@opengeni/db 0.31.1 → 0.36.1

package/dist/chunk-FPVAD4CO.js

@@ -0,0 +1,117 @@
+import {
+  rawRows,
+  rlsContextForWorkspace,
+  withWorkspaceSubjectRls,
+  withWorkspaceSubjectSessionActivityRls
+} from "./chunk-Z7VYMNPZ.js";
+
+// src/session-tenancy.ts
+import { createHash } from "crypto";
+import { sql } from "drizzle-orm";
+function canonicalSessionVisibilityTransitionHash(input) {
+  return createHash("sha256").update(
+    JSON.stringify({
+      version: 1,
+      sessionId: input.sessionId,
+      targetVisibility: input.targetVisibility,
+      expectedAuthorityEpoch: input.expectedAuthorityEpoch
+    })
+  ).digest("hex");
+}
+function canonicalSessionForkHash(input) {
+  return createHash("sha256").update(
+    JSON.stringify({
+      version: 1,
+      sourceSessionId: input.sourceSessionId,
+      destinationWorkspaceId: input.destinationWorkspaceId,
+      destinationVisibility: input.destinationVisibility
+    })
+  ).digest("hex");
+}
+async function transitionSessionVisibility(db, input) {
+  if (!Number.isSafeInteger(input.expectedAuthorityEpoch) || input.expectedAuthorityEpoch < 1) {
+    throw new Error("expectedAuthorityEpoch must be a positive safe integer");
+  }
+  if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
+  const requestHash = canonicalSessionVisibilityTransitionHash(input);
+  const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);
+  return await withWorkspaceSubjectSessionActivityRls(
+    db,
+    input.workspaceId,
+    input.actorSubjectId,
+    async (scopedDb) => {
+      const rows = await rawRows(
+        scopedDb,
+        sql`select
+          operation_id as "operationId",
+          visibility,
+          authority_epoch as "authorityEpoch",
+          owner_organization_membership_id as "ownerOrganizationMembershipId",
+          changed,
+          replay,
+          interrupted_attempt_count as "interruptedAttemptCount",
+          cancelled_turn_count as "cancelledTurnCount",
+          cancelled_update_count as "cancelledUpdateCount",
+          paused_goal_count as "pausedGoalCount",
+          revoked_grant_count as "revokedGrantCount"
+        from transition_session_visibility(
+          ${accountId}::uuid,
+          ${input.workspaceId}::uuid,
+          ${input.sessionId}::uuid,
+          ${input.actorSubjectId},
+          ${input.targetVisibility},
+          ${input.expectedAuthorityEpoch},
+          ${input.operationKey},
+          ${requestHash}
+        )`
+      );
+      const result = rows[0];
+      if (!result) throw new Error("Session visibility transition returned no result");
+      return result;
+    }
+  );
+}
+async function forkSessionContent(db, input) {
+  if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
+  const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
+  const requestHash = canonicalSessionForkHash(input);
+  return await withWorkspaceSubjectRls(
+    db,
+    input.sourceWorkspaceId,
+    input.actorSubjectId,
+    async (scopedDb) => {
+      const rows = await rawRows(
+        scopedDb,
+        sql`select
+          operation_id as "operationId",
+          session_id as "sessionId",
+          workspace_id as "workspaceId",
+          visibility,
+          authority_epoch as "authorityEpoch",
+          copied_history_item_count as "copiedHistoryItemCount",
+          replay
+        from fork_session_content(
+          ${accountId}::uuid,
+          ${input.sourceWorkspaceId}::uuid,
+          ${input.sourceSessionId}::uuid,
+          ${input.actorSubjectId},
+          ${input.destinationWorkspaceId}::uuid,
+          ${input.destinationVisibility},
+          ${input.operationKey},
+          ${requestHash}
+        )`
+      );
+      const result = rows[0];
+      if (!result) throw new Error("Session fork returned no result");
+      return result;
+    }
+  );
+}
+
+export {
+  canonicalSessionVisibilityTransitionHash,
+  canonicalSessionForkHash,
+  transitionSessionVisibility,
+  forkSessionContent
+};
+//# sourceMappingURL=chunk-FPVAD4CO.js.map

