cursedbelt 2.7.0 → 3.0.0

package/src/server/drivers/pooledControlStores.ts

@@ -1,197 +0,0 @@
-/**
- * The SHARED control-plane stores — the half of the saas profile that could not
- * exist until owner decision E17 (04 §1).
- *
- * A saas deployment is many API nodes and many workers. Two pieces of state
- * must be the SAME for all of them, and both had only per-node implementations:
- *
- *   • **the job-outcome log.** `SaasJobBroker`'s docstring promises that "a
- *     waiter on API node A sees a completion produced by worker B". The only
- *     stores were `bun:sqlite` (a file per node) and a heap map, so the promise
- *     was false in every real topology — a job completed by B left A's
- *     `awaitCompletion` polling a table that would never fill.
- *   • **the revoked-jti denylist.** `SessionSigner` already takes a
- *     `AsyncRevocationStore` seam, and the only implementation was a `Map` whose own
- *     docstring says "two OS processes do not share this". So a session revoked
- *     on node A stayed valid on node B until it expired — a promoted user's old
- *     token kept its old permissions wherever the revoke did not land, which is
- *     the exact failure `revokeUser` was written to prevent.
- *
- * Both are now the same thing: one table in the deployment's Postgres, reached
- * through the ONE pool the saas provider registers. Nothing here opens a socket
- * — the pool is injected (law #8), so a library never learns a connection
- * string.
- *
- * **Scoping lives in the query, and that is deliberate.** These are
- * control-plane tables, not domain tables: their maintenance verbs sweep every
- * tenant by design, and a revoked jti must be visible to a node that has not
- * resolved a tenant yet (that is what a denylist IS). So they carry no RLS
- * policy and are reached through `createPostgresControlExecutor`, which says so
- * at the call site rather than smuggling a placeholder tenant past the guard.
- * The tenant-predicated `WHERE` on the one read that returns rows is therefore
- * REQUIRED — the same law every `audit_log` read follows.
- */
-import {
-  createPostgresControlExecutor,
-  toPostgresDdl,
-  type SaasPool,
-  type StatementExecutor,
-} from 'cwip/storage';
-import type { AsyncRevocationStore } from '../guard/revocationStore';
-import {
-  createStatementJobResultStore,
-  JOB_RESULTS_DDL,
-  JOB_RESULTS_INDEX,
-  type JobResultStore,
-} from './jobResults';
-import { RETENTION_POLICY_DDL } from './retentionPolicy';
-import { SITE_COPY_DDL } from './siteCopy';
-
-/* ---------------------------------------------------------- pooled executor */
-
-/**
- * A {@link StatementExecutor} whose EVERY statement checks a connection out of
- * the pool and returns it.
- *
- * The shape matters, and the obvious alternative is a use-after-release bug:
- * `pool.withConnection(c => createPostgresControlExecutor(c))` hands back an
- * executor bound to a connection that has ALREADY gone back to the pool, so the
- * first statement it runs races whatever checked that socket out next. So the
- * checkout is per statement, exactly as `createPgJobResultStore` does it — the
- * store holds no connection of its own, because a long-lived one would be a
- * socket the pool is sized against but does not control.
- *
- * CONTROL-plane, so scoping lives in the query: these tables' maintenance verbs
- * (a retention sweep over every tenant's audit rows) are cross-tenant by design,
- * and a policy that hid the other tenants would make the sweep silently
- * incomplete. The tenant predicate on every read is therefore REQUIRED, which
- * `createStatementAuditTrailStore` enforces in its own `read`.
- */
-export const createPooledControlExecutor = (pool: SaasPool): StatementExecutor => {
-  const over = <T>(fn: (executor: StatementExecutor) => Promise<T>): Promise<T> =>
-    pool.withConnection(async (connection) => await fn(createPostgresControlExecutor(connection)));
-  return {
-    dialect: 'postgres',
-    all: (statement) => over((executor) => executor.all(statement)),
-    get: (statement) => over((executor) => executor.get(statement)),
-    write: (statement) => over((executor) => executor.write(statement)),
-  };
-};
-
-/* ------------------------------------------------------------- job results */
-
-/**
- * The durable outcome log over the deployment's pool.
