@noodleseed/one 0.38.0 → 0.39.0

package/node_modules/@noodle-borg/service/dist/billing/postgres-migration.js

@@ -0,0 +1,265 @@
+import { randomUUID } from 'node:crypto';
+import { insertAuditEvent } from '@noodle-borg/module-audit';
+import { commercialPlanPolicyId } from '../commercial-plans.js';
+import { legacyBillingMigrationMappingChecksum, previewLegacyBillingMigration, } from './migration.js';
+import { LegacyBillingMigrationConflictError, legacyBillingMigrationPlanEvidenceChecksum, legacyBillingMigrationRequestFingerprint, legacyBillingMigrationSuccessAudit, normalizeBillingMigrationServiceUrl, parseLegacyBillingMigrationApplyRequest, } from './migration-apply.js';
+import { GOOGLE_CONTROL_PLANE_ISSUER, normalizeBillingEmail, normalizeBillingIdentity, } from './model.js';
+import { ensureDefaultBillingAccountForLegacyMigrationTx, ensureOrgBillingLinkTx, getActiveEntitlementSnapshotQuery, getBillingAccountQuery, getDefaultBillingAccountQuery, getOrgBillingLinkQuery, } from './postgres.js';
+import { findPreparationById, findPreparationByIdempotencyKey, findPreparationByKind, LEGACY_BILLING_MIGRATION_KIND, preparationResult, previewOrganizationSlugs, transactionalLegacyMigrationControlPlane, transactionalLegacyMigrationInventory, } from './postgres-migration-support.js';
+const TABLE_LOCKS = [
+    'orgs',
+    'org_members',
+    'apps',
+    'environments',
+    'deploy_records',
+    'policy_assignments',
+    'billing_plan_versions',
+    'billing_accounts',
+    'billing_account_defaults',
+    'billing_account_members',
+    'billing_entitlement_snapshots',
+    'billing_account_active_snapshots',
+    'org_billing_home_accounts',
+    'org_billing_links',
+    'billing_legacy_migration_preparations',
+    'billing_legacy_migration_accounts',
+    'billing_legacy_migration_organizations',
+    'billing_legacy_migration_apps',
+    'billing_legacy_migration_plan_evidence',
+].join(', ');
+export async function prepareLegacyBillingMigrationRow(pool, input, now) {
+    const request = parseLegacyBillingMigrationApplyRequest(input.request);
+    const service = normalizeBillingMigrationServiceUrl(input.service);
+    if (request.legacyPlanEvidence.service !== service) {
+        throw new LegacyBillingMigrationConflictError('legacy_plan_evidence_drift', 'legacy plan evidence targets a different service');
+    }
+    const actorIdentity = normalizeBillingIdentity({
+        identityIssuer: GOOGLE_CONTROL_PLANE_ISSUER,
+        subject: input.actor.subject,
+    });
+    const actor = {
+        subject: actorIdentity.subject,
+        email: normalizeBillingEmail(input.actor.email),
+    };
+    const mappingChecksum = legacyBillingMigrationMappingChecksum(request.mappings);
+    const planEvidenceChecksum = legacyBillingMigrationPlanEvidenceChecksum(request.legacyPlanEvidence);
+    const requestFingerprint = legacyBillingMigrationRequestFingerprint(request, actor, service);
+    const client = await pool.connect();
+    try {
+        // READ COMMITTED lets a waiter observe the predecessor's committed replay row after the
+        // transaction-scoped migration lock releases. EXCLUSIVE table locks freeze every source table
+        // before preview revalidation and wait behind in-flight SELECT ... FOR UPDATE writers. Migration
+        // intentionally takes no default-owner advisory locks: signup writes org tables before acquiring
+        // those locks, so mixing both lock orders here would create an inversion.
