@openhi/constructs 0.0.106 → 0.0.108

package/lib/pre-token-generation.handler.js

@@ -23,9 +23,7 @@ __export(pre_token_generation_handler_exports, {
   handler: () => handler
 });
 module.exports = __toCommonJS(pre_token_generation_handler_exports);
-
-// src/data/operations/control/user/user-create-operation.ts
-var import_types2 = require("@openhi/types");
+var import_types5 = require("@openhi/types");
 
 // src/data/dynamo/dynamo-control-service.ts
 var import_electrodb8 = require("electrodb");
@@ -279,6 +277,16 @@ var MembershipEntity = new import_electrodb2.Entity({
     msgId: {
       type: "string",
       required: false
+    },
+    /**
+     * Denormalized `linked-data-identity` Reference (e.g. `Practitioner/abc`).
+     * Populated from the FHIR extension on the Membership resource at write
+     * time so future GSIs can index data-plane identity lookups without
+     * deserializing the full resource JSON. See ADR 2026-03-13-02 §6.
+     */
+    linkedDataIdentityRef: {
+      type: "string",
+      required: false
     }
   },
   indexes: {
@@ -871,6 +879,217 @@ function getDynamoControlService(tableName) {
   };
 }
 
+// src/data/operations/data-operations-common.ts
+var import_types2 = require("@openhi/types");
+
+// src/lib/compression.ts
+var import_node_zlib = require("zlib");
+var COMPRESSION_ALGOS = {
+  NONE: "none",
+  GZIP: "gzip",
+  BROTLI: "brotli",
+  DEFLATE: "deflate"
+};
+function isEnvelope(obj) {
+  return typeof obj === "object" && obj !== null && "v" in obj && "algo" in obj && "payload" in obj && typeof obj.payload === "string";
+}
+function decompressResource(compressedOrRaw) {
+  try {
+    const parsed = JSON.parse(compressedOrRaw);
+    if (isEnvelope(parsed)) {
+      if (parsed.algo === COMPRESSION_ALGOS.GZIP) {
+        const buf = Buffer.from(parsed.payload, "base64");
+        return (0, import_node_zlib.gunzipSync)(buf).toString("utf-8");
+      }
+      if (parsed.algo === COMPRESSION_ALGOS.NONE) {
+        return parsed.payload;
+      }
+      return parsed.payload;
+    }
+  } catch {
+  }
+  try {
+    const buf = Buffer.from(compressedOrRaw, "base64");
+    if (buf.length >= 2 && buf[0] === 31 && buf[1] === 139) {
+      return (0, import_node_zlib.gunzipSync)(buf).toString("utf-8");
+    }
+  } catch {
+  }
+  return compressedOrRaw;
+}
+
+// src/data/operations/data-operations-common.ts
+var DATA_ENTITY_SK = "CURRENT";
+var BATCH_GET_MAX_ATTEMPTS = 3;
+var BATCH_GET_BASE_BACKOFF_MS = 50;
+async function batchGetWithRetry(entity, keys) {
+  if (keys.length === 0) return [];
+  const collected = [];
+  let pending = keys;
+  let attempt = 0;
+  while (pending.length > 0) {
+    if (attempt > 0) {
+      await new Promise(
+        (resolve) => setTimeout(resolve, BATCH_GET_BASE_BACKOFF_MS * 2 ** (attempt - 1))
+      );
+    }
+    attempt++;
+    const result = await entity.get(pending).go();
+    collected.push(...result.data);
+    const unprocessed = result.unprocessed ?? [];
+    if (unprocessed.length === 0) break;
+    if (attempt >= BATCH_GET_MAX_ATTEMPTS) {
+      throw new Error(
+        `BatchGet exhausted retries: ${unprocessed.length} key(s) still unprocessed after ${BATCH_GET_MAX_ATTEMPTS} attempt(s)`
+      );
+    }
+    pending = unprocessed;
+  }
+  return collected;
+}
+async function dispatchListMode(mode, shardResults, hooks) {
+  if (mode === "count") {
+    let total = 0;
+    for (const shardResult of shardResults) {
+      total += (shardResult.data ?? []).length;
+    }
+    return { entries: [], total };
+  }
+  if (mode === "summary") {
+    const entries2 = [];
+    for (const shardResult of shardResults) {
+      for (const item of shardResult.data ?? []) {
+        if (typeof item.summary !== "string") continue;
+        let parsed;
+        try {
+          parsed = JSON.parse(item.summary);
+        } catch {
+          continue;
+        }
+        entries2.push(hooks.buildSummaryEntry(item.id, parsed));
+      }
+    }
+    return { entries: entries2, total: entries2.length };
+  }
+  const orderedIds = [];
+  for (const shardResult of shardResults) {
+    for (const item of shardResult.data ?? []) {
+      orderedIds.push(item.id);
+    }
+  }
+  if (orderedIds.length === 0) return { entries: [], total: 0 };
+  const items = await hooks.hydrate(orderedIds);
+  const byId = new Map(items.map((item) => [hooks.getId(item), item]));
+  const entries = [];
+  for (const id of orderedIds) {
+    const item = byId.get(id);
+    if (!item) continue;
+    entries.push(hooks.buildEntry(id, item));
+  }
+  return { entries, total: entries.length };
+}
+async function listDataEntitiesByWorkspace(entity, tenantId, workspaceId, mode = "full") {
+  const shardResults = await Promise.all(
+    Array.from(
+      { length: SHARD_COUNT },
+      (_, shard) => entity.query.gsi1({ tenantId, workspaceId, gsi1Shard: String(shard) }).go()
+    )
+  );
+  return dispatchListMode(
+    mode,
+    shardResults,
+    {
+      hydrate: (orderedIds) => batchGetWithRetry(
+        entity,
+        orderedIds.map((id) => ({
+          tenantId,
+          workspaceId,
+          id,
+          sk: DATA_ENTITY_SK
+        }))
+      ),
+      getId: (item) => item.id,
+      buildEntry: (id, item) => {
+        const parsed = JSON.parse(decompressResource(item.resource));
+        return { id, resource: { ...parsed, id } };
+      },
+      buildSummaryEntry: (id, parsed) => ({
+        id,
+        resource: { ...parsed, id }
+      })
+    }
+  );
+}
+
+// src/data/operations/control/membership/membership-list-operation.ts
+var SK = "CURRENT";
+async function listMembershipsOperation(params) {
