@noodleseed/one 0.45.0 → 0.47.0

package/node_modules/@noodle-borg/service/dist/billing/meter-readiness.js

@@ -0,0 +1,136 @@
+import { createHmac } from 'node:crypto';
+import { z } from 'zod';
+import { normalizeBillingUsageInstant } from './usage-window.js';
+export const BILLING_METER_READINESS_SCHEMA_VERSION = 1;
+export const BILLING_METER_RECEIPT_RETENTION_DAYS = 7;
+export const BILLING_METER_EXACT_KEY_TOMBSTONE_RETENTION_DAYS = 30;
+export const BILLING_METER_AGGREGATE_RETENTION_MONTHS = 25;
+export const BILLING_METER_PARTITION_HORIZON_MONTHS = 2;
+export const BILLING_METER_EVIDENCE_FRESHNESS_MS = 24 * 60 * 60 * 1_000;
+export const BILLING_METER_RETRY_IDENTITY_VERSION = 1;
+export const BILLING_METER_READINESS_CHECK_CODES = [
+    'durable_postgres',
+    'billing_attribution_complete',
+    'legacy_platform_quota_retired',
+    'key_generation_consistent',
+    'prepared_meter_epoch',
+    'partition_horizon',
+    'receipt_retention',
+    'exact_key_tombstones',
+    'aggregate_reconciliation',
+    'validation_mirror',
+    'writer_health',
+    'scheduler_health',
+];
+export const BILLING_METER_LATER_CUTOVER_GATES = [
+    'traffic_fleet_convergence_proof',
+    'plan_volume_capacity_proof',
+    'nonproduction_fail_closed_drill',
+    'grant_expiry_contract',
+    'authoritative_activation',
+    'protected_production_approval',
+];
+const BillingMeterInstantSchema = z.iso
+    .datetime({ offset: true })
+    .transform((value) => new Date(value).toISOString());
+const BillingMeterReadinessCheckSchema = z.strictObject({
+    code: z.enum(BILLING_METER_READINESS_CHECK_CODES),
+    state: z.enum(['pass', 'fail', 'unknown']),
+    checkedAt: BillingMeterInstantSchema.optional(),
+});
+const BillingMeterReadinessChecksSchema = z
+    .array(BillingMeterReadinessCheckSchema)
+    .length(BILLING_METER_READINESS_CHECK_CODES.length)
+    .superRefine((checks, context) => {
+    for (const [index, code] of BILLING_METER_READINESS_CHECK_CODES.entries()) {
+        if (checks[index]?.code !== code) {
+            context.addIssue({
+                code: 'custom',
+                message: `expected readiness check ${code} at index ${index}`,
+                path: [index, 'code'],
+            });
+        }
+    }
+});
+export const BillingMeterReadinessReportSchema = z
+    .strictObject({
+    schemaVersion: z.literal(BILLING_METER_READINESS_SCHEMA_VERSION),
+    checkedAt: BillingMeterInstantSchema,
+    technicalReadiness: z.enum(['ready', 'blocked', 'unavailable']),
+    metering: z.union([
+        z.strictObject({ mode: z.literal('not_started'), coverage: z.null() }),
+        z.strictObject({ mode: z.literal('shadow'), coverage: z.literal('partial') }),
+    ]),
+    enforcement: z.strictObject({ state: z.literal('legacy_unchanged') }),
+    activation: z.strictObject({ state: z.literal('not_available') }),
+    checks: BillingMeterReadinessChecksSchema,
+    laterCutoverGates: z.tuple([
+        z.literal('traffic_fleet_convergence_proof'),
+        z.literal('plan_volume_capacity_proof'),
+        z.literal('nonproduction_fail_closed_drill'),
+        z.literal('grant_expiry_contract'),
+        z.literal('authoritative_activation'),
+        z.literal('protected_production_approval'),
+    ]),
+})
+    .superRefine((report, context) => {
+    const allPass = report.checks.every((check) => check.state === 'pass');
+    if ((report.technicalReadiness === 'ready') !== allPass) {
+        context.addIssue({
+            code: 'custom',
+            message: 'technical readiness must be ready exactly when every readiness check passes',
+            path: ['technicalReadiness'],
+        });
+    }
+});
+export function buildBillingMeterReadinessReport(input) {
+    const checkedAt = normalizeBillingUsageInstant('billing meter readiness check', input.checkedAt);
+    if ((input.metering.mode === 'not_started' && input.metering.coverage !== null) ||
+        (input.metering.mode === 'shadow' && input.metering.coverage !== 'partial')) {
+        throw new Error('billing meter readiness metering state is inconsistent');
+    }
+    const checks = BILLING_METER_READINESS_CHECK_CODES.map((code) => {
+        const signal = input.checks[code];
+        return {
+            code,
+            state: signal.state,
+            ...(signal.checkedAt === undefined
+                ? {}
+                : {
+                    checkedAt: normalizeBillingUsageInstant(`billing meter readiness ${code} check`, signal.checkedAt),
+                }),
+        };
+    });
+    return BillingMeterReadinessReportSchema.parse({
+        schemaVersion: BILLING_METER_READINESS_SCHEMA_VERSION,
+        checkedAt,
+        technicalReadiness: checks.every((check) => check.state === 'pass') ? 'ready' : 'blocked',
+        metering: input.metering,
+        enforcement: { state: 'legacy_unchanged' },
+        activation: { state: 'not_available' },
+        checks,
+        laterCutoverGates: BILLING_METER_LATER_CUTOVER_GATES,
+    });
+}
+export function unavailableBillingMeterReadinessReport(checkedAt) {
+    const normalized = normalizeBillingUsageInstant('billing meter readiness check', checkedAt);
+    return BillingMeterReadinessReportSchema.parse({
+        schemaVersion: BILLING_METER_READINESS_SCHEMA_VERSION,
+        checkedAt: normalized,
+        technicalReadiness: 'unavailable',
+        metering: { mode: 'not_started', coverage: null },
+        enforcement: { state: 'legacy_unchanged' },
+        activation: { state: 'not_available' },
+        checks: BILLING_METER_READINESS_CHECK_CODES.map((code) => ({ code, state: 'unknown' })),
+        laterCutoverGates: BILLING_METER_LATER_CUTOVER_GATES,
+    });
+}
+/** A one-way generation marker; the HMAC key itself is never persisted or returned. */
+export function deriveBillingMeterKeyGeneration(hmacKey) {
+    if (hmacKey.length < 32)
+        throw new Error('billing usage HMAC key must be at least 32 characters');
+    return createHmac('sha256', hmacKey)
+        .update('noodle-billing-meter-key-generation-v1')
+        .digest('hex');
+}
+//# sourceMappingURL=meter-readiness.js.map

