@noodleseed/one 0.162.0 → 0.163.0

package/node_modules/@noodle-borg/service/dist/business-information/in-memory-store.js

@@ -1,6 +1,16 @@
 import { randomUUID } from 'node:crypto';
-import { activityFromRecord, applyRequestOperation, cloneActivity, cloneGrant, cloneInstallation, cloneRecord, deletedRecord, idempotencyDigest, initialRecord, installationFingerprint, normalizeInstallationInput, permissionsForBusinessRole, requestFingerprint, validateCollectionEnabled, validateExpectedRevision, } from './model.js';
-import { afterCursor, compareRecords, decodeCursor, encodeCursor, recordKey, scopeKey, } from './pagination.js';
+import { memoryActivityPage } from './activity-pagination.js';
+import { collectionControlEnabled } from './collection-controls.js';
+import { InMemoryInstallationLifecycle, } from './in-memory-installation-lifecycle.js';
+import { InMemoryBusinessInvitations } from './in-memory-invitations.js';
+import { BusinessMemoryLocks } from './in-memory-locks.js';
+import { InstallationCapacityError, MAX_RETAINED_INSTALLATIONS_PER_ORG, } from './installation-capacity.js';
+import { migrateLegacyRequestRecord } from './legacy-request-migration.js';
+import { activityFromRecord, applyRequestOperation, cloneGrant, cloneRecord, deletedRecord, effectiveInstallation, idempotencyDigest, initialRecord, installationFingerprint, managedInstallationIntentMatches, normalizeInstallationInput, permissionsForBusinessRole, requestFingerprint, validateCollectionEnabled, validateExpectedRevision, validateStoredRecord, } from './model.js';
+import { matchesNativeQueryMetadata, planNativeQuery, runNativeQuery } from './native-query.js';
+import { commitNativeMemoryRecord, NativeStorageBudget } from './native-storage-budget.js';
+import { afterCursor, compareRecords, decodeCursor, grantKey, installationIdKey, page, recordKey, scopeKey, } from './pagination.js';
+import { BusinessPrincipalAuthority, } from './principal-authority.js';
 import { boundedExportPageSize, boundedPageSize, validateEmail, validateScalar, validateScope, } from './validation.js';
 /** Process-local development/test adapter. Hosted services must use the PostgreSQL adapter. */
 export class InMemoryBusinessInformationStore {
@@ -9,33 +19,69 @@ export class InMemoryBusinessInformationStore {
     #publicIds = new Map();
     #installationFingerprints = new Map();
     #grants = new Map();
+    #invitations;
+    #lifecycle;
+    #principals = new BusinessPrincipalAuthority();
+    #custody = new NativeStorageBudget();
     #records = new Map();
     #activities = new Map();
     #idempotency = new Map();
-    #locks = new Map();
+    #locks = new BusinessMemoryLocks();
     #now;
     #id;
     #publicId;
+    #managedDefinition;
     constructor(options = {}) {
         this.#now = options.now ?? (() => new Date());
         this.#id = options.id ?? randomUUID;
         this.#publicId = options.publicId ?? (() => `sol_${randomUUID().replaceAll('-', '')}`);
+        this.#managedDefinition = options.managedDefinition;
+        this.#lifecycle = new InMemoryInstallationLifecycle({
+            installations: this.#installations,
+            getGrant: (scope, subject) => this.#grants.get(grantKey(scope, subject)),
+            withLock: (key, operation) => this.#locks.run(key, operation),
+            now: this.#now,
+            managedDefinition: this.#managedDefinition,
+        });
+        this.#invitations = new InMemoryBusinessInvitations({
+            now: this.#now,
+            getInstallation: (scope) => this.getInstallation(scope),
+            getGrant: (scope, subject) => this.getGrant(scope, subject),
+            putGrant: (grant) => this.#grants.set(grantKey(grant.scope, grant.subject), grant),
+            withGrantLock: (scope, operation) => this.#locks.run(`grants:${scopeKey(scope)}`, operation),
+            liveAdministratorCount: (scope) => this.#liveAdministratorCount(scope),
+        });
+    }
+    configurePrincipalAuthority(provider) {
+        this.#principals.configure(provider);
+    }
+    async listEligibleAssignees(scope) {
+        return this.#principals.eligible(await this.listGrants(scope));
+    }
+    getBusinessNotice(scope) {
+        return this.#lifecycle.getBusinessNotice(scope);
+    }
+    setBusinessNotice(input) {
+        return this.#lifecycle.setBusinessNotice(input);
     }
     async createInstallation(input) {
         const normalized = normalizeInstallationInput(input);
         const key = scopeKey(normalized.scope);
