@openhi/constructs 0.0.111 → 0.0.113

package/lib/seed-system-data.handler.mjs

@@ -3,14 +3,15 @@ import {
   SEED_SYSTEM_DATA_CONSUMER_NAME,
   SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR,
   import_workflows
-} from "./chunk-AGF3RAAZ.mjs";
+} from "./chunk-WPCBVDFZ.mjs";
 import {
   createRoleOperation
-} from "./chunk-AJ3G3THO.mjs";
+} from "./chunk-KO64HPWQ.mjs";
 import {
   require_lib
-} from "./chunk-SYBADQXI.mjs";
-import "./chunk-QR5JVSCF.mjs";
+} from "./chunk-ZM4GDHHC.mjs";
+import "./chunk-6NBGYGFL.mjs";
+import "./chunk-TRY7JGWO.mjs";
 import {
   __toESM
 } from "./chunk-LZOMFHX3.mjs";

package/lib/seed-system-data.handler.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/workflows/control-plane/seed-system-data/seed-system-data.handler.ts"],"sourcesContent":["import { DynamoDBClient } from \"@aws-sdk/client-dynamodb\";\nimport { EventBridgeClient } from \"@aws-sdk/client-eventbridge\";\nimport {\n  PLATFORM_ROLE_CONCEPTS,\n  PLATFORM_ROLE_IDS,\n  type PlatformRoleCode,\n} from \"@openhi/types\";\nimport {\n  OPENHI_CONTROL_SOURCE,\n  parseWorkflowEvent,\n  publishWorkflowEvent,\n  workflowDedupClient,\n  type PlatformDeploymentCompletedV1Detail,\n  type PublishResult,\n  type WorkflowDedupClient,\n} from \"@openhi/workflows\";\nimport type { EventBridgeEvent } from \"aws-lambda\";\nimport {\n  PlatformDeploymentCompletedV1,\n  PlatformSystemDataSeededV1,\n  SEED_SYSTEM_DATA_ACTOR_SYSTEM,\n  SEED_SYSTEM_DATA_CONSUMER_NAME,\n  SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR,\n} from \"./events\";\nimport type { OpenHiContext } from \"../../../data/openhi-context\";\nimport { createRoleOperation } from \"../../../data/operations/control/role/role-create-operation\";\n\n/**\n * @see sites/www-docs/content/packages/@openhi/constructs/workflows/control-plane/seed-system-data/seed-system-data-handler.md\n *\n * EventBridge workflow handler invoked once per platform-deploy event on\n * the control event bus. Idempotently re-asserts the platform-singleton\n * control-plane records (today: the three canonical Roles; future:\n * additional system data slotted in as sibling steps under the same\n * dedup record).\n */\n\ntype SeedSystemDataEvent = EventBridgeEvent<\n  \"platform.deployment-completed.v1\",\n  unknown\n>;\n\n/**\n * Input shape the handler passes to the completion publisher. Mirrors\n * the wire shape of `PlatformSystemDataSeededV1Detail` plus the\n * envelope-correlation fields the publisher needs to chain the new\n * event onto the originating deploy event.\n */\nexport interface PublishSeededInput {\n  /** Per-workflow payload — re-asserted record count + source event/stack ids. */\n  readonly payload: {\n    readonly sourceEventId: string;\n    readonly sourceStackId: string;\n    readonly seededRecordCount: number;\n  };\n  /**\n   * Envelope context propagated from the originating\n   * `platform.deployment-completed.v1` event so the chain is\n   * observable in logs.\n   */\n  readonly envelope: {\n    readonly correlationId: string;\n    readonly causationId: string;\n  };\n}\n\n/**\n * Dependency seam for tests. The factory mirrors the production\n * arrangement: a real DynamoDB client + the real `workflowDedupClient`\n * factory bound to the `OPENHI_WORKFLOW_DEDUP_TABLE_NAME` env var the\n * construct injects via `grantConsumer`.\n */\nexport interface SeedSystemDataDependencies {\n  readonly dedupClient: WorkflowDedupClient;\n  readonly seedRoles: (context: OpenHiContext) => Promise<void>;\n  /**\n   * Publishes the `platform.system-data-seeded.v1` completion event\n   * onto the control event bus. Called after a successful seed and\n   * before the handler returns — downstream consumers\n   * (`seed-demo-data`) subscribe to this event instead of the raw\n   * deploy-completion event so the dependency on system data is\n   * enforced by a happens-before edge.\n   */\n  readonly publishSeeded: (input: PublishSeededInput) => Promise<PublishResult>;\n}\n\nconst errorMessage = (err: unknown): string => {\n  if (err instanceof Error) {\n    return err.message;\n  }\n  return String(err);\n};\n\n/**\n * Lookup the stable record id for a given role code by walking the two\n * parallel generator-emitted constants. The `_IDS` / `_CONCEPTS` consts\n * are keyed by the same SCREAMING_SNAKE keys (the generator builds them\n * in lockstep), so a single key resolves both projections.\n */\nconst idForRoleCode = (code: PlatformRoleCode): string => {\n  for (const key of Object.keys(PLATFORM_ROLE_IDS) as Array<\n    keyof typeof PLATFORM_ROLE_IDS\n  >) {\n    if (PLATFORM_ROLE_CONCEPTS[key].code === code) {\n      return PLATFORM_ROLE_IDS[key];\n    }\n  }\n  // Unreachable while `_IDS` and `_CONCEPTS` are emitted from the same\n  // CodeSystem: every code in `_CONCEPTS` has a matching id in `_IDS`.\n  throw new Error(`No id mapping for role code \"${code}\".`);\n};\n\n/**\n * Re-assert the three canonical control-plane Role records. Stable ids\n * from `PLATFORM_ROLE_IDS` make re-runs after dedup-TTL expiry\n * idempotent: every put with the same id+sk lands on the same primary\n * key and produces the same end state.\n */\nconst seedSystemRoles = async (context: OpenHiContext): Promise<void> => {\n  for (const concept of Object.values(PLATFORM_ROLE_CONCEPTS)) {\n    const id = idForRoleCode(concept.code);\n    await createRoleOperation({\n      context,\n      body: {\n        id,\n        resource: {\n          resourceType: \"Role\",\n          code: concept.code,\n          display: concept.display,\n          active: true,\n        },\n      },\n    });\n  }\n};\n\n/**\n * Test-visible orchestrator. The production `handler` calls this with\n * real dependencies; unit tests inject fakes.