package/dist/chunk-FPVAD4CO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session-tenancy.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { sql } from \"drizzle-orm\";\nimport {\n  rawRows,\n  type Database,\n  rlsContextForWorkspace,\n  withWorkspaceSubjectRls,\n  withWorkspaceSubjectSessionActivityRls,\n} from \"./database\";\n\nexport type SessionTenancyVisibility = \"user_private\" | \"workspace_shared\";\n\nexport type TransitionSessionVisibilityInput = {\n  workspaceId: string;\n  sessionId: string;\n  actorSubjectId: string;\n  targetVisibility: SessionTenancyVisibility;\n  expectedAuthorityEpoch: number;\n  operationKey: string;\n};\n\nexport type TransitionSessionVisibilityResult = {\n  operationId: string;\n  visibility: SessionTenancyVisibility;\n  authorityEpoch: number;\n  ownerOrganizationMembershipId: string | null;\n  changed: boolean;\n  replay: boolean;\n  interruptedAttemptCount: number;\n  cancelledTurnCount: number;\n  cancelledUpdateCount: number;\n  pausedGoalCount: number;\n  revokedGrantCount: number;\n};\n\nexport type ForkSessionContentInput = {\n  sourceWorkspaceId: string;\n  sourceSessionId: string;\n  actorSubjectId: string;\n  destinationWorkspaceId: string;\n  destinationVisibility: SessionTenancyVisibility;\n  operationKey: string;\n};\n\nexport type ForkSessionContentResult = {\n  operationId: string;\n  sessionId: string;\n  workspaceId: string;\n  visibility: SessionTenancyVisibility;\n  authorityEpoch: number;\n  copiedHistoryItemCount: number;\n  replay: boolean;\n};\n\nexport function canonicalSessionVisibilityTransitionHash(\n  input: Pick<\n    TransitionSessionVisibilityInput,\n    \"sessionId\" | \"targetVisibility\" | \"expectedAuthorityEpoch\"\n  >,\n): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        version: 1,\n        sessionId: input.sessionId,\n        targetVisibility: input.targetVisibility,\n        expectedAuthorityEpoch: input.expectedAuthorityEpoch,\n      }),\n    )\n    .digest(\"hex\");\n}\n\nexport function canonicalSessionForkHash(\n  input: Pick<\n    ForkSessionContentInput,\n    \"sourceSessionId\" | \"destinationWorkspaceId\" | \"destinationVisibility\"\n  >,\n): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        version: 1,\n        sourceSessionId: input.sourceSessionId,\n        destinationWorkspaceId: input.destinationWorkspaceId,\n        destinationVisibility: input.destinationVisibility,\n      }),\n    )\n    .digest(\"hex\");\n}\n\nexport async function transitionSessionVisibility(\n  db: Database,\n  input: TransitionSessionVisibilityInput,\n): Promise<TransitionSessionVisibilityResult> {\n  if (!Number.isSafeInteger(input.expectedAuthorityEpoch) || input.expectedAuthorityEpoch < 1) {\n    throw new Error(\"expectedAuthorityEpoch must be a positive safe integer\");\n  }\n  if (!input.operationKey.trim()) throw new Error(\"operationKey must not be empty\");\n  const requestHash = canonicalSessionVisibilityTransitionHash(input);\n  const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);\n  return await withWorkspaceSubjectSessionActivityRls(\n    db,\n    input.workspaceId,\n    input.actorSubjectId,\n    async (scopedDb) => {\n      const rows = await rawRows<{\n        operationId: string;\n        visibility: SessionTenancyVisibility;\n        authorityEpoch: number;\n        ownerOrganizationMembershipId: string | null;\n        changed: boolean;\n        replay: boolean;\n        interruptedAttemptCount: number;\n        cancelledTurnCount: number;\n        cancelledUpdateCount: number;\n        pausedGoalCount: number;\n        revokedGrantCount: number;\n      }>(\n        scopedDb,\n        sql`select\n          operation_id as \"operationId\",\n          visibility,\n          authority_epoch as \"authorityEpoch\",\n          owner_organization_membership_id as \"ownerOrganizationMembershipId\",\n          changed,\n          replay,\n          interrupted_attempt_count as \"interruptedAttemptCount\",\n          cancelled_turn_count as \"cancelledTurnCount\",\n          cancelled_update_count as \"cancelledUpdateCount\",\n          paused_goal_count as \"pausedGoalCount\",\n          revoked_grant_count as \"revokedGrantCount\"\n        from transition_session_visibility(\n          ${accountId}::uuid,\n          ${input.workspaceId}::uuid,\n          ${input.sessionId}::uuid,\n          ${input.actorSubjectId},\n          ${input.targetVisibility},\n          ${input.expectedAuthorityEpoch},\n          ${input.operationKey},\n          ${requestHash}\n        )`,\n      );\n      const result = rows[0];\n      if (!result) throw new Error(\"Session visibility transition returned no result\");\n      return result;\n    },\n  );\n}\n\nexport async function forkSessionContent(\n  db: Database,\n  input: ForkSessionContentInput,\n): Promise<ForkSessionContentResult> {\n  if (!input.operationKey.trim()) throw new Error(\"operationKey must not be empty\");\n  const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);\n  const requestHash = canonicalSessionForkHash(input);\n  return await withWorkspaceSubjectRls(\n    db,\n    input.sourceWorkspaceId,\n    input.actorSubjectId,\n    async (scopedDb) => {\n      const rows = await