- *
- * Every call checks a connection out and returns it: the store holds no
- * connection of its own, because a long-lived one would be a socket the pool is
- * sized against but does not control.
- */
-export const createPgJobResultStore = (pool: SaasPool): JobResultStore => {
-  const over = <T>(fn: (store: JobResultStore) => Promise<T>): Promise<T> =>
-    pool.withConnection(async (connection) => await fn(createStatementJobResultStore(createPostgresControlExecutor(connection))));
-
-  return {
-    record: (result) => over((store) => store.record(result)),
-    read: (id) => over((store) => store.read(id)),
-    list: (query) => over((store) => store.list(query)),
-    prune: (maxAgeMs) => over((store) => store.prune(maxAgeMs)),
-  };
-};
-
-/* -------------------------------------------------------------- revocation */
-
-export const REVOCATIONS_TABLE = 'cc_revocations';
-
-/**
- * `exp` is the token's own expiry in epoch SECONDS — the unit `SessionSigner`
- * already works in. Storing the expiry rather than the revocation time is what
- * makes `prune` a single comparison against `now` and keeps a denylist entry
- * exactly as long as the token it denies could still be presented.
- */
-export const REVOCATIONS_DDL = `CREATE TABLE IF NOT EXISTS ${REVOCATIONS_TABLE} (
-  jti TEXT PRIMARY KEY NOT NULL,
-  exp INTEGER NOT NULL
-)`;
-
-export const REVOCATIONS_INDEX = `CREATE INDEX IF NOT EXISTS cc_revocations_exp ON ${REVOCATIONS_TABLE}(exp)`;
-
-export const createPgRevocationStore = (pool: SaasPool): AsyncRevocationStore => ({
-  async set(jti, expEpochSeconds) {
-    await pool.withConnection(async (connection) => {
-      // Keep the LATER exp. Two nodes revoking the same jti with slightly
-      // different clocks must not SHORTEN the denial window — the memory store
-      // has the same rule, and a store that disagreed with it would make
-      // "revoked" mean something different per profile.
-      await createPostgresControlExecutor(connection).write({
-        sql: `INSERT INTO ${REVOCATIONS_TABLE} (jti, exp) VALUES (?, ?)
-              ON CONFLICT (jti) DO UPDATE SET exp = max(${REVOCATIONS_TABLE}.exp, excluded.exp)`,
-        pg: `INSERT INTO ${REVOCATIONS_TABLE} (jti, exp) VALUES (?, ?)
-             ON CONFLICT (jti) DO UPDATE SET exp = GREATEST(${REVOCATIONS_TABLE}.exp, excluded.exp)`,
-        params: [jti, expEpochSeconds],
-      });
-    });
-  },
-
-  async get(jti) {
-    return await pool.withConnection(async (connection) => {
-      const row = await createPostgresControlExecutor(connection).get<{ exp: number | string }>({
-        sql: `SELECT exp FROM ${REVOCATIONS_TABLE} WHERE jti = ?`,
-        params: [jti],
-      });
-      // A pg `bigint` arrives as a string; `null` means "not revoked" and must
-      // never be confused with an exp of 0.
-      return row === null ? null : Number(row.exp);
-    });
-  },
-
-  async prune(nowEpochSeconds) {
-    return await pool.withConnection(async (connection) => {
-      const result = await createPostgresControlExecutor(connection).write({
-        sql: `DELETE FROM ${REVOCATIONS_TABLE} WHERE exp <= ?`,
-        params: [nowEpochSeconds],
-      });
-      return result.changes;
-    });
-  },
-});
-
-/* ------------------------------------------------------------------ schema */
-
-/**
- * The control-plane chain, in the deployment's dialect.
