@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/data/sqlite/documentRecordPersistence.js

@@ -0,0 +1,102 @@
+import { and, desc, eq, sql } from "drizzle-orm";
+import { normalizeEffectiveAccessLevel } from "../accessLevel.js";
+import { deserializeDocumentSyncPullContinuation } from "../documents/shared/pullContinuation.js";
+import { documentPendingUpdates, documents } from "./schema.js";
+import { getClientSQLitePersistenceRuntime } from "./sqlitePersistenceRuntime.js";
+/**
+ * The ONE select shape for a full documents-row record: every reader that
+ * feeds mapSelectedDocumentRecord spreads this, so a new record column cannot
+ * silently miss one of them.
+ */
+export const documentRecordSelection = {
+    id: documents.localId,
+    documentId: documents.documentId,
+    recoveryGeneration: documents.recoveryGeneration,
+    recoveryDocumentId: documents.recoveryDocumentId,
+    snapshotEndVersion: documents.snapshotEndVersion,
+    accessEpoch: documents.accessEpoch,
+    accessStateHash: documents.accessStateHash,
+    effectiveAccessLevel: documents.effectiveAccessLevel,
+    lastCommitLsn: documents.lastCommitLsn,
+    documentManifestBundle: documents.documentManifestBundle,
+    contentKeyBundle: documents.contentKeyBundle,
+    documentKekTargets: documents.documentKekTargets,
+    pendingBaseVersion: documents.pendingBaseVersion,
+    pullContinuation: documents.pullContinuation,
+};
+export function mapSelectedDocumentRecord(row) {
+    const record = {
+        id: row.id,
+        documentId: row.documentId,
+        recoveryGeneration: row.recoveryGeneration,
+        snapshotEndVersion: row.snapshotEndVersion,
+        accessEpoch: row.accessEpoch,
+        effectiveAccessLevel: normalizeEffectiveAccessLevel(row.effectiveAccessLevel),
+        lastCommitLsn: row.lastCommitLsn,
+        contentKeyBundle: row.contentKeyBundle,
+        documentKekTargets: row.documentKekTargets,
+        documentManifestBundle: row.documentManifestBundle,
+    };
+    if (row.accessStateHash !== null) {
+        record.accessStateHash = row.accessStateHash;
+    }
+    if (row.recoveryDocumentId !== null) {
+        record.recoveryDocumentId = row.recoveryDocumentId;
+    }
+    // Only surface the marker when one was persisted, so a row that never stored
+    // one keeps its prior shape (and init falls through to seeding it).
+    if (row.pendingBaseVersion !== null) {
+        record.pendingBaseVersion = row.pendingBaseVersion;
+    }
+    const pullContinuation = deserializeDocumentSyncPullContinuation(row.pullContinuation);
+    if (pullContinuation !== null) {
+        record.pullContinuation = pullContinuation;
+    }
+    else if (row.pullContinuation !== null) {
+        record.pullContinuationRecoveryRequired = true;
+    }
+    return record;
+}
+export async function loadDocumentRecord(execSql, scope) {
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const rows = await db
+        .select(documentRecordSelection)
+        .from(documents)
+        .where(and(eq(documents.appKind, scope.appKind), eq(documents.localId, scope.localId)))
+        .limit(1);
+    return rows[0] ? mapSelectedDocumentRecord(rows[0]) : null;
+}
+export async function findLocalIdByDocumentId(execSql, appKind, documentId) {
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const hasPendingUpdates = sql `EXISTS (
+    SELECT 1
+    FROM ${documentPendingUpdates}
+    WHERE ${documentPendingUpdates.appKind} = ${documents.appKind}
+      AND ${documentPendingUpdates.localId} = ${documents.localId}
+  )`;
+    const hasPendingLocalWork = sql `(
+    ${hasPendingUpdates}
+    OR (
+      ${documents.pendingBaseVersion} IS NOT NULL
+      AND ${documents.pendingBaseVersion} <> ${documents.snapshotEndVersion}
+    )
+  )`;
+    const rows = await db
+        .select({ localId: documents.localId })
+        .from(documents)
+        .where(and(eq(documents.appKind, appKind), eq(documents.documentId, documentId)))
+        // Duplicate remote identities can survive an interrupted local adoption.
+        // Preserve queued or deferred edits, then make the fallback stable.
+        .orderBy(desc(hasPendingLocalWork), desc(documents.updatedAt), desc(documents.localId))
+        .limit(1);
+    return rows[0]?.localId ?? null;
+}
+export async function deleteDocumentRecord(execSql, scope) {
+    await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {
+        await db
+            .delete(documents)
+            .where(and(eq(documents.appKind, scope.appKind), eq(documents.localId, scope.localId)))
+            .run();
+    });
+}
+//# sourceMappingURL=documentRecordPersistence.js.map

