cursedbelt 2.7.0 → 3.0.0

package/dist/server/drivers/pooledControlStores.pg.test.js

@@ -1,136 +0,0 @@
-/**
- * The SHARED control-plane stores against a REAL Postgres (04 §1).
- *
- * These two stores exist for exactly one reason — to be the same rows on every
- * node — and that claim is a claim about Postgres, not about TypeScript. A fake
- * pool can prove the plumbing (one pool, a connection per call, a tenant
- * predicate on the listing) and `pooledControlStores.spec.ts` does. It cannot
- * prove the SQL: `ON CONFLICT DO NOTHING`, `GREATEST`, `bigint`-as-string, and
- * the compiled DDL are all things only the engine can answer for, and a fake
- * that answered them would be answering with our own assumptions.
- *
- *   bun run test:pg          (starts a disposable container, runs, tears down)
- *   CC_PG_URL=postgres://…   (or point it at any throwaway database)
- *
- * SKIPPED, loudly, when `CC_PG_URL` is absent — the skip is a missing proof,
- * never a passing one. It runs nightly (`.github/workflows/nightly.yml`).
- */
-import { SQL } from 'bun';
-import { afterAll, beforeAll, describe, expect, it } from 'bun:test';
-import { JOB_RESULTS_TABLE, UNSCOPED_TENANT } from './jobResults';
-import { createPgJobResultStore, createPgRevocationStore, ensureSaasControlPlaneSchema, REVOCATIONS_TABLE, } from './pooledControlStores';
-const URL_ = process.env.CC_PG_URL;
-let sql;
-let pool;
-// SKIPPED unless CC_PG_URL names a throwaway Postgres — this suite's subject IS the engine. `bun run test:pg` supplies one.
-describe.skipIf(!URL_)('the shared control-plane stores against a real Postgres (04 §1)', () => {
-    // 120s, not Bun's default 5s. This hook drops and re-creates a role, a database
-    // and a whole migration chain against a REAL Postgres; on a shared 4-core CI
-    // runner that has been measured at over five seconds, and the failure it
-    // produces is deeply misleading — the hook times out, the runner closes the
-    // connection mid-migration, and the log reads `MIGRATION_FAILED` /
-    // `ERR_POSTGRES_CONNECTION_CLOSED` as though the SQL were wrong. Observed on
-    // the 2026-07-27 nightly, one run after a green one.
-    beforeAll(async () => {
-        sql = new SQL(URL_);
-        // A connection per call, checked out and returned — the same discipline the
-        // real `pg` pool adapter has, so the stores are exercised through the shape
-        // they ship with rather than a long-lived handle a test happens to hold.
-        const connection = {
-            async query(text, params = []) {
-                return (await sql.unsafe(text, [...params]));
-            },
-            async execute(text, params = []) {
-                const result = await sql.unsafe(text, [...params]);
-                return { rowCount: result.count ?? 0 };
-            },
-        };
-        pool = { async withConnection(fn) { return await fn(connection); } };
-        await sql.unsafe(`DROP TABLE IF EXISTS ${JOB_RESULTS_TABLE}`);
-        await sql.unsafe(`DROP TABLE IF EXISTS ${REVOCATIONS_TABLE}`);
-        await ensureSaasControlPlaneSchema(pool);
-    }, 120_000);
-    afterAll(async () => {
-        await sql?.end();
-    });
-    it('creates its schema idempotently — the chain is COMPILED, not hand-written', async () => {
-        // The second run is the assertion: the `IF NOT EXISTS` guard has to survive
-        // compilation from the SQLite source, or a deployment's second migration
-        // run is a hard failure.
-        await ensureSaasControlPlaneSchema(pool);
-        await ensureSaasControlPlaneSchema(pool);
-    });
-    /* ------------------------------------------------------- job results */
-    it('round-trips an outcome, keeping ok as a BOOLEAN across the bigint boundary', async () => {
-        const store = createPgJobResultStore(pool);
-        await store.record({ jobId: 'pg_1', ok: true, output: { files: 3 }, tenantId: 't_a', instanceId: 'gallery' });
-        // `ok` is a pg `bigint`, which the driver hands back as the STRING '1'. A
-        // `=== 1` comparison would be silently false and every outcome would read
-        // as a failure — on the dialect with no local test to catch it.
-        await expect(store.read('pg_1')).resolves.toMatchObject({
-            jobId: 'pg_1',
-            ok: true,
-            output: { files: 3 },
-            tenantId: 't_a',
-            instanceId: 'gallery',
-        });
-    });
-    it('keeps the FIRST outcome — ON CONFLICT DO NOTHING, not an upsert', async () => {
-        const store = createPgJobResultStore(pool);
-        await store.record({ jobId: 'pg_race', ok: false, error: 'cancelled', tenantId: 't_a' });
-        await store.record({ jobId: 'pg_race', ok: true, output: 'finished anyway', tenantId: 't_a' });
-        // The durable form of the settle race: a handler that returns normally
-        // moments after an API node recorded a cancel must not resurrect the job.