+  const { context, tableName, mode = "full" } = params;
+  const tenantId = context.tenantId;
+  const service = getDynamoControlService(tableName);
+  const shardResults = await Promise.all(
+    Array.from(
+      { length: SHARD_COUNT },
+      (_, shard) => service.entities.membership.query.gsi1({ tenantId, gsi1Shard: String(shard) }).go()
+    )
+  );
+  return dispatchListMode(mode, shardResults, {
+    hydrate: (orderedIds) => batchGetWithRetry(
+      service.entities.membership,
+      orderedIds.map((id) => ({ tenantId, id, sk: SK }))
+    ),
+    getId: (item) => item.id,
+    buildEntry: (id, item) => ({
+      id,
+      resource: {
+        resourceType: "Membership",
+        id,
+        ...JSON.parse(item.resource)
+      }
+    }),
+    buildSummaryEntry: (id, parsed) => ({
+      id,
+      resource: { resourceType: "Membership", id, ...parsed }
+    })
+  });
+}
+
+// src/data/operations/control/roleassignment/roleassignment-list-operation.ts
+var SK2 = "CURRENT";
+async function listRoleAssignmentsOperation(params) {
+  const { context, tableName, mode = "full" } = params;
+  const tenantId = context.tenantId;
+  const service = getDynamoControlService(tableName);
+  const shardResults = await Promise.all(
+    Array.from(
+      { length: SHARD_COUNT },
+      (_, shard) => service.entities.roleAssignment.query.gsi1({ tenantId, gsi1Shard: String(shard) }).go()
+    )
+  );
+  return dispatchListMode(mode, shardResults, {
+    hydrate: (orderedIds) => batchGetWithRetry(
+      service.entities.roleAssignment,
+      orderedIds.map((id) => ({ tenantId, id, sk: SK2 }))
+    ),
+    getId: (item) => item.id,
+    buildEntry: (id, item) => ({
+      id,
+      resource: {
+        resourceType: "RoleAssignment",
+        id,
+        ...JSON.parse(item.resource)
+      }
+    }),
+    buildSummaryEntry: (id, parsed) => ({
+      id,
+      resource: { resourceType: "RoleAssignment", id, ...parsed }
+    })
+  });
+}
+
+// src/data/operations/control/user/user-create-operation.ts
+var import_types3 = require("@openhi/types");
+
 // src/data/operations/control/user/user-find-by-sub-operation.ts
 async function findUserBySubOperation(params) {
   const { cognitoSub, tableName } = params;
@@ -888,12 +1107,6 @@ async function findUserBySubOperation(params) {
   };
 }
 
-// src/data/operations/data-operations-common.ts
-var import_types3 = require("@openhi/types");
-
-// src/lib/compression.ts
-var import_node_zlib = require("zlib");
-
 // src/data/operations/control/user/user-update-operation.ts
 var import_types4 = require("@openhi/types");
 
@@ -906,6 +1119,1051 @@ function parseUserResource(resource) {
   }
 }
 
+// src/data/dynamo/dynamo-data-service.ts
+var import_electrodb10 = require("electrodb");
+
+// src/data/dynamo/entities/data-entity-common.ts
+var import_electrodb9 = require("electrodb");
+var dataEntityAttributes = {
+  /** Sort key. "CURRENT" for current version; version history in S3. */
+  sk: {
+    type: "string",
+    required: true,
+    default: "CURRENT"
+  },
+  tenantId: {
+    type: "string",
+    required: true
+  },
+  workspaceId: {
+    type: "string",
+    required: true
+  },
+  /** FHIR Resource.id; logical id in URL and PK. */
+  id: {
+    type: "string",
+    required: true
+  },
+  /** FHIR resource as JSON string. JSON.stringify(resource) on write; JSON.parse(item.resource) on read. */
+  resource: {
+    type: "string",
+    required: true
+  },
+  /**
+   * Summary projection of the FHIR resource as a JSON string (uncompressed). Populated on every
+   * write via `extractSummary(resource)` so GSI projections can surface list/lookup data without
+   * reading the compressed `resource` blob. Kept uncompressed because the summary is small and
+   * must be fast to retrieve without encode/decode overhead.
+   *
+   * @see sites/www-docs/content/architecture/adr/2026-04-17-02-fhir-summary-projection-for-gsi-access-patterns.md
+   */
+  summary: {
+    type: "string",
+    required: true
+  },
+  /** Version id (e.g. ULID). Tracks current version; S3 history key. */
+  vid: {
+    type: "string",
+    required: true
+  },
+  lastUpdated: {
+    type: "string",
+    required: true
+  },
+  /**
+   * Shard index segment for the GSI1 partition key. Computed deterministically from `id`
+   * via `computeShard` so updates always land on the same shard. Stored as a string because
+   * it appears as a literal segment in the GSI1 PK template; the underlying value is 0..3.
+   * Not `required` because the value is derived via `watch`/`set`; ElectroDB's required-field
+   * check runs before watch propagation, so callers must not fail validation on a derived field.
+   *
+   * @see sites/www-docs/content/packages/@openhi/constructs/data/dynamo/single-table-design.md — GSI1 (sharded)
+   */
+  gsi1Shard: {
+    type: "string",
+    watch: ["id"],
+    set: (_val, item) => {
+      if (typeof item?.id !== "string" || item.id.length === 0) {
+        return void 0;
+      }
+      return String(computeShard(item.id));
+    }
+  },
+  /**
+   * GSI1 sort key. Written as the index's SK verbatim so list endpoints can
+   * use `BEGINS_WITH` for prefix queries (e.g. `?name=Sm` against Patient).
+   * Computed at write time via `extractSortKey(resource)` per DR-004:
+   *   - Labeled types (LABEL_PATHS): `<normalizedLabel>#<id>`
+   *   - Unlabeled types: `<ISO-8601 lastUpdated>#<id>`
+   * The factory deliberately does not derive this from `lastUpdated`/`id`
+   * — that would lock every type into the unlabeled fallback and defeat
+   * label-based BEGINS_WITH on labeled types.