\n */\nexport const runSeedSystemData = async (\n  event: SeedSystemDataEvent,\n  deps: SeedSystemDataDependencies,\n): Promise<void> => {\n  const parsed = parseWorkflowEvent(event, PlatformDeploymentCompletedV1);\n\n  // Dedup is the single circuit-breaker between EventBridge's\n  // at-least-once redelivery and the DynamoDB writes below. If\n  // `recordIfAbsent` returns `recorded: false`, a prior invocation of\n  // this (eventId, attempt) tuple already ran to completion — there is\n  // nothing left to do, so we exit without re-iterating the catalog.\n  const recordResult = await deps.dedupClient.recordIfAbsent({\n    consumerName: SEED_SYSTEM_DATA_CONSUMER_NAME,\n    eventId: parsed.dedupKey.eventId,\n    attempt: parsed.dedupKey.attempt,\n  });\n  if (!recordResult.recorded) {\n    return;\n  }\n\n  // Role records are platform-wide singletons (per ADR 2026-03-13-02 §4)\n  // and live under the sentinel tenant/workspace coordinates the\n  // `role-entity` declares (`TID#-#WID#-`). We pass an internal-system\n  // context whose tenant/workspace fields are empty strings; the role\n  // create operation reads only `date` and audit metadata.\n  const lastUpdated = parsed.envelope.occurredAt;\n  const context: OpenHiContext = {\n    tenantId: \"\",\n    workspaceId: \"\",\n    date: lastUpdated,\n    actorId: \"platform-deploy-bridge\",\n    actorName: \"Platform Deploy Bridge\",\n    actorType: \"internal-system\",\n    source: \"step-function\",\n  };\n\n  try {\n    await deps.seedRoles(context);\n  } catch (err) {\n    // Mark the dedup row failed so the replay tooling (TR-016 follow-up)\n    // can re-publish the originating event with a fresh attempt. The\n    // re-throw keeps EventBridge's failure-detection path intact — the\n    // event ends up in the DLQ + the workflow Lambda's failure\n    // CloudWatch alarm fires.\n    await deps.dedupClient.markFailed({\n      consumerName: SEED_SYSTEM_DATA_CONSUMER_NAME,\n      eventId: parsed.dedupKey.eventId,\n      attempt: parsed.dedupKey.attempt,\n      reason: errorMessage(err),\n    });\n    throw err;\n  }\n\n  // Seeding succeeded — publish `platform.system-data-seeded.v1` so\n  // downstream consumers that depend on the platform-singleton\n  // records existing (today: `seed-demo-data`) are triggered by a\n  // happens-before edge rather than by EventBridge retry timing.\n  //\n  // A publish failure here does NOT roll back the seed — the records\n  // are already in the data store and idempotent on re-fire. We log\n  // and re-throw so EventBridge retries the whole event; on retry,\n  // dedup wins (no-op) and the publish path re-runs.\n  const sourcePayload = parsed.envelope\n    .payload as PlatformDeploymentCompletedV1Detail;\n  await deps.publishSeeded({\n    payload: {\n      sourceEventId: parsed.envelope.eventId,\n      sourceStackId: sourcePayload.stackId,\n      seededRecordCount: Object.keys(PLATFORM_ROLE_IDS).length,\n    },\n    envelope: {\n      correlationId: parsed.envelope.correlationId,\n      causationId: parsed.envelope.eventId,\n    },\n  });\n};\n\nconst productionDependencies = (): SeedSystemDataDependencies => {\n  const dynamodb = new DynamoDBClient({});\n  const eventBridge = new EventBridgeClient({});\n  return {\n    dedupClient: workflowDedupClient(dynamodb),\n    seedRoles: seedSystemRoles,\n    publishSeeded: async (input) => {\n      const controlBusName = process.env[SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR];\n      if (!controlBusName) {\n        throw new Error(\n          `seed-system-data: ${SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR} env var is required to publish system-data-seeded events.`,\n        );\n      }\n      return publishWorkflowEvent(\n        eventBridge,\n        PlatformSystemDataSeededV1,\n        input.payload,\n        {\n          actor: { system: SEED_SYSTEM_DATA_ACTOR_SYSTEM },\n          correlationId: input.envelope.correlationId,\n          causationId: input.envelope.causationId,\n        },\n        {\n          busNameByPlane: { [OPENHI_CONTROL_SOURCE]: controlBusName },\n        },\n      );\n    },\n  };\n};\n\nexport const handler = async (event: SeedSystemDataEvent): Promise<void> =>\n  runSeedSystemData(event, productionDependencies());\n"],"mappings":";;;;;;;;;;;;;;;;;;AAOA,IAAAA,oBAQO;AAfP,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAgFP,IAAM,eAAe,CAAC,QAAyB;AAC7C,MAAI,eAAe,OAAO;AACxB,WAAO,IAAI;AAAA,EACb;AACA,SAAO,OAAO,GAAG;AACnB;AAQA,IAAM,gBAAgB,CAAC,SAAmC;AACxD,aAAW,OAAO,OAAO,KAAK,iBAAiB,GAE5C;AACD,QAAI,uBAAuB,GAAG,EAAE,SAAS,MAAM;AAC7C,aAAO,kBAAkB,GAAG;AAAA,IAC9B;AAAA,EACF;AAGA,QAAM,IAAI,MAAM,gCAAgC,IAAI,IAAI;AAC1D;AAQA,IAAM,kBAAkB,OAAO,YAA0C;AACvE,aAAW,WAAW,OAAO,OAAO,sBAAsB,GAAG;AAC3D,UAAM,KAAK,cAAc,QAAQ,IAAI;AACrC,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,MAAM;AAAA,QACJ;AAAA,QACA,UAAU;AAAA,UACR,cAAc;AAAA,UACd,MAAM,QAAQ;AAAA,UACd,SAAS,QAAQ;AAAA,UACjB,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAMO,IAAM,oBAAoB,OAC/B,OACA,SACkB;AAClB,QAAM,aAAS,sCAAmB,OAAO,8CAA6B;AAOtE,QAAM,eAAe,MAAM,KAAK,YAAY,eAAe;AAAA,IACzD,cAAc;AAAA,IACd,SAAS,OAAO,SAAS;AAAA,IACzB,SAAS,OAAO,SAAS;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,aAAa,UAAU;AAC1B;AAAA,EACF;AAOA,QAAM,cAAc,OAAO,SAAS;AACpC,QAAM,UAAyB;AAAA,IAC7B,UAAU;AAAA,IACV,aAAa;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,WAAW;AAAA,IACX,QAAQ;AAAA,EACV;AAEA,MAAI;AACF,UAAM,KAAK,UAAU,OAAO;AAAA,EAC9B,SAAS,KAAK;AAMZ,UAAM,KAAK,YAAY,WAAW;AAAA,MAChC,cAAc;AAAA,MACd,SAAS,OAAO,SAAS;AAAA,MACzB,SAAS,OAAO,SAAS;AAAA,MACzB,QAAQ,aAAa,GAAG;AAAA,IAC1B,CAAC;AACD,UAAM;AAAA,EACR;AAWA,QAAM,gBAAgB,OAAO,SAC1B;AACH,QAAM,KAAK,cAAc;AAAA,IACvB,SAAS;AAAA,MACP,eAAe,OAAO,SAAS;AAAA,MAC/B,eAAe,cAAc;AAAA,MAC7B,mBAAmB,OAAO,KAAK,iBAAiB,EAAE;AAAA,IACpD;AAAA,IACA,UAAU;AAAA,MACR,eAAe,OAAO,SAAS;AAAA,MAC/B,aAAa,OAAO,SAAS;AAAA,IAC/B;AAAA,EACF,CAAC;AACH;AAEA,IAAM,yBAAyB,MAAkC;AAC/D,QAAM,WAAW,IAAI,eAAe,CAAC,CAAC;AACtC,QAAM,cAAc,IAAI,kBAAkB,CAAC,CAAC;AAC5C,SAAO;AAAA,IACL,iBAAa,uCAAoB,QAAQ;AAAA,IACzC,WAAW;AAAA,IACX,eAAe,OAAO,UAAU;AAC9B,YAAM,iBAAiB,QAAQ,IAAI,oCAAoC;AACvE,UAAI,CAAC,gBAAgB;AACnB,cAAM,IAAI;AAAA,UACR,qBAAqB,oCAAoC;AAAA,QAC3D;AAAA,MACF;AACA,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN;AAAA,UACE,OAAO,EAAE,QAAQ,8BAA8B;AAAA,UAC/C,eAAe,MAAM,SAAS;AAAA,UAC9B,aAAa,MAAM,SAAS;AAAA,QAC9B;AAAA,QACA;AAAA,UACE,gBAAgB,EAAE,CAAC,uCAAqB,GAAG,eAAe;AAAA,QAC5D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,UAAU,OAAO,UAC5B,kBAAkB,OAAO,uBAAuB,CAAC;","names":["import_workflows"]}