-        await expect(store.read('pg_race')).resolves.toMatchObject({ ok: false, error: 'cancelled' });
-    });
-    it('lists only the named tenant’s outcomes, newest first', async () => {
-        const store = createPgJobResultStore(pool);
-        await store.record({ jobId: 'pg_old', ok: true, tenantId: 't_list', at: '2026-07-25T10:00:00.000Z' });
-        await store.record({ jobId: 'pg_new', ok: true, tenantId: 't_list', at: '2026-07-25T12:00:00.000Z' });
-        await store.record({ jobId: 'pg_mid', ok: true, tenantId: 't_list', at: '2026-07-25T11:00:00.000Z' });
-        await store.record({ jobId: 'pg_theirs', ok: true, tenantId: 't_other', at: '2026-07-25T13:00:00.000Z' });
-        await store.record({ jobId: 'pg_nobody', ok: true, tenantId: UNSCOPED_TENANT, at: '2026-07-25T14:00:00.000Z' });
-        const rows = await store.list({ tenantId: 't_list' });
-        expect(rows.map((row) => row.jobId)).toEqual(['pg_new', 'pg_mid', 'pg_old']);
-        // The one read that returns ROWS rather than a known id — so it is exactly
-        // where a missing scope becomes a cross-tenant leak.
-        expect(rows.some((row) => row.jobId === 'pg_theirs' || row.jobId === 'pg_nobody')).toBe(false);
-    });
-    it('caps the page', async () => {
-        const store = createPgJobResultStore(pool);
-        expect((await store.list({ tenantId: 't_list', limit: 2 })).length).toBe(2);
-    });
-    it('prunes by age, across every tenant', async () => {
-        const store = createPgJobResultStore(pool);
-        await store.record({ jobId: 'pg_ancient', ok: true, tenantId: 't_a', at: '2000-01-01T00:00:00.000Z' });
-        await store.record({ jobId: 'pg_fresh', ok: true, tenantId: 't_a' });
-        const removed = await store.prune(60_000);
-        expect(removed).toBeGreaterThanOrEqual(1);
-        await expect(store.read('pg_ancient')).resolves.toBeNull();
-        await expect(store.read('pg_fresh')).resolves.not.toBeNull();
-    });
-    /* --------------------------------------------------------- revocation */
-    it('records a revoked jti and reads its exp back as a NUMBER', async () => {
-        const store = createPgRevocationStore(pool);
-        await store.set('jti_a', 1_800_000_000);
-        await expect(store.get('jti_a')).resolves.toBe(1_800_000_000);
-        await expect(store.get('jti_never')).resolves.toBeNull();
-    });
-    it('keeps the LATER exp — two nodes with skewed clocks must not shorten the window', async () => {
-        const store = createPgRevocationStore(pool);
-        await store.set('jti_skew', 1_800_000_100);
-        await store.set('jti_skew', 1_800_000_000); // an earlier clock revoking the same jti
-        // GREATEST, not "last write wins": the shorter window would let a revoked
-        // token become valid again for the difference between the two clocks.
-        await expect(store.get('jti_skew')).resolves.toBe(1_800_000_100);
-    });
-    it('prunes only entries whose token could no longer be presented', async () => {
-        const store = createPgRevocationStore(pool);
-        await store.set('jti_expired', 1_000);
-        await store.set('jti_live', 1_900_000_000);
-        expect(await store.prune(2_000)).toBeGreaterThanOrEqual(1);
-        await expect(store.get('jti_expired')).resolves.toBeNull();
-        await expect(store.get('jti_live')).resolves.toBe(1_900_000_000);
-    });
-});
-//# sourceMappingURL=pooledControlStores.pg.test.js.map

package/dist/server/drivers/pooledControlStores.pg.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pooledControlStores.pg.test.js","sourceRoot":"","sources":["../../../src/server/drivers/pooledControlStores.pg.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;AAEnC,IAAI,GAAQ,CAAC;AACb,IAAI,IAAc,CAAC;AAEnB,4HAA4H;AAC5H,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC7F,gFAAgF;IAChF,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,6EAA6E;IAC7E,qDAAqD;IACrD,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,GAAG,GAAG,IAAI,GAAG,CAAC,IAAc,CAAC,CAAC;QAC9B,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,UAAU,GAAmB;YACjC,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,SAA6B,EAAE;gBAC1D,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAQ,CAAC;YACtD,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAA6B,EAAE;gBACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;gBACnD,OAAO,EAAE,QAAQ,EAAG,MAA6B,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACjE,CAAC;SACF,CAAC;QACF,IAAI,GAAG,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,OAAO,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAErE,MAAM,GAAG,CAAC,MAAM,CAAC,wBAAwB,iBAAiB,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,CAAC,MAAM,CAAC,wBAAwB,iBAAiB,EAAE,CAAC,CAAC;QAC9D,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,4EAA4E;QAC5E,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAE9G,0EAA0E;QAC1E,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YACtD,KAAK,EAAE,MAAM;YACb,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;YACpB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/F,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC1G,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAEhH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7E,2EAA2E;QAC3E,qDAAqD;QACrD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAC7B,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAE1E,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,yCAAyC;QACrF,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAE3C,MAAM,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/drivers/pooledIdentityStore.d.ts

@@ -1,89 +0,0 @@
-/**
- * The saas identity tier (04 §1a, owner decision E18/D10) — `tenants`, `users`,
- * `memberships` and `invitations` on the deployment's pooled Postgres.
