@noodleseed/one 0.174.0 → 0.175.1

package/node_modules/@noodle-borg/service/dist/application-activity.js

@@ -4,6 +4,7 @@ import { ApplicationActivityListResponseSchema, ApplicationActivityPreviewRespon
 import { resolveApplicationRuntimeTarget } from './application-runtime-target.js';
 import { createOperationCoordinationPort, } from './operation-coordination.js';
 import { createOperationEvidencePort, } from './operation-evidence.js';
+const runLocal = (operation) => operation();
 const POLICY_MESSAGES = {
     activity_conflict: 'History settings or plan changed. Reload before continuing.',
     activity_invalid: 'Activity paging or retention is invalid for the current policy.',
@@ -25,8 +26,8 @@ export class ApplicationActivity {
     constructor(options) {
         this.options = options;
     }
-    /** Shared strict operator projection. Callers authorize the live installation grant before and after it. */
-    async project(scope, action, input) {
+    /** Callers authorize before/after projection and fence each local effect with current authority. */
+    async project(scope, action, input, local = runLocal) {
         const coordinating = action.startsWith('coordination');
         const invalid = () => new ActivityPolicyError(coordinating ? 'coordination_invalid' : 'activity_invalid');
         const allowed = action === 'coordination-list'
@@ -51,16 +52,17 @@ export class ApplicationActivity {
             const store = this.options.coordination;
             if (!store)
                 throw new ActivityPolicyError('coordination_unavailable');
-            let resolved;
-            try {
-                resolved = await store.resolve(scope, parsed.data.resource, parsed.data.token, {
-                    reviewer: input.reviewer,
-                    reason: parsed.data.reason,
-                });
-            }
-            catch {
-                throw new ActivityPolicyError('coordination_unavailable');
-            }
+            const resolved = await local(async () => {
+                try {
+                    return await store.resolve(scope, parsed.data.resource, parsed.data.token, {
+                        reviewer: input.reviewer,
+                        reason: parsed.data.reason,
+                    });
+                }
+                catch {
+                    throw new ActivityPolicyError('coordination_unavailable');
+                }
+            });
             if (!resolved)
                 throw new ActivityPolicyError('coordination_conflict');
             return mutation(OperationCoordinationResolveResponseSchema.parse({ ok: true, data: { resolved: true } }), 'config.operation.coordination_resolved', { resource: parsed.data.resource });
@@ -77,52 +79,56 @@ export class ApplicationActivity {
             const store = this.options.coordination;
             if (!store)
                 throw new ActivityPolicyError('coordination_unavailable');
-            try {
-                const limit = parsed.data.limit ?? 100;
-                const records = await store.list(scope, limit, parsed.data.beforeResource);
-                if (records.some((record) => canonicalJson(record.scope) !== canonicalJson(scope)))
-                    throw new Error('Coordination scope mismatch');
-                return {
-                    response: OperationCoordinationListResponseSchema.parse({
-                        ok: true,
-                        data: {
-                            records: records.map(({ resource, token, reference, operationDigest, startedAt, deadline, state }) => ({
-                                resource,
-                                token,
-                                reference,
-                                operationDigest,
-                                startedAt: new Date(startedAt).toISOString(),
-                                deadline: new Date(deadline).toISOString(),
-                                state,
-                            })),
-                            ...(records.length === limit ? { nextBeforeResource: records.at(-1)?.resource } : {}),
-                        },
-                    }),
-                };
-            }
-            catch {
-                throw new ActivityPolicyError('coordination_unavailable');
-            }
+            return local(async () => {
+                try {
+                    const limit = parsed.data.limit ?? 100;
+                    const records = await store.list(scope, limit, parsed.data.beforeResource);
+                    if (records.some((record) => canonicalJson(record.scope) !== canonicalJson(scope)))
