@kernhq/module-inventory 0.2.0 → 0.4.0

package/dist/server/services/cursor.js

@@ -0,0 +1,39 @@
+import { KernError } from '@kernhq/kernel';
+export const encodeMark = (mark) => Buffer.from(JSON.stringify(mark), 'utf8').toString('base64url');
+/** Cheap and total, and it runs before the value can reach a `::uuid` cast. */
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function decodeMark(cursor, sort) {
+    const refuse = () => KernError.badRequest('That page marker is not one this list issued');
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw refuse();
+    }
+    if (typeof parsed?.i !== 'string' || !UUID.test(parsed.i))
+        throw refuse();
+    // One comparison covers both a sort this list never issues and a sort it issued under a
+    // *different* request. Either way the bookmark cannot be read against the ordering asked for,
+    // and pretending otherwise is what made "Load more" loop for ever.
+    if (parsed.s !== sort)
+        throw refuse();
+    return { i: parsed.i, s: sort };
+}
+export const encodeSeqMark = (mark) => Buffer.from(JSON.stringify(mark), 'utf8').toString('base64url');
+export function decodeSeqMark(cursor, sort) {
+    const refuse = () => KernError.badRequest('That page marker is not one this list issued');
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw refuse();
+    }
+    if (typeof parsed?.n !== 'number' || !Number.isSafeInteger(parsed.n) || parsed.n < 1)
+        throw refuse();
+    if (parsed.s !== sort)
+        throw refuse();
+    return { n: parsed.n, s: sort };
+}
+//# sourceMappingURL=cursor.js.map

package/dist/server/services/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../../src/server/services/cursor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAuC1C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAmB,IAAiB,EAAU,EAAE,CACxE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEjE,+EAA+E;AAC/E,MAAM,IAAI,GAAG,iEAAiE,CAAA;AAE9E,MAAM,UAAU,UAAU,CAAmB,MAAc,EAAE,IAAO;IAClE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,8CAA8C,CAAC,CAAA;IACzF,IAAI,MAAmC,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgC,CAAA;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,MAAM,EAAE,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,MAAM,EAAE,CAAA;IACzE,wFAAwF;IACxF,8FAA8F;IAC9F,mEAAmE;IACnE,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,MAAM,EAAE,CAAA;IACrC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;AACjC,CAAC;AA8BD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAmB,IAAoB,EAAU,EAAE,CAC9E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEjE,MAAM,UAAU,aAAa,CAAmB,MAAc,EAAE,IAAO;IACrE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,8CAA8C,CAAC,CAAA;IACzF,IAAI,MAAsC,CAAA;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAmC,CAAA;IAC1G,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,MAAM,EAAE,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,MAAM,EAAE,CAAA;IACpG,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,MAAM,EAAE,CAAA;IACrC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;AACjC,CAAC"}

package/dist/server/services/custody.d.ts

@@ -0,0 +1,175 @@
+import { type Tx } from '@kernhq/kernel';
+import type { CustodyPeriod as CustodyPeriodModel } from '../../contract/models.js';
+import { assets, custodyPeriods } from '../schema.js';
+import type { HistoryInput, NotifyService } from './notify.js';
+type AssetRow = typeof assets.$inferSelect;
+type PeriodRow = typeof custodyPeriods.$inferSelect;
+/** The wire shape: drizzle gives Date objects for timestamps, the contract promises ISO strings. */
+export declare function toCustodyPeriod(row: PeriodRow): CustodyPeriodModel;
+/**
+ * What one custody change wrote, and what may only leave the module once it has committed.
+ *
+ * `previousUserId` and `userId` are what `inventory.custody.changed` carries, and between them they
+ * say which of the three verbs happened without a fourth field claiming to: out from stock has no
+ * previous, back to stock has no next, a hand-on has both.
+ */
+export interface CustodyWritten {
+    asset: AssetRow;
+    /** The period this call opened. Null on a return: something closed, nothing opened. */
+    period: PeriodRow | null;
+    userId: string | null;
+    previousUserId: string | null;
+    activity: HistoryInput;
+    /** Who to tell, which is the recipient and never the person doing the handing. */
+    notifyUserId: string | null;
+}
+/**
+ * Who is holding what, over time.
+ *
+ * Effective-dated the way HR keeps employments: **nothing is ever updated in place**. A change
+ * closes the open row and inserts a new one, so the answer to "who had this laptop in March" is a
+ * row that still exists rather than a value that was overwritten.
+ *
+ * Three things happen in one transaction on every change, and the whole point of the class is that
+ * they cannot come apart: the period rows move, `assets.custodian_user_id`/`custody_since`/`status`
+ * are brought into step with them, and an `asset_history` entry records it. The denormalised
+ * columns on `assets` are what the list filters and the widget read; they are correct because they
+ * are written here, in the same transaction, and never by a job afterwards.