- *
- * ## Why this had to exist before a saas app could boot
- *
- * V2 REFUSES a saas config without the `guard` engine (`engine-dependency-
- * missing`), and `guard` needs a `resolveIdentity`. The only implementation was
- * `createRegistryIdentityStore` over `bun:sqlite` — a file on ONE machine. So
- * every saas branch in the codebase was unit-tested and unbootable: two API
- * nodes would each hold a different set of users, and "sign up on node A, 401 on
- * node B" is not a failure any single-process test can produce.
- *
- * The owner's decision (E18, Option A) was to port the SAME tables and the SAME
- * HMAC row-signing to the pooled Postgres, reached through the ONE injected pool
- * `createSaasHostServices` already owns. Options B (per-tenant SQLite on shared
- * storage) and C (an external IdP) were refused, not deferred.
- *
- * ## What is NOT here, on purpose
- *
- * There is no second copy of the identity SQL. `createStatementIdentityStore`
- * in `cwip/cc-registry` is the ONE implementation; this file supplies it a
- * pooled Postgres executor instead of a SQLite one, exactly as
- * `createPgJobResultStore` does for the outcome log. If you find yourself
- * writing an `INSERT INTO users` here, stop — the statement belongs in
- * `IDENTITY_STATEMENTS`, where both dialects read it.
- *
- * ## Why these tables use the CONTROL-PLANE executor, not `scopedExec`
- *
- * They are not tenant-rooted domain tables and cannot be governed by RLS:
- *
- *   • `users` is cross-tenant by construction — one human, many tenants — and a
- *     policy keyed on `app.tenant_id` would hide a user from their own login,
- *     which happens BEFORE any tenant is resolved.
- *   • `tenants` IS the tenant table; a tenant-isolation policy on it is circular.
- *   • `memberships` is the map that RESOLVES the tenant, so it must be readable
- *     before one is set.
- *
- * Scoping for these lives in the QUERY (`WHERE tenant_id = ?` on every listing
- * that returns rows), which is why `membersOfTenant` and `membershipsForUser`
- * are both predicated and neither has an unbounded variant.
- */
-import { type RegistryIdentityStore, type RegistryIdentityStoreOptions } from 'cwip/cc-registry';
-import { type SaasPool } from 'cwip/storage';
-/**
- * The identity store over the deployment's pool.
- *
- * Every call checks a connection out and returns it. The store holds no
- * connection of its own — a long-lived one would be a socket the pool is sized
- * against but does not control, and identity reads happen on the hot path of
- * every authenticated request.
- *
- * Note what this does NOT do: it does not wrap multi-statement operations in a
- * transaction. Each method here is a single statement (the upserts are one
- * `ON CONFLICT`, the mutations use `RETURNING`), except the read-modify-write
- * pair behind `changeRole`/`setPassword`/`setMembershipStatus`, which re-signs
- * the whole row. Those are last-writer-wins across nodes, which is correct for
- * this data: two admins changing one member's role concurrently should end at
- * one of the two values, and the row signature makes either outcome verifiable.
- * What it must never do is end at a row whose signature does not match its
- * contents, and it cannot — the signature is computed from the row being
- * written, in the same statement.
- */
-export declare const createPgIdentityStore: (pool: SaasPool, options: RegistryIdentityStoreOptions) => RegistryIdentityStore;
-/**
- * The identity chain, in the deployment's dialect.
- *
- * COMPILED from the SQLite source by `toPostgresDdl`, never hand-written — the
- * same law the control-plane chain follows. Order matters: `memberships` and
- * `invitations` carry foreign keys into `tenants`/`users`.
- */
-export declare const SAAS_IDENTITY_DDL: readonly string[];
-/**
- * Create the identity tables if they are absent, and REFUSE a schema whose
- * signed tables have drifted.
- *
- * The second half is not decoration. `users` and `memberships` are in
- * `CC_SIGNED_TABLES`, and a column added to either without being added to its
- * `*_COLUMN_ORDER` is silently outside the HMAC — tamperable, with every read
- * still reporting "verified". The local path catches that eagerly in
- * `createRegistryIdentityStore` via `PRAGMA table_info`; Postgres has no PRAGMA,
- * so the equivalent check lives here, in the function that owns this schema.
- *
- * Deliberately a NAMED, explicit call rather than something the store does on
- * construction — a shared database has ONE schema owner, and a library issuing
- * DDL on every process start would be N of them racing.
- */
-export declare const ensureSaasIdentitySchema: (pool: SaasPool) => Promise<void>;
-//# sourceMappingURL=pooledIdentityStore.d.ts.map

package/dist/server/drivers/pooledIdentityStore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pooledIdentityStore.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/pooledIdentityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EAClC,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAiC,KAAK,QAAQ,EAAiB,MAAM,cAAc,CAAC;AAE3F;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,QAAQ,EAAE,SAAS,4BAA4B,KAAG,qBAoC7F,CAAC;AAsBF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAS1B,CAAC;AAEtB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB,GAAU,MAAM,QAAQ,KAAG,OAAO,CAAC,IAAI,CAe3E,CAAC"}

package/dist/server/drivers/pooledIdentityStore.js

@@ -1,154 +0,0 @@
-/**
- * The saas identity tier (04 §1a, owner decision E18/D10) — `tenants`, `users`,
- * `memberships` and `invitations` on the deployment's pooled Postgres.