+                        throw new Error('Coordination scope mismatch');
+                    return {
+                        response: OperationCoordinationListResponseSchema.parse({
+                            ok: true,
+                            data: {
+                                records: records.map(({ resource, token, reference, operationDigest, startedAt, deadline, state, }) => ({
+                                    resource,
+                                    token,
+                                    reference,
+                                    operationDigest,
+                                    startedAt: new Date(startedAt).toISOString(),
+                                    deadline: new Date(deadline).toISOString(),
+                                    state,
+                                })),
+                                ...(records.length === limit
+                                    ? { nextBeforeResource: records.at(-1)?.resource }
+                                    : {}),
+                            },
+                        }),
+                    };
+                }
+                catch {
+                    throw new ActivityPolicyError('coordination_unavailable');
+                }
+            });
         }
         if (action === 'save-settings') {
             const parsed = ApplicationActivitySettingsSaveRequestSchema.safeParse(input.body);
             if (!parsed.success)
                 throw invalid();
-            const data = await this.save(scope, parsed.data);
+            const data = await this.save(scope, parsed.data, local);
             return mutation(ApplicationActivitySettingsResponseSchema.parse({ ok: true, data }), 'config.activity.retention_changed', { retentionDays: data.retentionDays });
         }
         if (action === 'preview')
             return {
                 response: ApplicationActivityPreviewResponseSchema.parse({
                     ok: true,
-                    data: await this.preview(scope),
+                    data: await this.preview(scope, local),
                 }),
             };
         if (action === 'settings')
             return {
                 response: ApplicationActivitySettingsResponseSchema.parse({
                     ok: true,
-                    data: (await this.settings(scope, input.canEdit)).projection,
+                    data: (await this.settings(scope, input.canEdit, local)).projection,
                 }),
             };
         const limit = parameters.has('limit') ? Number(parameters.get('limit')) : 50;
@@ -139,11 +145,11 @@ export class ApplicationActivity {
                     purpose: action,
                     limit,
                     ...(cursor === undefined ? {} : { cursor }),
-                }),
+                }, local),
             }),
         };
     }
-    async settings(scope, canEdit) {
+    async settings(scope, canEdit, local = runLocal) {
         const allowance = await this.options.allowance(scope.org);
         if (!allowance ||
             !validDays(allowance.maximumDays) ||
@@ -151,11 +157,14 @@ export class ApplicationActivity {
             allowance.defaultDays > allowance.maximumDays ||
             !allowance.revision)
             throw new ActivityPolicyError('activity_unavailable');
-        let setting = await this.options.store.readRetention(scope);
-        if (!setting) {
-            await this.options.store.setRetention(scope, allowance.defaultDays, undefined);
-            setting = await this.options.store.readRetention(scope);
-        }
+        const setting = await local(async () => {
+            let value = await this.options.store.readRetention(scope);
+            if (!value) {
+                await this.options.store.setRetention(scope, allowance.defaultDays, undefined);
+                value = await this.options.store.readRetention(scope);
+            }
+            return value;
+        });
         if (!setting || !validDays(setting.days))
             throw new ActivityPolicyError('activity_unavailable');
         return {
@@ -169,28 +178,28 @@ export class ApplicationActivity {
             },
         };
     }
-    async save(scope, input) {
-        const current = await this.settings(scope, true);
+    async save(scope, input, local = runLocal) {
+        const current = await this.settings(scope, true, local);
         if (current.projection.revision !== input.expectedRevision)
             throw new ActivityPolicyError('activity_conflict');
         if (!validDays(input.retentionDays) || input.retentionDays > current.allowance.maximumDays)
