@tearleads/client-sdk 0.1.111 → 0.1.112

package/client/organizations/index.js

@@ -1,5 +1,6 @@
 import { runWithSecurityIncidentReporting } from "../../data/keyingProjectionVerification/error.js";
-import { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, listLocalOrganizations, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry, withVerifiedDirectoryUser, } from "../../workflows/organizations/index.js";
+import { DatabaseUnavailableError } from "../../data/sync/databaseUnavailable.js";
+import { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, listLocalOrganizations, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry, withVerifiedDirectoryUser, } from "../../workflows/organizations/index.js";
 import { createOrganizationDataUsageCoordinator, } from "./organizationDataUsage.js";
 import { loadOrganizationGroupPresentationDetails } from "./organizationGroupPresentation.js";
 import { createOrganizationMemberships, } from "./organizationMemberships.js";
@@ -25,11 +26,20 @@ class OrganizationsService {
         this.memberships = createOrganizationMemberships(this.runtimeService, this.containerContents, openReconciler);
     }
     async addUserToGroup(input) {
+        // Group membership admits a user: only a verified identity link or this
+        // device's own keys can establish the identity it is granted to.
+        // The check reads the trust store of the scope this mutation captured, and
+        // that scope must still be current once it returns.
+        const mutation = currentOrganizationMutation(this.runtimeService);
+        await this.runtimeService.identityLinks.requireVerified(input.targetUserId, mutation.runtime.infra.execSql);
+        if (!mutation.stillCurrent()) {
+            throw new DatabaseUnavailableError("The active database changed while admitting this user. Try again.");
+        }
         return addUserToOrganizationGroup({
             ...input,
             containerContents: this.containerContents,
             readModelCoordinator: this.readModelCoordinator,
-            ...currentOrganizationMutation(this.runtimeService),
+            ...mutation,
         });
     }
     readPendingPolicyMutation(organizationId) {
@@ -56,13 +66,6 @@ class OrganizationsService {
             ...currentOrganizationMutation(this.runtimeService),
         });
     }
-    importUserById(userId) {
-        const runtime = this.runtimeService.workflowInput();
-        return importOrganizationUser({
-            resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
-            userId,
-        });
-    }
     loadBilling() {
         return runForOrganization(this.runtimeService, loadOrganizationBilling);
     }

package/client/organizations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,6BAA6B,GAG9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAmD9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC,EACpC,cAAmD;IAEnD,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,oBAAoB;IAML;IACA;IANV,WAAW,CAA0B;IAC7B,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC,EACrD,cAAmD;QAFlC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAGrD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,6BAA6B,CAC9C,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,aAAsB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,aAAa;YACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB,CAAC,aAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,CACrD,SAAS,EACT,aAAa,CACd,CACJ,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC;YAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;QACH,uEAAuE;QACvE,yDAAyD;QACzD,OAAO,CACL,IAAI;YACJ,yBAAyB,CACvB,cAAc,EACd,IAAI,EACJ,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE;gBACjD,cAAc;gBACd,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE;aAClC,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  listLocalOrganizations,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n  withVerifiedDirectoryUser,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n  createOrganizationDataUsageCoordinator,\n  type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n  createOrganizationMemberships,\n  type OrganizationContentReconciler,\n  type OrganizationMemberships,\n} from \"./organizationMemberships\";\nimport {\n  createOrganizationReadModelCoordinator,\n  leaveRequestVerifier,\n  type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n  authenticatedOrganizationId,\n  runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n  type AbandonOrganizationPolicyMutationInput,\n  abandonPendingOrganizationPolicyMutation,\n  type DiscardUnreadableOrganizationPolicyMutationInput,\n  discardUnreadableOrganizationPolicyMutation,\n  readPendingOrganizationPolicyMutation,\n  retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n  type AddOrganizationGroupUserInput,\n  addUserToOrganizationGroup,\n  createGroupForOrganization,\n  deleteGroupForOrganization,\n  type OrganizationGrantRef,\n  type RemoveOrganizationGroupUserInput,\n  removeUserFromOrganizationGroup,\n  revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationLeaveRequestResult,\n  OrganizationMembership,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type {\n  OrganizationContentReconciler,\n  OrganizationMemberships,\n} from \"./organizationMemberships\";\nexport type {\n  OrganizationGroupMutationReceipt,\n  Organizations,\n} from \"./organizationsTypes\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n  AddOrganizationGroupUserInput,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n  runtime: InternalRuntime,\n  containerContents: ContainerContents,\n  openReconciler: () => OrganizationContentReconciler,\n): Organizations {\n  return new OrganizationsService(runtime, containerContents, openReconciler);\n}\n\nclass OrganizationsService implements Organizations {\n  readonly memberships: OrganizationMemberships;\n  private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n  private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n    openReconciler: () => OrganizationContentReconciler,\n  ) {\n    this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n      this.runtimeService,\n    );\n    this.readModelCoordinator = createOrganizationReadModelCoordinator(\n      this.runtimeService,\n    );\n    this.memberships = createOrganizationMemberships(\n      