package/node_modules/@noodle-borg/service/dist/billing/meter-readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meter-readiness.js","sourceRoot":"","sources":["../../src/billing/meter-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAU,CAAC;AACjE,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAU,CAAC;AAC/D,MAAM,CAAC,MAAM,gDAAgD,GAAG,EAAW,CAAC;AAC5E,MAAM,CAAC,MAAM,wCAAwC,GAAG,EAAW,CAAC;AACpE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAU,CAAC;AACjE,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACxE,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAU,CAAC;AAE/D,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,kBAAkB;IAClB,8BAA8B;IAC9B,+BAA+B;IAC/B,2BAA2B;IAC3B,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,sBAAsB;IACtB,0BAA0B;IAC1B,mBAAmB;IACnB,eAAe;IACf,kBAAkB;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,iCAAiC;IACjC,4BAA4B;IAC5B,iCAAiC;IACjC,uBAAuB;IACvB,0BAA0B;IAC1B,+BAA+B;CACvB,CAAC;AAEX,MAAM,yBAAyB,GAAG,CAAC,CAAC,GAAG;KACpC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAC1B,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACvD,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1C,SAAS,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AACH,MAAM,iCAAiC,GAAG,CAAC;KACxC,KAAK,CAAC,gCAAgC,CAAC;KACvC,MAAM,CAAC,mCAAmC,CAAC,MAAM,CAAC;KAClD,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,mCAAmC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1E,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,4BAA4B,IAAI,aAAa,KAAK,EAAE;gBAC7D,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC;IAChE,SAAS,EAAE,yBAAyB;IACpC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;QAChB,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;KAC9E,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;IACjE,MAAM,EAAE,iCAAiC;IACzC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;QAC5C,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;QAC5C,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAClC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC;KAC3C,CAAC;CACH,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,kBAAkB,KAAK,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACxD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,6EAA6E;YACtF,IAAI,EAAE,CAAC,oBAAoB,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAqBL,MAAM,UAAU,gCAAgC,CAAC,KAIhD;IACC,MAAM,SAAS,GAAG,4BAA4B,CAAC,+BAA+B,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACjG,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC;QAC3E,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,mCAAmC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,SAAS,EAAE,4BAA4B,CACrC,2BAA2B,IAAI,QAAQ,EACvC,MAAM,CAAC,SAAS,CACjB;iBACF,CAAC;SAC8B,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC,KAAK,CAAC;QAC7C,aAAa,EAAE,sCAAsC;QACrD,SAAS;QACT,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;QAC1C,UAAU,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;QACtC,MAAM;QACN,iBAAiB,EAAE,iCAAiC;KACrD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,SAAiB;IAEjB,MAAM,UAAU,GAAG,4BAA4B,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;IAC5F,OAAO,iCAAiC,CAAC,KAAK,CAAC;QAC7C,aAAa,EAAE,sCAAsC;QACrD,SAAS,EAAE,UAAU;QACrB,kBAAkB,EAAE,aAAa;QACjC,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QACjD,WAAW,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;QAC1C,UAAU,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;QACtC,MAAM,EAAE,mCAAmC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,iBAAiB,EAAE,iCAAiC;KACrD,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,+BAA+B,CAAC,OAAe;IAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAClG,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;SACjC,MAAM,CAAC,wCAAwC,CAAC;SAChD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/node_modules/@noodle-borg/service/dist/billing/meter-runtime-config.d.ts

