@openhi/constructs 0.0.160 → 0.0.161

package/lib/counter-reconciliation.handler.js

@@ -0,0 +1,3324 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// ../workflows/lib/envelope-version.js
+var require_envelope_version = __commonJS({
+  "../workflows/lib/envelope-version.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ENVELOPE_VERSION = void 0;
+    exports2.isSupportedEnvelopeVersion = isSupportedEnvelopeVersion;
+    exports2.ENVELOPE_VERSION = "1.0";
+    var ENVELOPE_VERSION_PATTERN = /^\d+\.\d+$/;
+    var MIN_SUPPORTED_MAJOR = 1;
+    var MAX_SUPPORTED_MAJOR = 1;
+    function isSupportedEnvelopeVersion(version) {
+      if (!ENVELOPE_VERSION_PATTERN.test(version)) {
+        return false;
+      }
+      const major = Number.parseInt(version.split(".")[0], 10);
+      return major >= MIN_SUPPORTED_MAJOR && major <= MAX_SUPPORTED_MAJOR;
+    }
+  }
+});
+
+// ../workflows/lib/envelope.js
+var require_envelope = __commonJS({
+  "../workflows/lib/envelope.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.MissingActorContextError = void 0;
+    exports2.isWorkflowUserActor = isWorkflowUserActor;
+    exports2.isWorkflowSystemActor = isWorkflowSystemActor;
+    exports2.workflowUserActorFromClaims = workflowUserActorFromClaims;
+    function isWorkflowUserActor(actor) {
+      return actor.ohi_uid !== void 0;
+    }
+    function isWorkflowSystemActor(actor) {
+      return actor.system !== void 0;
+    }
+    function workflowUserActorFromClaims(claims) {
+      if (claims.ohi_tid === void 0 || claims.ohi_wid === void 0) {
+        throw new MissingActorContextError("workflowUserActorFromClaims: ohi_tid and ohi_wid are required on the workflow user-actor; the caller's JWT is missing one or both. Use a system-actor for pre-provisioning bootstrap workflows.");
+      }
+      return {
+        ohi_tid: claims.ohi_tid,
+        ohi_wid: claims.ohi_wid,
+        ohi_uid: claims.ohi_uid,
+        ohi_uname: claims.ohi_uname
+      };
+    }
+    var MissingActorContextError = class extends Error {
+      /** @param message - human-readable description of the missing claim. */
+      constructor(message) {
+        super(message);
+        this.name = "MissingActorContextError";
+      }
+    };
+    exports2.MissingActorContextError = MissingActorContextError;
+  }
+});
+
+// ../workflows/lib/sources.js
+var require_sources = __commonJS({
+  "../workflows/lib/sources.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.DEFAULT_BUS_NAME_BY_SOURCE = exports2.OPENHI_OPS_SOURCE = exports2.OPENHI_DATA_SOURCE = exports2.OPENHI_CONTROL_SOURCE = void 0;
+    exports2.OPENHI_CONTROL_SOURCE = "openhi.control";
+    exports2.OPENHI_DATA_SOURCE = "openhi.data";
+    exports2.OPENHI_OPS_SOURCE = "openhi.ops";
+    exports2.DEFAULT_BUS_NAME_BY_SOURCE = {
+      [exports2.OPENHI_CONTROL_SOURCE]: "openhi-control-event-bus",
+      [exports2.OPENHI_DATA_SOURCE]: "openhi-data-event-bus",
+      [exports2.OPENHI_OPS_SOURCE]: "openhi-ops-event-bus"
+    };
+  }
+});
+
+// ../workflows/lib/detail-types/registry.js
+var require_registry = __commonJS({
+  "../workflows/lib/detail-types/registry.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.InvalidDetailTypeRegistrationError = void 0;
+    exports2.defineDetailType = defineDetailType;
+    exports2.isWellFormedDetailType = isWellFormedDetailType;
+    function defineDetailType(entry) {
+      if (!isWellFormedDetailType(entry.detailType)) {
+        throw new InvalidDetailTypeRegistrationError(`Detail-type "${entry.detailType}" does not match the platform-wide format <area>.<event>.v<integer>. See TR-016 \xA7Open Items #2.`);
+      }
+      return entry;
+    }
+    var DETAIL_TYPE_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[a-z0-9]+(?:-[a-z0-9]+)*\.v\d+$/;
+    function isWellFormedDetailType(detailType) {
+      return DETAIL_TYPE_PATTERN.test(detailType);
+    }
+    var InvalidDetailTypeRegistrationError = class extends Error {
+      /** @param message - human-readable description of the violation. */
+      constructor(message) {
+        super(message);
+        this.name = "InvalidDetailTypeRegistrationError";
+      }
+    };
+    exports2.InvalidDetailTypeRegistrationError = InvalidDetailTypeRegistrationError;
+  }
+});
+
+// ../workflows/lib/detail-types/control-plane.js
+var require_control_plane = __commonJS({
+  "../workflows/lib/detail-types/control-plane.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ControlPlaneWorkspaceDeletedV1 = exports2.ControlPlaneWorkspaceCreatedV1 = exports2.ControlPlaneRoleAssignmentDeletedV1 = exports2.ControlPlaneRoleAssignmentCreatedV1 = exports2.ControlPlaneMembershipDeletedV1 = exports2.ControlPlaneMembershipCreatedV1 = exports2.ControlPlaneRenameFailedV1 = exports2.ControlPlaneRenameCompleteV1 = exports2.ControlPlaneRenameV1 = exports2.RENAMABLE_ENTITY_TYPE = exports2.ControlPlaneOwningDeleteFailedV1 = exports2.ControlPlaneOwningDeleteCompleteV1 = exports2.ControlPlaneOwningDeleteV1 = exports2.OWNING_ENTITY_TYPE = void 0;
+    var sources_1 = require_sources();
+    var registry_1 = require_registry();
+    exports2.OWNING_ENTITY_TYPE = {
+      Workspace: "Workspace",
+      User: "User"
+    };
+    exports2.ControlPlaneOwningDeleteV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.owning-delete.v1",
+      source: sources_1.OPENHI_DATA_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneOwningDeleteCompleteV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.owning-delete-complete.v1",
+      source: sources_1.OPENHI_OPS_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneOwningDeleteFailedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.owning-delete-failed.v1",
+      source: sources_1.OPENHI_OPS_SOURCE,
+      dedupRequired: true
+    });
+    exports2.RENAMABLE_ENTITY_TYPE = {
+      Tenant: "Tenant",
+      User: "User",
+      Role: "Role"
+    };
+    exports2.ControlPlaneRenameV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.rename.v1",
+      source: sources_1.OPENHI_DATA_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneRenameCompleteV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.rename-complete.v1",
+      source: sources_1.OPENHI_OPS_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneRenameFailedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.rename-failed.v1",
+      source: sources_1.OPENHI_OPS_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneMembershipCreatedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.membership-created.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneMembershipDeletedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.membership-deleted.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneRoleAssignmentCreatedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.role-assignment-created.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneRoleAssignmentDeletedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.role-assignment-deleted.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneWorkspaceCreatedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.workspace-created.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.ControlPlaneWorkspaceDeletedV1 = (0, registry_1.defineDetailType)({
+      detailType: "control-plane.workspace-deleted.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+  }
+});
+
+// ../workflows/lib/detail-types/platform.js
+var require_platform = __commonJS({
+  "../workflows/lib/detail-types/platform.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.PlatformSystemDataSeededV1 = exports2.PlatformDeploymentCompletedV1 = void 0;
+    var sources_1 = require_sources();
+    var registry_1 = require_registry();
+    exports2.PlatformDeploymentCompletedV1 = (0, registry_1.defineDetailType)({
+      detailType: "platform.deployment-completed.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+    exports2.PlatformSystemDataSeededV1 = (0, registry_1.defineDetailType)({
+      detailType: "platform.system-data-seeded.v1",
+      source: sources_1.OPENHI_CONTROL_SOURCE,
+      dedupRequired: true
+    });
+  }
+});
+
+// ../workflows/lib/detail-types/index.js
+var require_detail_types = __commonJS({
+  "../workflows/lib/detail-types/index.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    __exportStar(require_control_plane(), exports2);
+    __exportStar(require_platform(), exports2);
+    __exportStar(require_registry(), exports2);
+  }
+});
+
+// ../workflows/lib/publisher.js
+var require_publisher = __commonJS({
+  "../workflows/lib/publisher.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.WorkflowPublishError = void 0;
+    exports2.workflowsClient = workflowsClient;
+    exports2.publishWorkflowEvent = publishWorkflowEvent2;
+    var node_crypto_1 = require("crypto");
+    var client_eventbridge_1 = require("@aws-sdk/client-eventbridge");
+    var envelope_version_1 = require_envelope_version();
+    var sources_1 = require_sources();
+    function workflowsClient(bridge, options = {}) {
+      return {
+        publish: (entry, payload, ctx) => publishWorkflowEvent2(bridge, entry, payload, ctx, options)
+      };
+    }
+    async function publishWorkflowEvent2(bridge, entry, payload, ctx, options = {}) {
+      const eventIdGenerator = options.eventIdGenerator ?? (() => (0, node_crypto_1.randomUUID)());
+      const correlationIdGenerator = options.correlationIdGenerator ?? (() => (0, node_crypto_1.randomUUID)());
+      const now = options.now ?? (() => /* @__PURE__ */ new Date());
+      const envelope = {
+        eventId: eventIdGenerator(),
+        attempt: 1,
+        correlationId: ctx.correlationId ?? correlationIdGenerator(),
+        causationId: ctx.causationId ?? null,
+        actor: ctx.actor,
+        occurredAt: now().toISOString(),
+        envelopeVersion: envelope_version_1.ENVELOPE_VERSION,
+        payload
+      };
+      const busName = options.busNameByPlane?.[entry.source] ?? sources_1.DEFAULT_BUS_NAME_BY_SOURCE[entry.source];
+      const result = await bridge.send(new client_eventbridge_1.PutEventsCommand({
+        Entries: [
+          {
+            EventBusName: busName,
+            Source: entry.source,
+            DetailType: entry.detailType,
+            Detail: JSON.stringify(envelope)
+          }
+        ]
+      }));
+      if ((result.FailedEntryCount ?? 0) > 0) {
+        const first = result.Entries?.[0];
+        throw new WorkflowPublishError(`EventBridge rejected ${entry.detailType} publish on bus ${busName}: ${first?.ErrorCode ?? "unknown"} \u2014 ${first?.ErrorMessage ?? "no error message"}`);
+      }
+      return { eventId: envelope.eventId };
+    }
+    var WorkflowPublishError = class extends Error {
+      /** @param message - human-readable description of the failed publish. */
+      constructor(message) {
+        super(message);
+        this.name = "WorkflowPublishError";
+      }
+    };
+    exports2.WorkflowPublishError = WorkflowPublishError;
+  }
+});
+
+// ../workflows/lib/consumer.js
+var require_consumer = __commonJS({
+  "../workflows/lib/consumer.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.UnsupportedEnvelopeVersionError = exports2.InvalidWorkflowEventError = void 0;
+    exports2.parseWorkflowEvent = parseWorkflowEvent;
+    var envelope_version_1 = require_envelope_version();
+    function parseWorkflowEvent(event, expected) {
+      if (event.source !== expected.source) {
+        throw new InvalidWorkflowEventError(`EventBridge source "${event.source}" does not match expected detail-type's source "${expected.source}".`);
+      }
+      if (event["detail-type"] !== expected.detailType) {
+        throw new InvalidWorkflowEventError(`EventBridge detail-type "${event["detail-type"]}" does not match expected "${expected.detailType}".`);
+      }
+      const candidate = asEnvelopeCandidate(event.detail);
+      if (!(0, envelope_version_1.isSupportedEnvelopeVersion)(candidate.envelopeVersion)) {
+        throw new UnsupportedEnvelopeVersionError(`Envelope version "${candidate.envelopeVersion}" is outside the SDK's supported range.`);
+      }
+      const envelope = {
+        eventId: candidate.eventId,
+        attempt: candidate.attempt,
+        correlationId: candidate.correlationId,
+        causationId: candidate.causationId,
+        actor: candidate.actor,
+        occurredAt: candidate.occurredAt,
+        envelopeVersion: candidate.envelopeVersion,
+        payload: candidate.payload
+      };
+      return {
+        envelope,
+        dedupKey: { eventId: envelope.eventId, attempt: envelope.attempt }
+      };
+    }
+    function asEnvelopeCandidate(detail) {
+      if (detail === null || typeof detail !== "object") {
+        throw new InvalidWorkflowEventError("EventBridge detail is not a non-null object.");
+      }
+      const obj = detail;
+      assertString(obj, "eventId");
+      assertPositiveInteger(obj, "attempt");
+      assertString(obj, "correlationId");
+      assertCausationId(obj);
+      assertActor(obj);
+      assertString(obj, "occurredAt");
+      assertString(obj, "envelopeVersion");
+      if (!("payload" in obj)) {
+        throw new InvalidWorkflowEventError("Envelope is missing required field: payload.");
+      }
+      return obj;
+    }
+    function assertString(obj, field) {
+      const value = obj[field];
+      if (typeof value !== "string" || value.length === 0) {
+        throw new InvalidWorkflowEventError(`Envelope field "${field}" must be a non-empty string.`);
+      }
+    }
+    function assertPositiveInteger(obj, field) {
+      const value = obj[field];
+      if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+        throw new InvalidWorkflowEventError(`Envelope field "${field}" must be a 1-indexed integer.`);
+      }
+    }
