@nlabs/reaktor 1.17.0 → 1.18.0

package/lib/organizations/signup.js

@@ -0,0 +1,169 @@
+import { createHash, createPassword, parsePassword } from '@nlabs/utils/parsers/strings';
+import { createHmac, randomBytes } from 'node:crypto';
+import { organizationUserId } from './authorization.js';
+import { encodeOrganizationMail, organizationMailKey } from './mail.js';
+import { newOrganizationId, organizationKey, organizationStoreFor, requireIdentifier } from './store.js';
+export const queueOrganizationVerification = async (tx, registration, previous)=>{
+    const now = Date.now();
+    const token = randomBytes(32).toString('base64url');
+    const withinHour = previous && now - previous.resendWindow < 3600000;
+    const verification = {
+        attemptWindow: previous?.attemptWindow || now,
+        attempts: previous?.attempts || 0,
+        expiresAt: now + 24 * 3600000,
+        lastSent: now,
+        resendCount: withinHour ? previous.resendCount + 1 : 1,
+        resendWindow: withinHour ? previous.resendWindow : now,
+        tokenHash: organizationKey(token),
+        used: false,
+        userId: registration.userId
+    };
+    await tx.put('organizationVerificationTokens', registration.registrationId, verification, previous);
+    const jobId = newOrganizationId();
+    const job = {
+        attempts: 0,
+        desired: {
+            ciphertext: encodeOrganizationMail({
+                email: registration.email,
+                registrationId: registration.registrationId,
+                token
+            })
+        },
+        effectiveAt: now,
+        jobId,
+        kind: 'mail',
+        leaseExpires: 0,
+        organizationId: registration.organizationId,
+        owner: '',
+        priceVersion: '2026-10-v1',
+        sequence: -now,
+        status: 'pending'
+    };
+    await tx.put('organizationBillingJobs', jobId, job);
+};
+const insertOrganization = async (tx, name, userId)=>{
+    const now = Date.now();
+    const organization = {
+        createdAt: now,
+        name,
+        organizationId: newOrganizationId(),
+        ownerUserId: userId,
+        revision: 0,
+        updatedAt: now
+    };
+    const membership = {
+        createdAt: now,
+        organizationId: organization.organizationId,
+        revision: 0,
+        role: 'admin',
+        status: 'active',
+        updatedAt: now,
+        userId
+    };
+    await tx.put('organizations', organization.organizationId, organization);
+    await tx.put('organizationMemberships', organizationKey(organization.organizationId, userId), membership);
+    return organization;
+};
+export const registerOrganization = async (input, controlContext)=>{
+    if (!input || Object.keys(input).some((key)=>![
+            'email',
+            'organizationName',
+            'password',
+            'requestId'
+        ].includes(key)) || typeof input.email !== 'string' || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input.email) || input.email.length > 254 || typeof input.password !== 'string' || input.password.length < 12 || input.password.length > 128 || typeof input.organizationName !== 'string' || !input.organizationName.trim() || input.organizationName.length > 160) {
+        throw new Error('invalid_signup');
+    }
+    requireIdentifier(input.requestId);
+    const email = input.email.trim().toLowerCase();
+    const fingerprint = createHmac('sha256', organizationMailKey()).update(JSON.stringify({
+        ...input,
+        email
+    })).digest('hex');
+    const registrationId = organizationKey('registration', email, input.requestId);
+    return organizationStoreFor(controlContext).transaction(async (tx)=>{
+        const previous = await tx.get('organizationRegistrations', registrationId);
+        if (previous) {
+            if (previous.fingerprint !== fingerprint) {
+                throw new Error('registration_conflict');
+            }
+            return {
+                registrationId,
+                verificationRequired: true
+            };
+        }
+        const users = await tx.find('users', {
+            email
+        });
+        const userId = createHash(email);
+        const collision = await tx.get('users', userId);
+        const existing = users.length > 0 || Boolean(collision);
+        let organizationId = '';
+        if (!existing) {
+            const salt = randomBytes(32).toString('hex');
+            await tx.put('users', userId, {
+                active: true,
+                added: Date.now(),
+                email,
+                locale: 'en',
+                organizationAccount: true,
+                password: createPassword(parsePassword(input.password), salt),
+                salt,
+                type: 'user',
+                userAccess: 0,
+                username: email,
+                verifiedEmail: false
+            });
+            ({ organizationId } = await insertOrganization(tx, input.organizationName.trim(), userId));
+        }
+        const registration = {
+            email,
+            fingerprint,
+            organizationId,
+            registrationId,
+            requestId: input.requestId,
+            userId: existing ? '' : userId
+        };
+        await tx.put('organizationRegistrations', registrationId, registration);
+        if (!existing) {
+            await queueOrganizationVerification(tx, registration);
+        }
+        return {
+            registrationId,
+            verificationRequired: true
+        };
+    });
+};
+export const createOrganization = (context, name, requestId)=>organizationStoreFor(context).transaction(async (tx)=>{
+        const userId = organizationUserId(context);
+        const user = await tx.get('users', userId);
+        if (!user?.active || !user.verifiedEmail) {
+            throw new Error('email_verification_required');
+        }
+        if (typeof name !== 'string' || !name.trim() || name.length > 160) {
+            throw new Error('invalid_organization_name');
+        }
+        const key = organizationKey('authenticated-organization', userId, requireIdentifier(requestId));
+        const previous = await tx.get('organizationRegistrations', key);
+        if (previous) {
+            if (previous.name !== name.trim()) {
+                throw new Error('registration_conflict');
+            }
+            const existing = await tx.get('organizations', previous.organizationId);
+            const { _key, _rev, ...organization } = existing;
+            return organization;
+        }
+        const org = await insertOrganization(tx, name.trim(), userId);
+        await tx.put('organizationRegistrations', key, {
+            name: name.trim(),
+            organizationId: org.organizationId,
+            requestId: key,
+            userId
+        });
+        await tx.put('users', userId, {
+            ...user,
+            organizationAccount: true
+        }, user);
+        return org;
+    });
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9Vc2Vycy9uaXRyb2c3L0RldmVsb3BtZW50L3JlYWt0b3IvcGFja2FnZXMvcmVha3Rvci9zcmMvb3JnYW5pemF0aW9ucy9zaWdudXAudHMiXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHtjcmVhdGVIYXNoLCBjcmVhdGVQYXNzd29yZCwgcGFyc2VQYXNzd29yZH0gZnJvbSAnQG5sYWJzL3V0aWxzL3BhcnNlcnMvc3RyaW5ncyc7XG5pbXBvcnQge2NyZWF0ZUhtYWMsIHJhbmRvbUJ5dGVzfSBmcm9tICdub2RlOmNyeXB0byc7XG5cbmltcG9ydCB7b3JnYW5pemF0aW9uVXNlcklkfSBmcm9tICcuL2F1dGhvcml6YXRpb24uanMnO1xuaW1wb3J0IHtlbmNvZGVPcmdhbml6YXRpb25NYWlsLCBvcmdhbml6YXRpb25NYWlsS2V5fSBmcm9tICcuL21haWwuanMnO1xuaW1wb3J0IHtcbiAgbmV3T3JnYW5pemF0aW9uSWQsXG4gIG9yZ2FuaXphdGlvbktleSxcbiAgb3JnYW5pemF0aW9uU3RvcmVGb3IsXG4gIHJlcXVpcmVJZGVudGlmaWVyLFxuICB0eXBlIE9yZ2FuaXphdGlvblRyYW5zYWN0aW9uXG59IGZyb20gJy4vc3RvcmUuanMnO1xuXG5pbXBvcnQgdHlwZSB7QXBpQ29udGV4dH0gZnJvbSAnLi4vdHlwZXMvYXV0aC50eXBlcy5qcyc7XG5pbXBvcnQgdHlwZSB7QmlsbGluZ0pvYiwgT3JnYW5pemF0aW9uLCBPcmdhbml6YXRpb25NZW1iZXJzaGlwLCBTaWdudXBJbnB1dCwgU2lnbnVwUmVzdWx0fSBmcm9tICcuL3R5cGVzLmpzJztcblxuZXhwb3J0IHR5cGUgUmVnaXN0cmF0aW9uID0ge1xuICBlbWFpbDogc3RyaW5nO1xuICBmaW5nZXJwcmludDogc3RyaW5nO1xuICBvcmdhbml6YXRpb25JZDogc3RyaW5nO1xuICByZWdpc3RyYXRpb25JZDogc3RyaW5nO1xuICByZXF1ZXN0SWQ6IHN0cmluZztcbiAgdXNlcklkOiBzdHJpbmc7XG59O1xuZXhwb3J0