- *
- * ## Why this had to exist before a saas app could boot
- *
- * V2 REFUSES a saas config without the `guard` engine (`engine-dependency-
- * missing`), and `guard` needs a `resolveIdentity`. The only implementation was
- * `createRegistryIdentityStore` over `bun:sqlite` — a file on ONE machine. So
- * every saas branch in the codebase was unit-tested and unbootable: two API
- * nodes would each hold a different set of users, and "sign up on node A, 401 on
- * node B" is not a failure any single-process test can produce.
- *
- * The owner's decision (E18, Option A) was to port the SAME tables and the SAME
- * HMAC row-signing to the pooled Postgres, reached through the ONE injected pool
- * `createSaasHostServices` already owns. Options B (per-tenant SQLite on shared
- * storage) and C (an external IdP) were refused, not deferred.
- *
- * ## What is NOT here, on purpose
- *
- * There is no second copy of the identity SQL. `createStatementIdentityStore`
- * in `cwip/cc-registry` is the ONE implementation; this file supplies it a
- * pooled Postgres executor instead of a SQLite one, exactly as
- * `createPgJobResultStore` does for the outcome log. If you find yourself
- * writing an `INSERT INTO users` here, stop — the statement belongs in
- * `IDENTITY_STATEMENTS`, where both dialects read it.
- *
- * ## Why these tables use the CONTROL-PLANE executor, not `scopedExec`
- *
- * They are not tenant-rooted domain tables and cannot be governed by RLS:
- *
- *   • `users` is cross-tenant by construction — one human, many tenants — and a
- *     policy keyed on `app.tenant_id` would hide a user from their own login,
- *     which happens BEFORE any tenant is resolved.
- *   • `tenants` IS the tenant table; a tenant-isolation policy on it is circular.
- *   • `memberships` is the map that RESOLVES the tenant, so it must be readable
- *     before one is set.
- *
- * Scoping for these lives in the QUERY (`WHERE tenant_id = ?` on every listing
- * that returns rows), which is why `membersOfTenant` and `membershipsForUser`
- * are both predicated and neither has an unbounded variant.
- */
-import { createStatementIdentityStore, } from 'cwip/cc-registry';
-import { INVITATIONS_DDL, MEMBERSHIPS_DDL, MEMBERSHIPS_USER_INDEX, TENANTS_DDL, USERS_DDL, USERS_EMAIL_INDEX, } from 'cwip/cc-registry-schema';
-import { assertSignedColumnCoverage } from 'cwip/guard';
-import { createPostgresControlExecutor, toPostgresDdl } from 'cwip/storage';
-/**
- * The identity store over the deployment's pool.
- *
- * Every call checks a connection out and returns it. The store holds no
- * connection of its own — a long-lived one would be a socket the pool is sized
- * against but does not control, and identity reads happen on the hot path of
- * every authenticated request.
- *
- * Note what this does NOT do: it does not wrap multi-statement operations in a
- * transaction. Each method here is a single statement (the upserts are one
- * `ON CONFLICT`, the mutations use `RETURNING`), except the read-modify-write
- * pair behind `changeRole`/`setPassword`/`setMembershipStatus`, which re-signs
- * the whole row. Those are last-writer-wins across nodes, which is correct for
- * this data: two admins changing one member's role concurrently should end at
- * one of the two values, and the row signature makes either outcome verifiable.
- * What it must never do is end at a row whose signature does not match its
- * contents, and it cannot — the signature is computed from the row being
- * written, in the same statement.
- */
-export const createPgIdentityStore = (pool, options) => {
-    const over = (fn) => pool.withConnection(async (connection) => fn(createStatementIdentityStore(createPostgresControlExecutor(connection), options)));
-    return {
-        createTenant: (input) => over((s) => s.createTenant(input)),
-        getTenant: (id) => over((s) => s.getTenant(id)),
-        renameTenant: (id, title) => over((s) => s.renameTenant(id, title)),
-        setTenantStatus: (id, status) => over((s) => s.setTenantStatus(id, status)),
-        setTenantPlan: (id, planId) => over((s) => s.setTenantPlan(id, planId)),
-        createUser: (input) => over((s) => s.createUser(input)),
-        getUser: (id) => over((s) => s.getUser(id)),
-        getUserByEmail: (email) => over((s) => s.getUserByEmail(email)),
-        setUserStatus: (id, status) => over((s) => s.setUserStatus(id, status)),
-        setPassword: (id, envelope) => over((s) => s.setPassword(id, envelope)),
-        passwordEnvelope: (id) => over((s) => s.passwordEnvelope(id)),
-        createMembership: (input) => over((s) => s.createMembership(input)),
-        getMembership: (t, u) => over((s) => s.getMembership(t, u)),
-        membershipsForUser: (u) => over((s) => s.membershipsForUser(u)),
-        membersOfTenant: (t) => over((s) => s.membersOfTenant(t)),
-        changeRole: (t, u, role) => over((s) => s.changeRole(t, u, role)),
-        setMembershipPermissions: (t, u, perms) => over((s) => s.setMembershipPermissions(t, u, perms)),
-        setMembershipStatus: (t, u, status) => over((s) => s.setMembershipStatus(t, u, status)),
-        removeMembership: (t, u) => over((s) => s.removeMembership(t, u)),
-        createInvitation: (input) => over((s) => s.createInvitation(input)),
-        getInvitation: (hash) => over((s) => s.getInvitation(hash)),
-        acceptInvitation: (hash) => over((s) => s.acceptInvitation(hash)),
-        bootstrapLocalIdentity: () => over((s) => s.bootstrapLocalIdentity()),
-        verifyAll: () => over((s) => s.verifyAll()),
-    };
-};
-/* ------------------------------------------------------------------ schema */
-/**
- * Add `IF NOT EXISTS` to an authored DDL statement.