+    function assertCausationId(obj) {
+      if (!("causationId" in obj)) {
+        throw new InvalidWorkflowEventError("Envelope is missing required field: causationId.");
+      }
+      const value = obj.causationId;
+      if (value !== null && (typeof value !== "string" || value.length === 0)) {
+        throw new InvalidWorkflowEventError('Envelope field "causationId" must be a non-empty string or null.');
+      }
+    }
+    function assertActor(obj) {
+      const actor = obj.actor;
+      if (actor === null || typeof actor !== "object") {
+        throw new InvalidWorkflowEventError('Envelope field "actor" must be an object.');
+      }
+      const actorObj = actor;
+      const isUserActor = typeof actorObj.ohi_uid === "string" && typeof actorObj.ohi_uname === "string" && typeof actorObj.ohi_tid === "string" && typeof actorObj.ohi_wid === "string";
+      const isSystemActor = typeof actorObj.system === "string";
+      if (!isUserActor && !isSystemActor) {
+        throw new InvalidWorkflowEventError('Envelope field "actor" must be either a user-actor (ohi_tid, ohi_wid, ohi_uid, ohi_uname) or a system-actor ({ system: string }).');
+      }
+    }
+    var InvalidWorkflowEventError = class extends Error {
+      /** @param message - human-readable description of the validation failure. */
+      constructor(message) {
+        super(message);
+        this.name = "InvalidWorkflowEventError";
+      }
+    };
+    exports2.InvalidWorkflowEventError = InvalidWorkflowEventError;
+    var UnsupportedEnvelopeVersionError = class extends Error {
+      /** @param message - human-readable description of the unsupported version. */
+      constructor(message) {
+        super(message);
+        this.name = "UnsupportedEnvelopeVersionError";
+      }
+    };
+    exports2.UnsupportedEnvelopeVersionError = UnsupportedEnvelopeVersionError;
+  }
+});
+
+// ../workflows/lib/dedup/env.js
+var require_env = __commonJS({
+  "../workflows/lib/dedup/env.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH = exports2.WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS = exports2.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR = void 0;
+    exports2.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR = "OPENHI_WORKFLOW_DEDUP_TABLE_NAME";
+    exports2.WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS = 14 * 24 * 60 * 60;
+    exports2.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH = 64;
+  }
+});
+
+// ../workflows/lib/dedup/workflow-dedup-client.js
+var require_workflow_dedup_client = __commonJS({
+  "../workflows/lib/dedup/workflow-dedup-client.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.WorkflowDedupInvalidInputError = exports2.WorkflowDedupTableNameMissingError = void 0;
+    exports2.workflowDedupClient = workflowDedupClient;
+    exports2.recordIfAbsent = recordIfAbsent;
+    exports2.markFailed = markFailed;
+    exports2.encodeSortKey = encodeSortKey;
+    var client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+    var env_1 = require_env();
+    function workflowDedupClient(dynamodb, options = {}) {
+      return {
+        recordIfAbsent: (input) => recordIfAbsent(dynamodb, input, options),
+        markFailed: (input) => markFailed(dynamodb, input, options)
+      };
+    }
+    async function recordIfAbsent(dynamodb, input, options = {}) {
+      assertConsumerName(input.consumerName);
+      assertPositiveInteger(input.attempt, "attempt");
+      const ttlSeconds = input.ttlSeconds ?? options.defaultTtlSeconds ?? env_1.WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS;
+      if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
+        throw new WorkflowDedupInvalidInputError(`ttlSeconds must be a positive integer; got ${ttlSeconds}.`);
+      }
+      const tableName = resolveTableName(options.tableName);
+      const now = (options.now ?? defaultNow)();
+      const sk = encodeSortKey(input.eventId, input.attempt);
+      const expiresAt = Math.floor(now.getTime() / 1e3) + ttlSeconds;
+      try {
+        await dynamodb.send(new client_dynamodb_1.PutItemCommand({
+          TableName: tableName,
+          Item: {
+            consumerName: { S: input.consumerName },
+            sk: { S: sk },
+            eventId: { S: input.eventId },
+            attempt: { N: String(input.attempt) },
+            recordedAt: { S: now.toISOString() },
+            expiresAt: { N: String(expiresAt) }
+          },
+          ConditionExpression: "attribute_not_exists(consumerName) AND attribute_not_exists(sk)"
+        }));
+        return { recorded: true };
+      } catch (err) {
+        if (err instanceof client_dynamodb_1.ConditionalCheckFailedException) {
+          return { recorded: false, alreadyProcessed: true };
+        }
+        throw err;
+      }
+    }
+    async function markFailed(dynamodb, input, options = {}) {
+      assertConsumerName(input.consumerName);
+      assertPositiveInteger(input.attempt, "attempt");
+      if (input.reason.length === 0) {
+        throw new WorkflowDedupInvalidInputError("reason must be non-empty.");
+      }
+      const tableName = resolveTableName(options.tableName);
+      const now = (options.now ?? defaultNow)();
+      const sk = encodeSortKey(input.eventId, input.attempt);
+      await dynamodb.send(new client_dynamodb_1.UpdateItemCommand({
+        TableName: tableName,
+        Key: {
+          consumerName: { S: input.consumerName },
+          sk: { S: sk }
+        },
+        UpdateExpression: "SET #failed = :failed, #failureReason = :reason, #failedAt = :failedAt",
+        ExpressionAttributeNames: {
+          "#failed": "failed",
+          "#failureReason": "failureReason",
+          "#failedAt": "failedAt"
+        },
+        ExpressionAttributeValues: {
+          ":failed": { BOOL: true },
+          ":reason": { S: input.reason },
+          ":failedAt": { S: now.toISOString() }
+        }
+      }));
+    }
+    function encodeSortKey(eventId, attempt) {
+      if (eventId.length === 0) {
+        throw new WorkflowDedupInvalidInputError("eventId must be non-empty.");
+      }
+      return `${eventId}#${attempt}`;
+    }
+    function resolveTableName(explicit) {
+      const name = explicit ?? process.env[env_1.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR];
+      if (!name) {
+        throw new WorkflowDedupTableNameMissingError(`Workflow dedup table name not set. Pass options.tableName or set ${env_1.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR}.`);
+      }
+      return name;
+    }
+    function assertConsumerName(consumerName) {
+      if (consumerName.length === 0) {
+        throw new WorkflowDedupInvalidInputError("consumerName must be non-empty.");
+      }
+      if (consumerName.length > env_1.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH) {
+        throw new WorkflowDedupInvalidInputError(`consumerName must be \u2264${env_1.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH} chars; got ${consumerName.length}.`);
+      }
+      if (/\s/.test(consumerName)) {
+        throw new WorkflowDedupInvalidInputError("consumerName must not contain whitespace.");
+      }
+    }
+    function assertPositiveInteger(value, field) {
+      if (!Number.isInteger(value) || value < 1) {
+        throw new WorkflowDedupInvalidInputError(`${field} must be a 1-indexed integer; got ${value}.`);
+      }
+    }
+    function defaultNow() {
+      return /* @__PURE__ */ new Date();
+    }
+    var WorkflowDedupTableNameMissingError = class extends Error {
+      /** @param message - human-readable description. */
+      constructor(message) {
+        super(message);
+        this.name = "WorkflowDedupTableNameMissingError";
+      }
+    };
+    exports2.WorkflowDedupTableNameMissingError = WorkflowDedupTableNameMissingError;
+    var WorkflowDedupInvalidInputError = class extends Error {
+      /** @param message - human-readable description. */
+      constructor(message) {
+        super(message);
+        this.name = "WorkflowDedupInvalidInputError";
+      }
+    };
+    exports2.WorkflowDedupInvalidInputError = WorkflowDedupInvalidInputError;
+  }
+});
+
+// ../workflows/lib/dedup/index.js
+var require_dedup = __commonJS({
+  "../workflows/lib/dedup/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.workflowDedupClient = exports2.recordIfAbsent = exports2.markFailed = exports2.encodeSortKey = exports2.WorkflowDedupTableNameMissingError = exports2.WorkflowDedupInvalidInputError = exports2.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR = exports2.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH = exports2.WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS = void 0;
+    var env_1 = require_env();
+    Object.defineProperty(exports2, "WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS", { enumerable: true, get: function() {
+      return env_1.WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS;
+    } });
+    Object.defineProperty(exports2, "WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH", { enumerable: true, get: function() {
+      return env_1.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH;
+    } });
+    Object.defineProperty(exports2, "WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR", { enumerable: true, get: function() {
+      return env_1.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR;
+    } });
+    var workflow_dedup_client_1 = require_workflow_dedup_client();
+    Object.defineProperty(exports2, "WorkflowDedupInvalidInputError", { enumerable: true, get: function() {
+      return workflow_dedup_client_1.WorkflowDedupInvalidInputError;
+    } });
+    Object.defineProperty(exports2, "WorkflowDedupTableNameMissingError", { enumerable: true, get: function() {
+      return workflow_dedup_client_1.WorkflowDedupTableNameMissingError;
+    } });
+    Object.defineProperty(exports2, "encodeSortKey", { enumerable: true, get: function() {
+      return workflow_dedup_client_1.encodeSortKey;
+    } });
+    Object.defineProperty(exports2, "markFailed", { enumerable: true, get: function() {
+      return workflow_dedup_client_1.markFailed;
+    } });
+    Object.defineProperty(exports2, "recordIfAbsent", { enumerable: true, get: function() {
+      return workflow_dedup_client_1.recordIfAbsent;
+    } });
+    Object.defineProperty(exports2, "workflowDedupClient", { enumerable: true, get: function() {
+      return workflow_dedup_client_1.workflowDedupClient;
+    } });
+  }
+});
+
+// ../workflows/lib/index.js
+var require_lib = __commonJS({
+  "../workflows/lib/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.workflowDedupClient = exports2.recordIfAbsent = exports2.markFailed = exports2.encodeSortKey = exports2.WorkflowDedupTableNameMissingError = exports2.WorkflowDedupInvalidInputError = exports2.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR = exports2.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH = exports2.WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS = exports2.parseWorkflowEvent = exports2.UnsupportedEnvelopeVersionError = exports2.InvalidWorkflowEventError = exports2.workflowsClient = exports2.publishWorkflowEvent = exports2.WorkflowPublishError = exports2.isWellFormedDetailType = exports2.defineDetailType = exports2.RENAMABLE_ENTITY_TYPE = exports2.PlatformSystemDataSeededV1 = exports2.PlatformDeploymentCompletedV1 = exports2.OWNING_ENTITY_TYPE = exports2.InvalidDetailTypeRegistrationError = exports2.ControlPlaneWorkspaceDeletedV1 = exports2.ControlPlaneWorkspaceCreatedV1 = exports2.ControlPlaneRoleAssignmentDeletedV1 = exports2.ControlPlaneRoleAssignmentCreatedV1 = exports2.ControlPlaneRenameV1 = exports2.ControlPlaneRenameFailedV1 = exports2.ControlPlaneRenameCompleteV1 = exports2.ControlPlaneOwningDeleteV1 = exports2.ControlPlaneOwningDeleteFailedV1 = exports2.ControlPlaneOwningDeleteCompleteV1 = exports2.ControlPlaneMembershipDeletedV1 = exports2.ControlPlaneMembershipCreatedV1 = exports2.OPENHI_OPS_SOURCE = exports2.OPENHI_DATA_SOURCE = exports2.OPENHI_CONTROL_SOURCE = exports2.DEFAULT_BUS_NAME_BY_SOURCE = exports2.workflowUserActorFromClaims = exports2.isWorkflowUserActor = exports2.isWorkflowSystemActor = exports2.MissingActorContextError = exports2.isSupportedEnvelopeVersion = exports2.ENVELOPE_VERSION = void 0;
+    var envelope_version_1 = require_envelope_version();
+    Object.defineProperty(exports2, "ENVELOPE_VERSION", { enumerable: true, get: function() {
+      return envelope_version_1.ENVELOPE_VERSION;
+    } });
+    Object.defineProperty(exports2, "isSupportedEnvelopeVersion", { enumerable: true, get: function() {
+      return envelope_version_1.isSupportedEnvelopeVersion;
+    } });
+    var envelope_1 = require_envelope();
+    Object.defineProperty(exports2, "MissingActorContextError", { enumerable: true, get: function() {
+      return envelope_1.MissingActorContextError;
+    } });
+    Object.defineProperty(exports2, "isWorkflowSystemActor", { enumerable: true, get: function() {
+      return envelope_1.isWorkflowSystemActor;
+    } });
+    Object.defineProperty(exports2, "isWorkflowUserActor", { enumerable: true, get: function() {
+      return envelope_1.isWorkflowUserActor;
+    } });
+    Object.defineProperty(exports2, "workflowUserActorFromClaims", { enumerable: true, get: function() {
+      return envelope_1.workflowUserActorFromClaims;
+    } });
+    var sources_1 = require_sources();
+    Object.defineProperty(exports2, "DEFAULT_BUS_NAME_BY_SOURCE", { enumerable: true, get: function() {
+      return sources_1.DEFAULT_BUS_NAME_BY_SOURCE;
+    } });
+    Object.defineProperty(exports2, "OPENHI_CONTROL_SOURCE", { enumerable: true, get: function() {
+      return sources_1.OPENHI_CONTROL_SOURCE;
+    } });