- *
- * COMPILED from the SQLite source by `toPostgresDdl`, never hand-written: the
- * repo's standing law is that a Postgres chain is derived from the one an
- * author wrote and reviewed, so the two cannot drift a column apart. The
- * compiler refuses anything outside its closed grammar rather than guessing.
- */
-export const SAAS_CONTROL_PLANE_DDL: readonly string[] = [
-  JOB_RESULTS_DDL,
-  JOB_RESULTS_INDEX,
-  REVOCATIONS_DDL,
-  REVOCATIONS_INDEX,
-  // D30's retention windows. It belongs in THIS chain rather than in the
-  // retention job's own startup for the reason the next docstring gives: a
-  // shared database has one schema owner, and the maintenance cron is not it.
-  RETENTION_POLICY_DDL,
-  // D36's marketing-copy overrides (+ the platform-admin-tenant row). Same
-  // owner: the documented migration step, not whichever node first serves it.
-  SITE_COPY_DDL,
-].map(toPostgresDdl);
-
-/**
- * Create the control-plane tables if they are absent.
- *
- * Deliberately a NAMED, explicit call rather than something the stores do on
- * construction. A shared database has one schema owner, and a library that
- * issued DDL on every process start would be N of them racing — and would make
- * a read-only credential (the correct one for an API node that only reads the
- * denylist) fail at boot. A deployment calls this once, from a migration step
- * or a host that knows it holds the privilege.
- */
-export const ensureSaasControlPlaneSchema = async (pool: SaasPool): Promise<void> => {
-  await pool.withConnection(async (connection) => {
-    for (const statement of SAAS_CONTROL_PLANE_DDL) await connection.execute(statement, []);
-  });
-};

package/src/server/drivers/pooledIdentityStore.pg.test.ts

@@ -1,218 +0,0 @@
-/**
- * The saas identity tier against a REAL Postgres (04 §1a, owner decision E18).
- *
- * This suite is the whole justification for the port. The identity store exists
- * so that a user who signs up on node A can log in on node B, and that is a
- * claim about Postgres — not about TypeScript, and not about the SQLite suite in
- * `cwip/src/registry/identity.test.ts` that runs the same contract.
- *
- * What only the engine can answer for:
- *
- *   • the DDL, COMPILED from the SQLite source by `toPostgresDdl` — including
- *     the partial `UNIQUE INDEX … WHERE email IS NOT NULL`, which is the one
- *     piece of this schema that is easy to compile into something that silently
- *     means something else;
- *   • `ON CONFLICT (…) DO UPDATE SET … = excluded.…` on a COMPOSITE key;
- *   • `UPDATE … RETURNING *`, which the store now uses instead of write-then-read;
- *   • that a row signed on one connection VERIFIES on another — the HMAC covers
- *     column values, and a dialect that round-tripped a NULL or a timestamp
- *     differently would produce a signature mismatch on read rather than a
- *     visibly wrong value.
- *
- *   bun run test:pg          (starts a disposable container, runs, tears down)
- *   CC_PG_URL=postgres://…   (or point it at any throwaway database)
- *
- * SKIPPED, loudly, when `CC_PG_URL` is absent — the skip is a missing proof,
- * never a passing one. It runs nightly (`.github/workflows/nightly.yml`).
- */
-import { SQL } from 'bun';
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'bun:test';
-import { createRowSigner, mintMachineIntegrityKey } from 'cwip/guard';
-import type { RowIntegrityViolation, RowSigner } from 'cwip/guard';
-import type { RegistryIdentityStore } from 'cwip/cc-registry';
-import { RESERVED_TENANT_ID, RESERVED_USER_ID } from 'cwip/cc-registry';
-import type { SaasConnection, SaasPool } from 'cwip/storage';
-import { createPgIdentityStore, ensureSaasIdentitySchema } from './pooledIdentityStore';
-
-const URL_ = process.env.CC_PG_URL;
-
-let sql: SQL;
-let pool: SaasPool;
-let signer: RowSigner;
-let violations: RowIntegrityViolation[];
-let store: RegistryIdentityStore;
-
-const NOW = '2026-07-26T00:00:00.000Z';
-
-// SKIPPED unless CC_PG_URL names a throwaway Postgres — this suite's subject IS the engine. `bun run test:pg` supplies one.
