@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/src/modules/documents/lib/templateInstantiation.ts

@@ -0,0 +1,206 @@
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { hasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'
+import { DocumentTemplate } from '../data/entities'
+import {
+  documentTemplateContextSlotsSchema,
+  type DocumentTemplateFillSlotInput,
+} from '../data/validators'
+import { getEntityRegistryEntry, getEntityTokenFieldNames } from './entityRegistry'
+import { isDocumentEntityRegistryModuleEnabled } from './entityRegistryAvailability.server'
+import { verifyEntityRegistrySelections } from './entityRegistry.server'
+import { materializeDocumentHtml, type MaterializedDocumentHtml } from './collabMaterializer'
+import { renderTemplateTokens, type TemplateRenderResult } from './templateFill'
+import {
+  canonicalizeTemplatePreviewInput,
+  computeTemplatePreviewDigest,
+  type CanonicalTemplatePreview,
+} from './templatePreviewDigest'
+
+export type PrepareTemplateRenderInput = {
+  request: Request
+  template: DocumentTemplate
+  title: string
+  locale: string
+  effectiveDate: string
+  templateUpdatedAt: string
+  slots: DocumentTemplateFillSlotInput[]
+  userFeatures: readonly string[]
+  expectedDigest?: string | null
+  rejectUnresolved?: boolean
+}
+
+export type PreparedTemplateRender = {
+  canonical: CanonicalTemplatePreview
+  /**
+   * Authoritative registry snapshots in submitted slot order. Callers that
+   * persist entity links must use these records, never the submitted labels,
+   * hrefs, or token values.
+   */
+  verifiedSlots: DocumentTemplateFillSlotInput[]
+  previewDigest: string
+  render: TemplateRenderResult
+  content: MaterializedDocumentHtml
+}
+
+export function dedupeTemplateLinkSlots<T extends Pick<DocumentTemplateFillSlotInput, 'entityType' | 'entityId'>>(
+  slots: readonly T[],
+): T[] {
+  return Array.from(
+    new Map(slots.map((slot) => [`${slot.entityType}:${slot.entityId}`, slot])).values(),
+  )
+}
+
+export function clearOmittedOptionalSlotTokens(
+  bodyHtml: string,
+  contextSlots: DocumentTemplate['contextSlots'],
+  submittedSlots: readonly Pick<DocumentTemplateFillSlotInput, 'slot'>[],
+): string {
+  const submitted = new Set(submittedSlots.map((slot) => slot.slot))
+  const omittedOptional = new Set(
+    documentTemplateContextSlotsSchema
+      .parse(contextSlots ?? [])
+      .filter((slot) => !slot.required && !submitted.has(slot.slot))
+      .map((slot) => slot.slot),
+  )
+  if (omittedOptional.size === 0) return bodyHtml
+
+  return bodyHtml.replace(
+    /{{\s*([a-z][a-zA-Z0-9]*)\.[^{}]+?\s*}}/g,
+    (token, slot: string) => omittedOptional.has(slot) ? '' : token,
+  )
+}
+
+function validateTemplateRevision(template: DocumentTemplate, submitted: string): void {
+  const revision = new Date(submitted)
+  if (Number.isNaN(revision.getTime()) || revision.toISOString() !== template.updatedAt.toISOString()) {
+    throw new CrudHttpError(409, { error: 'documents.templates.staleTemplate' })
+  }
+}
+
+function validateTemplateSlots(
+  template: DocumentTemplate,
+  slots: DocumentTemplateFillSlotInput[],
+  features: readonly string[],
+): void {
+  const expectedSlots = documentTemplateContextSlotsSchema.parse(template.contextSlots ?? [])
+  const submittedByName = new Map(slots.map((slot) => [slot.slot, slot]))
+  if (submittedByName.size !== slots.length) {
+    throw new CrudHttpError(400, { error: 'documents.templates.duplicateSlot' })
+  }
+  for (const expected of expectedSlots) {
+    const expectedEntry = getEntityRegistryEntry(expected.entityType)
+    if (!expectedEntry) {
+      throw new CrudHttpError(400, { error: 'documents.links.invalidEntityType' })