+    Object.defineProperty(exports2, "OPENHI_DATA_SOURCE", { enumerable: true, get: function() {
+      return sources_1.OPENHI_DATA_SOURCE;
+    } });
+    Object.defineProperty(exports2, "OPENHI_OPS_SOURCE", { enumerable: true, get: function() {
+      return sources_1.OPENHI_OPS_SOURCE;
+    } });
+    var detail_types_1 = require_detail_types();
+    Object.defineProperty(exports2, "ControlPlaneMembershipCreatedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneMembershipCreatedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneMembershipDeletedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneMembershipDeletedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneOwningDeleteCompleteV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneOwningDeleteCompleteV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneOwningDeleteFailedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneOwningDeleteFailedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneOwningDeleteV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneOwningDeleteV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneRenameCompleteV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneRenameCompleteV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneRenameFailedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneRenameFailedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneRenameV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneRenameV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneRoleAssignmentCreatedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneRoleAssignmentCreatedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneRoleAssignmentDeletedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneRoleAssignmentDeletedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneWorkspaceCreatedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneWorkspaceCreatedV1;
+    } });
+    Object.defineProperty(exports2, "ControlPlaneWorkspaceDeletedV1", { enumerable: true, get: function() {
+      return detail_types_1.ControlPlaneWorkspaceDeletedV1;
+    } });
+    Object.defineProperty(exports2, "InvalidDetailTypeRegistrationError", { enumerable: true, get: function() {
+      return detail_types_1.InvalidDetailTypeRegistrationError;
+    } });
+    Object.defineProperty(exports2, "OWNING_ENTITY_TYPE", { enumerable: true, get: function() {
+      return detail_types_1.OWNING_ENTITY_TYPE;
+    } });
+    Object.defineProperty(exports2, "PlatformDeploymentCompletedV1", { enumerable: true, get: function() {
+      return detail_types_1.PlatformDeploymentCompletedV1;
+    } });
+    Object.defineProperty(exports2, "PlatformSystemDataSeededV1", { enumerable: true, get: function() {
+      return detail_types_1.PlatformSystemDataSeededV1;
+    } });
+    Object.defineProperty(exports2, "RENAMABLE_ENTITY_TYPE", { enumerable: true, get: function() {
+      return detail_types_1.RENAMABLE_ENTITY_TYPE;
+    } });
+    Object.defineProperty(exports2, "defineDetailType", { enumerable: true, get: function() {
+      return detail_types_1.defineDetailType;
+    } });
+    Object.defineProperty(exports2, "isWellFormedDetailType", { enumerable: true, get: function() {
+      return detail_types_1.isWellFormedDetailType;
+    } });
+    var publisher_1 = require_publisher();
+    Object.defineProperty(exports2, "WorkflowPublishError", { enumerable: true, get: function() {
+      return publisher_1.WorkflowPublishError;
+    } });
+    Object.defineProperty(exports2, "publishWorkflowEvent", { enumerable: true, get: function() {
+      return publisher_1.publishWorkflowEvent;
+    } });
+    Object.defineProperty(exports2, "workflowsClient", { enumerable: true, get: function() {
+      return publisher_1.workflowsClient;
+    } });
+    var consumer_1 = require_consumer();
+    Object.defineProperty(exports2, "InvalidWorkflowEventError", { enumerable: true, get: function() {
+      return consumer_1.InvalidWorkflowEventError;
+    } });
+    Object.defineProperty(exports2, "UnsupportedEnvelopeVersionError", { enumerable: true, get: function() {
+      return consumer_1.UnsupportedEnvelopeVersionError;
+    } });
+    Object.defineProperty(exports2, "parseWorkflowEvent", { enumerable: true, get: function() {
+      return consumer_1.parseWorkflowEvent;
+    } });
+    var dedup_1 = require_dedup();
+    Object.defineProperty(exports2, "WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS", { enumerable: true, get: function() {
+      return dedup_1.WORKFLOW_DEDUP_DEFAULT_TTL_SECONDS;
+    } });
+    Object.defineProperty(exports2, "WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH", { enumerable: true, get: function() {
+      return dedup_1.WORKFLOW_DEDUP_MAX_CONSUMER_NAME_LENGTH;
+    } });
+    Object.defineProperty(exports2, "WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR", { enumerable: true, get: function() {
+      return dedup_1.WORKFLOW_DEDUP_TABLE_NAME_ENV_VAR;
+    } });
+    Object.defineProperty(exports2, "WorkflowDedupInvalidInputError", { enumerable: true, get: function() {
+      return dedup_1.WorkflowDedupInvalidInputError;
+    } });
+    Object.defineProperty(exports2, "WorkflowDedupTableNameMissingError", { enumerable: true, get: function() {
+      return dedup_1.WorkflowDedupTableNameMissingError;
+    } });
+    Object.defineProperty(exports2, "encodeSortKey", { enumerable: true, get: function() {
+      return dedup_1.encodeSortKey;
+    } });
+    Object.defineProperty(exports2, "markFailed", { enumerable: true, get: function() {
+      return dedup_1.markFailed;
+    } });
+    Object.defineProperty(exports2, "recordIfAbsent", { enumerable: true, get: function() {
+      return dedup_1.recordIfAbsent;
+    } });
+    Object.defineProperty(exports2, "workflowDedupClient", { enumerable: true, get: function() {
+      return dedup_1.workflowDedupClient;
+    } });
+  }
+});
+
+// src/workflows/control-plane/counter-reconciliation/counter-reconciliation.handler.ts
+var counter_reconciliation_handler_exports = {};
+__export(counter_reconciliation_handler_exports, {
+  handler: () => handler,
+  runCounterReconciliation: () => runCounterReconciliation
+});
+module.exports = __toCommonJS(counter_reconciliation_handler_exports);
+
+// src/data/dynamo/dynamo-control-service.ts
+var import_electrodb14 = require("electrodb");
+
+// src/data/dynamo/dynamo-client.ts
+var import_client_dynamodb = require("@aws-sdk/client-dynamodb");
+var defaultTableName = process.env.DYNAMO_TABLE_NAME ?? "jesttesttable";
+var dynamoClient = new import_client_dynamodb.DynamoDBClient({
+  ...process.env.MOCK_DYNAMODB_ENDPOINT && {
+    endpoint: process.env.MOCK_DYNAMODB_ENDPOINT,
+    sslEnabled: false,
+    region: "local"
+  }
+});
+
+// src/data/dynamo/entities/control/configuration-entity.ts
+var import_electrodb = require("electrodb");
+
+// src/data/dynamo/entities/control/control-entity-common.ts
+var import_types = require("@openhi/types");
+
+// src/data/dynamo/shard.ts
+var SHARD_COUNT = 4;
+function computeShard(id) {
+  let hash = 2166136261;
+  for (let i = 0; i < id.length; i++) {
+    hash ^= id.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0) % SHARD_COUNT;
+}
+
+// src/data/dynamo/entities/control/control-entity-common.ts
+var gsi1ShardAttribute = {
+  type: "string",
+  watch: ["id"],
+  set: (_val, item) => {
+    if (typeof item?.id !== "string" || item.id.length === 0) {
+      return void 0;
+    }
+    return String(computeShard(item.id));
+  }
+};
+var gsi1skAttribute = {
+  type: "string",
+  watch: ["resource", "lastUpdated", "id"],
+  set: (_val, item) => {
+    const id = typeof item?.id === "string" ? item.id : "";
+    const lastUpdated = typeof item?.lastUpdated === "string" ? item.lastUpdated : "";
+    const fallback = `${lastUpdated}#${id}`;
+    if (typeof item?.resource !== "string" || item.resource.length === 0) {
+      return fallback;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(item.resource);
+    } catch {
+      return fallback;
+    }
+    if (!parsed || typeof parsed !== "object") return fallback;
+    const resourceType = parsed.resourceType;
+    if (typeof resourceType !== "string") return fallback;
+    const label = (0, import_types.extractLabel)(parsed);
+    return label !== void 0 ? `${label}#${id}` : fallback;
+  }
+};
+function extractRoleId(resource) {
+  const flat = resource.roleId;
+  if (typeof flat === "string" && flat.length > 0) return flat;
+  const role = resource.role;
+  if (role && typeof role === "object") {
+    const reference = role.reference;
+    if (typeof reference === "string" && reference.length > 0) {
+      const slash = reference.lastIndexOf("/");
+      const tail = slash >= 0 ? reference.slice(slash + 1) : reference;
+      if (tail.length > 0) return tail;
+    }
+  }
+  return void 0;
+}
+var roleAssignmentGsi1skAttribute = {
+  type: "string",
+  watch: ["resource", "denormalizedUserName", "lastUpdated", "id"],
+  set: (_val, item) => {
+    const id = typeof item?.id === "string" ? item.id : "";
+    const lastUpdated = typeof item?.lastUpdated === "string" ? item.lastUpdated : "";
+    const fallback = `${lastUpdated}#${id}`;
+    if (typeof item?.resource !== "string" || item.resource.length === 0) {
+      return fallback;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(item.resource);
+    } catch {
+      return fallback;
+    }
+    if (!parsed || typeof parsed !== "object") return fallback;
+    const roleId = extractRoleId(parsed);
+    if (roleId === void 0) return fallback;
+    const denormalizedUserName = typeof item.denormalizedUserName === "string" ? item.denormalizedUserName : "";
+    const normalizedUserName = denormalizedUserName.length > 0 ? (0, import_types.normalizeLabel)(denormalizedUserName) : "";
+    if (normalizedUserName.length === 0) return fallback;
+    return `${roleId}#${normalizedUserName}#${id}`;
+  }
+};
+var membershipGsi1skAttribute = {
+  type: "string",
+  watch: ["denormalizedUserName", "lastUpdated", "id"],
+  set: (_val, item) => {
+    const id = typeof item?.id === "string" ? item.id : "";
+    const lastUpdated = typeof item?.lastUpdated === "string" ? item.lastUpdated : "";
+    const fallback = `${lastUpdated}#${id}`;
+    const denormalizedUserName = typeof item?.denormalizedUserName === "string" ? item.denormalizedUserName : "";
+    const normalizedUserName = denormalizedUserName.length > 0 ? (0, import_types.normalizeLabel)(denormalizedUserName) : "";
+    if (normalizedUserName.length === 0) {
+      return fallback;
+    }
+    return `${normalizedUserName}#${id}`;
+  }
+};
+
+// src/data/dynamo/entities/control/configuration-entity.ts
+var ConfigurationEntity = new import_electrodb.Entity({
+  model: {
+    entity: "configuration",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /** Sort key. "CURRENT" for current version; version history in S3. */
+    sk: {
+      type: "string",
+      required: true,
+      default: "CURRENT"
+    },
+    /** Tenant scope. Use "BASELINE" when the config is baseline default (no tenant). */
+    tenantId: {
+      type: "string",
+      required: true,
+      default: "BASELINE"
+    },
+    /** Workspace scope. Use "-" when absent. */
+    workspaceId: {
+      type: "string",
+      required: true,
+      default: "-"
+    },
+    /** User scope. Use "-" when absent. */
+    userId: {
+      type: "string",
+      required: true,
+      default: "-"
+    },
+    /** Role scope. Use "-" when absent. */
+    roleId: {
+      type: "string",
+      required: true,
+      default: "-"
+    },
+    /** Config type (category), e.g. endpoints, branding, display. */
+    key: {
+      type: "string",
+      required: true
+    },
+    /** FHIR Resource.id; logical id in URL and for the Configuration resource. */
+    id: {
+      type: "string",
+      required: true
+    },
+    /** Payload as JSON string. JSON.stringify(resource) on write; JSON.parse(item.resource) on read. */
+    resource: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id, key, status).
+     * Populated on every write via extractSummary(resource); GSI1 INCLUDE surfaces it on lists.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id (e.g. ULID). Tracks current version; S3 history key. */
+    vid: {
+      type: "string",
+      required: true
+    },
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    gsi1Shard: gsi1ShardAttribute,
+    deleted: {
+      type: "boolean",
+      required: false
+    },
+    bundleId: {
+      type: "string",
+      required: false
+    },
+    msgId: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /** Base table: PK, SK (data store key names). PK is built from tenantId, workspaceId, userId, roleId; SK is built from key and sk. Do not supply PK or SK from outside. */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["tenantId", "workspaceId", "userId", "roleId"],
+        template: "CONFIG#TID#${tenantId}#WID#${workspaceId}#UID#${userId}#RID#${roleId}"
+      },
+      sk: {
+        field: "SK",
+        composite: ["key", "sk"],
+        template: "KEY#${key}#SK#${sk}"
+      }
+    },
+    /**
+     * GSI1 — Unified Sharded List per ADR-011: list all Configuration entries for a
+     * (tenant, workspace) across the four shards. Use for "list configs scoped to this tenant"
+     * (workspaceId = "-") or "list configs scoped to this workspace". Does not support
+     * hierarchical resolution in one query; use base table GetItem in fallback order
+     * (user → workspace → tenant → baseline) for that.
+     * SK is `<key>#<id>` — Configuration's `key` is a required entity attribute (the
+     * config category: endpoints, branding, display, …) and the natural sort/lookup
+     * dimension. `casing: "none"` preserves the literal key value.