-describe.skipIf(!URL_)('the saas identity tier against a real Postgres (04 §1a)', () => {
-  // 120s, not Bun's default 5s. This hook drops and re-creates a role, a database
-  // and a whole migration chain against a REAL Postgres; on a shared 4-core CI
-  // runner that has been measured at over five seconds, and the failure it
-  // produces is deeply misleading — the hook times out, the runner closes the
-  // connection mid-migration, and the log reads `MIGRATION_FAILED` /
-  // `ERR_POSTGRES_CONNECTION_CLOSED` as though the SQL were wrong. Observed on
-  // the 2026-07-27 nightly, one run after a green one.
-  beforeAll(async () => {
-    sql = new SQL(URL_ as string);
-    // A connection per call, checked out and returned — the discipline the real
-    // pool adapter has, so the store is exercised through the shape it ships
-    // with rather than a long-lived handle a test happens to hold.
-    const connection: SaasConnection = {
-      async query<R>(text: string, params: readonly unknown[] = []): Promise<R[]> {
-        return (await sql.unsafe(text, [...params])) as R[];
-      },
-      async execute(text: string, params: readonly unknown[] = []) {
-        const result = await sql.unsafe(text, [...params]);
-        return { rowCount: (result as { count?: number }).count ?? 0 };
-      },
-    };
-    pool = { async withConnection(fn) { return await fn(connection); } };
-
-    // Drop in FK order — memberships/invitations reference tenants and users.
-    for (const table of ['invitations', 'memberships', 'users', 'tenants'])
-      await sql.unsafe(`DROP TABLE IF EXISTS ${table} CASCADE`);
-    await ensureSaasIdentitySchema(pool);
-  }, 120_000);
-
-  afterAll(async () => {
-    await sql?.end();
-  });
-
-  beforeEach(async () => {
-    for (const table of ['invitations', 'memberships', 'users', 'tenants'])
-      await sql.unsafe(`DELETE FROM ${table}`);
-    violations = [];
-    signer = createRowSigner({ integrityKey: mintMachineIntegrityKey(), onViolation: (v) => violations.push(v) });
-    store = createPgIdentityStore(pool, { signer, now: () => NOW });
-  });
-
-  it('creates its schema idempotently — the chain is COMPILED, not hand-written', async () => {
-    // The second and third runs are the assertion: the injected `IF NOT EXISTS`
-    // has to survive compilation from the SQLite source, or a deployment's
-    // second migration run is a hard failure.
-    await ensureSaasIdentitySchema(pool);
-    await ensureSaasIdentitySchema(pool);
-  });
-
-  it('round-trips tenant → user → membership with a signature that verifies on a LATER connection', async () => {
-    await store.createTenant({ tenantId: 't_acme', title: 'Acme', planId: 'pro' });
-    await store.createUser({ userId: 'u_ann', email: 'ann@acme.test', pwEnvelope: '{"v":1}' });
-    await store.createMembership({
-      tenantId: 't_acme',
-      userId: 'u_ann',
-      role: 'ADMIN',
-      permissions: ['infra:write'],
-    });
-
-    // Each of these checks out its OWN connection — the signature has to survive
-    // the round trip through pg's type mapping, not just live in one session.