+    }
+    if (
+      expected.required
+      && (
+        !isDocumentEntityRegistryModuleEnabled(expectedEntry)
+        || !hasAllFeatures([expectedEntry.requiredFeature], Array.from(features))
+      )
+    ) {
+      throw new CrudHttpError(403, { error: 'Forbidden' })
+    }
+    const submitted = submittedByName.get(expected.slot)
+    if (!submitted) {
+      if (expected.required) {
+        throw new CrudHttpError(400, { error: 'documents.templates.requiredSlotMissing' })
+      }
+      continue
+    }
+    if (submitted.entityType !== expected.entityType) {
+      throw new CrudHttpError(400, { error: 'documents.templates.slotTypeMismatch' })
+    }
+  }
+  for (const submitted of slots) {
+    if (!expectedSlots.some((slot) => slot.slot === submitted.slot)) {
+      throw new CrudHttpError(400, { error: 'documents.templates.unknownSlot' })
+    }
+    const registryEntry = getEntityRegistryEntry(submitted.entityType)
+    if (
+      !registryEntry
+      || !isDocumentEntityRegistryModuleEnabled(registryEntry)
+      || !hasAllFeatures([registryEntry.requiredFeature], Array.from(features))
+    ) {
+      throw new CrudHttpError(403, { error: 'Forbidden' })
+    }
+    const allowedFields = getEntityTokenFieldNames(submitted.entityType)
+    for (const field of Object.keys(submitted.values)) {
+      if (!allowedFields.has(field)) {
+        throw new CrudHttpError(400, { error: 'documents.templates.invalidTokenField' })
+      }
+    }
+  }
+}
+
+export async function prepareTemplateRender(
+  input: PrepareTemplateRenderInput,
+): Promise<PreparedTemplateRender> {
+  validateTemplateRevision(input.template, input.templateUpdatedAt)
+  validateTemplateSlots(input.template, input.slots, input.userFeatures)
+  const verifiedSelections = await verifyEntityRegistrySelections(
+    input.request,
+    input.slots.map((slot) => ({
+      entityType: slot.entityType,
+      entityId: slot.entityId,
+      label: slot.label,
+      href: slot.href,
+    })),
+  )
+
+  const verifiedSlots = input.slots.map((slot) => {
+    const verified = verifiedSelections.get(`${slot.entityType}:${slot.entityId}`)
+    if (!verified) throw new CrudHttpError(400, { error: 'documents.links.targetMismatch' })
+    return {
+      ...slot,
+      label: verified.label,
+      href: verified.href,
+      values: verified.values,
+    }
+  })
+
+  const digestInput = {
+    templateId: input.template.id,
+    templateUpdatedAt: input.templateUpdatedAt,
+    title: input.title,
+    locale: input.locale,
+    effectiveDate: input.effectiveDate,
+    slots: verifiedSlots,
+  }
+  const canonical = canonicalizeTemplatePreviewInput(digestInput)
+  const previewDigest = computeTemplatePreviewDigest(digestInput)
+  if (input.expectedDigest && previewDigest !== input.expectedDigest) {
+    throw new CrudHttpError(409, { error: 'documents.templates.previewChanged' })
+  }
+
+  const tokenRender = renderTemplateTokens(
+    clearOmittedOptionalSlotTokens(
+      input.template.bodyHtml,
+      input.template.contextSlots,
+      canonical.slots,
+    ),
+    canonical.slots.map((slot) => ({
+      slot: slot.slot,
+      entityType: slot.entityType,
+      entityId: slot.entityId,
+      label: slot.label,
+      href: slot.href,
+      values: slot.values,
+    })),
+    { locale: canonical.locale, now: new Date(canonical.effectiveDate) },
+  )
+  if (input.rejectUnresolved && tokenRender.unresolvedTokens.length > 0) {
+    throw new CrudHttpError(400, {
+      error: 'documents.templates.unresolvedTokens',
+      unresolvedTokens: tokenRender.unresolvedTokens,
+    })
+  }
+
+  const content = materializeDocumentHtml(tokenRender.html)
+  if (!content) {