IHR5cGUgVmVyaWZpY2F0aW9uID0ge1xuICBhdHRlbXB0czogbnVtYmVyO1xuICBhdHRlbXB0V2luZG93OiBudW1iZXI7XG4gIGV4cGlyZXNBdDogbnVtYmVyO1xuICBsYXN0U2VudDogbnVtYmVyO1xuICByZXNlbmRDb3VudDogbnVtYmVyO1xuICByZXNlbmRXaW5kb3c6IG51bWJlcjtcbiAgdG9rZW5IYXNoOiBzdHJpbmc7XG4gIHVzZWQ6IGJvb2xlYW47XG4gIHVzZXJJZDogc3RyaW5nO1xufTtcbmV4cG9ydCBjb25zdCBxdWV1ZU9yZ2FuaXphdGlvblZlcmlmaWNhdGlvbiA9IGFzeW5jIChcbiAgdHg6IE9yZ2FuaXphdGlvblRyYW5zYWN0aW9uLFxuICByZWdpc3RyYXRpb246IFJlZ2lzdHJhdGlvbixcbiAgcHJldmlvdXM/OiBpbXBvcnQoJy4vc3RvcmUuanMnKS5TdG9yZWQ8VmVyaWZpY2F0aW9uPiB8IG51bGxcbik6IFByb21pc2U8dm9pZD4gPT4ge1xuICBjb25zdCBub3cgPSBEYXRlLm5vdygpO1xuICBjb25zdCB0b2tlbiA9IHJhbmRvbUJ5dGVzKDMyKS50b1N0cmluZygnYmFzZTY0dXJsJyk7XG4gIGNvbnN0IHdpdGhpbkhvdXIgPSBwcmV2aW91cyAmJiBub3cgLSBwcmV2aW91cy5yZXNlbmRXaW5kb3cgPCAzNjAwMDAwO1xuICBjb25zdCB2ZXJpZmljYXRpb246IFZlcmlmaWNhdGlvbiA9IHtcbiAgICBhdHRlbXB0V2luZG93OiBwcmV2aW91cz8uYXR0ZW1wdFdpbmRvdyB8fCBub3csXG4gICAgYXR0ZW1wdHM6IHByZXZpb3VzPy5hdHRlbXB0cyB8fCAwLFxuICAgIGV4cGlyZXNBdDogbm93ICsgKDI0ICogMzYwMDAwMCksXG4gICAgbGFzdFNlbnQ6IG5vdyxcbiAgICByZXNlbmRDb3VudDogd2l0aGluSG91ciA/IHByZXZpb3VzLnJlc2VuZENvdW50ICsgMSA6IDEsXG4gICAgcmVzZW5kV2luZG93OiB3aXRoaW5Ib3VyID8gcHJldmlvdXMucmVzZW5kV2luZG93IDogbm93LFxuICAgIHRva2VuSGFzaDogb3JnYW5pemF0aW9uS2V5KHRva2VuKSxcbiAgICB1c2VkOiBmYWxzZSxcbiAgICB1c2VySWQ6IHJlZ2lzdHJhdGlvbi51c2VySWRcbiAgfTtcbiAgYXdhaXQgdHgucHV0KCdvcmdhbml6YXRpb25WZXJpZmljYXRpb25Ub2tlbnMnLCByZWdpc3RyYXRpb24ucmVnaXN0cmF0aW9uSWQsIHZlcmlmaWNhdGlvbiwgcHJldmlvdXMpO1xuICBjb25zdCBqb2JJZCA9IG5ld09yZ2FuaXphdGlvbklkKCk7XG4gIGNvbnN0IGpvYjogQmlsbGluZ0pvYiA9IHtcbiAgICBhdHRlbXB0czogMCxcbiAgICBkZXNpcmVkOiB7XG4gICAgICBjaXBoZXJ0ZXh0OiBlbmNvZGVPcmdhbml6YXRpb25NYWlsKHtcbiAgICAgICAgZW1haWw6IHJlZ2lzdHJhdGlvbi5lbWFpbCxcbiAgICAgICAgcmVnaXN0cmF0aW9uSWQ6IHJlZ2lzdHJhdGlvbi5yZWdpc3RyYXRpb25JZCxcbiAgICAgICAgdG9rZW5cbiAgICAgIH0pXG4gICAgfSxcbiAgICBlZmZlY3RpdmVBdDogbm93LFxuICAgIGpvYklkLFxuICAgIGtpbmQ6ICdtYWlsJyxcbiAgICBsZWFzZUV4cGlyZXM6IDAsXG4gICAgb3JnYW5pemF0aW9uSWQ6IHJlZ2lzdHJhdGlvbi5vcmdhbml6YXRpb25JZCxcbiAgICBvd25lcjogJycsXG4gICAgcHJpY2VWZXJzaW9uOiAnMjAyNi0xMC12MScsXG4gICAgc2VxdWVuY2U6IC1ub3csXG4gICAgc3RhdHVzOiAncGVuZGluZydcbiAgfTtcbiAgYXdhaXQgdHgucHV0KCdvcmdhbml6YXRpb25CaWxsaW5nSm9icycsIGpvYklkLCBqb2IpO1xufTtcblxuY29uc3QgaW5zZXJ0T3JnYW5pemF0aW9uID0gYXN5bmMgKFxuICB0eDogT3JnYW5pemF0aW9uVHJhbnNhY3Rpb24sXG4gIG5hbWU6IHN0cmluZyxcbiAgdXNlcklkOiBzdHJpbmdcbik6IFByb21pc2U8T3JnYW5pemF0aW9uPiA9PiB7XG4gIGNvbnN0IG5vdyA9IERhdGUubm93KCk7XG4gIGNvbnN0IG9yZ2FuaXphdGlvbjogT3JnYW5pemF0aW9uID0ge1xuICAgIGNyZWF0ZWRBdDogbm93LFxuICAgIG5hbWUsXG4gICAgb3JnYW5pemF0aW9uSWQ6IG5ld09yZ2FuaXphdGlvbklkKCksXG4gICAgb3duZXJVc2VySWQ6IHVzZXJJZCxcbiAgICByZXZpc2lvbjogMCxcbiAgICB1cGRhdGVkQXQ6IG5vd1xuICB9O1xuICBjb25zdCBtZW1iZXJzaGlwOiBPcmdhbml6YXRpb25NZW1iZXJzaGlwID0ge1xuICAgIGNyZWF0ZWRBdDogbm93LFxuICAgIG9yZ2FuaXphdGlvbklkOiBvcmdhbml6YXRpb24ub3JnYW5pemF0aW9uSWQsXG4gICAgcmV2aXNpb246IDAsXG4gICAgcm9sZTogJ2FkbWluJyxcbiAgICBzdGF0dXM6ICdhY3RpdmUnLFxuICAgIHVwZGF0ZWRBdDogbm93LFxuICAgIHVzZXJJZFxuICB9O1xuICBhd2FpdCB0eC5wdXQoJ29yZ2FuaXphdGlvbnMnLCBvcmdhbml6YXRpb24ub3JnYW5pemF0aW9uSWQsIG9yZ2FuaXphdGlvbik7XG4gIGF3YWl0IHR4LnB1dCgnb3JnYW5pemF0aW9uTWVtYmVyc2hpcHMnLCBvcmdhbml6YXRpb25LZXkob3JnYW5pemF0aW9uLm9yZ2FuaXphdGlvbklkLCB1c2VySWQpLCBtZW1iZXJzaGlwKTtcbiAgcmV0dXJuIG9yZ2FuaXphdGlvbjtcbn07XG5cbmV4cG9ydCBjb25zdCByZWdpc3Rlck9yZ2FuaXphdGlvbiA9IGFzeW5jIChcbiAgaW5wdXQ6IFNpZ251cElucHV0LFxuICBjb250cm9sQ29udGV4dDogQXBpQ29udGV4dFxuKTogUHJvbWlzZTxTaWdudXBSZXN1bHQ+ID0+IHtcbiAgaWYoXG4gICAgIWlucHV0IHx8XG4gICAgT2JqZWN0LmtleXMoaW5wdXQpLnNvbWUoKGtleSkgPT4gIVsnZW1haWwnLCAnb3JnYW5pemF0aW9uTmFtZScsICdwYXNzd29yZCcsICdyZXF1ZXN0SWQnXS5pbmNsdWRlcyhrZXkpKSB8fFxuICAgIHR5cGVvZiBpbnB1dC5lbWFpbCAhPT0gJ3N0cmluZycgfHxcbiAgICAhL15bXlxcc0BdK0BbXlxcc0BdK1xcLlteXFxzQF0rJC8udGVzdChpbnB1dC5lbWFpbCkgfHxcbiAgICBpbnB1dC5lbWFpbC5sZW5ndGggPiAyNTQgfHxcbiAgICB0eXBlb2YgaW5wdXQucGFzc3dvcmQgIT09ICdzdHJpbmcnIHx8XG4gICAgaW5wdXQucGFzc3dvcmQubGVuZ3RoIDwgMTIgfHxcbiAgICBpbnB1dC5wYXNzd29yZC5sZW5ndGggPiAxMjggfHxcbiAgICB0eXBlb2YgaW5wdXQub3JnYW5pemF0aW9uTmFtZSAhPT0gJ3N0cmluZycgfHxcbiAgICAhaW5wdXQub3JnYW5pemF0aW9uTmFtZS50cmltKCkgfHxcbiAgICBpbnB1dC5vcmdhbml6YXRpb25OYW1lLmxlbmd0aCA+IDE2MFxuICApIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2ludmFsaWRfc2lnbnVwJyk7XG4gIH1cbiAgcmVxdWlyZUlkZW50aWZpZXIoaW5wdXQucmVxdWVzdElkKTtcbiAgY29uc3QgZW1haWwgPSBpbnB1dC5lbWFpbC50cmltKCkudG9Mb3dlckNhc2UoKTtcbiAgY29uc3QgZmluZ2VycHJpbnQgPSBjcmVhdGVIbWFjKCdzaGEyNTYnLCBvcmdhbml6YXRpb25NYWlsS2V5KCkpXG4gICAgLnVwZGF0ZShKU09OLnN0cmluZ2lmeSh7Li4uaW5wdXQsIGVtYWlsfSkpXG4gICAgLmRpZ2VzdCgnaGV4Jyk7XG4gIGNvbnN0IHJlZ2lzdHJhdGlvbklkID0gb3JnYW5pemF0aW9uS2V5KCdyZWdpc3RyYXRpb24nLCBlbWFpbCwgaW5wdXQucmVxdWVzdElkKTtcbiAgcmV0dXJuIG9yZ2FuaXphdGlvblN0b3JlRm9yKGNvbnRyb2xDb250ZXh0KS50cmFuc2FjdGlvbihhc3luYyAodHgpID0+IHtcbiAgICBjb25zdCBwcmV2aW91cyA9IGF3YWl0IHR4LmdldDxSZWdpc3RyYXRpb24+KCdvcmdhbml6YXRpb25SZWdpc3RyYXRpb25zJywgcmVnaXN0cmF0aW9uSWQpO1xuICAgIGlmKHByZXZpb3VzKSB7XG4gICAgICBpZihwcmV2aW91cy5maW5nZXJwcmludCAhPT0gZmluZ2VycHJpbnQpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKCdyZWdpc3RyYXRpb25fY29uZmxpY3QnKTtcbiAgICAgIH1cbiAgICAgIHJldHVybiB7cmVnaXN0cmF0aW9uSWQsIHZlcmlmaWNhdGlvblJlcXVpcmVkOiB0cnVlfTtcbiAgICB9XG4gICAgY29uc3QgdXNlcnMgPSBhd2FpdCB0eC5maW5kKCd1c2VycycsIHtlbWFpbH0pO1xuICAgIGNvbnN0IHVzZXJJZCA9IGNyZWF0ZUhhc2goZW1haWwpO1xuICAgIGNvbnN0IGNvbGxpc2lvbiA9IGF3YWl0IHR4LmdldCgndXNlcnMnLCB1c2VySWQpO1xuICAgIGNvbnN0IGV4aXN0aW5nID0gdXNlcnMubGVuZ3RoID4gMCB8fCBCb29sZWFuKGNvbGxpc2lvbik7XG4gICAgbGV0IG9yZ2FuaXphdGlvbklkID0gJyc7XG4gICAgaWYoIWV4aXN0aW5nKSB7XG4gICAgICBjb25zdCBzYWx0ID0gcmFuZG9tQnl0ZXMoMzIpLnRvU3RyaW5nKCdoZXgnKTtcbiAgICAgIGF3YWl0IHR4LnB1dCgndXNlcnMnLCB1c2VySWQsIHtcbiAgICAgICAgYWN0aXZlOiB0cnVlLFxuICAgICAgICBhZGRlZDogRGF0ZS5ub3coKSxcbiAgICAgICAgZW1haWwsXG4gICAgICAgIGxvY2FsZTogJ2VuJyxcbiAgICAgICAgb3JnYW5pemF0aW9uQWNjb3VudDogdHJ1ZSxcbiAgICAgICAgcGFzc3dvcmQ6IGNyZWF0ZVBhc3N3b3JkKHBhcnNlUGFzc3dvcmQoaW5wdXQucGFzc3dvcmQpLCBzYWx0KSxcbiAgICAgICAgc2FsdCxcbiAgICAgICAgdHlwZTogJ3VzZXInLFxuICAgICAgICB1c2VyQWNjZXNzOiAwLFxuICAgICAgICB1c2VybmFtZTogZW1haWwsXG4gICAgICAgIHZlcmlmaWVkRW1haWw6IGZhbHNlXG4gICAgICB9KTtcbiAgICAgICh7b3JnYW5pemF0aW9uSWR9ID0gYXdhaXQgaW5zZXJ0T3JnYW5pemF0aW9uKHR4LCBpbnB1dC5vcmdhbml6YXRpb25OYW1lLnRyaW0oKSwgdXNlcklkKSk7XG4gICAgfVxuICAgIGNvbnN0IHJlZ2lzdHJhdGlvbjogUmVnaXN0cmF0aW9uID0ge1xuICAgICAgZW1haWwsXG4gICAgICBmaW5nZXJwcmludCxcbiAgICAgIG9yZ2FuaXphdGlvbklkLFxuICAgICAgcmVnaXN0cmF0aW9uSWQsXG4gICAgICByZXF1ZXN0SWQ6IGlucHV0LnJlcXVlc3RJZCxcbiAgICAgIHVzZXJJZDogZXhpc3RpbmcgPyAnJyA6IHVzZXJJZFxuICAgIH07XG4gICAgYXdhaXQgdHgucHV0KCdvcmdhbml6YXRpb25SZWdpc3RyYXRpb25zJywgcmVnaXN0cmF0aW9uSWQsIHJlZ2lzdHJhdGlvbik7XG4gICAgaWYoIWV4aXN0aW5nKSB7XG4gICAgICBhd2FpdCBxdWV1ZU9yZ2FuaXphdGlvblZlcmlmaWNhdGlvbih0eCwgcmVnaXN0cmF0aW9uKTtcbiAgICB9XG4gICAgcmV0dXJuIHtyZWdpc3RyYXRpb25JZCwgdmVyaWZpY2F0aW9uUmVxdWlyZWQ6IHRydWV9O1xuICB9KTtcbn07XG5cbmV4cG9ydCBjb25zdCBjcmVhdGVPcmdhbml6YXRpb24gPSAoXG4gIGNvbnRleHQ6IEFwaUNvbnRleHQsXG4gIG5hbWU6IHN0cmluZyxcbiAgcmVxdWVzdElkOiBzdHJpbmdcbik6IFByb21pc2U8T3JnYW5pemF0aW9uPiA9PlxuICBvcmdhbml6YXRpb25TdG9yZUZvcihjb250ZXh0KS50cmFuc2FjdGlvbihhc3luYyAodHgpID0+IHtcbiAgICBjb25zdCB1c2VySWQgPSBvcmdhbml6YXRpb25Vc2VySWQoY29udGV4dCk7XG4gICAgY29uc3QgdXNlciA9IGF3YWl0IHR4LmdldDx7YWN0aXZlOiBib29sZWFuOyB2ZXJpZmllZEVtYWlsOiBib29sZWFufT4oJ3VzZXJzJywgdXNlcklkKTtcbiAgICBpZighdXNlcj8uYWN0aXZlIHx8ICF1c2VyLnZlcmlmaWVkRW1haWwpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignZW1haWxfdmVyaWZpY2F0aW9uX3JlcXVpcmVkJyk7XG4gICAgfVxuICAgIGlmKHR5cGVvZiBuYW1lICE9PSAnc3RyaW5nJyB8fCAhbmFtZS50cmltKCkgfHwgbmFtZS5sZW5ndGggPiAxNjApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignaW52YWxpZF9vcmdhbml6YXRpb25fbmFtZScpO1xuICAgIH1cbiAgICBjb25zdCBrZXkgPSBvcmdhbml6YXRpb25LZXkoJ2F1dGhlbnRpY2F0ZWQtb3JnYW5pemF0aW9uJywgdXNlcklkLCByZXF1aXJlSWRlbnRpZmllcihyZXF1ZXN0SWQpKTtcbiAgICBjb25zdCBwcmV2aW91cyA9IGF3YWl0IHR4LmdldDx7bmFtZTogc3RyaW5nOyBvcmdhbml6YXRpb25JZDogc3RyaW5nfT4oJ29yZ2FuaXphdGlvblJlZ2lzdHJhdGlvbnMnLCBrZXkpO1xuICAgIGlmKHByZXZpb3VzKSB7XG4gICAgICBpZihwcmV2aW91cy5uYW1lICE9PSBuYW1lLnRyaW0oKSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoJ3JlZ2lzdHJhdGlvbl9jb25mbGljdCcpO1xuICAgICAgfVxuICAgICAgY29uc3QgZXhpc3RpbmcgPSAoYXdhaXQgdHguZ2V0PE9yZ2FuaXphdGlvbj4oJ29yZ2FuaXphdGlvbnMnLCBwcmV2aW91cy5vcmdhbml6YXRpb25JZCkpITtcbiAgICAgIGNvbnN0IHtfa2V5LCBfcmV2LCAuLi5vcmdhbml6YXRpb259ID0gZXhpc3Rpbmc7XG4gICAgICByZXR1cm4gb3JnYW5pemF0aW9uO1xuICAgIH1cbiAgICBjb25zdCBvcmcgPSBhd2FpdCBpbnNlcnRPcmdhbml6YXRpb24odHgsIG5hbWUudHJpbSgpLCB1c2VySWQpO1xuICAgIGF3YWl0IHR4LnB1dCgnb3JnYW5pemF0aW9uUmVnaXN0cmF0aW9ucycsIGtleSwge1xuICAgICAgbmFtZTogbmFtZS50cmltKCksXG4gICAgICBvcmdhbml6YXRpb25JZDogb3JnLm9yZ2FuaXphdGlvbklkLFxuICAgICAgcmVxdWVzdElkOiBrZXksXG4gICAgICB1c2VySWRcbiAgICB9KTtcbiAgICBhd2FpdCB0eC5wdXQoJ3VzZXJzJywgdXNlcklkLCB7Li4udXNlciwgb3JnYW5pemF0aW9uQWNjb3VudDogdHJ1ZX0sIHVzZXIpO1xuICAgIHJldHVybiBvcmc7XG4gIH0pO1xuIl0sIm5hbWVzIjpbImNyZWF0ZUhhc2giLCJjcmVhdGVQYXNzd29yZCIsInBhcnNlUGFzc3dvcmQiLCJjcmVhdGVIbWFjIiwicmFuZG9tQnl0ZXMiLCJvcmdhbml6YXRpb25Vc2VySWQiLCJlbmNvZGVPcmdhbml6YXRpb25NYWlsIiwib3JnYW5pemF0aW9uTWFpbEtleSIsIm5ld09yZ2FuaXphdGlvbklkIiwib3JnYW5pemF0aW9uS2V5Iiwib3JnYW5pemF0aW9uU3RvcmVGb3IiLCJyZXF1aXJlSWRlbnRpZmllciIsInF1ZXVlT3JnYW5pemF0aW9uVmVyaWZpY2F0aW9uIiwidHgiLCJyZWdpc3RyYXRpb24iLCJwcmV2aW91cyIsIm5vdyIsIkRhdGUiLCJ0b2tlbiIsInRvU3RyaW5nIiwid2l0aGluSG91ciIsInJlc2VuZFdpbmRvdyIsInZlcmlmaWNhdGlvbiIsImF0dGVtcHRXaW5kb3ciLCJhdHRlbXB0cyIsImV4cGlyZXNBdCIsImxhc3RTZW50IiwicmVzZW5kQ291bnQiLCJ0b2tlbkhhc2giLCJ1c2VkIiwidXNlcklkIiwicHV0IiwicmVnaXN0cmF0aW9uSWQiLCJqb2JJZCIsImpvYiIsImRlc2lyZWQiLCJjaXBoZXJ0ZXh0IiwiZW1haWwiLCJlZmZlY3RpdmVBdCIsImtpbmQiLCJsZWFzZUV4cGlyZXMiLCJvcmdhbml6YXRpb25JZCIsIm93bmVyIiwicHJpY2VWZXJzaW9uIiwic2VxdWVuY2UiLCJzdGF0dXMiLCJpbnNlcnRPcmdhbml6YXRpb24iLCJuYW1lIiwib3JnYW5pemF0aW9uIiwiY3JlYXRlZEF0Iiwib3duZXJVc2VySWQiLCJyZXZpc2lvbiIsInVwZGF0ZWRBdCIsIm1lbWJlcnNoaXAiLCJyb2xlIiwicmVnaXN0ZXJPcmdhbml6YXRpb24iLCJpbnB1dCIsImNvbnRyb2xDb250ZXh0IiwiT2JqZWN0Iiwia2V5cyIsInNvbWUiLCJrZXkiLCJpbmNsdWRlcyIsInRlc3QiLCJsZW5ndGgiLCJwYXNzd29yZCIsIm9yZ2FuaXphdGlvbk5hbWUiLCJ0cmltIiwiRXJyb3IiLCJyZXF1ZXN0SWQiLCJ0b0xvd2VyQ2FzZSIsImZpbmdlcnByaW50IiwidXBkYXRlIiwiSlNPTiIsInN0cmluZ2lmeSIsImRpZ2VzdCIsInRyYW5zYWN0aW9uIiwiZ2V0IiwidmVyaWZpY2F0aW9uUmVxdWlyZWQiLCJ1c2VycyIsImZpbmQiLCJjb2xsaXNpb24iLCJleGlzdGluZyIsIkJvb2xlYW4iLCJzYWx0IiwiYWN0aXZlIiwiYWRkZWQiLCJsb2NhbGUiLCJvcmdhbml6YXRpb25BY2NvdW50IiwidHlwZSIsInVzZXJBY2Nlc3MiLCJ1c2VybmFtZSIsInZlcmlmaWVkRW1haWwiLCJjcmVhdGVPcmdhbml6YXRpb24iLCJjb250ZXh0IiwidXNlciIsIl9rZXkiLCJfcmV2Iiwib3JnIl0sIm1hcHBpbmdzIjoiQUFBQSxTQUFRQSxVQUFVLEVBQUVDLGNBQWMsRUFBRUMsYUFBYSxRQUFPLCtCQUErQjtBQUN2RixTQUFRQyxVQUFVLEVBQUVDLFdBQVcsUUFBTyxjQUFjO0FBRXBELFNBQVFDLGtCQUFrQixRQUFPLHFCQUFxQjtBQUN0RCxTQUFRQyxzQkFBc0IsRUFBRUMsbUJBQW1CLFFBQU8sWUFBWTtBQUN0RSxTQUNFQyxpQkFBaUIsRUFDakJDLGVBQWUsRUFDZkMsb0JBQW9CLEVBQ3BCQyxpQkFBaUIsUUFFWixhQUFhO0FBd0JwQixPQUFPLE1BQU1DLGdDQUFnQyxPQUMzQ0MsSUFDQUMsY0FDQUM7SUFFQSxNQUFNQyxNQUFNQyxLQUFLRCxHQUFHO0lBQ3BCLE1BQU1FLFFBQVFkLFlBQVksSUFBSWUsUUFBUSxDQUFDO0lBQ3ZDLE1BQU1DLGFBQWFMLFlBQVlDLE1BQU1ELFNBQVNNLFlBQVksR0FBRztJQUM3RCxNQUFNQyxlQUE2QjtRQUNqQ0MsZUFBZVIsVUFBVVEsaUJBQWlCUDtRQUMxQ1EsVUFBVVQsVUFBVVMsWUFBWTtRQUNoQ0MsV0FBV1QsTUFBTyxLQUFLO1FBQ3ZCVSxVQUFVVjtRQUNWVyxhQUFhUCxhQUFhTCxTQUFTWSxXQUFXLEdBQUcsSUFBSTtRQUNyRE4sY0FBY0QsYUFBYUwsU0FBU00sWUFBWSxHQUFHTDtRQUNuRFksV0FBV25CLGdCQUFnQlM7UUFDM0JXLE1BQU07UUFDTkMsUUFBUWhCLGFBQWFnQixNQUFNO0lBQzdCO0lBQ0EsTUFBTWpCLEdBQUdrQixHQUFHLENBQUMsa0NBQWtDakIsYUFBYWtCLGNBQWMsRUFBRVYsY0FBY1A7SUFDMUYsTUFBTWtCLFFBQVF6QjtJQUNkLE1BQU0wQixNQUFrQjtRQUN0QlYsVUFBVTtRQUNWVyxTQUFTO1lBQ1BDLFlBQVk5Qix1QkFBdUI7Z0JBQ2pDK0IsT0FBT3ZCLGFBQWF1QixLQUFLO2dCQUN6QkwsZ0JBQWdCbEIsYUFBYWtCLGNBQWM7Z0JBQzNDZDtZQUNGO1FBQ0Y7UUFDQW9CLGFBQWF0QjtRQUNiaUI7UUFDQU0sTUFBTTtRQUNOQyxjQUFjO1FBQ2RDLGdCQUFnQjNCLGFBQWEyQixjQUFjO1FBQzNDQyxPQUFPO1FBQ1BDLGNBQWM7UUFDZEMsVUFBVSxDQUFDNUI7UUFDWDZCLFFBQVE7SUFDVjtJQUNBLE1BQU1oQyxHQUFHa0IsR0FBRyxDQUFDLDJCQUEyQkUsT0FBT0M7QUFDakQsRUFBRTtBQUVGLE1BQU1ZLHFCQUFxQixPQUN6QmpDLElBQ0FrQyxNQUNBakI7SUFFQSxNQUFNZCxNQUFNQyxLQUFLRCxHQUFHO0lBQ3BCLE1BQU1nQyxlQUE2QjtRQUNqQ0MsV0FBV2pDO1FBQ1grQjtRQUNBTixnQkFBZ0JqQztRQUNoQjBDLGFBQWFwQjtRQUNicUIsVUFBVTtRQUNWQyxXQUFXcEM7SUFDYjtJQUNBLE1BQU1xQyxhQUFxQztRQUN6Q0osV0FBV2pDO1FBQ1h5QixnQkFBZ0JPLGFBQWFQLGNBQWM7UUFDM0NVLFVBQVU7UUFDVkcsTUFBTTtRQUNOVCxRQUFRO1FBQ1JPLFdBQVdwQztRQUNYYztJQUNGO0lBQ0EsTUFBTWpCLEdBQUdrQixHQUFHLENBQUMsaUJBQWlCaUIsYUFBYVAsY0FBYyxFQUFFTztJQUMzRCxNQUFNbkMsR0FBR2tCLEdBQUcsQ0FBQywyQkFBMkJ0QixnQkFBZ0J1QyxhQUFhUCxjQUFjLEVBQUVYLFNBQVN1QjtJQUM5RixPQUFPTDtBQUNUO0FBRUEsT0FBTyxNQUFNTyx1QkFBdUIsT0FDbENDLE9BQ0FDO0lBRUEsSUFDRSxDQUFDRCxTQUNERSxPQUFPQyxJQUFJLENBQUNILE9BQU9JLElBQUksQ0FBQyxDQUFDQyxNQUFRLENBQUM7WUFBQztZQUFTO1lBQW9CO1lBQVk7U0FBWSxDQUFDQyxRQUFRLENBQUNELFNBQ2xHLE9BQU9MLE1BQU1uQixLQUFLLEtBQUssWUFDdkIsQ0FBQyw2QkFBNkIwQixJQUFJLENBQUNQLE1BQU1uQixLQUFLLEtBQzlDbUIsTUFBTW5CLEtBQUssQ0FBQzJCLE1BQU0sR0FBRyxPQUNyQixPQUFPUixNQUFNUyxRQUFRLEtBQUssWUFDMUJULE1BQU1TLFFBQVEsQ0FBQ0QsTUFBTSxHQUFHLE1BQ3hCUixNQUFNUyxRQUFRLENBQUNELE1BQU0sR0FBRyxPQUN4QixPQUFPUixNQUFNVSxnQkFBZ0IsS0FBSyxZQUNsQyxDQUFDVixNQUFNVSxnQkFBZ0IsQ0FBQ0MsSUFBSSxNQUM1QlgsTUFBTVUsZ0JBQWdCLENBQUNGLE1BQU0sR0FBRyxLQUNoQztRQUNBLE1BQU0sSUFBSUksTUFBTTtJQUNsQjtJQUNBekQsa0JBQWtCNkMsTUFBTWEsU0FBUztJQUNqQyxNQUFNaEMsUUFBUW1CLE1BQU1uQixLQUFLLENBQUM4QixJQUFJLEdBQUdHLFdBQVc7SUFDNUMsTUFBTUMsY0FBY3BFLFdBQVcsVUFBVUksdUJBQ3RDaUUsTUFBTSxDQUFDQyxLQUFLQyxTQUFTLENBQUM7UUFBQyxHQUFHbEIsS0FBSztRQUFFbkI7SUFBSyxJQUN0Q3NDLE1BQU0sQ0FBQztJQUNWLE1BQU0zQyxpQkFBaUJ2QixnQkFBZ0IsZ0JBQWdCNEIsT0FBT21CLE1BQU1hLFNBQVM7SUFDN0UsT0FBTzNELHFCQUFxQitDLGdCQUFnQm1CLFdBQVcsQ0FBQyxPQUFPL0Q7UUFDN0QsTUFBTUUsV0FBVyxNQUFNRixHQUFHZ0UsR0FBRyxDQUFlLDZCQUE2QjdDO1FBQ3pFLElBQUdqQixVQUFVO1lBQ1gsSUFBR0EsU0FBU3dELFdBQVcsS0FBS0EsYUFBYTtnQkFDdkMsTUFBTSxJQUFJSCxNQUFNO1lBQ2xCO1lBQ0EsT0FBTztnQkFBQ3BDO2dCQUFnQjhDLHNCQUFzQjtZQUFJO1FBQ3BEO1FBQ0EsTUFBTUMsUUFBUSxNQUFNbEUsR0FBR21FLElBQUksQ0FBQyxTQUFTO1lBQUMzQztRQUFLO1FBQzNDLE1BQU1QLFNBQVM5QixXQUFXcUM7UUFDMUIsTUFBTTRDLFlBQVksTUFBTXBFLEdBQUdnRSxHQUFHLENBQUMsU0FBUy9DO1FBQ3hDLE1BQU1vRCxXQUFXSCxNQUFNZixNQUFNLEdBQUcsS0FBS21CLFFBQVFGO1FBQzdDLElBQUl4QyxpQkFBaUI7UUFDckIsSUFBRyxDQUFDeUMsVUFBVTtZQUNaLE1BQU1FLE9BQU9oRixZQUFZLElBQUllLFFBQVEsQ0FBQztZQUN0QyxNQUFNTixHQUFHa0IsR0FBRyxDQUFDLFNBQVNELFFBQVE7Z0JBQzVCdUQsUUFBUTtnQkFDUkMsT0FBT3JFLEtBQUtELEdBQUc7Z0JBQ2ZxQjtnQkFDQWtELFFBQVE7Z0JBQ1JDLHFCQUFxQjtnQkFDckJ2QixVQUFVaEUsZUFBZUMsY0FBY3NELE1BQU1TLFFBQVEsR0FBR21CO2dCQUN4REE7Z0JBQ0FLLE1BQU07Z0JBQ05DLFlBQVk7Z0JBQ1pDLFVBQVV0RDtnQkFDVnVELGVBQWU7WUFDakI7WUFDQyxDQUFBLEVBQUNuRCxjQUFjLEVBQUMsR0FBRyxNQUFNSyxtQkFBbUJqQyxJQUFJMkMsTUFBTVUsZ0JBQWdCLENBQUNDLElBQUksSUFBSXJDLE9BQU07UUFDeEY7UUFDQSxNQUFNaEIsZUFBNkI7WUFDakN1QjtZQUNBa0M7WUFDQTlCO1lBQ0FUO1lBQ0FxQyxXQUFXYixNQUFNYSxTQUFTO1lBQzFCdkMsUUFBUW9ELFdBQVcsS0FBS3BEO1FBQzFCO1FBQ0EsTUFBTWpCLEdBQUdrQixHQUFHLENBQUMsNkJBQTZCQyxnQkFBZ0JsQjtRQUMxRCxJQUFHLENBQUNvRSxVQUFVO1lBQ1osTUFBTXRFLDhCQUE4QkMsSUFBSUM7UUFDMUM7UUFDQSxPQUFPO1lBQUNrQjtZQUFnQjhDLHNCQUFzQjtRQUFJO0lBQ3BEO0FBQ0YsRUFBRTtBQUVGLE9BQU8sTUFBTWUscUJBQXFCLENBQ2hDQyxTQUNBL0MsTUFDQXNCLFlBRUEzRCxxQkFBcUJvRixTQUFTbEIsV0FBVyxDQUFDLE9BQU8vRDtRQUMvQyxNQUFNaUIsU0FBU3pCLG1CQUFtQnlGO1FBQ2xDLE1BQU1DLE9BQU8sTUFBTWxGLEdBQUdnRSxHQUFHLENBQTRDLFNBQVMvQztRQUM5RSxJQUFHLENBQUNpRSxNQUFNVixVQUFVLENBQUNVLEtBQUtILGFBQWEsRUFBRTtZQUN2QyxNQUFNLElBQUl4QixNQUFNO1FBQ2xCO1FBQ0EsSUFBRyxPQUFPckIsU0FBUyxZQUFZLENBQUNBLEtBQUtvQixJQUFJLE1BQU1wQixLQUFLaUIsTUFBTSxHQUFHLEtBQUs7WUFDaEUsTUFBTSxJQUFJSSxNQUFNO1FBQ2xCO1FBQ0EsTUFBTVAsTUFBTXBELGdCQUFnQiw4QkFBOEJxQixRQUFRbkIsa0JBQWtCMEQ7UUFDcEYsTUFBTXRELFdBQVcsTUFBTUYsR0FBR2dFLEdBQUcsQ0FBeUMsNkJBQTZCaEI7UUFDbkcsSUFBRzlDLFVBQVU7WUFDWCxJQUFHQSxTQUFTZ0MsSUFBSSxLQUFLQSxLQUFLb0IsSUFBSSxJQUFJO2dCQUNoQyxNQUFNLElBQUlDLE1BQU07WUFDbEI7WUFDQSxNQUFNYyxXQUFZLE1BQU1yRSxHQUFHZ0UsR0FBRyxDQUFlLGlCQUFpQjlELFNBQVMwQixjQUFjO1lBQ3JGLE1BQU0sRUFBQ3VELElBQUksRUFBRUMsSUFBSSxFQUFFLEdBQUdqRCxjQUFhLEdBQUdrQztZQUN0QyxPQUFPbEM7UUFDVDtRQUNBLE1BQU1rRCxNQUFNLE1BQU1wRCxtQkFBbUJqQyxJQUFJa0MsS0FBS29CLElBQUksSUFBSXJDO1FBQ3RELE1BQU1qQixHQUFHa0IsR0FBRyxDQUFDLDZCQUE2QjhCLEtBQUs7WUFDN0NkLE1BQU1BLEtBQUtvQixJQUFJO1lBQ2YxQixnQkFBZ0J5RCxJQUFJekQsY0FBYztZQUNsQzRCLFdBQVdSO1lBQ1gvQjtRQUNGO1FBQ0EsTUFBTWpCLEdBQUdrQixHQUFHLENBQUMsU0FBU0QsUUFBUTtZQUFDLEdBQUdpRSxJQUFJO1lBQUVQLHFCQUFxQjtRQUFJLEdBQUdPO1FBQ3BFLE9BQU9HO0lBQ1QsR0FBRyJ9

package/lib/organizations/store.d.ts

@@ -0,0 +1,25 @@
+import { type Database } from 'arangojs';
+import type { ApiContext } from '../types/auth.types.js';
+export declare const organizationCollections: readonly ['organizations', 'organizationMemberships', 'organizationApps', 'organizationRegistrations', 'organizationVerificationTokens', 'organizationInvitations', 'organizationOwnerTransfers', 'organizationBilling', 'organizationBillingJobs', 'organizationBillingEvents', 'organizationBillingPeriods', 'organizationBillingQuotes'];