+{"version":3,"sources":["../src/workflows/control-plane/seed-system-data/seed-system-data.handler.ts"],"sourcesContent":["import { DynamoDBClient } from \"@aws-sdk/client-dynamodb\";\nimport { EventBridgeClient } from \"@aws-sdk/client-eventbridge\";\nimport {\n  PLATFORM_ROLE_CONCEPTS,\n  PLATFORM_ROLE_IDS,\n  type PlatformRoleCode,\n} from \"@openhi/types\";\nimport {\n  OPENHI_CONTROL_SOURCE,\n  parseWorkflowEvent,\n  publishWorkflowEvent,\n  workflowDedupClient,\n  type PlatformDeploymentCompletedV1Detail,\n  type PublishResult,\n  type WorkflowDedupClient,\n} from \"@openhi/workflows\";\nimport type { EventBridgeEvent } from \"aws-lambda\";\nimport {\n  PlatformDeploymentCompletedV1,\n  PlatformSystemDataSeededV1,\n  SEED_SYSTEM_DATA_ACTOR_SYSTEM,\n  SEED_SYSTEM_DATA_CONSUMER_NAME,\n  SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR,\n} from \"./events\";\nimport type { OpenHiContext } from \"../../../data/openhi-context\";\nimport { createRoleOperation } from \"../../../data/operations/control/role/role-create-operation\";\n\n/**\n * @see sites/www-docs/content/packages/@openhi/constructs/workflows/control-plane/seed-system-data/seed-system-data-handler.md\n *\n * EventBridge workflow handler invoked once per platform-deploy event on\n * the control event bus. Idempotently re-asserts the platform-singleton\n * control-plane records (today: the three canonical Roles; future:\n * additional system data slotted in as sibling steps under the same\n * dedup record).\n */\n\ntype SeedSystemDataEvent = EventBridgeEvent<\n  \"platform.deployment-completed.v1\",\n  unknown\n>;\n\n/**\n * Input shape the handler passes to the completion publisher. Mirrors\n * the wire shape of `PlatformSystemDataSeededV1Detail` plus the\n * envelope-correlation fields the publisher needs to chain the new\n * event onto the originating deploy event.\n */\nexport interface PublishSeededInput {\n  /** Per-workflow payload — re-asserted record count + source event/stack ids. */\n  readonly payload: {\n    readonly sourceEventId: string;\n    readonly sourceStackId: string;\n    readonly seededRecordCount: number;\n  };\n  /**\n   * Envelope context propagated from the originating\n   * `platform.deployment-completed.v1` event so the chain is\n   * observable in logs.\n   */\n  readonly envelope: {\n    readonly correlationId: string;\n    readonly causationId: string;\n  };\n}\n\n/**\n * Dependency seam for tests. The factory mirrors the production\n * arrangement: a real DynamoDB client + the real `workflowDedupClient`\n * factory bound to the `OPENHI_WORKFLOW_DEDUP_TABLE_NAME` env var the\n * construct injects via `grantConsumer`.\n */\nexport interface SeedSystemDataDependencies {\n  readonly dedupClient: WorkflowDedupClient;\n  readonly seedRoles: (context: OpenHiContext) => Promise<void>;\n  /**\n   * Publishes the `platform.system-data-seeded.v1` completion event\n   * onto the control event bus. Called after a successful seed and\n   * before the handler returns — downstream consumers\n   * (`seed-demo-data`) subscribe to this event instead of the raw\n   * deploy-completion event so the dependency on system data is\n   * enforced by a happens-before edge.\n   */\n  readonly publishSeeded: (input: PublishSeededInput) => Promise<PublishResult>;\n}\n\nconst errorMessage = (err: unknown): string => {\n  if (err instanceof Error) {\n    return err.message;\n  }\n  return String(err);\n};\n\n/**\n * Lookup the stable record id for a given role code by walking the two\n * parallel generator-emitted constants. The `_IDS` / `_CONCEPTS` consts\n * are keyed by the same SCREAMING_SNAKE keys (the generator builds them\n * in lockstep), so a single key resolves both projections.\n */\nconst idForRoleCode = (code: PlatformRoleCode): string => {\n  for (const key of Object.keys(PLATFORM_ROLE_IDS) as Array<\n    keyof typeof PLATFORM_ROLE_IDS\n  >) {\n    if (PLATFORM_ROLE_CONCEPTS[key].code === code) {\n      return PLATFORM_ROLE_IDS[key];\n    }\n  }\n  // Unreachable while `_IDS` and `_CONCEPTS` are emitted from the same\n  // CodeSystem: every code in `_CONCEPTS` has a matching id in `_IDS`.\n  throw new Error(`No id mapping for role code \"${code}\".`);\n};\n\n/**\n * Re-assert the three canonical control-plane Role records. Stable ids\n * from `PLATFORM_ROLE_IDS` make re-runs after dedup-TTL expiry\n * idempotent: every put with the same id+sk lands on the same primary\n * key and produces the same end state.\n */\nconst seedSystemRoles = async (context: OpenHiContext): Promise<void> => {\n  for (const concept of Object.values(PLATFORM_ROLE_CONCEPTS)) {\n    const id = idForRoleCode(concept.code);\n    await createRoleOperation({\n      context,\n      body: {\n        id,\n        resource: {\n          resourceType: \"Role\",\n          code: concept.code,\n          display: concept.display,\n          active: true,\n        },\n      },\n    });\n  }\n};\n\n/**\n * Test-visible orchestrator. The production `handler` calls this with\n * real dependencies; unit tests inject fakes.\n */\nexport const runSeedSystemData = async (\n  event: SeedSystemDataEvent,\n  deps: SeedSystemDataDependencies,\n): Promise<void> => {\n  const parsed = parseWorkflowEvent(event, PlatformDeploymentCompletedV1);\n\n  // Dedup is the single circuit-breaker between EventBridge's\n  // at-least-once redelivery and the DynamoDB writes below. If\n  // `recordIfAbsent` returns `recorded: false`, a prior invocation of\n  // this (eventId, attempt) tuple already ran to completion — there is\n  // nothing left to do, so we exit without re-iterating the catalog.