+    throw new CrudHttpError(400, { error: 'documents.templates.invalidContent' })
+  }
+  const render = { ...tokenRender, html: content.html }
+
+  return { canonical, verifiedSlots, previewDigest, render, content }
+}

package/src/modules/documents/lib/templatePreviewDigest.ts

@@ -0,0 +1,122 @@
+import { createHash } from 'node:crypto'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  documentEntityTypeSchema,
+  documentTemplateFillSlotSchema,
+  documentTitleSchema,
+  type DocumentTemplateFillSlotInput,
+} from '../data/validators'
+
+export type TemplatePreviewDigestInput = {
+  templateId: string
+  templateUpdatedAt: string
+  title: string
+  locale: string
+  effectiveDate: string
+  slots: DocumentTemplateFillSlotInput[]
+}
+
+export type CanonicalTemplatePreviewValue = string | number | null
+
+export type CanonicalTemplatePreviewSlot = {
+  slot: string
+  entityType: DocumentTemplateFillSlotInput['entityType']
+  entityId: string
+  label: string
+  href: string
+  values: Record<string, CanonicalTemplatePreviewValue>
+}
+
+export type CanonicalTemplatePreview = {
+  schema: 'documents-template-preview-v1'
+  templateId: string
+  templateUpdatedAt: string
+  title: string
+  locale: string
+  effectiveDate: string
+  slots: CanonicalTemplatePreviewSlot[]
+}
+
+function normalizeDate(value: string, errorKey: string): string {
+  const parsed = new Date(value)
+  if (Number.isNaN(parsed.getTime())) throw new CrudHttpError(400, { error: errorKey })
+  return parsed.toISOString()
+}
+
+function normalizeValue(value: CanonicalTemplatePreviewValue): CanonicalTemplatePreviewValue {
+  if (typeof value === 'string') return value.normalize('NFC')
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value)) {
+      throw new CrudHttpError(400, { error: 'documents.templates.invalidValue' })
+    }
+    return Object.is(value, -0) ? 0 : value
+  }
+  return null
+}
+
+function compareLexicographically(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0
+}
+
+function canonicalizeSlot(slot: DocumentTemplateFillSlotInput): CanonicalTemplatePreviewSlot {
+  const parsed = documentTemplateFillSlotSchema.parse(slot)
+  const values: Record<string, CanonicalTemplatePreviewValue> = {}
+  const normalizedEntries = Object.entries(parsed.values).map(([key, value]) => [
+    key.normalize('NFC'),
+    normalizeValue(value),
+  ] as const).sort(([left], [right]) => compareLexicographically(left, right))
+  for (const [index, [key, value]] of normalizedEntries.entries()) {
+    if (index > 0 && normalizedEntries[index - 1]![0] === key) {
+      throw new CrudHttpError(400, { error: 'documents.templates.duplicateValueField' })
+    }
+    values[key] = value
+  }
+  return {
+    slot: parsed.slot.normalize('NFC'),
+    entityType: documentEntityTypeSchema.parse(parsed.entityType),
+    entityId: parsed.entityId,
+    label: parsed.label.normalize('NFC'),
+    href: parsed.href.normalize('NFC'),
+    values,
+  }
+}
+
+export function canonicalizeTemplatePreviewInput(
+  input: TemplatePreviewDigestInput,
+): CanonicalTemplatePreview {
+  let locale: string
+  try {
+    locale = new Intl.Locale(input.locale).toString()
+  } catch {
+    throw new CrudHttpError(400, { error: 'documents.templates.invalidLocale' })
+  }
+
+  const slots = input.slots.map(canonicalizeSlot).sort((left, right) => (
+    compareLexicographically(left.slot, right.slot)
+    || compareLexicographically(left.entityType, right.entityType)
+    || compareLexicographically(left.entityId, right.entityId)
+  ))
+  const slotNames = new Set<string>()
+  for (const slot of slots) {
+    if (slotNames.has(slot.slot)) {
+      throw new CrudHttpError(400, { error: 'documents.templates.duplicateSlot' })
+    }