-        return this.#withLock(`installation:${normalized.scope.org}:${normalized.scope.installationId}`, async () => {
+        return this.#locks.run(`installations:${normalized.scope.org}`, async () => {
             const existingKey = this.#installationIds.get(installationIdKey(normalized.scope.org, normalized.scope.installationId));
             const existing = existingKey === undefined ? undefined : this.#installations.get(existingKey);
             if (existing !== undefined) {
                 return {
                     disposition: existingKey === key &&
-                        this.#installationFingerprints.get(key) === installationFingerprint(normalized)
+                        (this.#installationFingerprints.get(key) === installationFingerprint(normalized) ||
+                            managedInstallationIntentMatches(existing, normalized))
                         ? 'replayed'
                         : 'conflict',
-                    installation: cloneInstallation(existing),
+                    installation: effectiveInstallation(existing, this.#managedDefinition),
                 };
             }
+            if ([...this.#installations.values()].filter((entry) => entry.scope.org === normalized.scope.org).length >= MAX_RETAINED_INSTALLATIONS_PER_ORG)
+                throw new InstallationCapacityError();
             const now = this.#now().toISOString();
             const installation = {
                 scope: { ...normalized.scope },
@@ -43,7 +89,10 @@ export class InMemoryBusinessInformationStore {
                 profileKey: normalized.profileKey,
                 profileVersion: normalized.profileVersion,
                 managedCollections: [...normalized.managedCollections],
+                definition: structuredClone(normalized.definition),
                 retentionDays: normalized.retentionDays,
+                intakeActive: true,
+                applicationGeneration: 'pending',
                 revision: 1,
                 createdAt: now,
                 createdBySubject: normalized.actorSubject,
@@ -66,29 +115,54 @@ export class InMemoryBusinessInformationStore {
                 updatedBySubject: normalized.actorSubject,
             };
             this.#grants.set(grantKey(normalized.scope, normalized.actorSubject), administrator);
-            return { disposition: 'created', installation: cloneInstallation(installation) };
+            return {
+                disposition: 'created',
+                installation: effectiveInstallation(installation, this.#managedDefinition),
+            };
         });
     }
     getInstallation(scope) {
-        const found = this.#installations.get(scopeKey(validateScope(scope)));
-        return Promise.resolve(found === undefined ? undefined : cloneInstallation(found));
+        return this.#lifecycle.getInstallation(scope);
     }
     getInstallationById(org, installationId) {
         const key = this.#installationIds.get(installationIdKey(validateScalar('organization', org, 63), validateScalar('installation', installationId, 63)));
         const found = key === undefined ? undefined : this.#installations.get(key);
-        return Promise.resolve(found === undefined ? undefined : cloneInstallation(found));
+        return Promise.resolve(found === undefined ? undefined : effectiveInstallation(found, this.#managedDefinition));
     }
     resolveInstallationByPublicId(publicId) {
         const key = this.#publicIds.get(validateScalar('public installation id', publicId, 128));
         const found = key === undefined ? undefined : this.#installations.get(key);
-        return Promise.resolve(found === undefined ? undefined : cloneInstallation(found));
+        return Promise.resolve(found === undefined ? undefined : effectiveInstallation(found, this.#managedDefinition));
     }
     listInstallations(org) {
-        const normalized = validateScalar('organization', org, 63);
-        return Promise.resolve([...this.#installations.values()]
-            .filter((installation) => installation.scope.org === normalized)
-            .sort((left, right) => left.createdAt.localeCompare(right.createdAt))
-            .map(cloneInstallation));
+        return this.#lifecycle.listInstallations(org);
+    }
+    listInstallationsForSubject(subject) {
+        const normalized = validateScalar('identity subject', subject, 256);
+        return Promise.resolve([...this.#grants.values()]
+            .filter((grant) => grant.subject === normalized && grant.revokedAt === undefined)