+        await client.query('BEGIN ISOLATION LEVEL READ COMMITTED');
+        await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+            'billing-legacy-shadow-prepare:v1',
+        ]);
+        const keyed = await findPreparationByIdempotencyKey(client, request.idempotencyKey);
+        if (keyed !== undefined) {
+            if (keyed.request_fingerprint !== requestFingerprint) {
+                throw new LegacyBillingMigrationConflictError('idempotency_key_conflict', 'idempotency key was already used by a different request or actor');
+            }
+            const replay = await preparationResult(client, keyed, true);
+            await insertAuditEvent(client, legacyBillingMigrationSuccessAudit(replay, actor), { now });
+            await client.query('COMMIT');
+            return replay;
+        }
+        const existing = await findPreparationByKind(client);
+        if (existing !== undefined) {
+            throw new LegacyBillingMigrationConflictError('migration_already_prepared', 'legacy billing migration was already prepared under a different idempotency key');
+        }
+        await client.query(`LOCK TABLE ${TABLE_LOCKS} IN EXCLUSIVE MODE`);
+        const preview = await previewLegacyBillingMigration(transactionalLegacyMigrationControlPlane(client), { schemaVersion: 1, mappings: request.mappings }, transactionalLegacyMigrationInventory(client));
+        if (!preview.ready) {
+            throw new LegacyBillingMigrationConflictError('preview_not_ready', 'legacy billing migration preview is no longer ready');
+        }
+        if (preview.previewChecksum !== request.expectedPreviewChecksum) {
+            throw new LegacyBillingMigrationConflictError('preview_checksum_mismatch', 'approved preview no longer matches current state');
+        }
+        await validateDefaultFreePlanEvidence(client, request, previewOrganizationSlugs(preview));
+        const preparedAt = now();
+        const migrationId = `bm_${randomUUID()}`;
+        await client.query(`INSERT INTO billing_legacy_migration_preparations
+         (id, migration_kind, schema_version, mode, state, idempotency_key,
+          request_fingerprint, mapping_checksum, preview_checksum, plan_evidence_checksum,
+          prepared_at, prepared_by_subject, prepared_by_email, reason)
+       VALUES ($1, $2, 1, 'shadow', 'prepared', $3, $4, $5, $6, $7, $8, $9, $10, $11)`, [
+            migrationId,
+            LEGACY_BILLING_MIGRATION_KIND,
+            request.idempotencyKey,
+            requestFingerprint,
+            mappingChecksum,
+            preview.previewChecksum,
+            planEvidenceChecksum,
+            preparedAt,
+            actor.subject,
+            actor.email,
+            request.reason,
+        ]);
+        const mappingByOrg = new Map(request.mappings.map((mapping) => [mapping.org, mapping]));
+        const unlinkedByOrg = new Map(preview.organizations.map((org) => [org.org, org]));
+        for (const fundingSet of preview.fundingSets) {
+            let billingAccountId;
+            let accountDisposition;
+            if (fundingSet.destination.kind === 'existing') {
+                billingAccountId = fundingSet.destination.billingAccountId;
+                accountDisposition = 'existing';
+            }
+            else {
+                const destination = fundingSet.destination;
+                const owner = preview.organizations.find((org) => org.mappedOwnerSubject === destination.subject);
+                const email = owner?.ownerCandidates.find((candidate) => candidate.subject === destination.subject)?.email;
+                if (email === undefined) {
+                    throw new LegacyBillingMigrationConflictError('preview_not_ready', 'prepared funding destination no longer has a selected owner email');
+                }
+                const account = await ensureDefaultBillingAccountForLegacyMigrationTx(client, {
+                    identityIssuer: destination.identityIssuer,
+                    subject: destination.subject,
+                    email,
+                }, preparedAt);
+                billingAccountId = account.id;
+                accountDisposition = 'created';
+            }
+            for (const org of fundingSet.organizations) {
+                const mapping = mappingByOrg.get(org);
+                if (mapping === undefined) {
+                    throw new LegacyBillingMigrationConflictError('preview_not_ready', 'ready preview contains an organization without a mapping');
+                }
+                let link;
+                let disposition;
+                if (mapping.linkState === 'linked') {
+                    link = await getOrgBillingLinkQuery(client, org);
+                    disposition = 'preserved';
+                }
+                else {
+                    const previewOrg = unlinkedByOrg.get(org);
+                    const selected = previewOrg?.ownerCandidates.find((owner) => owner.subject === mapping.defaultBillingOwnerSubject);