+   *
+   * @see openhi-planning DR-004
+   */
+  gsi1sk: {
+    type: "string",
+    required: true
+  },
+  deleted: {
+    type: "boolean",
+    required: false
+  },
+  bundleId: {
+    type: "string",
+    required: false
+  },
+  msgId: {
+    type: "string",
+    required: false
+  }
+};
+function createDataEntity(entity, resourceTypeLabel) {
+  return new import_electrodb9.Entity({
+    model: {
+      entity,
+      service: "data",
+      version: "01"
+    },
+    attributes: dataEntityAttributes,
+    indexes: {
+      /** Base table: PK, SK (data store key names). PK is built from tenantId, workspaceId, id. */
+      record: {
+        pk: {
+          field: "PK",
+          composite: ["tenantId", "workspaceId", "id"],
+          template: `TID#\${tenantId}#WID#\${workspaceId}#RT#${resourceTypeLabel}#ID#\${id}`
+        },
+        sk: {
+          field: "SK",
+          composite: ["sk"]
+        }
+      },
+      /**
+       * GSI1 — Unified Sharded List: list all resources of this type in a workspace; reads fan
+       * out across the four shards and merge by SK. SK is the writer-supplied `gsi1sk` verbatim
+       * (per DR-004) so labeled types serve `BEGINS_WITH` prefix queries on the natural label.
+       * `casing: "none"` is required on the SK because the writer (`extractSortKey`) already
+       * applies DR-004 normalization — ElectroDB's default lowercasing would mangle the
+       * ISO-8601 unlabeled fallback (`T`/`Z` → `t`/`z`).
+       */
+      gsi1: {
+        index: "GSI1",
+        pk: {
+          field: "GSI1PK",
+          composite: ["tenantId", "workspaceId", "gsi1Shard"],
+          template: `TID#\${tenantId}#WID#\${workspaceId}#RT#${resourceTypeLabel}#SHARD#\${gsi1Shard}`
+        },
+        sk: {
+          field: "GSI1SK",
+          casing: "none",
+          composite: ["gsi1sk"],
+          template: `\${gsi1sk}`
+        }
+      }
+    }
+  });
+}
+
+// src/data/dynamo/entities/data/account-entity.ts
+var AccountEntity = createDataEntity("account", "Account");
+
+// src/data/dynamo/entities/data/activity-definition-entity.ts
+var ActivityDefinitionEntity = createDataEntity(
+  "activitydefinition",
+  "ActivityDefinition"
+);
+
+// src/data/dynamo/entities/data/adverse-event-entity.ts
+var AdverseEventEntity = createDataEntity(
+  "adverseevent",
+  "AdverseEvent"
+);
+
+// src/data/dynamo/entities/data/allergy-intolerance-entity.ts
+var AllergyIntoleranceEntity = createDataEntity(
+  "allergyintolerance",
+  "AllergyIntolerance"
+);
+
+// src/data/dynamo/entities/data/appointment-entity.ts
+var AppointmentEntity = createDataEntity("appointment", "Appointment");
+
+// src/data/dynamo/entities/data/appointment-response-entity.ts
+var AppointmentResponseEntity = createDataEntity(
+  "appointmentresponse",
+  "AppointmentResponse"
+);
+
+// src/data/dynamo/entities/data/audit-event-entity.ts
+var AuditEventEntity = createDataEntity("auditevent", "AuditEvent");
+
+// src/data/dynamo/entities/data/basic-entity.ts
+var BasicEntity = createDataEntity("basic", "Basic");
+
+// src/data/dynamo/entities/data/biologically-derived-product-entity.ts
+var BiologicallyDerivedProductEntity = createDataEntity(
+  "biologicallyderivedproduct",
+  "BiologicallyDerivedProduct"
+);
+
+// src/data/dynamo/entities/data/body-structure-entity.ts
+var BodyStructureEntity = createDataEntity(
+  "bodystructure",
+  "BodyStructure"
+);
+
+// src/data/dynamo/entities/data/capability-statement-entity.ts
+var CapabilityStatementEntity = createDataEntity(
+  "capabilitystatement",
+  "CapabilityStatement"
+);
+
+// src/data/dynamo/entities/data/care-plan-entity.ts
+var CarePlanEntity = createDataEntity("careplan", "CarePlan");
+
+// src/data/dynamo/entities/data/care-team-entity.ts
+var CareTeamEntity = createDataEntity("careteam", "CareTeam");
+
+// src/data/dynamo/entities/data/catalog-entry-entity.ts
+var CatalogEntryEntity = createDataEntity(
+  "catalogentry",
+  "CatalogEntry"
+);
+
+// src/data/dynamo/entities/data/charge-item-definition-entity.ts
+var ChargeItemDefinitionEntity = createDataEntity(
+  "chargeitemdefinition",
+  "ChargeItemDefinition"
+);
+
+// src/data/dynamo/entities/data/charge-item-entity.ts
+var ChargeItemEntity = createDataEntity("chargeitem", "ChargeItem");
+
+// src/data/dynamo/entities/data/claim-entity.ts
+var ClaimEntity = createDataEntity("claim", "Claim");
+
+// src/data/dynamo/entities/data/claim-response-entity.ts
+var ClaimResponseEntity = createDataEntity(
+  "claimresponse",
+  "ClaimResponse"
+);
+
+// src/data/dynamo/entities/data/clinical-impression-entity.ts
+var ClinicalImpressionEntity = createDataEntity(
+  "clinicalimpression",
+  "ClinicalImpression"
+);
+
+// src/data/dynamo/entities/data/code-system-entity.ts
+var CodeSystemEntity = createDataEntity("codesystem", "CodeSystem");
+
+// src/data/dynamo/entities/data/communication-entity.ts
+var CommunicationEntity = createDataEntity(
+  "communication",
+  "Communication"
+);
+
+// src/data/dynamo/entities/data/communication-request-entity.ts
+var CommunicationRequestEntity = createDataEntity(
+  "communicationrequest",
+  "CommunicationRequest"
+);
+
+// src/data/dynamo/entities/data/compartment-definition-entity.ts
+var CompartmentDefinitionEntity = createDataEntity(
+  "compartmentdefinition",
+  "CompartmentDefinition"
+);
+
+// src/data/dynamo/entities/data/composition-entity.ts
+var CompositionEntity = createDataEntity("composition", "Composition");
+
+// src/data/dynamo/entities/data/concept-map-entity.ts
+var ConceptMapEntity = createDataEntity("conceptmap", "ConceptMap");
+
+// src/data/dynamo/entities/data/condition-entity.ts
+var ConditionEntity = createDataEntity("condition", "Condition");
+