             throw new ActivityPolicyError('activity_invalid');
-        if (!(await this.options.store.setRetention(scope, input.retentionDays, current.setting.revision)))
+        if (!(await local(() => this.options.store.setRetention(scope, input.retentionDays, current.setting.revision))))
             throw new ActivityPolicyError('activity_conflict');
-        return (await this.settings(scope, true)).projection;
+        return (await this.settings(scope, true, local)).projection;
     }
-    async page(scope, input) {
+    async page(scope, input, local = runLocal) {
         if (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100)
             throw new ActivityPolicyError('activity_invalid');
-        const policy = (await this.settings(scope, false)).projection;
+        const policy = (await this.settings(scope, false, local)).projection;
         const binding = this.hash({
             purpose: `activity-${input.purpose}-v1`,
             scope,
             revision: policy.revision,
             limit: input.limit,
         });
-        const records = await this.options.store.list(scope, this.options.now?.() ?? Date.now(), policy.maximumDays, input.limit + 1, decodeActivityCursor(input.cursor, binding));
-        if ((await this.settings(scope, false)).projection.revision !== policy.revision)
+        const records = await local(() => this.options.store.list(scope, this.options.now?.() ?? Date.now(), policy.retentionDays, input.limit + 1, decodeActivityCursor(input.cursor, binding)));
+        if ((await this.settings(scope, false, local)).projection.revision !== policy.revision)
             throw new ActivityPolicyError('activity_conflict');
         const page = records.slice(0, input.limit);
         const last = page.at(-1);
@@ -208,7 +217,7 @@ export class ApplicationActivity {
                     : { completedAt: new Date(completedAt).toISOString() }),
                 ...(reference === undefined ? {} : { reference }),
             })),
-            historyDays: policy.maximumDays,
+            historyDays: policy.retentionDays,
             ...(records.length > page.length && last
                 ? {
                     nextCursor: Buffer.from(JSON.stringify({ binding, startedAt: last.startedAt, id: last.id })).toString('base64url'),
@@ -224,7 +233,7 @@ export class ApplicationActivity {
     revision(scope, setting, allowance) {
         return sha256Canonical({ scope, setting, allowance });
     }
-    async preview(scope) {
+    async preview(scope, local = runLocal) {
         const unavailable = () => {
             throw new ActivityPolicyError('activity_unavailable');
         };
@@ -254,16 +263,28 @@ export class ApplicationActivity {
                 !validDays(maximumDays) ||
                 maximumDays >= allowance.maximumDays))
             throw new ActivityPolicyError('activity_unavailable');
-        const counts = await this.options.store
+        // A comparison is read-only: use the verified default without initializing a setting.
+        const readSetting = () => local(() => this.options.store.readRetention(scope).catch(unavailable));
+        const setting = await readSetting();
+        if (setting && !validDays(setting.days))
+            throw new ActivityPolicyError('activity_unavailable');
+        const selectedDays = setting?.days ?? allowance.defaultDays;
+        const counts = await local(() => this.options.store
             .preview(scope, {
             asOf,
             paidPeriodEnd,
-            currentMaximumDays: allowance.maximumDays,
-            scenarios: preview.scenarios,
+            currentMaximumDays: Math.min(selectedDays, allowance.maximumDays),
+            scenarios: preview.scenarios.map(({ id, maximumDays }) => ({
+                id,
+                maximumDays: Math.min(selectedDays, maximumDays),
+            })),
         })
-            .catch(unavailable);
+            .catch(unavailable));
         const current = await resolve();
-        if (current?.revision !== allowance.revision)
+        const currentSetting = await readSetting();
+        if (current?.revision !== allowance.revision ||
+            currentSetting?.revision !== setting?.revision ||
+            currentSetting?.days !== setting?.days)
             throw new ActivityPolicyError('activity_conflict');
         return {
             state: 'available',
@@ -274,6 +295,7 @@ export class ApplicationActivity {
                 purpose: 'activity-preview-v1',
                 scope,
                 allowance: allowance.revision,
+                setting: setting ?? null,
                 preview,
                 counts,
             }),