+            .map((grant) => {
+            const installation = this.#installations.get(scopeKey(grant.scope));
+            if (installation === undefined)
+                throw new Error('business grant installation is missing');
+            return {
+                installation: effectiveInstallation(installation, this.#managedDefinition),
+                grant: cloneGrant(grant),
+            };
+        })
+            .sort((left, right) => left.installation.createdAt.localeCompare(right.installation.createdAt)));
+    }
+    configureApplicationLifecycle(resolve) {
+        this.#lifecycle.configureApplicationLifecycle(resolve);
+    }
+    bindApplication(scope, generation) {
+        return this.#lifecycle.bindApplication(scope, generation);
+    }
+    pauseApplication(org, app, at, retired = false) {
+        return this.#lifecycle.pauseApplication(org, app, at, retired);
+    }
+    setIntakeState(input) {
+        return this.#lifecycle.setIntakeState(input);
     }
     getGrant(scope, subject) {
         const found = this.#grants.get(grantKey(validateScope(scope), subject));
@@ -108,7 +182,7 @@ export class InMemoryBusinessInformationStore {
         permissionsForBusinessRole(input.role);
         const scope = validateScope(input.scope);
         const key = grantKey(scope, subject);
-        return this.#withLock(`grants:${scopeKey(scope)}`, async () => {
+        return this.#locks.run(`grants:${scopeKey(scope)}`, async () => {
             if (!(await this.getInstallation(input.scope)))
                 return { ok: false, reason: 'not_found', currentRevision: 0 };
             const current = this.#grants.get(key);
@@ -142,7 +216,7 @@ export class InMemoryBusinessInformationStore {
         validateExpectedRevision(input.expectedRevision);
         const scope = validateScope(input.scope);
         const key = grantKey(scope, input.subject);
-        return this.#withLock(`grants:${scopeKey(scope)}`, async () => {
+        return this.#locks.run(`grants:${scopeKey(scope)}`, async () => {
             const current = this.#grants.get(key);
             if (current === undefined)
                 return { ok: false, reason: 'not_found', currentRevision: 0 };
@@ -170,44 +244,96 @@ export class InMemoryBusinessInformationStore {
             return { ok: true, grant: cloneGrant(grant) };
         });
     }
+    async createInvitation(input) {
+        return this.#invitations.create(input);
+    }
+    listInvitations(scope) {
+        return this.#invitations.list(scope);
+    }
+    async revokeInvitation(input) {
+        return this.#invitations.revoke(input);
+    }
+    async claimInvitation(input) {
+        return this.#invitations.claim(input);
+    }
     async createRequest(input) {
         const idempotencyKey = idempotencyDigest(input.idempotencyKey);
-        const installation = await this.#requiredInstallation(input.scope);
-        validateCollectionEnabled(installation, input.collectionKey);
         const key = `${scopeKey(input.scope)}\0${input.collectionKey}\0${idempotencyKey}`;
-        return this.#withLock(`request-create:${key}`, async () => {
-            const candidate = initialRecord({
-                installation,
-                collectionKey: input.collectionKey,
-                id: this.#id(),
-                payload: input.payload,
-                origin: input.origin,
-                actorSubject: input.actorSubject,
-                now: this.#now(),
-            });
-            const fingerprint = requestFingerprint({
-                collectionKey: candidate.collectionKey,
-                payload: candidate.content?.payload,
-                origin: candidate.origin,
-                actorSubject: candidate.createdBySubject,
+        return this.#locks.run(`request-create:${key}`, async () => {
+            return this.#locks.run(`intake:${scopeKey(input.scope)}`, async () => {
+                const installation = await this.#requiredInstallation(input.scope);
+                validateCollectionEnabled(installation, input.collectionKey);
+                const candidate = initialRecord({
+                    installation,
+                    collectionKey: input.collectionKey,
+                    id: this.#id(),
+                    payload: input.payload,
+                    ...(input.publicInput === undefined ? {} : { publicInput: input.publicInput }),
+                    origin: input.origin,
+                    actorSubject: input.actorSubject,
+                    now: this.#now(),