+// src/data/dynamo/entities/data/consent-entity.ts
+var ConsentEntity = createDataEntity("consent", "Consent");
+
+// src/data/dynamo/entities/data/contract-entity.ts
+var ContractEntity = createDataEntity("contract", "Contract");
+
+// src/data/dynamo/entities/data/coverage-eligibility-request-entity.ts
+var CoverageEligibilityRequestEntity = createDataEntity(
+  "coverageeligibilityrequest",
+  "CoverageEligibilityRequest"
+);
+
+// src/data/dynamo/entities/data/coverage-eligibility-response-entity.ts
+var CoverageEligibilityResponseEntity = createDataEntity(
+  "coverageeligibilityresponse",
+  "CoverageEligibilityResponse"
+);
+
+// src/data/dynamo/entities/data/coverage-entity.ts
+var CoverageEntity = createDataEntity("coverage", "Coverage");
+
+// src/data/dynamo/entities/data/detected-issue-entity.ts
+var DetectedIssueEntity = createDataEntity(
+  "detectedissue",
+  "DetectedIssue"
+);
+
+// src/data/dynamo/entities/data/device-definition-entity.ts
+var DeviceDefinitionEntity = createDataEntity(
+  "devicedefinition",
+  "DeviceDefinition"
+);
+
+// src/data/dynamo/entities/data/device-entity.ts
+var DeviceEntity = createDataEntity("device", "Device");
+
+// src/data/dynamo/entities/data/device-metric-entity.ts
+var DeviceMetricEntity = createDataEntity(
+  "devicemetric",
+  "DeviceMetric"
+);
+
+// src/data/dynamo/entities/data/device-request-entity.ts
+var DeviceRequestEntity = createDataEntity(
+  "devicerequest",
+  "DeviceRequest"
+);
+
+// src/data/dynamo/entities/data/device-use-statement-entity.ts
+var DeviceUseStatementEntity = createDataEntity(
+  "deviceusestatement",
+  "DeviceUseStatement"
+);
+
+// src/data/dynamo/entities/data/diagnostic-report-entity.ts
+var DiagnosticReportEntity = createDataEntity(
+  "diagnosticreport",
+  "DiagnosticReport"
+);
+
+// src/data/dynamo/entities/data/document-manifest-entity.ts
+var DocumentManifestEntity = createDataEntity(
+  "documentmanifest",
+  "DocumentManifest"
+);
+
+// src/data/dynamo/entities/data/document-reference-entity.ts
+var DocumentReferenceEntity = createDataEntity(
+  "documentreference",
+  "DocumentReference"
+);
+
+// src/data/dynamo/entities/data/effect-evidence-synthesis-entity.ts
+var EffectEvidenceSynthesisEntity = createDataEntity(
+  "effectevidencesynthesis",
+  "EffectEvidenceSynthesis"
+);
+
+// src/data/dynamo/entities/data/encounter-entity.ts
+var EncounterEntity = createDataEntity("encounter", "Encounter");
+
+// src/data/dynamo/entities/data/endpoint-entity.ts
+var EndpointEntity = createDataEntity("endpoint", "Endpoint");
+
+// src/data/dynamo/entities/data/enrollment-request-entity.ts
+var EnrollmentRequestEntity = createDataEntity(
+  "enrollmentrequest",
+  "EnrollmentRequest"
+);
+
+// src/data/dynamo/entities/data/enrollment-response-entity.ts
+var EnrollmentResponseEntity = createDataEntity(
+  "enrollmentresponse",
+  "EnrollmentResponse"
+);
+
+// src/data/dynamo/entities/data/episode-of-care-entity.ts
+var EpisodeOfCareEntity = createDataEntity(
+  "episodeofcare",
+  "EpisodeOfCare"
+);
+
+// src/data/dynamo/entities/data/event-definition-entity.ts
+var EventDefinitionEntity = createDataEntity(
+  "eventdefinition",
+  "EventDefinition"
+);
+
+// src/data/dynamo/entities/data/evidence-entity.ts
+var EvidenceEntity = createDataEntity("evidence", "Evidence");
+
+// src/data/dynamo/entities/data/evidence-variable-entity.ts
+var EvidenceVariableEntity = createDataEntity(
+  "evidencevariable",
+  "EvidenceVariable"
+);
+
+// src/data/dynamo/entities/data/example-scenario-entity.ts
+var ExampleScenarioEntity = createDataEntity(
+  "examplescenario",
+  "ExampleScenario"
+);
+
+// src/data/dynamo/entities/data/explanation-of-benefit-entity.ts
+var ExplanationOfBenefitEntity = createDataEntity(
+  "explanationofbenefit",
+  "ExplanationOfBenefit"
+);
+
+// src/data/dynamo/entities/data/family-member-history-entity.ts
+var FamilyMemberHistoryEntity = createDataEntity(
+  "familymemberhistory",
+  "FamilyMemberHistory"
+);
+
+// src/data/dynamo/entities/data/flag-entity.ts
+var FlagEntity = createDataEntity("flag", "Flag");
+
+// src/data/dynamo/entities/data/goal-entity.ts
+var GoalEntity = createDataEntity("goal", "Goal");
+
+// src/data/dynamo/entities/data/graph-definition-entity.ts
+var GraphDefinitionEntity = createDataEntity(
+  "graphdefinition",
+  "GraphDefinition"
+);
+
+// src/data/dynamo/entities/data/group-entity.ts
+var GroupEntity = createDataEntity("group", "Group");
+
+// src/data/dynamo/entities/data/guidance-response-entity.ts
+var GuidanceResponseEntity = createDataEntity(
+  "guidanceresponse",
+  "GuidanceResponse"
+);
+
+// src/data/dynamo/entities/data/healthcare-service-entity.ts
+var HealthcareServiceEntity = createDataEntity(
+  "healthcareservice",
+  "HealthcareService"
+);
+
+// src/data/dynamo/entities/data/imaging-study-entity.ts
+var ImagingStudyEntity = createDataEntity(
+  "imagingstudy",
+  "ImagingStudy"
+);
+
+// src/data/dynamo/entities/data/immunization-entity.ts
+var ImmunizationEntity = createDataEntity(
+  "immunization",
+  "Immunization"
+);
+
+// src/data/dynamo/entities/data/immunization-evaluation-entity.ts
+var ImmunizationEvaluationEntity = createDataEntity(
+  "immunizationevaluation",
+  "ImmunizationEvaluation"
+);
+
+// src/data/dynamo/entities/data/immunization-recommendation-entity.ts
+var ImmunizationRecommendationEntity = createDataEntity(
+  "immunizationrecommendation",
+  "ImmunizationRecommendation"
+);
+
+// src/data/dynamo/entities/data/implementation-guide-entity.ts
+var ImplementationGuideEntity = createDataEntity(
+  "implementationguide",
+  "ImplementationGuide"
+);
+
+// src/data/dynamo/entities/data/insurance-plan-entity.ts
+var InsurancePlanEntity = createDataEntity(