package/node_modules/@noodle-borg/service/dist/application-drafts/contracts.js

@@ -8,4 +8,13 @@ export class ApplicationDraftError extends Error {
         this.name = 'ApplicationDraftError';
     }
 }
+/** Service-facing availability only; source errors remain bounded validation reports. */
+export class DraftValidationUnavailableError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'DraftValidationUnavailableError';
+    }
+}
 //# sourceMappingURL=contracts.js.map

package/node_modules/@noodle-borg/service/dist/application-drafts/paths.js

@@ -1,7 +1,7 @@
 import { validateSlug } from '@noodle-borg/control-plane/portable';
 import { ApplicationDraftIdSchema } from '@noodle-borg/wire-contracts';
 export function parseApplicationDraftPath(path) {
-    const match = /^\/v1\/orgs\/([a-z0-9-]+)\/apps\/([a-z0-9-]+)\/drafts(?:\/([a-f0-9-]+)(?:\/(undo|history|diff))?)?$/.exec(path);
+    const match = /^\/v1\/orgs\/([a-z0-9-]+)\/apps\/([a-z0-9-]+)\/drafts(?:\/([a-f0-9-]+)(?:\/(undo|history|diff|validate))?)?$/.exec(path);
     const org = match?.[1], app = match?.[2], id = match?.[3], action = match?.[4];
     if (!org || !app || (id !== undefined && !ApplicationDraftIdSchema.safeParse(id).success))
         return undefined;
@@ -15,7 +15,7 @@ export function parseApplicationDraftPath(path) {
     return { org, app, ...(id ? { id } : {}), ...(action ? { action } : {}) };
 }
 export function applicationDraftMethods(ref) {
-    return ref.action === 'undo'
+    return ref.action === 'undo' || ref.action === 'validate'
         ? ['POST']
         : ref.action
             ? ['GET']

package/node_modules/@noodle-borg/service/dist/application-runtime-target.js

@@ -120,7 +120,7 @@ export function createApplicationServingRuntime(registry, providerOptions, contr
     const options = providerOptions;
     const businessInformationStore = options.businessInformationStore;
     const businessOnboarding = options.businessOnboarding !== undefined && businessInformationStore
-        ? new BusinessOnboarding(options.businessOnboarding, controlPlane, businessInformationStore)
+        ? new BusinessOnboarding(options.businessOnboarding, controlPlane, businessInformationStore, options.businessAuthoring?.workspaces)
         : undefined;
     const activateInstallation = (input) => activateSolutionInstallation(input, {
         registry,

package/node_modules/@noodle-borg/service/dist/business-information/contracts.d.ts

@@ -1,8 +1,11 @@
 import type { ArtifactVariableDeclaration, ManagedCollectionControls } from '@noodle-borg/compiler';
-import type { ManagedRecordQuery } from '@noodle-borg/wire-contracts';
+import type { EligibleBusinessAssignee, ManagedRecordQuery } from '@noodle-borg/wire-contracts';
+import type { BusinessWorkspaceAccess } from '../business-workspaces/contracts.js';
 import type { BusinessNoticeStore } from './business-notice.js';
 import type { BusinessPageStore } from './business-page.js';
+import type { NativeRecordLifecycleStore } from './native-record-lifecycle.js';
 import type { BusinessPrincipalProvider } from './principal-authority.js';
+import type { BusinessStaffAuthority } from './staff-authority.js';
 export type JsonPrimitive = string | number | boolean | null;
 export type JsonValue = JsonPrimitive | JsonObject | readonly JsonValue[];
 export interface JsonObject {
@@ -86,6 +89,8 @@ export interface SolutionInstallation {
     readonly managedCollections: readonly string[];
     readonly definition: SolutionDefinitionSnapshot;
     readonly retentionDays: ManagedRetentionDays;
+    /** Absent on legacy installations until reviewed lifecycle migration. */
+    readonly nativeRecordLifecycle?: 'explicit_erasure';
     /** Public native-record intake exposure; authorized records remain operable while paused. */
     readonly intakeActive: boolean;
     /** Internal binding to the authoritative app incarnation; never a Portal configuration value. */
@@ -97,6 +102,7 @@ export interface SolutionInstallation {
     readonly updatedBySubject: string;
 }
 export interface BusinessGrant {
+    readonly authorityVersion?: never;
     readonly scope: InstallationScope;
     readonly subject: string;
     readonly email?: string;
@@ -108,6 +114,11 @@ export interface BusinessGrant {
     readonly updatedBySubject: string;
     readonly revokedAt?: string;
 }
+/** Request-scoped access projection. Versioned access is never persisted as an installation grant. */
+export type BusinessStaffGrant = BusinessGrant | (BusinessWorkspaceAccess & {
+    readonly scope: InstallationScope;
+    readonly revokedAt?: never;
+});
 export interface BusinessInvitation {
     readonly scope: InstallationScope;
     readonly invitationId: string;
@@ -127,7 +138,8 @@ export interface BusinessInvitation {
     readonly revokedBySubject?: string;
 }
 export interface ManagedRequestOrigin {
-    readonly kind: 'embedded' | 'mcp' | 'portal' | 'api' | 'import';
+    /** `messaging` is trusted channel provenance (ADR 0240); its reference names the channel, e.g. `whatsapp`. */
+    readonly kind: 'embedded' | 'mcp' | 'portal' | 'api' | 'import' | 'messaging';
     readonly reference?: string;
 }
 export interface ManagedRequestNote {
@@ -157,7 +169,7 @@ export interface ManagedRequestRecord {
     readonly assigneeSubject?: string;
     readonly origin: ManagedRequestOrigin;
     readonly revision: number;
-    readonly retentionExpiresAt: string;
+    readonly retentionExpiresAt: string | null;
     readonly createdAt: string;
     readonly createdBySubject: string;
     readonly updatedAt: string;
@@ -435,7 +447,9 @@ export interface ManagedRequestStore {
 }
 export interface BusinessInformationStore extends SolutionInstallationStore, BusinessNoticeStore, BusinessGrantStore, ManagedRequestStore {
     readonly pages: BusinessPageStore;
+    readonly nativeLifecycle: NativeRecordLifecycleStore;
+    readonly staff: BusinessStaffAuthority;
     configurePrincipalAuthority(provider: BusinessPrincipalProvider | undefined): void;
-    listEligibleAssignees(scope: InstallationScope): Promise<readonly BusinessGrant[]>;
+    listEligibleAssignees(scope: InstallationScope, actor: string): Promise<readonly EligibleBusinessAssignee[]>;
 }
 //# sourceMappingURL=contracts.d.ts.map