this.runtimeService,\n      this.containerContents,\n      openReconciler,\n    );\n  }\n\n  async addUserToGroup(input: AddOrganizationGroupUserInput) {\n    return addUserToOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  readPendingPolicyMutation(organizationId: string) {\n    return readPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  discardUnreadablePolicyMutation(\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) {\n    return discardUnreadableOrganizationPolicyMutation(\n      this.runtimeService,\n      input,\n    );\n  }\n\n  retryPendingPolicyMutation(organizationId: string) {\n    return retryPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n    return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n  }\n\n  createGroup(name: string) {\n    return createGroupForOrganization({\n      name,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  deleteGroup(groupId: string) {\n    return deleteGroupForOrganization({\n      groupId,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  importUserById(userId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    return importOrganizationUser({\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      userId,\n    });\n  }\n\n  loadBilling() {\n    return runForOrganization(this.runtimeService, loadOrganizationBilling);\n  }\n\n  loadBillingForOrganization(organizationId: string) {\n    // Gated on an authenticated session rather than on the target being the\n    // active org. The server still enforces membership, so an org the caller\n    // cannot reach resolves to `null`.\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBilling,\n      organizationId,\n    );\n  }\n\n  loadBillingHistory() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingHistory,\n    );\n  }\n\n  loadBillingManagementUrl() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingManagementUrl,\n    );\n  }\n\n  loadStripeCheckoutOptions(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      loadStripeCheckoutOptions,\n      organizationId,\n    );\n  }\n\n  createStripeCheckout(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      createStripeCheckout,\n      organizationId,\n    );\n  }\n\n  createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n      organizationId,\n    );\n  }\n\n  cancelStripeSubscription() {\n    return runForOrganization(this.runtimeService, cancelStripeSubscription);\n  }\n\n  claimNativeSubscription(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => claimNativeOrganizationSubscription({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  checkNativePurchaseEligibility(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => checkNativePurchaseEligibility({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  loadDataUsage() {\n    return this.dataUsageCoordinator.reconcile();\n  }\n\n  loadLocalDataUsage() {\n    return this.dataUsageCoordinator.loadLocal();\n  }\n\n  loadDirectoryAndGroups() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcile(),\n    );\n  }\n\n  loadDirectoryAndGroupsAfterMutation() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile_after_mutation\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcileAfterMutation(),\n    );\n  }\n\n  loadLocalDirectoryAndGroups() {\n    return this.readModelCoordinator.loadLocal();\n  }\n\n  loadGroupMembers(groupId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || groupId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return runtime.apiClient.listOrganizationGroupMembers(\n      organizationId,\n      groupId,\n    );\n  }\n\n  loadGroupPresentationDetails(groupId: string, beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: groupId,\n        objectKind: \"principal\",\n        operation: \"group.presentation.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        loadOrganizationGroupPresentationDetails({\n          groupId,\n          beforeVersion,\n          readModelCoordinator: this.readModelCoordinator,\n          runtime,\n        }),\n    );\n  }\n\n  loadGrants() {\n    return this.readModelCoordinator.loadLocalGrants();\n  }\n\n  loadGroupContainers(groupId: string) {\n    return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n  }\n\n  listLocalOrganizations() {\n    const runtime = this.runtimeService.workflowInput();\n    if (runtime.infra.dbStatus !== \"ready\") {\n      return Promise.resolve([]);\n    }\n\n    return listLocalOrganizations({ execSql: runtime.infra.execSql });\n  }\n\n  loadPolicyHistory(beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        this.readModelCoordinator.loadOrganizationPolicyHistory(\n          undefined,\n          beforeVersion,\n        ),\n    );\n  }\n\n  loadUserDetail(userId: string) {\n    return this.readModelCoordinator.loadLocalUserDetail(userId);\n  }\n\n  async updateRosterEntry(userId: string, profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || userId.length === 0) {\n      return null;\n    }\n\n    const user = await updateOrganizationRosterEntry({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n      userId,\n    });\n    // Callers store this response as directory state, so its leave request\n    // passes the same check as one read from the read model.\n    return (\n      user &&\n      withVerifiedDirectoryUser(\n        organizationId,\n        user,\n        leaveRequestVerifier(this.runtimeService, runtime, {\n          organizationId,\n          userId: runtime.auth.userId ?? \"\",\n        }),\n      )\n    );\n  }\n\n  updateProfile(profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationProfile({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n    });\n  }\n\n  async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n    return removeUserFromOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  async revokeGrant(grant: OrganizationGrantRef) {\n    return revokeOrganizationGrant({\n      ...grant,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  startTrial(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      startOrganizationTrial,\n      organizationId,\n    );\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,6BAA6B,GAG9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAkD9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC,EACpC,cAAmD;IAEnD,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,oBAAoB;IAML;IACA;IANV,WAAW,CAA0B;IAC7B,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC,EACrD,cAAmD;QAFlC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAGrD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,6BAA6B,CAC9C,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,wEAAwE;QACxE,iEAAiE;QACjE,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,eAAe,CACrD,KAAK,CAAC,YAAY,EAClB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC/B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAChC,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,QAAQ;SACZ,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,aAAsB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,aAAa;YACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB,CAAC,aAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,CACrD,SAAS,EACT,aAAa,CACd,CACJ,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC;YAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;QACH,uEAAuE;QACvE,yDAAyD;QACzD,OAAO,CACL,IAAI;YACJ,yBAAyB,CACvB,cAAc,EACd,IAAI,EACJ,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE;gBACjD,cAAc;gBACd,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE;aAClC,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport { DatabaseUnavailableError } from \"../../data/sync/databaseUnavailable\";\nimport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  listLocalOrganizations,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n  withVerifiedDirectoryUser,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n  createOrganizationDataUsageCoordinator,\n  type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n  createOrganizationMemberships,\n  type OrganizationContentReconciler,\n  type OrganizationMemberships,\n} from \"./organizationMemberships\";\nimport {\n  createOrganizationReadModelCoordinator,\n  leaveRequestVerifier,\n  type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n  authenticatedOrganizationId,\n  runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n  type AbandonOrganizationPolicyMutationInput,\n  abandonPendingOrganizationPolicyMutation,\n  type DiscardUnreadableOrganizationPolicyMutationInput,\n  discardUnreadableOrganizationPolicyMutation,\n  readPendingOrganizationPolicyMutation,\n  retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n  type AddOrganizationGroupUserInput,\n  addUserToOrganizationGroup,\n  createGroupForOrganization,\n  deleteGroupForOrganization,\n  type OrganizationGrantRef,\n  type RemoveOrganizationGroupUserInput,\n  removeUserFromOrganizationGroup,\n  revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationLeaveRequestResult,\n  OrganizationMembership,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type {\n  OrganizationContentReconciler,\n  OrganizationMemberships,\n} from \"./organizationMemberships\";\nexport type {\n  OrganizationGroupMutationReceipt,\n  Organizations,\n} from \"./organizationsTypes\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n  AddOrganizationGroupUserInput,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n  runtime: InternalRuntime,\n  containerContents: ContainerContents,\n  openReconciler: () => OrganizationContentReconciler,\n): Organizations {\n  return new OrganizationsService(runtime, containerContents, openReconciler);\n}\n\nclass OrganizationsService implements Organizations {\n  readonly memberships: OrganizationMemberships;\n  private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n  private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n    openReconciler: () => OrganizationContentReconciler,\n  ) {\n    this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n      this.runtimeService,\n    );\n    this.readModelCoordinator = createOrganizationReadModelCoordinator(\n      this.runtimeService,\n    );\n    this.memberships = createOrganizationMemberships(\n      this.runtimeService,\n      this.containerContents,\n      openReconciler,\n    );\n  }\n\n  async addUserToGroup(input: AddOrganizationGroupUserInput) {\n    // Group membership admits a user: only a verified identity link or this\n    // device's own keys can establish the identity it is granted to.\n    // The check reads the trust store of the scope this mutation captured, and\n    // that scope must still be current once it returns.\n    const mutation = currentOrganizationMutation(this.runtimeService);\n    await this.runtimeService.identityLinks.requireVerified(\n      input.targetUserId,\n      mutation.runtime.infra.execSql,\n    );\n    if (!mutation.stillCurrent()) {\n      throw new DatabaseUnavailableError(\n        \"The active database changed while admitting this user. Try again.\",\n      );\n    }\n    return addUserToOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...mutation,\n    });\n  }\n\n  readPendingPolicyMutation(organizationId: string) {\n    return readPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  discardUnreadablePolicyMutation(\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) {\n    return discardUnreadableOrganizationPolicyMutation(\n      this.runtimeService,\n      input,\n    );\n  }\n\n  retryPendingPolicyMutation(organizationId: string) {\n    return retryPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n    return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n  }\n\n  createGroup(name: string) {\n    return createGroupForOrganization({\n      name,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  deleteGroup(groupId: string) {\n    return deleteGroupForOrganization({\n      groupId,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  loadBilling() {\n    return runForOrganization(this.runtimeService, loadOrganizationBilling);\n  }\n\n  loadBillingForOrganization(organizationId: string) {\n    // Gated on an authenticated session rather than on the target being the\n    // active org. The server still enforces membership, so an org the caller\n    // cannot reach resolves to `null`.