+     */
+    gsi1: {
+      index: "GSI1",
+      pk: {
+        field: "GSI1PK",
+        composite: ["tenantId", "workspaceId", "gsi1Shard"],
+        template: "TID#${tenantId}#WID#${workspaceId}#RT#Configuration#SHARD#${gsi1Shard}"
+      },
+      sk: {
+        field: "GSI1SK",
+        casing: "none",
+        composite: ["key", "id"],
+        template: "${key}#${id}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/configuration-user-projection-entity.ts
+var import_electrodb2 = require("electrodb");
+var ConfigurationUserProjectionEntity = new import_electrodb2.Entity({
+  model: {
+    entity: "configurationUserProjection",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /**
+     * User partition discriminator. Renders as `USER#ID#<userId>` on the
+     * base-table PK. Always required — the projection has no meaning
+     * outside a user partition.
+     */
+    userId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Pre-composed sort key — built by the operations-layer projection
+     * writer via `buildConfigurationUserProjectionSk`. The entity stores
+     * the value verbatim so the SK grammar (pattern #10 user-scope) is
+     * owned by the operations layer, not duplicated here.
+     */
+    sk: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Configuration canonical-record id. Stored as a discriminating
+     * field so consumers can hydrate the canonical row via the
+     * Configuration get-by-id operation when the projection's `summary`
+     * is insufficient.
+     */
+    configurationId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Tenant the Configuration is associated with. The canonical row
+     * keys off `(tenantId, workspaceId, userId, roleId)`; the projection
+     * carries `tenantId` so consumers reconstructing the canonical PK
+     * have the tenant segment without a hop.
+     */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Scope marker. Always `"user"` on this projection — recorded
+     * explicitly so future scope-bearing projections (workspace,
+     * tenant, role) can share filter semantics in a unified
+     * cross-projection list query if one ever lands.
+     */
+    scope: {
+      type: "string",
+      required: true,
+      default: "user"
+    },
+    /**
+     * Configuration's `key` attribute (config category, e.g. endpoints,
+     * branding, display). Mirrored from the canonical row so consumers
+     * reading the projection get the natural display label without a
+     * BatchGet hop. Doubles as the source of `<normalizedConfigName>` in
+     * the SK.
+     */
+    displayName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Summary projection (key display fields as JSON string) — mirrored
+     * from the canonical Configuration row so user-partition queries do
+     * not need a BatchGet hop.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id mirrored from the canonical Configuration row. */
+    vid: {
+      type: "string",
+      required: true
+    },
+    /** Last-updated timestamp mirrored from the canonical Configuration row. */
+    lastUpdated: {
+      type: "string",
+      required: true
+    }
+  },
+  indexes: {
+    /**
+     * Base table: PK = USER#ID#\<userId\>, SK = operation-supplied. A
+     * single `Query(PK = USER#ID#<userId>, SK begins_with 'CONFIGURATION#')`
+     * returns the user's user-scoped Configurations sorted by
+     * `<normalizedConfigName>` (then `<configurationId>` as the
+     * tiebreaker).
+     */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["userId"],
+        template: "USER#ID#${userId}"
+      },
+      sk: {
+        field: "SK",
+        casing: "none",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/configuration-workspace-projection-entity.ts
+var import_electrodb3 = require("electrodb");
+var ConfigurationWorkspaceProjectionEntity = new import_electrodb3.Entity({
+  model: {
+    entity: "configurationWorkspaceProjection",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /**
+     * Tenant the workspace belongs to. Renders as the leading segment
+     * of the base-table PK. Always required — the workspace partition
+     * is tenant-scoped per ADR-011.
+     */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Workspace partition discriminator. Renders as the trailing
+     * segment of the base-table PK
+     * (`TID#<tenantId>#WORKSPACE#ID#<workspaceId>`). Always required —
+     * the projection has no meaning outside a workspace partition.
+     */
+    workspaceId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Pre-composed sort key — built by the operations-layer projection
+     * writer via `buildConfigurationWorkspaceProjectionSk`. The entity
+     * stores the value verbatim so the SK grammar (pattern #10
+     * workspace-scope) is owned by the operations layer, not
+     * duplicated here.
+     */
+    sk: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Configuration canonical-record id. Stored as a discriminating
+     * field so consumers can hydrate the canonical row via the
+     * Configuration get-by-id operation when the projection's `summary`
+     * is insufficient.
+     */
+    configurationId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Scope marker. Always `"workspace"` on this projection — recorded
+     * explicitly so future scope-bearing projections (user, tenant,
+     * role) can share filter semantics in a unified cross-projection
+     * list query if one ever lands.
+     */
+    scope: {
+      type: "string",
+      required: true,
+      default: "workspace"
+    },
+    /**
+     * Configuration's `key` attribute (config category, e.g. endpoints,
+     * branding, display). Mirrored from the canonical row so consumers
+     * reading the projection get the natural display label without a
+     * BatchGet hop. Doubles as the source of `<normalizedConfigName>`
+     * in the SK.
+     */
+    displayName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Summary projection (key display fields as JSON string) — mirrored
+     * from the canonical Configuration row so workspace-partition
+     * queries do not need a BatchGet hop.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id mirrored from the canonical Configuration row. */
+    vid: {
+      type: "string",
+      required: true
+    },
+    /** Last-updated timestamp mirrored from the canonical Configuration row. */
+    lastUpdated: {
+      type: "string",
+      required: true
+    }
+  },
+  indexes: {
+    /**
+     * Base table: PK = TID#<tenantId>#WORKSPACE#ID#<workspaceId>,
+     * SK = operation-supplied. A single
+     * `Query(PK = TID#<tenantId>#WORKSPACE#ID#<workspaceId>, SK begins_with 'CONFIGURATION#')`
+     * returns the workspace's workspace-scoped Configurations sorted by
+     * `<normalizedConfigName>` (then `<configurationId>` as the
+     * tiebreaker).
+     */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["tenantId", "workspaceId"],
+        template: "TID#${tenantId}#WORKSPACE#ID#${workspaceId}"
+      },
+      sk: {
+        field: "SK",
+        casing: "none",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/membership-entity.ts
+var import_electrodb4 = require("electrodb");
+var MembershipEntity = new import_electrodb4.Entity({
+  model: {
+    entity: "membership",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /** Sort key sentinel. Always "CURRENT". */
+    sk: {
+      type: "string",
+      required: true,
+      default: "CURRENT"
+    },
+    /** Tenant in which the user has membership (required). */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /** FHIR Resource.id; membership id. */
+    id: {
+      type: "string",
+      required: true
+    },
+    /** Full Membership resource serialized as JSON string. */
+    resource: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id, displayName, status).
+     * Populated on every write via extractSummary(resource); GSI1 INCLUDE surfaces it on lists.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id (e.g. ULID). */
+    vid: {
+      type: "string",
+      required: true
+    },
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    gsi1Shard: gsi1ShardAttribute,
+    /**
+     * Derived GSI1 sort key — `<normalizedUserName>#<id>` per ADR-018
+     * pattern #1 so a GSI1 query partitioned on the tenant range-scans
+     * by user-name prefix and returns memberships sorted by user name.
+     * Falls back to `<lastUpdated>#<id>` when `denormalizedUserName`
+     * is missing.
+     */
+    gsi1sk: membershipGsi1skAttribute,
+    deleted: {
+      type: "boolean",
+      required: false
+    },
+    bundleId: {
+      type: "string",
+      required: false
+    },
+    msgId: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized `linked-data-identity` Reference (e.g. `Practitioner/abc`).
+     * Populated from the FHIR extension on the Membership resource at write
+     * time so future GSIs can index data-plane identity lookups without
+     * deserializing the full resource JSON. See ADR 2026-03-13-02 §6.
+     */
+    linkedDataIdentityRef: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized display name of the linked Tenant, captured at row
+     * last-write time. Promoted to a top-level attribute so the ADR-018
+     * adjacency-list projection SKs (pattern #3 — `MEMBERSHIP#TENANT#<normalizedTenantName>#…`)
+     * can be composed from a top-level field instead of digging into the
+     * `resource` JSON. Optional on the schema so pre-TR-024 rows do not
+     * break; the operations-layer multi-write helper (#1010) makes the
+     * field load-bearing at write time per TR-024 rule 2 (write-time
+     * source = canonical Tenant.displayName).
+     * @see TR-024 — Denormalized display-name attributes
+     */
+    denormalizedTenantName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized display name of the linked User, captured at row
+     * last-write time. Promoted to a top-level attribute so the ADR-018
+     * adjacency-list canonical-record GSI1SK (pattern #1 —
+     * `<normalizedUserName>#<id>`) and workspace-projection SK (pattern #2)
+     * can be composed from a top-level field. Optional on the schema so
+     * pre-TR-024 rows do not break; the operations-layer multi-write helper
+     * (#1010) makes the field load-bearing at write time per TR-024 rule 2
+     * (write-time source = canonical User.displayName).
+     * @see TR-024 — Denormalized display-name attributes
+     */
+    denormalizedUserName: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /** Base table: PK = TID#<tenantId>#MEMBERSHIP#ID#<id>, SK = CURRENT. Do not supply PK or SK from outside. */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["tenantId", "id"],
+        template: "TID#${tenantId}#MEMBERSHIP#ID#${id}"
+      },
+      sk: {
+        field: "SK",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    },
+    /**
+     * GSI1 — Unified Sharded List per ADR-011: list all Memberships for a tenant across the
+     * four shards. Membership is tenant-scoped only, so `WID#-` is a sentinel.
+     * SK is derived via `membershipGsi1skAttribute` — composes
+     * `<normalizedUserName>#<id>` per ADR-018 pattern #1 (users in a
+     * tenant, sorted by user name); falls back to `<lastUpdated>#<id>`
+     * when `denormalizedUserName` is missing. `casing: "none"` preserves
+     * the normalized label and ISO-8601 `T`/`Z`.
+     */
+    gsi1: {
+      index: "GSI1",
+      pk: {
+        field: "GSI1PK",
+        composite: ["tenantId", "gsi1Shard"],
+        template: "TID#${tenantId}#WID#-#RT#Membership#SHARD#${gsi1Shard}"
+      },
+      sk: {
+        field: "GSI1SK",
+        casing: "none",
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/membership-user-projection-entity.ts
+var import_electrodb5 = require("electrodb");
+var MembershipUserProjectionEntity = new import_electrodb5.Entity({
+  model: {
+    entity: "membershipUserProjection",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /**
+     * User partition discriminator. Renders as `USER#ID#<userId>` on the
+     * base-table PK. Always required — the projection has no meaning
+     * outside a user partition.
+     */
+    userId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Pre-composed sort key — built by the operations-layer projection
+     * writer via `buildMembershipUserProjectionSk*` helpers. The entity
+     * stores the value verbatim so the SK grammar (patterns #3 and #4)
+     * is owned by the operations layer, not duplicated here.
+     */
+    sk: {
+      type: "string",
+      required: true
+    },
+    /** Tenant in which the membership applies. Always required. */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Workspace the membership scopes to. Present iff the projection
+     * row is a pattern-#4 workspace sub-lane row; absent for pattern-#3
+     * tenant sub-lane rows.
+     */
+    workspaceId: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Membership canonical-record id. Stored as a discriminating field
+     * so consumers can hydrate the canonical row via
+     * `MembershipEntity.get({ tenantId, id: membershipId })` when the
+     * projection's `summary` is insufficient.
+     */
+    membershipId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id,
+     * displayName, status) — mirrored from the canonical Membership row
+     * so user-partition queries do not need a BatchGet hop.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id mirrored from the canonical Membership row. */
+    vid: {
+      type: "string",
+      required: true
+    },
+    /** Last-updated timestamp mirrored from the canonical Membership row. */
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Denormalized Tenant display name — required to compose pattern-#3
+     * SK (`MEMBERSHIP#TENANT#<normalizedTenantName>#…`). Optional on the
+     * schema because pre-TR-024 rows may not carry a display name; the
+     * operations layer falls back gracefully when missing.
+     */
+    denormalizedTenantName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized User display name — mirrored from the canonical
+     * Membership row per TR-024 rule 3 (canonical-record symmetry).
+     * Carried on the projection so consumers can render the user's
+     * display name without a hop to the User record.
+     */
+    denormalizedUserName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized Workspace display name — required to compose
+     * pattern-#4 SK (`MEMBERSHIP#WORKSPACE#TID#<tenantId>#<normalizedWorkspaceName>#…`).
+     * Optional on the schema (TR-024 § Open Item #4 defers a formal
+     * Workspace-rename cascade); the operations layer falls back to a
+     * sentinel when missing so the SK still has a valid shape.
+     */
+    denormalizedWorkspaceName: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /**
+     * Base table: PK = USER#ID#\<userId\>, SK = operation-supplied.
+     * Both pattern #3 and pattern #4 use this same index — the SK string
+     * encodes the lane discriminator (`MEMBERSHIP#TENANT#…` vs
+     * `MEMBERSHIP#WORKSPACE#…`) so a single
+     * `Query(PK = USER#ID#<userId>, SK begins_with 'MEMBERSHIP#')`
+     * returns both lanes interleaved.
