@lenso/organization 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,185 @@
-# Temporary Holding Version
+# Organization
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Optional business organizations, memberships and invitations. The root entry is
+an ordinary async service with no runtime dependencies on Lenso, Auth, Drizzle,
+Manage, Tasks or notification providers.
+
+## Responsibility boundaries
+
+- **Auth** establishes identity and revalidates its proof. A subject is
+  `{ realmId, subjectId }`, not a foreign key to a users table or an email address.
+- **Organization** persists relationships: `member`, `admin`, `owner`, and
+  invitations.
+- **Authorization** decides whether a verified subject may perform an action
+  within a particular organization. `OrganizationAccess.check` is required.
+
+An organization owner is not a Console or platform administrator. A shared Auth
+identity may be a business customer without Console admission, or a Console
+member without any business organization. Independent Console SSO can use another
+Auth realm/source; this package does not create a second password system.
+
+## Direct service and existing Auth
+
+```ts
+import { audience } from "@lenso/auth";
+import { createOrganizationService, memberRelationshipPolicy } from "@lenso/organization";
+import { createAuthOrganizationAccess } from "@lenso/organization/auth";
+import { postgresOrganizationStore } from "@lenso/organization/drizzle/pg";
+
+// Borrow the application's existing Auth and Drizzle database.
+const access = authentication.for(audience("business:organization"));
+const organizations = createOrganizationService({
+  store: postgresOrganizationStore(database),
+  access: createAuthOrganizationAccess({
+    access,
+    policy: memberRelationshipPolicy,
+  }),
+});
+
+// evidence comes from the trusted ingress, never organization input JSON.
+const actor = await access.required(evidence);
+const created = await organizations.createOrganization(actor, { name: "Operations" });
+const members = await organizations.listMembers(actor, {
+  organizationId: created.value.id,
+});
+```
+
+The Auth adapter uses `Access.enforce` on every call and CAS retry. Cloned,
+wrong-audience, wrong-instance and revoked actors fail Auth verification.
+`memberRelationshipPolicy` is an **opt-in example policy**, not inherent role
+semantics: members can read the organization/members and leave; admins manage
+ordinary members and invitations; owners can grant roles/ownership and transfer
+their ownership. Creation is allowed to verified subjects under this policy.
+Applications should constrain creation, actor kinds, realms and administrative
+actions according to their own authorization requirements.
+
+Cross-organization administrators require an explicit policy in the access
+adapter, independently verified by the application. No global organization list,
+implicit platform override or Console admission rule is provided. All member and
+invitation IDs, lists and totals are checked in the supplied organization scope.
+Policy callbacks receive actual stored relationships, not client-assigned roles.
+Single-invitation actions include the actual scoped invitation and target, without
+the digest. Role changes include the requested role. List actions authorize the
+**whole organization's** list and count, not a filtered per-invitation view;
+policies that permit only individual invitations should deny these list actions.
+
+## Thin Lenso registration
+
+`createOrganizationPlugin` from `/plugin` accepts:
+
+```ts
+import { createOrganizationPlugin } from "@lenso/organization/plugin";
+
+const organization = createOrganizationPlugin({
+  id: "business-organizations",
+  database: databasePlugin,
+  access: organizationAccessPlugin,
+  store: postgresOrganizationStore, // d1OrganizationStore for D1
+  config: { invitationLifetimeMs: 86_400_000 },
+});
+```
+
+`databasePlugin` and `organizationAccessPlugin` are the **exact installed
+instances**; the latter supplies `OrganizationAccess<Actor>`. Install those
+instances alongside `organization`. No resources are acquired during config
+import, no migrations run at startup, and stopping this plugin does not close
+borrowed Auth/database resources.
+
+Factory configuration is validated by `resolveOrganizationConfig`. Applications
+using Lenso Config may resolve these values in their existing configured setup
+and pass them to `createOrganizationService`; this package does not introduce a
+configuration source or hot-reload system.
+
+| Option                 | Default | Allowed                                   |
+| ---------------------- | ------- | ----------------------------------------- |
+| `invitationLifetimeMs` | 7 days  | 1 second to 30 days                       |
+| `maxMembers`           | 1000    | 1 to 1000                                 |
+| `maxInvitations`       | 1000    | 1 to 1000, including terminal invitations |
+| `conflictRetries`      | 8       | 0 to 32 known CAS misses                  |