+ *
+ * **A repair never refuses a handover.** An item at the repairer is still somebody's
+ * responsibility, so none of the three verbs looks at repair state to decide whether it may run —
+ * refusing `assign` would mean refusing `return` as well, and somebody leaving the company while
+ * their laptop is in the workshop has to be able to hand it back. What repair state *does* affect
+ * is the status these three write, which is `deriveStatus`'s job and is argued in `status.ts`.
+ *
+ * **The database is the arbiter of who won, not this file.** There is deliberately no `select … for
+ * update` before the period is inserted. `inventory_custody_no_overlap` — a GiST exclusion
+ * constraint on `(asset_id =, tstzrange(effective_from, effective_to, '[)') &&)` — is what makes two
+ * open periods impossible, so two people pressing *Hand over* on the same laptop in the same instant
+ * both read "nobody has it", both insert, and Postgres refuses exactly one of them. Locking the
+ * asset first would serialise them into two successful handovers, which is a worse answer wearing
+ * the clothes of a safer one. What this file owes the loser is a sentence they can act on rather
+ * than drizzle's "Failed query: insert into mod_inventory.custody_periods …", and that is `refuse()`
+ * below.
+ *
+ * **The asset row *is* locked afterwards, and that is a different job.** `stamp` takes it before it
+ * reads the repair state, because `status` is derived from two facts two services write and the
+ * winner of the race still has to write an answer nobody can overwrite from a stale snapshot. The
+ * distinction is argued at `lockAsset` in `status.ts`: the constraint decides the contest, the lock
+ * orders the bookkeeping that follows it.
+ */
+export declare class CustodyService {
+    private readonly notify;
+    constructor(notify: NotifyService);
+    /**
+     * The one error a lost race produces, in every place a race can be lost.
+     *
+     * Actionable rather than apologetic: the reader's screen is now out of date, and the only thing
+     * they can do about it is look again. `reason` is stable so a client could eventually say it in
+     * the reader's own language; the message is the honest fallback until one does.
+     */
+    private static refuse;
+    private asset;
+    /** The period that has not been closed, if there is one. At most one exists, by construction. */
+    open(tx: Tx, workspaceId: string, assetId: string): Promise<PeriodRow | undefined>;
+    /**
+     * Every period for one asset, newest first.
+     *
+     * Capped rather than paged: the rows are bounded by how many times one item changed hands, which
+     * is tens over its life. Ordered by `effective_from` and then by id, because a hand-on closes one
+     * row and opens another at the same instant and the two would otherwise have no order between
+     * them — the panel would show the handover before the return it replaced, at random.
+     */
+    history(tx: Tx, workspaceId: string, assetId: string, limit: number): Promise<PeriodRow[]>;
+    /**
+     * Close the open period at `at`, or refuse.
+     *
+     * `and effective_to is null` in the predicate is the optimistic guard: under READ COMMITTED a
+     * concurrent close blocks this statement, and when it resumes the row no longer matches, so zero
+     * rows come back rather than a second close silently overwriting the first one's timestamp.
+     */
+    private close;
+    private openPeriod;
+    /**
+     * The three denormalised columns, brought into step inside the same transaction.
+     *
+     * **`status` is not `userId ? 'assigned' : 'in_stock'`, and that line is what this comment is
+     * about.** An item can be at a repairer *and* assigned to somebody — the repair does not release
+     * whoever is answerable for it — so a handover that wrote `assigned` unconditionally would
+     * announce a laptop as back in the office while it was still in the workshop. Both facts are read
+     * and `deriveStatus` decides; the rule is argued in full in `status.ts`.
+     *
+     * **The asset row is locked before the repair state is read, and the order is the point.** Without
+     * it a repair completing in another transaction is invisible here and this handover's status is
+     * derived from a snapshot that has already stopped being true — the two writes then interleave
+     * into a status matching neither. See `lockAsset`.
+     *
+     * The lock is also what makes `assets.archive`'s refusal real rather than advisory. Archiving
+     * reads "nobody is holding it" under the same lock, so a handover racing an archive is ordered
+     * against it: whichever gets the lock second sees what the first committed, and the re-check below
+     * is what turns that into a refusal instead of an archived asset with an open custody period.
+     *
+     * @param repairsOn whether the workspace records repairs, read before the transaction opened.
+     * A workspace that has switched the capability off has no `under_repair`, because the procedure
+     * that would end one answers 404 — `deriveStatus` argues it in full, and this is one of the two
+     * write paths that lets an asset out of a status nothing else could move it out of.
+     */
+    private stamp;
+    /**
+     * The latest instant this asset's custody trail already reaches.