\n  const recordResult = await deps.dedupClient.recordIfAbsent({\n    consumerName: SEED_SYSTEM_DATA_CONSUMER_NAME,\n    eventId: parsed.dedupKey.eventId,\n    attempt: parsed.dedupKey.attempt,\n  });\n  if (!recordResult.recorded) {\n    return;\n  }\n\n  // Role records are platform-wide singletons (per ADR 2026-03-13-02 §4)\n  // and live under the sentinel tenant/workspace coordinates the\n  // `role-entity` declares (`TID#-#WID#-`). We pass an internal-system\n  // context whose tenant/workspace fields are empty strings; the role\n  // create operation reads only `date` and audit metadata.\n  const lastUpdated = parsed.envelope.occurredAt;\n  const context: OpenHiContext = {\n    tenantId: \"\",\n    workspaceId: \"\",\n    date: lastUpdated,\n    actorId: \"platform-deploy-bridge\",\n    actorName: \"Platform Deploy Bridge\",\n    actorType: \"internal-system\",\n    source: \"step-function\",\n  };\n\n  try {\n    await deps.seedRoles(context);\n  } catch (err) {\n    // Mark the dedup row failed so the replay tooling (TR-016 follow-up)\n    // can re-publish the originating event with a fresh attempt. The\n    // re-throw keeps EventBridge's failure-detection path intact — the\n    // event ends up in the DLQ + the workflow Lambda's failure\n    // CloudWatch alarm fires.\n    await deps.dedupClient.markFailed({\n      consumerName: SEED_SYSTEM_DATA_CONSUMER_NAME,\n      eventId: parsed.dedupKey.eventId,\n      attempt: parsed.dedupKey.attempt,\n      reason: errorMessage(err),\n    });\n    throw err;\n  }\n\n  // Seeding succeeded — publish `platform.system-data-seeded.v1` so\n  // downstream consumers that depend on the platform-singleton\n  // records existing (today: `seed-demo-data`) are triggered by a\n  // happens-before edge rather than by EventBridge retry timing.\n  //\n  // A publish failure here does NOT roll back the seed — the records\n  // are already in the data store and idempotent on re-fire. We log\n  // and re-throw so EventBridge retries the whole event; on retry,\n  // dedup wins (no-op) and the publish path re-runs.\n  const sourcePayload = parsed.envelope\n    .payload as PlatformDeploymentCompletedV1Detail;\n  await deps.publishSeeded({\n    payload: {\n      sourceEventId: parsed.envelope.eventId,\n      sourceStackId: sourcePayload.stackId,\n      seededRecordCount: Object.keys(PLATFORM_ROLE_IDS).length,\n    },\n    envelope: {\n      correlationId: parsed.envelope.correlationId,\n      causationId: parsed.envelope.eventId,\n    },\n  });\n};\n\nconst productionDependencies = (): SeedSystemDataDependencies => {\n  const dynamodb = new DynamoDBClient({});\n  const eventBridge = new EventBridgeClient({});\n  return {\n    dedupClient: workflowDedupClient(dynamodb),\n    seedRoles: seedSystemRoles,\n    publishSeeded: async (input) => {\n      const controlBusName = process.env[SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR];\n      if (!controlBusName) {\n        throw new Error(\n          `seed-system-data: ${SEED_SYSTEM_DATA_CONTROL_BUS_ENV_VAR} env var is required to publish system-data-seeded events.`,\n        );\n      }\n      return publishWorkflowEvent(\n        eventBridge,\n        PlatformSystemDataSeededV1,\n        input.payload,\n        {\n          actor: { system: SEED_SYSTEM_DATA_ACTOR_SYSTEM },\n          correlationId: input.envelope.correlationId,\n          causationId: input.envelope.causationId,\n        },\n        {\n          busNameByPlane: { [OPENHI_CONTROL_SOURCE]: controlBusName },\n        },\n      );\n    },\n  };\n};\n\nexport const handler = async (event: SeedSystemDataEvent): Promise<void> =>\n  runSeedSystemData(event, productionDependencies());\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAOA,IAAAA,oBAQO;AAfP,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAgFP,IAAM,eAAe,CAAC,QAAyB;AAC7C,MAAI,eAAe,OAAO;AACxB,WAAO,IAAI;AAAA,EACb;AACA,SAAO,OAAO,GAAG;AACnB;AAQA,IAAM,gBAAgB,CAAC,SAAmC;AACxD,aAAW,OAAO,OAAO,KAAK,iBAAiB,GAE5C;AACD,QAAI,uBAAuB,GAAG,EAAE,SAAS,MAAM;AAC7C,aAAO,kBAAkB,GAAG;AAAA,IAC9B;AAAA,EACF;AAGA,QAAM,IAAI,MAAM,gCAAgC,IAAI,IAAI;AAC1D;AAQA,IAAM,kBAAkB,OAAO,YAA0C;AACvE,aAAW,WAAW,OAAO,OAAO,sBAAsB,GAAG;AAC3D,UAAM,KAAK,cAAc,QAAQ,IAAI;AACrC,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,MAAM;AAAA,QACJ;AAAA,QACA,UAAU;AAAA,UACR,cAAc;AAAA,UACd,MAAM,QAAQ;AAAA,UACd,SAAS,QAAQ;AAAA,UACjB,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAMO,IAAM,oBAAoB,OAC/B,OACA,SACkB;AAClB,QAAM,aAAS,sCAAmB,OAAO,8CAA6B;AAOtE,QAAM,eAAe,MAAM,KAAK,YAAY,eAAe;AAAA,IACzD,cAAc;AAAA,IACd,SAAS,OAAO,SAAS;AAAA,IACzB,SAAS,OAAO,SAAS;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,aAAa,UAAU;AAC1B;AAAA,EACF;AAOA,QAAM,cAAc,OAAO,SAAS;AACpC,QAAM,UAAyB;AAAA,IAC7B,UAAU;AAAA,IACV,aAAa;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,WAAW;AAAA,IACX,QAAQ;AAAA,EACV;AAEA,MAAI;AACF,UAAM,KAAK,UAAU,OAAO;AAAA,EAC9B,SAAS,KAAK;AAMZ,UAAM,KAAK,YAAY,WAAW;AAAA,MAChC,cAAc;AAAA,MACd,SAAS,OAAO,SAAS;AAAA,MACzB,SAAS,OAAO,SAAS;AAAA,MACzB,QAAQ,aAAa,GAAG;AAAA,IAC1B,CAAC;AACD,UAAM;AAAA,EACR;AAWA,QAAM,gBAAgB,OAAO,SAC1B;AACH,QAAM,KAAK,cAAc;AAAA,IACvB,SAAS;AAAA,MACP,eAAe,OAAO,SAAS;AAAA,MAC/B,eAAe,cAAc;AAAA,MAC7B,mBAAmB,OAAO,KAAK,iBAAiB,EAAE;AAAA,IACpD;AAAA,IACA,UAAU;AAAA,MACR,eAAe,OAAO,SAAS;AAAA,MAC/B,aAAa,OAAO,SAAS;AAAA,IAC/B;AAAA,EACF,CAAC;AACH;AAEA,IAAM,yBAAyB,MAAkC;AAC/D,QAAM,WAAW,IAAI,eAAe,CAAC,CAAC;AACtC,QAAM,cAAc,IAAI,kBAAkB,CAAC,CAAC;AAC5C,SAAO;AAAA,IACL,iBAAa,uCAAoB,QAAQ;AAAA,IACzC,WAAW;AAAA,IACX,eAAe,OAAO,UAAU;AAC9B,YAAM,iBAAiB,QAAQ,IAAI,oCAAoC;AACvE,UAAI,CAAC,gBAAgB;AACnB,cAAM,IAAI;AAAA,UACR,qBAAqB,oCAAoC;AAAA,QAC3D;AAAA,MACF;AACA,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN;AAAA,UACE,OAAO,EAAE,QAAQ,8BAA8B;AAAA,UAC/C,eAAe,MAAM,SAAS;AAAA,UAC9B,aAAa,MAAM,SAAS;AAAA,QAC9B;AAAA,QACA;AAAA,UACE,gBAAgB,EAAE,CAAC,uCAAqB,GAAG,eAAe;AAAA,QAC5D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,UAAU,OAAO,UAC5B,kBAAkB,OAAO,uBAAuB,CAAC;","names":["import_workflows"]}