+
+## Operations and invitation handling
+
+The service exposes organization create/read/update; member list/add/remove/leave;
+role changes; explicit owner grant/transfer; invitation create/read/list/accept/
+revoke/prune. Input objects reject unknown fields. Add and invite always assign
+`member`; ordinary role input cannot assign `owner`. Self-promotion from member
+to admin and self-grant of ownership are rejected even with a permissive checker.
+
+`createInvitation(actor, { organizationId, target })` returns a token once in
+`result.value.token`. It contains 256 random bits. Storage contains only a SHA-256
+digest bound to the organization, invitation ID, realm/subject, fixed role and
+deadline. Do not log the token, put it in a URL or expose it in discovery metadata.
+Acceptance requires the exact target identity, organization, invitation ID and
+token. It atomically consumes the pending invitation and adds membership.
+
+Replay returns `INVITATION_ACCEPTED`; revoked and expired invitations return
+`INVITATION_REVOKED` and `INVITATION_EXPIRED`. Wrong subject/token/scoped ID returns
+`NOT_FOUND` after access checks. Removing/leaving a membership also revokes its
+pending invitations in the same write. Expiry is derived from storage time;
+expired invitations never grant membership.
+
+No email is sent. An application may call its optional Notification adapter
+**after** invitation creation commits. Delivery failure must not roll back or
+replace the invitation fact; retry delivery separately using the existing Tasks
+integration if needed. An uncertain storage write is not automatically retried.
+
+Terminal/expired records remain available until explicitly
+`pruneInvitations(actor, { organizationId, before })` removes them. Pruning never
+removes a still-live pending invitation. After pruning, replay returns `NOT_FOUND`.
+
+Each mutation returns `{ value, change }`; `change` includes organization ID,
+new version, action and affected subject references, never invitation credentials.
+`organizationMembershipReader(store)` from `/auth` can feed
+`Auth.Access.memberships`, returning role/version or null after removal.
+Authorization caches must include organization + realm + subject and revalidate
+versions or arrange their own invalidation. Return metadata is not an event
+delivery guarantee; no global event platform is installed.
+
+## Storage and explicit migrations
+
+- PG: `/drizzle/pg`, `/drizzle/schema-pg`, `migrations/pg/0000_organizations.sql`.
+- D1: `/drizzle/d1`, `/drizzle/schema-sqlite`,
+  `migrations/sqlite/0000_organizations.sql`.
+
+Add the chosen schema to the application's existing Drizzle schema. Incorporate
+the reviewed SQL into **one** application-owned migration history and apply it
+explicitly to an authorized database; do not apply both Drizzle and Wrangler
+migration runners to one D1 store.
+
+One row holds each organization's bounded JSON relationship snapshot and version.
+Every mutation performs version CAS. PG locks the row inside a transaction and
+checks the deadline in a fresh statement after waiting. D1 uses a single
+conditional `UPDATE ... RETURNING`, without interactive transactions. Last-owner
+checks and all transfer/member/invitation changes are committed together. A known
+CAS miss rereads and reauthorizes; a storage exception has unknown outcome.
+
+This design rewrites the snapshot and serializes writes per organization. It is
+intended for bounded organizations, not unbounded enterprise directories. A
+512,000-byte serialized state limit supplements the count limits. High contention
+can return `CONFLICT`; large organizations need a separately designed normalized
+store. Direct SQL edits bypass service authorization and are not a public API.
+Admission reserves timestamp-growth headroom so revoking many pending invites
+cannot prevent member removal/exit. Lowering configured count limits stops growth,
+but does not block cleanup of already-admitted relationships.
+
+## Validation
+
+After building existing `@lenso/core` and `@lenso/auth`, run:
+
+```sh
+bun run --cwd packages/organization build
+bun run --cwd packages/organization typecheck
+LENSO_REQUIRE_POSTGRES=1 bun run --cwd packages/organization test
+```
+
+PG tests create and stop their own private loopback cluster; the required flag
+fails if `postgres`, `initdb` or `pg_ctl` is unavailable. D1 tests use the existing
+installed Miniflare/workerd toolchain with disposable local D1 state, not a SQLite
+shim. Auth fixture tests exercise the real Auth proof boundary but do not validate
+an external identity provider. Local D1 evidence does not validate deployed
+Cloudflare replication. No exactly-once or cross-resource consistency is claimed.
+
+The workspace uses the single integration-owned root Bun lockfile.
+Manage/CLI/MCP operations are not automatically registered. If an application
+exposes any, it must explicitly select methods, authenticate trusted entry context
+and apply its organization authorization policy.