+                });
+                const fingerprint = requestFingerprint({
+                    collectionKey: candidate.collectionKey,
+                    payload: input.payload,
+                    origin: candidate.origin,
+                    actorSubject: candidate.createdBySubject,
+                });
+                const replay = this.#idempotency.get(key);
+                if (replay !== undefined) {
+                    const existing = this.#expireRecordIfNeeded(replay.recordKey, this.#now());
+                    if (existing === undefined)
+                        throw new Error('idempotency record points to a missing request');
+                    validateStoredRecord(installation, existing);
+                    return {
+                        disposition: replay.fingerprint === fingerprint ? 'replayed' : 'conflict',
+                        record: cloneRecord(existing),
+                    };
+                }
+                if (!(await this.#lifecycle.applicationAllows(installation)) ||
+                    ((input.origin.kind === 'embedded' || input.publicInput === true) &&
+                        !installation.intakeActive)) {
+                    return { disposition: 'paused' };
+                }
+                const currentKey = recordKey(input.scope, candidate.collectionKey, candidate.id);
+                this.#commitRecord(currentKey, candidate, 'created');
+                this.#idempotency.set(key, { fingerprint, recordKey: currentKey });
+                return { disposition: 'created', record: cloneRecord(candidate) };
             });
-            const replay = this.#idempotency.get(key);
-            if (replay !== undefined) {
-                const existing = this.#records.get(replay.recordKey);
-                if (existing === undefined)
-                    throw new Error('idempotency record points to a missing request');
-                return {
-                    disposition: replay.fingerprint === fingerprint ? 'replayed' : 'conflict',
-                    record: cloneRecord(existing),
-                };
-            }
-            const currentKey = recordKey(input.scope, candidate.collectionKey, candidate.id);
-            this.#records.set(currentKey, candidate);
-            this.#activities.set(currentKey, [activityFromRecord(candidate, 'created')]);
-            this.#idempotency.set(key, { fingerprint, recordKey: currentKey });
-            return { disposition: 'created', record: cloneRecord(candidate) };
         });
     }
+    async probeRequest(input) {
+        const installation = await this.#requiredInstallation(input.scope);
+        const candidate = initialRecord({
+            installation,
+            collectionKey: input.collectionKey,
+            id: this.#id(),
+            payload: input.payload,
+            ...(input.publicInput === undefined ? {} : { publicInput: input.publicInput }),
+            origin: input.origin,
+            actorSubject: input.actorSubject,
+            now: this.#now(),
+        });
+        const digest = idempotencyDigest(input.idempotencyKey);
+        const key = `${scopeKey(input.scope)}\0${input.collectionKey}\0${digest}`;
+        const replay = this.#idempotency.get(key);
+        if (replay === undefined)
+            return { disposition: 'missing' };
+        const existing = this.#expireRecordIfNeeded(replay.recordKey, this.#now());
+        if (existing === undefined)
+            throw new Error('idempotency record points to a missing request');
+        validateStoredRecord(installation, existing);
+        const fingerprint = requestFingerprint({
+            collectionKey: candidate.collectionKey,
+            payload: input.payload,
+            origin: candidate.origin,
+            actorSubject: candidate.createdBySubject,
+        });
+        return {
+            disposition: replay.fingerprint === fingerprint ? 'replayed' : 'conflict',
+            record: cloneRecord(existing),
+        };
+    }
     #liveAdministratorCount(scope) {
         const prefix = `${scopeKey(scope)}\0`;
         return [...this.#grants.entries()].filter(([key, grant]) => key.startsWith(prefix) && grant.role === 'administrator' && grant.revokedAt === undefined).length;
@@ -215,61 +341,124 @@ export class InMemoryBusinessInformationStore {
     async getRequest(scope, collectionKey, id, options = {}) {
         const installation = await this.#requiredInstallation(scope);
         const collection = validateCollectionEnabled(installation, collectionKey);