+  "insuranceplan",
+  "InsurancePlan"
+);
+
+// src/data/dynamo/entities/data/invoice-entity.ts
+var InvoiceEntity = createDataEntity("invoice", "Invoice");
+
+// src/data/dynamo/entities/data/library-entity.ts
+var LibraryEntity = createDataEntity("library", "Library");
+
+// src/data/dynamo/entities/data/linkage-entity.ts
+var LinkageEntity = createDataEntity("linkage", "Linkage");
+
+// src/data/dynamo/entities/data/list-entity.ts
+var ListEntity = createDataEntity("list", "List");
+
+// src/data/dynamo/entities/data/location-entity.ts
+var LocationEntity = createDataEntity("location", "Location");
+
+// src/data/dynamo/entities/data/measure-entity.ts
+var MeasureEntity = createDataEntity("measure", "Measure");
+
+// src/data/dynamo/entities/data/measure-report-entity.ts
+var MeasureReportEntity = createDataEntity(
+  "measurereport",
+  "MeasureReport"
+);
+
+// src/data/dynamo/entities/data/media-entity.ts
+var MediaEntity = createDataEntity("media", "Media");
+
+// src/data/dynamo/entities/data/medication-administration-entity.ts
+var MedicationAdministrationEntity = createDataEntity(
+  "medicationadministration",
+  "MedicationAdministration"
+);
+
+// src/data/dynamo/entities/data/medication-dispense-entity.ts
+var MedicationDispenseEntity = createDataEntity(
+  "medicationdispense",
+  "MedicationDispense"
+);
+
+// src/data/dynamo/entities/data/medication-entity.ts
+var MedicationEntity = createDataEntity("medication", "Medication");
+
+// src/data/dynamo/entities/data/medication-knowledge-entity.ts
+var MedicationKnowledgeEntity = createDataEntity(
+  "medicationknowledge",
+  "MedicationKnowledge"
+);
+
+// src/data/dynamo/entities/data/medication-request-entity.ts
+var MedicationRequestEntity = createDataEntity(
+  "medicationrequest",
+  "MedicationRequest"
+);
+
+// src/data/dynamo/entities/data/medication-statement-entity.ts
+var MedicationStatementEntity = createDataEntity(
+  "medicationstatement",
+  "MedicationStatement"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-authorization-entity.ts
+var MedicinalProductAuthorizationEntity = createDataEntity(
+  "medicinalproductauthorization",
+  "MedicinalProductAuthorization"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-contraindication-entity.ts
+var MedicinalProductContraindicationEntity = createDataEntity(
+  "medicinalproductcontraindication",
+  "MedicinalProductContraindication"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-entity.ts
+var MedicinalProductEntity = createDataEntity(
+  "medicinalproduct",
+  "MedicinalProduct"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-indication-entity.ts
+var MedicinalProductIndicationEntity = createDataEntity(
+  "medicinalproductindication",
+  "MedicinalProductIndication"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-ingredient-entity.ts
+var MedicinalProductIngredientEntity = createDataEntity(
+  "medicinalproductingredient",
+  "MedicinalProductIngredient"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-interaction-entity.ts
+var MedicinalProductInteractionEntity = createDataEntity(
+  "medicinalproductinteraction",
+  "MedicinalProductInteraction"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-manufactured-entity.ts
+var MedicinalProductManufacturedEntity = createDataEntity(
+  "medicinalproductmanufactured",
+  "MedicinalProductManufactured"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-packaged-entity.ts
+var MedicinalProductPackagedEntity = createDataEntity(
+  "medicinalproductpackaged",
+  "MedicinalProductPackaged"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-pharmaceutical-entity.ts
+var MedicinalProductPharmaceuticalEntity = createDataEntity(
+  "medicinalproductpharmaceutical",
+  "MedicinalProductPharmaceutical"
+);
+
+// src/data/dynamo/entities/data/medicinal-product-undesirable-effect-entity.ts
+var MedicinalProductUndesirableEffectEntity = createDataEntity(
+  "medicinalproductundesirableeffect",
+  "MedicinalProductUndesirableEffect"
+);
+
+// src/data/dynamo/entities/data/message-definition-entity.ts
+var MessageDefinitionEntity = createDataEntity(
+  "messagedefinition",
+  "MessageDefinition"
+);
+
+// src/data/dynamo/entities/data/message-header-entity.ts
+var MessageHeaderEntity = createDataEntity(
+  "messageheader",
+  "MessageHeader"
+);
+
+// src/data/dynamo/entities/data/molecular-sequence-entity.ts
+var MolecularSequenceEntity = createDataEntity(
+  "molecularsequence",
+  "MolecularSequence"
+);
+
+// src/data/dynamo/entities/data/naming-system-entity.ts
+var NamingSystemEntity = createDataEntity(
+  "namingsystem",
+  "NamingSystem"
+);
+
+// src/data/dynamo/entities/data/nutrition-order-entity.ts
+var NutritionOrderEntity = createDataEntity(
+  "nutritionorder",
+  "NutritionOrder"
+);
+
+// src/data/dynamo/entities/data/observation-definition-entity.ts
+var ObservationDefinitionEntity = createDataEntity(
+  "observationdefinition",
+  "ObservationDefinition"
+);
+
+// src/data/dynamo/entities/data/observation-entity.ts
+var ObservationEntity = createDataEntity("observation", "Observation");
+
+// src/data/dynamo/entities/data/operation-definition-entity.ts
+var OperationDefinitionEntity = createDataEntity(
+  "operationdefinition",
+  "OperationDefinition"
+);
+
+// src/data/dynamo/entities/data/organization-affiliation-entity.ts
+var OrganizationAffiliationEntity = createDataEntity(
+  "organizationaffiliation",
+  "OrganizationAffiliation"
+);
+
+// src/data/dynamo/entities/data/organization-entity.ts
+var OrganizationEntity = createDataEntity(
+  "organization",
+  "Organization"
+);
+
+// src/data/dynamo/entities/data/patient-entity.ts
+var PatientEntity = createDataEntity("patient", "Patient");
+