+     *
+     * The end of the most recent closed period, or the start of the open one. One row answers it
+     * because the periods for an asset cannot overlap — that is what `inventory_custody_no_overlap`
+     * enforces — so the row that starts last also ends last.
+     */
+    private boundary;
+    /**
+     * The instant this change happens, for both halves of it.
+     *
+     * One value, so the period that closes and the period that opens abut exactly: `'[)'` ranges
+     * `[…, at)` and `[at, …)` do not overlap, where two `now()` calls a microsecond apart would leave
+     * a gap during which the asset was held by nobody.
+     *
+     * **It is a millisecond past the trail's own end, not `now()`, and both halves of that are a
+     * defect this replaced.**
+     *
+     * - `max(now, open.effectiveFrom)` produced a **zero-length period** whenever the two were equal,
+     *   which two handovers inside one millisecond make them — a JS `Date` resolves no finer. `[t, t)`
+     *   is empty, an empty range overlaps nothing, so the exclusion constraint waves it through and
+     *   the trail permanently records somebody holding the item for no time at all. Anybody reading
+     *   "who had this in March" gets a name that was never true. Strictly after the boundary, there
+     *   is no such row to write.
+     * - `assign` used plain `now()`, which a clock that steps backwards puts *before* the end of the
+     *   last closed period — so the new period overlapped a finished one, Postgres refused it with
+     *   `23P01`, and the person was told "somebody changed who is holding this a moment before you
+     *   did. Reload." Nobody had; reloading changes nothing; the handover is refused again every time.
+     *   Reading the trail's own end rather than the clock makes that unreachable instead of merely
+     *   better explained: the next period always starts after the last one ended, whatever the clock
+     *   says.
+     *
+     * `now` still wins whenever it is ahead, which is every ordinary case — this only ever moves the
+     * instant forward, never back, so it cannot manufacture a period that starts before its asset was
+     * bought.
+     */
+    private instant;
+    /**
+     * Hand a free item to a member.
+     *
+     * Refuses when somebody already has it, rather than quietly taking it off them: `transfer` is the
+     * procedure that means "hand it on", and collapsing the two would make a mistyped assignment
+     * indistinguishable from a deliberate handover in the timeline everyone reads afterwards.
+     */
+    assign(tx: Tx, workspaceId: string, actorId: string | null, assetId: string, userId: string, note: string | null, repairsOn: boolean): Promise<CustodyWritten>;
+    /**
+     * Hand it straight on. One transaction, not a return followed by an assign.
+     *
+     * Two calls would leave the asset `in_stock` with no custodian in between — visible to anybody
+     * reading the list at that moment, and permanently visible in the timeline as a return nobody
+     * performed and a stock period nobody spent.
+     */
+    transfer(tx: Tx, workspaceId: string, actorId: string | null, assetId: string, userId: string, note: string | null, repairsOn: boolean): Promise<CustodyWritten>;
+    /** Take it back. Closes the open period and puts the item back in stock. */
+    return(tx: Tx, workspaceId: string, actorId: string | null, assetId: string, note: string | null, repairsOn: boolean): Promise<CustodyWritten>;
+}
+export {};
+//# sourceMappingURL=custody.d.ts.map

package/dist/server/services/custody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custody.d.ts","sourceRoot":"","sources":["../../../src/server/services/custody.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,EAAE,EAAU,MAAM,gBAAgB,CAAA;AAE3D,OAAO,KAAK,EAAE,aAAa,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACnF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG9D,KAAK,QAAQ,GAAG,OAAO,MAAM,CAAC,YAAY,CAAA;AAC1C,KAAK,SAAS,GAAG,OAAO,cAAc,CAAC,YAAY,CAAA;AAYnD,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,kBAAkB,CAYlE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,QAAQ,CAAA;IACf,uFAAuF;IACvF,MAAM,EAAE,SAAS,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,EAAE,YAAY,CAAA;IACtB,kFAAkF;IAClF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAElD;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;YAOP,KAAK;IAiBnB,iGAAiG;IAC3F,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAexF;;;;;;;OAOG;IACG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAShG;;;;;;OAMG;YACW,KAAK;YAgBL,UAAU;IA+BxB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,KAAK;IA6CnB;;;;;;OAMG;YACW,QAAQ;IAUtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,OAAO;IAKrB;;;;;;OAMG;IACG,MAAM,CACV,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,cAAc,CAAC;IAqC1B;;;;;;OAMG;IACG,QAAQ,CACZ,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,cAAc,CAAC;IAkC1B,4EAA4E;IACtE,MAAM,CACV,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,cAAc,CAAC;CAgC3B"}

package/dist/server/services/custody.js

@@ -0,0 +1,367 @@
+import { KernError, uuidv7 } from '@kernhq/kernel';
+import { and, desc, eq, isNull } from 'drizzle-orm';
+import { assets, custodyPeriods } from '../schema.js';
+import { violated } from './db-errors.js';
+import { awayForRepair, deriveStatus, lockAsset } from './status.js';
+/** The GiST exclusion constraint `0001_rls.sql` added. Two open periods for one asset are it. */
+const NO_OVERLAP = 'inventory_custody_no_overlap';
+/**
+ * One millisecond: the finest a JS `Date` resolves, and therefore the shortest custody period this
+ * module is able to write. See `instant` — it is what keeps two changes in the same millisecond
+ * from recording a period nobody held the item for.