+                    if (selected === undefined) {
+                        throw new LegacyBillingMigrationConflictError('preview_not_ready', 'mapped organization owner is no longer available');
+                    }
+                    link = await ensureOrgBillingLinkTx(client, {
+                        org,
+                        billingAccountId,
+                        homeFreeBillingAccountId: billingAccountId,
+                        homeOwner: {
+                            identityIssuer: GOOGLE_CONTROL_PLANE_ISSUER,
+                            subject: selected.subject,
+                        },
+                        linkedBy: actorIdentity,
+                        reason: request.reason,
+                    }, preparedAt);
+                    disposition = 'created';
+                }
+                if (link === undefined || link.billingAccountId !== billingAccountId) {
+                    throw new LegacyBillingMigrationConflictError('incomplete_billing_destination', 'organization billing link does not match its prepared funding destination');
+                }
+                await validateLinkedDefaultFreeTuple(client, link);
+                await client.query(`INSERT INTO billing_legacy_migration_organizations
+             (migration_id, org_slug, billing_account_id, link_disposition, link_version,
+              home_owner_identity_issuer, home_owner_subject)
+           VALUES ($1, $2, $3, $4, $5, $6, $7)`, [
+                    migrationId,
+                    org,
+                    billingAccountId,
+                    disposition,
+                    link.version,
+                    link.homeOwner.identityIssuer,
+                    link.homeOwner.subject,
+                ]);
+            }
+            const snapshot = await completeDefaultFreeSnapshot(client, billingAccountId);
+            const capacity = productionCapacity(snapshot.entitlements['apps.production.max']);
+            const grantCandidate = fundingSet.productionApps.length > capacity;
+            await client.query(`INSERT INTO billing_legacy_migration_accounts
+           (migration_id, billing_account_id, account_disposition, snapshot_id,
+            organization_count, production_app_count, production_capacity,
+            grant_candidate_at_preparation)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [
+                migrationId,
+                billingAccountId,
+                accountDisposition,
+                snapshot.id,
+                fundingSet.organizations.length,
+                fundingSet.productionApps.length,
+                capacity,
+                grantCandidate,
+            ]);
+            for (const app of fundingSet.productionApps) {
+                await client.query(`INSERT INTO billing_legacy_migration_apps
+             (migration_id, billing_account_id, org_slug, app_slug, app_created_at)
+           VALUES ($1, $2, $3, $4, $5)`, [migrationId, billingAccountId, app.org, app.app, app.createdAt]);
+            }
+        }
+        for (const projection of request.legacyPlanEvidence.projections) {
+            await client.query(`INSERT INTO billing_legacy_migration_plan_evidence
+           (migration_id, org_slug, source, plan_code, plan_state)
+         VALUES ($1, $2, 'default', 'free', 'active')`, [migrationId, projection.org]);
+        }
+        const stored = await findPreparationById(client, migrationId);
+        if (stored === undefined)
+            throw new Error('prepared billing migration record was not persisted');
+        const result = await preparationResult(client, stored, false);
+        await insertAuditEvent(client, legacyBillingMigrationSuccessAudit(result, actor), { now });
+        await client.query('COMMIT');
+        return result;
+    }
+    catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        const code = postgresErrorCode(error);
+        if (code === '40001' || code === '40P01') {
+            throw new LegacyBillingMigrationConflictError('serialization_conflict', 'billing migration state changed concurrently; retry the exact request');
+        }
+        throw error;
+    }
+    finally {
+        client.release();
+    }
+}
+async function validateDefaultFreePlanEvidence(client, request, authoritativeOrganizations) {
+    const evidenceOrganizations = request.legacyPlanEvidence.projections
+        .map((projection) => projection.org)
+        .sort();
+    if (JSON.stringify(evidenceOrganizations) !== JSON.stringify([...authoritativeOrganizations].sort())) {
+        throw new LegacyBillingMigrationConflictError('legacy_plan_evidence_drift', 'legacy plan evidence does not cover every authoritative organization exactly once');
+    }
+    const policyIds = evidenceOrganizations.map(commercialPlanPolicyId);
+    const { rows } = await client.query('SELECT id FROM policy_assignments WHERE active = true AND id = ANY($1::text[]) LIMIT 1', [policyIds]);
+    if (rows[0] !== undefined) {