\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBilling,\n      organizationId,\n    );\n  }\n\n  loadBillingHistory() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingHistory,\n    );\n  }\n\n  loadBillingManagementUrl() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingManagementUrl,\n    );\n  }\n\n  loadStripeCheckoutOptions(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      loadStripeCheckoutOptions,\n      organizationId,\n    );\n  }\n\n  createStripeCheckout(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      createStripeCheckout,\n      organizationId,\n    );\n  }\n\n  createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n      organizationId,\n    );\n  }\n\n  cancelStripeSubscription() {\n    return runForOrganization(this.runtimeService, cancelStripeSubscription);\n  }\n\n  claimNativeSubscription(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => claimNativeOrganizationSubscription({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  checkNativePurchaseEligibility(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => checkNativePurchaseEligibility({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  loadDataUsage() {\n    return this.dataUsageCoordinator.reconcile();\n  }\n\n  loadLocalDataUsage() {\n    return this.dataUsageCoordinator.loadLocal();\n  }\n\n  loadDirectoryAndGroups() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcile(),\n    );\n  }\n\n  loadDirectoryAndGroupsAfterMutation() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile_after_mutation\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcileAfterMutation(),\n    );\n  }\n\n  loadLocalDirectoryAndGroups() {\n    return this.readModelCoordinator.loadLocal();\n  }\n\n  loadGroupMembers(groupId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || groupId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return runtime.apiClient.listOrganizationGroupMembers(\n      organizationId,\n      groupId,\n    );\n  }\n\n  loadGroupPresentationDetails(groupId: string, beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: groupId,\n        objectKind: \"principal\",\n        operation: \"group.presentation.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        loadOrganizationGroupPresentationDetails({\n          groupId,\n          beforeVersion,\n          readModelCoordinator: this.readModelCoordinator,\n          runtime,\n        }),\n    );\n  }\n\n  loadGrants() {\n    return this.readModelCoordinator.loadLocalGrants();\n  }\n\n  loadGroupContainers(groupId: string) {\n    return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n  }\n\n  listLocalOrganizations() {\n    const runtime = this.runtimeService.workflowInput();\n    if (runtime.infra.dbStatus !== \"ready\") {\n      return Promise.resolve([]);\n    }\n\n    return listLocalOrganizations({ execSql: runtime.infra.execSql });\n  }\n\n  loadPolicyHistory(beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        this.readModelCoordinator.loadOrganizationPolicyHistory(\n          undefined,\n          beforeVersion,\n        ),\n    );\n  }\n\n  loadUserDetail(userId: string) {\n    return this.readModelCoordinator.loadLocalUserDetail(userId);\n  }\n\n  async updateRosterEntry(userId: string, profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || userId.length === 0) {\n      return null;\n    }\n\n    const user = await updateOrganizationRosterEntry({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n      userId,\n    });\n    // Callers store this response as directory state, so its leave request\n    // passes the same check as one read from the read model.\n    return (\n      user &&\n      withVerifiedDirectoryUser(\n        organizationId,\n        user,\n        leaveRequestVerifier(this.runtimeService, runtime, {\n          organizationId,\n          userId: runtime.auth.userId ?? \"\",\n        }),\n      )\n    );\n  }\n\n  updateProfile(profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationProfile({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n    });\n  }\n\n  async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n    return removeUserFromOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  async revokeGrant(grant: OrganizationGrantRef) {\n    return revokeOrganizationGrant({\n      ...grant,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  startTrial(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      startOrganizationTrial,\n      organizationId,\n    );\n  }\n}\n"]}

package/client/organizations/organizationsTypes.d.ts

@@ -1,6 +1,6 @@
 import type { NativeSubscriptionStore } from "../../internal/validators/billing.js";
 import type { PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
-import type { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, revokeOrganizationContainerGrant, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
+import type { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, revokeOrganizationContainerGrant, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
 import type { InternalWorkflowRuntimeInput } from "../runtime/workflowRuntime.js";
 import type { OrganizationDataUsageCoordinator } from "./organizationDataUsage.js";
 import type { loadOrganizationGroupPresentationDetails } from "./organizationGroupPresentation.js";
@@ -18,7 +18,6 @@ export interface Organizations {
     addUserToGroup: (input: AddOrganizationGroupUserInput) => Promise<OrganizationGroupMutationReceipt>;
     createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;
     deleteGroup: (groupId: string) => ReturnType<typeof deleteGroupForOrganization>;
-    importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;
     loadBilling: () => ReturnType<typeof loadOrganizationBilling>;
     /** Billing for an organization the session is not currently switched to. */
     loadBillingForOrganization: (organizationId: string) => ReturnType<typeof loadOrganizationBilling>;