@@ -0,0 +1,9 @@
+export interface BillingMeterValidationRuntimeConfig {
+    readonly cpuAlwaysAllocated: true;
+    /** Test-only cadence override; production uses the exported 30-second health interval. */
+    readonly writerHeartbeatIntervalMs?: number;
+    /** Test-only cadence override; production uses the exported five-minute scheduler interval. */
+    readonly schedulerIntervalMs?: number;
+}
+export declare function resolveBillingMeterValidationRuntimeConfig(env: Readonly<Record<string, string | undefined>>): BillingMeterValidationRuntimeConfig | undefined;
+//# sourceMappingURL=meter-runtime-config.d.ts.map

package/node_modules/@noodle-borg/service/dist/billing/meter-runtime-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meter-runtime-config.d.ts","sourceRoot":"","sources":["../../src/billing/meter-runtime-config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC;IAClC,0FAA0F;IAC1F,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,+FAA+F;IAC/F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,wBAAgB,0CAA0C,CACxD,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAChD,mCAAmC,GAAG,SAAS,CAmBjD"}

package/node_modules/@noodle-borg/service/dist/billing/meter-runtime-config.js

@@ -0,0 +1,24 @@
+export function resolveBillingMeterValidationRuntimeConfig(env) {
+    const enabled = parseOptionalBoolean('NOODLE_BILLING_METER_VALIDATION_ENABLED', env.NOODLE_BILLING_METER_VALIDATION_ENABLED);
+    const cpuAlwaysAllocated = parseOptionalBoolean('NOODLE_BILLING_METER_CPU_ALWAYS_ALLOCATED', env.NOODLE_BILLING_METER_CPU_ALWAYS_ALLOCATED);
+    if (enabled !== true) {
+        if (cpuAlwaysAllocated === true) {
+            throw new Error('always-allocated CPU assertion requires validation to be enabled');
+        }
+        return undefined;
+    }
+    if (cpuAlwaysAllocated !== true) {
+        throw new Error('billing meter validation requires an explicit always-allocated CPU assertion');
+    }
+    return { cpuAlwaysAllocated: true };
+}
+function parseOptionalBoolean(name, value) {
+    if (value === undefined || value.length === 0)
+        return undefined;
+    if (value === 'true' || value === '1')
+        return true;
+    if (value === 'false' || value === '0')
+        return false;
+    throw new Error(`${name} must be true/false or 1/0`);
+}
+//# sourceMappingURL=meter-runtime-config.js.map

package/node_modules/@noodle-borg/service/dist/billing/meter-runtime-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meter-runtime-config.js","sourceRoot":"","sources":["../../src/billing/meter-runtime-config.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,0CAA0C,CACxD,GAAiD;IAEjD,MAAM,OAAO,GAAG,oBAAoB,CAClC,yCAAyC,EACzC,GAAG,CAAC,uCAAuC,CAC5C,CAAC;IACF,MAAM,kBAAkB,GAAG,oBAAoB,CAC7C,2CAA2C,EAC3C,GAAG,CAAC,yCAAyC,CAC9C,CAAC;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAyB;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;AACvD,CAAC"}

package/node_modules/@noodle-borg/service/dist/billing/meter-validation-epoch.d.ts