-        const record = this.#records.get(recordKey(scope, collection.key, validateScalar('record id', id, 128)));
+        const key = recordKey(scope, collection.key, validateScalar('record id', id, 128));
+        const record = this.#expireRecordIfNeeded(key, this.#now());
         if (record === undefined || (record.deletedAt !== undefined && options.includeDeleted !== true))
             return undefined;
+        validateStoredRecord(installation, record);
         return cloneRecord(record);
     }
+    async listAcceptedSchemaInventory() {
+        const inventory = new Map();
+        for (const record of this.#records.values()) {
+            const identity = {
+                profileKey: record.profileKey,
+                profileVersion: record.profileVersion,
+                collectionKey: record.collectionKey,
+                schemaVersion: record.schemaVersion,
+                schemaDigest: record.schemaDigest,
+            };
+            inventory.set(JSON.stringify(identity), identity);
+            if (record.originalSchema !== undefined) {
+                const original = { ...identity, ...record.originalSchema };
+                inventory.set(JSON.stringify(original), original);
+            }
+        }
+        return [...inventory.entries()]
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([, identity]) => ({ ...identity }));
+    }
     async listRequests(input) {
         const installation = await this.#requiredInstallation(input.scope);
         const collection = validateCollectionEnabled(installation, input.collectionKey);
-        const limit = boundedPageSize(input.limit);
-        const cursor = input.cursor === undefined
-            ? undefined
-            : decodeCursor(input.cursor, {
-                kind: 'list',
-                scope: input.scope,
-                collectionKey: collection.key,
-            });
-        const records = this.#matchingRecords(input.scope, collection.key)
-            .filter((record) => input.includeDeleted === true || record.deletedAt === undefined)
-            .filter((record) => input.status === undefined || record.status === input.status)
-            .filter((record) => input.assigneeSubject === undefined || record.assigneeSubject === input.assigneeSubject)
-            .filter((record) => cursor === undefined || afterCursor(record, cursor));
-        return page(records, limit, 'list', input.scope, collection.key);
+        const now = this.#now();
+        const plan = await planNativeQuery(input, collection, now, (id) => this.getRequest(input.scope, collection.key, id, { includeDeleted: true }));
+        const records = this.#matchingRecords(input.scope, collection.key).filter((record) => matchesNativeQueryMetadata(record, plan, now));
+        const result = await runNativeQuery(plan, records);
+        for (const record of result.records)
+            validateStoredRecord(installation, record);
+        return result;
     }
     async mutateRequest(input) {
         validateExpectedRevision(input.expectedRevision);
         const installation = await this.#requiredInstallation(input.scope);
         const collection = validateCollectionEnabled(installation, input.collectionKey);
         const key = recordKey(input.scope, collection.key, validateScalar('record id', input.id, 128));
-        return this.#withLock(`request:${key}`, async () => {
-            const current = this.#records.get(key);
+        const mutate = () => this.#locks.run(`request:${key}`, async () => {
+            const current = this.#expireRecordIfNeeded(key, this.#now());
             if (current === undefined || current.deletedAt !== undefined) {
                 return { ok: false, reason: 'not_found', currentRevision: 0 };
             }
             if (current.revision !== input.expectedRevision) {
                 return { ok: false, reason: 'conflict', currentRevision: current.revision };
             }
-            const applied = applyRequestOperation(current, input.operation, input.actorSubject, this.#now(), this.#id);
+            if (input.operation.kind === 'assign' &&
+                !collectionControlEnabled(collection, 'assignment')) {
+                return { ok: false, reason: 'invalid_transition', currentRevision: current.revision };
+            }
+            if (input.operation.kind === 'assign' && input.operation.assigneeSubject !== undefined) {
+                const assignee = this.#grants.get(grantKey(input.scope, input.operation.assigneeSubject));