+ */
+const TICK_MS = 1;
+/** The wire shape: drizzle gives Date objects for timestamps, the contract promises ISO strings. */
+export function toCustodyPeriod(row) {
+    return {
+        id: row.id,
+        workspaceId: row.workspaceId,
+        assetId: row.assetId,
+        userId: row.userId,
+        note: row.note,
+        effectiveFrom: row.effectiveFrom.toISOString(),
+        effectiveTo: row.effectiveTo?.toISOString() ?? null,
+        createdBy: row.createdBy,
+        createdAt: row.createdAt.toISOString(),
+    };
+}
+/**
+ * Who is holding what, over time.
+ *
+ * Effective-dated the way HR keeps employments: **nothing is ever updated in place**. A change
+ * closes the open row and inserts a new one, so the answer to "who had this laptop in March" is a
+ * row that still exists rather than a value that was overwritten.
+ *
+ * Three things happen in one transaction on every change, and the whole point of the class is that
+ * they cannot come apart: the period rows move, `assets.custodian_user_id`/`custody_since`/`status`
+ * are brought into step with them, and an `asset_history` entry records it. The denormalised
+ * columns on `assets` are what the list filters and the widget read; they are correct because they
+ * are written here, in the same transaction, and never by a job afterwards.
+ *
+ * **A repair never refuses a handover.** An item at the repairer is still somebody's
+ * responsibility, so none of the three verbs looks at repair state to decide whether it may run —
+ * refusing `assign` would mean refusing `return` as well, and somebody leaving the company while
+ * their laptop is in the workshop has to be able to hand it back. What repair state *does* affect
+ * is the status these three write, which is `deriveStatus`'s job and is argued in `status.ts`.
+ *
+ * **The database is the arbiter of who won, not this file.** There is deliberately no `select … for
+ * update` before the period is inserted. `inventory_custody_no_overlap` — a GiST exclusion
+ * constraint on `(asset_id =, tstzrange(effective_from, effective_to, '[)') &&)` — is what makes two
+ * open periods impossible, so two people pressing *Hand over* on the same laptop in the same instant
+ * both read "nobody has it", both insert, and Postgres refuses exactly one of them. Locking the
+ * asset first would serialise them into two successful handovers, which is a worse answer wearing
+ * the clothes of a safer one. What this file owes the loser is a sentence they can act on rather
+ * than drizzle's "Failed query: insert into mod_inventory.custody_periods …", and that is `refuse()`
+ * below.
+ *
+ * **The asset row *is* locked afterwards, and that is a different job.** `stamp` takes it before it
+ * reads the repair state, because `status` is derived from two facts two services write and the
+ * winner of the race still has to write an answer nobody can overwrite from a stale snapshot. The
+ * distinction is argued at `lockAsset` in `status.ts`: the constraint decides the contest, the lock
+ * orders the bookkeeping that follows it.
+ */
+export class CustodyService {
+    notify;
+    constructor(notify) {
+        this.notify = notify;
+    }
+    /**
+     * The one error a lost race produces, in every place a race can be lost.
+     *
+     * Actionable rather than apologetic: the reader's screen is now out of date, and the only thing
+     * they can do about it is look again. `reason` is stable so a client could eventually say it in
+     * the reader's own language; the message is the honest fallback until one does.
+     */
+    static refuse() {
+        return KernError.conflict('Somebody changed who is holding this a moment before you did. Reload to see where it is now.', 'inventory.custody.conflict');
+    }
+    async asset(tx, workspaceId, assetId) {
+        const [row] = await tx
+            .select()
+            .from(assets)
+            .where(and(eq(assets.workspaceId, workspaceId), eq(assets.id, assetId)));
+        if (!row)
+            throw KernError.notFound('Asset');
+        // An archived asset is one the workspace has said it no longer tracks. Handing it to somebody
+        // would make them answerable for something that is not in the register, and the timeline would
+        // carry a handover after a retirement.
+        if (row.archivedAt)
+            throw KernError.conflict('This item is archived. Restore it before handing it over.', 'inventory.custody.archived');
+        return row;
+    }
+    /** The period that has not been closed, if there is one. At most one exists, by construction. */
+    async open(tx, workspaceId, assetId) {
+        const [row] = await tx
+            .select()
+            .from(custodyPeriods)
+            .where(and(eq(custodyPeriods.workspaceId, workspaceId), eq(custodyPeriods.assetId, assetId), isNull(custodyPeriods.effectiveTo)))
+            .limit(1);
+        return row;
+    }
+    /**
+     * Every period for one asset, newest first.