- *
- * The registry's DDL is authored WITHOUT the guard because it runs inside a
- * versioned migration chain, where a table that already exists means the
- * migration bookkeeping is wrong and should fail loudly. A shared database is
- * the opposite case: `ensureSaasIdentitySchema` is explicitly idempotent and may
- * be called by any deployment step that knows it holds the privilege.
- *
- * Injected here rather than by re-authoring the four statements, because a
- * second copy of a CREATE TABLE differing by three words is precisely the drift
- * the compile-from-source rule exists to prevent.
- */
-const ifNotExists = (ddl) => ddl
-    .replace(/^(\s*CREATE\s+TABLE\s+)(?!IF\s+NOT\s+EXISTS)/i, '$1IF NOT EXISTS ')
-    .replace(/^(\s*CREATE\s+(?:UNIQUE\s+)?INDEX\s+)(?!IF\s+NOT\s+EXISTS)/i, '$1IF NOT EXISTS ');
-/**
- * The identity chain, in the deployment's dialect.
- *
- * COMPILED from the SQLite source by `toPostgresDdl`, never hand-written — the
- * same law the control-plane chain follows. Order matters: `memberships` and
- * `invitations` carry foreign keys into `tenants`/`users`.
- */
-export const SAAS_IDENTITY_DDL = [
-    TENANTS_DDL,
-    USERS_DDL,
-    USERS_EMAIL_INDEX,
-    MEMBERSHIPS_DDL,
-    MEMBERSHIPS_USER_INDEX,
-    INVITATIONS_DDL,
-]
-    .map(ifNotExists)
-    .map(toPostgresDdl);
-/**
- * Create the identity tables if they are absent, and REFUSE a schema whose
- * signed tables have drifted.
- *
- * The second half is not decoration. `users` and `memberships` are in
- * `CC_SIGNED_TABLES`, and a column added to either without being added to its
- * `*_COLUMN_ORDER` is silently outside the HMAC — tamperable, with every read
- * still reporting "verified". The local path catches that eagerly in
- * `createRegistryIdentityStore` via `PRAGMA table_info`; Postgres has no PRAGMA,
- * so the equivalent check lives here, in the function that owns this schema.
- *
- * Deliberately a NAMED, explicit call rather than something the store does on
- * construction — a shared database has ONE schema owner, and a library issuing
- * DDL on every process start would be N of them racing.
- */
-export const ensureSaasIdentitySchema = async (pool) => {
-    await pool.withConnection(async (connection) => {
-        for (const statement of SAAS_IDENTITY_DDL)
-            await connection.execute(statement, []);
-        for (const table of ['users', 'memberships']) {
-            const rows = (await connection.query('SELECT column_name FROM information_schema.columns WHERE table_name = $1', [table]));
-            assertSignedColumnCoverage(table, rows.map((row) => row.column_name));
-        }
-    });
-};
-//# sourceMappingURL=pooledIdentityStore.js.map

package/dist/server/drivers/pooledIdentityStore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pooledIdentityStore.js","sourceRoot":"","sources":["../../../src/server/drivers/pooledIdentityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EACL,4BAA4B,GAG7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,6BAA6B,EAAiB,aAAa,EAAE,MAAM,cAAc,CAAC;AAE3F;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAc,EAAE,OAAqC,EAAyB,EAAE;IACpH,MAAM,IAAI,GAAG,CAAI,EAAgD,EAAc,EAAE,CAC/E,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CACvC,EAAE,CAAC,4BAA4B,CAAC,6BAA6B,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,CACrF,CAAC;IAEJ,OAAO;QACL,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3D,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC/C,YAAY,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnE,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEvE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/D,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACvE,WAAW,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvE,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAE7D,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC/D,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzD,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,wBAAwB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/F,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACvF,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEjE,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnE,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3D,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAEjE,sBAAsB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;QACrE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC,CAAC;AAEF,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,GAAG,CAAC,GAAW,EAAU,EAAE,CAC1C,GAAG;KACA,OAAO,CAAC,+CAA+C,EAAE,kBAAkB,CAAC;KAC5E,OAAO,CAAC,6DAA6D,EAAE,kBAAkB,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,WAAW;IACX,SAAS;IACT,iBAAiB;IACjB,eAAe;IACf,sBAAsB;IACtB,eAAe;CAChB;KACE,GAAG,CAAC,WAAW,CAAC;KAChB,GAAG,CAAC,aAAa,CAAC,CAAC;AAEtB;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,IAAc,EAAiB,EAAE;IAC9E,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QAC7C,KAAK,MAAM,SAAS,IAAI,iBAAiB;YAAE,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAEnF,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,aAAa,CAAU,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,CAAC,MAAM,UAAU,CAAC,KAAK,CAClC,0EAA0E,EAC1E,CAAC,KAAK,CAAC,CACR,CAAmC,CAAC;YACrC,0BAA0B,CACxB,KAAK,EACL,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/server/drivers/pooledIdentityStore.pg.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=pooledIdentityStore.pg.test.d.ts.map

package/dist/server/drivers/pooledIdentityStore.pg.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pooledIdentityStore.pg.test.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/pooledIdentityStore.pg.test.ts"],"names":[],"mappings":""}

package/dist/server/drivers/pooledIdentityStore.pg.test.js

@@ -1,193 +0,0 @@
-/**
- * The saas identity tier against a REAL Postgres (04 §1a, owner decision E18).