package/data/sqlite/documentRecordPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentRecordPersistence.js","sourceRoot":"","sources":["documentRecordPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,uCAAuC,EAAE,MAAM,sCAAsC,CAAC;AAM/F,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAG/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,EAAE,EAAE,SAAS,CAAC,OAAO;IACrB,UAAU,EAAE,SAAS,CAAC,UAAU;IAChC,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;IAChD,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;IAChD,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;IAChD,WAAW,EAAE,SAAS,CAAC,WAAW;IAClC,eAAe,EAAE,SAAS,CAAC,eAAe;IAC1C,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;IACpD,aAAa,EAAE,SAAS,CAAC,aAAa;IACtC,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;IACxD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;IAC5C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;IAChD,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;IAChD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;CAC7C,CAAC;AAEF,MAAM,UAAU,yBAAyB,CACvC,GAA8B;IAE9B,MAAM,MAAM,GAAmB;QAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,oBAAoB,EAAE,6BAA6B,CACjD,GAAG,CAAC,oBAAoB,CACzB;QACD,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;KACnD,CAAC;IAEF,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/C,CAAC;IAED,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACrD,CAAC;IAED,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACrD,CAAC;IAED,MAAM,gBAAgB,GAAG,uCAAuC,CAC9D,GAAG,CAAC,gBAAgB,CACrB,CAAC;IACF,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC7C,CAAC;SAAM,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC;IACjD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,KAAoB;IAEpB,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,uBAAuB,CAAC;SAC/B,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACpC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACrC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,OAAe,EACf,UAAkB;IAElB,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,GAAG,CAAQ;;WAE5B,sBAAsB;YACrB,sBAAsB,CAAC,OAAO,MAAM,SAAS,CAAC,OAAO;YACrD,sBAAsB,CAAC,OAAO,MAAM,SAAS,CAAC,OAAO;IAC7D,CAAC;IACH,MAAM,mBAAmB,GAAG,GAAG,CAAQ;MACnC,iBAAiB;;QAEf,SAAS,CAAC,kBAAkB;YACxB,SAAS,CAAC,kBAAkB,OAAO,SAAS,CAAC,kBAAkB;;IAEvE,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;SACtC,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAC1E;QACD,yEAAyE;QACzE,oEAAoE;SACnE,OAAO,CACN,IAAI,CAAC,mBAAmB,CAAC,EACzB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EACzB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,KAAoB;IAEpB,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxE,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EACpC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CACrC,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { and, desc, eq, sql } from \"drizzle-orm\";\nimport { normalizeEffectiveAccessLevel } from \"../accessLevel\";\nimport { deserializeDocumentSyncPullContinuation } from \"../documents/shared/pullContinuation\";\nimport type {\n  DocumentRecord,\n  DocumentScope,\n  SelectedDocumentRecordRow,\n} from \"./documentPersistenceTypes\";\nimport { documentPendingUpdates, documents } from \"./schema\";\nimport { getClientSQLitePersistenceRuntime } from \"./sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"./sqlSchema\";\n\n/**\n * The ONE select shape for a full documents-row record: every reader that\n * feeds mapSelectedDocumentRecord spreads this, so a new record column cannot\n * silently miss one of them.\n */\nexport const documentRecordSelection = {\n  id: documents.localId,\n  documentId: documents.documentId,\n  recoveryGeneration: documents.recoveryGeneration,\n  recoveryDocumentId: documents.recoveryDocumentId,\n  snapshotEndVersion: documents.snapshotEndVersion,\n  accessEpoch: documents.accessEpoch,\n  accessStateHash: documents.accessStateHash,\n  effectiveAccessLevel: documents.effectiveAccessLevel,\n  lastCommitLsn: documents.lastCommitLsn,\n  documentManifestBundle: documents.documentManifestBundle,\n  contentKeyBundle: documents.contentKeyBundle,\n  documentKekTargets: documents.documentKekTargets,\n  pendingBaseVersion: documents.pendingBaseVersion,\n  pullContinuation: documents.pullContinuation,\n};\n\nexport function mapSelectedDocumentRecord(\n  row: SelectedDocumentRecordRow,\n): DocumentRecord {\n  const record: DocumentRecord = {\n    id: row.id,\n    documentId: row.documentId,\n    recoveryGeneration: row.recoveryGeneration,\n    snapshotEndVersion: row.snapshotEndVersion,\n    accessEpoch: row.accessEpoch,\n    effectiveAccessLevel: normalizeEffectiveAccessLevel(\n      row.effectiveAccessLevel,\n    ),\n    lastCommitLsn: row.lastCommitLsn,\n    contentKeyBundle: row.contentKeyBundle,\n    documentKekTargets: row.documentKekTargets,\n    documentManifestBundle: row.documentManifestBundle,\n  };\n\n  if (row.accessStateHash !== null) {\n    record.accessStateHash = row.accessStateHash;\n  }\n\n  if (row.recoveryDocumentId !== null) {\n    record.recoveryDocumentId = row.recoveryDocumentId;\n  }\n\n  // Only surface the marker when one was persisted, so a row that never stored\n  // one keeps its prior shape (and init falls through to seeding it).\n  if (row.pendingBaseVersion !== null) {\n    record.pendingBaseVersion = row.pendingBaseVersion;\n  }\n\n  const pullContinuation = deserializeDocumentSyncPullContinuation(\n    row.pullContinuation,\n  );\n  if (pullContinuation !== null) {\n    record.pullContinuation = pullContinuation;\n  } else if (row.pullContinuation !== null) {\n    record.pullContinuationRecoveryRequired = true;\n  }\n\n  return record;\n}\n\nexport async function loadDocumentRecord(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<DocumentRecord | null> {\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const rows = await db\n    .select(documentRecordSelection)\n    .from(documents)\n    .where(\n      and(\n        eq(documents.appKind, scope.appKind),\n        eq(documents.localId, scope.localId),\n      ),\n    )\n    .limit(1);\n\n  return rows[0] ? mapSelectedDocumentRecord(rows[0]) : null;\n}\n\nexport async function findLocalIdByDocumentId(\n  execSql: ExecSql,\n  appKind: string,\n  documentId: string,\n): Promise<string | null> {\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const hasPendingUpdates = sql<number>`EXISTS (\n    SELECT 1\n    FROM ${documentPendingUpdates}\n    WHERE ${documentPendingUpdates.appKind} = ${documents.appKind}\n      AND ${documentPendingUpdates.localId} = ${documents.localId}\n  )`;\n  const hasPendingLocalWork = sql<number>`(\n    ${hasPendingUpdates}\n    OR (\n      ${documents.pendingBaseVersion} IS NOT NULL\n      AND ${documents.pendingBaseVersion} <> ${documents.snapshotEndVersion}\n    )\n  )`;\n  const rows = await db\n    .select({ localId: documents.localId })\n    .from(documents)\n    .where(\n      and(eq(documents.appKind, appKind), eq(documents.documentId, documentId)),\n    )\n    // Duplicate remote identities can survive an interrupted local adoption.\n    // Preserve queued or deferred edits, then make the fallback stable.\n    .orderBy(\n      desc(hasPendingLocalWork),\n      desc(documents.updatedAt),\n      desc(documents.localId),\n    )\n    .limit(1);\n\n  return rows[0]?.localId ?? null;\n}\n\nexport async function deleteDocumentRecord(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<void> {\n  await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {\n    await db\n      .delete(documents)\n      .where(\n        and(\n          eq(documents.appKind, scope.appKind),\n          eq(documents.localId, scope.localId),\n        ),\n      )\n      .run();\n  });\n}\n"]}