+    slotNames.add(slot.slot)
+  }
+
+  return {
+    schema: 'documents-template-preview-v1',
+    templateId: input.templateId,
+    templateUpdatedAt: normalizeDate(input.templateUpdatedAt, 'documents.templates.invalidRevision'),
+    title: documentTitleSchema.parse(input.title).normalize('NFC'),
+    locale,
+    effectiveDate: normalizeDate(input.effectiveDate, 'documents.templates.invalidEffectiveDate'),
+    slots,
+  }
+}
+
+export function computeTemplatePreviewDigest(input: TemplatePreviewDigestInput): string {
+  const canonical = canonicalizeTemplatePreviewInput(input)
+  const digest = createHash('sha256').update(JSON.stringify(canonical), 'utf8').digest('hex')
+  return `sha256:${digest}`
+}

package/src/modules/documents/lib/templateSeeds.ts

@@ -0,0 +1,248 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { randomUUID } from 'node:crypto'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { DocumentTemplate } from '../data/entities'
+
+export type DefaultDocumentTemplateSeed = {
+  name: string
+  description: string
+  bodyHtml: string
+  contextSlots: { slot: string; entityType: string; required?: boolean }[]
+}
+
+/** Managed seed metadata is internal to the idempotent setup path. */
+export type ManagedDocumentTemplateSeed = DefaultDocumentTemplateSeed & {
+  seedKey: string
+  legacyAdoptable?: boolean
+}
+
+const TEMPLATE_SEED_ACTOR_ID = '00000000-0000-4000-8000-000000000000'
+const DEFAULT_NAME_SUFFIX = ' — Open Mercato default'
+
+export const DEFAULT_DOCUMENT_TEMPLATES: Array<ManagedDocumentTemplateSeed> = [
+  {
+    seedKey: 'offer-letter',
+    legacyAdoptable: true,
+    name: 'Offer letter',
+    description: 'A proposal starter with customer and quote context.',
+    bodyHtml: [
+      '<h1>Offer for {{customer.name}}</h1>',
+      '<p>{{customer.chip}}</p>',
+      '<p>Thank you for the opportunity to prepare offer {{quote.number}}.</p>',
+      '<p>Write your offer details here…</p>',
+      '<p>Prepared on {{date}}</p>',
+    ].join(''),
+    contextSlots: [
+      { slot: 'customer', entityType: 'customer-person', required: true },
+      { slot: 'quote', entityType: 'quote', required: false },
+    ],
+  },
+  {
+    seedKey: 'meeting-notes',
+    legacyAdoptable: true,
+    name: 'Meeting notes',
+    description: 'A structured note template for meetings and follow-ups.',
+    bodyHtml: [
+      '<h1>Meeting notes — {{date}}</h1>',
+      '<p>{{company.chip}}</p>',
+      '<h2>Attendees</h2><ul></ul>',
+      '<h2>Agenda</h2><ul></ul>',
+      '<h2>Action items</h2><ul></ul>',
+    ].join(''),
+    contextSlots: [{ slot: 'company', entityType: 'customer-company', required: false }],
+  },
+  {
+    seedKey: 'deal-summary',
+    legacyAdoptable: true,
+    name: 'Deal summary',
+    description: 'A concise deal snapshot with customer context.',
+    bodyHtml: [
+      '<h1>Deal summary: {{deal.title}}</h1>',
+      '<p>{{deal.chip}}</p>',
+      '<table><tbody>',
+      '<tr><td>Status</td><td>{{deal.status}}</td></tr>',
+      '<tr><td>Value</td><td>{{deal.value}} {{deal.valueCurrency}}</td></tr>',
+      '<tr><td>Customer</td><td>{{customer.name}}</td></tr>',
+      '</tbody></table>',
+      '<h2>Notes</h2><p></p>',
+    ].join(''),
+    contextSlots: [
+      { slot: 'deal', entityType: 'deal', required: true },
+      { slot: 'customer', entityType: 'customer-company', required: false },
+    ],
+  },
+  {
+    seedKey: 'customer-meeting-brief',
+    name: 'Customer meeting brief',
+    description: 'Prepare a customer conversation with context and clear outcomes.',
+    bodyHtml: [
+      '<h1>Meeting brief — {{customer.name}}</h1>',
+      '<p>{{customer.chip}}</p>',
+      '<h2>Purpose</h2><p></p>',