package/package.json

@@ -44,7 +44,7 @@
     "@aws-sdk/client-s3": "^3.1045.0",
     "@aws-sdk/client-secrets-manager": "^3.1045.0",
     "@aws-sdk/client-ssm": "^3.1045.0",
-    "@codedrifters/utils": "^0.0.25",
+    "@codedrifters/utils": "^0.0.26",
     "@codegenie/serverless-express": "^4.17.1",
     "@types/aws-lambda": "^8.10.161",
     "awscdk-appsync-utils": "^0.0.858",
@@ -71,7 +71,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.111",
+  "version": "0.0.113",
   "types": "lib/index.d.ts",
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"pnpm exec projen\".",
   "scripts": {

package/lib/chunk-2TPJ6HOF.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/data/operations/control/user/user-find-by-sub-operation.ts","../src/data/operations/control/user/user-resource-helpers.ts","../src/data/operations/fhir-reference.ts","../src/data/operations/control/user/user-create-operation.ts","../src/data/operations/control/user/user-get-by-id-operation.ts","../src/data/operations/control/user/user-list-operation.ts","../src/data/operations/control/user/user-switch-tenant-workspace-operation.ts","../src/data/operations/control/membership/membership-find-for-user-in-tenant-operation.ts","../src/data/operations/control/user/user-update-operation.ts","../src/data/operations/control/user/user-delete-operation.ts"],"sourcesContent":["import { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface FindUserBySubParams {\n  context: OpenHiContext;\n  cognitoSub: string;\n  tableName?: string;\n}\n\nexport interface FindUserBySubResult {\n  id: string;\n  cognitoSub?: string;\n  resource: string;\n  vid: string;\n}\n\n/**\n * Look up a User by Cognito sub via GSI2, projecting the row to a stable\n * result shape. Returns `undefined` when no row matches.\n */\nexport async function findUserBySubOperation(\n  params: FindUserBySubParams,\n): Promise<FindUserBySubResult | undefined> {\n  const { cognitoSub, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  const result = await service.entities.user.query\n    .gsi2({ cognitoSub })\n    .go({ limit: 1 });\n  const item = result.data?.[0];\n  if (!item) {\n    return undefined;\n  }\n  return {\n    id: item.id,\n    cognitoSub: item.cognitoSub,\n    resource: item.resource,\n    vid: item.vid,\n  };\n}\n","import type { User } from \"@openhi/types\";\n\n/**\n * Helpers for working with persisted OpenHI User resources. Co-located with\n * the User operations because both the Cognito triggers and the onboarding\n * workflow consume these alongside `findUserBySubOperation`.\n */\n\n// Defensive parse — JSON.parse may yield any shape, so every field is optional.\nexport type UserResource = Partial<User>;\n\n/**\n * Existing User resources are stored as JSON strings in the data store; parse\n * defensively so a malformed payload returns `undefined` rather than throwing.\n */\nexport function parseUserResource(resource: string): UserResource | undefined {\n  try {\n    return JSON.parse(resource) as UserResource;\n  } catch {\n    return undefined;\n  }\n}\n","/**\n * Pure helpers for working with FHIR Reference fields. Shared across data-plane\n * and control-plane operations and the handlers that wrap them.\n */\n\n/**\n * Extract the id portion from a FHIR-style reference such as `Patient/<id>` or\n * `Tenant/<id>`. Returns `undefined` if the reference is missing, does not\n * match the prefix, or has an empty id after the prefix.\n */\nexport function idFromReference(\n  reference: string | undefined,\n  prefix: string,\n): string | undefined {\n  if (!reference || !reference.startsWith(prefix)) {\n    return undefined;\n  }\n  const id = reference.slice(prefix.length);\n  return id.length > 0 ? id : undefined;\n}\n","import { extractSummary, type FhirResourceLike } from \"@openhi/types\";\nimport { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface UserCreateParams {\n  context: OpenHiContext;\n  body: { id?: string; resource?: Record<string, unknown> | string };\n  tableName?: string;\n}\n\nexport interface UserCreateResult {\n  id: string;\n  resource: { resourceType: string; id: string; [key: string]: unknown };\n  meta: { lastUpdated: string; versionId: string };\n}\n\nexport async function createUserOperation(\n  params: UserCreateParams,\n): Promise<UserCreateResult> {\n  const { context, body, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  const id = body.id ?? `user-${Date.now()}`;\n  const parsedResource =\n    typeof body.resource === \"string\"\n      ? (JSON.parse(body.resource) as Record<string, unknown>)\n      : (body.resource ?? {});\n\n  const lastUpdated = context.date ?? new Date().toISOString();\n  const vid = `1`;\n\n  const resource = { resourceType: \"User\", id, ...parsedResource };\n  const summary = JSON.stringify(extractSummary(resource as FhirResourceLike));\n\n  await service.entities.user\n    .put({\n      id,\n      resource: JSON.stringify(resource),\n      summary,\n      vid,\n      lastUpdated,\n    })\n    .go();\n\n  return {\n    id,\n    resource,\n    meta: { lastUpdated, versionId: vid },\n  };\n}\n","import { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { NotFoundError } from \"../../../errors\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface UserGetByIdParams {\n  context: OpenHiContext;\n  id: string;\n  tableName?: string;\n}\n\nexport interface UserGetByIdResult {\n  id: string;\n  resource: { resourceType: string; id: string; [key: string]: unknown };\n}\n\nexport async function getUserByIdOperation(\n  params: UserGetByIdParams,\n): Promise<UserGetByIdResult> {\n  