+     */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["userId"],
+        template: "USER#ID#${userId}"
+      },
+      sk: {
+        field: "SK",
+        casing: "none",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/membership-workspace-projection-entity.ts
+var import_electrodb6 = require("electrodb");
+var MembershipWorkspaceProjectionEntity = new import_electrodb6.Entity({
+  model: {
+    entity: "membershipWorkspaceProjection",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /**
+     * Tenant the workspace belongs to. Renders as the leading segment
+     * of the base-table PK. Always required — the workspace partition
+     * is tenant-scoped per ADR-011.
+     */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Workspace partition discriminator. Renders as the trailing
+     * segment of the base-table PK
+     * (`TID#<tenantId>#WORKSPACE#ID#<workspaceId>`). Always required —
+     * the projection has no meaning outside a workspace partition.
+     */
+    workspaceId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Pre-composed sort key — built by the operations-layer projection
+     * writer via `buildMembershipWorkspaceProjectionSk`. The entity
+     * stores the value verbatim so the SK grammar (pattern #2) is
+     * owned by the operations layer, not duplicated here.
+     */
+    sk: {
+      type: "string",
+      required: true
+    },
+    /**
+     * User the membership links. Stored as a discriminating field so
+     * consumers can hydrate the canonical User row via
+     * `UserEntity.get({ id: userId, sk: "CURRENT" })` when the
+     * projection's `summary` is insufficient.
+     */
+    userId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Membership canonical-record id. Stored as a discriminating field
+     * so consumers can hydrate the canonical row via
+     * `MembershipEntity.get({ tenantId, id: membershipId })` when the
+     * projection's `summary` is insufficient.
+     */
+    membershipId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id,
+     * displayName, status) — mirrored from the canonical Membership row
+     * so workspace-partition queries do not need a BatchGet hop.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id mirrored from the canonical Membership row. */
+    vid: {
+      type: "string",
+      required: true
+    },
+    /** Last-updated timestamp mirrored from the canonical Membership row. */
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Denormalized User display name — required to compose the
+     * pattern-#2 SK (`MEMBERSHIP#<normalizedUserName>#…`). Optional on
+     * the schema because pre-TR-024 rows may not carry a display name;
+     * the operations layer falls back to a sentinel when missing so
+     * the SK still has a valid shape. The TR-023 rename-cascade
+     * pipeline rewrites the SK on a User rename.
+     */
+    denormalizedUserName: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /**
+     * Base table: PK = TID#<tenantId>#WORKSPACE#ID#<workspaceId>,
+     * SK = operation-supplied. Pattern #2 uses this index — the SK
+     * encodes the entity-type prefix (`MEMBERSHIP#…`) so a
+     * `Query(PK = TID#<tenantId>#WORKSPACE#ID#<workspaceId>, SK begins_with 'MEMBERSHIP#')`
+     * returns every member projection for the workspace in normalized-
+     * user-name sort order.
+     */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["tenantId", "workspaceId"],
+        template: "TID#${tenantId}#WORKSPACE#ID#${workspaceId}"
+      },
+      sk: {
+        field: "SK",
+        casing: "none",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/role-entity.ts
+var import_electrodb7 = require("electrodb");
+var RoleEntity = new import_electrodb7.Entity({
+  model: {
+    entity: "role",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /** Sort key sentinel. Always "CURRENT". */
+    sk: {
+      type: "string",
+      required: true,
+      default: "CURRENT"
+    },
+    /** FHIR Resource.id; role id. */
+    id: {
+      type: "string",
+      required: true
+    },
+    /** Full Role resource serialized as JSON string. */
+    resource: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id, displayName, status).
+     * Populated on every write via extractSummary(resource); GSI1 INCLUDE surfaces it on lists.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id (e.g. ULID). */
+    vid: {
+      type: "string",
+      required: true
+    },
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
+    deleted: {
+      type: "boolean",
+      required: false
+    },
+    bundleId: {
+      type: "string",
+      required: false
+    },
+    msgId: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /** Base table: PK = ROLE#ID#<id>, SK = CURRENT. Do not supply PK or SK from outside. */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["id"],
+        template: "ROLE#ID#${id}"
+      },
+      sk: {
+        field: "SK",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    },
+    /**
+     * GSI1 — Unified Sharded List per ADR-011: list all Roles across the four shards.
+     * Non-tenant-isolated, so `TID#-#WID#-` sentinels precede `RT#Role#SHARD#<n>`.
+     * SK is derived via `gsi1skAttribute` — uses the resource's natural label when
+     * extractable, else `<lastUpdated>#<id>` (DR-004). `casing: "none"` preserves the
+     * normalized label and ISO-8601 `T`/`Z`.
+     */
+    gsi1: {
+      index: "GSI1",
+      pk: {
+        field: "GSI1PK",
+        composite: ["gsi1Shard"],
+        template: "TID#-#WID#-#RT#Role#SHARD#${gsi1Shard}"
+      },
+      sk: {
+        field: "GSI1SK",
+        casing: "none",
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/roleassignment-entity.ts
+var import_electrodb8 = require("electrodb");
+var RoleAssignmentEntity = new import_electrodb8.Entity({
+  model: {
+    entity: "roleassignment",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /** Sort key sentinel. Always "CURRENT". */
+    sk: {
+      type: "string",
+      required: true,
+      default: "CURRENT"
+    },
+    /** Tenant in which the role assignment applies (required). */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /** FHIR Resource.id; role assignment id. */
+    id: {
+      type: "string",
+      required: true
+    },
+    /** Full RoleAssignment resource serialized as JSON string. */
+    resource: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id, displayName, status).
+     * Populated on every write via extractSummary(resource); GSI1 INCLUDE surfaces it on lists.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id (e.g. ULID). */
+    vid: {
+      type: "string",
+      required: true
+    },
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    gsi1Shard: gsi1ShardAttribute,
+    /**
+     * Derived GSI1 sort key — discriminator-first
+     * `<roleId>#<normalizedUserName>#<id>` per ADR-018 pattern #8 so a
+     * GSI1 query partitioned on the tenant can `begins_with('<roleId>#')`
+     * to enumerate every user assigned to a given role, sorted by user
+     * name. Falls back to `<lastUpdated>#<id>` when either component is
+     * missing.
+     */
+    gsi1sk: roleAssignmentGsi1skAttribute,
+    deleted: {
+      type: "boolean",
+      required: false
+    },
+    bundleId: {
+      type: "string",
+      required: false
+    },
+    msgId: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized display name of the linked Tenant, captured at row
+     * last-write time. Promoted to a top-level attribute so the ADR-018
+     * adjacency-list user-projection SK (pattern #5 —
+     * `ROLEASSIGNMENT#TENANT#<normalizedRoleName>#<roleId>#TID#<tenantId>#<id>`)
+     * can be composed from a top-level field instead of digging into the
+     * `resource` JSON. Optional on the schema so pre-TR-024 rows do not
+     * break; the operations-layer multi-write helper (#1010) makes the
+     * field load-bearing at write time per TR-024 rule 2 (write-time
+     * source = canonical Tenant.displayName).
+     * @see TR-024 — Denormalized display-name attributes
+     */
+    denormalizedTenantName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized display name of the linked User, captured at row
+     * last-write time. Promoted to a top-level attribute so the ADR-018
+     * adjacency-list canonical-record GSI1SK (pattern #8 —
+     * `<roleId>#<normalizedUserName>#<id>`) and workspace-projection SK
+     * (pattern #9) can be composed from a top-level field. Optional on
+     * the schema so pre-TR-024 rows do not break; the operations-layer
+     * multi-write helper (#1010) makes the field load-bearing at write
+     * time per TR-024 rule 2 (write-time source = canonical
+     * User.displayName).
+     * @see TR-024 — Denormalized display-name attributes
+     */
+    denormalizedUserName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized display name of the linked Role, captured at row
+     * last-write time. Promoted to a top-level attribute so the ADR-018
+     * adjacency-list user-projection SK (pattern #5 —
+     * `ROLEASSIGNMENT#TENANT#<normalizedRoleName>#…`) can be composed from
+     * a top-level field. Optional on the schema so pre-TR-024 rows do not
+     * break; the operations-layer multi-write helper (#1010) makes the
+     * field load-bearing at write time per TR-024 rule 2 (write-time
+     * source = canonical Role.displayName).
+     * @see TR-024 — Denormalized display-name attributes
+     */
+    denormalizedRoleName: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /** Base table: PK = TID#<tenantId>#ROLEASSIGNMENT#ID#<id>, SK = CURRENT. Do not supply PK or SK from outside. */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["tenantId", "id"],
+        template: "TID#${tenantId}#ROLEASSIGNMENT#ID#${id}"
+      },
+      sk: {
+        field: "SK",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    },
+    /**
+     * GSI1 — Unified Sharded List per ADR-011: list all RoleAssignments for a tenant across the
+     * four shards. Tenant-scoped only, so `WID#-` is a sentinel.
+     * SK is derived via `roleAssignmentGsi1skAttribute` — composes the
+     * discriminator-first `<roleId>#<normalizedUserName>#<id>` shape per
+     * ADR-018 pattern #8 (users with a specific role in a tenant, sorted
+     * by user name); falls back to `<lastUpdated>#<id>` when either
+     * component is missing. `casing: "none"` preserves the normalized
+     * label and ISO-8601 `T`/`Z`.
+     */
+    gsi1: {
+      index: "GSI1",
+      pk: {
+        field: "GSI1PK",
+        composite: ["tenantId", "gsi1Shard"],
+        template: "TID#${tenantId}#WID#-#RT#RoleAssignment#SHARD#${gsi1Shard}"
+      },
+      sk: {
+        field: "GSI1SK",
+        casing: "none",
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/roleassignment-user-projection-entity.ts
+var import_electrodb9 = require("electrodb");
+var RoleAssignmentUserProjectionEntity = new import_electrodb9.Entity({
+  model: {
+    entity: "roleAssignmentUserProjection",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /**
+     * User partition discriminator. Renders as `USER#ID#<userId>` on the
+     * base-table PK. Always required — the projection has no meaning
+     * outside a user partition.
+     */
+    userId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Pre-composed sort key — built by the operations-layer projection
+     * writer via `buildRoleAssignmentUserProjectionSk*` helpers. The
+     * entity stores the value verbatim so the SK grammar (tenant-lane
+     * vs workspace-lane) is owned by the operations layer, not
+     * duplicated here.
+     */
+    sk: {
+      type: "string",
+      required: true
+    },
+    /** Tenant in which the role assignment applies. Always required. */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Workspace the role assignment scopes to. Present iff the
+     * projection row is the workspace-level sub-lane; absent for
+     * tenant-level sub-lane rows.
+     */
+    workspaceId: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Role the assignment grants. Stored as a discriminating field so
+     * `Query(PK = USER#ID#<userId>, SK begins_with 'ROLEASSIGNMENT#…')`
+     * results carry the role id without a hop to the canonical row.
+     */
+    roleId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * RoleAssignment canonical-record id. Stored as a discriminating
+     * field so consumers can hydrate the canonical row via
+     * `RoleAssignmentEntity.get({ tenantId, id: roleAssignmentId })`
+     * when the projection's `summary` is insufficient.
+     */
+    roleAssignmentId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id,
+     * displayName, status) — mirrored from the canonical RoleAssignment
+     * row so user-partition queries do not need a BatchGet hop.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id mirrored from the canonical RoleAssignment row. */
+    vid: {
+      type: "string",
+      required: true
+    },
+    /** Last-updated timestamp mirrored from the canonical RoleAssignment row. */
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Denormalized Tenant display name — mirrored from the canonical
+     * RoleAssignment row per TR-024 rule 3 (canonical-record symmetry).
+     * Optional on the schema because pre-TR-024 rows may not carry a
+     * display name; the operations layer falls back gracefully when
+     * missing.
+     */
+    denormalizedTenantName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized User display name — mirrored from the canonical
+     * RoleAssignment row per TR-024 rule 3 (canonical-record symmetry).
+     * Carried on the projection so consumers can render the user's
+     * display name without a hop to the User record.
+     */
+    denormalizedUserName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized Role display name — required to compose the SK's
+     * `<normalizedRoleName>` segment. Optional on the schema (pre-TR-024
+     * rows fall back to a sentinel) but expected to be present at write
+     * time per TR-024 rule 2 (write-time source =
+     * canonical Role.displayName).
+     */
+    denormalizedRoleName: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /**
+     * Base table: PK = USER#ID#\<userId\>, SK = operation-supplied. Both
+     * sub-lanes (tenant-level and workspace-level) use this same index —
+     * the SK string encodes the lane discriminator
+     * (`ROLEASSIGNMENT#TENANT#…` vs `ROLEASSIGNMENT#WORKSPACE#…`) so a
+     * single `Query(PK = USER#ID#<userId>, SK begins_with 'ROLEASSIGNMENT#')`
+     * returns both lanes interleaved.
+     */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["userId"],
+        template: "USER#ID#${userId}"
+      },
+      sk: {
+        field: "SK",
+        casing: "none",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/roleassignment-workspace-projection-entity.ts
+var import_electrodb10 = require("electrodb");
+var RoleAssignmentWorkspaceProjectionEntity = new import_electrodb10.Entity({
+  model: {
+    entity: "roleAssignmentWorkspaceProjection",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /**
+     * Tenant the workspace belongs to. Renders as the leading segment
+     * of the base-table PK. Always required — the workspace partition
+     * is tenant-scoped per ADR-011.