package/data/sqlite/documentSyncFailurePersistence.d.ts

@@ -0,0 +1,29 @@
+import type { DocumentScope } from "./documentPersistenceTypes.js";
+import { type ExecSql } from "./sqlSchema.js";
+interface DocumentSyncFailureFields {
+    readonly attemptedAt: string;
+    readonly message: string;
+    readonly status: number | null;
+}
+/**
+ * Upsert the last terminal failure or incoming-update quarantine for a document
+ * scope. The durable pending-update queue has no status columns, so this row is
+ * what lets the write-queue view explain a blocked document. One row per scope:
+ * a newer failure replaces the old.
+ */
+export declare function recordDocumentSyncFailure(execSql: ExecSql, scope: DocumentScope, failure: DocumentSyncFailureFields): Promise<void>;
+/**
+ * Whether any queued local write has recorded a terminal failure — a
+ * `document_sync_failures` row or an intent row carrying `last_error`. This is
+ * the evidence gate for recovery triggers (e.g. re-arming write lanes when org
+ * access is restored): without it a transient denial during bootstrap would
+ * fire recovery work with nothing to recover, racing the startup sync passes.
+ */
+export declare function hasRecordedTerminalSyncFailures(execSql: ExecSql): Promise<boolean>;
+/**
+ * Drop the recorded failure for a scope. Called when a later sync pass for the
+ * scope succeeds and whenever the scope's local sync state is torn down, so a
+ * stale failure never outlives the condition it describes.
+ */
+export declare function clearDocumentSyncFailure(execSql: ExecSql, scope: DocumentScope): Promise<void>;
+export {};

package/data/sqlite/documentSyncFailurePersistence.js

@@ -0,0 +1,91 @@
+import { and, eq, isNotNull } from "drizzle-orm";
+import { containerCreateIntents, containerCreateIntentTables, containerMoveIntents, containerMoveIntentTables, documentMoveIntents, documentMoveIntentTables, documentSyncFailures, documentTables, } from "./schema.js";
+import { getClientSQLitePersistenceRuntime } from "./sqlitePersistenceRuntime.js";
+import { ensureSqlTables } from "./sqlSchema.js";
+/**
+ * Upsert the last terminal failure or incoming-update quarantine for a document
+ * scope. The durable pending-update queue has no status columns, so this row is
+ * what lets the write-queue view explain a blocked document. One row per scope:
+ * a newer failure replaces the old.
+ */
+export async function recordDocumentSyncFailure(execSql, scope, failure) {
+    await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {
+        await db
+            .insert(documentSyncFailures)
+            .values({
+            appKind: scope.appKind,
+            localId: scope.localId,
+            status: failure.status,
+            message: failure.message,
+            attemptedAt: failure.attemptedAt,
+        })
+            .onConflictDoUpdate({
+            target: [documentSyncFailures.appKind, documentSyncFailures.localId],
+            set: {
+                status: failure.status,
+                message: failure.message,
+                attemptedAt: failure.attemptedAt,
+            },
+        })
+            .run();
+    });
+}
+/**
+ * Whether any queued local write has recorded a terminal failure — a
+ * `document_sync_failures` row or an intent row carrying `last_error`. This is
+ * the evidence gate for recovery triggers (e.g. re-arming write lanes when org
+ * access is restored): without it a transient denial during bootstrap would
+ * fire recovery work with nothing to recover, racing the startup sync passes.
+ */
+export async function hasRecordedTerminalSyncFailures(execSql) {
+    await ensureSqlTables(execSql, [
+        ...documentTables,
+        ...containerCreateIntentTables,
+        ...containerMoveIntentTables,
+        ...documentMoveIntentTables,
+    ]);
+    const { db } = getClientSQLitePersistenceRuntime(execSql);
+    const [failure] = await db
+        .select({ localId: documentSyncFailures.localId })
+        .from(documentSyncFailures)
+        .limit(1);
+    if (failure) {
+        return true;
+    }
+    const [createIntent] = await db
+        .select({ id: containerCreateIntents.id })
+        .from(containerCreateIntents)
+        .where(isNotNull(containerCreateIntents.lastError))
+        .limit(1);
+    if (createIntent) {
+        return true;
+    }
+    const [moveIntent] = await db
+        .select({ id: containerMoveIntents.id })
+        .from(containerMoveIntents)
+        .where(isNotNull(containerMoveIntents.lastError))
+        .limit(1);
+    if (moveIntent) {
+        return true;
+    }
+    const [documentMoveIntent] = await db
+        .select({ id: documentMoveIntents.id })
+        .from(documentMoveIntents)
+        .where(isNotNull(documentMoveIntents.lastError))
+        .limit(1);
+    return documentMoveIntent !== undefined;
+}
+/**
+ * Drop the recorded failure for a scope. Called when a later sync pass for the
+ * scope succeeds and whenever the scope's local sync state is torn down, so a
+ * stale failure never outlives the condition it describes.
+ */
+export async function clearDocumentSyncFailure(execSql, scope) {
+    await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {
+        await db
+            .delete(documentSyncFailures)
+            .where(and(eq(documentSyncFailures.appKind, scope.appKind), eq(documentSyncFailures.localId, scope.localId)))
+            .run();
+    });
+}
+//# sourceMappingURL=documentSyncFailurePersistence.js.map