@@ -0,0 +1,75 @@
+import type { AuditEventInput } from '@noodle-borg/module';
+import { z } from 'zod';
+import type { ControlPlaneIdentity } from '../auth/deploy-gate.js';
+export declare const BILLING_METER_VALIDATION_WRITER_CONTRACT_VERSION = 1;
+declare const prepareRequestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    mode: z.ZodLiteral<"validation">;
+    reason: z.ZodString;
+    idempotencyKey: z.ZodString;
+    confirmed: z.ZodLiteral<true>;
+}, z.core.$strict>;
+declare const retireRequestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    epochId: z.ZodString;
+    reason: z.ZodString;
+    idempotencyKey: z.ZodString;
+    confirmed: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare const BillingMeterValidationEpochResultSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    epochId: z.ZodString;
+    mode: z.ZodLiteral<"validation">;
+    state: z.ZodEnum<{
+        prepared: "prepared";
+        retired: "retired";
+    }>;
+    replayed: z.ZodBoolean;
+    preparedAt: z.ZodISODateTime;
+    retiredAt: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodNull]>;
+    retryIdentityVersion: z.ZodNumber;
+    writerContractVersion: z.ZodNumber;
+    serviceReleaseSha: z.ZodString;
+    meteringMode: z.ZodLiteral<"shadow">;
+    enforcementMode: z.ZodLiteral<"legacy_unchanged">;
+}, z.core.$strict>;
+export type BillingMeterValidationEpochPrepareRequest = z.infer<typeof prepareRequestSchema>;
+export type BillingMeterValidationEpochRetireRequest = z.infer<typeof retireRequestSchema>;
+export type BillingMeterValidationEpochResult = z.infer<typeof BillingMeterValidationEpochResultSchema>;
+export interface BillingMeterValidationEpochStore {
+    /** PostgreSQL stores persist success audits with the lifecycle transaction. */
+    readonly successAuditMode?: 'transactional';
+    prepareValidationEpoch(input: {
+        readonly request: BillingMeterValidationEpochPrepareRequest;
+        readonly actor: ControlPlaneIdentity;
+        readonly service: string;
+    }): Promise<BillingMeterValidationEpochResult>;
+    retireValidationEpoch(input: {
+        readonly request: BillingMeterValidationEpochRetireRequest;
+        readonly actor: ControlPlaneIdentity;
+        readonly service: string;
+    }): Promise<BillingMeterValidationEpochResult>;
+}
+export type BillingMeterValidationEpochConflictCode = 'idempotency_key_conflict' | 'validation_epoch_already_prepared' | 'validation_epoch_not_found' | 'validation_epoch_state_conflict' | 'validation_epoch_configuration_unavailable' | 'serialization_conflict';
+export declare class BillingMeterValidationEpochConflictError extends Error {
+    readonly code: BillingMeterValidationEpochConflictCode;
+    constructor(code: BillingMeterValidationEpochConflictCode, message: string);
+}
+export declare function parseBillingMeterValidationEpochPrepareRequest(value: unknown): BillingMeterValidationEpochPrepareRequest;
+export declare function parseBillingMeterValidationEpochRetireRequest(value: unknown): BillingMeterValidationEpochRetireRequest;
+type FingerprintInput = {
+    readonly action: 'validation_prepare';
+    readonly request: BillingMeterValidationEpochPrepareRequest;
+    readonly actor: Pick<ControlPlaneIdentity, 'subject' | 'email'>;
+    readonly service: string;
+} | {
+    readonly action: 'validation_retire';
+    readonly request: BillingMeterValidationEpochRetireRequest;
+    readonly actor: Pick<ControlPlaneIdentity, 'subject' | 'email'>;
+    readonly service: string;
+};
+export declare function billingMeterValidationEpochRequestFingerprint(input: FingerprintInput): string;
+export declare function billingMeterValidationEpochSuccessAudit(action: 'validation_prepare' | 'validation_retire', result: BillingMeterValidationEpochResult, actor: Pick<ControlPlaneIdentity, 'subject' | 'email'>): AuditEventInput;
+export declare function normalizeBillingMeterServiceUrl(value: string): string;
+export {};
+//# sourceMappingURL=meter-validation-epoch.d.ts.map