+export declare const organizationEdgeCollections: readonly ("hasConnection" | "hasConversation" | "hasCustomerNotification" | "hasCustomerOrder" | "hasFile" | "hasLocation" | "hasMailingList" | "hasMedia" | "hasPayment" | "hasPersona" | "hasPurchasedProduct" | "hasReaction" | "hasSupportTicket" | "hasSupportTicketEvent" | "hasSupportTicketMessage" | "isPosted" | "isTagged")[];
+export type OrganizationCollection = (typeof organizationCollections)[number] | (typeof organizationEdgeCollections)[number] | 'users';
+export type Stored<T> = T & {
+    _key: string;
+    _rev?: string;
+};
+export type OrganizationTransaction = Readonly<{
+    find: <T>(collection: OrganizationCollection, filter: Readonly<Record<string, unknown>>) => Promise<Stored<T>[]>;
+    get: <T>(collection: OrganizationCollection, key: string) => Promise<Stored<T> | null>;
+    put: <T extends object>(collection: OrganizationCollection, key: string, document: T, previous?: Stored<object> | null) => Promise<void>;
+    remove: (collection: OrganizationCollection, document: Stored<object>) => Promise<void>;
+}>;
+export type OrganizationStore = Readonly<{
+    initialize: () => Promise<void>;
+    transaction: <T>(action: (tx: OrganizationTransaction) => Promise<T>) => Promise<T>;
+}>;
+export declare const organizationKey: (...parts: string[]) => string;
+export declare const newOrganizationId: () => string;
+export declare const requireIdentifier: (value: unknown) => string;
+export declare const controlDatabaseName: () => string;
+export declare const organizationStoreFor: (_context: ApiContext) => OrganizationStore;
+export declare const createOrganizationStore: (controlName: string, database?: Database) => OrganizationStore;

package/lib/organizations/store.js

@@ -0,0 +1,167 @@
+/* Stream-transaction steps and ordered retry assertions must execute sequentially. */ /* eslint-disable no-await-in-loop */ import { aql } from 'arangojs';
+import { createHash, randomUUID } from 'node:crypto';
+import { DEFAULT_EDGE_COLLECTIONS } from '../constants/collections.js';
+import { useDb } from '../utils/arangodbUtils.js';
+export const organizationCollections = [
+    'organizations',
+    'organizationMemberships',
+    'organizationApps',
+    'organizationRegistrations',
+    'organizationVerificationTokens',
+    'organizationInvitations',
+    'organizationOwnerTransfers',
+    'organizationBilling',
+    'organizationBillingJobs',
+    'organizationBillingEvents',
+    'organizationBillingPeriods',
+    'organizationBillingQuotes'
+];
+export const organizationEdgeCollections = DEFAULT_EDGE_COLLECTIONS;
+export const organizationKey = (...parts)=>createHash('sha256').update(JSON.stringify(parts)).digest('hex');
+export const newOrganizationId = ()=>randomUUID();
+export const requireIdentifier = (value)=>{
+    if (typeof value !== 'string' || !/^[a-zA-Z0-9_-]{1,128}$/.test(value)) {
+        throw new Error('invalid_identifier');
+    }
+    return value;
+};
+export const controlDatabaseName = ()=>{
+    const name = process.env.ARANGODB_DATABASE;
+    if (!name || !/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(name) || name === '_system') {
+        throw new Error('organization_control_database_required');
+    }
+    return name;
+};
+export const organizationStoreFor = (_context)=>createOrganizationStore(controlDatabaseName());
+const indexes = {
+    organizationApps: [
+        [
+            'appId'
+        ]
+    ],
+    organizationBilling: [
+        [
+            'organizationId'
+        ]
+    ],
+    organizationBillingEvents: [
+        [
+            'eventId'
+        ]
+    ],
+    organizationBillingJobs: [
+        [
+            'organizationId',
+            'sequence'
+        ]
+    ],
+    organizationMemberships: [
+        [
+            'organizationId',
+            'userId'
+        ]
+    ],
+    organizations: [
+        [
+            'organizationId'
+        ]
+    ]
+};
+export const createOrganizationStore = (controlName, database = useDb(controlName))=>{
+    if (!controlName || controlName === '_system' || !/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(controlName)) {
+        throw new Error('organization_control_database_required');
+    }
+    let initialized = false;
+    const initialize = async ()=>{
+        if (initialized) {
+            return;
+        }
+        for (const name of [
+            ...organizationCollections,
+            'users',
+            ...organizationEdgeCollections
+        ]){
+            const collection = database.collection(name);
+            if (!await collection.exists()) {
+                try {
+                    await collection.create(organizationEdgeCollections.includes(name) ? {
+                        type: 3
+                    } : {});
+                } catch (error) {
+                    if (error.errorNum !== 1207) {
+                        throw error;
+                    }
+                }
+            }
+            for (const fields of indexes[name] || []){
+                await collection.ensureIndex({
+                    fields,
+                    type: 'persistent',
+                    unique: true
+                });
+            }
+        }
+        initialized = true;
+    };
+    const transaction = async (action)=>{
+        await initialize();
+        const trx = await database.beginTransaction({
+            exclusive: [
+                ...organizationCollections,
+                'users',
+                ...organizationEdgeCollections
+            ]
+        }, {
+            lockTimeout: 10
+        });
+        const tx = {
+            find: async (name, filter)=>{
+                const cursor = await trx.step(()=>database.query(aql`FOR doc IN ${database.collection(name)} FILTER MATCHES(doc, ${filter}) RETURN doc`));
+                return await cursor.all();
+            },
+            get: async (name, key)=>{
+                const cursor = await trx.step(()=>database.query(aql`RETURN DOCUMENT(${name}, ${requireIdentifier(key)})`));
+                return await cursor.next();
+            },
+            put: async (name, key, document, previous)=>{
+                const collection = database.collection(name);
+                const { _id, _key, _rev, ...safe } = document;
+                if (previous) {
+                    await trx.step(()=>collection.replace({
+                            _key: requireIdentifier(key),
+                            _rev: previous._rev
+                        }, safe, {
+                            ignoreRevs: false
+                        }));
+                } else {
+                    await trx.step(()=>collection.save({
+                            ...safe,
+                            _key: requireIdentifier(key)
+                        }));
+                }
+            },
+            remove: async (name, document)=>{
+                await trx.step(()=>database.collection(name).remove({
+                        _key: document._key,
+                        _rev: document._rev
+                    }, {
+                        ignoreRevs: false
+                    }));
+            }
+        };
+        try {
+            const result = await action(tx);
+            await trx.commit();
+            return result;
+        } catch (error) {
+            await trx.abort().catch(()=>undefined);
+            throw error;
+        }
+    };
+    return {
+        initialize,
+        transaction
+    };
+}; /* Stream-transaction steps and ordered retry assertions must execute sequentially. */  /* ArangoDB document metadata uses these reserved field names. */  /* eslint no-underscore-dangle: ["warn", {"allow": ["_key", "_rev", "_id"]}] */ 