package/node_modules/@noodle-borg/service/dist/business-information/in-memory-business-pages.js

@@ -21,17 +21,15 @@ export class InMemoryBusinessPages {
         const scope = validateScope(input.scope);
         const actorSubject = validateScalar('page actor', input.actorSubject, 500);
         const key = scopeKey(scope);
-        return this.locks.run(`grants:${key}`, () => this.locks.run(`intake:${key}`, async () => {
-            const grant = await this.business.getGrant(scope, actorSubject);
+        return this.business.staff.run(scope, actorSubject, 'installation:administer', () => this.locks.run(`grants:${key}`, () => this.locks.run(`intake:${key}`, async () => {
             if (!(await this.business.getInstallation(scope)) ||
-                grant?.role !== 'administrator' ||
-                grant.revokedAt ||
+                !(await this.business.staff.allows(scope, actorSubject, 'installation:administer')) ||
                 !(await this.principals.allows(actorSubject)))
                 throw new BusinessPageError('business_page_forbidden');
             const next = await nextBusinessPage(this.#records.get(key), { ...input, scope, actorSubject }, this.now().toISOString(), await this.business.getBusinessNotice(scope), assertReady);
             this.#records.set(key, structuredClone(next));
             return next;
-        }));
+        })), () => new BusinessPageError('business_page_forbidden'));
     }
 }
 //# sourceMappingURL=in-memory-business-pages.js.map

package/node_modules/@noodle-borg/service/dist/business-information/in-memory-installation-lifecycle.js