+        throw new LegacyBillingMigrationConflictError('legacy_plan_evidence_drift', 'a legacy plan projection is no longer default Free and active');
+    }
+}
+async function validateLinkedDefaultFreeTuple(client, link) {
+    if (link === undefined ||
+        link.billingAccountId !== link.homeFreeBillingAccountId ||
+        link.fallbackBillingAccountId !== link.homeFreeBillingAccountId) {
+        throw new LegacyBillingMigrationConflictError('incomplete_billing_destination', 'default-Free migration requires the active, home, and fallback accounts to match');
+    }
+    const ownerDefault = await getDefaultBillingAccountQuery(client, link.homeOwner, true);
+    const { rows } = await client.query(`SELECT role FROM billing_account_members
+     WHERE billing_account_id = $1 AND identity_issuer = $2 AND subject = $3`, [link.billingAccountId, link.homeOwner.identityIssuer, link.homeOwner.subject]);
+    if (ownerDefault?.id !== link.billingAccountId || rows[0]?.role !== 'owner') {
+        throw new LegacyBillingMigrationConflictError('incomplete_billing_destination', 'billing destination does not have a complete default owner tuple');
+    }
+}
+async function completeDefaultFreeSnapshot(client, billingAccountId) {
+    const account = await getBillingAccountQuery(client, billingAccountId);
+    const snapshot = await getActiveEntitlementSnapshotQuery(client, billingAccountId);
+    if (account?.state !== 'active' || snapshot?.planCode !== 'free') {
+        throw new LegacyBillingMigrationConflictError('incomplete_billing_destination', 'billing destination must have an active verified Free snapshot');
+    }
+    productionCapacity(snapshot.entitlements['apps.production.max']);
+    return snapshot;
+}
+function productionCapacity(value) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new LegacyBillingMigrationConflictError('incomplete_billing_destination', 'billing destination has an invalid apps.production.max entitlement');
+    }
+    return value;
+}
+function postgresErrorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code)
+        : undefined;
+}
+//# sourceMappingURL=postgres-migration.js.map

package/node_modules/@noodle-borg/service/dist/billing/postgres-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-migration.js","sourceRoot":"","sources":["../../src/billing/postgres-migration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAG7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,qCAAqC,EACrC,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,kCAAkC,EAClC,mCAAmC,EACnC,uCAAuC,GACxC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,+CAA+C,EAC/C,sBAAsB,EACtB,iCAAiC,EACjC,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,iBAAiB,EACjB,wBAAwB,EACxB,wCAAwC,EACxC,qCAAqC,GACtC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,WAAW,GAAG;IAClB,MAAM;IACN,aAAa;IACb,MAAM;IACN,cAAc;IACd,gBAAgB;IAChB,oBAAoB;IACpB,uBAAuB;IACvB,kBAAkB;IAClB,0BAA0B;IAC1B,yBAAyB;IACzB,+BAA+B;IAC/B,kCAAkC;IAClC,2BAA2B;IAC3B,mBAAmB;IACnB,uCAAuC;IACvC,mCAAmC;IACnC,wCAAwC;IACxC,+BAA+B;IAC/B,wCAAwC;CACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAAU,EACV,KAIC,EACD,GAAe;IAEf,MAAM,OAAO,GAAG,uCAAuC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,kBAAkB,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,IAAI,mCAAmC,CAC3C,4BAA4B,EAC5B,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,wBAAwB,CAAC;QAC7C,cAAc,EAAE,2BAA2B;QAC3C,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;KAChD,CAAC;IACF,MAAM,eAAe,GAAG,qCAAqC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,oBAAoB,GAAG,0CAA0C,CACrE,OAAO,CAAC,kBAAkB,CAC3B,CAAC;IACF,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,wFAAwF;QACxF,8FAA8F;QAC9F,iGAAiG;QACjG,iGAAiG;QACjG,0EAA0E;QAC1E,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;YAC1E,kCAAkC;SACnC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QACpF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,mBAAmB,KAAK,kBAAkB,EAAE,CAAC;gBACrD,MAAM,IAAI,mCAAmC,CAC3C,0BAA0B,EAC1B,kEAAkE,CACnE,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5D,MAAM,gBAAgB,CAAC,MAAM,EAAE,kCAAkC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3F,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,mCAAmC,CAC3C,4BAA4B,EAC5B,iFAAiF,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,oBAAoB,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,wCAAwC,CAAC,MAAM,CAAC,EAChD,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAChD,qCAAqC,CAAC,MAAM,CAAC,CAC9C,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,EACnB,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC;YAChE,MAAM,IAAI,mCAAmC,CAC3C,2BAA2B,EAC3B,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,+BAA+B,CAAC,MAAM,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC;QAE1F,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,KAAK,CAChB;;;;sFAIgF,EAChF;YACE,WAAW;YACX,6BAA6B;YAC7B,OAAO,CAAC,cAAc;YACtB,kBAAkB;YAClB,eAAe;YACf,OAAO,CAAC,eAAe;YACvB,oBAAoB;YACpB,UAAU;YACV,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,KAAK;YACX,OAAO,CAAC,MAAM;SACf,CACF,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAClF,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,gBAAwB,CAAC;YAC7B,IAAI,kBAA0C,CAAC;YAC/C,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/C,gBAAgB,GAAG,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC3D,kBAAkB,GAAG,UAAU,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;gBAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CACtC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,kBAAkB,KAAK,WAAW,CAAC,OAAO,CACxD,CAAC;gBACF,MAAM,KAAK,GAAG,KAAK,EAAE,eAAe,CAAC,IAAI,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,CACzD,EAAE,KAAK,CAAC;gBACT,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;gBACJ,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,+CAA+C,CACnE,MAAM,EACN;oBACE,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,OAAO,EAAE,WAAW,CAAC,OAAO;oBAC5B,KAAK;iBACN,EACD,UAAU,CACX,CAAC;gBACF,gBAAgB,GAAG,OAAO,CAAC,EAAE,CAAC;gBAC9B,kBAAkB,GAAG,SAAS,CAAC;YACjC,CAAC;YAED,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,EACnB,0DAA0D,CAC3D,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAwD,CAAC;gBAC7D,IAAI,WAAoC,CAAC;gBACzC,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACnC,IAAI,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;oBACjD,WAAW,GAAG,WAAW,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1C,MAAM,QAAQ,GAAG,UAAU,EAAE,eAAe,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,0BAA0B,CAChE,CAAC;oBACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,EACnB,kDAAkD,CACnD,CAAC;oBACJ,CAAC;oBACD,IAAI,GAAG,MAAM,sBAAsB,CACjC,MAAM,EACN;wBACE,GAAG;wBACH,gBAAgB;wBAChB,wBAAwB,EAAE,gBAAgB;wBAC1C,SAAS,EAAE;4BACT,cAAc,EAAE,2BAA2B;4BAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;yBAC1B;wBACD,QAAQ,EAAE,aAAa;wBACvB,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB,EACD,UAAU,CACX,CAAC;oBACF,WAAW,GAAG,SAAS,CAAC;gBAC1B,CAAC;gBACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;oBACrE,MAAM,IAAI,mCAAmC,CAC3C,gCAAgC,EAChC,2EAA2E,CAC5E,CAAC;gBACJ,CAAC;gBACD,MAAM,8BAA8B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACnD,MAAM,MAAM,CAAC,KAAK,CAChB;;;+CAGqC,EACrC;oBACE,WAAW;oBACX,GAAG;oBACH,gBAAgB;oBAChB,WAAW;oBACX,IAAI,CAAC,OAAO;oBACZ,IAAI,CAAC,SAAS,CAAC,cAAc;oBAC7B,IAAI,CAAC,SAAS,CAAC,OAAO;iBACvB,CACF,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAClF,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,QAAQ,CAAC;YACnE,MAAM,MAAM,CAAC,KAAK,CAChB;;;;iDAIyC,EACzC;gBACE,WAAW;gBACX,gBAAgB;gBAChB,kBAAkB;gBAClB,QAAQ,CAAC,EAAE;gBACX,UAAU,CAAC,aAAa,CAAC,MAAM;gBAC/B,UAAU,CAAC,cAAc,CAAC,MAAM;gBAChC,QAAQ;gBACR,cAAc;aACf,CACF,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC5C,MAAM,MAAM,CAAC,KAAK,CAChB;;uCAE6B,EAC7B,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC;YAChE,MAAM,MAAM,CAAC,KAAK,CAChB;;sDAE8C,EAC9C,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,gBAAgB,CAAC,MAAM,EAAE,kCAAkC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3F,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC3C,wBAAwB,EACxB,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,MAAkB,EAClB,OAA2C,EAC3C,0BAA6C;IAE7C,MAAM,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,WAAW;SACjE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;SACnC,IAAI,EAAE,CAAC;IACV,IACE,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,IAAI,EAAE,CAAC,EAChG,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,4BAA4B,EAC5B,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,wFAAwF,EACxF,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,mCAAmC,CAC3C,4BAA4B,EAC5B,+DAA+D,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,MAAkB,EAClB,IAAwD;IAExD,IACE,IAAI,KAAK,SAAS;QAClB,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,wBAAwB;QACvD,IAAI,CAAC,wBAAwB,KAAK,IAAI,CAAC,wBAAwB,EAC/D,CAAC;QACD,MAAM,IAAI,mCAAmC,CAC3C,gCAAgC,EAChC,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;6EACyE,EACzE,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAC/E,CAAC;IACF,IAAI,YAAY,EAAE,EAAE,KAAK,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5E,MAAM,IAAI,mCAAmC,CAC3C,gCAAgC,EAChC,kEAAkE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,MAAkB,EAAE,gBAAwB;IACrF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnF,IAAI,OAAO,EAAE,KAAK,KAAK,QAAQ,IAAI,QAAQ,EAAE,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjE,MAAM,IAAI,mCAAmC,CAC3C,gCAAgC,EAChC,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,mCAAmC,CAC3C,gCAAgC,EAChC,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAC,MAAM,CAAE,KAAoC,CAAC,IAAI,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/node_modules/@noodle-borg/service/dist/billing/postgres-records.d.ts

@@ -0,0 +1,66 @@
+import { type BillingAccountMemberRecord, type BillingAccountRecord, type EntitlementSnapshotRecord, type OrgBillingLinkRecord, type PlanVersionRecord } from './model.js';
+export declare function accountRowToRecord(row: AccountRow): BillingAccountRecord;
+export declare function memberRowToRecord(row: MemberRow): BillingAccountMemberRecord;