package/node_modules/@noodle-borg/service/dist/billing/meter-validation-epoch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meter-validation-epoch.d.ts","sourceRoot":"","sources":["../../src/billing/meter-validation-epoch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGnE,eAAO,MAAM,gDAAgD,IAAI,CAAC;AAUlE,QAAA,MAAM,oBAAoB;;;;;;kBAMxB,CAAC;AAEH,QAAA,MAAM,mBAAmB;;;;;;kBAMvB,CAAC;AAEH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;kBAgChD,CAAC;AAEL,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAC7F,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAC3F,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,WAAW,gCAAgC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAC5C,sBAAsB,CAAC,KAAK,EAAE;QAC5B,QAAQ,CAAC,OAAO,EAAE,yCAAyC,CAAC;QAC5D,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC/C,qBAAqB,CAAC,KAAK,EAAE;QAC3B,QAAQ,CAAC,OAAO,EAAE,wCAAwC,CAAC;QAC3D,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,uCAAuC,GAC/C,0BAA0B,GAC1B,mCAAmC,GACnC,4BAA4B,GAC5B,iCAAiC,GACjC,4CAA4C,GAC5C,wBAAwB,CAAC;AAE7B,qBAAa,wCAAyC,SAAQ,KAAK;IACjE,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC;gBAE3C,IAAI,EAAE,uCAAuC,EAAE,OAAO,EAAE,MAAM;CAK3E;AAED,wBAAgB,8CAA8C,CAC5D,KAAK,EAAE,OAAO,GACb,yCAAyC,CAQ3C;AAED,wBAAgB,6CAA6C,CAC3D,KAAK,EAAE,OAAO,GACb,wCAAwC,CAQ1C;AAED,KAAK,gBAAgB,GACjB;IACE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,yCAAyC,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,wCAAwC,CAAC;IAC3D,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,wBAAgB,6CAA6C,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAQ7F;AAED,wBAAgB,uCAAuC,CACrD,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,EAClD,MAAM,EAAE,iCAAiC,EACzC,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,OAAO,CAAC,GACrD,eAAe,CAoBjB;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAarE"}

package/node_modules/@noodle-borg/service/dist/billing/meter-validation-epoch.js

@@ -0,0 +1,127 @@
+import { z } from 'zod';
+import { billingContentChecksum } from './model.js';
+export const BILLING_METER_VALIDATION_WRITER_CONTRACT_VERSION = 1;
+const scalarSchema = (label, max) => z
+    .string()
+    .trim()
+    .min(1, `${label} is required`)
+    .max(max, `${label} must be ${max} characters or fewer`)
+    .refine((value) => !hasControlCharacters(value), `${label} cannot contain control characters`);
+const prepareRequestSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    mode: z.literal('validation'),
+    reason: scalarSchema('reason', 512),
+    idempotencyKey: scalarSchema('idempotencyKey', 256),
+    confirmed: z.literal(true),
+});
+const retireRequestSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    epochId: scalarSchema('epochId', 128),
+    reason: scalarSchema('reason', 512),
+    idempotencyKey: scalarSchema('idempotencyKey', 256),
+    confirmed: z.literal(true),
+});
+export const BillingMeterValidationEpochResultSchema = z
+    .strictObject({
+    schemaVersion: z.literal(1),
+    epochId: scalarSchema('epochId', 128),
+    mode: z.literal('validation'),
+    state: z.enum(['prepared', 'retired']),
+    replayed: z.boolean(),
+    preparedAt: z.iso.datetime({ offset: true }),
+    retiredAt: z.union([z.iso.datetime({ offset: true }), z.null()]),
+    retryIdentityVersion: z.number().int().positive(),
+    writerContractVersion: z.number().int().positive(),
+    serviceReleaseSha: z
+        .string()
+        .regex(/^[0-9a-f]{40}$/, 'serviceReleaseSha must be a full lowercase Git SHA'),
+    meteringMode: z.literal('shadow'),
+    enforcementMode: z.literal('legacy_unchanged'),
+})
+    .superRefine((result, context) => {
+    if (result.state === 'prepared' && result.retiredAt !== null) {
+        context.addIssue({
+            code: 'custom',
+            path: ['retiredAt'],
+            message: 'a prepared validation epoch cannot have a retirement timestamp',
+        });
+    }
+    if (result.state === 'retired' && result.retiredAt === null) {
+        context.addIssue({
+            code: 'custom',
+            path: ['retiredAt'],
+            message: 'a retired validation epoch requires a retirement timestamp',
+        });
+    }
+});
+export class BillingMeterValidationEpochConflictError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'BillingMeterValidationEpochConflictError';
+        this.code = code;
+    }
+}
+export function parseBillingMeterValidationEpochPrepareRequest(value) {
+    const result = prepareRequestSchema.safeParse(value);
+    if (!result.success) {
+        throw new Error(`invalid billing meter validation epoch prepare: ${z.prettifyError(result.error)}`);
+    }
+    return result.data;
+}
+export function parseBillingMeterValidationEpochRetireRequest(value) {
+    const result = retireRequestSchema.safeParse(value);
+    if (!result.success) {
+        throw new Error(`invalid billing meter validation epoch retire: ${z.prettifyError(result.error)}`);
+    }
+    return result.data;
+}
+export function billingMeterValidationEpochRequestFingerprint(input) {
+    return billingContentChecksum({
+        schemaVersion: input.request.schemaVersion,
+        action: input.action,
+        request: input.request,
+        actor: { subject: input.actor.subject, email: input.actor.email },
+        service: normalizeBillingMeterServiceUrl(input.service),
+    });
+}
+export function billingMeterValidationEpochSuccessAudit(action, result, actor) {
+    return {
+        eventType: 'billing.metering.validation_epoch',
+        org: 'platform',
+        actorSubject: actor.subject,
+        ...(actor.email !== undefined ? { actorEmail: actor.email } : {}),
+        decision: 'allow',
+        status: action === 'validation_prepare' && !result.replayed ? 201 : 200,
+        details: {
+            action,
+            epochId: result.epochId,
+            state: result.state,
+            replayed: result.replayed,
+            retryIdentityVersion: result.retryIdentityVersion,
+            writerContractVersion: result.writerContractVersion,
+            serviceReleaseSha: result.serviceReleaseSha,
+            meteringMode: result.meteringMode,
+            enforcementMode: result.enforcementMode,
+        },
+    };
+}
+export function normalizeBillingMeterServiceUrl(value) {
+    const parsed = new URL(value);
+    if ((parsed.protocol !== 'https:' && parsed.protocol !== 'http:') ||
+        parsed.username !== '' ||
+        parsed.password !== '' ||
+        parsed.pathname !== '/' ||
+        parsed.search !== '' ||
+        parsed.hash !== '') {
+        throw new Error('billing meter service must be an HTTP(S) origin');
+    }
+    return parsed.origin;
+}
+function hasControlCharacters(value) {
+    return [...value].some((character) => {
+        const code = character.charCodeAt(0);
+        return code <= 0x1f || code === 0x7f;
+    });
+}
+//# sourceMappingURL=meter-validation-epoch.js.map