- *
- * This suite is the whole justification for the port. The identity store exists
- * so that a user who signs up on node A can log in on node B, and that is a
- * claim about Postgres — not about TypeScript, and not about the SQLite suite in
- * `cwip/src/registry/identity.test.ts` that runs the same contract.
- *
- * What only the engine can answer for:
- *
- *   • the DDL, COMPILED from the SQLite source by `toPostgresDdl` — including
- *     the partial `UNIQUE INDEX … WHERE email IS NOT NULL`, which is the one
- *     piece of this schema that is easy to compile into something that silently
- *     means something else;
- *   • `ON CONFLICT (…) DO UPDATE SET … = excluded.…` on a COMPOSITE key;
- *   • `UPDATE … RETURNING *`, which the store now uses instead of write-then-read;
- *   • that a row signed on one connection VERIFIES on another — the HMAC covers
- *     column values, and a dialect that round-tripped a NULL or a timestamp
- *     differently would produce a signature mismatch on read rather than a
- *     visibly wrong value.
- *
- *   bun run test:pg          (starts a disposable container, runs, tears down)
- *   CC_PG_URL=postgres://…   (or point it at any throwaway database)
- *
- * SKIPPED, loudly, when `CC_PG_URL` is absent — the skip is a missing proof,
- * never a passing one. It runs nightly (`.github/workflows/nightly.yml`).
- */
-import { SQL } from 'bun';
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'bun:test';
-import { createRowSigner, mintMachineIntegrityKey } from 'cwip/guard';
-import { RESERVED_TENANT_ID, RESERVED_USER_ID } from 'cwip/cc-registry';
-import { createPgIdentityStore, ensureSaasIdentitySchema } from './pooledIdentityStore';
-const URL_ = process.env.CC_PG_URL;
-let sql;
-let pool;
-let signer;
-let violations;
-let store;
-const NOW = '2026-07-26T00:00:00.000Z';
-// SKIPPED unless CC_PG_URL names a throwaway Postgres — this suite's subject IS the engine. `bun run test:pg` supplies one.
-describe.skipIf(!URL_)('the saas identity tier against a real Postgres (04 §1a)', () => {
-    // 120s, not Bun's default 5s. This hook drops and re-creates a role, a database
-    // and a whole migration chain against a REAL Postgres; on a shared 4-core CI
-    // runner that has been measured at over five seconds, and the failure it
-    // produces is deeply misleading — the hook times out, the runner closes the
-    // connection mid-migration, and the log reads `MIGRATION_FAILED` /
-    // `ERR_POSTGRES_CONNECTION_CLOSED` as though the SQL were wrong. Observed on
-    // the 2026-07-27 nightly, one run after a green one.
-    beforeAll(async () => {
-        sql = new SQL(URL_);
-        // A connection per call, checked out and returned — the discipline the real
-        // pool adapter has, so the store is exercised through the shape it ships
-        // with rather than a long-lived handle a test happens to hold.
-        const connection = {
-            async query(text, params = []) {
-                return (await sql.unsafe(text, [...params]));
-            },
-            async execute(text, params = []) {
-                const result = await sql.unsafe(text, [...params]);
-                return { rowCount: result.count ?? 0 };
-            },
-        };
-        pool = { async withConnection(fn) { return await fn(connection); } };
-        // Drop in FK order — memberships/invitations reference tenants and users.
-        for (const table of ['invitations', 'memberships', 'users', 'tenants'])
-            await sql.unsafe(`DROP TABLE IF EXISTS ${table} CASCADE`);
-        await ensureSaasIdentitySchema(pool);
-    }, 120_000);
-    afterAll(async () => {
-        await sql?.end();
-    });
-    beforeEach(async () => {
-        for (const table of ['invitations', 'memberships', 'users', 'tenants'])
-            await sql.unsafe(`DELETE FROM ${table}`);
-        violations = [];
-        signer = createRowSigner({ integrityKey: mintMachineIntegrityKey(), onViolation: (v) => violations.push(v) });
-        store = createPgIdentityStore(pool, { signer, now: () => NOW });
-    });
-    it('creates its schema idempotently — the chain is COMPILED, not hand-written', async () => {
-        // The second and third runs are the assertion: the injected `IF NOT EXISTS`
-        // has to survive compilation from the SQLite source, or a deployment's
-        // second migration run is a hard failure.