+      '<h2>Discussion points</h2><ul></ul>',
+      '<h2>Desired outcomes</h2><ul></ul>',
+      '<p>Prepared on {{date}}</p>',
+    ].join(''),
+    contextSlots: [{ slot: 'customer', entityType: 'customer-person', required: true }],
+  },
+  {
+    seedKey: 'deal-proposal',
+    name: 'Deal proposal',
+    description: 'A proposal grounded in the current deal value and stage.',
+    bodyHtml: [
+      '<h1>Proposal — {{deal.title}}</h1>',
+      '<p>{{deal.chip}}</p>',
+      '<p>Status: {{deal.status}}</p>',
+      '<p>Value: {{deal.value}} {{deal.valueCurrency}}</p>',
+      '<h2>Objectives</h2><p></p>',
+      '<h2>Approach</h2><p></p>',
+      '<h2>Next steps</h2><ol></ol>',
+    ].join(''),
+    contextSlots: [{ slot: 'deal', entityType: 'deal', required: true }],
+  },
+  {
+    seedKey: 'quote-cover-letter',
+    name: 'Quote cover letter',
+    description: 'A concise cover letter for a sales quote.',
+    bodyHtml: [
+      '<h1>Quote {{quote.number}}</h1>',
+      '<p>{{quote.chip}}</p>',
+      '<p>Thank you for considering this proposal.</p>',
+      '<p>Total: {{quote.total}} {{quote.currency}}</p>',
+      '<h2>Summary</h2><p></p>',
+      '<p>Prepared on {{date}}</p>',
+    ].join(''),
+    contextSlots: [{ slot: 'quote', entityType: 'quote', required: true }],
+  },
+  {
+    seedKey: 'order-handoff',
+    name: 'Order handoff',
+    description: 'Capture delivery context and ownership for an accepted order.',
+    bodyHtml: [
+      '<h1>Order handoff — {{order.number}}</h1>',
+      '<p>{{order.chip}}</p>',
+      '<p>Status: {{order.status}}</p>',
+      '<p>Total: {{order.total}} {{order.currency}}</p>',
+      '<h2>Delivery notes</h2><p></p>',
+      '<h2>Owners and next steps</h2><ul></ul>',
+    ].join(''),
+    contextSlots: [{ slot: 'order', entityType: 'sales-order', required: true }],
+  },
+  {
+    seedKey: 'product-brief',
+    name: 'Product brief',
+    description: 'A reusable product positioning and launch brief.',
+    bodyHtml: [
+      '<h1>Product brief — {{product.title}}</h1>',
+      '<p>{{product.chip}}</p>',
+      '<p>SKU: {{product.sku}}</p>',
+      '<h2>Audience</h2><p></p>',
+      '<h2>Value proposition</h2><p></p>',
+      '<h2>Launch checklist</h2><ul></ul>',
+    ].join(''),
+    contextSlots: [{ slot: 'product', entityType: 'product', required: true }],
+  },
+]
+
+type SeedDocumentTemplatesScope = {
+  tenantId: string
+  organizationId: string
+  createdByUserId?: string | null
+}
+
+function slotsMatch(
+  current: DocumentTemplate['contextSlots'],
+  expected: DefaultDocumentTemplateSeed['contextSlots'],
+): boolean {
+  return JSON.stringify(current ?? []) === JSON.stringify(expected)
+}
+
+async function findBySeedKey(
+  em: EntityManager,
+  scope: SeedDocumentTemplatesScope,
+  seedKey: string,
+): Promise<DocumentTemplate | null> {
+  return findOneWithDecryption(
+    em,
+    DocumentTemplate,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      seedKey,
+    },
+    { filters: false },
+    scope,
+  )
+}
+
+async function findActiveByName(
+  em: EntityManager,
+  scope: SeedDocumentTemplatesScope,
+  name: string,
+): Promise<DocumentTemplate | null> {
+  return findOneWithDecryption(
+    em,
+    DocumentTemplate,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      name,
+      deletedAt: null,
+    },
+    undefined,
+    scope,
+  )
+}
+
+export async function seedDefaultDocumentTemplates(
+  em: EntityManager,
+  scope: SeedDocumentTemplatesScope,
+): Promise<void> {
+  // Setup can share an EntityManager with other module initializers. Isolate
+  // the unique-race recovery path so clearing a failed seed insert never drops
+  // unrelated pending setup changes from the caller's unit of work.