package/node_modules/@noodle-borg/service/dist/billing/meter-validation-epoch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meter-validation-epoch.js","sourceRoot":"","sources":["../../src/billing/meter-validation-epoch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC;AAElE,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAClD,CAAC;KACE,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,cAAc,CAAC;KAC9B,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,YAAY,GAAG,sBAAsB,CAAC;KACvD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,oCAAoC,CAAC,CAAC;AAEnG,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC;IACnC,cAAc,EAAE,YAAY,CAAC,gBAAgB,EAAE,GAAG,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC;IACrC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC;IACnC,cAAc,EAAE,YAAY,CAAC,gBAAgB,EAAE,GAAG,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClD,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,oDAAoD,CAAC;IAChF,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAC/C,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/B,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AA+BL,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IACxD,IAAI,CAA0C;IAEvD,YAAY,IAA6C,EAAE,OAAe;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0CAA0C,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,8CAA8C,CAC5D,KAAc;IAEd,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mDAAmD,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,6CAA6C,CAC3D,KAAc;IAEd,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,kDAAkD,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAgBD,MAAM,UAAU,6CAA6C,CAAC,KAAuB;IACnF,OAAO,sBAAsB,CAAC;QAC5B,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;QACjE,OAAO,EAAE,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,MAAkD,EAClD,MAAyC,EACzC,KAAsD;IAEtD,OAAO;QACL,SAAS,EAAE,mCAAmC;QAC9C,GAAG,EAAE,UAAU;QACf,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,MAAM,KAAK,oBAAoB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QACvE,OAAO,EAAE;YACP,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAa;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC7D,MAAM,CAAC,QAAQ,KAAK,EAAE;QACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;QACtB,MAAM,CAAC,QAAQ,KAAK,GAAG;QACvB,MAAM,CAAC,MAAM,KAAK,EAAE;QACpB,MAAM,CAAC,IAAI,KAAK,EAAE,EAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/billing/postgres-enforcement-profile-schema.d.ts