package/dist/auth.d.ts

@@ -0,0 +1,22 @@
+import type { Access, Actor, MembershipReader } from "@lenso/auth";
+import type { AccessRequest, MemberRole, OrganizationAccess, OrganizationStore } from "./contracts";
+/**
+ * Borrow the application's audience-bound Auth access. Policy is required:
+ * authentication and organization membership are not authorization by themselves.
+ */
+export declare function createAuthOrganizationAccess<R extends string, Evidence, S extends string, A extends string>(options: {
+    access: Access<R, Evidence, S, A>;
+    policy(principal: Actor<R, S, A>, request: AccessRequest): boolean | Promise<boolean>;
+}): OrganizationAccess<Actor<R, S, A> | null>;
+export interface OrganizationMembership {
+    role: MemberRole;
+    version: number;
+}
+/**
+ * Trusted internal reader for Auth.Access.memberships. No Console admission and
+ * no permission grant. Cache keys must include organization, realm and subject;
+ * consumers must revalidate versions or explicitly invalidate after each change.
+ */
+export declare function organizationMembershipReader(store: OrganizationStore): MembershipReader<string, string, {
+    organizationId: string;
+}, OrganizationMembership>;

package/dist/auth.js

@@ -0,0 +1,26 @@
+import {
+  sameSubject2
+} from "./index-kdetdk6w.js";
+
+// src/auth.ts
+function createAuthOrganizationAccess(options) {
+  return {
+    async check(actor, request) {
+      const verified = await options.access.enforce(actor, request, ({ principal, resource }) => options.policy(principal, resource));
+      return { realmId: verified.realmId, subjectId: verified.subjectId };
+    }
+  };
+}
+function organizationMembershipReader(store) {
+  return async (subject, resource, context) => {
+    context.signal.throwIfAborted();
+    const snapshot = await store.read(resource.organizationId);
+    context.signal.throwIfAborted();
+    const relationship = snapshot?.state.members.find((item) => sameSubject2(item.subject, subject));
+    return relationship && snapshot ? { role: relationship.role, version: snapshot.state.organization.version } : null;
+  };
+}
+export {
+  createAuthOrganizationAccess,
+  organizationMembershipReader
+};

package/dist/capacity.d.ts

@@ -0,0 +1,3 @@
+import { type OrganizationState } from "./contracts";
+export declare const maximumSnapshotBytes = 512000;
+export declare function assertSnapshotCapacity(state: OrganizationState): void;

package/dist/contracts.d.ts

@@ -0,0 +1,96 @@
+/** A business subject reference, structurally compatible with Auth.SubjectRef. */
+export interface SubjectRef {
+    readonly realmId: string;
+    readonly subjectId: string;
+}
+export type MemberRole = "member" | "admin" | "owner";
+export interface Member {
+    subject: SubjectRef;
+    role: MemberRole;
+    joinedAt: number;
+}
+export interface Organization {
+    id: string;
+    name: string;
+    version: number;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface Invitation {
+    id: string;
+    organizationId: string;
+    target: SubjectRef;
+    role: "member";
+    createdBy: SubjectRef;
+    createdAt: number;
+    expiresAt: number;
+    status: "pending" | "accepted" | "revoked" | "expired";
+    resolvedAt: number | null;
+}
+export interface StoredInvitation extends Omit<Invitation, "status"> {
+    status: "pending" | "accepted" | "revoked";
+    tokenDigest: string;
+}
+/** One CAS domain: every relationship change increments the organization version. */
+export interface OrganizationState {
+    organization: Organization;
+    members: Member[];
+    invitations: StoredInvitation[];
+}
+export interface OrganizationSnapshot {
+    state: OrganizationState;
+    /** Storage-authoritative milliseconds, used for invitation expiry. */
+    observedAt: number;
+}
+export interface OrganizationStore {
+    create(state: OrganizationState): Promise<void>;
+    read(organizationId: string): Promise<OrganizationSnapshot | null>;
+    /**
+     * Atomically replace only at expectedVersion. If validUntil is supplied, check
+     * storage time strictly before it at the write boundary, including lock waits.
+     * False means no write. An exception means unknown outcome and MUST NOT retry.
+     */
+    compareAndSwap(expectedVersion: number, next: OrganizationState, validUntil?: number): Promise<boolean>;
+}
+export type OrganizationAction = "organization.create" | "organization.read" | "organization.update" | "member.list" | "member.add" | "member.remove" | "member.leave" | "member.role" | "owner.grant" | "owner.transfer" | "invitation.create" | "invitation.read" | "invitation.list" | "invitation.accept" | "invitation.revoke" | "invitation.prune";
+export interface AccessRequest {
+    action: OrganizationAction;
+    organizationId: string | null;
+    /** Never includes invitation digests. Null on create or missing organization. */
+    organization: Organization | null;
+    members: readonly Member[];
+    target?: SubjectRef;
+    requestedRole?: MemberRole;
+    invitationId?: string;
+    /** Actual scoped invitation, stripped of its digest; null when missing. */
+    invitation?: Invitation | null;
+}
+/**
+ * Trusted integration boundary, not business JSON. Must revalidate identity,
+ * organization scope and action permission each call (including CAS retries).
+ * Cross-organization administration is permitted only by an explicit policy here.
+ */
+export interface OrganizationAccess<Actor> {
+    check(actor: Actor, request: AccessRequest): Promise<SubjectRef>;
+}
+export interface OrganizationConfig {
+    invitationLifetimeMs: number;
+    maxMembers: number;
+    maxInvitations: number;
+    conflictRetries: number;
+}
+export interface MembershipChange {
+    organizationId: string;
+    version: number;
+    action: OrganizationAction;
+    subjects: SubjectRef[];
+}
+export interface MutationResult<T> {
+    value: T;
+    change: MembershipChange;
+}
+export type OrganizationErrorCode = "INVALID_INPUT" | "FORBIDDEN" | "NOT_FOUND" | "LAST_OWNER" | "ALREADY_MEMBER" | "INVITATION_ACCEPTED" | "INVITATION_REVOKED" | "INVITATION_EXPIRED" | "CONFLICT" | "CAPACITY";
+export declare class OrganizationError extends Error {
+    readonly code: OrganizationErrorCode;
+    constructor(code: OrganizationErrorCode);
+}

