@openhi/constructs 0.0.160 → 0.0.162

package/lib/{chunk-7RZHFI77.mjs → chunk-VESULYQQ.mjs}

@@ -1,6 +1,6 @@
 import {
   require_lib
-} from "./chunk-ZM4GDHHC.mjs";
+} from "./chunk-KMEWULMX.mjs";
 import {
   __toESM
 } from "./chunk-LZOMFHX3.mjs";
@@ -19,4 +19,4 @@ export {
   OWNING_DELETE_OPS_EVENT_BUS_ENV_VAR,
   import_workflows
 };
-//# sourceMappingURL=chunk-7RZHFI77.mjs.map
+//# sourceMappingURL=chunk-VESULYQQ.mjs.map

package/lib/{chunk-AOSEKL7U.mjs → chunk-WOTU36P3.mjs}

@@ -1,16 +1,14 @@
 import {
-  batchGetWithRetry,
-  dispatchListMode
-} from "./chunk-MVQWAIMC.mjs";
+  membershipListByUserOperation
+} from "./chunk-DWSWCUZR.mjs";
 import {
   ForbiddenError,
   NotFoundError,
   ValidationError
 } from "./chunk-FYHBHHWK.mjs";
 import {
-  SHARD_COUNT,
   getDynamoControlService
-} from "./chunk-VZCPGQXA.mjs";
+} from "./chunk-EUIP2U5F.mjs";
 
 // src/data/operations/control/user/user-find-by-sub-operation.ts
 async function findUserBySubOperation(params) {
@@ -95,102 +93,9 @@ async function getUserByIdOperation(params) {
   };
 }
 
-// src/data/operations/control/user/user-list-operation.ts
-var SK = "CURRENT";
-async function listUsersOperation(params) {
-  const { tableName, mode = "full" } = params;
-  const service = getDynamoControlService(tableName);
-  const shardResults = await Promise.all(
-    Array.from(
-      { length: SHARD_COUNT },
-      (_, shard) => service.entities.user.query.gsi1({ gsi1Shard: String(shard) }).go()
-    )
-  );
-  return dispatchListMode(mode, shardResults, {
-    hydrate: (orderedIds) => batchGetWithRetry(
-      service.entities.user,
-      orderedIds.map((id) => ({ id, sk: SK }))
-    ),
-    getId: (item) => item.id,
-    buildEntry: (id, item) => ({
-      id,
-      resource: {
-        resourceType: "User",
-        id,
-        ...JSON.parse(item.resource)
-      }
-    }),
-    buildSummaryEntry: (id, parsed) => ({
-      id,
-      resource: { resourceType: "User", id, ...parsed }
-    })
-  });
-}
-
 // src/data/operations/control/user/user-switch-tenant-workspace-operation.ts
 import { extractSummary as extractSummary2 } from "@openhi/types";
-
-// src/data/operations/control/membership/membership-list-by-user-operation.ts
-function buildSkPrefix(mode, tenantId) {
-  switch (mode) {
-    case "tenant":
-      return "MEMBERSHIP#TENANT#";
-    case "workspace":
-      return "MEMBERSHIP#WORKSPACE#";
-    case "workspaceInTenant":
-      return `MEMBERSHIP#WORKSPACE#TID#${tenantId}#`;
-    case "all":
-    default:
-      return "MEMBERSHIP#";
-  }
-}
-async function membershipListByUserOperation(params) {
-  const {
-    userId,
-    mode = "all",
-    tenantId,
-    cursor = null,
-    limit,
-    order,
-    tableName
-  } = params;
-  if (mode === "workspaceInTenant" && !tenantId) {
-    throw new Error(
-      'membershipListByUserOperation: tenantId is required when mode === "workspaceInTenant"'
-    );
-  }
-  const service = getDynamoControlService(tableName);
-  const skPrefix = buildSkPrefix(mode, tenantId);
-  const goOptions = {
-    cursor
-  };
-  if (limit !== void 0) {
-    goOptions.limit = limit;
-  }
-  if (order !== void 0) {
-    goOptions.order = order;
-  }
-  const result = await service.entities.membershipUserProjection.query.record({ userId }).begins({ sk: skPrefix }).go(goOptions);
-  const items = (result.data ?? []).map(
-    (row) => ({
-      userId: row.userId,
-      sk: row.sk,
-      tenantId: row.tenantId,
-      workspaceId: row.workspaceId,
-      membershipId: row.membershipId,
-      summary: row.summary,
-      vid: row.vid,
-      lastUpdated: row.lastUpdated,
-      denormalizedTenantName: row.denormalizedTenantName,
-      denormalizedUserName: row.denormalizedUserName,
-      denormalizedWorkspaceName: row.denormalizedWorkspaceName
-    })
-  );
-  return { items, cursor: result.cursor ?? null };
-}
-
-// src/data/operations/control/user/user-switch-tenant-workspace-operation.ts
-var SK2 = "CURRENT";
+var SK = "CURRENT";
 async function switchUserTenantWorkspaceOperation(params) {
   const { cognitoSub, tenantReference, workspaceReference, tableName } = params;
   const tenantId = idFromReference(tenantReference, "Tenant/");
@@ -251,7 +156,7 @@ async function switchUserTenantWorkspaceOperation(params) {
     extractSummary2(updatedResource)
   );
   const service = getDynamoControlService(tableName);
-  await service.entities.user.patch({ id: user.id, sk: SK2 }).set({
+  await service.entities.user.patch({ id: user.id, sk: SK }).set({
     resource: JSON.stringify(updatedResource),
     summary,
     vid,
@@ -303,12 +208,10 @@ export {
   createUserOperation,
   deleteUserOperation,
   getUserByIdOperation,
-  membershipListByUserOperation,
-  listUsersOperation,
   updateUserOperation,
   findUserBySubOperation,
   parseUserResource,
   idFromReference,
   switchUserTenantWorkspaceOperation
 };
-//# sourceMappingURL=chunk-AOSEKL7U.mjs.map
+//# sourceMappingURL=chunk-WOTU36P3.mjs.map