rawRows<ForkSessionContentResult>(\n        scopedDb,\n        sql`select\n          operation_id as \"operationId\",\n          session_id as \"sessionId\",\n          workspace_id as \"workspaceId\",\n          visibility,\n          authority_epoch as \"authorityEpoch\",\n          copied_history_item_count as \"copiedHistoryItemCount\",\n          replay\n        from fork_session_content(\n          ${accountId}::uuid,\n          ${input.sourceWorkspaceId}::uuid,\n          ${input.sourceSessionId}::uuid,\n          ${input.actorSubjectId},\n          ${input.destinationWorkspaceId}::uuid,\n          ${input.destinationVisibility},\n          ${input.operationKey},\n          ${requestHash}\n        )`,\n      );\n      const result = rows[0];\n      if (!result) throw new Error(\"Session fork returned no result\");\n      return result;\n    },\n  );\n}\n"],"mappings":";;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,WAAW;AAqDb,SAAS,yCACd,OAIQ;AACR,SAAO,WAAW,QAAQ,EACvB;AAAA,IACC,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,MACT,WAAW,MAAM;AAAA,MACjB,kBAAkB,MAAM;AAAA,MACxB,wBAAwB,MAAM;AAAA,IAChC,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACjB;AAEO,SAAS,yBACd,OAIQ;AACR,SAAO,WAAW,QAAQ,EACvB;AAAA,IACC,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,MACT,iBAAiB,MAAM;AAAA,MACvB,wBAAwB,MAAM;AAAA,MAC9B,uBAAuB,MAAM;AAAA,IAC/B,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACjB;AAEA,eAAsB,4BACpB,IACA,OAC4C;AAC5C,MAAI,CAAC,OAAO,cAAc,MAAM,sBAAsB,KAAK,MAAM,yBAAyB,GAAG;AAC3F,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,CAAC,MAAM,aAAa,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AAChF,QAAM,cAAc,yCAAyC,KAAK;AAClE,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,WAAW;AACxE,SAAO,MAAM;AAAA,IACX;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO,aAAa;AAClB,YAAM,OAAO,MAAM;AAAA,QAajB;AAAA,QACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAaI,SAAS;AAAA,YACT,MAAM,WAAW;AAAA,YACjB,MAAM,SAAS;AAAA,YACf,MAAM,cAAc;AAAA,YACpB,MAAM,gBAAgB;AAAA,YACtB,MAAM,sBAAsB;AAAA,YAC5B,MAAM,YAAY;AAAA,YAClB,WAAW;AAAA;AAAA,MAEjB;AACA,YAAM,SAAS,KAAK,CAAC;AACrB,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,kDAAkD;AAC/E,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,mBACpB,IACA,OACmC;AACnC,MAAI,CAAC,MAAM,aAAa,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AAChF,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,iBAAiB;AAC9E,QAAM,cAAc,yBAAyB,KAAK;AAClD,SAAO,MAAM;AAAA,IACX;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO,aAAa;AAClB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YASI,SAAS;AAAA,YACT,MAAM,iBAAiB;AAAA,YACvB,MAAM,eAAe;AAAA,YACrB,MAAM,cAAc;AAAA,YACpB,MAAM,sBAAsB;AAAA,YAC5B,MAAM,qBAAqB;AAAA,YAC3B,MAAM,YAAY;AAAA,YAClB,WAAW;AAAA;AAAA,MAEjB;AACA,YAAM,SAAS,KAAK,CAAC;AACrB,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iCAAiC;AAC9D,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-GYO7ED2Q.js

@@ -0,0 +1,259 @@
+import {
+  nestedPostgresSqlState,
+  rawRows
+} from "./chunk-Z7VYMNPZ.js";
+
+// src/canonical-human-identities.ts
+import { createHash } from "crypto";
+import {
+  CanonicalHumanIdentityMutationResponse,
+  CanonicalHumanIdentityProjection
+} from "@opengeni/contracts/canonical-human-identities";
+import { sql } from "drizzle-orm";
+var CanonicalHumanIdentityConflictError = class extends Error {
+  name = "CanonicalHumanIdentityConflictError";
+  code = "CANONICAL_HUMAN_IDENTITY_CONFLICT";
+  constructor() {
+    super("The canonical human identity changed in another request");
+  }
+};
+var CanonicalHumanIdentityOperationReuseError = class extends Error {
+  name = "CanonicalHumanIdentityOperationReuseError";
+  code = "CANONICAL_HUMAN_IDENTITY_OPERATION_REUSED";
+  constructor() {
+    super("The canonical human identity operation id was already used for another request");
+  }
+};
+var CanonicalHumanIdentityNotFoundError = class extends Error {
+  name = "CanonicalHumanIdentityNotFoundError";
+  constructor(message = "Canonical human identity was not found") {
+    super(message);
+  }
+};
+var CanonicalHumanIdentityAuthorityError = class extends Error {
+  name = "CanonicalHumanIdentityAuthorityError";
+};
+function deterministicOperationId(seed) {
+  const bytes = createHash("sha256").update(seed, "utf8").digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function projectionValue(value) {
+  if (typeof value === "string") return JSON.parse(value);
+  return value;
+}
+function mapSqlError(error) {
+  const state = nestedPostgresSqlState(error);
+  if (state === "40001") throw new CanonicalHumanIdentityConflictError();
+  if (state === "23505") throw new CanonicalHumanIdentityOperationReuseError();