+     */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Workspace partition discriminator. Renders as the trailing
+     * segment of the base-table PK
+     * (`TID#<tenantId>#WORKSPACE#ID#<workspaceId>`). Always required —
+     * the projection has no meaning outside a workspace partition.
+     */
+    workspaceId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Pre-composed sort key — built by the operations-layer projection
+     * writer via `buildRoleAssignmentWorkspaceProjectionSk`. The entity
+     * stores the value verbatim so the SK grammar (pattern #9) is
+     * owned by the operations layer, not duplicated here.
+     */
+    sk: {
+      type: "string",
+      required: true
+    },
+    /**
+     * User the role assignment grants the role to. Stored as a
+     * discriminating field so consumers can hydrate the canonical User
+     * row via `UserEntity.get({ id: userId, sk: "CURRENT" })` when the
+     * projection's `summary` is insufficient.
+     */
+    userId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Role the assignment grants. Stored as a discriminating field —
+     * also rendered into the SK as the discriminator-first segment so
+     * `begins_with('ROLEASSIGNMENT#<roleId>#')` filters one role.
+     */
+    roleId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * RoleAssignment canonical-record id. Stored as a discriminating
+     * field so consumers can hydrate the canonical row via
+     * `RoleAssignmentEntity.get({ tenantId, id: roleAssignmentId })`
+     * when the projection's `summary` is insufficient.
+     */
+    roleAssignmentId: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id,
+     * displayName, status) — mirrored from the canonical RoleAssignment
+     * row so workspace-partition queries do not need a BatchGet hop.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id mirrored from the canonical RoleAssignment row. */
+    vid: {
+      type: "string",
+      required: true
+    },
+    /** Last-updated timestamp mirrored from the canonical RoleAssignment row. */
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Denormalized User display name — required to compose the
+     * pattern-#9 SK (`ROLEASSIGNMENT#<roleId>#<normalizedUserName>#…`).
+     * Optional on the schema because pre-TR-024 rows may not carry a
+     * display name; the operations layer falls back to a sentinel when
+     * missing so the SK still has a valid shape. The TR-023 rename-
+     * cascade pipeline rewrites the SK on a User rename.
+     */
+    denormalizedUserName: {
+      type: "string",
+      required: false
+    },
+    /**
+     * Denormalized Role display name — mirrored from the canonical
+     * RoleAssignment row per TR-024 rule 3 (canonical-record symmetry).
+     * Carried on the projection so consumers can render the role's
+     * display name without a hop to the Role record. Not part of the
+     * SK (pattern #9 sorts on `<normalizedUserName>`, not role name) —
+     * a Role rename does NOT rewrite this SK.
+     */
+    denormalizedRoleName: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /**
+     * Base table: PK = TID#<tenantId>#WORKSPACE#ID#<workspaceId>,
+     * SK = operation-supplied. Pattern #9 uses this index — the SK
+     * encodes the entity-type prefix and discriminator-first roleId
+     * (`ROLEASSIGNMENT#<roleId>#…`) so
+     * `Query(PK = TID#<tenantId>#WORKSPACE#ID#<workspaceId>, SK begins_with 'ROLEASSIGNMENT#<roleId>#')`
+     * returns every user-assignment for that role in the workspace, sorted
+     * by normalized user name.
+     */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["tenantId", "workspaceId"],
+        template: "TID#${tenantId}#WORKSPACE#ID#${workspaceId}"
+      },
+      sk: {
+        field: "SK",
+        casing: "none",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/tenant-entity.ts
+var import_electrodb11 = require("electrodb");
+var TenantEntity = new import_electrodb11.Entity({
+  model: {
+    entity: "tenant",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /** Sort key sentinel. Always "CURRENT". */
+    sk: {
+      type: "string",
+      required: true,
+      default: "CURRENT"
+    },
+    /** The tenant's own id (= resource id). Drives the partition key. */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /** FHIR Resource.id; logical id in URL. Equals tenantId. */
+    id: {
+      type: "string",
+      required: true
+    },
+    /** Full Tenant resource serialized as JSON string. */
+    resource: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id, displayName, status).
+     * Populated on every write via extractSummary(resource); GSI1 INCLUDE surfaces it on lists.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id (e.g. ULID). */
+    vid: {
+      type: "string",
+      required: true
+    },
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    /**
+     * ADR-028 denormalized counter — number of tenant-scoped Memberships
+     * (users) in this tenant. Maintained by the counter-maintenance
+     * consumer via atomic ADD; absent/0 until first event or reconciliation.
+     */
+    usersInTenant: {
+      type: "number",
+      required: false
+    },
+    /**
+     * ADR-028 denormalized counter — number of Workspaces in this tenant.
+     * Maintained by the counter-maintenance consumer via atomic ADD;
+     * absent/0 until first event or reconciliation.
+     */
+    workspacesInTenant: {
+      type: "number",
+      required: false
+    },
+    gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
+    deleted: {
+      type: "boolean",
+      required: false
+    },
+    bundleId: {
+      type: "string",
+      required: false
+    },
+    msgId: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /** Base table: PK = TENANT#ID#<tenantId>, SK = CURRENT. Do not supply PK or SK from outside. */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["tenantId"],
+        template: "TENANT#ID#${tenantId}"
+      },
+      sk: {
+        field: "SK",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    },
+    /**
+     * GSI1 — Unified Sharded List per ADR-011: list all Tenants across the four shards.
+     * Tenant lives at the platform tier (no parent tenant or workspace), so `TID#-#WID#-`
+     * sentinels precede `RT#Tenant#SHARD#<n>`. SK is derived via `gsi1skAttribute` —
+     * `<normalizedName>#<id>` when the resource carries a `name`, else `<lastUpdated>#<id>`
+     * (DR-004). `casing: "none"` preserves the normalized label and ISO-8601 `T`/`Z`.
+     */
+    gsi1: {
+      index: "GSI1",
+      pk: {
+        field: "GSI1PK",
+        composite: ["gsi1Shard"],
+        template: "TID#-#WID#-#RT#Tenant#SHARD#${gsi1Shard}"
+      },
+      sk: {
+        field: "GSI1SK",
+        casing: "none",
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/user-entity.ts
+var import_electrodb12 = require("electrodb");
+var UserEntity = new import_electrodb12.Entity({
+  model: {
+    entity: "user",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /** Sort key sentinel. Always "CURRENT". */
+    sk: {
+      type: "string",
+      required: true,
+      default: "CURRENT"
+    },
+    /** FHIR Resource.id; platform user id (ohi_uid). */
+    id: {
+      type: "string",
+      required: true
+    },
+    /** Full User resource serialized as JSON string. */
+    resource: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id, displayName, status).
+     * Populated on every write via extractSummary(resource); GSI1 INCLUDE surfaces it on lists.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Immutable Cognito-issued `sub` claim. Drives GSI2 (sub-lookup). Optional until the
+     * Post Confirmation Lambda (#770) lands; required thereafter.
+     */
+    cognitoSub: {
+      type: "string",
+      required: false
+    },
+    /** Version id (e.g. ULID). */
+    vid: {
+      type: "string",
+      required: true
+    },
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    /**
+     * ADR-028 denormalized counter — number of tenant-scoped Memberships
+     * (tenants) this user belongs to. Maintained by the
+     * counter-maintenance consumer via atomic ADD; absent/0 until first
+     * event or reconciliation.
+     */
+    tenantsForUser: {
+      type: "number",
+      required: false
+    },
+    /**
+     * ADR-028 denormalized counter — number of workspace-scoped
+     * Memberships (workspaces) this user belongs to. Maintained by the
+     * counter-maintenance consumer via atomic ADD; absent/0 until first
+     * event or reconciliation.
+     */
+    workspacesForUser: {
+      type: "number",
+      required: false
+    },
+    gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
+    deleted: {
+      type: "boolean",
+      required: false
+    },
+    /**
+     * TR-022 / ADR-018 lifecycle state for the cascade pipeline.
+     *
+     * - `active` (or undefined) — normal, readable state.
+     * - `deleting` — intermediate state set synchronously by the
+     *   hard-delete API entry point. The owning-delete cascade state
+     *   machine fans out from this transition (DynamoDB stream →
+     *   `control-plane.owning-delete.v1` → Step Functions). Readers MUST
+     *   short-circuit on `deleting` so partial cascades stay invisible.
+     * - `deleted-failed` — terminal failure state set by the cascade
+     *   finalize Lambda when the cascade run fails irrecoverably.
+     *   Operators recover by re-running the cascade or by direct
+     *   intervention.
+     *
+     * The cascade finalize step deletes the canonical record conditional
+     * on `lifecycleState = "deleting"`; on replay the conditional check
+     * fails and the finalize step treats that as a no-op success.
+     */
+    lifecycleState: {
+      type: ["active", "deleting", "deleted-failed"],
+      required: false
+    },
+    bundleId: {
+      type: "string",
+      required: false
+    },
+    msgId: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /** Base table: PK = USER#ID#<id>, SK = CURRENT. Do not supply PK or SK from outside. */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["id"],
+        template: "USER#ID#${id}"
+      },
+      sk: {
+        field: "SK",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    },
+    /**
+     * GSI1 — Unified Sharded List per ADR-011: list all Users across the four shards.
+     * Non-tenant-isolated, so `TID#-#WID#-` sentinels precede `RT#User#SHARD#<n>`.
+     * SK is derived via `gsi1skAttribute` — uses the resource's natural label when
+     * extractable (string `name`/`title` via introspection), else `<lastUpdated>#<id>`
+     * (DR-004). `casing: "none"` preserves the normalized label and ISO-8601 `T`/`Z`.
+     */
+    gsi1: {
+      index: "GSI1",
+      pk: {
+        field: "GSI1PK",
+        composite: ["gsi1Shard"],
+        template: "TID#-#WID#-#RT#User#SHARD#${gsi1Shard}"
+      },
+      sk: {
+        field: "GSI1SK",
+        casing: "none",
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
+      }
+    },
+    /**
+     * GSI2 — Cognito sub-lookup per ADR-011: resolves the UserEntity from a Cognito `sub` claim.
+     * `condition` skips the index when `cognitoSub` is missing so legacy items without a sub are
+     * not indexed.
+     */
+    gsi2: {
+      index: "GSI2",
+      condition: (attrs) => typeof attrs.cognitoSub === "string" && attrs.cognitoSub.length > 0,
+      pk: {
+        field: "GSI2PK",
+        casing: "none",
+        composite: ["cognitoSub"],
+        template: "USER#SUB#${cognitoSub}"
+      },
+      sk: {
+        field: "GSI2SK",
+        casing: "none",
+        composite: [],
+        template: "CURRENT"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/entities/control/workspace-entity.ts
+var import_electrodb13 = require("electrodb");
+var WorkspaceEntity = new import_electrodb13.Entity({
+  model: {
+    entity: "workspace",
+    service: "control",
+    version: "01"
+  },
+  attributes: {
+    /** Sort key sentinel. Always "CURRENT". */
+    sk: {
+      type: "string",
+      required: true,
+      default: "CURRENT"
+    },
+    /** Tenant that contains this workspace (required). */
+    tenantId: {
+      type: "string",
+      required: true
+    },
+    /** FHIR Resource.id; logical id in URL. */
+    id: {
+      type: "string",
+      required: true
+    },
+    /** Full Workspace resource serialized as JSON string. */
+    resource: {
+      type: "string",
+      required: true
+    },
+    /**
+     * Summary projection (key display fields as JSON string: id, displayName, status).
+     * Populated on every write via extractSummary(resource); GSI1 INCLUDE surfaces it on lists.
+     */
+    summary: {
+      type: "string",
+      required: true
+    },
+    /** Version id (e.g. ULID). */
+    vid: {
+      type: "string",
+      required: true
+    },
+    lastUpdated: {
+      type: "string",
+      required: true
+    },
+    /**
+     * ADR-028 denormalized counter — number of workspace-scoped
+     * Memberships (users) in this workspace. Maintained by the
+     * counter-maintenance consumer via atomic ADD; absent/0 until first
+     * event or reconciliation.
+     */
+    usersInWorkspace: {
+      type: "number",
+      required: false
+    },
+    /**
+     * ADR-028 denormalized counter — number of workspace-scoped
+     * RoleAssignments classified as admin-tier in this workspace.
+     * Maintained by the counter-maintenance consumer via atomic ADD;
+     * absent/0 until first event or reconciliation.
+     */
+    adminUsersInWorkspace: {
+      type: "number",
+      required: false
+    },
+    /**
+     * ADR-028 denormalized counter — number of workspace-scoped
+     * RoleAssignments classified as non-admin in this workspace.
+     * Maintained by the counter-maintenance consumer via atomic ADD;
+     * absent/0 until first event or reconciliation.
+     */
+    normalUsersInWorkspace: {
+      type: "number",
+      required: false
+    },
+    gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
+    deleted: {
+      type: "boolean",
+      required: false
+    },
+    /**
+     * TR-022 / ADR-018 lifecycle state for the cascade pipeline.
+     *
+     * - `active` (or undefined) — normal, readable state.
+     * - `deleting` — intermediate state set synchronously by the
+     *   hard-delete API entry point. The owning-delete cascade state
+     *   machine fans out from this transition (DynamoDB stream →
+     *   `control-plane.owning-delete.v1` → Step Functions). Readers MUST
+     *   short-circuit on `deleting` so partial cascades stay invisible.