const { id, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  const response = await service.entities.user.get({ id, sk: \"CURRENT\" }).go();\n\n  const item = response.data;\n  if (!item) {\n    throw new NotFoundError(`User not found: ${id}`);\n  }\n\n  const parsedResource = JSON.parse(item.resource) as Record<string, unknown>;\n\n  return {\n    id,\n    resource: { resourceType: \"User\", id, ...parsedResource },\n  };\n}\n","import { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { SHARD_COUNT } from \"../../../dynamo/shard\";\nimport { OpenHiContext } from \"../../../openhi-context\";\nimport {\n  batchGetWithRetry,\n  dispatchListMode,\n  type ListOperationMode,\n} from \"../../data-operations-common\";\n\nconst SK = \"CURRENT\";\n\nexport interface UserListParams {\n  context: OpenHiContext;\n  tableName?: string;\n  /** #853: defaults to `\"full\"`. `\"summary\"` skips BatchGet, `\"count\"` returns total only. */\n  mode?: ListOperationMode;\n}\n\nexport interface UserListResult {\n  entries: Array<{\n    id: string;\n    resource: { resourceType: string; id: string; [key: string]: unknown };\n  }>;\n  total: number;\n}\n\n/**\n * Lists Users via GSI1 (sharded). `mode` (default `\"full\"`) selects between BatchGet hydration,\n * summary-only (parse `summary` JSON projected on GSI1), or count-only (skip both). See\n * `dispatchListMode` in data-operations-common for the canonical mode contract.\n */\nexport async function listUsersOperation(\n  params: UserListParams,\n): Promise<UserListResult> {\n  const { tableName, mode = \"full\" } = params;\n  const service = getDynamoControlService(tableName);\n\n  const shardResults = await Promise.all(\n    Array.from({ length: SHARD_COUNT }, (_, shard) =>\n      service.entities.user.query.gsi1({ gsi1Shard: String(shard) }).go(),\n    ),\n  );\n\n  return dispatchListMode<\n    { id: string; resource: string },\n    UserListResult[\"entries\"][number]\n  >(mode, shardResults, {\n    hydrate: (orderedIds) =>\n      batchGetWithRetry(\n        service.entities.user,\n        orderedIds.map((id) => ({ id, sk: SK })),\n      ) as Promise<Array<{ id: string; resource: string }>>,\n    getId: (item) => item.id,\n    buildEntry: (id, item) => ({\n      id,\n      resource: {\n        resourceType: \"User\",\n        id,\n        ...(JSON.parse(item.resource) as Record<string, unknown>),\n      },\n    }),\n    buildSummaryEntry: (id, parsed) => ({\n      id,\n      resource: { resourceType: \"User\", id, ...parsed },\n    }),\n  });\n}\n","import { extractSummary, type FhirResourceLike } from \"@openhi/types\";\nimport { findUserBySubOperation } from \"./user-find-by-sub-operation\";\nimport { parseUserResource } from \"./user-resource-helpers\";\nimport { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport {\n  ForbiddenError,\n  NotFoundError,\n  ValidationError,\n} from \"../../../errors\";\nimport { idFromReference } from \"../../fhir-reference\";\nimport {\n  findMembershipsForUserInTenantOperation,\n  pickTenantMembership,\n  pickWorkspaceMembership,\n} from \"../membership/membership-find-for-user-in-tenant-operation\";\n\nconst SK = \"CURRENT\";\n\nexport interface UserSwitchTenantWorkspaceParams {\n  cognitoSub: string;\n  tenantReference: string;\n  workspaceReference: string;\n  tableName?: string;\n  /** Override the clock — used by tests for deterministic `lastUpdated`. */\n  now?: () => Date;\n}\n\nexport interface UserSwitchTenantWorkspaceResult {\n  id: string;\n  resource: Record<string, unknown>;\n  meta: { lastUpdated: string; versionId: string };\n}\n\n/**\n * Update `currentTenant` and `currentWorkspace` on the User resource for the\n * caller authenticated by the given Cognito `sub`. All other fields on the\n * User are preserved.\n *\n * Throws:\n * - `ValidationError` when either reference is missing or malformed\n * - `NotFoundError` when no User matches the Cognito subject\n * - `ForbiddenError` when the caller lacks a tenant-level OR workspace-level\n *   Membership in the requested tenant / workspace\n *\n * @see https://github.com/codedrifters/openhi/issues/769\n */\nexport async function switchUserTenantWorkspaceOperation(\n  params: UserSwitchTenantWorkspaceParams,\n): Promise<UserSwitchTenantWorkspaceResult> {\n  const { cognitoSub, tenantReference, workspaceReference, tableName } = params;\n\n  const tenantId = idFromReference(tenantReference, \"Tenant/\");\n  if (!tenantId) {\n    throw new ValidationError(\n      \"tenant.reference must be a 'Tenant/<id>' reference.\",\n    );\n  }\n  const workspaceId = idFromReference(workspaceReference, \"Workspace/\");\n  if (!workspaceId) {\n    throw new ValidationError(\n      \"workspace.reference must be a 'Workspace/<id>' reference.\",\n    );\n  }\n\n  const user = await findUserBySubOperation({\n    // findUserBySubOperation does not read context fields; pass a stub.\n    context: {\n      tenantId: \"\",\n      workspaceId: \"\",\n      date: \"\",\n      actorId: \"\",\n      actorName: \"\",\n      actorType: \"internal-system\",\n    },\n    cognitoSub,\n    tableName,\n  });\n  if (!user) {\n    throw new NotFoundError(\n      \"User not yet provisioned for the authenticated Cognito subject.\",\n    );\n  }\n\n  const { memberships } = await findMembershipsForUserInTenantOperation({\n    tenantId,\n    userId: user.id,\n    tableName,\n  });\n  if (!pickTenantMembership(memberships)) {\n    throw new ForbiddenError(`User is not a member of Tenant/${tenantId}.`);\n  }\n  if (!pickWorkspaceMembership(memberships, workspaceId)) {\n    throw new ForbiddenError(\n      `User is not a member of Workspace/${workspaceId} in Tenant/${tenantId}.