+  const seedEm = typeof em.fork === 'function' ? em.fork() : em
+  const createdByUserId = scope.createdByUserId ?? TEMPLATE_SEED_ACTOR_ID
+
+  for (const seed of DEFAULT_DOCUMENT_TEMPLATES) {
+    if (await findBySeedKey(seedEm, scope, seed.seedKey)) continue
+
+    const nameCollision = await findActiveByName(seedEm, scope, seed.name)
+    if (
+      seed.legacyAdoptable
+      && nameCollision
+      && nameCollision.description === seed.description
+      && nameCollision.bodyHtml === seed.bodyHtml
+      && slotsMatch(nameCollision.contextSlots, seed.contextSlots)
+    ) {
+      nameCollision.seedKey = seed.seedKey
+      try {
+        await seedEm.flush()
+      } catch (error) {
+        seedEm.clear()
+        if (!await findBySeedKey(seedEm, scope, seed.seedKey)) throw error
+      }
+      continue
+    }
+
+    const template = seedEm.create(DocumentTemplate, {
+      id: randomUUID(),
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      seedKey: seed.seedKey,
+      name: nameCollision ? `${seed.name}${DEFAULT_NAME_SUFFIX}` : seed.name,
+      description: seed.description,
+      bodyHtml: seed.bodyHtml,
+      contextSlots: seed.contextSlots,
+      createdByUserId,
+      isActive: true,
+    })
+    seedEm.persist(template)
+    try {
+      await seedEm.flush()
+    } catch (error) {
+      seedEm.clear()
+      if (!await findBySeedKey(seedEm, scope, seed.seedKey)) throw error
+    }
+  }
+}

package/src/modules/documents/lib/userLabels.ts

@@ -0,0 +1,58 @@
+import { sanitizeDocumentsDisplayLabel } from './displayLabels'
+import {
+  resolveAuthPrincipalService,
+  type DocumentsServiceContainer,
+} from './platformServices'
+
+export type UserLabel = { label: string; secondary?: string | null }
+export type ViewerSafeUserLabel = { label: string }
+
+function cleanString(value: unknown): string | null {
+  return sanitizeDocumentsDisplayLabel(value)
+}
+
+export async function resolveUserLabels(
+  container: DocumentsServiceContainer | null | undefined,
+  scope: { tenantId: string; organizationId: string },
+  userIds: string[],
+): Promise<Map<string, UserLabel>> {
+  const uniqueUserIds = Array.from(
+    new Set(userIds.map((id) => id.trim()).filter((id) => id.length > 0)),
+  )
+  const labels = new Map<string, UserLabel>()
+  if (uniqueUserIds.length === 0) return labels
+
+  const service = resolveAuthPrincipalService(container)
+  if (!service) return labels
+  const users = await service.resolveLabels({ type: 'user', ids: uniqueUserIds, scope })
+
+  for (const user of users) {
+    const label = cleanString(user.label)
+    const secondary = cleanString(user.secondary)
+    if (!label) continue
+    labels.set(user.id, { label, secondary: secondary && secondary !== label ? secondary : null })
+  }
+
+  return labels
+}
+
+/**
+ * Resolve labels safe for document viewers. Comment history needs readable
+ * author names, but it is not a directory surface: secondary identifiers must
+ * not cross this boundary. The primary label itself is kept as the directory
+ * resolved it — for an account without a display name that is its email, the
+ * same label the list owner column and version history already show, so a
+ * commenter never degrades to the "unknown user" placeholder.
+ */
+export async function resolveViewerSafeUserLabels(
+  container: DocumentsServiceContainer | null | undefined,
+  scope: { tenantId: string; organizationId: string },
+  userIds: string[],
+): Promise<Map<string, ViewerSafeUserLabel>> {
+  const resolved = await resolveUserLabels(container, scope, userIds)
+  const labels = new Map<string, ViewerSafeUserLabel>()
+  for (const [userId, value] of resolved.entries()) {
+    labels.set(userId, { label: value.label })
+  }
+  return labels
+}