+     *
+     * Capped rather than paged: the rows are bounded by how many times one item changed hands, which
+     * is tens over its life. Ordered by `effective_from` and then by id, because a hand-on closes one
+     * row and opens another at the same instant and the two would otherwise have no order between
+     * them — the panel would show the handover before the return it replaced, at random.
+     */
+    async history(tx, workspaceId, assetId, limit) {
+        return tx
+            .select()
+            .from(custodyPeriods)
+            .where(and(eq(custodyPeriods.workspaceId, workspaceId), eq(custodyPeriods.assetId, assetId)))
+            .orderBy(desc(custodyPeriods.effectiveFrom), desc(custodyPeriods.id))
+            .limit(limit);
+    }
+    /**
+     * Close the open period at `at`, or refuse.
+     *
+     * `and effective_to is null` in the predicate is the optimistic guard: under READ COMMITTED a
+     * concurrent close blocks this statement, and when it resumes the row no longer matches, so zero
+     * rows come back rather than a second close silently overwriting the first one's timestamp.
+     */
+    async close(tx, workspaceId, periodId, at) {
+        const [row] = await tx
+            .update(custodyPeriods)
+            .set({ effectiveTo: at })
+            .where(and(eq(custodyPeriods.workspaceId, workspaceId), eq(custodyPeriods.id, periodId), isNull(custodyPeriods.effectiveTo)))
+            .returning();
+        if (!row)
+            throw CustodyService.refuse();
+        return row;
+    }
+    async openPeriod(tx, workspaceId, assetId, userId, note, actorId, at) {
+        try {
+            const [row] = await tx
+                .insert(custodyPeriods)
+                .values({
+                id: uuidv7(),
+                workspaceId,
+                assetId,
+                userId,
+                note,
+                effectiveFrom: at,
+                createdBy: actorId,
+            })
+                .returning();
+            return row;
+        }
+        catch (err) {
+            // The constraint bit: another transaction opened a period for this asset between our read and
+            // our insert. Anything else is a real fault and must not be disguised as a lost race.
+            if (violated(err, NO_OVERLAP))
+                throw CustodyService.refuse();
+            throw err;
+        }
+    }
+    /**
+     * The three denormalised columns, brought into step inside the same transaction.
+     *
+     * **`status` is not `userId ? 'assigned' : 'in_stock'`, and that line is what this comment is
+     * about.** An item can be at a repairer *and* assigned to somebody — the repair does not release
+     * whoever is answerable for it — so a handover that wrote `assigned` unconditionally would
+     * announce a laptop as back in the office while it was still in the workshop. Both facts are read
+     * and `deriveStatus` decides; the rule is argued in full in `status.ts`.
+     *
+     * **The asset row is locked before the repair state is read, and the order is the point.** Without
+     * it a repair completing in another transaction is invisible here and this handover's status is
+     * derived from a snapshot that has already stopped being true — the two writes then interleave
+     * into a status matching neither. See `lockAsset`.
+     *
+     * The lock is also what makes `assets.archive`'s refusal real rather than advisory. Archiving
+     * reads "nobody is holding it" under the same lock, so a handover racing an archive is ordered
+     * against it: whichever gets the lock second sees what the first committed, and the re-check below
+     * is what turns that into a refusal instead of an archived asset with an open custody period.
+     *
+     * @param repairsOn whether the workspace records repairs, read before the transaction opened.
+     * A workspace that has switched the capability off has no `under_repair`, because the procedure
+     * that would end one answers 404 — `deriveStatus` argues it in full, and this is one of the two
+     * write paths that lets an asset out of a status nothing else could move it out of.
+     */
+    async stamp(tx, workspaceId, assetId, userId, at, repairsOn) {
+        const locked = await lockAsset(tx, workspaceId, assetId);
+        /**
+         * Re-read under the lock, because the check in `asset()` was made against a snapshot an archive
+         * committed a moment later could already have replaced.
+         *
+         * **Only when somebody is being *given* the item, and that is a narrowing rather than an escape
+         * hatch.** A return never reaches this branch with an archived row at all: `return` calls
+         * `asset()` first, and `asset()` refuses an archived asset outright, whichever verb asked. The
+         * condition is here because a *return* has nothing to race — it can only ever leave the asset
+         * unheld — so re-checking it would be a refusal with no state behind it. This comment used to
+         * claim the opposite, that a return on an archived asset is deliberately allowed so an item that
+         * had reached the impossible state could be undone; it is not allowed, it never was, and the
+         * lock in `assets.archive` is what makes that state unreachable rather than merely rare.
