one person rather than the workspace's whole roll, which
+ * matters on an instance where a workspace has thousands of seats and this runs on every handover.
+ *
+ * **`active`, not merely present.** An invitation nobody has accepted is not somebody who can be
+ * handed a thing, and a suspended account is one the workspace has deliberately shut out.
+ *
+ * **A failure here refuses rather than waves through.** Every other cross-service call this module
+ * makes is best-effort, and this one deliberately is not: swallowing the failure would mean the
+ * check silently stops existing exactly while core is unwell, which is indistinguishable from not
+ * having written it. `UNAVAILABLE` is 503 and says the true thing — the answer is not knowable right
+ * now — where a 400 would tell somebody their colleague is not a member.
+ */
+export declare function requireWorkspaceMember(kernel: Kernel, workspaceId: string, userId: string): Promise<void>;
+//# sourceMappingURL=members.d.ts.map

package/dist/server/services/members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../../../src/server/services/members.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAsBf"}

package/dist/server/services/members.js

@@ -0,0 +1,39 @@
+import { KernError } from '@kernhq/kernel';
+/**
+ * Is this person somebody this workspace can hand a laptop to?
+ *
+ * **`custody.assign` and `custody.transfer` took any uuid.** The id arrives in the request, nothing
+ * looked it up, and the module then wrote it into `custody_periods.user_id` and
+ * `assets.custodian_user_id` — the two columns that answer "who is answerable for this" for the rest
+ * of the item's life — and sent a notification to it. So a member of one workspace could record a
+ * *stranger* as holding company property, and the product would then chase that stranger about it.
+ * Every screen renders an id it cannot resolve as "a former member", which is the honest thing for a
+ * screen to say and exactly what hides this: the register looks plausible and names nobody real.
+ *
+ * The check is a question for core, because membership is core's fact and this module has no copy of
+ * it. `core.users.principal` answers with one person rather than the workspace's whole roll, which
+ * matters on an instance where a workspace has thousands of seats and this runs on every handover.
+ *
+ * **`active`, not merely present.** An invitation nobody has accepted is not somebody who can be
+ * handed a thing, and a suspended account is one the workspace has deliberately shut out.
+ *
+ * **A failure here refuses rather than waves through.** Every other cross-service call this module
+ * makes is best-effort, and this one deliberately is not: swallowing the failure would mean the
+ * check silently stops existing exactly while core is unwell, which is indistinguishable from not
+ * having written it. `UNAVAILABLE` is 503 and says the true thing — the answer is not knowable right
+ * now — where a 400 would tell somebody their colleague is not a member.
+ */
+export async function requireWorkspaceMember(kernel, workspaceId, userId) {
+    let principal;
+    try {
+        principal = await kernel.call('core.users.principal', { userId });
+    }
+    catch (err) {
+        kernel.log.warn({ err: err instanceof Error ? err.message : String(err), workspaceId }, 'inventory: could not check whether the new custodian is a member');
+        throw new KernError('UNAVAILABLE', 'Who belongs to this workspace cannot be checked right now. Try again in a moment.');
+    }
+    const member = (principal?.memberships ?? []).some((m) => m.workspaceId === workspaceId && m.status === 'active');
+    if (!member)
+        throw KernError.badRequest('That person is not a member of this workspace, so nothing can be handed to them.');
+}
+//# sourceMappingURL=members.js.map

package/dist/server/services/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../../../src/server/services/members.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAe,MAAM,gBAAgB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,WAAmB,EACnB,MAAc;IAEd,IAAI,SAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAmB,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,EACtE,kEAAkE,CACnE,CAAA;QACD,MAAM,IAAI,SAAS,CACjB,aAAa,EACb,mFAAmF,CACpF,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAC9D,CAAA;IACD,IAAI,CAAC,MAAM;QACT,MAAM,SAAS,CAAC,UAAU,CACxB,kFAAkF,CACnF,CAAA;AACL,CAAC"}