package/lib/chunk-WOTU36P3.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/data/operations/control/user/user-find-by-sub-operation.ts","../src/data/operations/control/user/user-resource-helpers.ts","../src/data/operations/fhir-reference.ts","../src/data/operations/control/user/user-create-operation.ts","../src/data/operations/control/user/user-get-by-id-operation.ts","../src/data/operations/control/user/user-switch-tenant-workspace-operation.ts","../src/data/operations/control/user/user-update-operation.ts","../src/data/operations/control/user/user-delete-operation.ts"],"sourcesContent":["import { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface FindUserBySubParams {\n  context: OpenHiContext;\n  cognitoSub: string;\n  tableName?: string;\n}\n\nexport interface FindUserBySubResult {\n  id: string;\n  cognitoSub?: string;\n  resource: string;\n  summary?: string;\n  vid: string;\n  lastUpdated?: string;\n}\n\n/**\n * Look up a User by Cognito sub via GSI2, then fetch the canonical row\n * from the base table so projection-skipped attributes (`resource`,\n * `summary`, `vid`, `lastUpdated`) are populated. Returns `undefined`\n * when no row matches the sub, or when the GSI2 hit points at a\n * canonical row that has since been hard-deleted.\n *\n * GSI2 projects only `id` (+ ElectroDB markers), so a single index\n * query is insufficient — see #1175.\n */\nexport async function findUserBySubOperation(\n  params: FindUserBySubParams,\n): Promise<FindUserBySubResult | undefined> {\n  const { cognitoSub, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  const indexResult = await service.entities.user.query\n    .gsi2({ cognitoSub })\n    .go({ limit: 1, attributes: [\"id\"] });\n  const indexItem = indexResult.data?.[0];\n  if (!indexItem) {\n    return undefined;\n  }\n\n  const canonical = await service.entities.user\n    .get({ id: indexItem.id, sk: \"CURRENT\" })\n    .go();\n  const row = canonical.data;\n  if (!row) {\n    return undefined;\n  }\n\n  return {\n    id: row.id,\n    cognitoSub: row.cognitoSub,\n    resource: row.resource,\n    summary: row.summary,\n    vid: row.vid,\n    lastUpdated: row.lastUpdated,\n  };\n}\n","import type { User } from \"@openhi/types\";\n\n/**\n * Helpers for working with persisted OpenHI User resources. Co-located with\n * the User operations because both the Cognito triggers and the onboarding\n * workflow consume these alongside `findUserBySubOperation`.\n */\n\n// Defensive parse — JSON.parse may yield any shape, so every field is optional.\nexport type UserResource = Partial<User>;\n\n/**\n * Existing User resources are stored as JSON strings in the data store; parse\n * defensively so a malformed payload returns `undefined` rather than throwing.\n */\nexport function parseUserResource(resource: string): UserResource | undefined {\n  try {\n    return JSON.parse(resource) as UserResource;\n  } catch {\n    return undefined;\n  }\n}\n","/**\n * Pure helpers for working with FHIR Reference fields. Shared across data-plane\n * and control-plane operations and the handlers that wrap them.\n */\n\n/**\n * Extract the id portion from a FHIR-style reference such as `Patient/<id>` or\n * `Tenant/<id>`. Returns `undefined` if the reference is missing, does not\n * match the prefix, or has an empty id after the prefix.\n */\nexport function idFromReference(\n  reference: string | undefined,\n  prefix: string,\n): string | undefined {\n  if (!reference || !reference.startsWith(prefix)) {\n    return undefined;\n  }\n  const id = reference.slice(prefix.length);\n  return id.length > 0 ? id : undefined;\n}\n","import { extractSummary, type FhirResourceLike } from \"@openhi/types\";\nimport { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface UserCreateParams {\n  context: OpenHiContext;\n  body: { id?: string; resource?: Record<string, unknown> | string };\n  tableName?: string;\n}\n\nexport interface UserCreateResult {\n  id: string;\n  resource: { resourceType: string; id: string; [key: string]: unknown };\n  meta: { lastUpdated: string; versionId: string };\n}\n\nexport async function createUserOperation(\n  params: UserCreateParams,\n): Promise<UserCreateResult> {\n  const { context, body, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  const id = body.id ?? `user-${Date.now()}`;\n  const parsedResource =\n    typeof body.resource === \"string\"\n      ? (JSON.parse(body.resource) as Record<string, unknown>)\n      : (body.resource ?? {});\n\n  const lastUpdated = context.date ?? new Date().toISOString();\n  const vid = `1`;\n\n  const resource = { resourceType: \"User\", id, ...parsedResource };\n  const summary = JSON.stringify(extractSummary(resource as FhirResourceLike));\n\n  await service.entities.user\n    .put({\n      id,\n      resource: JSON.stringify(resource),\n      summary,\n      vid,\n      lastUpdated,\n    })\n    .go();\n\n  return {\n    id,\n    resource,\n    meta: { lastUpdated, versionId: vid },\n  };\n}\n","import { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { NotFoundError } from \"../../../errors\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface UserGetByIdParams {\n  context: OpenHiContext;\n  id: string;\n  tableName?: string;\n}\n\nexport interface UserGetByIdResult {\n  id: string;\n  resource: { resourceType: string; id: string; [key: string]: unknown };\n}\n\nexport async function getUserByIdOperation(\n  params: UserGetByIdParams,\n): Promise<UserGetByIdResult> {\n  const { id, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  const response = await service.entities.user.get({ id, sk: \"CURRENT\" }).go();\n\n  const item = response.data;\n  if (!item) {\n    throw new NotFoundError(`User not found: ${id}`);\n  }\n\n  const parsedResource = JSON.parse(item.resource) as Record<string, unknown>;\n\n  return {\n    id,\n    resource: { resourceType: \"User\", id, ...parsedResource },\n  };\n}\n","import { extractSummary, type FhirResourceLike } from \"@openhi/types\";\nimport { findUserBySubOperation } from \"./user-find-by-sub-operation\";\nimport { parseUserResource } from \"./user-resource-helpers\";\nimport { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport {\n  ForbiddenError,\n  NotFoundError,\n  ValidationError,\n} from \"../../../errors\";\nimport { idFromReference } from \"../../fhir-reference\";\nimport { membershipListByUserOperation } from \"../membership/membership-list-by-user-operation\";\n\nconst SK = \"CURRENT\";\n\nexport interface UserSwitchTenantWorkspaceParams {\n  cognitoSub: string;\n  tenantReference: string;\n  workspaceReference: string;\n  tableName?: string;\n  /** Override the clock — used by tests for deterministic `lastUpdated`. */\n  now?: () => Date;\n}\n\nexport interface UserSwitchTenantWorkspaceResult {\n  id: string;\n  resource: Record<string, unknown>;\n  meta: { lastUpdated: string; versionId: string };\n}\n\n/**\n * Update `currentTenant` and `currentWorkspace` on the User resource for the\n * caller authenticated by the given Cognito `sub`. All other fields on the\n * User are preserved.\n *\n * Membership pre-condition uses the ADR-018 adjacency-list user projection\n * (pattern #4, workspace sub-lane). A single base-table Query on\n * `PK = USER#ID#<userId>` with\n * `SK begins_with 'MEMBERSHIP#WORKSPACE#TID#<tenantId>#'`\n * (via {@link membershipListByUserOperation} with `mode: \"workspaceInTenant\"`)\n * confirms the caller has a workspace-level Membership in the requested\n * tenant + workspace pair. No GSI1 fan-out, no scan.\n *\n * Throws:\n * - `ValidationError` when either reference is missing or malformed\n * - `NotFoundError` when no User matches the Cognito subject\n * - `ForbiddenError` when the caller has no Membership in the requested\n *   `(tenantId, workspaceId)` pair on their user-partition projection\n *\n * @see https://github.com/codedrifters/openhi/issues/769\n * @see https://github.com/codedrifters/openhi/issues/1020\n * @see ADR-018 § Access Pattern Coverage (pattern #4)\n */\nexport async function switchUserTenantWorkspaceOperation(\n  params: UserSwitchTenantWorkspaceParams,\n): Promise<UserSwitchTenantWorkspaceResult> {\n  const { cognitoSub, tenantReference, workspaceReference, tableName } = params;\n\n  const tenantId = idFromReference(tenantReference, \"Tenant/\");\n  if (!tenantId) {\n    throw new ValidationError(\n      \"tenant.reference must be a 'Tenant/<id>' reference.\",\n    );\n  }\n  const workspaceId = idFromReference(workspaceReference, \"Workspace/\");\n  if (!workspaceId) {\n    throw new ValidationError(\n      \"workspace.reference must be a 'Workspace/<id>' reference.