@@ -10,10 +10,12 @@ export class InMemoryInstallationLifecycle {
     #managedDefinition;
     #application;
     #notices = new Map();
-    #getGrant;
+    #staff;
+    #principals;
     constructor(input) {
         this.#installations = input.installations;
-        this.#getGrant = input.getGrant;
+        this.#staff = input.staff;
+        this.#principals = input.principals;
         this.#withLock = input.withLock;
         this.#now = input.now;
         this.#managedDefinition = input.managedDefinition;
@@ -35,9 +37,9 @@ export class InMemoryInstallationLifecycle {
     async setBusinessNotice(input) {
         const scope = validateScope(input.scope);
         const notice = validatedNotice(input);
-        return this.#withLock(`grants:${scopeKey(scope)}`, async () => {
-            const grant = this.#getGrant(scope, input.actorSubject);
-            if (grant?.role !== 'administrator' || grant.revokedAt)
+        return this.#staff.run(scope, input.actorSubject, 'installation:administer', () => this.#withLock(`grants:${scopeKey(scope)}`, async () => {
+            if (!(await this.#staff.allows(scope, input.actorSubject, 'installation:administer')) ||
+                !(await this.#principals.allows(input.actorSubject)))
                 throw new BusinessNoticeError('business_notice_forbidden');
             const key = scopeKey(scope);
             const current = this.#notices.get(key);
@@ -51,7 +53,7 @@ export class InMemoryInstallationLifecycle {
             };
             this.#notices.set(key, record);
             return structuredClone(record);
-        });
+        }), () => new BusinessNoticeError('business_notice_forbidden'));
     }
     configureApplicationLifecycle(resolve) {
         this.#application = resolve;

package/node_modules/@noodle-borg/service/dist/business-information/in-memory-native-lifecycle.js

@@ -0,0 +1,80 @@
+import { checkLifecycleReview, lifecyclePreview, NativeLifecycleError, sameLifecycleReview, } from './native-record-lifecycle.js';
+import { nativeCustodyBytes } from './native-storage-budget.js';
+import { scopeKey } from './pagination.js';
+import { validateScalar, validateScope } from './validation.js';
+/** Local/test only. No await between inventory verification and the synchronous atomic commit. */
+export class InMemoryNativeRecordLifecycle {
+    options;
+    #receipts = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    preview(scope, actor) {
+        return this.run(scope, actor, (installation) => lifecyclePreview(installation, this.inventory(scope), this.options.now().toISOString()));
+    }
+    migrate(input) {
+        return this.run(input.scope, input.actor, (installation) => {
+            const key = scopeKey(input.scope);
+            const receipt = this.#receipts.get(key);
+            if (receipt &&
+                sameLifecycleReview(receipt.preview, input.preview) &&
+                receipt.actor === input.actor)
+                return { ...receipt.result, replayed: true };
+            const now = this.options.now().toISOString();
+            checkLifecycleReview(installation, this.inventory(input.scope), input.preview, now);
+            const updates = [];
+            let beforeBytes = 0, afterBytes = 0;
+            for (const [recordKey, record] of this.options.records) {
+                if (scopeKey(record.scope) !== key ||
+                    record.deletedAt ||
+                    record.retentionExpiresAt === null ||
+                    record.retentionExpiresAt <= now)
+                    continue;
+                const next = { ...record, retentionExpiresAt: null };
+                beforeBytes += nativeCustodyBytes(record);
+                afterBytes += nativeCustodyBytes(next);
+                updates.push([recordKey, next]);
+            }
+            const result = {
+                policy: 'explicit_erasure',
+                installationRevision: installation.revision + 1,
+                recordsPreserved: updates.length,
+                replayed: false,
+            };
+            this.options.budget.replace(key, beforeBytes, afterBytes);
+            for (const [id, record] of updates)
+                this.options.records.set(id, record);
+            this.options.installations.set(key, {
+                ...installation,
+                nativeRecordLifecycle: 'explicit_erasure',
+                revision: result.installationRevision,
+                updatedAt: now,
+                updatedBySubject: input.actor,
+            });
+            this.#receipts.set(key, {
+                preview: structuredClone(input.preview),
+                actor: input.actor,
+                result,
+            });
+            return result;
+        });
+    }
+    inventory(scope) {
+        return [...this.options.records.values()].filter((r) => scopeKey(r.scope) === scopeKey(scope) && !r.deletedAt);
+    }
+    run(input, actor, work) {
+        const scope = validateScope(input);
+        validateScalar('actor', actor, 256);
+        const { staff, locks, principals } = this.options;
+        return staff.run(scope, actor, 'installation:administer', () => locks.run(`grants:${scopeKey(scope)}`, () => locks.run(`intake:${scopeKey(scope)}`, async () => {
+            if (!(await staff.allows(scope, actor, 'installation:administer')) ||
+                !(await principals.allows(actor)))
+                throw new NativeLifecycleError('lifecycle_denied');
+            const installation = this.options.installations.get(scopeKey(scope));
+            if (!installation)
+                throw new NativeLifecycleError('lifecycle_unavailable');
+            return work(installation);
+        })), () => new NativeLifecycleError('lifecycle_denied'));
+    }
+}
+//# sourceMappingURL=in-memory-native-lifecycle.js.map