+                if (assignee === undefined ||
+                    assignee.revokedAt !== undefined ||
+                    assignee.role === 'viewer' ||
+                    !(await this.#principals.allows(assignee.subject))) {
+                    return { ok: false, reason: 'invalid_assignee', currentRevision: current.revision };
+                }
+            }
+            const historicalCollection = validateStoredRecord(installation, current);
+            const applied = applyRequestOperation(current, {
+                ...historicalCollection,
+                ...(collection.management === undefined ? {} : { management: collection.management }),
+                ...(collection.editableFields === undefined
+                    ? {}
+                    : { editableFields: collection.editableFields }),
+            }, input.operation, input.actorSubject, this.#now(), this.#id);
             if (applied === undefined) {
                 return { ok: false, reason: 'invalid_transition', currentRevision: current.revision };
             }
-            this.#records.set(key, applied.record);
-            this.#activities.get(key)?.push(activityFromRecord(applied.record, applied.activityKind));
+            this.#commitRecord(key, applied.record, applied.activityKind);
             return { ok: true, record: cloneRecord(applied.record) };
         });
+        return input.operation.kind === 'assign'
+            ? this.#locks.run(`grants:${scopeKey(input.scope)}`, mutate)
+            : mutate();
+    }
+    async migrateLegacyRequest(input) {
+        validateExpectedRevision(input.expectedRevision);
+        const installation = await this.#requiredInstallation(input.scope);
+        validateCollectionEnabled(installation, input.collectionKey);
+        const key = recordKey(input.scope, input.collectionKey, validateScalar('record id', input.id, 128));
+        return this.#locks.run(`request:${key}`, async () => {
+            const current = this.#expireRecordIfNeeded(key, this.#now());
+            if (current === undefined || current.deletedAt !== undefined)
+                return { ok: false, reason: 'not_found', currentRevision: current?.revision ?? 0 };
+            if (current.revision !== input.expectedRevision)
+                return { ok: false, reason: 'conflict', currentRevision: current.revision };
+            const previous = validateStoredRecord(installation, current);
+            const migrated = migrateLegacyRequestRecord(current, previous, installation, input.actorSubject, this.#now());
+            if (migrated === undefined)
+                return { ok: false, reason: 'invalid_transition', currentRevision: current.revision };
+            if (migrated !== current) {
+                this.#commitRecord(key, migrated, 'schema_migrated');
+            }
+            return { ok: true, record: cloneRecord(migrated) };
+        });
     }
     async deleteRequest(input) {
         validateExpectedRevision(input.expectedRevision);
         const installation = await this.#requiredInstallation(input.scope);
         const collection = validateCollectionEnabled(installation, input.collectionKey);
         const key = recordKey(input.scope, collection.key, validateScalar('record id', input.id, 128));
-        return this.#withLock(`request:${key}`, () => Promise.resolve(this.#eraseRecord(key, input.expectedRevision, input.actorSubject, 'customer_request')));
+        return this.#locks.run(`request:${key}`, () => Promise.resolve(this.#eraseRecord(key, input.expectedRevision, input.actorSubject, 'customer_request')));
     }
-    listActivity(scope, collectionKey, id) {
-        const key = recordKey(validateScope(scope), collectionKey, validateScalar('record id', id, 128));
-        return Promise.resolve((this.#activities.get(key) ?? []).map(cloneActivity));
+    async listActivity(scope, collectionKey, id, input) {
+        const installation = await this.#requiredInstallation(scope);
+        const collection = validateCollectionEnabled(installation, collectionKey);
+        const key = recordKey(validateScope(scope), collection.key, validateScalar('record id', id, 128));
+        const record = this.#expireRecordIfNeeded(key, this.#now());
+        if (record !== undefined)
+            validateStoredRecord(installation, record);
+        return memoryActivityPage(scope, collection.key, id, this.#activities.get(key) ?? [], input);
     }
     async exportRequests(input) {
         const installation = await this.#requiredInstallation(input.scope);