package/data/sqlite/documentSyncFailurePersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentSyncFailurePersistence.js","sourceRoot":"","sources":["documentSyncFailurePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAgB,eAAe,EAAE,MAAM,aAAa,CAAC;AAQ5D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,KAAoB,EACpB,OAAkC;IAElC,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxE,MAAM,EAAE;aACL,MAAM,CAAC,oBAAoB,CAAC;aAC5B,MAAM,CAAC;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC;YACpE,GAAG,EAAE;gBACH,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC;SACF,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAgB;IAEhB,MAAM,eAAe,CAAC,OAAO,EAAE;QAC7B,GAAG,cAAc;QACjB,GAAG,2BAA2B;QAC9B,GAAG,yBAAyB;QAC5B,GAAG,wBAAwB;KAC5B,CAAC,CAAC;IACH,MAAM,EAAE,EAAE,EAAE,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,CAAC;SACjD,IAAI,CAAC,oBAAoB,CAAC;SAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,EAAE;SAC5B,MAAM,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,EAAE,EAAE,CAAC;SACzC,IAAI,CAAC,sBAAsB,CAAC;SAC5B,KAAK,CAAC,SAAS,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;SAClD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC;SACvC,IAAI,CAAC,oBAAoB,CAAC;SAC1B,KAAK,CAAC,SAAS,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;SAChD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,kBAAkB,CAAC,GAAG,MAAM,EAAE;SAClC,MAAM,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC;SACtC,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,kBAAkB,KAAK,SAAS,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,KAAoB;IAEpB,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxE,MAAM,EAAE;aACL,MAAM,CAAC,oBAAoB,CAAC;aAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAC/C,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAChD,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { and, eq, isNotNull } from \"drizzle-orm\";\nimport type { DocumentScope } from \"./documentPersistenceTypes\";\nimport {\n  containerCreateIntents,\n  containerCreateIntentTables,\n  containerMoveIntents,\n  containerMoveIntentTables,\n  documentMoveIntents,\n  documentMoveIntentTables,\n  documentSyncFailures,\n  documentTables,\n} from \"./schema\";\nimport { getClientSQLitePersistenceRuntime } from \"./sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"./sqlSchema\";\n\ninterface DocumentSyncFailureFields {\n  readonly attemptedAt: string;\n  readonly message: string;\n  readonly status: number | null;\n}\n\n/**\n * Upsert the last terminal failure or incoming-update quarantine for a document\n * scope. The durable pending-update queue has no status columns, so this row is\n * what lets the write-queue view explain a blocked document. One row per scope:\n * a newer failure replaces the old.\n */\nexport async function recordDocumentSyncFailure(\n  execSql: ExecSql,\n  scope: DocumentScope,\n  failure: DocumentSyncFailureFields,\n): Promise<void> {\n  await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {\n    await db\n      .insert(documentSyncFailures)\n      .values({\n        appKind: scope.appKind,\n        localId: scope.localId,\n        status: failure.status,\n        message: failure.message,\n        attemptedAt: failure.attemptedAt,\n      })\n      .onConflictDoUpdate({\n        target: [documentSyncFailures.appKind, documentSyncFailures.localId],\n        set: {\n          status: failure.status,\n          message: failure.message,\n          attemptedAt: failure.attemptedAt,\n        },\n      })\n      .run();\n  });\n}\n\n/**\n * Whether any queued local write has recorded a terminal failure — a\n * `document_sync_failures` row or an intent row carrying `last_error`. This is\n * the evidence gate for recovery triggers (e.g. re-arming write lanes when org\n * access is restored): without it a transient denial during bootstrap would\n * fire recovery work with nothing to recover, racing the startup sync passes.\n */\nexport async function hasRecordedTerminalSyncFailures(\n  execSql: ExecSql,\n): Promise<boolean> {\n  await ensureSqlTables(execSql, [\n    ...documentTables,\n    ...containerCreateIntentTables,\n    ...containerMoveIntentTables,\n    ...documentMoveIntentTables,\n  ]);\n  const { db } = getClientSQLitePersistenceRuntime(execSql);\n  const [failure] = await db\n    .select({ localId: documentSyncFailures.localId })\n    .from(documentSyncFailures)\n    .limit(1);\n  if (failure) {\n    return true;\n  }\n  const [createIntent] = await db\n    .select({ id: containerCreateIntents.id })\n    .from(containerCreateIntents)\n    .where(isNotNull(containerCreateIntents.lastError))\n    .limit(1);\n  if (createIntent) {\n    return true;\n  }\n  const [moveIntent] = await db\n    .select({ id: containerMoveIntents.id })\n    .from(containerMoveIntents)\n    .where(isNotNull(containerMoveIntents.lastError))\n    .limit(1);\n  if (moveIntent) {\n    return true;\n  }\n  const [documentMoveIntent] = await db\n    .select({ id: documentMoveIntents.id })\n    .from(documentMoveIntents)\n    .where(isNotNull(documentMoveIntents.lastError))\n    .limit(1);\n  return documentMoveIntent !== undefined;\n}\n\n/**\n * Drop the recorded failure for a scope. Called when a later sync pass for the\n * scope succeeds and whenever the scope's local sync state is torn down, so a\n * stale failure never outlives the condition it describes.\n */\nexport async function clearDocumentSyncFailure(\n  execSql: ExecSql,\n  scope: DocumentScope,\n): Promise<void> {\n  await getClientSQLitePersistenceRuntime(execSql).runMutation(async (db) => {\n    await db\n      .delete(documentSyncFailures)\n      .where(\n        and(\n          eq(documentSyncFailures.appKind, scope.appKind),\n          eq(documentSyncFailures.localId, scope.localId),\n        ),\n      )\n      .run();\n  });\n}\n"]}