\",\n    );\n  }\n\n  const user = await findUserBySubOperation({\n    // findUserBySubOperation does not read context fields; pass a stub.\n    context: {\n      tenantId: \"\",\n      workspaceId: \"\",\n      date: \"\",\n      actorId: \"\",\n      actorName: \"\",\n      actorType: \"internal-system\",\n    },\n    cognitoSub,\n    tableName,\n  });\n  if (!user) {\n    throw new NotFoundError(\n      \"User not yet provisioned for the authenticated Cognito subject.\",\n    );\n  }\n\n  // ADR-018: single Query on the user partition, narrowed to the workspace\n  // sub-lane of the requested tenant. The lane includes `workspaceId` on\n  // every row; a row with `workspaceId === <requested>` is sufficient and\n  // necessary proof that the caller may switch to that pair.\n  const projection = await membershipListByUserOperation({\n    userId: user.id,\n    mode: \"workspaceInTenant\",\n    tenantId,\n    tableName,\n  });\n  const hasMembership = projection.items.some(\n    (row) => row.workspaceId === workspaceId,\n  );\n  if (!hasMembership) {\n    throw new ForbiddenError(\n      `User is not a member of Workspace/${workspaceId} in Tenant/${tenantId}.`,\n    );\n  }\n\n  const existingResource = parseUserResource(user.resource) ?? {};\n  const updatedResource: Record<string, unknown> = {\n    ...existingResource,\n    resourceType: \"User\",\n    id: user.id,\n    currentTenant: { reference: `Tenant/${tenantId}` },\n    currentWorkspace: { reference: `Workspace/${workspaceId}` },\n  };\n\n  const lastUpdated = (params.now ? params.now() : new Date()).toISOString();\n  const vid = `${Date.now()}`;\n  const summary = JSON.stringify(\n    extractSummary(updatedResource as FhirResourceLike),\n  );\n\n  const service = getDynamoControlService(tableName);\n  await service.entities.user\n    .patch({ id: user.id, sk: SK })\n    .set({\n      resource: JSON.stringify(updatedResource),\n      summary,\n      vid,\n      lastUpdated,\n    })\n    .go();\n\n  return {\n    id: user.id,\n    resource: updatedResource,\n    meta: { lastUpdated, versionId: vid },\n  };\n}\n","import { extractSummary, type FhirResourceLike } from \"@openhi/types\";\nimport { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { NotFoundError } from \"../../../errors\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface UserUpdateParams {\n  context: OpenHiContext;\n  id: string;\n  body: { resource?: Record<string, unknown> | string };\n  tableName?: string;\n}\n\nexport interface UserUpdateResult {\n  id: string;\n  resource: { resourceType: string; id: string; [key: string]: unknown };\n  meta: { lastUpdated: string; versionId: string };\n}\n\nexport async function updateUserOperation(\n  params: UserUpdateParams,\n): Promise<UserUpdateResult> {\n  const { context, id, body, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  const existing = await service.entities.user.get({ id, sk: \"CURRENT\" }).go();\n  if (!existing.data) {\n    throw new NotFoundError(`User not found: ${id}`);\n  }\n\n  const parsedResource =\n    typeof body.resource === \"string\"\n      ? (JSON.parse(body.resource) as Record<string, unknown>)\n      : (body.resource ?? {});\n\n  const lastUpdated = context.date ?? new Date().toISOString();\n  const vid = `${Date.now()}`;\n\n  const resource = { resourceType: \"User\", id, ...parsedResource };\n  const summary = JSON.stringify(extractSummary(resource as FhirResourceLike));\n\n  await service.entities.user\n    .put({\n      id,\n      resource: JSON.stringify(resource),\n      summary,\n      vid,\n      lastUpdated,\n    })\n    .go();\n\n  return {\n    id,\n    resource,\n    meta: { lastUpdated, versionId: vid },\n  };\n}\n","import { getDynamoControlService } from \"../../../dynamo/dynamo-control-service\";\nimport { OpenHiContext } from \"../../../openhi-context\";\n\nexport interface UserDeleteParams {\n  context: OpenHiContext;\n  id: string;\n  tableName?: string;\n}\n\nexport async function deleteUserOperation(\n  params: UserDeleteParams,\n): Promise<void> {\n  const { id, tableName } = params;\n  const service = getDynamoControlService(tableName);\n\n  await service.entities.user.delete({ id, sk: \"CURRENT\" }).go();\n}\n"],"mappings":";;;;;;;;;;;;;AA4BA,eAAsB,uBACpB,QAC0C;AAC1C,QAAM,EAAE,YAAY,UAAU,IAAI;AAClC,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,cAAc,MAAM,QAAQ,SAAS,KAAK,MAC7C,KAAK,EAAE,WAAW,CAAC,EACnB,GAAG,EAAE,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;AACtC,QAAM,YAAY,YAAY,OAAO,CAAC;AACtC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,MAAM,QAAQ,SAAS,KACtC,IAAI,EAAE,IAAI,UAAU,IAAI,IAAI,UAAU,CAAC,EACvC,GAAG;AACN,QAAM,MAAM,UAAU;AACtB,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,YAAY,IAAI;AAAA,IAChB,UAAU,IAAI;AAAA,IACd,SAAS,IAAI;AAAA,IACb,KAAK,IAAI;AAAA,IACT,aAAa,IAAI;AAAA,EACnB;AACF;;;AC3CO,SAAS,kBAAkB,UAA4C;AAC5E,MAAI;AACF,WAAO,KAAK,MAAM,QAAQ;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACXO,SAAS,gBACd,WACA,QACoB;AACpB,MAAI,CAAC,aAAa,CAAC,UAAU,WAAW,MAAM,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,KAAK,UAAU,MAAM,OAAO,MAAM;AACxC,SAAO,GAAG,SAAS,IAAI,KAAK;AAC9B;;;ACnBA,SAAS,sBAA6C;AAgBtD,eAAsB,oBACpB,QAC2B;AAC3B,QAAM,EAAE,SAAS,MAAM,UAAU,IAAI;AACrC,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,IAAI,CAAC;AACxC,QAAM,iBACJ,OAAO,KAAK,aAAa,WACpB,KAAK,MAAM,KAAK,QAAQ,IACxB,KAAK,YAAY,CAAC;AAEzB,QAAM,cAAc,QAAQ,SAAQ,oBAAI,KAAK,GAAE,YAAY;AAC3D,QAAM,MAAM;AAEZ,QAAM,WAAW,EAAE,cAAc,QAAQ,IAAI,GAAG,eAAe;AAC/D,QAAM,UAAU,KAAK,UAAU,eAAe,QAA4B,CAAC;AAE3E,QAAM,QAAQ,SAAS,KACpB,IAAI;AAAA,IACH;AAAA,IACA,UAAU,KAAK,UAAU,QAAQ;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,GAAG;AAEN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,EAAE,aAAa,WAAW,IAAI;AAAA,EACtC;AACF;;;AClCA,eAAsB,qBACpB,QAC4B;AAC5B,QAAM,EAAE,IAAI,UAAU,IAAI;AAC1B,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,WAAW,MAAM,QAAQ,SAAS,KAAK,IAAI,EAAE,IAAI,IAAI,UAAU,CAAC,EAAE,GAAG;AAE3E,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,mBAAmB,EAAE,EAAE;AAAA,EACjD;AAEA,QAAM,iBAAiB,KAAK,MAAM,KAAK,QAAQ;AAE/C,SAAO;AAAA,IACL;AAAA,IACA,UAAU,EAAE,cAAc,QAAQ,IAAI,GAAG,eAAe;AAAA,EAC1D;AACF;;;AClCA,SAAS,kBAAAA,uBAA6C;AAYtD,IAAM,KAAK;AAwCX,eAAsB,mCACpB,QAC0C;AAC1C,QAAM,EAAE,YAAY,iBAAiB,oBAAoB,UAAU,IAAI;AAEvE,QAAM,WAAW,gBAAgB,iBAAiB,SAAS;AAC3D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,cAAc,gBAAgB,oBAAoB,YAAY;AACpE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,MAAM,uBAAuB;AAAA;AAAA,IAExC,SAAS;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,MACb,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAMA,QAAM,aAAa,MAAM,8BAA8B;AAAA,IACrD,QAAQ,KAAK;AAAA,IACb,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,gBAAgB,WAAW,MAAM;AAAA,IACrC,CAAC,QAAQ,IAAI,gBAAgB;AAAA,EAC/B;AACA,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI;AAAA,MACR,qCAAqC,WAAW,cAAc,QAAQ;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,mBAAmB,kBAAkB,KAAK,QAAQ,KAAK,CAAC;AAC9D,QAAM,kBAA2C;AAAA,IAC/C,GAAG;AAAA,IACH,cAAc;AAAA,IACd,IAAI,KAAK;AAAA,IACT,eAAe,EAAE,WAAW,UAAU,QAAQ,GAAG;AAAA,IACjD,kBAAkB,EAAE,WAAW,aAAa,WAAW,GAAG;AAAA,EAC5D;AAEA,QAAM,eAAe,OAAO,MAAM,OAAO,IAAI,IAAI,oBAAI,KAAK,GAAG,YAAY;AACzE,QAAM,MAAM,GAAG,KAAK,IAAI,CAAC;AACzB,QAAM,UAAU,KAAK;AAAA,IACnBC,gBAAe,eAAmC;AAAA,EACpD;AAEA,QAAM,UAAU,wBAAwB,SAAS;AACjD,QAAM,QAAQ,SAAS,KACpB,MAAM,EAAE,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,EAC7B,IAAI;AAAA,IACH,UAAU,KAAK,UAAU,eAAe;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,GAAG;AAEN,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,UAAU;AAAA,IACV,MAAM,EAAE,aAAa,WAAW,IAAI;AAAA,EACtC;AACF;;;AC3IA,SAAS,kBAAAC,uBAA6C;AAkBtD,eAAsB,oBACpB,QAC2B;AAC3B,QAAM,EAAE,SAAS,IAAI,MAAM,UAAU,IAAI;AACzC,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,WAAW,MAAM,QAAQ,SAAS,KAAK,IAAI,EAAE,IAAI,IAAI,UAAU,CAAC,EAAE,GAAG;AAC3E,MAAI,CAAC,SAAS,MAAM;AAClB,UAAM,IAAI,cAAc,mBAAmB,EAAE,EAAE;AAAA,EACjD;AAEA,QAAM,iBACJ,OAAO,KAAK,aAAa,WACpB,KAAK,MAAM,KAAK,QAAQ,IACxB,KAAK,YAAY,CAAC;AAEzB,QAAM,cAAc,QAAQ,SAAQ,oBAAI,KAAK,GAAE,YAAY;AAC3D,QAAM,MAAM,GAAG,KAAK,IAAI,CAAC;AAEzB,QAAM,WAAW,EAAE,cAAc,QAAQ,IAAI,GAAG,eAAe;AAC/D,QAAM,UAAU,KAAK,UAAUC,gBAAe,QAA4B,CAAC;AAE3E,QAAM,QAAQ,SAAS,KACpB,IAAI;AAAA,IACH;AAAA,IACA,UAAU,KAAK,UAAU,QAAQ;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,GAAG;AAEN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,EAAE,aAAa,WAAW,IAAI;AAAA,EACtC;AACF;;;AC9CA,eAAsB,oBACpB,QACe;AACf,QAAM,EAAE,IAAI,UAAU,IAAI;AAC1B,QAAM,UAAU,wBAAwB,SAAS;AAEjD,QAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,IAAI,IAAI,UAAU,CAAC,EAAE,GAAG;AAC/D;","names":["extractSummary","extractSummary","extractSummary","extractSummary"]}