@@ -0,0 +1,4 @@
+import type { Pool } from 'pg';
+/** Additive classification-only schema. Creating these tables never seals or profiles an account. */
+export declare function ensureBillingEnforcementProfileSchema(pool: Pool): Promise<void>;
+//# sourceMappingURL=postgres-enforcement-profile-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/billing/postgres-enforcement-profile-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-enforcement-profile-schema.d.ts","sourceRoot":"","sources":["../../src/billing/postgres-enforcement-profile-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,qGAAqG;AACrG,wBAAsB,qCAAqC,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAwGrF"}

package/node_modules/@noodle-borg/service/dist/billing/postgres-enforcement-profile-schema.js

@@ -0,0 +1,107 @@
+/** Additive classification-only schema. Creating these tables never seals or profiles an account. */
+export async function ensureBillingEnforcementProfileSchema(pool) {
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS billing_enforcement_cohort_seals (
+      id                         text PRIMARY KEY,
+      singleton                  boolean NOT NULL DEFAULT true UNIQUE CHECK (singleton),
+      schema_version             integer NOT NULL CHECK (schema_version = 1),
+      cohort_kind                text NOT NULL UNIQUE CHECK (cohort_kind = 'legacy_internal_v1'),
+      state                      text NOT NULL CHECK (state = 'sealed'),
+      legacy_account_profile     text NOT NULL CHECK (legacy_account_profile = 'legacy_internal_exempt'),
+      post_seal_account_profile  text NOT NULL CHECK (post_seal_account_profile = 'enforced'),
+      sealed_at                  timestamptz NOT NULL,
+      sealed_by_subject          text NOT NULL,
+      sealed_by_email            text NOT NULL,
+      service_origin             text NOT NULL,
+      reason                     text NOT NULL
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS billing_account_enforcement_profiles (
+      billing_account_id text NOT NULL REFERENCES billing_accounts(id) ON DELETE RESTRICT,
+      version            integer NOT NULL CHECK (version > 0),
+      schema_version     integer NOT NULL CHECK (schema_version = 1),
+      mode               text NOT NULL CHECK (mode IN ('legacy_internal_exempt', 'enforced')),
+      cohort_kind        text NOT NULL CHECK (cohort_kind = 'legacy_internal_v1'),
+      cohort_seal_id     text NOT NULL REFERENCES billing_enforcement_cohort_seals(id) ON DELETE RESTRICT,
+      source             text NOT NULL CHECK (source IN ('legacy_cohort_seal', 'post_seal_account')),
+      effective_from     timestamptz NOT NULL,
+      created_at         timestamptz NOT NULL,
+      PRIMARY KEY (billing_account_id, version),
+      CHECK (
+        (mode = 'legacy_internal_exempt' AND source = 'legacy_cohort_seal') OR
+        (mode = 'enforced' AND source = 'post_seal_account')
+      )
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS billing_account_active_enforcement_profiles (
+      billing_account_id text PRIMARY KEY REFERENCES billing_accounts(id) ON DELETE RESTRICT,
+      profile_version    integer NOT NULL CHECK (profile_version > 0),
+      FOREIGN KEY (billing_account_id, profile_version)
+        REFERENCES billing_account_enforcement_profiles(billing_account_id, version)
+        ON DELETE RESTRICT
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS billing_enforcement_cohort_operations (
+      operation_id          text PRIMARY KEY,
+      action                text NOT NULL CHECK (action = 'seal'),
+      idempotency_key_hash  text NOT NULL UNIQUE CHECK (idempotency_key_hash ~ '^[0-9a-f]{64}$'),
+      request_fingerprint   text NOT NULL CHECK (request_fingerprint ~ '^[0-9a-f]{64}$'),
+      cohort_seal_id        text NOT NULL REFERENCES billing_enforcement_cohort_seals(id) ON DELETE RESTRICT,
+      result                jsonb NOT NULL,
+      actor_subject         text NOT NULL,
+      actor_email           text NOT NULL,
+      service_origin        text NOT NULL,
+      reason                text NOT NULL,
+      created_at            timestamptz NOT NULL
+    )
+  `);
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION assign_post_seal_billing_enforcement_profile()
+    RETURNS trigger LANGUAGE plpgsql AS $$
+    DECLARE
+      seal_id text;
+      profile_time timestamptz;
+    BEGIN
+      SELECT id INTO seal_id
+      FROM billing_enforcement_cohort_seals
+      WHERE singleton = true;
+      IF seal_id IS NULL THEN
+        RETURN NEW;
+      END IF;
+
+      profile_time := billing_meter_transaction_time();
+      INSERT INTO billing_account_enforcement_profiles
+        (billing_account_id, version, schema_version, mode, cohort_kind, cohort_seal_id,
+         source, effective_from, created_at)
+      VALUES
+        (NEW.id, 1, 1, 'enforced', 'legacy_internal_v1', seal_id,
+         'post_seal_account', profile_time, profile_time);
+      INSERT INTO billing_account_active_enforcement_profiles
+        (billing_account_id, profile_version)
+      VALUES (NEW.id, 1);
+      RETURN NEW;
+    END
+    $$
+  `);
+    await pool.query(`
+    DO $billing_enforcement_account_trigger$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1
+        FROM pg_trigger
+        WHERE tgname = 'billing_accounts_assign_post_seal_enforcement_profile'
+          AND tgrelid = 'billing_accounts'::regclass
+          AND NOT tgisinternal
+      ) THEN
+        CREATE TRIGGER billing_accounts_assign_post_seal_enforcement_profile
+        AFTER INSERT ON billing_accounts
+        FOR EACH ROW EXECUTE FUNCTION assign_post_seal_billing_enforcement_profile();
+      END IF;
+    END
+    $billing_enforcement_account_trigger$
+  `);
+}
+//# sourceMappingURL=postgres-enforcement-profile-schema.js.map