package/data/sqlite/organizationDataUsageSchema.js

@@ -0,0 +1,40 @@
+import { integer, primaryKey, sqliteTable, text, } from "drizzle-orm/sqlite-core";
+import { defineSqlTableSchema } from "./sqlTableSchema.js";
+export const ORGANIZATION_DATA_USAGE_PROJECTION_VERSION = 1;
+/** One server-computed usage snapshot per organization requester. */
+export const organizationDataUsageSnapshots = sqliteTable("organization_data_usage_snapshots", {
+    organizationId: text("organization_id").notNull(),
+    requesterUserId: text("requester_user_id").notNull(),
+    projectionVersion: integer("projection_version").notNull(),
+    blobCount: integer("blob_count").notNull(),
+    blobByteLength: integer("blob_byte_length").notNull(),
+    documentByteLength: integer("document_byte_length").notNull(),
+    documentCount: integer("document_count").notNull(),
+    documentUpdateCount: integer("document_update_count").notNull(),
+    totalByteLength: integer("total_byte_length").notNull(),
+    refreshedAt: text("refreshed_at").notNull(),
+}, (table) => [
+    primaryKey({ columns: [table.organizationId, table.requesterUserId] }),
+]);
+/** Exact document-category rows belonging to a requester usage snapshot. */
+export const organizationDataUsageCategories = sqliteTable("organization_data_usage_categories", {
+    organizationId: text("organization_id").notNull(),
+    requesterUserId: text("requester_user_id").notNull(),
+    category: text("category").notNull(),
+    byteLength: integer("byte_length").notNull(),
+    documentCount: integer("document_count").notNull(),
+    updateCount: integer("update_count").notNull(),
+}, (table) => [
+    primaryKey({
+        columns: [table.organizationId, table.requesterUserId, table.category],
+    }),
+]);
+export const organizationDataUsageTables = [
+    defineSqlTableSchema(organizationDataUsageSnapshots),
+    defineSqlTableSchema(organizationDataUsageCategories),
+];
+export const organizationDataUsageSQLiteSchema = {
+    organizationDataUsageSnapshots,
+    organizationDataUsageCategories,
+};
+//# sourceMappingURL=organizationDataUsageSchema.js.map

package/data/sqlite/organizationDataUsageSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationDataUsageSchema.js","sourceRoot":"","sources":["organizationDataUsageSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAuB,MAAM,kBAAkB,CAAC;AAE7E,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAU,CAAC;AAErE,qEAAqE;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,WAAW,CACvD,mCAAmC,EACnC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,iBAAiB,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IAC1D,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,cAAc,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE;IACrD,kBAAkB,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;IAC7D,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAClD,mBAAmB,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE;IAC/D,eAAe,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACvD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;CAC5C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;CACvE,CACF,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,oCAAoC,EACpC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IAC5C,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAClD,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;CAC/C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC;KACvE,CAAC;CACH,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAkC;IACxE,oBAAoB,CAAC,8BAA8B,CAAC;IACpD,oBAAoB,CAAC,+BAA+B,CAAC;CACtD,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,8BAA8B;IAC9B,+BAA+B;CAChC,CAAC","sourcesContent":["import {\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\nimport { defineSqlTableSchema, type SqlTableSchema } from \"./sqlTableSchema\";\n\nexport const ORGANIZATION_DATA_USAGE_PROJECTION_VERSION = 1 as const;\n\n/** One server-computed usage snapshot per organization requester. */\nexport const organizationDataUsageSnapshots = sqliteTable(\n  \"organization_data_usage_snapshots\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    requesterUserId: text(\"requester_user_id\").notNull(),\n    projectionVersion: integer(\"projection_version\").notNull(),\n    blobCount: integer(\"blob_count\").notNull(),\n    blobByteLength: integer(\"blob_byte_length\").notNull(),\n    documentByteLength: integer(\"document_byte_length\").notNull(),\n    documentCount: integer(\"document_count\").notNull(),\n    documentUpdateCount: integer(\"document_update_count\").notNull(),\n    totalByteLength: integer(\"total_byte_length\").notNull(),\n    refreshedAt: text(\"refreshed_at\").notNull(),\n  },\n  (table) => [\n    primaryKey({ columns: [table.organizationId, table.requesterUserId] }),\n  ],\n);\n\n/** Exact document-category rows belonging to a requester usage snapshot. */\nexport const organizationDataUsageCategories = sqliteTable(\n  \"organization_data_usage_categories\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    requesterUserId: text(\"requester_user_id\").notNull(),\n    category: text(\"category\").notNull(),\n    byteLength: integer(\"byte_length\").notNull(),\n    documentCount: integer(\"document_count\").notNull(),\n    updateCount: integer(\"update_count\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [table.organizationId, table.requesterUserId, table.category],\n    }),\n  ],\n);\n\nexport const organizationDataUsageTables: ReadonlyArray<SqlTableSchema> = [\n  defineSqlTableSchema(organizationDataUsageSnapshots),\n  defineSqlTableSchema(organizationDataUsageCategories),\n];\n\nexport const organizationDataUsageSQLiteSchema = {\n  organizationDataUsageSnapshots,\n  organizationDataUsageCategories,\n};\n"]}

package/data/sqlite/organizationFounderSchema.js

@@ -0,0 +1,9 @@
+import { sqliteTable, text } from "drizzle-orm/sqlite-core";
+/** Immutable authority for a personal organization's signed replacement. */
+export const organizationFounders = sqliteTable("organization_founders", {
+    organizationId: text("organization_id").primaryKey(),
+    userId: text("user_id").notNull(),
+    signingKeyFingerprint: text("signing_key_fingerprint").notNull(),
+    genesisStateHash: text("genesis_state_hash").notNull(),
+});
+//# sourceMappingURL=organizationFounderSchema.js.map

package/data/sqlite/organizationFounderSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationFounderSchema.js","sourceRoot":"","sources":["organizationFounderSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC,uBAAuB,EAAE;IACvE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,EAAE;IACpD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAChE,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;CACvD,CAAC,CAAC","sourcesContent":["import { sqliteTable, text } from \"drizzle-orm/sqlite-core\";\n\n/** Immutable authority for a personal organization's signed replacement. */\nexport const organizationFounders = sqliteTable(\"organization_founders\", {\n  organizationId: text(\"organization_id\").primaryKey(),\n  userId: text(\"user_id\").notNull(),\n  signingKeyFingerprint: text(\"signing_key_fingerprint\").notNull(),\n  genesisStateHash: text(\"genesis_state_hash\").notNull(),\n});\n"]}