@@ -289,6 +478,8 @@ export class InMemoryBusinessInformationStore {
             .filter((record) => record.createdAt <= snapshotAt)
             .filter((record) => input.includeDeleted === true || record.deletedAt === undefined)
             .filter((record) => cursor === undefined || afterCursor(record, cursor));
+        for (const record of records)
+            validateStoredRecord(installation, record);
         return {
             ...page(records, limit, 'export', input.scope, collection.key, snapshotAt),
             snapshotAt,
@@ -305,7 +496,7 @@ export class InMemoryBusinessInformationStore {
             .slice(0, limit);
         let purged = 0;
         for (const [key, record] of candidates) {
-            const result = await this.#withLock(`request:${key}`, () => Promise.resolve(this.#eraseRecord(key, record.revision, 'system:retention', 'retention_expired')));
+            const result = await this.#locks.run(`request:${key}`, () => Promise.resolve(this.#eraseRecord(key, record.revision, 'system:retention', 'retention_expired')));
             if (result.ok)
                 purged += 1;
         }
@@ -313,13 +504,28 @@ export class InMemoryBusinessInformationStore {
     }
     #matchingRecords(scope, collectionKey) {
         const prefix = `${scopeKey(scope)}\0${collectionKey}\0`;
+        const now = this.#now().toISOString();
         return [...this.#records.entries()]
-            .filter(([key]) => key.startsWith(prefix))
+            .filter(([key, record]) => key.startsWith(prefix) &&
+            (record.deletedAt !== undefined || record.retentionExpiresAt > now))
             .map(([, record]) => record)
             .sort(compareRecords);
     }
-    #eraseRecord(key, expectedRevision, actorSubject, reason) {
+    #expireRecordIfNeeded(key, now) {
         const current = this.#records.get(key);
+        if (current === undefined ||
+            current.deletedAt !== undefined ||
+            current.retentionExpiresAt > now.toISOString()) {
+            return current;
+        }
+        const erased = deletedRecord(current, 'system:retention', now, 'retention_expired');
+        this.#commitRecord(key, erased, 'retention_expired');
+        return erased;
+    }
+    #eraseRecord(key, expectedRevision, actorSubject, reason) {
+        const current = reason === 'retention_expired'
+            ? this.#records.get(key)
+            : this.#expireRecordIfNeeded(key, this.#now());
         if (current === undefined || current.deletedAt !== undefined) {
             return { ok: false, reason: 'not_found', currentRevision: current?.revision ?? 0 };
         }
@@ -327,18 +533,12 @@ export class InMemoryBusinessInformationStore {
             return { ok: false, reason: 'conflict', currentRevision: current.revision };
         }
         const erased = deletedRecord(current, actorSubject, this.#now(), reason);
-        this.#records.set(key, erased);
-        const erasedHistory = (this.#activities.get(key) ?? []).map((activity) => {
-            const { content: ignored, ...metadata } = activity;
-            void ignored;
-            return metadata;
-        });
-        this.#activities.set(key, [
-            ...erasedHistory,
-            activityFromRecord(erased, reason === 'customer_request' ? 'deleted' : 'retention_expired'),
-        ]);
+        this.#commitRecord(key, erased, reason === 'customer_request' ? 'deleted' : 'retention_expired');
         return { ok: true, record: cloneRecord(erased) };
     }
+    #commitRecord(key, record, kind) {
+        commitNativeMemoryRecord(this.#records, this.#activities, this.#custody, key, record, activityFromRecord(record, kind));
+    }
     async #requiredInstallation(scope) {
         const installation = await this.getInstallation(scope);
         if (installation === undefined)
@@ -353,50 +553,5 @@ export class InMemoryBusinessInformationStore {
         }
         throw new Error('could not allocate a unique public installation id');
     }
-    async #withLock(key, operation) {
-        const previous = this.#locks.get(key) ?? Promise.resolve();
-        let release = () => void 0;
-        const current = new Promise((resolve) => {
-            release = resolve;
-        });
-        const queued = previous.then(() => current);
-        this.#locks.set(key, queued);
-        await previous;
-        try {
-            return await operation();
-        }
-        finally {
-            release(undefined);
-            if (this.#locks.get(key) === queued)