-    expect((await store.getTenant('t_acme'))?.planId).toBe('pro');
-    expect(await store.getUser('u_ann')).toMatchObject({ userId: 'u_ann', hasPassword: true, createdAt: NOW });
-    expect((await store.getMembership('t_acme', 'u_ann'))?.role).toBe('ADMIN');
-    expect((await store.membershipsForUser('u_ann')).map((m) => m.tenantId)).toEqual(['t_acme']);
-    expect(await store.verifyAll()).toEqual([]);
-    expect(violations).toEqual([]);
-  });
-
-  it('keeps a NULL email out of the signature mismatch trap', async () => {
-    // The failure this guards: pg returning `undefined` where SQLite returns
-    // `null` would change the signed serialization and make every passwordless
-    // user's next read a SECURITY_INTEGRITY_VIOLATION.
-    await store.createUser({ userId: 'u_nobody' });
-    expect(await store.getUser('u_nobody')).toMatchObject({ email: undefined, hasPassword: false });
-    expect(await store.passwordEnvelope('u_nobody')).toBeNull();
-    expect(await store.verifyAll()).toEqual([]);
-  });
-
-  it('upserts on a COMPOSITE key and re-signs the whole row', async () => {
-    await store.createTenant({ tenantId: 't_acme', title: 'Acme' });
-    await store.createUser({ userId: 'u_ann' });
-    await store.createMembership({ tenantId: 't_acme', userId: 'u_ann', role: 'VIEWER' });
-
-    expect((await store.changeRole('t_acme', 'u_ann', 'MEMBER'))?.role).toBe('MEMBER');
-    expect((await store.setMembershipPermissions('t_acme', 'u_ann', ['reports:read']))?.permissions).toEqual([
-      'reports:read',
-    ]);
-    // One row, not two: `ON CONFLICT (tenant_id, user_id)` has to bind the
-    // composite key, and a mis-compiled conflict target would insert a duplicate.
-    expect(await store.membersOfTenant('t_acme')).toHaveLength(1);
-    expect(await store.verifyAll()).toEqual([]);
-  });
-
-  it('UPDATE … RETURNING gives the caller the row in ONE statement', async () => {
-    await store.createTenant({ tenantId: 't_acme', title: 'Acme' });
-    expect((await store.renameTenant('t_acme', 'Acme Corp'))?.title).toBe('Acme Corp');
-    expect((await store.setTenantStatus('t_acme', 'suspended'))?.status).toBe('suspended');
-    // A miss returns no rows rather than throwing.
-    expect(await store.renameTenant('t_missing', 'Nope')).toBeNull();
-  });
-
-  it('enforces the PARTIAL unique-email index — the compile step most likely to lie', async () => {
-    await store.createUser({ userId: 'u_ann', email: 'dup@acme.test' });
-    await expect(store.createUser({ userId: 'u_bob', email: 'dup@acme.test' })).rejects.toThrow();
-    // …but many NULL emails are fine, which is the half a non-partial UNIQUE
-    // would silently break — and it would break it for every passwordless user
-    // at once, on the dialect with no local test.
-    await store.createUser({ userId: 'u_c' });
-    await store.createUser({ userId: 'u_d' });
-    expect((await store.getUser('u_d'))?.userId).toBe('u_d');
-  });
-
-  it('refuses a row tampered with directly in the database', async () => {
-    await store.createTenant({ tenantId: 't_acme', title: 'Acme' });
-    await store.createUser({ userId: 'u_ann' });
-    await store.createMembership({ tenantId: 't_acme', userId: 'u_ann', role: 'VIEWER' });
-
-    // The threat is a shell on the shared database, not a shell on one laptop —
-    // which is exactly why this has to hold on Postgres too.