-        await ensureSaasIdentitySchema(pool);
-        await ensureSaasIdentitySchema(pool);
-    });
-    it('round-trips tenant → user → membership with a signature that verifies on a LATER connection', async () => {
-        await store.createTenant({ tenantId: 't_acme', title: 'Acme', planId: 'pro' });
-        await store.createUser({ userId: 'u_ann', email: 'ann@acme.test', pwEnvelope: '{"v":1}' });
-        await store.createMembership({
-            tenantId: 't_acme',
-            userId: 'u_ann',
-            role: 'ADMIN',
-            permissions: ['infra:write'],
-        });
-        // Each of these checks out its OWN connection — the signature has to survive
-        // the round trip through pg's type mapping, not just live in one session.
-        expect((await store.getTenant('t_acme'))?.planId).toBe('pro');
-        expect(await store.getUser('u_ann')).toMatchObject({ userId: 'u_ann', hasPassword: true, createdAt: NOW });
-        expect((await store.getMembership('t_acme', 'u_ann'))?.role).toBe('ADMIN');
-        expect((await store.membershipsForUser('u_ann')).map((m) => m.tenantId)).toEqual(['t_acme']);
-        expect(await store.verifyAll()).toEqual([]);
-        expect(violations).toEqual([]);
-    });
-    it('keeps a NULL email out of the signature mismatch trap', async () => {
-        // The failure this guards: pg returning `undefined` where SQLite returns
-        // `null` would change the signed serialization and make every passwordless
-        // user's next read a SECURITY_INTEGRITY_VIOLATION.
-        await store.createUser({ userId: 'u_nobody' });
-        expect(await store.getUser('u_nobody')).toMatchObject({ email: undefined, hasPassword: false });
-        expect(await store.passwordEnvelope('u_nobody')).toBeNull();
-        expect(await store.verifyAll()).toEqual([]);
-    });
-    it('upserts on a COMPOSITE key and re-signs the whole row', async () => {
-        await store.createTenant({ tenantId: 't_acme', title: 'Acme' });
-        await store.createUser({ userId: 'u_ann' });
-        await store.createMembership({ tenantId: 't_acme', userId: 'u_ann', role: 'VIEWER' });
-        expect((await store.changeRole('t_acme', 'u_ann', 'MEMBER'))?.role).toBe('MEMBER');
-        expect((await store.setMembershipPermissions('t_acme', 'u_ann', ['reports:read']))?.permissions).toEqual([
-            'reports:read',
-        ]);
-        // One row, not two: `ON CONFLICT (tenant_id, user_id)` has to bind the
-        // composite key, and a mis-compiled conflict target would insert a duplicate.
-        expect(await store.membersOfTenant('t_acme')).toHaveLength(1);
-        expect(await store.verifyAll()).toEqual([]);
-    });
-    it('UPDATE … RETURNING gives the caller the row in ONE statement', async () => {
-        await store.createTenant({ tenantId: 't_acme', title: 'Acme' });
-        expect((await store.renameTenant('t_acme', 'Acme Corp'))?.title).toBe('Acme Corp');
-        expect((await store.setTenantStatus('t_acme', 'suspended'))?.status).toBe('suspended');
-        // A miss returns no rows rather than throwing.
-        expect(await store.renameTenant('t_missing', 'Nope')).toBeNull();
-    });
-    it('enforces the PARTIAL unique-email index — the compile step most likely to lie', async () => {
-        await store.createUser({ userId: 'u_ann', email: 'dup@acme.test' });
-        await expect(store.createUser({ userId: 'u_bob', email: 'dup@acme.test' })).rejects.toThrow();
-        // …but many NULL emails are fine, which is the half a non-partial UNIQUE
-        // would silently break — and it would break it for every passwordless user
-        // at once, on the dialect with no local test.
-        await store.createUser({ userId: 'u_c' });
-        await store.createUser({ userId: 'u_d' });
-        expect((await store.getUser('u_d'))?.userId).toBe('u_d');
-    });
-    it('refuses a row tampered with directly in the database', async () => {
-        await store.createTenant({ tenantId: 't_acme', title: 'Acme' });
-        await store.createUser({ userId: 'u_ann' });
-        await store.createMembership({ tenantId: 't_acme', userId: 'u_ann', role: 'VIEWER' });
-        // The threat is a shell on the shared database, not a shell on one laptop —
-        // which is exactly why this has to hold on Postgres too.