`,\n    );\n  }\n\n  const existingResource = parseUserResource(user.resource) ?? {};\n  const updatedResource: Record<string, unknown> = {\n    ...existingResource,\n    resourceType: \"User\",\n    id: user.id,\n    currentTenant: { reference: `Tenant/${tenantId}` },\n    currentWorkspace: { reference: `Workspace/${workspaceId}` },\n  };\n\n  const lastUpdated = (params.now ? params.now() : new Date()).toISOString();\n  const vid = `${Date.now()}`;\n  const summary = JSON.stringify(\n    extractSummary(updatedResource as FhirResourceLike),\n  );\n\n  const service = getDynamoControlService(tableName);\n  await service.entities.user\n    .patch({ id: user.id, sk: SK })\n    .set({\n      resource: JSON.stringify(updatedResource),\n      summary,\n      vid,\n      lastUpdated,\n    })\n    .go();\n\n  return {\n    id: user.id,\n    resource: updatedResource,\n    meta: { lastUpdated, versionId: vid },\n  };\n}\n","import { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { SHARD_COUNT } from \"../../../dynamo/shard\";\n\nconst SK = \"CURRENT\";\n\nexport interface MembershipFindForUserInTenantParams {\n  tenantId: string;\n  userId: string;\n  tableName?: string;\n}\n\nexport interface MembershipMatch {\n  id: string;\n  resource: Record<string, unknown>;\n}\n\nexport interface MembershipFindForUserInTenantResult {\n  memberships: Array<MembershipMatch>;\n}\n\n/**\n * Return every Membership in `tenantId` whose `resource.user.reference`\n * equals `User/<userId>` — including both the tenant-level membership\n * (no `workspace` reference) and any workspace-level memberships.\n *\n * Implementation: fan-out GSI1 query across all four shards for the\n * tenant, parse the resource JSON, and filter by `user.reference`.\n *\n * Interim implementation — to be replaced by the adjacency-list\n * `USER#ID#<userId>` projection in #977 (ADR-018) once it lands. The\n * scan cost is bounded by the size of the target tenant; that's fine\n * for `POST /User/$switch` membership validation in v1 and avoids\n * pulling forward a partially-landed GSI.\n */\nexport async function findMembershipsForUserInTenantOperation(\n  params: MembershipFindForUserInTenantParams,\n): Promise<MembershipFindForUserInTenantResult> {\n  const { tenantId, userId, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  const shardResults = await Promise.all(\n    Array.from({ length: SHARD_COUNT }, (_, shard) =>\n      service.entities.membership.query\n        .gsi1({ tenantId, gsi1Shard: String(shard) })\n        .go(),\n    ),\n  );\n\n  const expectedUserRef = `User/${userId}`;\n  const memberships: Array<MembershipMatch> = [];\n\n  for (const shard of shardResults) {\n    for (const item of shard.data ?? []) {\n      if (item.sk !== SK) {\n        continue;\n      }\n      let parsed: Record<string, unknown>;\n      try {\n        parsed = JSON.parse(item.resource) as Record<string, unknown>;\n      } catch {\n        continue;\n      }\n      const userRef = (parsed.user as { reference?: unknown } | undefined)\n        ?.reference;\n      if (userRef !== expectedUserRef) {\n        continue;\n      }\n      memberships.push({ id: item.id, resource: parsed });\n    }\n  }\n\n  return { memberships };\n}\n\n/**\n * Tenant-level Membership: caller is a member of the tenant but not\n * scoped to a specific Workspace (no `workspace.reference`).\n */\nexport function pickTenantMembership(\n  memberships: ReadonlyArray<MembershipMatch>,\n): MembershipMatch | undefined {\n  return memberships.find(\n    (m) =>\n      (m.resource.workspace as { reference?: unknown } | undefined) == null,\n  );\n}\n\n/**\n * Workspace-level Membership for the given workspace id, if the caller\n * is a member.\n */\nexport function pickWorkspaceMembership(\n  memberships: ReadonlyArray<MembershipMatch>,\n  workspaceId: string,\n): MembershipMatch | undefined {\n  const expectedWorkspaceRef = `Workspace/${workspaceId}`;\n  return memberships.find(\n    (m) =>\n      (m.resource.workspace as { reference?: unknown } | undefined)\n        ?.reference === expectedWorkspaceRef,\n  );\n}\n","import { extractSummary, type FhirResourceLike } from \"@openhi/types\";\nimport { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { NotFoundError } from \"../../../errors\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface UserUpdateParams {\n  context: OpenHiContext;\n  id: string;\n  body: { resource?: Record<string, unknown> | string };\n  tableName?: string;\n}\n\nexport interface UserUpdateResult {\n  id: string;\n  resource: { resourceType: string; id: string; [key: string]: unknown };\n  meta: { lastUpdated: string; versionId: string };\n}\n\nexport async function updateUserOperation(\n  params: UserUpdateParams,\n): Promise<UserUpdateResult> {\n  const { context, id, body, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  const existing = await service.entities.user.get({ id, sk: \"CURRENT\" }).go();\n  if (!existing.data) {\n    throw new NotFoundError(`User not found: ${id}`);\n  }\n\n  const parsedResource =\n    typeof body.resource === \"string\"\n      ? (JSON.parse(body.resource) as Record<string, unknown>)\n      : (body.resource ?? {});\n\n  const lastUpdated = context.date ?? new Date().toISOString();\n  const vid = `${Date.now()}`;\n\n  const resource = { resourceType: \"User\", id, ...parsedResource };\n  const summary = JSON.stringify(extractSummary(resource as FhirResourceLike));\n\n  await service.entities.user\n    .put({\n      id,\n      resource: JSON.stringify(resource),\n      summary,\n      vid,\n      lastUpdated,\n    })\n    .go();\n\n  return {\n    id,\n    resource,\n    meta: { lastUpdated, versionId: vid },\n  };\n}\n","import { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface UserDeleteParams {\n  context: OpenHiContext;\n  id: string;\n  tableName?: string;\n}\n\nexport async function deleteUserOperation(\n  params: UserDeleteParams,\n): Promise<void> {\n  const { id, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  await