-    await sql.unsafe("UPDATE memberships SET role = 'OWNER' WHERE tenant_id = 't_acme' AND user_id = 'u_ann'");
-
-    await expect(store.getMembership('t_acme', 'u_ann')).rejects.toThrow(
-      /SECURITY_INTEGRITY_VIOLATION|signature mismatch/i,
-    );
-    expect(violations).toHaveLength(1);
-    expect(await store.verifyAll()).toEqual(['memberships:t_acme/u_ann']);
-  });
-
-  it('single-use-accepts an invitation under a conditional UPDATE', async () => {
-    await store.createTenant({ tenantId: 't_acme', title: 'Acme' });
-    await store.createInvitation({
-      tokenHash: 'hash-1',
-      tenantId: 't_acme',
-      email: 'bob@acme.test',
-      role: 'MEMBER',
-      expiresAt: '2026-08-01T00:00:00.000Z',
-    });
-    expect((await store.acceptInvitation('hash-1'))?.acceptedAt).toBe(NOW);
-    // `WHERE accepted_at IS NULL` is what makes a replay a no-op rather than a
-    // second membership — the property two API nodes racing depend on.
-    expect(await store.acceptInvitation('hash-1')).toBeNull();
-  });
-
-  it('bootstraps and removes idempotently', async () => {
-    const first = await store.bootstrapLocalIdentity();
-    expect(first.tenant.tenantId).toBe(RESERVED_TENANT_ID);
-    expect(first.user.userId).toBe(RESERVED_USER_ID);
-    await store.bootstrapLocalIdentity();
-    expect(await store.membersOfTenant(RESERVED_TENANT_ID)).toHaveLength(1);
-
-    expect(await store.removeMembership(RESERVED_TENANT_ID, RESERVED_USER_ID)).toBe(true);
-    // `changes` has to come back from pg's rowCount, or a second delete would
-    // report success and a caller would believe it removed something twice.
-    expect(await store.removeMembership(RESERVED_TENANT_ID, RESERVED_USER_ID)).toBe(false);
-  });
-
-  it('REFUSES a schema whose signed table grew an uncovered column', async () => {
-    // The silent-tamper hole: a column outside `*_COLUMN_ORDER` is outside the
-    // HMAC, so it can be edited freely while every read still reports verified.
-    // The local path catches this with PRAGMA table_info; Postgres has no
-    // PRAGMA, so `ensureSaasIdentitySchema` is where the equivalent check lives.
-    await sql.unsafe('ALTER TABLE users ADD COLUMN sneaky TEXT');
-    try {
-      await expect(ensureSaasIdentitySchema(pool)).rejects.toThrow(/sneaky|coverage|signed/i);
-    } finally {
-      await sql.unsafe('ALTER TABLE users DROP COLUMN sneaky');
-    }
-  });
-});

package/src/server/drivers/pooledIdentityStore.ts

@@ -1,184 +0,0 @@
-/**
- * The saas identity tier (04 §1a, owner decision E18/D10) — `tenants`, `users`,
- * `memberships` and `invitations` on the deployment's pooled Postgres.
- *
- * ## Why this had to exist before a saas app could boot
- *
- * V2 REFUSES a saas config without the `guard` engine (`engine-dependency-
- * missing`), and `guard` needs a `resolveIdentity`. The only implementation was
- * `createRegistryIdentityStore` over `bun:sqlite` — a file on ONE machine. So
- * every saas branch in the codebase was unit-tested and unbootable: two API
- * nodes would each hold a different set of users, and "sign up on node A, 401 on
- * node B" is not a failure any single-process test can produce.
- *
- * The owner's decision (E18, Option A) was to port the SAME tables and the SAME
- * HMAC row-signing to the pooled Postgres, reached through the ONE injected pool
- * `createSaasHostServices` already owns. Options B (per-tenant SQLite on shared
- * storage) and C (an external IdP) were refused, not deferred.
- *
- * ## What is NOT here, on purpose
- *
- * There is no second copy of the identity SQL. `createStatementIdentityStore`
- * in `cwip/cc-registry` is the ONE implementation; this file supplies it a
- * pooled Postgres executor instead of a SQLite one, exactly as
- * `createPgJobResultStore` does for the outcome log. If you find yourself
- * writing an `INSERT INTO users` here, stop — the statement belongs in
- * `IDENTITY_STATEMENTS`, where both dialects read it.