-        await sql.unsafe("UPDATE memberships SET role = 'OWNER' WHERE tenant_id = 't_acme' AND user_id = 'u_ann'");
-        await expect(store.getMembership('t_acme', 'u_ann')).rejects.toThrow(/SECURITY_INTEGRITY_VIOLATION|signature mismatch/i);
-        expect(violations).toHaveLength(1);
-        expect(await store.verifyAll()).toEqual(['memberships:t_acme/u_ann']);
-    });
-    it('single-use-accepts an invitation under a conditional UPDATE', async () => {
-        await store.createTenant({ tenantId: 't_acme', title: 'Acme' });
-        await store.createInvitation({
-            tokenHash: 'hash-1',
-            tenantId: 't_acme',
-            email: 'bob@acme.test',
-            role: 'MEMBER',
-            expiresAt: '2026-08-01T00:00:00.000Z',
-        });
-        expect((await store.acceptInvitation('hash-1'))?.acceptedAt).toBe(NOW);
-        // `WHERE accepted_at IS NULL` is what makes a replay a no-op rather than a
-        // second membership — the property two API nodes racing depend on.
-        expect(await store.acceptInvitation('hash-1')).toBeNull();
-    });
-    it('bootstraps and removes idempotently', async () => {
-        const first = await store.bootstrapLocalIdentity();
-        expect(first.tenant.tenantId).toBe(RESERVED_TENANT_ID);
-        expect(first.user.userId).toBe(RESERVED_USER_ID);
-        await store.bootstrapLocalIdentity();
-        expect(await store.membersOfTenant(RESERVED_TENANT_ID)).toHaveLength(1);
-        expect(await store.removeMembership(RESERVED_TENANT_ID, RESERVED_USER_ID)).toBe(true);
-        // `changes` has to come back from pg's rowCount, or a second delete would
-        // report success and a caller would believe it removed something twice.
-        expect(await store.removeMembership(RESERVED_TENANT_ID, RESERVED_USER_ID)).toBe(false);
-    });
-    it('REFUSES a schema whose signed table grew an uncovered column', async () => {
-        // The silent-tamper hole: a column outside `*_COLUMN_ORDER` is outside the
-        // HMAC, so it can be edited freely while every read still reports verified.
-        // The local path catches this with PRAGMA table_info; Postgres has no
-        // PRAGMA, so `ensureSaasIdentitySchema` is where the equivalent check lives.
-        await sql.unsafe('ALTER TABLE users ADD COLUMN sneaky TEXT');
-        try {
-            await expect(ensureSaasIdentitySchema(pool)).rejects.toThrow(/sneaky|coverage|signed/i);
-        }
-        finally {
-            await sql.unsafe('ALTER TABLE users DROP COLUMN sneaky');
-        }
-    });
-});
-//# sourceMappingURL=pooledIdentityStore.pg.test.js.map

package/dist/server/drivers/pooledIdentityStore.pg.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pooledIdentityStore.pg.test.js","sourceRoot":"","sources":["../../../src/server/drivers/pooledIdentityStore.pg.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAExF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;AAEnC,IAAI,GAAQ,CAAC;AACb,IAAI,IAAc,CAAC;AACnB,IAAI,MAAiB,CAAC;AACtB,IAAI,UAAmC,CAAC;AACxC,IAAI,KAA4B,CAAC;AAEjC,MAAM,GAAG,GAAG,0BAA0B,CAAC;AAEvC,4HAA4H;AAC5H,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACrF,gFAAgF;IAChF,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,6EAA6E;IAC7E,qDAAqD;IACrD,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,GAAG,GAAG,IAAI,GAAG,CAAC,IAAc,CAAC,CAAC;QAC9B,4EAA4E;QAC5E,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,UAAU,GAAmB;YACjC,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,SAA6B,EAAE;gBAC1D,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAQ,CAAC;YACtD,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAA6B,EAAE;gBACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;gBACnD,OAAO,EAAE,QAAQ,EAAG,MAA6B,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACjE,CAAC;SACF,CAAC;QACF,IAAI,GAAG,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,OAAO,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAErE,0EAA0E;QAC1E,KAAK,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC;YACpE,MAAM,GAAG,CAAC,MAAM,CAAC,wBAAwB,KAAK,UAAU,CAAC,CAAC;QAC5D,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,KAAK,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC;YACpE,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC;QAC3C,UAAU,GAAG,EAAE,CAAC;QAChB,MAAM,GAAG,eAAe,CAAC,EAAE,YAAY,EAAE,uBAAuB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9G,KAAK,GAAG,qBAAqB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,4EAA4E;QAC5E,uEAAuE;QACvE,0CAA0C;QAC1C,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QAC3G,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3F,MAAM,KAAK,CAAC,gBAAgB,CAAC;YAC3B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,CAAC,aAAa,CAAC;SAC7B,CAAC,CAAC;QAEH,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3G,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEtF,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnF,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC;YACvG,cAAc;SACf,CAAC,CAAC;QACH,uEAAuE;QACvE,8EAA8E;QAC9E,MAAM,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnF,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvF,+CAA+C;QAC/C,MAAM,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACpE,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9F,yEAAyE;QACzE,2EAA2E;QAC3E,8CAA8C;QAC9C,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEtF,4EAA4E;QAC5E,yDAAyD;QACzD,MAAM,GAAG,CAAC,MAAM,CAAC,wFAAwF,CAAC,CAAC;QAE3G,MAAM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAClE,kDAAkD,CACnD,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC,gBAAgB,CAAC;YAC3B,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvE,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExE,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,GAAG,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC1F,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}