package/lib/{chunk-X5E4YJGZ.mjs → chunk-YPTJJ35S.mjs}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-QJDHVMKT.mjs";
 import {
   getDynamoControlService
-} from "./chunk-VZCPGQXA.mjs";
+} from "./chunk-EUIP2U5F.mjs";
 
 // src/data/operations/control/rename-cascade/rename-cascade-rewrite-chunk-operation.ts
 var RENAME_CASCADE_MAX_TARGETS_PER_CHUNK = 50;
@@ -63,4 +63,4 @@ export {
   rewriteRenameCascadeChunkOperation,
   chunkRenameCascadeTargets
 };
-//# sourceMappingURL=chunk-X5E4YJGZ.mjs.map
+//# sourceMappingURL=chunk-YPTJJ35S.mjs.map

package/lib/counter-apply-operation-DZM3MIDm.d.mts

@@ -0,0 +1,63 @@
+/**
+ * ADR-028 atomic counter mutation against a canonical control-plane
+ * record. Each call applies one concurrency-safe DynamoDB `ADD` delta
+ * (`+1` on a relationship/lifecycle create, `-1` on delete) to a single
+ * named counter attribute on the canonical Tenant / Workspace / User row.
+ *
+ * The mutation goes through ElectroDB's `patch(key).add({ counter })`,
+ * which compiles to a DynamoDB `ADD` update expression — atomic, no
+ * read-modify-write. `patch` also stamps an `attribute_exists` guard on
+ * the partition key, so a counter is never written onto a phantom /
+ * deleted canonical record. Using ElectroDB (rather than a raw
+ * `UpdateItemCommand`) keeps the composite-key casing in lockstep with
+ * the entity definitions.
+ *
+ * Floor guard contract (ADR-028 § Floor guard): a `-1` against an
+ * absent / `0` counter is clamped to a no-op via a `.where(counter > 0)`
+ * condition — when the condition fails ElectroDB throws and the
+ * operation swallows it, returning `false`. The guard is a safety net,
+ * not the source of truth: ADR-028's reconciliation job recomputes the
+ * real value from canonical data and owns correctness.
+ *
+ * @see sites/www-docs/content/packages/@openhi/constructs/data/operations/control/counters/counter-apply-operation.md
+ */
+/** Counter attribute names per ADR-028, grouped by the canonical record they live on. */
+declare const TENANT_COUNTERS: readonly ["usersInTenant", "workspacesInTenant"];
+declare const WORKSPACE_COUNTERS: readonly ["usersInWorkspace", "adminUsersInWorkspace", "normalUsersInWorkspace"];
+declare const USER_COUNTERS: readonly ["tenantsForUser", "workspacesForUser"];
+type TenantCounter = (typeof TENANT_COUNTERS)[number];
+type WorkspaceCounter = (typeof WORKSPACE_COUNTERS)[number];
+type UserCounter = (typeof USER_COUNTERS)[number];
+/** The `+1` (create) / `-1` (delete) delta direction. */
+type CounterDelta = 1 | -1;
+/** Which canonical entity the counter lives on. */
+declare const COUNTER_TARGET: {
+    readonly Tenant: "Tenant";
+    readonly Workspace: "Workspace";
+    readonly User: "User";
+};
+type CounterTarget = (typeof COUNTER_TARGET)[keyof typeof COUNTER_TARGET];
+/**
+ * A resolved counter mutation: which canonical record (target + the
+ * ElectroDB composite-key fields that identify it), the attribute, and
+ * the delta. The router emits these; the operation applies them.
+ */
+type CounterMutation = {
+    readonly target: typeof COUNTER_TARGET.Tenant;
+    readonly tenantId: string;
+    readonly attribute: TenantCounter;
+    readonly delta: CounterDelta;
+} | {
+    readonly target: typeof COUNTER_TARGET.Workspace;
+    readonly tenantId: string;
+    readonly workspaceId: string;
+    readonly attribute: WorkspaceCounter;