+         */
+        if (userId !== null && locked.archivedAt)
+            throw KernError.conflict('This item is archived. Restore it before handing it over.', 'inventory.custody.archived');
+        const status = deriveStatus({
+            custodianUserId: userId,
+            awayForRepair: await awayForRepair(tx, workspaceId, assetId, repairsOn),
+        });
+        const [row] = await tx
+            .update(assets)
+            .set({
+            custodianUserId: userId,
+            custodySince: at,
+            status,
+            updatedAt: new Date(),
+        })
+            .where(and(eq(assets.workspaceId, workspaceId), eq(assets.id, assetId)))
+            .returning();
+        if (!row)
+            throw KernError.notFound('Asset');
+        return row;
+    }
+    /**
+     * The latest instant this asset's custody trail already reaches.
+     *
+     * The end of the most recent closed period, or the start of the open one. One row answers it
+     * because the periods for an asset cannot overlap — that is what `inventory_custody_no_overlap`
+     * enforces — so the row that starts last also ends last.
+     */
+    async boundary(tx, workspaceId, assetId) {
+        const [row] = await tx
+            .select({ from: custodyPeriods.effectiveFrom, to: custodyPeriods.effectiveTo })
+            .from(custodyPeriods)
+            .where(and(eq(custodyPeriods.workspaceId, workspaceId), eq(custodyPeriods.assetId, assetId)))
+            .orderBy(desc(custodyPeriods.effectiveFrom), desc(custodyPeriods.id))
+            .limit(1);
+        return row ? (row.to ?? row.from) : null;
+    }
+    /**
+     * The instant this change happens, for both halves of it.
+     *
+     * One value, so the period that closes and the period that opens abut exactly: `'[)'` ranges
+     * `[…, at)` and `[at, …)` do not overlap, where two `now()` calls a microsecond apart would leave
+     * a gap during which the asset was held by nobody.
+     *
+     * **It is a millisecond past the trail's own end, not `now()`, and both halves of that are a
+     * defect this replaced.**
+     *
+     * - `max(now, open.effectiveFrom)` produced a **zero-length period** whenever the two were equal,
+     *   which two handovers inside one millisecond make them — a JS `Date` resolves no finer. `[t, t)`
+     *   is empty, an empty range overlaps nothing, so the exclusion constraint waves it through and
+     *   the trail permanently records somebody holding the item for no time at all. Anybody reading
+     *   "who had this in March" gets a name that was never true. Strictly after the boundary, there
+     *   is no such row to write.
+     * - `assign` used plain `now()`, which a clock that steps backwards puts *before* the end of the
+     *   last closed period — so the new period overlapped a finished one, Postgres refused it with
+     *   `23P01`, and the person was told "somebody changed who is holding this a moment before you
+     *   did. Reload." Nobody had; reloading changes nothing; the handover is refused again every time.
+     *   Reading the trail's own end rather than the clock makes that unreachable instead of merely
+     *   better explained: the next period always starts after the last one ended, whatever the clock
+     *   says.
+     *
+     * `now` still wins whenever it is ahead, which is every ordinary case — this only ever moves the
+     * instant forward, never back, so it cannot manufacture a period that starts before its asset was
+     * bought.
+     */
+    async instant(tx, workspaceId, assetId) {
+        const boundary = await this.boundary(tx, workspaceId, assetId);
+        return new Date(Math.max(Date.now(), boundary ? boundary.getTime() + TICK_MS : 0));
+    }
+    /**
+     * Hand a free item to a member.
+     *
+     * Refuses when somebody already has it, rather than quietly taking it off them: `transfer` is the
+     * procedure that means "hand it on", and collapsing the two would make a mistyped assignment
+     * indistinguishable from a deliberate handover in the timeline everyone reads afterwards.
+     */
+    async assign(tx, workspaceId, actorId, assetId, userId, note, repairsOn) {
+        // Called for its two refusals — a row in another workspace is a 404, an archived one a
+        // conflict — and not for the row, which `stamp` returns below in its post-handover shape.
+        await this.asset(tx, workspaceId, assetId);
+        const open = await this.open(tx, workspaceId, assetId);
+        if (open)
+            throw KernError.conflict(open.userId === userId
+                ? 'They are already holding this item.'
+                : 'Somebody else is holding this item. Hand it on, or take it back first.', 'inventory.custody.already_held');
+        const at = await this.instant(tx, workspaceId, assetId);
+        const period = await this.openPeriod(tx, workspaceId, assetId, userId, note, actorId, at);
+        const row = await this.stamp(tx, workspaceId, assetId, userId, at, repairsOn);
+        const activity = {
+            workspaceId,
+            assetId,
+            actorId,
+            action: 'assigned',
+            data: { userId, ...(note ? { note } : {}) },
+        };
+        await this.notify.history(tx, activity);
+        return {
+            asset: row,
+            period,
+            userId,
+            previousUserId: null,
+            activity,
+            // Never the person doing the handing: telling somebody what they just did is the notification
+            // everybody switches the type off over.