+// src/data/dynamo/entities/data/payment-notice-entity.ts
+var PaymentNoticeEntity = createDataEntity(
+  "paymentnotice",
+  "PaymentNotice"
+);
+
+// src/data/dynamo/entities/data/payment-reconciliation-entity.ts
+var PaymentReconciliationEntity = createDataEntity(
+  "paymentreconciliation",
+  "PaymentReconciliation"
+);
+
+// src/data/dynamo/entities/data/person-entity.ts
+var PersonEntity = createDataEntity("person", "Person");
+
+// src/data/dynamo/entities/data/plan-definition-entity.ts
+var PlanDefinitionEntity = createDataEntity(
+  "plandefinition",
+  "PlanDefinition"
+);
+
+// src/data/dynamo/entities/data/practitioner-entity.ts
+var PractitionerEntity = createDataEntity(
+  "practitioner",
+  "Practitioner"
+);
+
+// src/data/dynamo/entities/data/practitioner-role-entity.ts
+var PractitionerRoleEntity = createDataEntity(
+  "practitionerrole",
+  "PractitionerRole"
+);
+
+// src/data/dynamo/entities/data/procedure-entity.ts
+var ProcedureEntity = createDataEntity("procedure", "Procedure");
+
+// src/data/dynamo/entities/data/provenance-entity.ts
+var ProvenanceEntity = createDataEntity("provenance", "Provenance");
+
+// src/data/dynamo/entities/data/questionnaire-entity.ts
+var QuestionnaireEntity = createDataEntity(
+  "questionnaire",
+  "Questionnaire"
+);
+
+// src/data/dynamo/entities/data/questionnaire-response-entity.ts
+var QuestionnaireResponseEntity = createDataEntity(
+  "questionnaireresponse",
+  "QuestionnaireResponse"
+);
+
+// src/data/dynamo/entities/data/related-person-entity.ts
+var RelatedPersonEntity = createDataEntity(
+  "relatedperson",
+  "RelatedPerson"
+);
+
+// src/data/dynamo/entities/data/request-group-entity.ts
+var RequestGroupEntity = createDataEntity(
+  "requestgroup",
+  "RequestGroup"
+);
+
+// src/data/dynamo/entities/data/research-definition-entity.ts
+var ResearchDefinitionEntity = createDataEntity(
+  "researchdefinition",
+  "ResearchDefinition"
+);
+
+// src/data/dynamo/entities/data/research-element-definition-entity.ts
+var ResearchElementDefinitionEntity = createDataEntity(
+  "researchelementdefinition",
+  "ResearchElementDefinition"
+);
+
+// src/data/dynamo/entities/data/research-study-entity.ts
+var ResearchStudyEntity = createDataEntity(
+  "researchstudy",
+  "ResearchStudy"
+);
+
+// src/data/dynamo/entities/data/research-subject-entity.ts
+var ResearchSubjectEntity = createDataEntity(
+  "researchsubject",
+  "ResearchSubject"
+);
+
+// src/data/dynamo/entities/data/risk-assessment-entity.ts
+var RiskAssessmentEntity = createDataEntity(
+  "riskassessment",
+  "RiskAssessment"
+);
+
+// src/data/dynamo/entities/data/risk-evidence-synthesis-entity.ts
+var RiskEvidenceSynthesisEntity = createDataEntity(
+  "riskevidencesynthesis",
+  "RiskEvidenceSynthesis"
+);
+
+// src/data/dynamo/entities/data/schedule-entity.ts
+var ScheduleEntity = createDataEntity("schedule", "Schedule");
+
+// src/data/dynamo/entities/data/search-parameter-entity.ts
+var SearchParameterEntity = createDataEntity(
+  "searchparameter",
+  "SearchParameter"
+);
+
+// src/data/dynamo/entities/data/service-request-entity.ts
+var ServiceRequestEntity = createDataEntity(
+  "servicerequest",
+  "ServiceRequest"
+);
+
+// src/data/dynamo/entities/data/slot-entity.ts
+var SlotEntity = createDataEntity("slot", "Slot");
+
+// src/data/dynamo/entities/data/specimen-definition-entity.ts
+var SpecimenDefinitionEntity = createDataEntity(
+  "specimendefinition",
+  "SpecimenDefinition"
+);
+
+// src/data/dynamo/entities/data/specimen-entity.ts
+var SpecimenEntity = createDataEntity("specimen", "Specimen");
+
+// src/data/dynamo/entities/data/structure-definition-entity.ts
+var StructureDefinitionEntity = createDataEntity(
+  "structuredefinition",
+  "StructureDefinition"
+);
+
+// src/data/dynamo/entities/data/structure-map-entity.ts
+var StructureMapEntity = createDataEntity(
+  "structuremap",
+  "StructureMap"
+);
+
+// src/data/dynamo/entities/data/subscription-entity.ts
+var SubscriptionEntity = createDataEntity(
+  "subscription",
+  "Subscription"
+);
+
+// src/data/dynamo/entities/data/substance-entity.ts
+var SubstanceEntity = createDataEntity("substance", "Substance");
+
+// src/data/dynamo/entities/data/substance-nucleic-acid-entity.ts
+var SubstanceNucleicAcidEntity = createDataEntity(
+  "substancenucleicacid",
+  "SubstanceNucleicAcid"
+);
+
+// src/data/dynamo/entities/data/substance-polymer-entity.ts
+var SubstancePolymerEntity = createDataEntity(
+  "substancepolymer",
+  "SubstancePolymer"
+);
+
+// src/data/dynamo/entities/data/substance-protein-entity.ts
+var SubstanceProteinEntity = createDataEntity(
+  "substanceprotein",
+  "SubstanceProtein"
+);
+
+// src/data/dynamo/entities/data/substance-reference-information-entity.ts
+var SubstanceReferenceInformationEntity = createDataEntity(
+  "substancereferenceinformation",
+  "SubstanceReferenceInformation"
+);
+
+// src/data/dynamo/entities/data/substance-source-material-entity.ts
+var SubstanceSourceMaterialEntity = createDataEntity(
+  "substancesourcematerial",
+  "SubstanceSourceMaterial"
+);
+
+// src/data/dynamo/entities/data/substance-specification-entity.ts
+var SubstanceSpecificationEntity = createDataEntity(
+  "substancespecification",
+  "SubstanceSpecification"
+);
+
+// src/data/dynamo/entities/data/supply-delivery-entity.ts
+var SupplyDeliveryEntity = createDataEntity(
+  "supplydelivery",
+  "SupplyDelivery"
+);
+
+// src/data/dynamo/entities/data/supply-request-entity.ts
+var SupplyRequestEntity = createDataEntity(
+  "supplyrequest",
+  "SupplyRequest"
+);
+
+// src/data/dynamo/entities/data/task-entity.ts
+var TaskEntity = createDataEntity("task", "Task");
+
+// src/data/dynamo/entities/data/terminology-capabilities-entity.ts