package/data/sqlite/organizationProvisioningAttemptSchema.js

@@ -0,0 +1,23 @@
+import { sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { defineSqlTableSchema } from "./sqlTableSchema.js";
+/**
+ * Durable client-side handoff for a purged personal organization replacement.
+ *
+ * The replacement request is intentionally retained until both remote
+ * provisioning and the organization-scoped local reset commit. A lost HTTP
+ * response or a failed local reset can therefore replay the exact signed
+ * artifacts instead of minting an incompatible second organization.
+ */
+export const organizationProvisioningAttempts = sqliteTable("organization_provisioning_attempts", {
+    replacedOrganizationId: text("replaced_organization_id").primaryKey(),
+    userId: text("user_id").notNull(),
+    organizationId: text("organization_id").notNull(),
+    rootContainerId: text("root_container_id").notNull(),
+    serializedArtifacts: text("serialized_artifacts").notNull(),
+    createdAt: text("created_at").notNull(),
+});
+export const organizationProvisioningAttemptTables = [defineSqlTableSchema(organizationProvisioningAttempts)];
+export const organizationProvisioningAttemptSQLiteSchema = {
+    organizationProvisioningAttempts,
+};
+//# sourceMappingURL=organizationProvisioningAttemptSchema.js.map

package/data/sqlite/organizationProvisioningAttemptSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationProvisioningAttemptSchema.js","sourceRoot":"","sources":["organizationProvisioningAttemptSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAuB,MAAM,kBAAkB,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,WAAW,CACzD,oCAAoC,EACpC;IACE,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,UAAU,EAAE;IACrE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,mBAAmB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE;IAC3D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAChD,CAAC,oBAAoB,CAAC,gCAAgC,CAAC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,2CAA2C,GAAG;IACzD,gCAAgC;CACjC,CAAC","sourcesContent":["import { sqliteTable, text } from \"drizzle-orm/sqlite-core\";\nimport { defineSqlTableSchema, type SqlTableSchema } from \"./sqlTableSchema\";\n\n/**\n * Durable client-side handoff for a purged personal organization replacement.\n *\n * The replacement request is intentionally retained until both remote\n * provisioning and the organization-scoped local reset commit. A lost HTTP\n * response or a failed local reset can therefore replay the exact signed\n * artifacts instead of minting an incompatible second organization.\n */\nexport const organizationProvisioningAttempts = sqliteTable(\n  \"organization_provisioning_attempts\",\n  {\n    replacedOrganizationId: text(\"replaced_organization_id\").primaryKey(),\n    userId: text(\"user_id\").notNull(),\n    organizationId: text(\"organization_id\").notNull(),\n    rootContainerId: text(\"root_container_id\").notNull(),\n    serializedArtifacts: text(\"serialized_artifacts\").notNull(),\n    createdAt: text(\"created_at\").notNull(),\n  },\n);\n\nexport const organizationProvisioningAttemptTables: ReadonlyArray<SqlTableSchema> =\n  [defineSqlTableSchema(organizationProvisioningAttempts)];\n\nexport const organizationProvisioningAttemptSQLiteSchema = {\n  organizationProvisioningAttempts,\n};\n"]}