+export declare function planVersionRowToRecord(row: PlanVersionRow): PlanVersionRecord;
+export declare function entitlementSnapshotRowToRecord(row: EntitlementSnapshotRow): EntitlementSnapshotRecord;
+export declare function orgBillingLinkRowToRecord(row: OrgBillingLinkRow): OrgBillingLinkRecord;
+export declare function validateScalarId(name: string, value: string): string;
+export interface AccountRow {
+    readonly id: string;
+    readonly display_name: string;
+    readonly state: string;
+    readonly created_at: Date | string;
+}
+export interface MemberRow {
+    readonly billing_account_id: string;
+    readonly identity_issuer: string;
+    readonly subject: string;
+    readonly email: string;
+    readonly role: string;
+    readonly created_at: Date | string;
+}
+export interface PlanVersionRow {
+    readonly id: string;
+    readonly plan_code: string;
+    readonly version: number;
+    readonly effective_from: Date | string;
+    readonly entitlements: unknown;
+    readonly content_checksum: string;
+    readonly created_at: Date | string;
+}
+export interface EntitlementSnapshotRow {
+    readonly id: string;
+    readonly billing_account_id: string;
+    readonly version: number;
+    readonly plan_version_id: string;
+    readonly plan_code: string;
+    readonly plan_version: number;
+    readonly plan_effective_from: Date | string;
+    readonly plan_entitlements: unknown;
+    readonly plan_content_checksum: string;
+    readonly plan_created_at: Date | string;
+    readonly source_kind: string;
+    readonly generation_reason: string;
+    readonly verification_status: string;
+    readonly effective_from: Date | string;
+    readonly monthly_usage_anchor: Date | string;
+    readonly entitlements: unknown;
+    readonly content_checksum: string;
+    readonly verified_at: Date | string;
+    readonly created_at: Date | string;
+}
+export interface OrgBillingLinkRow {
+    readonly org_slug: string;
+    readonly billing_account_id: string;
+    readonly home_free_billing_account_id: string;
+    readonly home_owner_identity_issuer: string;
+    readonly home_owner_subject: string;
+    readonly fallback_billing_account_id: string;
+    readonly version: number;
+    readonly active: boolean;
+    readonly linked_at: Date | string;
+    readonly linked_by_identity_issuer: string;
+    readonly linked_by_subject: string;
+    readonly reason: string;
+}
+//# sourceMappingURL=postgres-records.d.ts.map

package/node_modules/@noodle-borg/service/dist/billing/postgres-records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-records.d.ts","sourceRoot":"","sources":["../../src/billing/postgres-records.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAGzB,KAAK,yBAAyB,EAG9B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAEvB,MAAM,YAAY,CAAC;AAEpB,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,GAAG,oBAAoB,CAUxE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,0BAA0B,CAc5E;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,iBAAiB,CAuB7E;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,sBAAsB,GAC1B,yBAAyB,CAiD3B;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,iBAAiB,GAAG,oBAAoB,CAoBtF;AA2BD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAapE;AAQD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,IAAI,GAAG,MAAM,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,IAAI,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,IAAI,GAAG,MAAM,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,IAAI,GAAG,MAAM,CAAC;IACvC,QAAQ,CAAC,oBAAoB,EAAE,IAAI,GAAG,MAAM,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB"}

package/node_modules/@noodle-borg/service/dist/billing/postgres-records.js

@@ -0,0 +1,163 @@
+import { validateSlug } from '../store/validate.js';
+import { billingContentChecksum, normalizeBillingEmail, normalizeBillingIdentity, validateBillingAccountId, } from './model.js';
+export function accountRowToRecord(row) {
+    if (row.state !== 'active' && row.state !== 'draft' && row.state !== 'inactive') {
+        throw new Error('persisted billing account has an invalid state');
+    }
+    return {
+        id: validateBillingAccountId(row.id),
+        displayName: row.display_name,
+        state: row.state,
+        createdAt: toIsoString(row.created_at),
+    };
+}
+export function memberRowToRecord(row) {
+    if (row.role !== 'owner' && row.role !== 'admin' && row.role !== 'viewer') {
+        throw new Error('persisted billing member has an invalid role');
+    }
+    return {
+        billingAccountId: validateBillingAccountId(row.billing_account_id),
+        ...normalizeBillingIdentity({
+            identityIssuer: row.identity_issuer,
+            subject: row.subject,
+        }),
+        email: normalizeBillingEmail(row.email),
+        role: row.role,
+        createdAt: toIsoString(row.created_at),
+    };
+}
+export function planVersionRowToRecord(row) {
+    const effectiveFrom = toIsoString(row.effective_from);
+    const entitlements = parseEntitlements(row.entitlements);