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9Vc2Vycy9uaXRyb2c3L0RldmVsb3BtZW50L3JlYWt0b3IvcGFja2FnZXMvcmVha3Rvci9zcmMvb3JnYW5pemF0aW9ucy9zdG9yZS50cyJdLCJzb3VyY2VzQ29udGVudCI6WyIvKiBTdHJlYW0tdHJhbnNhY3Rpb24gc3RlcHMgYW5kIG9yZGVyZWQgcmV0cnkgYXNzZXJ0aW9ucyBtdXN0IGV4ZWN1dGUgc2VxdWVudGlhbGx5LiAqL1xuLyogZXNsaW50LWRpc2FibGUgbm8tYXdhaXQtaW4tbG9vcCAqL1xuaW1wb3J0IHthcWwsIHR5cGUgRGF0YWJhc2V9IGZyb20gJ2FyYW5nb2pzJztcbmltcG9ydCB7Y3JlYXRlSGFzaCwgcmFuZG9tVVVJRH0gZnJvbSAnbm9kZTpjcnlwdG8nO1xuXG5pbXBvcnQge0RFRkFVTFRfRURHRV9DT0xMRUNUSU9OU30gZnJvbSAnLi4vY29uc3RhbnRzL2NvbGxlY3Rpb25zLmpzJztcbmltcG9ydCB7dXNlRGJ9IGZyb20gJy4uL3V0aWxzL2FyYW5nb2RiVXRpbHMuanMnO1xuXG5pbXBvcnQgdHlwZSB7QXBpQ29udGV4dH0gZnJvbSAnLi4vdHlwZXMvYXV0aC50eXBlcy5qcyc7XG5cbmV4cG9ydCBjb25zdCBvcmdhbml6YXRpb25Db2xsZWN0aW9ucyA9IFtcbiAgJ29yZ2FuaXphdGlvbnMnLFxuICAnb3JnYW5pemF0aW9uTWVtYmVyc2hpcHMnLFxuICAnb3JnYW5pemF0aW9uQXBwcycsXG4gICdvcmdhbml6YXRpb25SZWdpc3RyYXRpb25zJyxcbiAgJ29yZ2FuaXphdGlvblZlcmlmaWNhdGlvblRva2VucycsXG4gICdvcmdhbml6YXRpb25JbnZpdGF0aW9ucycsXG4gICdvcmdhbml6YXRpb25Pd25lclRyYW5zZmVycycsXG4gICdvcmdhbml6YXRpb25CaWxsaW5nJyxcbiAgJ29yZ2FuaXphdGlvbkJpbGxpbmdKb2JzJyxcbiAgJ29yZ2FuaXphdGlvbkJpbGxpbmdFdmVudHMnLFxuICAnb3JnYW5pemF0aW9uQmlsbGluZ1BlcmlvZHMnLFxuICAnb3JnYW5pemF0aW9uQmlsbGluZ1F1b3Rlcydcbl0gYXMgY29uc3Q7XG5leHBvcnQgY29uc3Qgb3JnYW5pemF0aW9uRWRnZUNvbGxlY3Rpb25zID0gREVGQVVMVF9FREdFX0NPTExFQ1RJT05TO1xuZXhwb3J0IHR5cGUgT3JnYW5pemF0aW9uQ29sbGVjdGlvbiA9XG4gICh0eXBlb2Ygb3JnYW5pemF0aW9uQ29sbGVjdGlvbnMpW251bWJlcl0gfCAodHlwZW9mIG9yZ2FuaXphdGlvbkVkZ2VDb2xsZWN0aW9ucylbbnVtYmVyXSB8ICd1c2Vycyc7XG5leHBvcnQgdHlwZSBTdG9yZWQ8VD4gPSBUICYge19rZXk6IHN0cmluZzsgX3Jldj86IHN0cmluZ307XG5leHBvcnQgdHlwZSBPcmdhbml6YXRpb25UcmFuc2FjdGlvbiA9IFJlYWRvbmx5PHtcbiAgZmluZDogPFQ+KFxuICAgIGNvbGxlY3Rpb246IE9yZ2FuaXphdGlvbkNvbGxlY3Rpb24sXG4gICAgZmlsdGVyOiBSZWFkb25seTxSZWNvcmQ8c3RyaW5nLCB1bmtub3duPj5cbiAgKSA9PiBQcm9taXNlPFN0b3JlZDxUPltdPjtcbiAgZ2V0OiA8VD4oY29sbGVjdGlvbjogT3JnYW5pemF0aW9uQ29sbGVjdGlvbiwga2V5OiBzdHJpbmcpID0+IFByb21pc2U8U3RvcmVkPFQ+IHwgbnVsbD47XG4gIHB1dDogPFQgZXh0ZW5kcyBvYmplY3Q+KFxuICAgIGNvbGxlY3Rpb246IE9yZ2FuaXphdGlvbkNvbGxlY3Rpb24sXG4gICAga2V5OiBzdHJpbmcsXG4gICAgZG9jdW1lbnQ6IFQsXG4gICAgcHJldmlvdXM/OiBTdG9yZWQ8b2JqZWN0PiB8IG51bGxcbiAgKSA9PiBQcm9taXNlPHZvaWQ+O1xuICByZW1vdmU6IChjb2xsZWN0aW9uOiBPcmdhbml6YXRpb25Db2xsZWN0aW9uLCBkb2N1bWVudDogU3RvcmVkPG9iamVjdD4pID0+IFByb21pc2U8dm9pZD47XG59PjtcbmV4cG9ydCB0eXBlIE9yZ2FuaXphdGlvblN0b3JlID0gUmVhZG9ubHk8e1xuICBpbml0aWFsaXplOiAoKSA9PiBQcm9taXNlPHZvaWQ+O1xuICB0cmFuc2FjdGlvbjogPFQ+KGFjdGlvbjogKHR4OiBPcmdhbml6YXRpb25UcmFuc2FjdGlvbikgPT4gUHJvbWlzZTxUPikgPT4gUHJvbWlzZTxUPjtcbn0+O1xuZXhwb3J0IGNvbnN0IG9yZ2FuaXphdGlvbktleSA9ICguLi5wYXJ0czogc3RyaW5nW10pOiBzdHJpbmcgPT5cbiAgY3JlYXRlSGFzaCgnc2hhMjU2JykudXBkYXRlKEpTT04uc3RyaW5naWZ5KHBhcnRzKSkuZGlnZXN0KCdoZXgnKTtcbmV4cG9ydCBjb25zdCBuZXdPcmdhbml6YXRpb25JZCA9ICgpOiBzdHJpbmcgPT4gcmFuZG9tVVVJRCgpO1xuZXhwb3J0IGNvbnN0IHJlcXVpcmVJZGVudGlmaWVyID0gKHZhbHVlOiB1bmtub3duKTogc3RyaW5nID0+IHtcbiAgaWYodHlwZW9mIHZhbHVlICE9PSAnc3RyaW5nJyB8fCAhL15bYS16QS1aMC05Xy1dezEsMTI4fSQvLnRlc3QodmFsdWUpKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdpbnZhbGlkX2lkZW50aWZpZXInKTtcbiAgfVxuICByZXR1cm4gdmFsdWU7XG59O1xuZXhwb3J0IGNvbnN0IGNvbnRyb2xEYXRhYmFzZU5hbWUgPSAoKTogc3RyaW5nID0+IHtcbiAgY29uc3QgbmFtZSA9IHByb2Nlc3MuZW52LkFSQU5HT0RCX0RBVEFCQVNFO1xuICBpZighbmFtZSB8fCAhL15bYS16QS1aXVthLXpBLVowLTlfLV17MCw2M30kLy50ZXN0KG5hbWUpIHx8IG5hbWUgPT09ICdfc3lzdGVtJykge1xuICAgIHRocm93IG5ldyBFcnJvcignb3JnYW5pemF0aW9uX2NvbnRyb2xfZGF0YWJhc2VfcmVxdWlyZWQnKTtcbiAgfVxuICByZXR1cm4gbmFtZTtcbn07XG5leHBvcnQgY29uc3Qgb3JnYW5pemF0aW9uU3RvcmVGb3IgPSAoX2NvbnRleHQ6IEFwaUNvbnRleHQpOiBPcmdhbml6YXRpb25TdG9yZSA9PlxuICBjcmVhdGVPcmdhbml6YXRpb25TdG9yZShjb250cm9sRGF0YWJhc2VOYW1lKCkpO1xuXG5jb25zdCBpbmRleGVzOiBQYXJ0aWFsPFJlY29yZDxPcmdhbml6YXRpb25Db2xsZWN0aW9uLCBzdHJpbmdbXVtdPj4gPSB7XG4gIG9yZ2FuaXphdGlvbkFwcHM6IFtbJ2FwcElkJ11dLFxuICBvcmdhbml6YXRpb25CaWxsaW5nOiBbWydvcmdhbml6YXRpb25JZCddXSxcbiAgb3JnYW5pemF0aW9uQmlsbGluZ0V2ZW50czogW1snZXZlbnRJZCddXSxcbiAgb3JnYW5pemF0aW9uQmlsbGluZ0pvYnM6IFtbJ29yZ2FuaXphdGlvbklkJywgJ3NlcXVlbmNlJ11dLFxuICBvcmdhbml6YXRpb25NZW1iZXJzaGlwczogW1snb3JnYW5pemF0aW9uSWQnLCAndXNlcklkJ11dLFxuICBvcmdhbml6YXRpb25zOiBbWydvcmdhbml6YXRpb25JZCddXVxufTtcblxuZXhwb3J0IGNvbnN0IGNyZWF0ZU9yZ2FuaXphdGlvblN0b3JlID0gKFxuICBjb250cm9sTmFtZTogc3RyaW5nLFxuICBkYXRhYmFzZTogRGF0YWJhc2UgPSB1c2VEYihjb250cm9sTmFtZSlcbik6IE9yZ2FuaXphdGlvblN0b3JlID0+IHtcbiAgaWYoIWNvbnRyb2xOYW1lIHx8IGNvbnRyb2xOYW1lID09PSAnX3N5c3RlbScgfHwgIS9eW2EtekEtWl1bYS16QS1aMC05Xy1dezAsNjN9JC8udGVzdChjb250cm9sTmFtZSkpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ29yZ2FuaXphdGlvbl9jb250cm9sX2RhdGFiYXNlX3JlcXVpcmVkJyk7XG4gIH1cbiAgbGV0IGluaXRpYWxpemVkID0gZmFsc2U7XG4gIGNvbnN0IGluaXRpYWxpemUgPSBhc3luYyAoKTogUHJvbWlzZTx2b2lkPiA9PiB7XG4gICAgaWYoaW5pdGlhbGl6ZWQpIHtcbiAgICAgIHJldHVybjtcbiAgICB9XG4gICAgZm9yKGNvbnN0IG5hbWUgb2YgW1xuICAgICAgLi4ub3JnYW5pemF0aW9uQ29sbGVjdGlvbnMsXG4gICAgICAndXNlcnMnLFxuICAgICAgLi4ub3JnYW5pemF0aW9uRWRnZUNvbGxlY3Rpb25zXG4gICAgXSBhcyBPcmdhbml6YXRpb25Db2xsZWN0aW9uW10pIHtcbiAgICAgIGNvbnN0IGNvbGxlY3Rpb24gPSBkYXRhYmFzZS5jb2xsZWN0aW9uKG5hbWUpO1xuICAgICAgaWYoIShhd2FpdCBjb2xsZWN0aW9uLmV4aXN0cygpKSkge1xuICAgICAgICB0cnkge1xuICAgICAgICAgIGF3YWl0IGNvbGxlY3Rpb24uY3JlYXRlKFxuICAgICAgICAgICAgb3JnYW5pemF0aW9uRWRnZUNvbGxlY3Rpb25zLmluY2x1ZGVzKG5hbWUgYXMgKHR5cGVvZiBvcmdhbml6YXRpb25FZGdlQ29sbGVjdGlvbnMpW251bWJlcl0pXG4gICAgICAgICAgICAgID8ge3R5cGU6IDN9XG4gICAgICAgICAgICAgIDoge31cbiAgICAgICAgICApO1xuICAgICAgICB9IGNhdGNoKGVycm9yKSB7XG4gICAgICAgICAgaWYoKGVycm9yIGFzIHtlcnJvck51bT86IG51bWJlcn0pLmVycm9yTnVtICE9PSAxMjA3KSB7XG4gICAgICAgICAgICB0aHJvdyBlcnJvcjtcbiAgICAgICAgICB9XG4gICAgICAgIH1cbiAgICAgIH1cbiAgICAgIGZvcihjb25zdCBmaWVsZHMgb2YgaW5kZXhlc1tuYW1lXSB8fCBbXSkge1xuICAgICAgICBhd2FpdCBjb2xsZWN0aW9uLmVuc3VyZUluZGV4KHtmaWVsZHMsIHR5cGU6ICdwZXJzaXN0ZW50JywgdW5pcXVlOiB0cnVlfSk7XG4gICAgICB9XG4gICAgfVxuICAgIGluaXRpYWxpemVkID0gdHJ1ZTtcbiAgfTtcbiAgY29uc3QgdHJhbnNhY3Rpb24gPSBhc3luYyA8VD4oYWN0aW9uOiAodHg6IE9yZ2FuaXphdGlvblRyYW5zYWN0aW9uKSA9PiBQcm9taXNlPFQ+KTogUHJvbWlzZTxUPiA9PiB7XG4gICAgYXdhaXQgaW5pdGlhbGl6ZSgpO1xuICAgIGNvbnN0IHRyeCA9IGF3YWl0IGRhdGFiYXNlLmJlZ2luVHJhbnNhY3Rpb24oXG4gICAgICB7ZXhjbHVzaXZlOiBbLi4ub3JnYW5pemF0aW9uQ29sbGVjdGlvbnMsICd1c2VycycsIC4uLm9yZ2FuaXphdGlvbkVkZ2VDb2xsZWN0aW9uc119LFxuICAgICAge2xvY2tUaW1lb3V0OiAxMH1cbiAgICApO1xuICAgIGNvbnN0IHR4OiBPcmdhbml6YXRpb25UcmFuc2FjdGlvbiA9IHtcbiAgICAgIGZpbmQ6IGFzeW5jIDxEPihuYW1lOiBPcmdhbml6YXRpb25Db2xsZWN0aW9uLCBmaWx0ZXI6IFJlYWRvbmx5PFJlY29yZDxzdHJpbmcsIHVua25vd24+PikgPT4ge1xuICAgICAgICBjb25zdCBjdXJzb3IgPSBhd2FpdCB0cnguc3RlcCgoKSA9PlxuICAgICAgICAgIGRhdGFiYXNlLnF1ZXJ5KFxuICAgICAgICAgICAgYXFsYEZPUiBkb2MgSU4gJHtkYXRhYmFzZS5jb2xsZWN0aW9uKG5hbWUpfSBGSUxURVIgTUFUQ0hFUyhkb2MsICR7ZmlsdGVyfSkgUkVUVVJOIGRvY2BcbiAgICAgICAgICApXG4gICAgICAgICk7XG4gICAgICAgIHJldHVybiAoYXdhaXQgY3Vyc29yLmFsbCgpKSBhcyBTdG9yZWQ8RD5bXTtcbiAgICAgIH0sXG4gICAgICBnZXQ6IGFzeW5jIDxEPihuYW1lOiBPcmdhbml6YXRpb25Db2xsZWN0aW9uLCBrZXk6IHN0cmluZykgPT4ge1xuICAgICAgICBjb25zdCBjdXJzb3IgPSBhd2FpdCB0cnguc3RlcCgoKSA9PlxuICAgICAgICAgIGRhdGFiYXNlLnF1ZXJ5KGFxbGBSRVRVUk4gRE9DVU1FTlQoJHtuYW1lfSwgJHtyZXF1aXJlSWRlbnRpZmllcihrZXkpfSlgKVxuICAgICAgICApO1xuICAgICAgICByZXR1cm4gKGF3YWl0IGN1cnNvci5uZXh0KCkpIGFzIFN0b3JlZDxEPiB8IG51bGw7XG4gICAgICB9LFxuICAgICAgcHV0OiBhc3luYyA8RCBleHRlbmRzIG9iamVjdD4oXG4gICAgICAgIG5hbWU6IE9yZ2FuaXphdGlvbkNvbGxlY3Rpb24sXG4gICAgICAgIGtleTogc3RyaW5nLFxuICAgICAgICBkb2N1bWVudDogRCxcbiAgICAgICAgcHJldmlvdXM/OiBTdG9yZWQ8b2JqZWN0PiB8IG51bGxcbiAgICAgICkgPT4ge1xuICAgICAgICBjb25zdCBjb2xsZWN0aW9uID0gZGF0YWJhc2UuY29sbGVjdGlvbihuYW1lKTtcbiAgICAgICAgY29uc3Qge19pZCwgX2tleSwgX3JldiwgLi4uc2FmZX0gPSBkb2N1bWVudCBhcyBEICYge19pZD86IHN0cmluZzsgX2tleT86IHN0cmluZzsgX3Jldj86IHN0cmluZ307XG4gICAgICAgIGlmKHByZXZpb3VzKSB7XG4gICAgICAgICAgYXdhaXQgdHJ4LnN0ZXAoKCkgPT5cbiAgICAgICAgICAgIGNvbGxlY3Rpb24ucmVwbGFjZSh7X2tleTogcmVxdWlyZUlkZW50aWZpZXIoa2V5KSwgX3JldjogcHJldmlvdXMuX3Jldn0sIHNhZmUsIHtpZ25vcmVSZXZzOiBmYWxzZX0pXG4gICAgICAgICAgKTtcbiAgICAgICAgfSBlbHNlIHtcbiAgICAgICAgICBhd2FpdCB0cnguc3RlcCgoKSA9PiBjb2xsZWN0aW9uLnNhdmUoey4uLnNhZmUsIF9rZXk6IHJlcXVpcmVJZGVudGlmaWVyKGtleSl9KSk7XG4gICAgICAgIH1cbiAgICAgIH0sXG4gICAgICByZW1vdmU6IGFzeW5jIChuYW1lLCBkb2N1bWVudCkgPT4ge1xuICAgICAgICBhd2FpdCB0cnguc3RlcCgoKSA9PlxuICAgICAgICAgIGRhdGFiYXNlLmNvbGxlY3Rpb24obmFtZSkucmVtb3ZlKHtfa2V5OiBkb2N1bWVudC5fa2V5LCBfcmV2OiBkb2N1bWVudC5fcmV2fSwge2lnbm9yZVJldnM6IGZhbHNlfSlcbiAgICAgICAgKTtcbiAgICAgIH1cbiAgICB9O1xuICAgIHRyeSB7XG4gICAgICBjb25zdCByZXN1bHQgPSBhd2FpdCBhY3Rpb24odHgpO1xuICAgICAgYXdhaXQgdHJ4LmNvbW1pdCgpO1xuICAgICAgcmV0dXJuIHJlc3VsdDtcbiAgICB9IGNhdGNoKGVycm9yKSB7XG4gICAgICBhd2FpdCB0cnguYWJvcnQoKS5jYXRjaCgoKSA9PiB1bmRlZmluZWQpO1xuICAgICAgdGhyb3cgZXJyb3I7XG4gICAgfVxuICB9O1xuICByZXR1cm4ge2luaXRpYWxpemUsIHRyYW5zYWN0aW9ufTtcbn07XG4vKiBTdHJlYW0tdHJhbnNhY3Rpb24gc3RlcHMgYW5kIG9yZGVyZWQgcmV0cnkgYXNzZXJ0aW9ucyBtdXN0IGV4ZWN1dGUgc2VxdWVudGlhbGx5LiAqL1xuXG4vKiBBcmFuZ29EQiBkb2N1bWVudCBtZXRhZGF0YSB1c2VzIHRoZXNlIHJlc2VydmVkIGZpZWxkIG5hbWVzLiAqL1xuLyogZXNsaW50IG5vLXVuZGVyc2NvcmUtZGFuZ2xlOiBbXCJ3YXJuXCIsIHtcImFsbG93XCI6IFtcIl9rZXlcIiwgXCJfcmV2XCIsIFwiX2lkXCJdfV0gKi9cbiJdLCJuYW1lcyI6WyJhcWwiLCJjcmVhdGVIYXNoIiwicmFuZG9tVVVJRCIsIkRFRkFVTFRfRURHRV9DT0xMRUNUSU9OUyIsInVzZURiIiwib3JnYW5pemF0aW9uQ29sbGVjdGlvbnMiLCJvcmdhbml6YXRpb25FZGdlQ29sbGVjdGlvbnMiLCJvcmdhbml6YXRpb25LZXkiLCJwYXJ0cyIsInVwZGF0ZSIsIkpTT04iLCJzdHJpbmdpZnkiLCJkaWdlc3QiLCJuZXdPcmdhbml6YXRpb25JZCIsInJlcXVpcmVJZGVudGlmaWVyIiwidmFsdWUiLCJ0ZXN0IiwiRXJyb3IiLCJjb250cm9sRGF0YWJhc2VOYW1lIiwibmFtZSIsInByb2Nlc3MiLCJlbnYiLCJBUkFOR09EQl9EQVRBQkFTRSIsIm9yZ2FuaXphdGlvblN0b3JlRm9yIiwiX2NvbnRleHQiLCJjcmVhdGVPcmdhbml6YXRpb25TdG9yZSIsImluZGV4ZXMiLCJvcmdhbml6YXRpb25BcHBzIiwib3JnYW5pemF0aW9uQmlsbGluZyIsIm9yZ2FuaXphdGlvbkJpbGxpbmdFdmVudHMiLCJvcmdhbml6YXRpb25CaWxsaW5nSm9icyIsIm9yZ2FuaXphdGlvbk1lbWJlcnNoaXBzIiwib3JnYW5pemF0aW9ucyIsImNvbnRyb2xOYW1lIiwiZGF0YWJhc2UiLCJpbml0aWFsaXplZCIsImluaXRpYWxpemUiLCJjb2xsZWN0aW9uIiwiZXhpc3RzIiwiY3JlYXRlIiwiaW5jbHVkZXMiLCJ0eXBlIiwiZXJyb3IiLCJlcnJvck51bSIsImZpZWxkcyIsImVuc3VyZUluZGV4IiwidW5pcXVlIiwidHJhbnNhY3Rpb24iLCJhY3Rpb24iLCJ0cngiLCJiZWdpblRyYW5zYWN0aW9uIiwiZXhjbHVzaXZlIiwibG9ja1RpbWVvdXQiLCJ0eCIsImZpbmQiLCJmaWx0ZXIiLCJjdXJzb3IiLCJzdGVwIiwicXVlcnkiLCJhbGwiLCJnZXQiLCJrZXkiLCJuZXh0IiwicHV0IiwiZG9jdW1lbnQiLCJwcmV2aW91cyIsIl9pZCIsIl9rZXkiLCJfcmV2Iiwic2FmZSIsInJlcGxhY2UiLCJpZ25vcmVSZXZzIiwic2F2ZSIsInJlbW92ZSIsInJlc3VsdCIsImNvbW1pdCIsImFib3J0IiwiY2F0Y2giLCJ1bmRlZmluZWQiXSwibWFwcGluZ3MiOiJBQUFBLG9GQUFvRixHQUNwRixtQ0FBbUMsR0FDbkMsU0FBUUEsR0FBRyxRQUFzQixXQUFXO0FBQzVDLFNBQVFDLFVBQVUsRUFBRUMsVUFBVSxRQUFPLGNBQWM7QUFFbkQsU0FBUUMsd0JBQXdCLFFBQU8sOEJBQThCO0FBQ3JFLFNBQVFDLEtBQUssUUFBTyw0QkFBNEI7QUFJaEQsT0FBTyxNQUFNQywwQkFBMEI7SUFDckM7SUFDQTtJQUNBO0lBQ0E7SUFDQTtJQUNBO0lBQ0E7SUFDQTtJQUNBO0lBQ0E7SUFDQTtJQUNBO0NBQ0QsQ0FBVTtBQUNYLE9BQU8sTUFBTUMsOEJBQThCSCx5QkFBeUI7QUFzQnBFLE9BQU8sTUFBTUksa0JBQWtCLENBQUMsR0FBR0MsUUFDakNQLFdBQVcsVUFBVVEsTUFBTSxDQUFDQyxLQUFLQyxTQUFTLENBQUNILFFBQVFJLE1BQU0sQ0FBQyxPQUFPO0FBQ25FLE9BQU8sTUFBTUMsb0JBQW9CLElBQWNYLGFBQWE7QUFDNUQsT0FBTyxNQUFNWSxvQkFBb0IsQ0FBQ0M7SUFDaEMsSUFBRyxPQUFPQSxVQUFVLFlBQVksQ0FBQyx5QkFBeUJDLElBQUksQ0FBQ0QsUUFBUTtRQUNyRSxNQUFNLElBQUlFLE1BQU07SUFDbEI7SUFDQSxPQUFPRjtBQUNULEVBQUU7QUFDRixPQUFPLE1BQU1HLHNCQUFzQjtJQUNqQyxNQUFNQyxPQUFPQyxRQUFRQyxHQUFHLENBQUNDLGlCQUFpQjtJQUMxQyxJQUFHLENBQUNILFFBQVEsQ0FBQyxnQ0FBZ0NILElBQUksQ0FBQ0csU0FBU0EsU0FBUyxXQUFXO1FBQzdFLE1BQU0sSUFBSUYsTUFBTTtJQUNsQjtJQUNBLE9BQU9FO0FBQ1QsRUFBRTtBQUNGLE9BQU8sTUFBTUksdUJBQXVCLENBQUNDLFdBQ25DQyx3QkFBd0JQLHVCQUF1QjtBQUVqRCxNQUFNUSxVQUErRDtJQUNuRUMsa0JBQWtCO1FBQUM7WUFBQztTQUFRO0tBQUM7SUFDN0JDLHFCQUFxQjtRQUFDO1lBQUM7U0FBaUI7S0FBQztJQUN6Q0MsMkJBQTJCO1FBQUM7WUFBQztTQUFVO0tBQUM7SUFDeENDLHlCQUF5QjtRQUFDO1lBQUM7WUFBa0I7U0FBVztLQUFDO0lBQ3pEQyx5QkFBeUI7UUFBQztZQUFDO1lBQWtCO1NBQVM7S0FBQztJQUN2REMsZUFBZTtRQUFDO1lBQUM7U0FBaUI7S0FBQztBQUNyQztBQUVBLE9BQU8sTUFBTVAsMEJBQTBCLENBQ3JDUSxhQUNBQyxXQUFxQjlCLE1BQU02QixZQUFZO0lBRXZDLElBQUcsQ0FBQ0EsZUFBZUEsZ0JBQWdCLGFBQWEsQ0FBQyxnQ0FBZ0NqQixJQUFJLENBQUNpQixjQUFjO1FBQ2xHLE1BQU0sSUFBSWhCLE1BQU07SUFDbEI7SUFDQSxJQUFJa0IsY0FBYztJQUNsQixNQUFNQyxhQUFhO1FBQ2pCLElBQUdELGFBQWE7WUFDZDtRQUNGO1FBQ0EsS0FBSSxNQUFNaEIsUUFBUTtlQUNiZDtZQUNIO2VBQ0dDO1NBQ0osQ0FBOEI7WUFDN0IsTUFBTStCLGFBQWFILFNBQVNHLFVBQVUsQ0FBQ2xCO1lBQ3ZDLElBQUcsQ0FBRSxNQUFNa0IsV0FBV0MsTUFBTSxJQUFLO2dCQUMvQixJQUFJO29CQUNGLE1BQU1ELFdBQVdFLE1BQU0sQ0FDckJqQyw0QkFBNEJrQyxRQUFRLENBQUNyQixRQUNqQzt3QkFBQ3NCLE1BQU07b0JBQUMsSUFDUixDQUFDO2dCQUVULEVBQUUsT0FBTUMsT0FBTztvQkFDYixJQUFHLEFBQUNBLE1BQThCQyxRQUFRLEtBQUssTUFBTTt3QkFDbkQsTUFBTUQ7b0JBQ1I7Z0JBQ0Y7WUFDRjtZQUNBLEtBQUksTUFBTUUsVUFBVWxCLE9BQU8sQ0FBQ1AsS0FBSyxJQUFJLEVBQUUsQ0FBRTtnQkFDdkMsTUFBTWtCLFdBQVdRLFdBQVcsQ0FBQztvQkFBQ0Q7b0JBQVFILE1BQU07b0JBQWNLLFFBQVE7Z0JBQUk7WUFDeEU7UUFDRjtRQUNBWCxjQUFjO0lBQ2hCO0lBQ0EsTUFBTVksY0FBYyxPQUFVQztRQUM1QixNQUFNWjtRQUNOLE1BQU1hLE1BQU0sTUFBTWYsU0FBU2dCLGdCQUFnQixDQUN6QztZQUFDQyxXQUFXO21CQUFJOUM7Z0JBQXlCO21CQUFZQzthQUE0QjtRQUFBLEdBQ2pGO1lBQUM4QyxhQUFhO1FBQUU7UUFFbEIsTUFBTUMsS0FBOEI7WUFDbENDLE1BQU0sT0FBVW5DLE1BQThCb0M7Z0JBQzVDLE1BQU1DLFNBQVMsTUFBTVAsSUFBSVEsSUFBSSxDQUFDLElBQzVCdkIsU0FBU3dCLEtBQUssQ0FDWjFELEdBQUcsQ0FBQyxXQUFXLEVBQUVrQyxTQUFTRyxVQUFVLENBQUNsQixNQUFNLHFCQUFxQixFQUFFb0MsT0FBTyxZQUFZLENBQUM7Z0JBRzFGLE9BQVEsTUFBTUMsT0FBT0csR0FBRztZQUMxQjtZQUNBQyxLQUFLLE9BQVV6QyxNQUE4QjBDO2dCQUMzQyxNQUFNTCxTQUFTLE1BQU1QLElBQUlRLElBQUksQ0FBQyxJQUM1QnZCLFNBQVN3QixLQUFLLENBQUMxRCxHQUFHLENBQUMsZ0JBQWdCLEVBQUVtQixLQUFLLEVBQUUsRUFBRUwsa0JBQWtCK0MsS0FBSyxDQUFDLENBQUM7Z0JBRXpFLE9BQVEsTUFBTUwsT0FBT00sSUFBSTtZQUMzQjtZQUNBQyxLQUFLLE9BQ0g1QyxNQUNBMEMsS0FDQUcsVUFDQUM7Z0JBRUEsTUFBTTVCLGFBQWFILFNBQVNHLFVBQVUsQ0FBQ2xCO2dCQUN2QyxNQUFNLEVBQUMrQyxHQUFHLEVBQUVDLElBQUksRUFBRUMsSUFBSSxFQUFFLEdBQUdDLE1BQUssR0FBR0w7Z0JBQ25DLElBQUdDLFVBQVU7b0JBQ1gsTUFBTWhCLElBQUlRLElBQUksQ0FBQyxJQUNicEIsV0FBV2lDLE9BQU8sQ0FBQzs0QkFBQ0gsTUFBTXJELGtCQUFrQitDOzRCQUFNTyxNQUFNSCxTQUFTRyxJQUFJO3dCQUFBLEdBQUdDLE1BQU07NEJBQUNFLFlBQVk7d0JBQUs7Z0JBRXBHLE9BQU87b0JBQ0wsTUFBTXRCLElBQUlRLElBQUksQ0FBQyxJQUFNcEIsV0FBV21DLElBQUksQ0FBQzs0QkFBQyxHQUFHSCxJQUFJOzRCQUFFRixNQUFNckQsa0JBQWtCK0M7d0JBQUk7Z0JBQzdFO1lBQ0Y7WUFDQVksUUFBUSxPQUFPdEQsTUFBTTZDO2dCQUNuQixNQUFNZixJQUFJUSxJQUFJLENBQUMsSUFDYnZCLFNBQVNHLFVBQVUsQ0FBQ2xCLE1BQU1zRCxNQUFNLENBQUM7d0JBQUNOLE1BQU1ILFNBQVNHLElBQUk7d0JBQUVDLE1BQU1KLFNBQVNJLElBQUk7b0JBQUEsR0FBRzt3QkFBQ0csWUFBWTtvQkFBSztZQUVuRztRQUNGO1FBQ0EsSUFBSTtZQUNGLE1BQU1HLFNBQVMsTUFBTTFCLE9BQU9LO1lBQzVCLE1BQU1KLElBQUkwQixNQUFNO1lBQ2hCLE9BQU9EO1FBQ1QsRUFBRSxPQUFNaEMsT0FBTztZQUNiLE1BQU1PLElBQUkyQixLQUFLLEdBQUdDLEtBQUssQ0FBQyxJQUFNQztZQUM5QixNQUFNcEM7UUFDUjtJQUNGO0lBQ0EsT0FBTztRQUFDTjtRQUFZVztJQUFXO0FBQ2pDLEVBQUUsQ0FDRixvRkFBb0YsSUFFcEYsK0RBQStELElBQy9ELDZFQUE2RSJ9

package/lib/organizations/types.d.ts

@@ -0,0 +1,138 @@
+import type { ApiContext } from '../types/auth.types.js';
+export type PlanKey = 'starter' | 'pro';
+export type BillingMode = 'disabled' | 'test';
+export type MembershipRole = 'admin' | 'member';
+export type MembershipStatus = 'pending' | 'active' | 'deactivated';
+export type Organization = Readonly<{
+    createdAt: number;
+    name: string;
+    organizationId: string;
+    ownerUserId: string;
+    revision: number;
+    updatedAt: number;
+}>;
+export type OrganizationMembership = Readonly<{
+    createdAt: number;
+    organizationId: string;
+    revision: number;
+    role: MembershipRole;
+    status: MembershipStatus;
+    updatedAt: number;
+    userId: string;
+}>;
+export type OrganizationAccess = Readonly<{
+    membership: OrganizationMembership;
+    organization: Organization;
+    userId: string;
+}>;
+export type OrganizationPlan = Readonly<{
+    additionalSeatCents: number;
+    baseCents: number;
+    currency: 'usd';
+    includedSeats: 10;
+    interval: 'month';
+    key: PlanKey;
+    version: '2026-10-v1';
+}>;
+export type OveragePreference = Readonly<{
+    enabled: boolean;
+    monthlyCapCents: number;
+    revision: number;
+}>;
+export type SubscriptionSummary = Readonly<{
+    activeMembers: number;
+    billingMode: BillingMode;
+    canManage: boolean;
+    estimatedMonthlyCents: number;
+    extraSeats: number;
+    metersEnabled: false;
+    organizationId: string;
+    overage: OveragePreference;
+    pendingChange: string | null;
+    periodEnd: number | null;
+    plan: PlanKey | null;
+    reconciliationPending: boolean;
+    status: string;
+}>;
+export type MembershipChange = Readonly<{
+    confirmedQuoteId?: string;
+    expectedRevision: number;
+    role: MembershipRole;
+    status: MembershipStatus;
+    userId: string;
+}>;
+export type SeatChangeQuote = Readonly<{
+    currency: 'usd';
+    expiresAt: number;
+    organizationRevision: number;
+    prorationCents: number;
+    quantity: number;
+    quoteId: string;
+}>;
+export type SignupInput = Readonly<{
+    email: string;
+    organizationName: string;
+    password: string;
+    requestId: string;
+}>;
+export type SignupResult = Readonly<{
+    registrationId: string;
+    verificationRequired: true;
+}>;
+export type BillingJob = Readonly<{
+    attempts: number;