+    readonly delta: CounterDelta;
+} | {
+    readonly target: typeof COUNTER_TARGET.User;
+    readonly userId: string;
+    readonly attribute: UserCounter;
+    readonly delta: CounterDelta;
+};
+
+export type { CounterMutation as C, CounterTarget as a };

package/lib/counter-apply-operation-DZM3MIDm.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ADR-028 atomic counter mutation against a canonical control-plane
+ * record. Each call applies one concurrency-safe DynamoDB `ADD` delta
+ * (`+1` on a relationship/lifecycle create, `-1` on delete) to a single
+ * named counter attribute on the canonical Tenant / Workspace / User row.
+ *
+ * The mutation goes through ElectroDB's `patch(key).add({ counter })`,
+ * which compiles to a DynamoDB `ADD` update expression — atomic, no
+ * read-modify-write. `patch` also stamps an `attribute_exists` guard on
+ * the partition key, so a counter is never written onto a phantom /
+ * deleted canonical record. Using ElectroDB (rather than a raw
+ * `UpdateItemCommand`) keeps the composite-key casing in lockstep with
+ * the entity definitions.
+ *
+ * Floor guard contract (ADR-028 § Floor guard): a `-1` against an
+ * absent / `0` counter is clamped to a no-op via a `.where(counter > 0)`
+ * condition — when the condition fails ElectroDB throws and the
+ * operation swallows it, returning `false`. The guard is a safety net,
+ * not the source of truth: ADR-028's reconciliation job recomputes the
+ * real value from canonical data and owns correctness.
+ *
+ * @see sites/www-docs/content/packages/@openhi/constructs/data/operations/control/counters/counter-apply-operation.md
+ */
+/** Counter attribute names per ADR-028, grouped by the canonical record they live on. */
+declare const TENANT_COUNTERS: readonly ["usersInTenant", "workspacesInTenant"];
+declare const WORKSPACE_COUNTERS: readonly ["usersInWorkspace", "adminUsersInWorkspace", "normalUsersInWorkspace"];
+declare const USER_COUNTERS: readonly ["tenantsForUser", "workspacesForUser"];
+type TenantCounter = (typeof TENANT_COUNTERS)[number];
+type WorkspaceCounter = (typeof WORKSPACE_COUNTERS)[number];
+type UserCounter = (typeof USER_COUNTERS)[number];
+/** The `+1` (create) / `-1` (delete) delta direction. */
+type CounterDelta = 1 | -1;
+/** Which canonical entity the counter lives on. */
+declare const COUNTER_TARGET: {
+    readonly Tenant: "Tenant";
+    readonly Workspace: "Workspace";
+    readonly User: "User";
+};
+type CounterTarget = (typeof COUNTER_TARGET)[keyof typeof COUNTER_TARGET];
+/**
+ * A resolved counter mutation: which canonical record (target + the
+ * ElectroDB composite-key fields that identify it), the attribute, and
+ * the delta. The router emits these; the operation applies them.
+ */
+type CounterMutation = {
+    readonly target: typeof COUNTER_TARGET.Tenant;
+    readonly tenantId: string;
+    readonly attribute: TenantCounter;
+    readonly delta: CounterDelta;
+} | {
+    readonly target: typeof COUNTER_TARGET.Workspace;
+    readonly tenantId: string;
+    readonly workspaceId: string;
+    readonly attribute: WorkspaceCounter;
+    readonly delta: CounterDelta;
+} | {
+    readonly target: typeof COUNTER_TARGET.User;
+    readonly userId: string;
+    readonly attribute: UserCounter;
+    readonly delta: CounterDelta;
+};
+
+export type { CounterMutation as C, CounterTarget as a };