+var TerminologyCapabilitiesEntity = createDataEntity(
+  "terminologycapabilities",
+  "TerminologyCapabilities"
+);
+
+// src/data/dynamo/entities/data/test-report-entity.ts
+var TestReportEntity = createDataEntity("testreport", "TestReport");
+
+// src/data/dynamo/entities/data/test-script-entity.ts
+var TestScriptEntity = createDataEntity("testscript", "TestScript");
+
+// src/data/dynamo/entities/data/value-set-entity.ts
+var ValueSetEntity = createDataEntity("valueset", "ValueSet");
+
+// src/data/dynamo/entities/data/verification-result-entity.ts
+var VerificationResultEntity = createDataEntity(
+  "verificationresult",
+  "VerificationResult"
+);
+
+// src/data/dynamo/entities/data/vision-prescription-entity.ts
+var VisionPrescriptionEntity = createDataEntity(
+  "visionprescription",
+  "VisionPrescription"
+);
+
+// src/data/dynamo/dynamo-data-service.ts
+var dataPlaneEntities = {
+  account: AccountEntity,
+  activitydefinition: ActivityDefinitionEntity,
+  adverseevent: AdverseEventEntity,
+  allergyintolerance: AllergyIntoleranceEntity,
+  appointment: AppointmentEntity,
+  appointmentresponse: AppointmentResponseEntity,
+  auditevent: AuditEventEntity,
+  basic: BasicEntity,
+  biologicallyderivedproduct: BiologicallyDerivedProductEntity,
+  bodystructure: BodyStructureEntity,
+  capabilitystatement: CapabilityStatementEntity,
+  careplan: CarePlanEntity,
+  careteam: CareTeamEntity,
+  catalogentry: CatalogEntryEntity,
+  codesystem: CodeSystemEntity,
+  chargeitem: ChargeItemEntity,
+  chargeitemdefinition: ChargeItemDefinitionEntity,
+  claim: ClaimEntity,
+  claimresponse: ClaimResponseEntity,
+  clinicalimpression: ClinicalImpressionEntity,
+  communication: CommunicationEntity,
+  communicationrequest: CommunicationRequestEntity,
+  compartmentdefinition: CompartmentDefinitionEntity,
+  composition: CompositionEntity,
+  conceptmap: ConceptMapEntity,
+  condition: ConditionEntity,
+  consent: ConsentEntity,
+  contract: ContractEntity,
+  coverage: CoverageEntity,
+  coverageeligibilityrequest: CoverageEligibilityRequestEntity,
+  coverageeligibilityresponse: CoverageEligibilityResponseEntity,
+  detectedissue: DetectedIssueEntity,
+  device: DeviceEntity,
+  devicedefinition: DeviceDefinitionEntity,
+  devicemetric: DeviceMetricEntity,
+  devicerequest: DeviceRequestEntity,
+  deviceusestatement: DeviceUseStatementEntity,
+  diagnosticreport: DiagnosticReportEntity,
+  documentmanifest: DocumentManifestEntity,
+  documentreference: DocumentReferenceEntity,
+  effectevidencesynthesis: EffectEvidenceSynthesisEntity,
+  encounter: EncounterEntity,
+  examplescenario: ExampleScenarioEntity,
+  endpoint: EndpointEntity,
+  enrollmentrequest: EnrollmentRequestEntity,
+  enrollmentresponse: EnrollmentResponseEntity,
+  episodeofcare: EpisodeOfCareEntity,
+  eventdefinition: EventDefinitionEntity,
+  evidence: EvidenceEntity,
+  evidencevariable: EvidenceVariableEntity,
+  explanationofbenefit: ExplanationOfBenefitEntity,
+  familymemberhistory: FamilyMemberHistoryEntity,
+  flag: FlagEntity,
+  goal: GoalEntity,
+  graphdefinition: GraphDefinitionEntity,
+  group: GroupEntity,
+  guidanceresponse: GuidanceResponseEntity,
+  healthcareservice: HealthcareServiceEntity,
+  immunization: ImmunizationEntity,
+  immunizationevaluation: ImmunizationEvaluationEntity,
+  immunizationrecommendation: ImmunizationRecommendationEntity,
+  imagingstudy: ImagingStudyEntity,
+  implementationguide: ImplementationGuideEntity,
+  insuranceplan: InsurancePlanEntity,
+  invoice: InvoiceEntity,
+  library: LibraryEntity,
+  linkage: LinkageEntity,
+  list: ListEntity,
+  location: LocationEntity,
+  medication: MedicationEntity,
+  medicationadministration: MedicationAdministrationEntity,
+  medicationdispense: MedicationDispenseEntity,
+  medicationknowledge: MedicationKnowledgeEntity,
+  medicationrequest: MedicationRequestEntity,
+  medicationstatement: MedicationStatementEntity,
+  medicinalproduct: MedicinalProductEntity,
+  medicinalproductauthorization: MedicinalProductAuthorizationEntity,
+  medicinalproductcontraindication: MedicinalProductContraindicationEntity,
+  medicinalproductingredient: MedicinalProductIngredientEntity,
+  medicinalproductindication: MedicinalProductIndicationEntity,
+  medicinalproductinteraction: MedicinalProductInteractionEntity,
+  medicinalproductmanufactured: MedicinalProductManufacturedEntity,
+  medicinalproductpackaged: MedicinalProductPackagedEntity,
+  medicinalproductpharmaceutical: MedicinalProductPharmaceuticalEntity,
+  medicinalproductundesirableeffect: MedicinalProductUndesirableEffectEntity,
+  media: MediaEntity,
+  measure: MeasureEntity,
+  measurereport: MeasureReportEntity,
+  messagedefinition: MessageDefinitionEntity,
+  messageheader: MessageHeaderEntity,
+  molecularsequence: MolecularSequenceEntity,
+  namingsystem: NamingSystemEntity,
+  nutritionorder: NutritionOrderEntity,
+  observation: ObservationEntity,
+  observationdefinition: ObservationDefinitionEntity,
+  operationdefinition: OperationDefinitionEntity,
+  organization: OrganizationEntity,
+  organizationaffiliation: OrganizationAffiliationEntity,
+  patient: PatientEntity,
+  paymentnotice: PaymentNoticeEntity,
+  paymentreconciliation: PaymentReconciliationEntity,
+  person: PersonEntity,
+  plandefinition: PlanDefinitionEntity,
+  practitioner: PractitionerEntity,
+  practitionerrole: PractitionerRoleEntity,
+  procedure: ProcedureEntity,
+  provenance: ProvenanceEntity,
+  questionnaire: QuestionnaireEntity,
+  questionnaireresponse: QuestionnaireResponseEntity,
+  requestgroup: RequestGroupEntity,
+  relatedperson: RelatedPersonEntity,
+  researchdefinition: ResearchDefinitionEntity,
+  researchelementdefinition: ResearchElementDefinitionEntity,