package/client/organizations/organizationsTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createOrganizationGroup,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  LocalOrganizationSummary,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationMemberships } from \"./organizationMemberships\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n  AddOrganizationGroupUserInput,\n  deleteGroupForOrganization,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. */\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n  discardUnreadablePolicyMutation: (\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  readPendingPolicyMutation: (\n    organizationId: string,\n  ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n  retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n  abandonPendingPolicyMutation: (\n    input: AbandonOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  addUserToGroup: (\n    input: AddOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n  deleteGroup: (\n    groupId: string,\n  ) => ReturnType<typeof deleteGroupForOrganization>;\n  importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n  loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n  /** Billing for an organization the session is not currently switched to. */\n  loadBillingForOrganization: (\n    organizationId: string,\n  ) => ReturnType<typeof loadOrganizationBilling>;\n  loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n  loadBillingManagementUrl: () => ReturnType<\n    typeof loadOrganizationBillingManagementUrl\n  >;\n  /** Direct Stripe checkout (issue #1654): options, start, and cancel. */\n  loadStripeCheckoutOptions: (\n    organizationId?: string,\n  ) => ReturnType<typeof loadStripeCheckoutOptions>;\n  createStripeCheckout: (\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckout>;\n  createStripeCheckoutSession: (\n    returnUrl: string,\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckoutSession>;\n  cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n  claimNativeSubscription: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n  checkNativePurchaseEligibility: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof checkNativePurchaseEligibility>;\n  loadDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"reconcile\"]\n  >;\n  loadLocalDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"loadLocal\"]\n  >;\n  loadDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcile\"]\n  >;\n  loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n  >;\n  loadLocalDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocal\"]\n  >;\n  loadGroupMembers: (\n    groupId: string,\n  ) => ReturnType<\n    InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n  >;\n  loadGroupPresentationDetails(\n    groupId: string,\n    beforeVersion?: number,\n  ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n  loadGroupContainers: (\n    groupId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n  loadGrants: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n  >;\n  listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n  /** The user's own memberships and per-organization sync choices. */\n  readonly memberships: OrganizationMemberships;\n  loadPolicyHistory: (\n    beforeVersion?: number,\n  ) => ReturnType<\n    OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n  >;\n  loadUserDetail: (\n    userId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n  updateRosterEntry: (\n    userId: string,\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationRosterEntry>;\n  updateProfile: (\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationProfile>;\n  removeUserFromGroup: (\n    input: RemoveOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  revokeGrant: (\n    grant: OrganizationGrantRef,\n  ) => Promise<\n    | Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n    | OrganizationGroupMutationReceipt\n  >;\n  startTrial: (\n    organizationId?: string,\n  ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}
+{"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createOrganizationGroup,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  LocalOrganizationSummary,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationMemberships } from \"./organizationMemberships\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n  AddOrganizationGroupUserInput,\n  deleteGroupForOrganization,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. */\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n  discardUnreadablePolicyMutation: (\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  readPendingPolicyMutation: (\n    organizationId: string,\n  ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n  retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n  abandonPendingPolicyMutation: (\n    input: AbandonOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  addUserToGroup: (\n    input: AddOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n  deleteGroup: (\n    groupId: string,\n  ) => ReturnType<typeof deleteGroupForOrganization>;\n  loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n  /** Billing for an organization the session is not currently switched to. */\n  loadBillingForOrganization: (\n    organizationId: string,\n  ) => ReturnType<typeof loadOrganizationBilling>;\n  loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n  loadBillingManagementUrl: () => ReturnType<\n    typeof loadOrganizationBillingManagementUrl\n  >;\n  /** Direct Stripe checkout (issue #1654): options, start, and cancel. */\n  loadStripeCheckoutOptions: (\n    organizationId?: string,\n  ) => ReturnType<typeof loadStripeCheckoutOptions>;\n  createStripeCheckout: (\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckout>;\n  createStripeCheckoutSession: (\n    returnUrl: string,\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckoutSession>;\n  cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n  claimNativeSubscription: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n  checkNativePurchaseEligibility: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof checkNativePurchaseEligibility>;\n  loadDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"reconcile\"]\n  >;\n  loadLocalDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"loadLocal\"]\n  >;\n  loadDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcile\"]\n  >;\n  loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n  >;\n  loadLocalDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocal\"]\n  >;\n  loadGroupMembers: (\n    groupId: string,\n  ) => ReturnType<\n    InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n  >;\n  loadGroupPresentationDetails(\n    groupId: string,\n    beforeVersion?: number,\n  ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n  loadGroupContainers: (\n    groupId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n  loadGrants: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n  >;\n  listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n  /** The user's own memberships and per-organization sync choices. */\n  readonly memberships: OrganizationMemberships;\n  loadPolicyHistory: (\n    beforeVersion?: number,\n  ) => ReturnType<\n    OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n  >;\n  loadUserDetail: (\n    userId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n  updateRosterEntry: (\n    userId: string,\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationRosterEntry>;\n  updateProfile: (\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationProfile>;\n  removeUserFromGroup: (\n    input: RemoveOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  revokeGrant: (\n    grant: OrganizationGrantRef,\n  ) => Promise<\n    | Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n    | OrganizationGroupMutationReceipt\n  >;\n  startTrial: (\n    organizationId?: string,\n  ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}