+    desired: Record<string, unknown>;
+    effectiveAt: number;
+    jobId: string;
+    kind: 'cancel' | 'mail' | 'plan' | 'reconcile' | 'seats';
+    leaseExpires: number;
+    organizationId: string;
+    owner: string;
+    priceVersion: '2026-10-v1';
+    sequence: number;
+    status: 'complete' | 'pending';
+}>;
+export type ProviderSubscription = Readonly<{
+    cancelAtPeriodEnd?: boolean;
+    baseItemId: string;
+    customerId: string;
+    extraSeats: number;
+    id: string;
+    lastJobId?: string;
+    pendingPlan?: PlanKey | null;
+    periodEnd: number;
+    periodStart: number;
+    plan: PlanKey;
+    seatItemId: string;
+    status: string;
+    startedAt?: number;
+}>;
+export type CheckoutResult = Readonly<{
+    expiresAt: number;
+    id: string;
+    url: string;
+}>;
+export type VerifiedBillingEvent = Readonly<{
+    customerId: string;
+    eventId: string;
+    type: string;
+}>;
+export type BillingAdjustment = Readonly<{
+    amountCents: number;
+    periodEnd: number;
+    periodStart: number;
+    providerId: string;
+}>;
+export type BillingUpdateResult = Readonly<{
+    adjustments: readonly BillingAdjustment[];
+}>;
+export type BillingProvider = Readonly<{
+    checkout: (customerId: string, plan: PlanKey, extraSeats: number, key: string) => Promise<CheckoutResult>;
+    customer: (organizationId: string, email: string) => Promise<string>;
+    portal: (customerId: string) => Promise<string>;
+    preview: (subscription: ProviderSubscription, plan: PlanKey, seats: number, effectiveAt: number) => Promise<number>;
+    retrieve: (customerId: string, subscriptionId?: string) => Promise<ProviderSubscription | null>;
+    update: (subscription: ProviderSubscription, job: BillingJob, fence: () => Promise<void>) => Promise<BillingUpdateResult>;
+    verify: (body: string | Buffer, signature: string) => VerifiedBillingEvent;
+}>;
+export type OrganizationContext = ApiContext;

package/lib/organizations/types.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9Vc2Vycy9uaXRyb2c3L0RldmVsb3BtZW50L3JlYWt0b3IvcGFja2FnZXMvcmVha3Rvci9zcmMvb3JnYW5pemF0aW9ucy90eXBlcy50cyJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgdHlwZSB7QXBpQ29udGV4dH0gZnJvbSAnLi4vdHlwZXMvYXV0aC50eXBlcy5qcyc7XG5cbmV4cG9ydCB0eXBlIFBsYW5LZXkgPSAnc3RhcnRlcicgfCAncHJvJztcbmV4cG9ydCB0eXBlIEJpbGxpbmdNb2RlID0gJ2Rpc2FibGVkJyB8ICd0ZXN0JztcbmV4cG9ydCB0eXBlIE1lbWJlcnNoaXBSb2xlID0gJ2FkbWluJyB8ICdtZW1iZXInO1xuZXhwb3J0IHR5cGUgTWVtYmVyc2hpcFN0YXR1cyA9ICdwZW5kaW5nJyB8ICdhY3RpdmUnIHwgJ2RlYWN0aXZhdGVkJztcbmV4cG9ydCB0eXBlIE9yZ2FuaXphdGlvbiA9IFJlYWRvbmx5PHtcbiAgY3JlYXRlZEF0OiBudW1iZXI7XG4gIG5hbWU6IHN0cmluZztcbiAgb3JnYW5pemF0aW9uSWQ6IHN0cmluZztcbiAgb3duZXJVc2VySWQ6IHN0cmluZztcbiAgcmV2aXNpb246IG51bWJlcjtcbiAgdXBkYXRlZEF0OiBudW1iZXI7XG59PjtcbmV4cG9ydCB0eXBlIE9yZ2FuaXphdGlvbk1lbWJlcnNoaXAgPSBSZWFkb25seTx7XG4gIGNyZWF0ZWRBdDogbnVtYmVyO1xuICBvcmdhbml6YXRpb25JZDogc3RyaW5nO1xuICByZXZpc2lvbjogbnVtYmVyO1xuICByb2xlOiBNZW1iZXJzaGlwUm9sZTtcbiAgc3RhdHVzOiBNZW1iZXJzaGlwU3RhdHVzO1xuICB1cGRhdGVkQXQ6IG51bWJlcjtcbiAgdXNlcklkOiBzdHJpbmc7XG59PjtcbmV4cG9ydCB0eXBlIE9yZ2FuaXphdGlvbkFjY2VzcyA9IFJlYWRvbmx5PHtcbiAgbWVtYmVyc2hpcDogT3JnYW5pemF0aW9uTWVtYmVyc2hpcDtcbiAgb3JnYW5pemF0aW9uOiBPcmdhbml6YXRpb247XG4gIHVzZXJJZDogc3RyaW5nO1xufT47XG5leHBvcnQgdHlwZSBPcmdhbml6YXRpb25QbGFuID0gUmVhZG9ubHk8e1xuICBhZGRpdGlvbmFsU2VhdENlbnRzOiBudW1iZXI7XG4gIGJhc2VDZW50czogbnVtYmVyO1xuICBjdXJyZW5jeTogJ3VzZCc7XG4gIGluY2x1ZGVkU2VhdHM6IDEwO1xuICBpbnRlcnZhbDogJ21vbnRoJztcbiAga2V5OiBQbGFuS2V5O1xuICB2ZXJzaW9uOiAnMjAyNi0xMC12MSc7XG59PjtcbmV4cG9ydCB0eXBlIE92ZXJhZ2VQcmVmZXJlbmNlID0gUmVhZG9ubHk8e2VuYWJsZWQ6IGJvb2xlYW47IG1vbnRobHlDYXBDZW50czogbnVtYmVyOyByZXZpc2lvbjogbnVtYmVyfT47XG5leHBvcnQgdHlwZSBTdWJzY3JpcHRpb25TdW1tYXJ5ID0gUmVhZG9ubHk8e1xuICBhY3RpdmVNZW1iZXJzOiBudW1iZXI7XG4gIGJpbGxpbmdNb2RlOiBCaWxsaW5nTW9kZTtcbiAgY2FuTWFuYWdlOiBib29sZWFuO1xuICBlc3RpbWF0ZWRNb250aGx5Q2VudHM6IG51bWJlcjtcbiAgZXh0cmFTZWF0czogbnVtYmVyO1xuICBtZXRlcnNFbmFibGVkOiBmYWxzZTtcbiAgb3JnYW5pemF0aW9uSWQ6IHN0cmluZztcbiAgb3ZlcmFnZTogT3ZlcmFnZVByZWZlcmVuY2U7XG4gIHBlbmRpbmdDaGFuZ2U6IHN0cmluZyB8IG51bGw7XG4gIHBlcmlvZEVuZDogbnVtYmVyIHwgbnVsbDtcbiAgcGxhbjogUGxhbktleSB8IG51bGw7XG4gIHJlY29uY2lsaWF0aW9uUGVuZGluZzogYm9vbGVhbjtcbiAgc3RhdHVzOiBzdHJpbmc7XG59PjtcbmV4cG9ydCB0eXBlIE1lbWJlcnNoaXBDaGFuZ2UgPSBSZWFkb25seTx7XG4gIGNvbmZpcm1lZFF1b3RlSWQ/OiBzdHJpbmc7XG4gIGV4cGVjdGVkUmV2aXNpb246IG51bWJlcjtcbiAgcm9sZTogTWVtYmVyc2hpcFJvbGU7XG4gIHN0YXR1czogTWVtYmVyc2hpcFN0YXR1cztcbiAgdXNlcklkOiBzdHJpbmc7XG59PjtcbmV4cG9ydCB0eXBlIFNlYXRDaGFuZ2VRdW90ZSA9IFJlYWRvbmx5PHtcbiAgY3VycmVuY3k6ICd1c2QnO1xuICBleHBpcmVzQXQ6IG51bWJlcjtcbiAgb3JnYW5pemF0aW9uUmV2aXNpb246IG51bWJlcjtcbiAgcHJvcmF0aW9uQ2VudHM6IG51bWJlcjtcbiAgcXVhbnRpdHk6IG51bWJlcjtcbiAgcXVvdGVJZDogc3RyaW5nO1xufT47XG5leHBvcnQgdHlwZSBTaWdudXBJbnB1dCA9IFJlYWRvbmx5PHtcbiAgZW1haWw6IHN0cmluZztcbiAgb3JnYW5pemF0aW9uTmFtZTogc3RyaW5nO1xuICBwYXNzd29yZDogc3RyaW5nO1xuICByZXF1ZXN0SWQ6IHN0cmluZztcbn0+O1xuZXhwb3J0IHR5cGUgU2lnbnVwUmVzdWx0ID0gUmVhZG9ubHk8e3JlZ2lzdHJhdGlvbklkOiBzdHJpbmc7IHZlcmlmaWNhdGlvblJlcXVpcmVkOiB0cnVlfT47XG5leHBvcnQgdHlwZSBCaWxsaW5nSm9iID0gUmVhZG9ubHk8e1xuICBhdHRlbXB0czogbnVtYmVyO1xuICBkZXNpcmVkOiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcbiAgZWZmZWN0aXZlQXQ6IG51bWJlcjtcbiAgam9iSWQ6IHN0cmluZztcbiAga2luZDogJ2NhbmNlbCcgfCAnbWFpbCcgfCAncGxhbicgfCAncmVjb25jaWxlJyB8ICdzZWF0cyc7XG4gIGxlYXNlRXhwaXJlczogbnVtYmVyO1xuICBvcmdhbml6YXRpb25JZDogc3RyaW5nO1xuICBvd25lcjogc3RyaW5nO1xuICBwcmljZVZlcnNpb246ICcyMDI2LTEwLXYxJztcbiAgc2VxdWVuY2U6IG51bWJlcjtcbiAgc3RhdHVzOiAnY29tcGxldGUnIHwgJ3BlbmRpbmcnO1xufT47XG5leHBvcnQgdHlwZSBQcm92aWRlclN1YnNjcmlwdGlvbiA9IFJlYWRvbmx5PHtcbiAgY2FuY2VsQXRQZXJpb2RFbmQ/OiBib29sZWFuO1xuICBiYXNlSXRlbUlkOiBzdHJpbmc7XG4gIGN1c3RvbWVySWQ6IHN0cmluZztcbiAgZXh0cmFTZWF0czogbnVtYmVyO1xuICBpZDogc3RyaW5nO1xuICBsYXN0Sm9iSWQ/OiBzdHJpbmc7XG4gIHBlbmRpbmdQbGFuPzogUGxhbktleSB8IG51bGw7XG4gIHBlcmlvZEVuZDogbnVtYmVyO1xuICBwZXJpb2RTdGFydDogbnVtYmVyO1xuICBwbGFuOiBQbGFuS2V5O1xuICBzZWF0SXRlbUlkOiBzdHJpbmc7XG4gIHN0YXR1czogc3RyaW5nO1xuICBzdGFydGVkQXQ/OiBudW1iZXI7XG59PjtcbmV4cG9ydCB0eXBlIENoZWNrb3V0UmVzdWx0ID0gUmVhZG9ubHk8e2V4cGlyZXNBdDogbnVtYmVyOyBpZDogc3RyaW5nOyB1cmw6IHN0cmluZ30+O1xuZXhwb3J0IHR5cGUgVmVyaWZpZWRCaWxsaW5nRXZlbnQgPSBSZWFkb25seTx7Y3VzdG9tZXJJZDogc3RyaW5nOyBldmVudElkOiBzdHJpbmc7IHR5cGU6IHN0cmluZ30+O1xuZXhwb3J0IHR5cGUgQmlsbGluZ0FkanVzdG1lbnQgPSBSZWFkb25seTx7XG4gIGFtb3VudENlbnRzOiBudW1iZXI7XG4gIHBlcmlvZEVuZDogbnVtYmVyO1xuICBwZXJpb2RTdGFydDogbnVtYmVyO1xuICBwcm92aWRlcklkOiBzdHJpbmc7XG59PjtcbmV4cG9ydCB0eXBlIEJpbGxpbmdVcGRhdGVSZXN1bHQgPSBSZWFkb25seTx7YWRqdXN0bWVudHM6IHJlYWRvbmx5IEJpbGxpbmdBZGp1c3RtZW50W119PjtcbmV4cG9ydCB0eXBlIEJpbGxpbmdQcm92aWRlciA9IFJlYWRvbmx5PHtcbiAgY2hlY2tvdXQ6IChjdXN0b21lcklkOiBzdHJpbmcsIHBsYW46IFBsYW5LZXksIGV4dHJhU2VhdHM6IG51bWJlciwga2V5OiBzdHJpbmcpID0+IFByb21pc2U8Q2hlY2tvdXRSZXN1bHQ+O1xuICBjdXN0b21lcjogKG9yZ2FuaXphdGlvbklkOiBzdHJpbmcsIGVtYWlsOiBzdHJpbmcpID0+IFByb21pc2U8c3RyaW5nPjtcbiAgcG9ydGFsOiAoY3VzdG9tZXJJZDogc3RyaW5nKSA9PiBQcm9taXNlPHN0cmluZz47XG4gIHByZXZpZXc6IChcbiAgICBzdWJzY3JpcHRpb246IFByb3ZpZGVyU3Vic2NyaXB0aW9uLFxuICAgIHBsYW46IFBsYW5LZXksXG4gICAgc2VhdHM6IG51bWJlcixcbiAgICBlZmZlY3RpdmVBdDogbnVtYmVyXG4gICkgPT4gUHJvbWlzZTxudW1iZXI+O1xuICByZXRyaWV2ZTogKGN1c3RvbWVySWQ6IHN0cmluZywgc3Vic2NyaXB0aW9uSWQ/OiBzdHJpbmcpID0+IFByb21pc2U8UHJvdmlkZXJTdWJzY3JpcHRpb24gfCBudWxsPjtcbiAgdXBkYXRlOiAoXG4gICAgc3Vic2NyaXB0aW9uOiBQcm92aWRlclN1YnNjcmlwdGlvbixcbiAgICBqb2I6IEJpbGxpbmdKb2IsXG4gICAgZmVuY2U6ICgpID0+IFByb21pc2U8dm9pZD5cbiAgKSA9PiBQcm9taXNlPEJpbGxpbmdVcGRhdGVSZXN1bHQ+O1xuICB2ZXJpZnk6IChib2R5OiBzdHJpbmcgfCBCdWZmZXIsIHNpZ25hdHVyZTogc3RyaW5nKSA9PiBWZXJpZmllZEJpbGxpbmdFdmVudDtcbn0+O1xuZXhwb3J0IHR5cGUgT3JnYW5pemF0aW9uQ29udGV4dCA9IEFwaUNvbnRleHQ7XG4iXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBa0lBLFdBQTZDIn0=

package/lib/organizations/verification.d.ts

@@ -0,0 +1,3 @@
+import type { ApiContext } from '../types/auth.types.js';
+export declare const verifyOrganizationEmail: (registrationId: string, token: string, context: ApiContext) => Promise<void>;
+export declare const resendOrganizationVerification: (registrationId: string, context: ApiContext) => Promise<void>;

package/lib/organizations/verification.js

@@ -0,0 +1,51 @@
+import { queueOrganizationVerification } from './signup.js';
+import { organizationKey, organizationStoreFor, requireIdentifier } from './store.js';