+  researchstudy: ResearchStudyEntity,
+  researchsubject: ResearchSubjectEntity,
+  riskassessment: RiskAssessmentEntity,
+  riskevidencesynthesis: RiskEvidenceSynthesisEntity,
+  schedule: ScheduleEntity,
+  searchparameter: SearchParameterEntity,
+  servicerequest: ServiceRequestEntity,
+  specimen: SpecimenEntity,
+  specimendefinition: SpecimenDefinitionEntity,
+  structuredefinition: StructureDefinitionEntity,
+  structuremap: StructureMapEntity,
+  substance: SubstanceEntity,
+  substancenucleicacid: SubstanceNucleicAcidEntity,
+  substancepolymer: SubstancePolymerEntity,
+  substanceprotein: SubstanceProteinEntity,
+  substancereferenceinformation: SubstanceReferenceInformationEntity,
+  substancespecification: SubstanceSpecificationEntity,
+  substancesourcematerial: SubstanceSourceMaterialEntity,
+  subscription: SubscriptionEntity,
+  terminologycapabilities: TerminologyCapabilitiesEntity,
+  testreport: TestReportEntity,
+  testscript: TestScriptEntity,
+  valueset: ValueSetEntity,
+  supplydelivery: SupplyDeliveryEntity,
+  supplyrequest: SupplyRequestEntity,
+  slot: SlotEntity,
+  task: TaskEntity,
+  visionprescription: VisionPrescriptionEntity,
+  verificationresult: VerificationResultEntity
+};
+var dataPlaneService = new import_electrodb10.Service(dataPlaneEntities, {
+  table: defaultTableName,
+  client: dynamoClient
+});
+var DynamoDataService = {
+  entities: dataPlaneService.entities
+};
+function getDynamoDataService(tableName) {
+  const resolved = tableName ?? defaultTableName;
+  const service = new import_electrodb10.Service(dataPlaneEntities, {
+    table: resolved,
+    client: dynamoClient
+  });
+  return {
+    entities: service.entities
+  };
+}
+
+// src/data/operations/data/practitionerrole/practitionerrole-list-operation.ts
+async function listPractitionerRolesOperation(params) {
+  const { context, tableName, mode } = params;
+  const { tenantId, workspaceId } = context;
+  const service = getDynamoDataService(tableName);
+  return listDataEntitiesByWorkspace(
+    service.entities.practitionerrole,
+    tenantId,
+    workspaceId,
+    mode
+  );
+}
+
 // src/data/operations/fhir-reference.ts
 function idFromReference(reference, prefix) {
   if (!reference || !reference.startsWith(prefix)) {
@@ -966,12 +2224,100 @@ async function resolveClaims(cognitoSub) {
     );
     return void 0;
   }
+  const [ohi_organization_roles, ohi_platform_roles] = await Promise.all([
+    resolveOrganizationRoles(tenantId, workspaceId, user.id),
+    resolvePlatformRoles(tenantId, workspaceId, user.id)
+  ]);
   return {
     ohi_tid: tenantId,
     ohi_wid: workspaceId,
     ohi_uid: user.id,
-    ohi_uname: displayName
+    ohi_uname: displayName,
+    ...ohi_organization_roles !== void 0 ? { ohi_organization_roles } : {},
+    ...ohi_platform_roles !== void 0 ? { ohi_platform_roles } : {}
+  };
+}
+async function resolveOrganizationRoles(tenantId, workspaceId, userId) {
+  const claimContext = {
+    ...lookupContext,
+    tenantId,
+    workspaceId
+  };
+  const memberships = await listMembershipsOperation({
+    context: claimContext,
+    mode: "full"
+  });
+  const userRef = `User/${userId}`;
+  const workspaceRef = `Workspace/${workspaceId}`;
+  const matching = memberships.entries.find((entry) => {
+    const r = entry.resource;
+    return r.user?.reference === userRef && r.workspace?.reference === workspaceRef;
+  });
+  if (matching === void 0) {
+    return void 0;
+  }
+  const linked = (0, import_types5.getLinkedDataIdentity)(
+    matching.resource
+  );
+  if (linked?.reference === void 0) {
+    return void 0;
+  }
+  const practitionerRoleList = await listPractitionerRolesOperation({
+    context: claimContext,
+    mode: "full"
+  });
+  const organizationRef = `Organization/${workspaceId}`;
+  const codes = /* @__PURE__ */ new Set();
+  for (const entry of practitionerRoleList.entries) {
+    const role = entry.resource;
+    if (role.practitioner?.reference !== linked.reference) continue;
+    if (role.organization?.reference !== organizationRef) continue;
+    const codings = role.code?.flatMap((cc) => cc.coding ?? []) ?? [];
+    for (const c of codings) {
+      if (typeof c.code !== "string") continue;
+      const parsed = import_types5.organizationRoleCodeSchema.safeParse(c.code);
+      if (parsed.success) {
+        codes.add(parsed.data);
+      }
+    }
+  }
+  return Array.from(codes);
+}
+async function resolvePlatformRoles(tenantId, workspaceId, userId) {
+  const claimContext = {
+    ...lookupContext,
+    tenantId,
+    workspaceId
   };
+  const assignments = await listRoleAssignmentsOperation({
+    context: claimContext,
+    mode: "full"
+  });
+  const userRef = `User/${userId}`;
+  const workspaceRef = `Workspace/${workspaceId}`;
+  const userAssignments = assignments.entries.filter((entry) => {
+    const r = entry.resource;
+    if (r.user?.reference !== userRef) return false;
+    const wsRef = r.workspace?.reference;
+    return wsRef === void 0 || wsRef === workspaceRef;
+  });
+  if (userAssignments.length === 0) {
+    return void 0;
+  }
+  const codes = /* @__PURE__ */ new Set();
+  for (const entry of userAssignments) {
+    const r = entry.resource;
+    const ref = r.role?.reference;
+    if (typeof ref !== "string") continue;
+    const roleId = idFromReference(ref, "Role/");
+    if (roleId === void 0) continue;
+    const candidate = roleId.startsWith("role-") ? roleId.slice("role-".length) : roleId;
+    const parsed = import_types5.platformRoleCodeSchema.safeParse(candidate);
+    if (parsed.success) {
+      codes.add(parsed.data);
+    }
+  }
+  return Array.from(codes);
 }
 var handler = async (event, _context) => {
   try {