package/dist/drizzle/d1.d.ts

@@ -0,0 +1,3 @@
+import type { DrizzleD1Database } from "drizzle-orm/d1";
+import type { OrganizationStore } from "../contracts";
+export declare function d1OrganizationStore<TSchema extends Record<string, unknown> = Record<string, unknown>>(db: DrizzleD1Database<TSchema>): OrganizationStore;

package/dist/drizzle/d1.js

@@ -0,0 +1,45 @@
+import {
+  organizations3
+} from "../index-0ax8jdj3.js";
+import {
+  assertValidVersion,
+  validateState,
+  encodeState,
+  decodeSnapshot
+} from "../index-2bwbvaz5.js";
+
+// src/drizzle/d1.ts
+import { and, eq, sql } from "drizzle-orm";
+function d1OrganizationStore(db) {
+  return {
+    async create(state) {
+      await db.insert(organizations3).values({
+        id: state.organization.id,
+        version: state.organization.version,
+        state: encodeState(state)
+      }).run();
+    },
+    async read(id) {
+      const [row] = await db.select({
+        id: organizations3.id,
+        version: organizations3.version,
+        state: organizations3.state,
+        observedAt: sql`CAST(unixepoch('subsec') * 1000 AS INTEGER)`
+      }).from(organizations3).where(eq(organizations3.id, id)).limit(1).all();
+      return row ? decodeSnapshot(row.id, row.version, row.state, Number(row.observedAt)) : null;
+    },
+    async compareAndSwap(expectedVersion, next, validUntil) {
+      assertValidVersion(expectedVersion, "expected version");
+      validateState(next);
+      if (next.organization.version !== expectedVersion + 1)
+        throw new Error("Invalid organization version transition");
+      if (validUntil !== undefined && !Number.isSafeInteger(validUntil))
+        throw new Error("Invalid organization validity deadline");
+      const rows = await db.update(organizations3).set({ version: next.organization.version, state: encodeState(next) }).where(and(eq(organizations3.id, next.organization.id), eq(organizations3.version, expectedVersion), validUntil === undefined ? sql`1 = 1` : sql`CAST(unixepoch('subsec') * 1000 AS INTEGER) < ${validUntil}`)).returning({ id: organizations3.id }).all();
+      return rows.length > 0;
+    }
+  };
+}
+export {
+  d1OrganizationStore
+};