+            notifyUserId: userId === actorId ? null : userId,
+        };
+    }
+    /**
+     * Hand it straight on. One transaction, not a return followed by an assign.
+     *
+     * Two calls would leave the asset `in_stock` with no custodian in between — visible to anybody
+     * reading the list at that moment, and permanently visible in the timeline as a return nobody
+     * performed and a stock period nobody spent.
+     */
+    async transfer(tx, workspaceId, actorId, assetId, userId, note, repairsOn) {
+        await this.asset(tx, workspaceId, assetId);
+        const open = await this.open(tx, workspaceId, assetId);
+        if (!open)
+            throw KernError.conflict('Nobody is holding this item, so there is nothing to hand on. Assign it instead.', 'inventory.custody.not_held');
+        if (open.userId === userId)
+            throw KernError.conflict('They are already holding this item.', 'inventory.custody.already_held');
+        const at = await this.instant(tx, workspaceId, assetId);
+        await this.close(tx, workspaceId, open.id, at);
+        const period = await this.openPeriod(tx, workspaceId, assetId, userId, note, actorId, at);
+        const row = await this.stamp(tx, workspaceId, assetId, userId, at, repairsOn);
+        const activity = {
+            workspaceId,
+            assetId,
+            actorId,
+            action: 'transferred',
+            data: { userId, previousUserId: open.userId, ...(note ? { note } : {}) },
+        };
+        await this.notify.history(tx, activity);
+        return {
+            asset: row,
+            period,
+            userId,
+            previousUserId: open.userId,
+            activity,
+            notifyUserId: userId === actorId ? null : userId,
+        };
+    }
+    /** Take it back. Closes the open period and puts the item back in stock. */
+    async return(tx, workspaceId, actorId, assetId, note, repairsOn) {
+        await this.asset(tx, workspaceId, assetId);
+        const open = await this.open(tx, workspaceId, assetId);
+        if (!open)
+            throw KernError.conflict('Nobody is holding this item, so there is nothing to take back.', 'inventory.custody.not_held');
+        const at = await this.instant(tx, workspaceId, assetId);
+        await this.close(tx, workspaceId, open.id, at);
+        const row = await this.stamp(tx, workspaceId, assetId, null, null, repairsOn);
+        const activity = {
+            workspaceId,
+            assetId,
+            actorId,
+            action: 'returned',
+            data: { previousUserId: open.userId, ...(note ? { note } : {}) },
+        };
+        await this.notify.history(tx, activity);
+        return {
+            asset: row,
+            period: null,
+            userId: null,
+            previousUserId: open.userId,
+            activity,
+            // A return is not news to anybody: the person who had it knows they handed it back, and the
+            // person taking it back is the one making the call.
+            notifyUserId: null,
+        };
+    }
+}
+//# sourceMappingURL=custody.js.map

package/dist/server/services/custody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custody.js","sourceRoot":"","sources":["../../../src/server/services/custody.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAW,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAKpE,iGAAiG;AACjG,MAAM,UAAU,GAAG,8BAA8B,CAAA;AAEjD;;;;GAIG;AACH,MAAM,OAAO,GAAG,CAAC,CAAA;AAEjB,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAAgD;QACjE,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE;QAC9C,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;QACnD,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAA;AACH,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD;;;;;;OAMG;IACK,MAAM,CAAC,MAAM;QACnB,OAAO,SAAS,CAAC,QAAQ,CACvB,8FAA8F,EAC9F,4BAA4B,CAC7B,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe;QAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAC1E,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,8FAA8F;QAC9F,+FAA+F;QAC/F,uCAAuC;QACvC,IAAI,GAAG,CAAC,UAAU;YAChB,MAAM,SAAS,CAAC,QAAQ,CACtB,2DAA2D,EAC3D,4BAA4B,CAC7B,CAAA;QACH,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe;QACrD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAC3C,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,EACnC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe,EAAE,KAAa;QACvE,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;aAC5F,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;aACpE,KAAK,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,KAAK,CAAC,EAAM,EAAE,WAAmB,EAAE,QAAgB,EAAE,EAAQ;QACzE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;aACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAC3C,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,EAC/B,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CACnC,CACF;aACA,SAAS,EAAE,CAAA;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,cAAc,CAAC,MAAM,EAAE,CAAA;QACvC,