+export const verifyOrganizationEmail = async (registrationId, token, context)=>{
+    const error = await organizationStoreFor(context).transaction(async (tx)=>{
+        const previous = await tx.get('organizationVerificationTokens', requireIdentifier(registrationId));
+        if (!previous || previous.used || previous.expiresAt <= Date.now()) {
+            return 'invalid_verification';
+        }
+        const now = Date.now();
+        const attempts = now - previous.attemptWindow < 3600000 ? previous.attempts : 0;
+        if (attempts >= 10) {
+            return 'verification_rate_limited';
+        }
+        const valid = typeof token === 'string' && token.length <= 128 && previous.tokenHash === organizationKey(token);
+        await tx.put('organizationVerificationTokens', registrationId, {
+            ...previous,
+            attemptWindow: attempts ? previous.attemptWindow : now,
+            attempts: attempts + 1,
+            used: valid
+        }, previous);
+        if (!valid) {
+            return 'invalid_verification';
+        }
+        const user = await tx.get('users', previous.userId);
+        if (!user) {
+            throw new Error('invalid_verification');
+        }
+        await tx.put('users', previous.userId, {
+            ...user,
+            verifiedEmail: true
+        }, user);
+        return '';
+    });
+    if (error) {
+        throw new Error(error);
+    }
+};
+export const resendOrganizationVerification = (registrationId, context)=>organizationStoreFor(context).transaction(async (tx)=>{
+        const registration = await tx.get('organizationRegistrations', requireIdentifier(registrationId));
+        const previous = await tx.get('organizationVerificationTokens', registrationId);
+        if (!registration?.userId || !previous || previous.used) {
+            return;
+        }
+        const now = Date.now();
+        if (now - previous.lastSent < 60000 || now - previous.resendWindow < 3600000 && previous.resendCount >= 5) {
+            throw new Error('verification_rate_limited');
+        }
+        await queueOrganizationVerification(tx, registration, previous);
+    });
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9Vc2Vycy9uaXRyb2c3L0RldmVsb3BtZW50L3JlYWt0b3IvcGFja2FnZXMvcmVha3Rvci9zcmMvb3JnYW5pemF0aW9ucy92ZXJpZmljYXRpb24udHMiXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHtxdWV1ZU9yZ2FuaXphdGlvblZlcmlmaWNhdGlvbiwgdHlwZSBSZWdpc3RyYXRpb24sIHR5cGUgVmVyaWZpY2F0aW9ufSBmcm9tICcuL3NpZ251cC5qcyc7XG5pbXBvcnQge29yZ2FuaXphdGlvbktleSwgb3JnYW5pemF0aW9uU3RvcmVGb3IsIHJlcXVpcmVJZGVudGlmaWVyfSBmcm9tICcuL3N0b3JlLmpzJztcblxuaW1wb3J0IHR5cGUge0FwaUNvbnRleHR9IGZyb20gJy4uL3R5cGVzL2F1dGgudHlwZXMuanMnO1xuXG5leHBvcnQgY29uc3QgdmVyaWZ5T3JnYW5pemF0aW9uRW1haWwgPSBhc3luYyAoXG4gIHJlZ2lzdHJhdGlvbklkOiBzdHJpbmcsXG4gIHRva2VuOiBzdHJpbmcsXG4gIGNvbnRleHQ6IEFwaUNvbnRleHRcbik6IFByb21pc2U8dm9pZD4gPT4ge1xuICBjb25zdCBlcnJvciA9IGF3YWl0IG9yZ2FuaXphdGlvblN0b3JlRm9yKGNvbnRleHQpLnRyYW5zYWN0aW9uKGFzeW5jICh0eCkgPT4ge1xuICAgIGNvbnN0IHByZXZpb3VzID0gYXdhaXQgdHguZ2V0PFZlcmlmaWNhdGlvbj4oXG4gICAgICAnb3JnYW5pemF0aW9uVmVyaWZpY2F0aW9uVG9rZW5zJyxcbiAgICAgIHJlcXVpcmVJZGVudGlmaWVyKHJlZ2lzdHJhdGlvbklkKVxuICAgICk7XG4gICAgaWYoIXByZXZpb3VzIHx8IHByZXZpb3VzLnVzZWQgfHwgcHJldmlvdXMuZXhwaXJlc0F0IDw9IERhdGUubm93KCkpIHtcbiAgICAgIHJldHVybiAnaW52YWxpZF92ZXJpZmljYXRpb24nO1xuICAgIH1cbiAgICBjb25zdCBub3cgPSBEYXRlLm5vdygpO1xuICAgIGNvbnN0IGF0dGVtcHRzID0gbm93IC0gcHJldmlvdXMuYXR0ZW1wdFdpbmRvdyA8IDM2MDAwMDAgPyBwcmV2aW91cy5hdHRlbXB0cyA6IDA7XG4gICAgaWYoYXR0ZW1wdHMgPj0gMTApIHtcbiAgICAgIHJldHVybiAndmVyaWZpY2F0aW9uX3JhdGVfbGltaXRlZCc7XG4gICAgfVxuICAgIGNvbnN0IHZhbGlkID1cbiAgICAgIHR5cGVvZiB0b2tlbiA9PT0gJ3N0cmluZycgJiYgdG9rZW4ubGVuZ3RoIDw9IDEyOCAmJiBwcmV2aW91cy50b2tlbkhhc2ggPT09IG9yZ2FuaXphdGlvbktleSh0b2tlbik7XG4gICAgYXdhaXQgdHgucHV0KFxuICAgICAgJ29yZ2FuaXphdGlvblZlcmlmaWNhdGlvblRva2VucycsXG4gICAgICByZWdpc3RyYXRpb25JZCxcbiAgICAgIHtcbiAgICAgICAgLi4ucHJldmlvdXMsXG4gICAgICAgIGF0dGVtcHRXaW5kb3c6IGF0dGVtcHRzID8gcHJldmlvdXMuYXR0ZW1wdFdpbmRvdyA6IG5vdyxcbiAgICAgICAgYXR0ZW1wdHM6IGF0dGVtcHRzICsgMSxcbiAgICAgICAgdXNlZDogdmFsaWRcbiAgICAgIH0sXG4gICAgICBwcmV2aW91c1xuICAgICk7XG4gICAgaWYoIXZhbGlkKSB7XG4gICAgICByZXR1cm4gJ2ludmFsaWRfdmVyaWZpY2F0aW9uJztcbiAgICB9XG4gICAgY29uc3QgdXNlciA9IGF3YWl0IHR4LmdldCgndXNlcnMnLCBwcmV2aW91cy51c2VySWQpO1xuICAgIGlmKCF1c2VyKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ2ludmFsaWRfdmVyaWZpY2F0aW9uJyk7XG4gICAgfVxuICAgIGF3YWl0IHR4LnB1dCgndXNlcnMnLCBwcmV2aW91cy51c2VySWQsIHsuLi51c2VyLCB2ZXJpZmllZEVtYWlsOiB0cnVlfSwgdXNlcik7XG4gICAgcmV0dXJuICcnO1xuICB9KTtcbiAgaWYoZXJyb3IpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoZXJyb3IpO1xuICB9XG59O1xuXG5leHBvcnQgY29uc3QgcmVzZW5kT3JnYW5pemF0aW9uVmVyaWZpY2F0aW9uID0gKHJlZ2lzdHJhdGlvbklkOiBzdHJpbmcsIGNvbnRleHQ6IEFwaUNvbnRleHQpOiBQcm9taXNlPHZvaWQ+ID0+XG4gIG9yZ2FuaXphdGlvblN0b3JlRm9yKGNvbnRleHQpLnRyYW5zYWN0aW9uKGFzeW5jICh0eCkgPT4ge1xuICAgIGNvbnN0IHJlZ2lzdHJhdGlvbiA9IGF3YWl0IHR4LmdldDxSZWdpc3RyYXRpb24+KFxuICAgICAgJ29yZ2FuaXphdGlvblJlZ2lzdHJhdGlvbnMnLFxuICAgICAgcmVxdWlyZUlkZW50aWZpZXIocmVnaXN0cmF0aW9uSWQpXG4gICAgKTtcbiAgICBjb25zdCBwcmV2aW91cyA9IGF3YWl0IHR4LmdldDxWZXJpZmljYXRpb24+KCdvcmdhbml6YXRpb25WZXJpZmljYXRpb25Ub2tlbnMnLCByZWdpc3RyYXRpb25JZCk7XG4gICAgaWYoIXJlZ2lzdHJhdGlvbj8udXNlcklkIHx8ICFwcmV2aW91cyB8fCBwcmV2aW91cy51c2VkKSB7XG4gICAgICByZXR1cm47XG4gICAgfVxuICAgIGNvbnN0IG5vdyA9IERhdGUubm93KCk7XG4gICAgaWYoXG4gICAgICBub3cgLSBwcmV2aW91cy5sYXN0U2VudCA8IDYwMDAwIHx8XG4gICAgICAobm93IC0gcHJldmlvdXMucmVzZW5kV2luZG93IDwgMzYwMDAwMCAmJiBwcmV2aW91cy5yZXNlbmRDb3VudCA+PSA1KVxuICAgICkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCd2ZXJpZmljYXRpb25fcmF0ZV9saW1pdGVkJyk7XG4gICAgfVxuICAgIGF3YWl0IHF1ZXVlT3JnYW5pemF0aW9uVmVyaWZpY2F0aW9uKHR4LCByZWdpc3RyYXRpb24sIHByZXZpb3VzKTtcbiAgfSk7XG4iXSwibmFtZXMiOlsicXVldWVPcmdhbml6YXRpb25WZXJpZmljYXRpb24iLCJvcmdhbml6YXRpb25LZXkiLCJvcmdhbml6YXRpb25TdG9yZUZvciIsInJlcXVpcmVJZGVudGlmaWVyIiwidmVyaWZ5T3JnYW5pemF0aW9uRW1haWwiLCJyZWdpc3RyYXRpb25JZCIsInRva2VuIiwiY29udGV4dCIsImVycm9yIiwidHJhbnNhY3Rpb24iLCJ0eCIsInByZXZpb3VzIiwiZ2V0IiwidXNlZCIsImV4cGlyZXNBdCIsIkRhdGUiLCJub3ciLCJhdHRlbXB0cyIsImF0dGVtcHRXaW5kb3ciLCJ2YWxpZCIsImxlbmd0aCIsInRva2VuSGFzaCIsInB1dCIsInVzZXIiLCJ1c2VySWQiLCJFcnJvciIsInZlcmlmaWVkRW1haWwiLCJyZXNlbmRPcmdhbml6YXRpb25WZXJpZmljYXRpb24iLCJyZWdpc3RyYXRpb24iLCJsYXN0U2VudCIsInJlc2VuZFdpbmRvdyIsInJlc2VuZENvdW50Il0sIm1hcHBpbmdzIjoiQUFBQSxTQUFRQSw2QkFBNkIsUUFBNkMsY0FBYztBQUNoRyxTQUFRQyxlQUFlLEVBQUVDLG9CQUFvQixFQUFFQyxpQkFBaUIsUUFBTyxhQUFhO0FBSXBGLE9BQU8sTUFBTUMsMEJBQTBCLE9BQ3JDQyxnQkFDQUMsT0FDQUM7SUFFQSxNQUFNQyxRQUFRLE1BQU1OLHFCQUFxQkssU0FBU0UsV0FBVyxDQUFDLE9BQU9DO1FBQ25FLE1BQU1DLFdBQVcsTUFBTUQsR0FBR0UsR0FBRyxDQUMzQixrQ0FDQVQsa0JBQWtCRTtRQUVwQixJQUFHLENBQUNNLFlBQVlBLFNBQVNFLElBQUksSUFBSUYsU0FBU0csU0FBUyxJQUFJQyxLQUFLQyxHQUFHLElBQUk7WUFDakUsT0FBTztRQUNUO1FBQ0EsTUFBTUEsTUFBTUQsS0FBS0MsR0FBRztRQUNwQixNQUFNQyxXQUFXRCxNQUFNTCxTQUFTTyxhQUFhLEdBQUcsVUFBVVAsU0FBU00sUUFBUSxHQUFHO1FBQzlFLElBQUdBLFlBQVksSUFBSTtZQUNqQixPQUFPO1FBQ1Q7UUFDQSxNQUFNRSxRQUNKLE9BQU9iLFVBQVUsWUFBWUEsTUFBTWMsTUFBTSxJQUFJLE9BQU9ULFNBQVNVLFNBQVMsS0FBS3BCLGdCQUFnQks7UUFDN0YsTUFBTUksR0FBR1ksR0FBRyxDQUNWLGtDQUNBakIsZ0JBQ0E7WUFDRSxHQUFHTSxRQUFRO1lBQ1hPLGVBQWVELFdBQVdOLFNBQVNPLGFBQWEsR0FBR0Y7WUFDbkRDLFVBQVVBLFdBQVc7WUFDckJKLE1BQU1NO1FBQ1IsR0FDQVI7UUFFRixJQUFHLENBQUNRLE9BQU87WUFDVCxPQUFPO1FBQ1Q7UUFDQSxNQUFNSSxPQUFPLE1BQU1iLEdBQUdFLEdBQUcsQ0FBQyxTQUFTRCxTQUFTYSxNQUFNO1FBQ2xELElBQUcsQ0FBQ0QsTUFBTTtZQUNSLE1BQU0sSUFBSUUsTUFBTTtRQUNsQjtRQUNBLE1BQU1mLEdBQUdZLEdBQUcsQ0FBQyxTQUFTWCxTQUFTYSxNQUFNLEVBQUU7WUFBQyxHQUFHRCxJQUFJO1lBQUVHLGVBQWU7UUFBSSxHQUFHSDtRQUN2RSxPQUFPO0lBQ1Q7SUFDQSxJQUFHZixPQUFPO1FBQ1IsTUFBTSxJQUFJaUIsTUFBTWpCO0lBQ2xCO0FBQ0YsRUFBRTtBQUVGLE9BQU8sTUFBTW1CLGlDQUFpQyxDQUFDdEIsZ0JBQXdCRSxVQUNyRUwscUJBQXFCSyxTQUFTRSxXQUFXLENBQUMsT0FBT0M7UUFDL0MsTUFBTWtCLGVBQWUsTUFBTWxCLEdBQUdFLEdBQUcsQ0FDL0IsNkJBQ0FULGtCQUFrQkU7UUFFcEIsTUFBTU0sV0FBVyxNQUFNRCxHQUFHRSxHQUFHLENBQWUsa0NBQWtDUDtRQUM5RSxJQUFHLENBQUN1QixjQUFjSixVQUFVLENBQUNiLFlBQVlBLFNBQVNFLElBQUksRUFBRTtZQUN0RDtRQUNGO1FBQ0EsTUFBTUcsTUFBTUQsS0FBS0MsR0FBRztRQUNwQixJQUNFQSxNQUFNTCxTQUFTa0IsUUFBUSxHQUFHLFNBQ3pCYixNQUFNTCxTQUFTbUIsWUFBWSxHQUFHLFdBQVduQixTQUFTb0IsV0FBVyxJQUFJLEdBQ2xFO1lBQ0EsTUFBTSxJQUFJTixNQUFNO1FBQ2xCO1FBQ0EsTUFBTXpCLDhCQUE4QlUsSUFBSWtCLGNBQWNqQjtJQUN4RCxHQUFHIn0=