- *
- * ## Why these tables use the CONTROL-PLANE executor, not `scopedExec`
- *
- * They are not tenant-rooted domain tables and cannot be governed by RLS:
- *
- *   • `users` is cross-tenant by construction — one human, many tenants — and a
- *     policy keyed on `app.tenant_id` would hide a user from their own login,
- *     which happens BEFORE any tenant is resolved.
- *   • `tenants` IS the tenant table; a tenant-isolation policy on it is circular.
- *   • `memberships` is the map that RESOLVES the tenant, so it must be readable
- *     before one is set.
- *
- * Scoping for these lives in the QUERY (`WHERE tenant_id = ?` on every listing
- * that returns rows), which is why `membersOfTenant` and `membershipsForUser`
- * are both predicated and neither has an unbounded variant.
- */
-import {
-  createStatementIdentityStore,
-  type RegistryIdentityStore,
-  type RegistryIdentityStoreOptions,
-} from 'cwip/cc-registry';
-import {
-  INVITATIONS_DDL,
-  MEMBERSHIPS_DDL,
-  MEMBERSHIPS_USER_INDEX,
-  TENANTS_DDL,
-  USERS_DDL,
-  USERS_EMAIL_INDEX,
-} from 'cwip/cc-registry-schema';
-import { assertSignedColumnCoverage } from 'cwip/guard';
-import { createPostgresControlExecutor, type SaasPool, toPostgresDdl } from 'cwip/storage';
-
-/**
- * The identity store over the deployment's pool.
- *
- * Every call checks a connection out and returns it. The store holds no
- * connection of its own — a long-lived one would be a socket the pool is sized
- * against but does not control, and identity reads happen on the hot path of
- * every authenticated request.
- *
- * Note what this does NOT do: it does not wrap multi-statement operations in a
- * transaction. Each method here is a single statement (the upserts are one
- * `ON CONFLICT`, the mutations use `RETURNING`), except the read-modify-write
- * pair behind `changeRole`/`setPassword`/`setMembershipStatus`, which re-signs
- * the whole row. Those are last-writer-wins across nodes, which is correct for
- * this data: two admins changing one member's role concurrently should end at
- * one of the two values, and the row signature makes either outcome verifiable.
- * What it must never do is end at a row whose signature does not match its
- * contents, and it cannot — the signature is computed from the row being
- * written, in the same statement.
- */
-export const createPgIdentityStore = (pool: SaasPool, options: RegistryIdentityStoreOptions): RegistryIdentityStore => {
-  const over = <T>(fn: (store: RegistryIdentityStore) => Promise<T>): Promise<T> =>
-    pool.withConnection(async (connection) =>
-      fn(createStatementIdentityStore(createPostgresControlExecutor(connection), options)),
-    );
-
-  return {
-    createTenant: (input) => over((s) => s.createTenant(input)),
-    getTenant: (id) => over((s) => s.getTenant(id)),
-    renameTenant: (id, title) => over((s) => s.renameTenant(id, title)),
-    setTenantStatus: (id, status) => over((s) => s.setTenantStatus(id, status)),
-    setTenantPlan: (id, planId) => over((s) => s.setTenantPlan(id, planId)),
-
-    createUser: (input) => over((s) => s.createUser(input)),
-    getUser: (id) => over((s) => s.getUser(id)),
-    getUserByEmail: (email) => over((s) => s.getUserByEmail(email)),
-    setUserStatus: (id, status) => over((s) => s.setUserStatus(id, status)),
-    setPassword: (id, envelope) => over((s) => s.setPassword(id, envelope)),
-    passwordEnvelope: (id) => over((s) => s.passwordEnvelope(id)),
-
-    createMembership: (input) => over((s) => s.createMembership(input)),
-    getMembership: (t, u) => over((s) => s.getMembership(t, u)),
-    membershipsForUser: (u) => over((s) => s.membershipsForUser(u)),
-    membersOfTenant: (t) => over((s) => s.membersOfTenant(t)),
-    changeRole: (t, u, role) => over((s) => s.changeRole(t, u, role)),
-    setMembershipPermissions: (t, u, perms) => over((s) => s.setMembershipPermissions(t, u, perms)),
-    setMembershipStatus: (t, u, status) => over((s) => s.setMembershipStatus(t, u, status)),
-    removeMembership: (t, u) => over((s) => s.removeMembership(t, u)),
-
-    createInvitation: (input) => over((s) => s.createInvitation(input)),
-    getInvitation: (hash) => over((s) => s.getInvitation(hash)),
-    acceptInvitation: (hash) => over((s) => s.acceptInvitation(hash)),
-
-    bootstrapLocalIdentity: () => over((s) => s.bootstrapLocalIdentity()),
-    verifyAll: () => over((s) => s.verifyAll()),
-  };
-};
-
-/* ------------------------------------------------------------------ schema */
-
-/**
- * Add `IF NOT EXISTS` to an authored DDL statement.