+  if (state === "P0002") throw new CanonicalHumanIdentityNotFoundError();
+  if (state === "42501") {
+    throw new CanonicalHumanIdentityAuthorityError(
+      error instanceof Error ? error.message : "Canonical human identity authority denied"
+    );
+  }
+  throw error;
+}
+async function ensureCanonicalHumanIdentity(db, input) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`
+        select
+          identity_id as "identityId",
+          identity_revision as "identityRevision",
+          auth_revision as "authRevision",
+          identity_status as "identityStatus"
+        from ensure_canonical_human_identity(${input.authUserId}, ${input.displayName})
+      `
+    );
+    if (!row) throw new CanonicalHumanIdentityNotFoundError();
+    return {
+      identityId: row.identityId,
+      identityRevision: Number(row.identityRevision),
+      authRevision: Number(row.authRevision),
+      identityStatus: row.identityStatus
+    };
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function ensureCanonicalHumanIdentityForAuthUser(db, authUserId) {
+  const [user] = await rawRows(
+    db,
+    sql`
+      select coalesce(nullif(btrim(name), ''), email) as "displayName"
+      from auth_users
+      where id = ${authUserId}
+      limit 1
+    `
+  );
+  if (!user) throw new CanonicalHumanIdentityNotFoundError("Authentication user was not found");
+  return await ensureCanonicalHumanIdentity(db, {
+    authUserId,
+    displayName: user.displayName
+  });
+}
+async function synchronizeCanonicalHumanLoginBindings(db, authUserId) {
+  let authority = await ensureCanonicalHumanIdentityForAuthUser(db, authUserId);
+  const accounts = await rawRows(
+    db,
+    sql`
+      select
+        id,
+        lower(provider_id) as "providerId",
+        account_id as "providerAccountId"
+      from auth_identities
+      where user_id = ${authUserId}
+      order by created_at, id
+    `
+  );
+  for (const account of accounts) {
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      const projection = await getCanonicalHumanIdentityProjection(db, authUserId);
+      if (projection.activeIdentity.status !== "active") {
+        return {
+          identityId: projection.activeIdentity.id,
+          identityRevision: projection.activeIdentity.identityRevision,
+          authRevision: projection.activeIdentity.authRevision,
+          identityStatus: projection.activeIdentity.status
+        };
+      }
+      const existing = projection.loginBindings.find(
+        (binding) => binding.providerId === account.providerId && binding.providerAccountId === account.providerAccountId
+      );
+      if (existing?.status === "active") {
+        authority = {
+          identityId: projection.activeIdentity.id,
+          identityRevision: projection.activeIdentity.identityRevision,
+          authRevision: projection.activeIdentity.authRevision,
+          identityStatus: projection.activeIdentity.status
+        };
+        break;
+      }
+      try {
+        const result = await applyCanonicalHumanIdentityOperation(db, {
+          operationId: deterministicOperationId(
+            `canonical-human-account-link
+${account.id}
+${projection.activeIdentity.identityRevision}`
+          ),
+          authUserId,
+          expectedIdentityRevision: projection.activeIdentity.identityRevision,
+          operationType: "link",
+          providerId: account.providerId,
+          providerAccountId: account.providerAccountId,
+          reason: "Synchronize verified authentication account"
+        });
+        authority = {
+          identityId: result.identity.activeIdentity.id,
+          identityRevision: result.identity.activeIdentity.identityRevision,
+          authRevision: result.identity.activeIdentity.authRevision,
+          identityStatus: result.identity.activeIdentity.status
+        };
+        break;
+      } catch (error) {
+        if (error instanceof CanonicalHumanIdentityConflictError && attempt < 3) continue;
+        if (error instanceof CanonicalHumanIdentityAuthorityError) {
+          const currentProjection = await getCanonicalHumanIdentityProjection(db, authUserId);
+          if (currentProjection.activeIdentity.status !== "active") {
+            return {
+              identityId: currentProjection.activeIdentity.id,
+              identityRevision: currentProjection.activeIdentity.identityRevision,
+              authRevision: currentProjection.activeIdentity.authRevision,
+              identityStatus: currentProjection.activeIdentity.status
+            };
+          }
+        }
+        throw error;
+      }
+    }