package/dist/drizzle/pg.d.ts

@@ -0,0 +1,3 @@
+import type { PgDatabase, PgQueryResultHKT } from "drizzle-orm/pg-core";
+import type { OrganizationStore } from "../contracts";
+export declare function postgresOrganizationStore<TSchema extends Record<string, unknown> = Record<string, unknown>, TResult extends PgQueryResultHKT = PgQueryResultHKT>(db: PgDatabase<TResult, TSchema>): OrganizationStore;

package/dist/drizzle/pg.js

@@ -0,0 +1,60 @@
+import {
+  organizations2
+} from "../index-zjdv6bc6.js";
+import {
+  assertValidVersion,
+  validateState,
+  encodeState,
+  decodeSnapshot
+} from "../index-2bwbvaz5.js";
+
+// src/drizzle/pg.ts
+import { and, eq, sql } from "drizzle-orm";
+function postgresOrganizationStore(db) {
+  return {
+    async create(state) {
+      const encoded = encodeState(state);
+      await db.insert(organizations2).values({
+        id: state.organization.id,
+        version: state.organization.version,
+        state: encoded
+      });
+    },
+    async read(id) {
+      const [row] = await db.select({
+        id: organizations2.id,
+        version: organizations2.version,
+        state: organizations2.state,
+        observedAt: sql`floor(extract(epoch from clock_timestamp()) * 1000)::bigint`
+      }).from(organizations2).where(eq(organizations2.id, id)).limit(1);
+      return row ? decodeSnapshot(row.id, row.version, row.state, Number(row.observedAt)) : null;
+    },
+    async compareAndSwap(expectedVersion, next, validUntil) {
+      assertValidVersion(expectedVersion, "expected version");
+      validateState(next);
+      if (next.organization.version !== expectedVersion + 1) {
+        throw new Error("Invalid organization version transition");
+      }
+      const encoded = encodeState(next);
+      return db.transaction(async (tx) => {
+        const locked = await tx.select({ id: organizations2.id }).from(organizations2).where(eq(organizations2.id, next.organization.id)).for("update");
+        if (!locked.length)
+          return false;
+        const conditions = [
+          eq(organizations2.id, next.organization.id),
+          eq(organizations2.version, expectedVersion)
+        ];
+        if (validUntil !== undefined) {
+          if (!Number.isSafeInteger(validUntil))
+            throw new Error("Invalid organization validity deadline");
+          conditions.push(sql`floor(extract(epoch from clock_timestamp()) * 1000)::bigint < ${validUntil}::bigint`);
+        }
+        const rows = await tx.update(organizations2).set({ version: next.organization.version, state: encoded }).where(and(...conditions)).returning({ id: organizations2.id });
+        return rows.length > 0;
+      });
+    }
+  };
+}
+export {
+  postgresOrganizationStore
+};

package/dist/drizzle/schema-pg.d.ts

@@ -0,0 +1,58 @@
+export declare const organizations: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "organizations";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "organizations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        version: import("drizzle-orm/pg-core").PgColumn<{
+            name: "version";
+            tableName: "organizations";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        state: import("drizzle-orm/pg-core").PgColumn<{
+            name: "state";
+            tableName: "organizations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;

package/dist/drizzle/schema-pg.js

@@ -0,0 +1,6 @@
+import {
+  organizations2
+} from "../index-zjdv6bc6.js";
+export {
+  organizations2 as organizations
+};

package/dist/drizzle/schema-sqlite.d.ts

@@ -0,0 +1,62 @@
+export declare const organizations: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "organizations";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "organizations";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        version: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "version";
+            tableName: "organizations";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        state: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "state";
+            tableName: "organizations";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: 'sqlite';
+}>;

package/dist/drizzle/schema-sqlite.js

@@ -0,0 +1,6 @@
+import {
+  organizations3
+} from "../index-0ax8jdj3.js";
+export {
+  organizations3 as organizations
+};

package/dist/drizzle/shared.d.ts

@@ -0,0 +1,5 @@
+import type { OrganizationSnapshot, OrganizationState } from "../contracts";
+export declare function assertValidVersion(value: number, label: string): void;
+export declare function validateState(state: OrganizationState): void;
+export declare function encodeState(state: OrganizationState): string;
+export declare function decodeSnapshot(id: string, version: number, encoded: string, observedAt: number): OrganizationSnapshot;

package/dist/index-0ax8jdj3.js

@@ -0,0 +1,9 @@
+// src/drizzle/schema-sqlite.ts
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+var organizations3 = sqliteTable("organizations", {
+  id: text("id").primaryKey(),
+  version: integer("version").notNull(),
+  state: text("state").notNull()
+});
+
+export { organizations3 };