service.entities.user.delete({ id, sk: \"CURRENT\" }).go();\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,eAAsB,uBACpB,QAC0C;AAC1C,QAAM,EAAE,YAAY,UAAU,IAAI;AAClC,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,SAAS,MAAM,QAAQ,SAAS,KAAK,MACxC,KAAK,EAAE,WAAW,CAAC,EACnB,GAAG,EAAE,OAAO,EAAE,CAAC;AAClB,QAAM,OAAO,OAAO,OAAO,CAAC;AAC5B,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK;AAAA,IACf,KAAK,KAAK;AAAA,EACZ;AACF;;;ACxBO,SAAS,kBAAkB,UAA4C;AAC5E,MAAI;AACF,WAAO,KAAK,MAAM,QAAQ;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACXO,SAAS,gBACd,WACA,QACoB;AACpB,MAAI,CAAC,aAAa,CAAC,UAAU,WAAW,MAAM,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,KAAK,UAAU,MAAM,OAAO,MAAM;AACxC,SAAO,GAAG,SAAS,IAAI,KAAK;AAC9B;;;ACnBA,SAAS,sBAA6C;AAgBtD,eAAsB,oBACpB,QAC2B;AAC3B,QAAM,EAAE,SAAS,MAAM,UAAU,IAAI;AACrC,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,IAAI,CAAC;AACxC,QAAM,iBACJ,OAAO,KAAK,aAAa,WACpB,KAAK,MAAM,KAAK,QAAQ,IACxB,KAAK,YAAY,CAAC;AAEzB,QAAM,cAAc,QAAQ,SAAQ,oBAAI,KAAK,GAAE,YAAY;AAC3D,QAAM,MAAM;AAEZ,QAAM,WAAW,EAAE,cAAc,QAAQ,IAAI,GAAG,eAAe;AAC/D,QAAM,UAAU,KAAK,UAAU,eAAe,QAA4B,CAAC;AAE3E,QAAM,QAAQ,SAAS,KACpB,IAAI;AAAA,IACH;AAAA,IACA,UAAU,KAAK,UAAU,QAAQ;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,GAAG;AAEN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,EAAE,aAAa,WAAW,IAAI;AAAA,EACtC;AACF;;;AClCA,eAAsB,qBACpB,QAC4B;AAC5B,QAAM,EAAE,IAAI,UAAU,IAAI;AAC1B,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,WAAW,MAAM,QAAQ,SAAS,KAAK,IAAI,EAAE,IAAI,IAAI,UAAU,CAAC,EAAE,GAAG;AAE3E,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,mBAAmB,EAAE,EAAE;AAAA,EACjD;AAEA,QAAM,iBAAiB,KAAK,MAAM,KAAK,QAAQ;AAE/C,SAAO;AAAA,IACL;AAAA,IACA,UAAU,EAAE,cAAc,QAAQ,IAAI,GAAG,eAAe;AAAA,EAC1D;AACF;;;ACzBA,IAAM,KAAK;AAsBX,eAAsB,mBACpB,QACyB;AACzB,QAAM,EAAE,WAAW,OAAO,OAAO,IAAI;AACrC,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,eAAe,MAAM,QAAQ;AAAA,IACjC,MAAM;AAAA,MAAK,EAAE,QAAQ,YAAY;AAAA,MAAG,CAAC,GAAG,UACtC,QAAQ,SAAS,KAAK,MAAM,KAAK,EAAE,WAAW,OAAO,KAAK,EAAE,CAAC,EAAE,GAAG;AAAA,IACpE;AAAA,EACF;AAEA,SAAO,iBAGL,MAAM,cAAc;AAAA,IACpB,SAAS,CAAC,eACR;AAAA,MACE,QAAQ,SAAS;AAAA,MACjB,WAAW,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,EAAE;AAAA,IACzC;AAAA,IACF,OAAO,CAAC,SAAS,KAAK;AAAA,IACtB,YAAY,CAAC,IAAI,UAAU;AAAA,MACzB;AAAA,MACA,UAAU;AAAA,QACR,cAAc;AAAA,QACd;AAAA,QACA,GAAI,KAAK,MAAM,KAAK,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,IACA,mBAAmB,CAAC,IAAI,YAAY;AAAA,MAClC;AAAA,MACA,UAAU,EAAE,cAAc,QAAQ,IAAI,GAAG,OAAO;AAAA,IAClD;AAAA,EACF,CAAC;AACH;;;AClEA,SAAS,kBAAAA,uBAA6C;;;ACGtD,IAAMC,MAAK;AA+BX,eAAsB,wCACpB,QAC8C;AAC9C,QAAM,EAAE,UAAU,QAAQ,UAAU,IAAI;AACxC,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,eAAe,MAAM,QAAQ;AAAA,IACjC,MAAM;AAAA,MAAK,EAAE,QAAQ,YAAY;AAAA,MAAG,CAAC,GAAG,UACtC,QAAQ,SAAS,WAAW,MACzB,KAAK,EAAE,UAAU,WAAW,OAAO,KAAK,EAAE,CAAC,EAC3C,GAAG;AAAA,IACR;AAAA,EACF;AAEA,QAAM,kBAAkB,QAAQ,MAAM;AACtC,QAAM,cAAsC,CAAC;AAE7C,aAAW,SAAS,cAAc;AAChC,eAAW,QAAQ,MAAM,QAAQ,CAAC,GAAG;AACnC,UAAI,KAAK,OAAOA,KAAI;AAClB;AAAA,MACF;AACA,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,KAAK,QAAQ;AAAA,MACnC,QAAQ;AACN;AAAA,MACF;AACA,YAAM,UAAW,OAAO,MACpB;AACJ,UAAI,YAAY,iBAAiB;AAC/B;AAAA,MACF;AACA,kBAAY,KAAK,EAAE,IAAI,KAAK,IAAI,UAAU,OAAO,CAAC;AAAA,IACpD;AAAA,EACF;AAEA,SAAO,EAAE,YAAY;AACvB;AAMO,SAAS,qBACd,aAC6B;AAC7B,SAAO,YAAY;AAAA,IACjB,CAAC,MACE,EAAE,SAAS,aAAqD;AAAA,EACrE;AACF;AAMO,SAAS,wBACd,aACA,aAC6B;AAC7B,QAAM,uBAAuB,aAAa,WAAW;AACrD,SAAO,YAAY;AAAA,IACjB,CAAC,MACE,EAAE,SAAS,WACR,cAAc;AAAA,EACtB;AACF;;;ADrFA,IAAMC,MAAK;AA8BX,eAAsB,mCACpB,QAC0C;AAC1C,QAAM,EAAE,YAAY,iBAAiB,oBAAoB,UAAU,IAAI;AAEvE,QAAM,WAAW,gBAAgB,iBAAiB,SAAS;AAC3D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,cAAc,gBAAgB,oBAAoB,YAAY;AACpE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,MAAM,uBAAuB;AAAA;AAAA,IAExC,SAAS;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,MACb,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,EAAE,YAAY,IAAI,MAAM,wCAAwC;AAAA,IACpE;AAAA,IACA,QAAQ,KAAK;AAAA,IACb;AAAA,EACF,CAAC;AACD,MAAI,CAAC,qBAAqB,WAAW,GAAG;AACtC,UAAM,IAAI,eAAe,kCAAkC,QAAQ,GAAG;AAAA,EACxE;AACA,MAAI,CAAC,wBAAwB,aAAa,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qCAAqC,WAAW,cAAc,QAAQ;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,mBAAmB,kBAAkB,KAAK,QAAQ,KAAK,CAAC;AAC9D,QAAM,kBAA2C;AAAA,IAC/C,GAAG;AAAA,IACH,cAAc;AAAA,IACd,IAAI,KAAK;AAAA,IACT,eAAe,EAAE,WAAW,UAAU,QAAQ,GAAG;AAAA,IACjD,kBAAkB,EAAE,WAAW,aAAa,WAAW,GAAG;AAAA,EAC5D;AAEA,QAAM,eAAe,OAAO,MAAM,OAAO,IAAI,IAAI,oBAAI,KAAK,GAAG,YAAY;AACzE,QAAM,MAAM,GAAG,KAAK,IAAI,CAAC;AACzB,QAAM,UAAU,KAAK;AAAA,IACnBC,gBAAe,eAAmC;AAAA,EACpD;AAEA,QAAM,UAAU,wBAAwB,SAAS;AACjD,QAAM,QAAQ,SAAS,KACpB,MAAM,EAAE,IAAI,KAAK,IAAI,IAAID,IAAG,CAAC,EAC7B,IAAI;AAAA,IACH,UAAU,KAAK,UAAU,eAAe;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,GAAG;AAEN,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,UAAU;AAAA,IACV,MAAM,EAAE,aAAa,WAAW,IAAI;AAAA,EACtC;AACF;;;AEhIA,SAAS,kBAAAE,uBAA6C;AAkBtD,eAAsB,oBACpB,QAC2B;AAC3B,QAAM,EAAE,SAAS,IAAI,MAAM,UAAU,IAAI;AACzC,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,WAAW,MAAM,QAAQ,SAAS,KAAK,IAAI,EAAE,IAAI,IAAI,UAAU,CAAC,EAAE,GAAG;AAC3E,MAAI,CAAC,SAAS,MAAM;AAClB,UAAM,IAAI,cAAc,mBAAmB,EAAE,EAAE;AAAA,EACjD;AAEA,QAAM,iBACJ,OAAO,KAAK,aAAa,WACpB,KAAK,MAAM,KAAK,QAAQ,IACxB,KAAK,YAAY,CAAC;AAEzB,QAAM,cAAc,QAAQ,SAAQ,oBAAI,KAAK,GAAE,YAAY;AAC3D,QAAM,MAAM,GAAG,KAAK,IAAI,CAAC;AAEzB,QAAM,WAAW,EAAE,cAAc,QAAQ,IAAI,GAAG,eAAe;AAC/D,QAAM,UAAU,KAAK,UAAUC,gBAAe,QAA4B,CAAC;AAE3E,QAAM,QAAQ,SAAS,KACpB,IAAI;AAAA,IACH;AAAA,IACA,UAAU,KAAK,UAAU,QAAQ;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,GAAG;AAEN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,EAAE,aAAa,WAAW,IAAI;AAAA,EACtC;AACF;;;AC9CA,eAAsB,oBACpB,QACe;AACf,QAAM,EAAE,IAAI,UAAU,IAAI;AAC1B,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,IAAI,IAAI,UAAU,CAAC,EAAE,GAAG;AAC/D;","names":["extractSummary","SK","SK","extractSummary","extractSummary","extractSummary"]}