+  }
+  return authority;
+}
+async function validateCanonicalHumanSession(db, input) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`
+        select validate_canonical_human_session(
+          ${input.authSessionId},
+          ${input.authUserId},
+          ${input.allowRecovery ?? false}
+        ) as valid
+      `
+    );
+    return row?.valid === true;
+  } catch (error) {
+    mapSqlError(error);
+  }
+}
+async function getCanonicalHumanIdentityProjection(db, authUserId) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`
+        select get_canonical_human_identity_projection(${authUserId}) as projection
+      `
+    );
+    if (row?.projection === null || row?.projection === void 0) {
+      throw new CanonicalHumanIdentityNotFoundError();
+    }
+    return CanonicalHumanIdentityProjection.parse(projectionValue(row.projection));
+  } catch (error) {
+    if (error instanceof CanonicalHumanIdentityNotFoundError) throw error;
+    mapSqlError(error);
+  }
+}
+async function applyCanonicalHumanIdentityOperation(db, input) {
+  try {
+    const [row] = await rawRows(
+      db,
+      sql`
+        select
+          outcome,
+          identity_id as "identityId",
+          identity_revision as "identityRevision",
+          auth_revision as "authRevision"
+        from apply_canonical_human_identity_operation(
+          ${input.operationId},
+          ${input.authUserId},
+          ${input.expectedIdentityRevision},
+          ${input.operationType},
+          ${input.bindingId ?? null},
+          ${input.providerId ?? null},
+          ${input.providerAccountId ?? null},
+          ${input.reason}
+        )
+      `
+    );
+    if (!row) throw new CanonicalHumanIdentityNotFoundError();
+    const identity = await getCanonicalHumanIdentityProjection(db, input.authUserId);
+    return CanonicalHumanIdentityMutationResponse.parse({
+      outcome: row.outcome,
+      operationId: input.operationId,
+      identity
+    });
+  } catch (error) {
+    if (error instanceof CanonicalHumanIdentityConflictError || error instanceof CanonicalHumanIdentityOperationReuseError || error instanceof CanonicalHumanIdentityNotFoundError || error instanceof CanonicalHumanIdentityAuthorityError) {
+      throw error;
+    }
+    mapSqlError(error);
+  }
+}
+
+export {
+  CanonicalHumanIdentityConflictError,
+  CanonicalHumanIdentityOperationReuseError,
+  CanonicalHumanIdentityNotFoundError,
+  CanonicalHumanIdentityAuthorityError,
+  ensureCanonicalHumanIdentity,
+  ensureCanonicalHumanIdentityForAuthUser,
+  synchronizeCanonicalHumanLoginBindings,
+  validateCanonicalHumanSession,
+  getCanonicalHumanIdentityProjection,
+  applyCanonicalHumanIdentityOperation
+};
+//# sourceMappingURL=chunk-GYO7ED2Q.js.map

package/dist/chunk-GYO7ED2Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n  CanonicalHumanIdentityMutationResponse,\n  CanonicalHumanIdentityProjection,\n  type CanonicalHumanIdentityMutationOutcome,\n  type CanonicalHumanIdentityMutationResponse as CanonicalHumanIdentityMutationResponseType,\n  type CanonicalHumanIdentityProjection as CanonicalHumanIdentityProjectionType,\n} from \"@opengeni/contracts/canonical-human-identities\";\nimport { sql } from \"drizzle-orm\";\nimport type { Database } from \"./database\";\nimport { rawRows } from \"./database\";\nimport { nestedPostgresSqlState } from \"./persistence-errors\";\n\nexport type CanonicalHumanSessionAuthority = {\n  identityId: string;\n  identityRevision: number;\n  authRevision: number;\n  identityStatus: \"active\" | \"recovery_required\" | \"disputed\" | \"disabled\";\n};\n\nexport class CanonicalHumanIdentityConflictError extends Error {\n  readonly name = \"CanonicalHumanIdentityConflictError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_CONFLICT\";\n\n  constructor() {\n    super(\"The canonical human identity changed in another request\");\n  }\n}\n\nexport class CanonicalHumanIdentityOperationReuseError extends Error {\n  readonly name = \"CanonicalHumanIdentityOperationReuseError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_OPERATION_REUSED\";\n\n  constructor() {\n    super(\"The canonical human identity operation id was already used for another request\");\n  }\n}\n\nexport class CanonicalHumanIdentityNotFoundError extends Error {\n  readonly name = \"CanonicalHumanIdentityNotFoundError\";\n\n  constructor(message = \"Canonical human identity was not found\") {\n    super(message);\n  }\n}\n\nexport class CanonicalHumanIdentityAuthorityError extends Error {\n  readonly name = \"CanonicalHumanIdentityAuthorityError\";\n}\n\nfunction deterministicOperationId(seed: string): string {\n  const bytes = createHash(\"sha256\").update(seed, \"utf8\").digest().subarray(0, 16);\n  bytes[6] = (bytes[6]! & 0x0f) | 0x50;\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\nfunction projectionValue(value: unknown): unknown {\n  if (typeof value === \"string\") return JSON.parse(value);\n  return value;\n}\n\nfunction mapSqlError(error: unknown): never {\n  const state = nestedPostgresSqlState(error);\n  if (state === \"40001\") throw new CanonicalHumanIdentityConflictError();\n  if (state === \"23505\") throw new CanonicalHumanIdentityOperationReuseError();\n  if (state === \"P0002\") throw new CanonicalHumanIdentityNotFoundError();\n  if (state === \"42501\") {\n    throw new CanonicalHumanIdentityAuthorityError(\n      error instanceof Error ? error.message : \"Canonical human identity authority denied\",\n    );\n  }\n  throw error;\n}\n\nexport async function ensureCanonicalHumanIdentity(\n  db: Database,\n  input: { authUserId: string; displayName: string },\n): Promise<CanonicalHumanSessionAuthority> {\n  try {\n    const [row] = await rawRows<{\n      identityId: string;\n      identityRevision: number | string;\n      authRevision: number | string;\n      identityStatus: CanonicalHumanSessionAuthority[\"identityStatus\"];\n    }>(\n      db,\n      sql`\n        select\n          identity_id as \"identityId\",\n          identity_revision as \"identityRevision\",\n          auth_revision as \"authRevision\",\n          identity_status as \"identityStatus\"\n        from ensure_canonical_human_identity(${input.authUserId}, ${input.displayName})\n      `,\n    );\n    if (!row) throw new CanonicalHumanIdentityNotFoundError();\n    return {\n      identityId: row.identityId,\n      identityRevision: Number(row.identityRevision),\n      authRevision: Number(row.authRevision),\n      identityStatus: row.identityStatus,\n    };\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function ensureCanonicalHumanIdentityForAuthUser(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanSessionAuthority> {\n  const [user] = await rawRows<{ displayName: string }>(\n    db,\n    sql`\n      select coalesce(nullif(btrim(name), ''), email) as \"displayName\"\n      from auth_users\n      where id = ${authUserId}\n      limit 1\n    `,\n  );\n  if (!user) throw new CanonicalHumanIdentityNotFoundError(\"Authentication user was not found\");\n  return await ensureCanonicalHumanIdentity(db, {\n    authUserId,\n    displayName: user.displayName,\n  });\n}\n\nexport async function synchronizeCanonicalHumanLoginBindings(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanSessionAuthority> {\n  let authority = await ensureCanonicalHumanIdentityForAuthUser(db, authUserId);\n  const accounts = await rawRows<{\n    id: string;\n    providerId: string;\n    providerAccountId: string;\n  }>(\n    db,\n    sql`\n      select\n        id,\n        lower(provider_id) as \"providerId\",\n        account_id as \"providerAccountId\"\n      from auth_identities\n      where user_id = ${authUserId}\n      order by created_at, id\n    `,\n  );\n\n  for (const account of accounts) {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      const projection = await getCanonicalHumanIdentityProjection(db, authUserId);\n      if (projection.activeIdentity.status !== \"active\") {\n        return {\n          identityId: projection.activeIdentity.id,\n          identityRevision: projection.activeIdentity.identityRevision,\n          authRevision: projection.activeIdentity.authRevision,\n          identityStatus: projection.activeIdentity.status,\n        };\n      }\n      const existing = projection.loginBindings.find(\n        (binding) =>\n          binding.providerId === account.providerId &&\n          binding.providerAccountId === account.providerAccountId,\n      );\n      if (existing?.status === \"active\") {\n        authority = {\n          identityId: projection.activeIdentity.id,\n          identityRevision: projection.activeIdentity.identityRevision,\n          authRevision: projection.activeIdentity.authRevision,\n          identityStatus: projection.activeIdentity.status,\n        };\n        break;\n      }\n      try {\n        const result = await applyCanonicalHumanIdentityOperation(db, {\n          operationId: deterministicOperationId(\n            `canonical-human-account-link\\n${account.id}\\n${projection.activeIdentity.identityRevision}`,\n          ),\n          authUserId,\n          expectedIdentityRevision: projection.activeIdentity.identityRevision,\n          operationType: \"link\",\n          providerId: account.providerId,\n          