package/node_modules/@noodle-borg/service/dist/billing/postgres-enforcement-profile-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-enforcement-profile-schema.js","sourceRoot":"","sources":["../../src/billing/postgres-enforcement-profile-schema.ts"],"names":[],"mappings":"AAEA,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,IAAU;IACpE,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;GAehB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;GAiBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;GAQhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;GAchB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;GAgBhB,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/billing/postgres-enforcement-profile.d.ts

@@ -0,0 +1,18 @@
+import type { Pool, PoolClient } from 'pg';
+import type { ControlPlaneIdentity } from '../auth/deploy-gate.js';
+import { type BillingAccountEnforcementProfileRecord, type BillingEnforcementCohortSealRequest, type BillingEnforcementCohortSealResponse, type BillingEnforcementCohortStatusResponse } from './enforcement-profile.js';
+export declare const BILLING_ENFORCEMENT_COHORT_LIFECYCLE_LOCK_KEY = "billing-enforcement-cohort-seal:legacy-internal-v1";
+export declare function getEnforcementCohortStatusRow(pool: Pool): Promise<BillingEnforcementCohortStatusResponse>;
+export declare function getActiveBillingAccountEnforcementProfileRow(pool: Pool, billingAccountId: string): Promise<BillingAccountEnforcementProfileRecord | undefined>;
+export declare function sealEnforcementCohortRow(pool: Pool, input: {
+    readonly request: BillingEnforcementCohortSealRequest;
+    readonly actor: ControlPlaneIdentity;
+    readonly service: string;
+}): Promise<BillingEnforcementCohortSealResponse>;
+/**
+ * Application-side defense in depth after account insertion. The database trigger normally creates the
+ * profile first; the active-profile lookup keeps this helper idempotent with that trigger-created state.
+ */
+export declare function ensurePostSealBillingAccountEnforcementProfileTx(client: PoolClient, billingAccountId: string): Promise<BillingAccountEnforcementProfileRecord | undefined>;
+export declare function requireBillingAccountEnforcementProfileIfSealedTx(client: PoolClient, billingAccountId: string): Promise<void>;
+//# sourceMappingURL=postgres-enforcement-profile.d.ts.map

package/node_modules/@noodle-borg/service/dist/billing/postgres-enforcement-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-enforcement-profile.d.ts","sourceRoot":"","sources":["../../src/billing/postgres-enforcement-profile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAkB,MAAM,IAAI,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAEL,KAAK,sCAAsC,EAE3C,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EAEzC,KAAK,sCAAsC,EAM5C,MAAM,0BAA0B,CAAC;AAKlC,eAAO,MAAM,6CAA6C,uDACJ,CAAC;AA6BvD,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,sCAAsC,CAAC,CAajD;AAED,wBAAgB,4CAA4C,CAC1D,IAAI,EAAE,IAAI,EACV,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,sCAAsC,GAAG,SAAS,CAAC,CAK7D;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE;IACL,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACA,OAAO,CAAC,oCAAoC,CAAC,CA4H/C;AAED;;;GAGG;AACH,wBAAsB,gDAAgD,CACpE,MAAM,EAAE,UAAU,EAClB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,sCAAsC,GAAG,SAAS,CAAC,CAsB7D;AAED,wBAAsB,iDAAiD,CACrE,MAAM,EAAE,UAAU,EAClB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAOf"}