+    const record = {
+        id: validateScalarId('plan version id', row.id),
+        planCode: validateScalarId('plan code', row.plan_code),
+        version: validatePositiveInteger('plan version', row.version),
+        effectiveFrom,
+        entitlements,
+        contentChecksum: row.content_checksum,
+        createdAt: toIsoString(row.created_at),
+    };
+    const checksum = billingContentChecksum({
+        id: record.id,
+        planCode: record.planCode,
+        version: record.version,
+        effectiveFrom: record.effectiveFrom,
+        entitlements: record.entitlements,
+    });
+    if (checksum !== record.contentChecksum) {
+        throw new Error(`persisted plan version ${record.id} failed checksum verification`);
+    }
+    return record;
+}
+export function entitlementSnapshotRowToRecord(row) {
+    if (row.source_kind !== 'system-free' ||
+        row.generation_reason !== 'default-account-created' ||
+        row.verification_status !== 'verified') {
+        throw new Error('persisted entitlement snapshot has an unsupported provenance');
+    }
+    const effectiveFrom = toIsoString(row.effective_from);
+    const monthlyUsageAnchor = toIsoString(row.monthly_usage_anchor);
+    const entitlements = parseEntitlements(row.entitlements);
+    const plan = planVersionRowToRecord({
+        id: row.plan_version_id,
+        plan_code: row.plan_code,
+        version: row.plan_version,
+        effective_from: row.plan_effective_from,
+        entitlements: row.plan_entitlements,
+        content_checksum: row.plan_content_checksum,
+        created_at: row.plan_created_at,
+    });
+    const record = {
+        id: validateScalarId('entitlement snapshot id', row.id),
+        billingAccountId: validateBillingAccountId(row.billing_account_id),
+        version: validatePositiveInteger('entitlement snapshot version', row.version),
+        planVersionId: validateScalarId('plan version id', row.plan_version_id),
+        planCode: plan.planCode,
+        planVersion: plan.version,
+        sourceKind: row.source_kind,
+        generationReason: row.generation_reason,
+        verificationStatus: row.verification_status,
+        effectiveFrom,
+        monthlyUsageAnchor,
+        entitlements,
+        contentChecksum: row.content_checksum,
+        verifiedAt: toIsoString(row.verified_at),
+        createdAt: toIsoString(row.created_at),
+    };
+    const checksum = billingContentChecksum({
+        billingAccountId: record.billingAccountId,
+        version: record.version,
+        planVersionId: record.planVersionId,
+        effectiveFrom: record.effectiveFrom,
+        monthlyUsageAnchor: record.monthlyUsageAnchor,
+        entitlements: record.entitlements,
+    });
+    if (checksum !== record.contentChecksum) {
+        throw new Error(`persisted entitlement snapshot ${record.id} failed checksum verification`);
+    }
+    return record;
+}
+export function orgBillingLinkRowToRecord(row) {
+    if (!row.active)
+        throw new Error('persisted current billing-account link is inactive');
+    return {
+        orgSlug: validateSlug('org', row.org_slug),
+        billingAccountId: validateBillingAccountId(row.billing_account_id),
+        homeFreeBillingAccountId: validateBillingAccountId(row.home_free_billing_account_id),
+        homeOwner: normalizeBillingIdentity({
+            identityIssuer: row.home_owner_identity_issuer,
+            subject: row.home_owner_subject,
+        }),
+        fallbackBillingAccountId: validateBillingAccountId(row.fallback_billing_account_id),
+        version: validatePositiveInteger('billing link version', row.version),
+        active: true,
+        linkedAt: toIsoString(row.linked_at),
+        linkedBy: normalizeBillingIdentity({
+            identityIssuer: row.linked_by_identity_issuer,
+            subject: row.linked_by_subject,
+        }),
+        reason: validateScalarId('billing link reason', row.reason),
+    };
+}
+function parseEntitlements(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('persisted entitlements must be an object');
+    }
+    const entitlements = {};
+    for (const [key, candidate] of Object.entries(value)) {
+        validateScalarId('entitlement key', key);
+        if (candidate !== null &&
+            typeof candidate !== 'boolean' &&
+            typeof candidate !== 'string' &&
+            (typeof candidate !== 'number' || !Number.isFinite(candidate))) {
+            throw new Error(`persisted entitlement ${key} has an invalid value`);
+        }
+        entitlements[key] = candidate;
+    }
+    return Object.freeze(entitlements);
+}
+function validatePositiveInteger(name, value) {
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new Error(`${name} must be positive`);
+    return value;
+}
+export function validateScalarId(name, value) {
+    const normalized = value.trim();
+    if (normalized.length === 0 ||
+        normalized.length > 512 ||
+        [...normalized].some((character) => {