+     * - `deleted-failed` — terminal failure state set by the cascade
+     *   finalize Lambda when the cascade run fails irrecoverably.
+     *   Operators recover by re-running the cascade or by direct
+     *   intervention.
+     *
+     * The cascade finalize step deletes the canonical record conditional
+     * on `lifecycleState = "deleting"`; on replay the conditional check
+     * fails and the finalize step treats that as a no-op success.
+     */
+    lifecycleState: {
+      type: ["active", "deleting", "deleted-failed"],
+      required: false
+    },
+    bundleId: {
+      type: "string",
+      required: false
+    },
+    msgId: {
+      type: "string",
+      required: false
+    }
+  },
+  indexes: {
+    /** Base table: PK = TID#<tenantId>#WORKSPACE#ID#<id>, SK = CURRENT. Do not supply PK or SK from outside. */
+    record: {
+      pk: {
+        field: "PK",
+        composite: ["tenantId", "id"],
+        template: "TID#${tenantId}#WORKSPACE#ID#${id}"
+      },
+      sk: {
+        field: "SK",
+        composite: ["sk"],
+        template: "${sk}"
+      }
+    },
+    /**
+     * GSI1 — Unified Sharded List per ADR-011: list all Workspaces for a tenant across the
+     * four shards. Workspace is itself the workspace identity, so `WID#-` is a sentinel.
+     * SK is derived via `gsi1skAttribute` — `<normalizedName>#<id>` when the resource
+     * carries a `name`, else `<lastUpdated>#<id>` (DR-004). `casing: "none"` preserves
+     * the normalized label and ISO-8601 `T`/`Z`.
+     */
+    gsi1: {
+      index: "GSI1",
+      pk: {
+        field: "GSI1PK",
+        composite: ["tenantId", "gsi1Shard"],
+        template: "TID#${tenantId}#WID#-#RT#Workspace#SHARD#${gsi1Shard}"
+      },
+      sk: {
+        field: "GSI1SK",
+        casing: "none",
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
+      }
+    }
+  }
+});
+
+// src/data/dynamo/dynamo-control-service.ts
+var controlPlaneEntities = {
+  configuration: ConfigurationEntity,
+  configurationUserProjection: ConfigurationUserProjectionEntity,
+  configurationWorkspaceProjection: ConfigurationWorkspaceProjectionEntity,
+  membership: MembershipEntity,
+  membershipUserProjection: MembershipUserProjectionEntity,
+  membershipWorkspaceProjection: MembershipWorkspaceProjectionEntity,
+  role: RoleEntity,
+  roleAssignment: RoleAssignmentEntity,
+  roleAssignmentUserProjection: RoleAssignmentUserProjectionEntity,
+  roleAssignmentWorkspaceProjection: RoleAssignmentWorkspaceProjectionEntity,
+  tenant: TenantEntity,
+  user: UserEntity,
+  workspace: WorkspaceEntity
+};
+var controlPlaneService = new import_electrodb14.Service(controlPlaneEntities, {
+  table: defaultTableName,
+  client: dynamoClient
+});
+var DynamoControlService = {
+  entities: controlPlaneService.entities,
+  transaction: controlPlaneService.transaction
+};
+function getDynamoControlService(tableName) {
+  const resolved = tableName ?? defaultTableName;
+  const service = new import_electrodb14.Service(controlPlaneEntities, {
+    table: resolved,
+    client: dynamoClient
+  });
+  return {
+    entities: service.entities,
+    transaction: service.transaction
+  };
+}
+
+// src/data/operations/control/counters/counter-apply-operation.ts
+var COUNTER_TARGET = {
+  Tenant: "Tenant",
+  Workspace: "Workspace",
+  User: "User"
+};
+
+// src/data/operations/control/counters/role-admin-classification.ts
+function isAdminRoleAssignment(input) {
+  if (codeIsAdminTier(input.roleLevel)) {
+    return true;
+  }
+  if (idMatchesAdmin(input.roleId)) {
+    return true;
+  }
+  return false;
+}
+function codeIsAdminTier(roleLevel) {
+  if (typeof roleLevel !== "string" || roleLevel.length === 0) {
+    return false;
+  }
+  const lower = roleLevel.toLowerCase();
+  return lower === "admin" || lower.endsWith("admin");
+}
+function idMatchesAdmin(roleId) {
+  if (typeof roleId !== "string" || roleId.length === 0) {
+    return false;
+  }
+  return roleId.toLowerCase().includes("admin");
+}
+
+// src/data/operations/control/control-event-publisher.ts
+var import_client_eventbridge = require("@aws-sdk/client-eventbridge");
+var import_workflows = __toESM(require_lib());
+function extractRoleLevel(resource) {
+  const code = resource?.code;
+  const first = code?.coding?.[0]?.code;
+  return typeof first === "string" && first.length > 0 ? first : void 0;
+}
+
+// src/data/operations/control/membership/membership-list-by-user-operation.ts
+function buildSkPrefix(mode, tenantId) {
+  switch (mode) {
+    case "tenant":
+      return "MEMBERSHIP#TENANT#";
+    case "workspace":
+      return "MEMBERSHIP#WORKSPACE#";
+    case "workspaceInTenant":
+      return `MEMBERSHIP#WORKSPACE#TID#${tenantId}#`;
+    case "all":
+    default:
+      return "MEMBERSHIP#";
+  }
+}
+
+// src/data/operations/control/membership/membership-count-by-user-operation.ts
+async function countMembershipsByUserOperation(params) {
+  const { userId, mode = "all", tenantId, tableName } = params;
+  if (mode === "workspaceInTenant" && !tenantId) {
+    throw new Error(
+      'countMembershipsByUserOperation: tenantId is required when mode === "workspaceInTenant"'
+    );
+  }
+  const service = getDynamoControlService(tableName);
+  const skPrefix = buildSkPrefix(mode, tenantId);
+  const result = await service.entities.membershipUserProjection.query.record({ userId }).begins({ sk: skPrefix }).go({ pages: "all", attributes: ["membershipId"] });
+  return (result.data ?? []).length;
+}
+
+// src/data/operations/control/membership/membership-list-by-workspace-operation.ts
+async function membershipListByWorkspaceOperation(params) {
+  const {
+    tenantId,
+    workspaceId,
+    cursor = null,
+    limit,
+    order,
+    tableName
+  } = params;
+  const service = getDynamoControlService(tableName);
+  const goOptions = {
+    cursor
+  };
+  if (limit !== void 0) {
+    goOptions.limit = limit;
+  }
+  if (order !== void 0) {
+    goOptions.order = order;
+  }
+  const result = await service.entities.membershipWorkspaceProjection.query.record({ tenantId, workspaceId }).begins({ sk: "MEMBERSHIP#" }).go(goOptions);
+  const items = (result.data ?? []).map((row) => ({
+    tenantId: row.tenantId,
+    workspaceId: row.workspaceId,
+    sk: row.sk,
+    userId: row.userId,
+    membershipId: row.membershipId,
+    summary: row.summary,
+    vid: row.vid,
+    lastUpdated: row.lastUpdated,
+    denormalizedUserName: row.denormalizedUserName
+  }));
+  return { items, cursor: result.cursor ?? null };
+}
+
+// src/data/operations/data-operations-common.ts
+var import_types2 = require("@openhi/types");
+
+// src/lib/compression.ts
+var import_node_zlib = require("zlib");
+
+// src/data/operations/data-operations-common.ts
+var BATCH_GET_MAX_ATTEMPTS = 3;
+var BATCH_GET_BASE_BACKOFF_MS = 50;
+async function batchGetWithRetry(entity, keys) {
+  if (keys.length === 0) return [];
+  const collected = [];
+  let pending = keys;
+  let attempt = 0;
+  while (pending.length > 0) {
+    if (attempt > 0) {
+      await new Promise(
+        (resolve) => setTimeout(resolve, BATCH_GET_BASE_BACKOFF_MS * 2 ** (attempt - 1))
+      );
+    }
+    attempt++;
+    const result = await entity.get(pending).go();
+    collected.push(...result.data);
+    const unprocessed = result.unprocessed ?? [];
+    if (unprocessed.length === 0) break;
+    if (attempt >= BATCH_GET_MAX_ATTEMPTS) {
+      throw new Error(
+        `BatchGet exhausted retries: ${unprocessed.length} key(s) still unprocessed after ${BATCH_GET_MAX_ATTEMPTS} attempt(s)`
+      );
+    }
+    pending = unprocessed;
+  }
+  return collected;
+}
+async function dispatchListMode(mode, shardResults, hooks) {
+  if (mode === "count") {
+    let total = 0;
+    for (const shardResult of shardResults) {
+      total += (shardResult.data ?? []).length;
+    }
+    return { entries: [], total };
+  }
+  if (mode === "summary") {
+    const entries2 = [];
+    for (const shardResult of shardResults) {
+      for (const item of shardResult.data ?? []) {
+        if (typeof item.summary !== "string") continue;
+        let parsed;
+        try {
+          parsed = JSON.parse(item.summary);
+        } catch {
+          continue;
+        }
+        entries2.push(hooks.buildSummaryEntry(item.id, parsed));
+      }
+    }
+    return { entries: entries2, total: entries2.length };
+  }
+  const orderedIds = [];
+  for (const shardResult of shardResults) {
+    for (const item of shardResult.data ?? []) {
+      orderedIds.push(item.id);
+    }
+  }
+  if (orderedIds.length === 0) return { entries: [], total: 0 };
+  const items = await hooks.hydrate(orderedIds);
+  const byId = new Map(items.map((item) => [hooks.getId(item), item]));
+  const entries = [];
+  for (const id of orderedIds) {
+    const item = byId.get(id);
+    if (!item) continue;
+    entries.push(hooks.buildEntry(id, item));
+  }
+  return { entries, total: entries.length };
+}
+
+// src/data/operations/control/membership/membership-list-operation.ts
+var SK = "CURRENT";
+async function listMembershipsOperation(params) {
+  const { context, tableName, mode = "full" } = params;
+  const tenantId = context.tenantId;
+  const service = getDynamoControlService(tableName);
+  const shardResults = await Promise.all(
+    Array.from(
+      { length: SHARD_COUNT },
+      (_, shard) => service.entities.membership.query.gsi1({ tenantId, gsi1Shard: String(shard) }).go()
+    )
+  );
+  return dispatchListMode(mode, shardResults, {
+    hydrate: (orderedIds) => batchGetWithRetry(
+      service.entities.membership,
+      orderedIds.map((id) => ({ tenantId, id, sk: SK }))
+    ),
+    getId: (item) => item.id,
+    buildEntry: (id, item) => ({
+      id,
+      resource: {
+        resourceType: "Membership",
+        id,
+        ...JSON.parse(item.resource)
+      }
+    }),
+    buildSummaryEntry: (id, parsed) => ({
+      id,
+      resource: { resourceType: "Membership", id, ...parsed }
+    })
+  });
+}
+
+// src/data/operations/control/membership/membership-user-projection.ts
+var import_types3 = require("@openhi/types");
+function extractReferenceSlug(resource, fieldName) {
+  const field = resource[fieldName];
+  if (!field || typeof field !== "object") {
+    return void 0;
+  }
+  const reference = field.reference;
+  if (typeof reference !== "string" || reference.length === 0) {
+    return void 0;
+  }
+  const slash = reference.lastIndexOf("/");
+  const tail = slash >= 0 ? reference.slice(slash + 1) : reference;
+  return tail.length > 0 ? tail : void 0;
+}
+
+// src/data/operations/control/roleassignment/roleassignment-list-by-workspace-operation.ts
+function buildSkPrefix2(roleId) {
+  if (roleId === void 0 || roleId.length === 0) {
+    return "ROLEASSIGNMENT#";
+  }
+  return `ROLEASSIGNMENT#${roleId}#`;
+}
+async function roleAssignmentListByWorkspaceOperation(params) {
+  const {
+    tenantId,
+    workspaceId,
+    roleId,
+    cursor = null,
+    limit,
+    order,
+    tableName
+  } = params;
+  const service = getDynamoControlService(tableName);
+  const skPrefix = buildSkPrefix2(roleId);
+  const goOptions = {
+    cursor
+  };
+  if (limit !== void 0) {
+    goOptions.limit = limit;
+  }
+  if (order !== void 0) {
+    goOptions.order = order;
+  }
+  const result = await service.entities.roleAssignmentWorkspaceProjection.query.record({ tenantId, workspaceId }).begins({ sk: skPrefix }).go(goOptions);
+  const items = (result.data ?? []).map((row) => ({
+    tenantId: row.tenantId,
+    workspaceId: row.workspaceId,
+    sk: row.sk,
+    userId: row.userId,
+    roleId: row.roleId,
+    roleAssignmentId: row.roleAssignmentId,
+    summary: row.summary,
+    vid: row.vid,
+    lastUpdated: row.lastUpdated,
+    denormalizedUserName: row.denormalizedUserName,
+    denormalizedRoleName: row.denormalizedRoleName
+  }));
+  return { items, cursor: result.cursor ?? null };
+}
+
+// src/data/operations/control/workspace/workspace-list-operation.ts
+var SK2 = "CURRENT";
+function counterValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+async function listWorkspacesOperation(params) {
+  const { context, tableName, mode = "full" } = params;
+  const { tenantId } = context;
+  const service = getDynamoControlService(tableName);
+  const shardResults = await Promise.all(
+    Array.from(
+      { length: SHARD_COUNT },
+      (_, shard) => service.entities.workspace.query.gsi1({ tenantId, gsi1Shard: String(shard) }).go()
+    )
+  );
+  return dispatchListMode(mode, shardResults, {
+    hydrate: (orderedIds) => batchGetWithRetry(
+      service.entities.workspace,
+      orderedIds.map((id) => ({ tenantId, id, sk: SK2 }))
+    ),
+    getId: (item) => item.id,
+    // FULL mode (admin list default): read the ADR-028 counters off the
+    // canonical record hydrated by BatchGet and expose them as
+    // `resource.counts`. Missing counters render as 0.