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,EAAM,EACN,WAAmB,EACnB,OAAe,EACf,MAAc,EACd,IAAmB,EACnB,OAAsB,EACtB,EAAQ;QAER,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,cAAc,CAAC;iBACtB,MAAM,CAAC;gBACN,EAAE,EAAE,MAAM,EAAE;gBACZ,WAAW;gBACX,OAAO;gBACP,MAAM;gBACN,IAAI;gBACJ,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,OAAO;aACnB,CAAC;iBACD,SAAS,EAAE,CAAA;YACd,OAAO,GAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8FAA8F;YAC9F,sFAAsF;YACtF,IAAI,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAAE,MAAM,cAAc,CAAC,MAAM,EAAE,CAAA;YAC5D,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,KAAK,CACjB,EAAM,EACN,WAAmB,EACnB,OAAe,EACf,MAAqB,EACrB,EAAe,EACf,SAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACxD;;;;;;;;;;;;WAYG;QACH,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU;YACtC,MAAM,SAAS,CAAC,QAAQ,CACtB,2DAA2D,EAC3D,4BAA4B,CAC7B,CAAA;QACH,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,MAAM,aAAa,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;SACxE,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,MAAM,CAAC;aACd,GAAG,CAAC;YACH,eAAe,EAAE,MAAM;YACvB,YAAY,EAAE,EAAE;YAChB,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;aACvE,SAAS,EAAE,CAAA;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,QAAQ,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe;QACjE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,aAAa,EAAE,EAAE,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC;aAC9E,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;aAC5F,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;aACpE,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,WAAmB,EAAE,OAAe;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QAC9D,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,OAAsB,EACtB,OAAe,EACf,MAAc,EACd,IAAmB,EACnB,SAAkB;QAElB,uFAAuF;QACvF,0FAA0F;QAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACtD,IAAI,IAAI;YACN,MAAM,SAAS,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,KAAK,MAAM;gBACpB,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,wEAAwE,EAC5E,gCAAgC,CACjC,CAAA;QAEH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACzF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAiB;YAC7B,WAAW;YACX,OAAO;YACP,OAAO;YACP,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC5C,CAAA;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACvC,OAAO;YACL,KAAK,EAAE,GAAG;YACV,MAAM;YACN,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,QAAQ;YACR,8FAA8F;YAC9F,wCAAwC;YACxC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;SACjD,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACZ,EAAM,EACN,WAAmB,EACnB,OAAsB,EACtB,OAAe,EACf,MAAc,EACd,IAAmB,EACnB,SAAkB;QAElB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI;YACP,MAAM,SAAS,CAAC,QAAQ,CACtB,iFAAiF,EACjF,4BAA4B,CAC7B,CAAA;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YACxB,MAAM,SAAS,CAAC,QAAQ,CAAC,qCAAqC,EAAE,gCAAgC,CAAC,CAAA;QAEnG,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACzF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAiB;YAC7B,WAAW;YACX,OAAO;YACP,OAAO;YACP,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACzE,CAAA;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACvC,OAAO;YACL,KAAK,EAAE,GAAG;YACV,MAAM;YACN,MAAM;YACN,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,QAAQ;YACR,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;SACjD,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,OAAsB,EACtB,OAAe,EACf,IAAmB,EACnB,SAAkB;QAElB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI;YACP,MAAM,SAAS,CAAC,QAAQ,CACtB,gEAAgE,EAChE,4BAA4B,CAC7B,CAAA;QAEH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAiB;YAC7B,WAAW;YACX,OAAO;YACP,OAAO;YACP,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACjE,CAAA;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACvC,OAAO;YACL,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;YACZ,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,QAAQ;YACR,4FAA4F;YAC5F,oDAAoD;YACpD,YAAY,EAAE,IAAI;SACnB,CAAA;IACH,CAAC;CACF"}

package/dist/server/services/db-errors.d.ts

@@ -0,0 +1,7 @@
+/** The constraint's name, if a named one refused the write. */
+export declare const constraintOf: (err: unknown) => string | undefined;
+/** The SQLSTATE, if one reached us. `23P01` is an exclusion violation, `23505` a unique one. */
+export declare const sqlStateOf: (err: unknown) => string | undefined;
+/** Did this write lose to `name`, whichever way Postgres reported it? */
+export declare const violated: (err: unknown, name: string) => boolean;
+//# sourceMappingURL=db-errors.d.ts.map

package/dist/server/services/db-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-errors.d.ts","sourceRoot":"","sources":["../../../src/server/services/db-errors.ts"],"names":[],"mappings":"AAgCA,+DAA+D;AAC/D,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,MAAM,GAAG,SAC4B,CAAA;AAEjF,gGAAgG;AAChG,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,MAAM,GAAG,SACkD,CAAA;AAErG,yEAAyE;AACzE,eAAO,MAAM,QAAQ,GAAI,KAAK,OAAO,EAAE,MAAM,MAAM,KAAG,OAAqC,CAAA"}