-                this.#locks.delete(key);
-        }
-    }
-}
-function installationIdKey(org, installationId) {
-    return `${org}\0${installationId}`;
-}
-function grantKey(scope, subject) {
-    return `${scopeKey(scope)}\0${validateScalar('grant subject', subject, 256)}`;
-}
-function page(records, limit, kind, scope, collectionKey, snapshotAt) {
-    const selected = records.slice(0, limit).map(cloneRecord);
-    const last = selected.at(-1);
-    const hasMore = records.length > limit;
-    return {
-        records: selected,
-        ...(hasMore && last !== undefined
-            ? {
-                nextCursor: encodeCursor({
-                    version: 1,
-                    kind,
-                    scope: scopeKey(scope),
-                    collectionKey,
-                    lastCreatedAt: last.createdAt,
-                    lastId: last.id,
-                    ...(snapshotAt === undefined ? {} : { snapshotAt }),
-                }),
-            }
-            : {}),
-    };
 }
 //# sourceMappingURL=in-memory-store.js.map

package/node_modules/@noodle-borg/service/dist/business-information/installation-capacity.js

@@ -0,0 +1,10 @@
+/** Technical retained-metadata guard, independent of app or commercial entitlements. */
+export const MAX_RETAINED_INSTALLATIONS_PER_ORG = 1_000;
+export class InstallationCapacityError extends Error {
+    code = 'installation_capacity_exceeded';
+    constructor() {
+        super('This organization has reached its retained installation limit. Reuse an existing application and environment; existing installations remain accessible.');
+        this.name = 'InstallationCapacityError';
+    }
+}
+//# sourceMappingURL=installation-capacity.js.map

package/node_modules/@noodle-borg/service/dist/business-information/invitations.js

@@ -0,0 +1,68 @@
+import { createHash } from 'node:crypto';
+import { validateExpectedRevision } from './model.js';
+import { validateEmail, validateScalar, validateScope } from './validation.js';
+export function normalizeInvitationInput(input) {
+    const expiresAt = input.expiresAt;
+    if (!Number.isFinite(expiresAt.getTime()))
+        throw new Error('invitation expiry is invalid');
+    const tokenDigest = validateDigest('invitation token digest', input.tokenDigest);
+    const idempotencyDigest = createHash('sha256')
+        .update(validateScalar('invitation idempotency key', input.idempotencyKey, 128))
+        .digest('hex');
+    const normalized = {
+        scope: validateScope(input.scope),
+        invitationId: validateScalar('invitation id', input.invitationId, 128),
+        email: validateEmail(input.email),
+        role: input.role,
+        tokenDigest,
+        idempotencyDigest,
+        expiresAt,
+        actorSubject: validateScalar('actor subject', input.actorSubject, 256),
+    };
+    return {
+        ...normalized,
+        createFingerprint: createHash('sha256')
+            .update(JSON.stringify({
+            scope: normalized.scope,
+            email: normalized.email,
+            role: normalized.role,
+            tokenDigest: normalized.tokenDigest,
+        }))
+            .digest('hex'),
+    };
+}
+export function validateInvitationMutation(input) {
+    validateExpectedRevision(input.expectedRevision);
+    return {
+        scope: validateScope(input.scope),
+        invitationId: validateScalar('invitation id', input.invitationId, 128),
+        expectedRevision: input.expectedRevision,
+        actorSubject: validateScalar('actor subject', input.actorSubject, 256),
+    };
+}
+export function validateInvitationClaim(input) {
+    return {
+        tokenDigest: validateDigest('invitation token digest', input.tokenDigest),
+        subject: validateScalar('identity subject', input.subject, 256),
+        email: validateEmail(input.email),
+    };
+}
+export function invitationStatus(invitation, now) {
+    if (invitation.acceptedAt !== undefined)
+        return 'accepted';
+    if (invitation.revokedAt !== undefined)
+        return 'revoked';
+    if (Date.parse(invitation.expiresAt) <= now.getTime())
+        return 'expired';
+    return 'pending';
+}
+export function cloneInvitation(invitation) {
+    return { ...invitation, scope: { ...invitation.scope } };
+}
+function validateDigest(name, value) {
+    const digest = validateScalar(name, value, 64);
+    if (!/^[a-f0-9]{64}$/.test(digest))
+        throw new Error(`${name} is invalid`);
+    return digest;
+}
+//# sourceMappingURL=invitations.js.map