+            const code = character.charCodeAt(0);
+            return code <= 0x1f || code === 0x7f;
+        })) {
+        throw new Error(`${name} must be a non-empty scalar identifier`);
+    }
+    return normalized;
+}
+function toIsoString(value) {
+    const date = value instanceof Date ? value : new Date(value);
+    if (!Number.isFinite(date.getTime()))
+        throw new Error('persisted billing timestamp is invalid');
+    return date.toISOString();
+}
+//# sourceMappingURL=postgres-records.js.map

package/node_modules/@noodle-borg/service/dist/billing/postgres-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-records.js","sourceRoot":"","sources":["../../src/billing/postgres-records.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAIL,sBAAsB,EAEtB,qBAAqB,EACrB,wBAAwB,EAGxB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,kBAAkB,CAAC,GAAe;IAChD,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,wBAAwB,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAClE,GAAG,wBAAwB,CAAC;YAC1B,cAAc,EAAE,GAAG,CAAC,eAAe;YACnC,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC;QACF,KAAK,EAAE,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC;QACvC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAmB;IACxD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,MAAM,GAAsB;QAChC,EAAE,EAAE,gBAAgB,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/C,QAAQ,EAAE,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC;QACtD,OAAO,EAAE,uBAAuB,CAAC,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC;QAC7D,aAAa;QACb,YAAY;QACZ,eAAe,EAAE,GAAG,CAAC,gBAAgB;QACrC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;KACvC,CAAC;IACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACtC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAA2B;IAE3B,IACE,GAAG,CAAC,WAAW,KAAK,aAAa;QACjC,GAAG,CAAC,iBAAiB,KAAK,yBAAyB;QACnD,GAAG,CAAC,mBAAmB,KAAK,UAAU,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,sBAAsB,CAAC;QAClC,EAAE,EAAE,GAAG,CAAC,eAAe;QACvB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,YAAY;QACzB,cAAc,EAAE,GAAG,CAAC,mBAAmB;QACvC,YAAY,EAAE,GAAG,CAAC,iBAAiB;QACnC,gBAAgB,EAAE,GAAG,CAAC,qBAAqB;QAC3C,UAAU,EAAE,GAAG,CAAC,eAAe;KAChC,CAAC,CAAC;IACH,MAAM,MAAM,GAA8B;QACxC,EAAE,EAAE,gBAAgB,CAAC,yBAAyB,EAAE,GAAG,CAAC,EAAE,CAAC;QACvD,gBAAgB,EAAE,wBAAwB,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAClE,OAAO,EAAE,uBAAuB,CAAC,8BAA8B,EAAE,GAAG,CAAC,OAAO,CAAC;QAC7E,aAAa,EAAE,gBAAgB,CAAC,iBAAiB,EAAE,GAAG,CAAC,eAAe,CAAC;QACvE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;QACvC,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;QAC3C,aAAa;QACb,kBAAkB;QAClB,YAAY;QACZ,eAAe,EAAE,GAAG,CAAC,gBAAgB;QACrC,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;QACxC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;KACvC,CAAC;IACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACtC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,EAAE,+BAA+B,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAsB;IAC9D,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvF,OAAO;QACL,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC;QAC1C,gBAAgB,EAAE,wBAAwB,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAClE,wBAAwB,EAAE,wBAAwB,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACpF,SAAS,EAAE,wBAAwB,CAAC;YAClC,cAAc,EAAE,GAAG,CAAC,0BAA0B;YAC9C,OAAO,EAAE,GAAG,CAAC,kBAAkB;SAChC,CAAC;QACF,wBAAwB,EAAE,wBAAwB,CAAC,GAAG,CAAC,2BAA2B,CAAC;QACnF,OAAO,EAAE,uBAAuB,CAAC,sBAAsB,EAAE,GAAG,CAAC,OAAO,CAAC;QACrE,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;QACpC,QAAQ,EAAE,wBAAwB,CAAC;YACjC,cAAc,EAAE,GAAG,CAAC,yBAAyB;YAC7C,OAAO,EAAE,GAAG,CAAC,iBAAiB;SAC/B,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,YAAY,GAAqD,EAAE,CAAC;IAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,gBAAgB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACzC,IACE,SAAS,KAAK,IAAI;YAClB,OAAO,SAAS,KAAK,SAAS;YAC9B,OAAO,SAAS,KAAK,QAAQ;YAC7B,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAC9D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,uBAAuB,CAAC,CAAC;QACvE,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IAC1D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,MAAM,GAAG,GAAG;QACvB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;QACvC,CAAC,CAAC,EACF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACvC,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC"}

package/node_modules/@noodle-borg/service/dist/billing/postgres-schema.d.ts

@@ -0,0 +1,4 @@
+import type { Pool } from 'pg';
+/** Additive BA-1 schema. No existing organization is linked or otherwise migrated here. */
+export declare function ensureBillingSchema(pool: Pool): Promise<void>;
+//# sourceMappingURL=postgres-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/billing/postgres-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-schema.d.ts","sourceRoot":"","sources":["../../src/billing/postgres-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAI/B,2FAA2F;AAC3F,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAuNnE"}