package/data/sqlite/organizationReadModelSchema.js

@@ -0,0 +1,133 @@
+import { integer, primaryKey, sqliteTable, text, } from "drizzle-orm/sqlite-core";
+/** Cursor and lane-level fields for one locally projected organization. */
+export const organizationReadModelState = sqliteTable("organization_read_model_state", {
+    organizationId: text("organization_id").notNull(),
+    cursor: text("cursor").notNull(),
+    profileDocumentId: text("profile_document_id"),
+    memberGroupId: text("member_group_id").notNull(),
+    updatedAt: text("updated_at").notNull(),
+}, (table) => [primaryKey({ columns: [table.organizationId] })]);
+/** Requester-scoped fields that must not become organization-global state. */
+export const organizationReadModelRequesters = sqliteTable("organization_read_model_requesters", {
+    organizationId: text("organization_id").notNull(),
+    userId: text("user_id").notNull(),
+    isOrgAdmin: integer("is_org_admin", { mode: "boolean" }).notNull(),
+    updatedAt: text("updated_at").notNull(),
+}, (table) => [primaryKey({ columns: [table.organizationId, table.userId] })]);
+/** Normalized organization directory rows. `isSelf` is derived at read time. */
+export const organizationReadModelDirectoryUsers = sqliteTable("organization_read_model_directory_users", {
+    organizationId: text("organization_id").notNull(),
+    userId: text("user_id").notNull(),
+    sortOrder: integer("sort_order").notNull(),
+    signingKeyFingerprint: text("signing_key_fingerprint").notNull(),
+    signingPublicKey: text("signing_public_key").notNull(),
+    encapsulationPublicKey: text("encapsulation_public_key").notNull(),
+    encapsulationKeyFingerprint: text("encapsulation_key_fingerprint").notNull(),
+    isPersonalOrganizationOwner: integer("is_personal_organization_owner", {
+        mode: "boolean",
+    }).notNull(),
+    createdAt: text("created_at").notNull(),
+    status: text("status").notNull(),
+    profileDocumentId: text("profile_document_id"),
+    joinedAt: text("joined_at").notNull(),
+    updatedAt: text("updated_at").notNull(),
+    disabledAt: text("disabled_at"),
+    disabledByUserId: text("disabled_by_user_id"),
+}, (table) => [primaryKey({ columns: [table.organizationId, table.userId] })]);
+/** Normalized organization group summaries and their current state heads. */
+export const organizationReadModelGroups = sqliteTable("organization_read_model_groups", {
+    organizationId: text("organization_id").notNull(),
+    groupId: text("group_id").notNull(),
+    sortOrder: integer("sort_order").notNull(),
+    name: text("name").notNull(),
+    createdAt: text("created_at").notNull(),
+    isBuiltin: integer("is_builtin", { mode: "boolean" }).notNull(),
+    stateHash: text("state_hash"),
+    stateVersion: integer("state_version"),
+    keyEpoch: integer("key_epoch"),
+    memberCount: integer("member_count"),
+}, (table) => [primaryKey({ columns: [table.organizationId, table.groupId] })]);
+/** Exact policy-state heads used to bind locally projected cryptographic data. */
+export const organizationReadModelPolicyHeads = sqliteTable("organization_read_model_policy_heads", {
+    organizationId: text("organization_id").notNull(),
+    principalType: text("principal_type").notNull(),
+    principalId: text("principal_id").notNull(),
+    stateHash: text("state_hash").notNull(),
+    stateVersion: integer("state_version").notNull(),
+    keyEpoch: integer("key_epoch").notNull(),
+    keyFingerprint: text("key_fingerprint").notNull(),
+    memberCount: integer("member_count").notNull(),
+}, (table) => [
+    primaryKey({
+        columns: [table.organizationId, table.principalType, table.principalId],
+    }),
+]);
+/** State-hash-bound completeness rows for each projected group membership. */
+export const organizationReadModelGroupMemberships = sqliteTable("organization_read_model_group_memberships", {
+    organizationId: text("organization_id").notNull(),
+    groupId: text("group_id").notNull(),
+    stateHash: text("state_hash").notNull(),
+}, (table) => [primaryKey({ columns: [table.organizationId, table.groupId] })]);
+/** Direct users bound to the exact state in the membership completeness row. */
+export const organizationReadModelGroupMembers = sqliteTable("organization_read_model_group_members", {
+    organizationId: text("organization_id").notNull(),
+    groupId: text("group_id").notNull(),
+    userId: text("user_id").notNull(),
+    sortOrder: integer("sort_order").notNull(),
+    stateHash: text("state_hash").notNull(),
+    role: text("role").notNull(),
+    signingKeyFingerprint: text("signing_key_fingerprint"),
+    signingPublicKey: text("signing_public_key"),
+    encapsulationPublicKey: text("encapsulation_public_key"),
+    encapsulationKeyFingerprint: text("encapsulation_key_fingerprint"),
+}, (table) => [
+    primaryKey({
+        columns: [table.organizationId, table.groupId, table.userId],
+    }),
+]);
+/**
+ * Durable record of a server 403/404 for one requester's presentation
+ * projection. Written before the revoked rows are purged so a purge failure
+ * followed by an offline restart cannot serve the revoked projection; cleared
+ * only by a successful authoritative reconcile for the same scope.
+ */
+export const organizationPresentationDenials = sqliteTable("organization_presentation_denials", {
+    organizationId: text("organization_id").notNull(),
+    requesterUserId: text("requester_user_id").notNull(),
+    projection: text("projection").notNull(),
+    deniedAt: text("denied_at").notNull(),
+}, (table) => [
+    primaryKey({
+        columns: [table.organizationId, table.requesterUserId, table.projection],
+    }),
+]);
+/** Whole-lane container grants used only by organization presentation reads. */
+export const organizationReadModelContainerGrants = sqliteTable("organization_read_model_container_grants", {
+    organizationId: text("organization_id").notNull(),
+    containerId: text("container_id").notNull(),
+    subjectType: text("subject_type").notNull(),
+    subjectId: text("subject_id").notNull(),
+    sortOrder: integer("sort_order").notNull(),
+    accessLevel: text("access_level").notNull(),
+    createdAt: text("created_at").notNull(),
+    depth: integer("depth").notNull(),
+    isBuiltin: integer("is_builtin", { mode: "boolean" }).notNull(),
+    metadataAccessEpoch: integer("metadata_access_epoch").notNull(),
+    metadataAccessStateHash: text("metadata_access_state_hash").notNull(),
+    metadataDocumentId: text("metadata_document_id"),
+    parentId: text("parent_id"),
+    updatedAt: text("updated_at").notNull(),
+    userId: text("user_id"),
+    signingKeyFingerprint: text("signing_key_fingerprint"),
+    groupId: text("group_id"),
+}, (table) => [
+    primaryKey({
+        columns: [
+            table.organizationId,
+            table.containerId,
+            table.subjectType,
+            table.subjectId,
+        ],
+    }),
+]);
+//# sourceMappingURL=organizationReadModelSchema.js.map