package/node_modules/@noodle-borg/service/dist/business-information/in-memory-store.js

@@ -5,17 +5,22 @@ import { InMemoryBusinessPages } from './in-memory-business-pages.js';
 import { InMemoryInstallationLifecycle, } from './in-memory-installation-lifecycle.js';
 import { InMemoryBusinessInvitations } from './in-memory-invitations.js';
 import { BusinessMemoryLocks } from './in-memory-locks.js';
+import { InMemoryNativeRecordLifecycle } from './in-memory-native-lifecycle.js';
 import { InstallationCapacityError, MAX_RETAINED_INSTALLATIONS_PER_ORG, } from './installation-capacity.js';
 import { migrateLegacyRequestRecord } from './legacy-request-migration.js';
-import { activityFromRecord, applyRequestOperation, cloneGrant, cloneRecord, deletedRecord, effectiveInstallation, idempotencyDigest, initialRecord, installationFingerprint, managedInstallationIntentMatches, normalizeInstallationInput, permissionsForBusinessRole, requestFingerprint, validateCollectionEnabled, validateExpectedRevision, validateStoredRecord, } from './model.js';
+import { eraseNativeMemoryRecord, expireNativeMemoryRecord } from './memory-native-retention.js';
+import { activityFromRecord, applyRequestOperation, cloneGrant, cloneRecord, effectiveInstallation, idempotencyDigest, initialRecord, installationFingerprint, managedInstallationIntentMatches, normalizeInstallationInput, permissionsForBusinessRole, requestFingerprint, validateCollectionEnabled, validateExpectedRevision, validateStoredRecord, } from './model.js';
 import { matchesNativeQueryMetadata, planNativeQuery, runNativeQuery } from './native-query.js';
 import { commitNativeMemoryRecord, NativeStorageBudget } from './native-storage-budget.js';
 import { afterCursor, compareRecords, decodeCursor, grantKey, installationIdKey, page, recordKey, scopeKey, } from './pagination.js';
 import { BusinessPrincipalAuthority, } from './principal-authority.js';
+import { BusinessStaffAuthority } from './staff-authority.js';
 import { boundedExportPageSize, boundedPageSize, validateEmail, validateScalar, validateScope, } from './validation.js';
 /** Process-local development/test adapter. Hosted services must use the PostgreSQL adapter. */
 export class InMemoryBusinessInformationStore {
+    staff = new BusinessStaffAuthority((scope, subject) => this.getGrant(scope, subject));
     pages;
+    nativeLifecycle;
     #installations = new Map();
     #installationIds = new Map();
     #publicIds = new Map();
@@ -39,9 +44,19 @@ export class InMemoryBusinessInformationStore {
         this.#publicId = options.publicId ?? (() => `sol_${randomUUID().replaceAll('-', '')}`);
         this.#managedDefinition = options.managedDefinition;
         this.pages = new InMemoryBusinessPages(this, this.#locks, this.#principals, this.#now);
+        this.nativeLifecycle = new InMemoryNativeRecordLifecycle({
+            installations: this.#installations,
+            records: this.#records,
+            locks: this.#locks,
+            staff: this.staff,
+            principals: this.#principals,
+            budget: this.#custody,
+            now: this.#now,
+        });
         this.#lifecycle = new InMemoryInstallationLifecycle({
             installations: this.#installations,
-            getGrant: (scope, subject) => this.#grants.get(grantKey(scope, subject)),
+            staff: this.staff,
+            principals: this.#principals,
             withLock: (key, operation) => this.#locks.run(key, operation),
             now: this.#now,
             managedDefinition: this.#managedDefinition,
@@ -58,8 +73,8 @@ export class InMemoryBusinessInformationStore {
     configurePrincipalAuthority(provider) {
         this.#principals.configure(provider);
     }
-    async listEligibleAssignees(scope) {
-        return this.#principals.eligible(await this.listGrants(scope));
+    async listEligibleAssignees(scope, actor) {
+        return this.staff.eligibleAssignees(scope, actor, async () => this.#principals.eligible(await this.listGrants(scope)));
     }
     getBusinessNotice(scope) {
         return this.#lifecycle.getBusinessNotice(scope);
@@ -400,11 +415,8 @@ export class InMemoryBusinessInformationStore {
                 return { ok: false, reason: 'invalid_transition', currentRevision: current.revision };
             }
             if (input.operation.kind === 'assign' && input.operation.assigneeSubject !== undefined) {
-                const assignee = this.#grants.get(grantKey(input.scope, input.operation.assigneeSubject));
-                if (assignee === undefined ||
-                    assignee.revokedAt !== undefined ||
-                    assignee.role === 'viewer' ||
-                    !(await this.#principals.allows(assignee.subject))) {
+                if (!(await this.staff.allows(input.scope, input.operation.assigneeSubject, 'records:assign')) ||
+                    !(await this.#principals.allows(input.operation.assigneeSubject))) {
                     return { ok: false, reason: 'invalid_assignee', currentRevision: current.revision };
                 }
             }
@@ -495,6 +507,7 @@ export class InMemoryBusinessInformationStore {
         const candidates = [...this.#records.entries()]
             .filter(([key, record]) => (scope === undefined || key.startsWith(`${scope}\0`)) &&
             record.deletedAt === undefined &&
+            record.retentionExpiresAt !== null &&
             record.retentionExpiresAt <= now.toISOString())
             .slice(0, limit);
         let purged = 0;
@@ -510,34 +523,17 @@ export class InMemoryBusinessInformationStore {
         const now = this.#now().toISOString();
         return [...this.#records.entries()]
             .filter(([key, record]) => key.startsWith(prefix) &&
-            (record.deletedAt !== undefined || record.retentionExpiresAt > now))
+            (record.deletedAt !== undefined ||
+                record.retentionExpiresAt === null ||
+                record.retentionExpiresAt > now))
             .map(([, record]) => record)
             .sort(compareRecords);
     }
     #expireRecordIfNeeded(key, now) {
-        const current = this.#records.get(key);
-        if (current === undefined ||
-            current.deletedAt !== undefined ||
-            current.retentionExpiresAt > now.toISOString()) {
-            return current;
-        }
-        const erased = deletedRecord(current, 'system:retention', now, 'retention_expired');
-        this.#commitRecord(key, erased, 'retention_expired');
-        return erased;
+        return expireNativeMemoryRecord({ records: this.#records, commit: this.#commitRecord.bind(this) }, key, now);
     }
     #eraseRecord(key, expectedRevision, actorSubject, reason) {
-        const current = reason === 'retention_expired'
-            ? this.#records.get(key)
-            : this.#expireRecordIfNeeded(key, this.#now());
-        if (current === undefined || current.deletedAt !== undefined) {
-            return { ok: false, reason: 'not_found', currentRevision: current?.revision ?? 0 };
-        }
-        if (current.revision !== expectedRevision) {
-            return { ok: false, reason: 'conflict', currentRevision: current.revision };
-        }
-        const erased = deletedRecord(current, actorSubject, this.#now(), reason);
-        this.#commitRecord(key, erased, reason === 'customer_request' ? 'deleted' : 'retention_expired');
-        return { ok: true, record: cloneRecord(erased) };
+        return eraseNativeMemoryRecord({ records: this.#records, commit: this.#commitRecord.bind(this) }, key, expectedRevision, actorSubject, reason, this.#now());
     }
     #commitRecord(key, record, kind) {
         commitNativeMemoryRecord(this.#records, this.#activities, this.#custody, key, record, activityFromRecord(record, kind));