providerAccountId: account.providerAccountId,\n          reason: \"Synchronize verified authentication account\",\n        });\n        authority = {\n          identityId: result.identity.activeIdentity.id,\n          identityRevision: result.identity.activeIdentity.identityRevision,\n          authRevision: result.identity.activeIdentity.authRevision,\n          identityStatus: result.identity.activeIdentity.status,\n        };\n        break;\n      } catch (error) {\n        if (error instanceof CanonicalHumanIdentityConflictError && attempt < 3) continue;\n        if (error instanceof CanonicalHumanIdentityAuthorityError) {\n          const currentProjection = await getCanonicalHumanIdentityProjection(db, authUserId);\n          if (currentProjection.activeIdentity.status !== \"active\") {\n            return {\n              identityId: currentProjection.activeIdentity.id,\n              identityRevision: currentProjection.activeIdentity.identityRevision,\n              authRevision: currentProjection.activeIdentity.authRevision,\n              identityStatus: currentProjection.activeIdentity.status,\n            };\n          }\n        }\n        throw error;\n      }\n    }\n  }\n  return authority;\n}\n\nexport async function validateCanonicalHumanSession(\n  db: Database,\n  input: { authSessionId: string; authUserId: string; allowRecovery?: boolean },\n): Promise<boolean> {\n  try {\n    const [row] = await rawRows<{ valid: boolean }>(\n      db,\n      sql`\n        select validate_canonical_human_session(\n          ${input.authSessionId},\n          ${input.authUserId},\n          ${input.allowRecovery ?? false}\n        ) as valid\n      `,\n    );\n    return row?.valid === true;\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function getCanonicalHumanIdentityProjection(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanIdentityProjectionType> {\n  try {\n    const [row] = await rawRows<{ projection: unknown }>(\n      db,\n      sql`\n        select get_canonical_human_identity_projection(${authUserId}) as projection\n      `,\n    );\n    if (row?.projection === null || row?.projection === undefined) {\n      throw new CanonicalHumanIdentityNotFoundError();\n    }\n    return CanonicalHumanIdentityProjection.parse(projectionValue(row.projection));\n  } catch (error) {\n    if (error instanceof CanonicalHumanIdentityNotFoundError) throw error;\n    mapSqlError(error);\n  }\n}\n\nexport type ApplyCanonicalHumanIdentityOperationInput = {\n  operationId: string;\n  authUserId: string;\n  expectedIdentityRevision: number;\n  operationType: \"link\" | \"unlink\" | \"begin_recovery\" | \"recover\";\n  bindingId?: string | null;\n  providerId?: string | null;\n  providerAccountId?: string | null;\n  reason: string;\n};\n\nexport async function applyCanonicalHumanIdentityOperation(\n  db: Database,\n  input: ApplyCanonicalHumanIdentityOperationInput,\n): Promise<CanonicalHumanIdentityMutationResponseType> {\n  try {\n    const [row] = await rawRows<{\n      outcome: CanonicalHumanIdentityMutationOutcome;\n      identityId: string;\n      identityRevision: number | string;\n      authRevision: number | string;\n    }>(\n      db,\n      sql`\n        select\n          outcome,\n          identity_id as \"identityId\",\n          identity_revision as \"identityRevision\",\n          auth_revision as \"authRevision\"\n        from apply_canonical_human_identity_operation(\n          ${input.operationId},\n          ${input.authUserId},\n          ${input.expectedIdentityRevision},\n          ${input.operationType},\n          ${input.bindingId ?? null},\n          ${input.providerId ?? null},\n          ${input.providerAccountId ?? null},\n          ${input.reason}\n        )\n      `,\n    );\n    if (!row) throw new CanonicalHumanIdentityNotFoundError();\n    const identity = await getCanonicalHumanIdentityProjection(db, input.authUserId);\n    return CanonicalHumanIdentityMutationResponse.parse({\n      outcome: row.outcome,\n      operationId: input.operationId,\n      identity,\n    });\n  } catch (error) {\n    if (\n      error instanceof CanonicalHumanIdentityConflictError ||\n      error instanceof CanonicalHumanIdentityOperationReuseError ||\n      error instanceof CanonicalHumanIdentityNotFoundError ||\n      error instanceof CanonicalHumanIdentityAuthorityError\n    ) {\n      throw error;\n    }\n    mapSqlError(error);\n  }\n}\n"],"mappings":";;;;;;AAAA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,WAAW;AAYb,IAAM,sCAAN,cAAkD,MAAM;AAAA,EACpD,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,yDAAyD;AAAA,EACjE;AACF;AAEO,IAAM,4CAAN,cAAwD,MAAM;AAAA,EAC1D,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,gFAAgF;AAAA,EACxF;AACF;AAEO,IAAM,sCAAN,cAAkD,MAAM;AAAA,EACpD,OAAO;AAAA,EAEhB,YAAY,UAAU,0CAA0C;AAC9D,UAAM,OAAO;AAAA,EACf;AACF;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAClB;AAEA,SAAS,yBAAyB,MAAsB;AACtD,QAAM,QAAQ,WAAW,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE;AAC/E,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC1G;AAEA,SAAS,gBAAgB,OAAyB;AAChD,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,MAAM,KAAK;AACtD,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,QAAM,QAAQ,uBAAuB,KAAK;AAC1C,MAAI,UAAU,QAAS,OAAM,IAAI,oCAAoC;AACrE,MAAI,UAAU,QAAS,OAAM,IAAI,0CAA0C;AAC3E,MAAI,UAAU,QAAS,OAAM,IAAI,oCAAoC;AACrE,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM;AACR;AAEA,eAAsB,6BACpB,IACA,OACyC;AACzC,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAMlB;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+CAMyC,MAAM,UAAU,KAAK,MAAM,WAAW;AAAA;AAAA,IAEjF;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,oCAAoC;AACxD,WAAO;AAAA,MACL,YAAY,IAAI;AAAA,MAChB,kBAAkB,OAAO,IAAI,gBAAgB;AAAA,MAC7C,cAAc,OAAO,IAAI,YAAY;AAAA,MACrC,gBAAgB,IAAI;AAAA,IACtB;AAAA,EACF,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,wCACpB,IACA,YACyC;AACzC,QAAM,CAAC,IAAI,IAAI,MAAM;AAAA,IACnB;AAAA,IACA;AAAA;AAAA;AAAA,mBAGe,UAAU;AAAA;AAAA;AAAA,EAG3B;AACA,MAAI,CAAC,KAAM,OAAM,IAAI,oCAAoC,mCAAmC;AAC5F,SAAO,MAAM,6BAA6B,IAAI;AAAA,IAC5C;AAAA,IACA,aAAa,KAAK;AAAA,EACpB,CAAC;AACH;AAEA,eAAsB,uCACpB,IACA,YACyC;AACzC,MAAI,YAAY,MAAM,wCAAwC,IAAI,UAAU;AAC5E,QAAM,WAAW,MAAM;AAAA,IAKrB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAMoB,UAAU;AAAA;AAAA;AAAA,EAGhC;AAEA,aAAW,WAAW,UAAU;AAC9B,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,YAAM,aAAa,MAAM,oCAAoC,IAAI,UAAU;AAC3E,UAAI,WAAW,eAAe,WAAW,UAAU;AACjD,eAAO;AAAA,UACL,YAAY,WAAW,eAAe;AAAA,UACtC,kBAAkB,WAAW,eAAe;AAAA,UAC5C,cAAc,WAAW,eAAe;AAAA,UACxC,gBAAgB,WAAW,eAAe;AAAA,QAC5C;AAAA,MACF;AACA,YAAM,WAAW,WAAW,cAAc;AAAA,QACxC,CAAC,YACC,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,sBAAsB,QAAQ;AAAA,MAC1C;AACA,UAAI,UAAU,WAAW,UAAU;AACjC,oBAAY;AAAA,UACV,YAAY,WAAW,eAAe;AAAA,UACtC,kBAAkB,WAAW,eAAe;AAAA,UAC5C,cAAc,WAAW,eAAe;AAAA,UACxC,gBAAgB,WAAW,eAAe;AAAA,QAC5C;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,qCAAqC,IAAI;AAAA,UAC5D,aAAa;AAAA,YACX;AAAA,EAAiC,QAAQ,EAAE;AAAA,EAAK,WAAW,eAAe,gBAAgB;AAAA,UAC5F;AAAA,UACA;AAAA,UACA,0BAA0B,WAAW,eAAe;AAAA,UACpD,eAAe;AAAA,UACf,YAAY,QAAQ;AAAA,UACpB,mBAAmB,QAAQ;AAAA,UAC3B,QAAQ;AAAA,QACV,CAAC;AACD,oBAAY;AAAA,UACV,YAAY,OAAO,SAAS,eAAe;AAAA,UAC3C,kBAAkB,OAAO,SAAS,eAAe;AAAA,UACjD,cAAc,OAAO,SAAS,eAAe;AAAA,UAC7C,gBAAgB,OAAO,SAAS,eAAe;AAAA,QACjD;AACA;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,uCAAuC,UAAU,EAAG;AACzE,YAAI,iBAAiB,sCAAsC;AACzD,gBAAM,oBAAoB,MAAM,oCAAoC,IAAI,UAAU;AAClF,cAAI,kBAAkB,eAAe,WAAW,UAAU;AACxD,mBAAO;AAAA,cACL,YAAY,kBAAkB,eAAe;AAAA,cAC7C,kBAAkB,kBAAkB,eAAe;AAAA,cACnD,cAAc,kBAAkB,eAAe;AAAA,cAC/C,gBAAgB,kBAAkB,eAAe;AAAA,YACnD;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,8BACpB,IACA,OACkB;AAClB,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA;AAAA,YAEM,MAAM,aAAa;AAAA,YACnB,MAAM,UAAU;AAAA,YAChB,MAAM,iBAAiB,KAAK;AAAA;AAAA;AAAA,IAGpC;AACA,WAAO,KAAK,UAAU;AAAA,EACxB,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,oCACpB,IACA,YAC+C;AAC/C,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,yDACmD,UAAU;AAAA;AAAA,IAE/D;AACA,QAAI,KAAK,eAAe,QAAQ,KAAK,eAAe,QAAW;AAC7D,YAAM,IAAI,oCAAoC;AAAA,IAChD;AACA,WAAO,iCAAiC,MAAM,gBAAgB,IAAI,UAAU,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,oCAAqC,OAAM;AAChE,gBAAY,KAAK;AAAA,EACnB;AACF;AAaA,eAAsB,qCACpB,IACA,OACqD;AACrD,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAMlB;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAOM,MAAM,WAAW;AAAA,YACjB,MAAM,UAAU;AAAA,YAChB,MAAM,wBAAwB;AAAA,YAC9B,MAAM,aAAa;AAAA,YACnB,MAAM,aAAa,IAAI;AAAA,YACvB,MAAM,cAAc,IAAI;AAAA,YACxB,MAAM,qBAAqB,IAAI;AAAA,YAC/B,MAAM,MAAM;AAAA;AAAA;AAAA,IAGpB;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,oCAAoC;AACxD,UAAM,WAAW,MAAM,oCAAoC,IAAI,MAAM,UAAU;AAC/E,WAAO,uCAAuC,MAAM;AAAA,MAClD,SAAS,IAAI;AAAA,MACb,aAAa,MAAM;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QACE,iBAAiB,uCACjB,iBAAiB,6CACjB,iBAAiB,uCACjB,iBAAiB,sCACjB;AACA,YAAM;AAAA,IACR;AACA,gBAAY,KAAK;AAAA,EACnB;AACF;","names":[]}

package/dist/{chunk-F5FT7BEZ.js → chunk-HSOWSYOX.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-ISI2TIUG.js";
+} from "./chunk-Z7VYMNPZ.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3532,4 +3532,4 @@ export {
   PostgresEditableArtifactStore,
   PostgresEditableArtifactLiveReadStore
 };
-//# sourceMappingURL=chunk-F5FT7BEZ.js.map
+//# sourceMappingURL=chunk-HSOWSYOX.js.map