+    buildEntry: (id, item) => ({
+      id,
+      resource: {
+        resourceType: "Workspace",
+        id,
+        ...JSON.parse(item.resource),
+        counts: {
+          usersInWorkspace: counterValue(item.usersInWorkspace),
+          adminUsersInWorkspace: counterValue(item.adminUsersInWorkspace),
+          normalUsersInWorkspace: counterValue(item.normalUsersInWorkspace)
+        }
+      }
+    }),
+    // SUMMARY mode reads only the GSI1 `summary` projection (no
+    // counters); surface zeros so the shape stays uniform.
+    buildSummaryEntry: (id, parsed) => ({
+      id,
+      resource: {
+        resourceType: "Workspace",
+        id,
+        ...parsed,
+        counts: {
+          usersInWorkspace: 0,
+          adminUsersInWorkspace: 0,
+          normalUsersInWorkspace: 0
+        }
+      }
+    })
+  });
+}
+
+// src/data/operations/control/counters/counter-reconcile-operation.ts
+function counterValue2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function reconcileContext(tenantId) {
+  return {
+    tenantId,
+    workspaceId: "",
+    date: (/* @__PURE__ */ new Date()).toISOString(),
+    actorId: "counter-reconciliation",
+    actorName: "Counter Reconciliation Job",
+    actorType: "internal-system",
+    source: "step-function"
+  };
+}
+async function reconcileTenantCountersOperation(params) {
+  const { tenantId, tableName } = params;
+  const service = getDynamoControlService(tableName);
+  const context = reconcileContext(tenantId);
+  const workspacesResult = await listWorkspacesOperation({
+    context,
+    tableName,
+    mode: "count"
+  });
+  const workspacesInTenant = workspacesResult.total;
+  const memberships = await listMembershipsOperation({
+    context,
+    tableName,
+    mode: "full"
+  });
+  let usersInTenant = 0;
+  for (const entry of memberships.entries) {
+    const workspaceSlug = extractReferenceSlug(entry.resource, "workspace");
+    if (workspaceSlug === void 0) {
+      usersInTenant += 1;
+    }
+  }
+  const current = await service.entities.tenant.get({ tenantId, sk: "CURRENT" }).go();
+  const drift = [];
+  const recomputed = {
+    usersInTenant,
+    workspacesInTenant
+  };
+  for (const counter of Object.keys(recomputed)) {
+    const oldValue = counterValue2(current.data?.[counter]);
+    const newValue = recomputed[counter];
+    if (oldValue !== newValue) {
+      drift.push({
+        target: COUNTER_TARGET.Tenant,
+        id: tenantId,
+        counter,
+        old: oldValue,
+        new: newValue
+      });
+    }
+  }
+  if (drift.length > 0) {
+    await service.entities.tenant.patch({ tenantId, sk: "CURRENT" }).set(recomputed).go();
+  }
+  return { drift };
+}
+async function reconcileWorkspaceCountersOperation(params) {
+  const { tenantId, workspaceId, tableName } = params;
+  const service = getDynamoControlService(tableName);
+  let usersInWorkspace = 0;
+  let membershipCursor = null;
+  do {
+    const page = await membershipListByWorkspaceOperation({
+      tenantId,
+      workspaceId,
+      cursor: membershipCursor,
+      tableName
+    });
+    usersInWorkspace += page.items.length;
+    membershipCursor = page.cursor;
+  } while (membershipCursor !== null);
+  let adminUsersInWorkspace = 0;
+  let normalUsersInWorkspace = 0;
+  let roleAssignmentCursor = null;
+  do {
+    const page = await roleAssignmentListByWorkspaceOperation({
+      tenantId,
+      workspaceId,
+      cursor: roleAssignmentCursor,
+      tableName
+    });
+    for (const item of page.items) {
+      const roleLevel = await readRoleLevel(
+        service,
+        tenantId,
+        item.roleAssignmentId
+      );
+      if (isAdminRoleAssignment({ roleLevel, roleId: item.roleId })) {
+        adminUsersInWorkspace += 1;
+      } else {
+        normalUsersInWorkspace += 1;
+      }
+    }
+    roleAssignmentCursor = page.cursor;
+  } while (roleAssignmentCursor !== null);
+  const current = await service.entities.workspace.get({ tenantId, id: workspaceId, sk: "CURRENT" }).go();
+  const drift = [];
+  const recomputed = {
+    usersInWorkspace,
+    adminUsersInWorkspace,
+    normalUsersInWorkspace
+  };
+  for (const counter of Object.keys(recomputed)) {
+    const oldValue = counterValue2(current.data?.[counter]);
+    const newValue = recomputed[counter];
+    if (oldValue !== newValue) {
+      drift.push({
+        target: COUNTER_TARGET.Workspace,
+        id: workspaceId,
+        tenantId,
+        counter,
+        old: oldValue,
+        new: newValue
+      });
+    }
+  }
+  if (drift.length > 0) {
+    await service.entities.workspace.patch({ tenantId, id: workspaceId, sk: "CURRENT" }).set(recomputed).go();
+  }
+  return { drift };
+}
+async function reconcileUserCountersOperation(params) {
+  const { userId, tableName } = params;
+  const service = getDynamoControlService(tableName);
+  const tenantsForUser = await countMembershipsByUserOperation({
+    userId,
+    mode: "tenant",
+    tableName
+  });
+  const workspacesForUser = await countMembershipsByUserOperation({
+    userId,
+    mode: "workspace",
+    tableName
+  });
+  const current = await service.entities.user.get({ id: userId, sk: "CURRENT" }).go();
+  const drift = [];
+  const recomputed = {
+    tenantsForUser,
+    workspacesForUser
+  };
+  for (const counter of Object.keys(recomputed)) {
+    const oldValue = counterValue2(current.data?.[counter]);
+    const newValue = recomputed[counter];
+    if (oldValue !== newValue) {
+      drift.push({
+        target: COUNTER_TARGET.User,
+        id: userId,
+        counter,
+        old: oldValue,
+        new: newValue
+      });
+    }
+  }
+  if (drift.length > 0) {
+    await service.entities.user.patch({ id: userId, sk: "CURRENT" }).set(recomputed).go();
+  }
+  return { drift };
+}
+async function readRoleLevel(service, tenantId, roleAssignmentId) {
+  const response = await service.entities.roleAssignment.get({ tenantId, id: roleAssignmentId, sk: "CURRENT" }).go();
+  if (!response.data) {
+    return void 0;
+  }
+  const resource = JSON.parse(response.data.resource);
+  return extractRoleLevel(resource);
+}
+
+// src/data/operations/control/tenant/tenant-list-operation.ts
+var SK3 = "CURRENT";
+function counterValue3(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+async function listTenantsOperation(params) {
+  const { tableName, mode = "full" } = params;
+  const service = getDynamoControlService(tableName);
+  const shardResults = await Promise.all(
+    Array.from(
+      { length: SHARD_COUNT },
+      (_, shard) => service.entities.tenant.query.gsi1({ gsi1Shard: String(shard) }).go()
+    )
+  );
+  return dispatchListMode(mode, shardResults, {
+    hydrate: (orderedIds) => batchGetWithRetry(
+      service.entities.tenant,
+      orderedIds.map((id) => ({ tenantId: id, sk: SK3 }))
+    ),
+    getId: (item) => item.id,
+    // FULL mode (admin list default): read the ADR-028 counters off the
+    // canonical record hydrated by BatchGet and expose them as
+    // `resource.counts`. Missing counters render as 0.
+    buildEntry: (id, item) => ({
+      id,
+      resource: {
+        resourceType: "Tenant",
+        id,
+        ...JSON.parse(item.resource),
+        counts: {
+          usersInTenant: counterValue3(item.usersInTenant),
+          workspacesInTenant: counterValue3(item.workspacesInTenant)
+        }
+      }
+    }),
+    // SUMMARY mode reads only the GSI1 `summary` projection, which does
+    // not carry the counters; surface zeros so the shape stays uniform.
+    buildSummaryEntry: (id, parsed) => ({
+      id,
+      resource: {
+        resourceType: "Tenant",
+        id,
+        ...parsed,
+        counts: { usersInTenant: 0, workspacesInTenant: 0 }
+      }
+    })
+  });
+}
+
+// src/data/operations/control/user/user-list-operation.ts
+var SK4 = "CURRENT";
+function counterValue4(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+async function listUsersOperation(params) {
+  const { tableName, mode = "full" } = params;
+  const service = getDynamoControlService(tableName);
+  const shardResults = await Promise.all(
+    Array.from(
+      { length: SHARD_COUNT },
+      (_, shard) => service.entities.user.query.gsi1({ gsi1Shard: String(shard) }).go()
+    )
+  );
+  return dispatchListMode(mode, shardResults, {
+    hydrate: (orderedIds) => batchGetWithRetry(
+      service.entities.user,
+      orderedIds.map((id) => ({ id, sk: SK4 }))
+    ),
+    getId: (item) => item.id,
+    // FULL mode (admin list default): read the ADR-028 counters off the
+    // canonical record hydrated by BatchGet and expose them as
+    // `resource.counts`. Missing counters render as 0.
+    buildEntry: (id, item) => ({
+      id,
+      resource: {
+        resourceType: "User",
+        id,
+        ...JSON.parse(item.resource),
+        counts: {
+          tenantsForUser: counterValue4(item.tenantsForUser),
+          workspacesForUser: counterValue4(item.workspacesForUser)
+        }
+      }
+    }),
+    // SUMMARY mode reads only the GSI1 `summary` projection (no
+    // counters); surface zeros so the shape stays uniform.
+    buildSummaryEntry: (id, parsed) => ({
+      id,
+      resource: {
+        resourceType: "User",
+        id,
+        ...parsed,
+        counts: { tenantsForUser: 0, workspacesForUser: 0 }
+      }
+    })
+  });
+}
+
+// src/data/operations/control/counters/counter-reconcile-driver.ts
+function driverContext(tenantId) {
+  return {
+    tenantId,
+    workspaceId: "",
+    date: (/* @__PURE__ */ new Date()).toISOString(),
+    actorId: "counter-reconciliation",
+    actorName: "Counter Reconciliation Job",
+    actorType: "internal-system",
+    source: "step-function"
+  };
+}
+async function reconcileAllCountersOperation(params = {}) {
+  const { tableName } = params;
+  const drift = [];
+  let tenantsScanned = 0;
+  let workspacesScanned = 0;
+  let usersScanned = 0;
+  const tenants = await listTenantsOperation({
+    context: driverContext(""),
+    tableName,
+    mode: "summary"
+  });
+  for (const tenant of tenants.entries) {
+    tenantsScanned += 1;
+    const tenantResult = await reconcileTenantCountersOperation({
+      tenantId: tenant.id,
+      tableName
+    });
+    drift.push(...tenantResult.drift);
+    const workspaces = await listWorkspacesOperation({
+      context: driverContext(tenant.id),
+      tableName,
+      mode: "summary"
+    });
+    for (const workspace of workspaces.entries) {
+      workspacesScanned += 1;
+      const workspaceResult = await reconcileWorkspaceCountersOperation({
+        tenantId: tenant.id,
+        workspaceId: workspace.id,
+        tableName
+      });
+      drift.push(...workspaceResult.drift);
+    }
+  }
+  const users = await listUsersOperation({
+    context: driverContext(""),
+    tableName,
+    mode: "summary"
+  });
+  for (const user of users.entries) {
+    usersScanned += 1;
+    const userResult = await reconcileUserCountersOperation({
+      userId: user.id,
+      tableName
+    });
+    drift.push(...userResult.drift);
+  }
+  return {
+    drift,
+    scanned: {
+      tenants: tenantsScanned,
+      workspaces: workspacesScanned,
+      users: usersScanned
+    },
+    countersCorrected: drift.length
+  };
+}
+
+// src/workflows/control-plane/counter-reconciliation/counter-reconciliation.handler.ts
+var runCounterReconciliation = async (deps) => {
+  const report = await deps.reconcileAll();
+  console.log(
+    JSON.stringify({
+      message: "counter-reconciliation complete",
+      scanned: report.scanned,
+      countersCorrected: report.countersCorrected,
+      drift: report.drift
+    })
+  );
+  return report;
+};
+var productionDependencies = () => ({
+  reconcileAll: () => reconcileAllCountersOperation()
+});
+var handler = async () => runCounterReconciliation(productionDependencies());
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler,
+  runCounterReconciliation
+});
+//# sourceMappingURL=counter-reconciliation.handler.js.map