package/data/sqlite/organizationReadModelSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReadModelSchema.js","sourceRoot":"","sources":["organizationReadModelSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,+BAA+B,EAC/B;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC9C,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IAChD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAC7D,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,oCAAoC,EACpC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,UAAU,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAClE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAC3E,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,mCAAmC,GAAG,WAAW,CAC5D,yCAAyC,EACzC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAChE,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE;IAClE,2BAA2B,EAAE,IAAI,CAC/B,+BAA+B,CAChC,CAAC,OAAO,EAAE;IACX,2BAA2B,EAAE,OAAO,CAAC,gCAAgC,EAAE;QACrE,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC,OAAO,EAAE;IACZ,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC9C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC;CAC9C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAC3E,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CACpD,gCAAgC,EAChC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;CACrC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,gCAAgC,GAAG,WAAW,CACzD,sCAAsC,EACtC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAChD,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;CAC/C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC;KACxE,CAAC;CACH,CACF,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qCAAqC,GAAG,WAAW,CAC9D,2CAA2C,EAC3C;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,iCAAiC,GAAG,WAAW,CAC1D,uCAAuC,EACvC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC5C,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC;IACxD,2BAA2B,EAAE,IAAI,CAAC,+BAA+B,CAAC;CACnE,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;KAC7D,CAAC;CACH,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,mCAAmC,EACnC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;CACtC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC;KACzE,CAAC;CACH,CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,oCAAoC,GAAG,WAAW,CAC7D,0CAA0C,EAC1C;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/D,mBAAmB,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE;IAC/D,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE;IACrE,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IACvB,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;CAC1B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE;YACP,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,SAAS;SAChB;KACF,CAAC;CACH,CACF,CAAC","sourcesContent":["import {\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\n\n/** Cursor and lane-level fields for one locally projected organization. */\nexport const organizationReadModelState = sqliteTable(\n  \"organization_read_model_state\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    cursor: text(\"cursor\").notNull(),\n    profileDocumentId: text(\"profile_document_id\"),\n    memberGroupId: text(\"member_group_id\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId] })],\n);\n\n/** Requester-scoped fields that must not become organization-global state. */\nexport const organizationReadModelRequesters = sqliteTable(\n  \"organization_read_model_requesters\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    userId: text(\"user_id\").notNull(),\n    isOrgAdmin: integer(\"is_org_admin\", { mode: \"boolean\" }).notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.userId] })],\n);\n\n/** Normalized organization directory rows. `isSelf` is derived at read time. */\nexport const organizationReadModelDirectoryUsers = sqliteTable(\n  \"organization_read_model_directory_users\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    userId: text(\"user_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    signingKeyFingerprint: text(\"signing_key_fingerprint\").notNull(),\n    signingPublicKey: text(\"signing_public_key\").notNull(),\n    encapsulationPublicKey: text(\"encapsulation_public_key\").notNull(),\n    encapsulationKeyFingerprint: text(\n      \"encapsulation_key_fingerprint\",\n    ).notNull(),\n    isPersonalOrganizationOwner: integer(\"is_personal_organization_owner\", {\n      mode: \"boolean\",\n    }).notNull(),\n    createdAt: text(\"created_at\").notNull(),\n    status: text(\"status\").notNull(),\n    profileDocumentId: text(\"profile_document_id\"),\n    joinedAt: text(\"joined_at\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n    disabledAt: text(\"disabled_at\"),\n    disabledByUserId: text(\"disabled_by_user_id\"),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.userId] })],\n);\n\n/** Normalized organization group summaries and their current state heads. */\nexport const organizationReadModelGroups = sqliteTable(\n  \"organization_read_model_groups\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    groupId: text(\"group_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    name: text(\"name\").notNull(),\n    createdAt: text(\"created_at\").notNull(),\n    isBuiltin: integer(\"is_builtin\", { mode: \"boolean\" }).notNull(),\n    stateHash: text(\"state_hash\"),\n    stateVersion: integer(\"state_version\"),\n    keyEpoch: integer(\"key_epoch\"),\n    memberCount: integer(\"member_count\"),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.groupId] })],\n);\n\n/** Exact policy-state heads used to bind locally projected cryptographic data. */\nexport const organizationReadModelPolicyHeads = sqliteTable(\n  \"organization_read_model_policy_heads\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    principalType: text(\"principal_type\").notNull(),\n    principalId: text(\"principal_id\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    stateVersion: integer(\"state_version\").notNull(),\n    keyEpoch: integer(\"key_epoch\").notNull(),\n    keyFingerprint: text(\"key_fingerprint\").notNull(),\n    memberCount: integer(\"member_count\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [table.organizationId, table.principalType, table.principalId],\n    }),\n  ],\n);\n\n/** State-hash-bound completeness rows for each projected group membership. */\nexport const organizationReadModelGroupMemberships = sqliteTable(\n  \"organization_read_model_group_memberships\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    groupId: text(\"group_id\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.groupId] })],\n);\n\n/** Direct users bound to the exact state in the membership completeness row. */\nexport const organizationReadModelGroupMembers = sqliteTable(\n  \"organization_read_model_group_members\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    groupId: text(\"group_id\").notNull(),\n    userId: text(\"user_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    role: text(\"role\").notNull(),\n    signingKeyFingerprint: text(\"signing_key_fingerprint\"),\n    signingPublicKey: text(\"signing_public_key\"),\n    encapsulationPublicKey: text(\"encapsulation_public_key\"),\n    encapsulationKeyFingerprint: text(\"encapsulation_key_fingerprint\"),\n  },\n  (table) => [\n    primaryKey({\n      columns: [table.organizationId, table.groupId, table.userId],\n    }),\n  ],\n);\n\n/**\n * Durable record of a server 403/404 for one requester's presentation\n * projection. Written before the revoked rows are purged so a purge failure\n * followed by an offline restart cannot serve the revoked projection; cleared\n * only by a successful authoritative reconcile for the same scope.\n */\nexport const organizationPresentationDenials = sqliteTable(\n  \"organization_presentation_denials\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    requesterUserId: text(\"requester_user_id\").notNull(),\n    projection: text(\"projection\").notNull(),\n    deniedAt: text(\"denied_at\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [table.organizationId, table.requesterUserId, table.projection],\n    }),\n  ],\n);\n\n/** Whole-lane container grants used only by organization presentation reads. */\nexport const organizationReadModelContainerGrants = sqliteTable(\n  \"organization_read_model_container_grants\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    containerId: text(\"container_id\").notNull(),\n    subjectType: text(\"subject_type\").notNull(),\n    subjectId: text(\"subject_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    accessLevel: text(\"access_level\").notNull(),\n    createdAt: text(\"created_at\").notNull(),\n    depth: integer(\"depth\").notNull(),\n    isBuiltin: integer(\"is_builtin\", { mode: \"boolean\" }).notNull(),\n    metadataAccessEpoch: integer(\"metadata_access_epoch\").notNull(),\n    metadataAccessStateHash: text(\"metadata_access_state_hash\").notNull(),\n    metadataDocumentId: text(\"metadata_document_id\"),\n    parentId: text(\"parent_id\"),\n    updatedAt: text(\"updated_at\").notNull(),\n    userId: text(\"user_id\"),\n    signingKeyFingerprint: text(\"signing_key_fingerprint\"),\n    groupId: text(\"group_id\"),\n  },\n  (table) => [\n    primaryKey({\n      columns: [\n        table.organizationId,\n        table.containerId,\n        table.subjectType,\n        table.subjectId,\n      ],\n    }),\n  ],\n);\n"]}