package/lib/counter-maintenance.handler.d.mts

@@ -0,0 +1,38 @@
+import { WorkflowDedupClient } from '@openhi/workflows';
+import { EventBridgeEvent } from 'aws-lambda';
+import { C as CounterMutation } from './counter-apply-operation-DZM3MIDm.mjs';
+
+/**
+ * @see sites/www-docs/content/packages/@openhi/constructs/workflows/control-plane/counter-maintenance/counter-maintenance-handler.md
+ *
+ * ADR-028 counter-maintenance consumer. Invoked once per control-plane
+ * domain event on the control event bus. Dedupes the event on
+ * `(consumerName, eventId, attempt)` via the TR-015 `WorkflowDedupTable`,
+ * then applies the resolved atomic-ADD counter deltas to the affected
+ * canonical Tenant / Workspace / User records.
+ *
+ * Idempotency: an atomic ADD is not idempotent, so a replayed event must
+ * be a no-op. `recordIfAbsent` is the circuit-breaker — when it returns
+ * `recorded: false` a prior delivery of this exact `(eventId, attempt)`
+ * already applied the deltas, so the handler exits without re-applying.
+ * The dedup write happens-before the counter mutations, exactly as
+ * ADR-028 § Consume requires.
+ */
+type CounterMaintenanceEvent = EventBridgeEvent<string, unknown>;
+/** Dependency seam for tests; production wires the real dedup client. */
+interface CounterMaintenanceDependencies {
+    readonly dedupClient: WorkflowDedupClient;
+    /**
+     * Apply one resolved counter mutation. Defaults to
+     * {@link applyCounterDeltaOperation}; tests inject a spy.
+     */
+    readonly applyMutation: (mutation: CounterMutation) => Promise<void>;
+}
+/**
+ * Test-visible orchestrator. The production `handler` calls this with
+ * real dependencies; unit tests inject fakes.
+ */
+declare const runCounterMaintenance: (event: CounterMaintenanceEvent, deps: CounterMaintenanceDependencies) => Promise<void>;
+declare const handler: (event: CounterMaintenanceEvent) => Promise<void>;
+
+export { type CounterMaintenanceDependencies, handler, runCounterMaintenance };

package/lib/counter-maintenance.handler.d.ts

@@ -0,0 +1,38 @@
+import { WorkflowDedupClient } from '@openhi/workflows';
+import { EventBridgeEvent } from 'aws-lambda';
+import { C as CounterMutation } from './counter-apply-operation-DZM3MIDm.js';
+
+/**
+ * @see sites/www-docs/content/packages/@openhi/constructs/workflows/control-plane/counter-maintenance/counter-maintenance-handler.md
+ *
+ * ADR-028 counter-maintenance consumer. Invoked once per control-plane
+ * domain event on the control event bus. Dedupes the event on
+ * `(consumerName, eventId, attempt)` via the TR-015 `WorkflowDedupTable`,
+ * then applies the resolved atomic-ADD counter deltas to the affected
+ * canonical Tenant / Workspace / User records.
+ *
+ * Idempotency: an atomic ADD is not idempotent, so a replayed event must
+ * be a no-op. `recordIfAbsent` is the circuit-breaker — when it returns
+ * `recorded: false` a prior delivery of this exact `(eventId, attempt)`
+ * already applied the deltas, so the handler exits without re-applying.
+ * The dedup write happens-before the counter mutations, exactly as
+ * ADR-028 § Consume requires.
+ */
+type CounterMaintenanceEvent = EventBridgeEvent<string, unknown>;
+/** Dependency seam for tests; production wires the real dedup client. */
+interface CounterMaintenanceDependencies {
+    readonly dedupClient: WorkflowDedupClient;
+    /**
+     * Apply one resolved counter mutation. Defaults to
+     * {@link applyCounterDeltaOperation}; tests inject a spy.
+     */
+    readonly applyMutation: (mutation: CounterMutation) => Promise<void>;
+}
+/**
+ * Test-visible orchestrator. The production `handler` calls this with
+ * real dependencies; unit tests inject fakes.
+ */
+declare const runCounterMaintenance: (event: CounterMaintenanceEvent, deps: CounterMaintenanceDependencies) => Promise<void>;
+declare const handler: (event: CounterMaintenanceEvent) => Promise<void>;
+
+export { type CounterMaintenanceDependencies, handler, runCounterMaintenance };