- *
- * The registry's DDL is authored WITHOUT the guard because it runs inside a
- * versioned migration chain, where a table that already exists means the
- * migration bookkeeping is wrong and should fail loudly. A shared database is
- * the opposite case: `ensureSaasIdentitySchema` is explicitly idempotent and may
- * be called by any deployment step that knows it holds the privilege.
- *
- * Injected here rather than by re-authoring the four statements, because a
- * second copy of a CREATE TABLE differing by three words is precisely the drift
- * the compile-from-source rule exists to prevent.
- */
-const ifNotExists = (ddl: string): string =>
-  ddl
-    .replace(/^(\s*CREATE\s+TABLE\s+)(?!IF\s+NOT\s+EXISTS)/i, '$1IF NOT EXISTS ')
-    .replace(/^(\s*CREATE\s+(?:UNIQUE\s+)?INDEX\s+)(?!IF\s+NOT\s+EXISTS)/i, '$1IF NOT EXISTS ');
-
-/**
- * The identity chain, in the deployment's dialect.
- *
- * COMPILED from the SQLite source by `toPostgresDdl`, never hand-written — the
- * same law the control-plane chain follows. Order matters: `memberships` and
- * `invitations` carry foreign keys into `tenants`/`users`.
- */
-export const SAAS_IDENTITY_DDL: readonly string[] = [
-  TENANTS_DDL,
-  USERS_DDL,
-  USERS_EMAIL_INDEX,
-  MEMBERSHIPS_DDL,
-  MEMBERSHIPS_USER_INDEX,
-  INVITATIONS_DDL,
-]
-  .map(ifNotExists)
-  .map(toPostgresDdl);
-
-/**
- * Create the identity tables if they are absent, and REFUSE a schema whose
- * signed tables have drifted.
- *
- * The second half is not decoration. `users` and `memberships` are in
- * `CC_SIGNED_TABLES`, and a column added to either without being added to its
- * `*_COLUMN_ORDER` is silently outside the HMAC — tamperable, with every read
- * still reporting "verified". The local path catches that eagerly in
- * `createRegistryIdentityStore` via `PRAGMA table_info`; Postgres has no PRAGMA,
- * so the equivalent check lives here, in the function that owns this schema.
- *
- * Deliberately a NAMED, explicit call rather than something the store does on
- * construction — a shared database has ONE schema owner, and a library issuing
- * DDL on every process start would be N of them racing.
- */
-export const ensureSaasIdentitySchema = async (pool: SaasPool): Promise<void> => {
-  await pool.withConnection(async (connection) => {
-    for (const statement of SAAS_IDENTITY_DDL) await connection.execute(statement, []);
-
-    for (const table of ['users', 'memberships'] as const) {
-      const rows = (await connection.query(
-        'SELECT column_name FROM information_schema.columns WHERE table_name = $1',
-        [table],
-      )) as Array<{ column_name: string }>;
-      assertSignedColumnCoverage(
-        table,
-        rows.map((row) => row.column_name),
-      );
-    }
-  });
-};