package/client/runtime/workflowRuntime.d.ts

@@ -32,7 +32,7 @@ export interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {
     readonly withPrincipalHistoryProtection?: PrincipalHistoryProtectionLease | undefined;
 }
 export interface InternalRuntime {
-    identityLinks: Pick<TrustedUserIdentityService, "createLink" | "verifyLink" | "resolvePinned">;
+    identityLinks: Pick<TrustedUserIdentityService, "createLink" | "verifyLink" | "resolvePinned" | "resolveVerified" | "requireVerified">;
     retirePrincipalHistoryProtection(): void;
     readonly sessionGeneration: number;
     readonly adoptRootContainer: ContainerContentsRootAdopter;

package/client/runtime/workflowRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAIjG,OAAO,EAAgB,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAEhC,sBAAsB,GAGvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,uCAAuC,GAExC,MAAM,0DAA0D,CAAC;AAWlE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAqEpE,SAAS,wBAAwB,CAC/B,YAAyC,EACzC,cAA4B;IAE5B,OAAO,iCAAiC,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,0BAA0B,EAAE,YAAY,CAAC,0BAA0B;QACnE,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;YACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,cAAc;gBACf,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACnE,UAAU,EAAE,cAAc,EAAE;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,cAAc;gBACd,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAkB;IAElB,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;QACtD,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;KAClD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,+BAA+B,CACtC,YAAyC,EACzC,SAA4D,EAC5D,YAAkC;IAElC,OAAO,uCAAuC,CAAC;QAC7C,SAAS;QACT,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAC5C,YAAY,CAAC,mBAAmB;YAC9B,CAAC,CAAC,sBAAsB,CAAC;gBACrB,OAAO;gBACP,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,MAAM;aACP,CAAC;YACJ,CAAC,CAAC,IAAI;QACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB;KACnE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;QACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC;QACrE,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,EACtB,wBAAwB,CACtB,YAAY,EACZ,GAAG,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAC7C,CAAC,IAAI,CACP,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,0BAA0B;QACzC,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,gCAAgC,EAAE,+BAA+B,CAC/D,YAAY,EACZ,iBAAiB,CAAC,IAAI,EACtB,YAAY,CACb;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC;YAAE,kBAAkB,IAAI,CAAC,CAAC;QACxE,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE,EACxE,eAA2C;IAE3C,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,eAAe,EAAE;YAC5B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../../data/documents/documentKinds\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport { type ExecSql, unavailableExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  loadPinnedUserIdentity,\n  type TrustedUserIdentityResolver,\n  type TrustedUserIdentityService,\n} from \"../../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../../workflows/container-contents\";\nimport {\n  createProvisionedPrincipalHistoryPrimer,\n  type ProvisionedPrincipalHistoryPrimer,\n} from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../../workflows/shared/runtimeInput\";\nimport type { Blobs } from \"../blobs\";\nimport type { Identity } from \"../identity\";\nimport { acknowledgedSessionRoot } from \"../session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"../session/sessionTypes\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport {\n  createPrincipalMutationApiCustody,\n  type PrincipalMutationApi,\n} from \"./principalMutationApi\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: PrincipalMutationApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  identityLinks: Pick<\n    TrustedUserIdentityService,\n    \"createLink\" | \"verifyLink\" | \"resolvePinned\"\n  >;\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  readonly primeProvisionedPrincipalHistory: ProvisionedPrincipalHistoryPrimer;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  principalMutationTimeoutMs?: number | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nfunction createRuntimeMutationApi(\n  dependencies: WorkflowRuntimeDependencies,\n  readGeneration: () => number,\n) {\n  return createPrincipalMutationApiCustody({\n    api: dependencies.api,\n    principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,\n    readScope: () => {\n      const { signingKeyPair, signingFingerprint } = dependencies.identity;\n      const { userId, isAuthenticated } = dependencies.session;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !isAuthenticated ||\n        !userId ||\n        !signingKeyPair ||\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        database: dependencies.getDomainScope(),\n        execSql: dependencies.database.requireExecSql(\"principal mutation\"),\n        generation: readGeneration(),\n        identityTrustDomain,\n        signingFingerprint,\n        signingKeyPair,\n        userId,\n      };\n    },\n  });\n}\n\nfunction localIdentityCandidate(\n  identity: Identity,\n): LocalUserIdentityCandidate | null {\n  const { encapsulationKeyPair, signingKeyPair } = identity;\n  if (!encapsulationKeyPair || !signingKeyPair) return null;\n  return {\n    encapsulationPublicKey: encapsulationKeyPair.publicKey,\n    signingKeyFingerprint: identity.signingFingerprint,\n    signingPublicKey: signingKeyPair.signingPublicKey,\n  };\n}\n\n/** Priming reads the runtime's database, identity and trust pins; it pins nothing. */\nfunction createRuntimeProvisioningPrimer(\n  dependencies: WorkflowRuntimeDependencies,\n  bindLease: () => PrincipalHistoryProtectionLease | undefined,\n  readyExecSql: () => ExecSql | null,\n): ProvisionedPrincipalHistoryPrimer {\n  return createProvisionedPrincipalHistoryPrimer({\n    bindLease,\n    execSqlFor: (database) =>\n      dependencies.database.client === database ? readyExecSql() : null,\n    loadPinnedIdentity: async (execSql, userId) =>\n      dependencies.identityTrustDomain\n        ? loadPinnedUserIdentity({\n            execSql,\n            identityTrustDomain: dependencies.identityTrustDomain,\n            userId,\n          })\n        : null,\n    logError: dependencies.logError,\n    signingFingerprint: () => dependencies.identity.signingFingerprint,\n  });\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const readyExecSql = () =>\n    dependencies.database.status === \"ready\"\n      ? dependencies.database.requireExecSql(\"trusted user identity\")\n      : null;\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: readyExecSql,\n    getLocalIdentity: () => localIdentityCandidate(dependencies.identity),\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n    createRuntimeMutationApi(\n      dependencies,\n      () => runtimeSubscription.mutationGeneration,\n    ).bind,\n  );\n\n  return {\n    identityLinks: trustedUserIdentityService,\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    primeProvisionedPrincipalHistory: createRuntimeProvisioningPrimer(\n      dependencies,\n      historyProtection.bind,\n      readyExecSql,\n    ),\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let mutationGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    mutationGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    if (sessionScopeChanged(sessionSnapshot, next)) mutationGeneration += 1;\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get mutationGeneration() {\n      return mutationGeneration;\n    },\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken || sessionScopeChanged(previous, next)\n  );\n}\n\n// A transport token renewal cannot turn a definite write refusal into saved work.\n// Journal custody still expires on every change to its identity or storage scope.\nfunction sessionScopeChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n  bindMutationApi: () => PrincipalMutationApi,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: bindMutationApi(),\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}
+{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAIjG,OAAO,EAAgB,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAEhC,sBAAsB,GAGvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,uCAAuC,GAExC,MAAM,0DAA0D,CAAC;AAWlE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAyEpE,SAAS,wBAAwB,CAC/B,YAAyC,EACzC,cAA4B;IAE5B,OAAO,iCAAiC,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,0BAA0B,EAAE,YAAY,CAAC,0BAA0B;QACnE,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;YACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,cAAc;gBACf,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACnE,UAAU,EAAE,cAAc,EAAE;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,cAAc;gBACd,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAkB;IAElB,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;QACtD,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;KAClD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,+BAA+B,CACtC,YAAyC,EACzC,SAA4D,EAC5D,YAAkC;IAElC,OAAO,uCAAuC,CAAC;QAC7C,SAAS;QACT,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAC5C,YAAY,CAAC,mBAAmB;YAC9B,CAAC,CAAC,sBAAsB,CAAC;gBACrB,OAAO;gBACP,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,MAAM;aACP,CAAC;YACJ,CAAC,CAAC,IAAI;QACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB;KACnE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;QACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC;QACrE,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,EACtB,wBAAwB,CACtB,YAAY,EACZ,GAAG,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAC7C,CAAC,IAAI,CACP,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,0BAA0B;QACzC,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,gCAAgC,EAAE,+BAA+B,CAC/D,YAAY,EACZ,iBAAiB,CAAC,IAAI,EACtB,YAAY,CACb;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC;YAAE,kBAAkB,IAAI,CAAC,CAAC;QACxE,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE,EACxE,eAA2C;IAE3C,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,eAAe,EAAE;YAC5B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../../data/documents/documentKinds\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport { type ExecSql, unavailableExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  loadPinnedUserIdentity,\n  type TrustedUserIdentityResolver,\n  type TrustedUserIdentityService,\n} from \"../../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../../workflows/container-contents\";\nimport {\n  createProvisionedPrincipalHistoryPrimer,\n  type ProvisionedPrincipalHistoryPrimer,\n} from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../../workflows/shared/runtimeInput\";\nimport type { Blobs } from \"../blobs\";\nimport type { Identity } from \"../identity\";\nimport { acknowledgedSessionRoot } from \"../session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"../session/sessionTypes\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport {\n  createPrincipalMutationApiCustody,\n  type PrincipalMutationApi,\n} from \"./principalMutationApi\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: PrincipalMutationApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  identityLinks: Pick<\n    TrustedUserIdentityService,\n    | \"createLink\"\n    | \"verifyLink\"\n    | \"resolvePinned\"\n    | \"resolveVerified\"\n    | \"requireVerified\"\n  >;\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  readonly primeProvisionedPrincipalHistory: ProvisionedPrincipalHistoryPrimer;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  principalMutationTimeoutMs?: number | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nfunction createRuntimeMutationApi(\n  dependencies: WorkflowRuntimeDependencies,\n  readGeneration: () => number,\n) {\n  return createPrincipalMutationApiCustody({\n    api: dependencies.api,\n    principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,\n    readScope: () => {\n      const { signingKeyPair, signingFingerprint } = dependencies.identity;\n      const { userId, isAuthenticated } = dependencies.session;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !isAuthenticated ||\n        !userId ||\n        !signingKeyPair ||\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        database: dependencies.getDomainScope(),\n        execSql: dependencies.database.requireExecSql(\"principal mutation\"),\n        generation: readGeneration(),\n        identityTrustDomain,\n        signingFingerprint,\n        signingKeyPair,\n        userId,\n      };\n    },\n  });\n}\n\nfunction localIdentityCandidate(\n  identity: Identity,\n): LocalUserIdentityCandidate | null {\n  const { encapsulationKeyPair, signingKeyPair } = identity;\n  if (!encapsulationKeyPair || !signingKeyPair) return null;\n  return {\n    encapsulationPublicKey: encapsulationKeyPair.publicKey,\n    signingKeyFingerprint: identity.signingFingerprint,\n    signingPublicKey: signingKeyPair.signingPublicKey,\n  };\n}\n\n/** Priming reads the runtime's database, identity and trust pins; it pins nothing. */\nfunction createRuntimeProvisioningPrimer(\n  dependencies: WorkflowRuntimeDependencies,\n  bindLease: () => PrincipalHistoryProtectionLease | undefined,\n  readyExecSql: () => ExecSql | null,\n): ProvisionedPrincipalHistoryPrimer {\n  return createProvisionedPrincipalHistoryPrimer({\n    bindLease,\n    execSqlFor: (database) =>\n      dependencies.database.client === database ? readyExecSql() : null,\n    loadPinnedIdentity: async (execSql, userId) =>\n      dependencies.identityTrustDomain\n        ? loadPinnedUserIdentity({\n            execSql,\n            identityTrustDomain: dependencies.identityTrustDomain,\n            userId,\n          })\n        : null,\n    logError: dependencies.logError,\n    signingFingerprint: () => dependencies.identity.signingFingerprint,\n  });\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const readyExecSql = () =>\n    dependencies.database.status === \"ready\"\n      ? dependencies.database.requireExecSql(\"trusted user identity\")\n      : null;\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: readyExecSql,\n    getLocalIdentity: () => localIdentityCandidate(dependencies.identity),\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n    createRuntimeMutationApi(\n      dependencies,\n      () => runtimeSubscription.mutationGeneration,\n    ).bind,\n  );\n\n  return {\n    identityLinks: trustedUserIdentityService,\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    primeProvisionedPrincipalHistory: createRuntimeProvisioningPrimer(\n      dependencies,\n      historyProtection.bind,\n      readyExecSql,\n    ),\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let mutationGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    mutationGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    if (sessionScopeChanged(sessionSnapshot, next)) mutationGeneration += 1;\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get mutationGeneration() {\n      return mutationGeneration;\n    },\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken || sessionScopeChanged(previous, next)\n  );\n}\n\n// A transport token renewal cannot turn a definite write refusal into saved work.\n// Journal custody still expires on every change to its identity or storage scope.\nfunction sessionScopeChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n  bindMutationApi: () => PrincipalMutationApi,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: bindMutationApi(),\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}

package/data/persistence/trustedUserIdentityPinPersistence.js

@@ -4,6 +4,10 @@ import { getClientSQLitePersistenceRuntime, } from "../sqlite/sqlitePersistenceR
 import { ensureSqlTables } from "../sqlite/sqlSchema.js";
 import { TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE, TRUSTED_USER_IDENTITY_FORMAT_VERSION, TRUSTED_USER_IDENTITY_SIGNING_SUITE, } from "../trustedUserIdentity/types.js";
 import { runTrustedUserIdentityPinTransaction } from "./trustedUserIdentityPinTransaction.js";
+const provenanceRank = { observed: 0, link: 1, self: 2 };
+function isTrustedUserIdentityPinProvenance(value) {
+    return value === "self" || value === "link" || value === "observed";
+}
 const comparedPinFields = [
     "userId",
     "formatVersion",
@@ -117,6 +121,9 @@ function validationFailure(value) {
         !Number.isFinite(Date.parse(firstSeenAt))) {
         return "firstSeenAt must be a valid timestamp";
     }
+    if (!isTrustedUserIdentityPinProvenance(Reflect.get(value, "provenance"))) {
+        return "provenance must be self, link, or observed";
+    }
     return null;
 }
 function validatedStringField(value, field) {
@@ -133,6 +140,13 @@ function validatedFormatVersion(value) {
     }
     return formatVersion;
 }
+function validatedProvenance(value) {
+    const provenance = Reflect.get(value, "provenance");
+    if (!isTrustedUserIdentityPinProvenance(provenance)) {
+        throw new TypeError("Validated pin provenance is not a provenance");
+    }
+    return provenance;
+}
 function assertCandidatePin(pin) {
     const failure = validationFailure(pin);
     if (failure) {
@@ -158,6 +172,7 @@ function parseStoredPin(value, scope) {
         encapsulationPublicKey: validatedStringField(value, "encapsulationPublicKey"),
         encapsulationKeyFingerprint: validatedStringField(value, "encapsulationKeyFingerprint"),
         firstSeenAt: validatedStringField(value, "firstSeenAt"),
+        provenance: validatedProvenance(value),
     };
     if (pin.identityTrustDomain !== scope.identityTrustDomain ||
         pin.userId !== scope.userId) {
@@ -199,12 +214,14 @@ export async function loadTrustedUserIdForSigningKey(input) {
     return rows[0]?.userId ?? null;
 }
 /**
- * Atomically establishes or verifies a trust-on-first-use identity pin.
+ * Atomically establishes or verifies a durable identity pin.
  *
  * The immediate transaction serializes first contact across SDK instances that
  * share the SQLite database. Conflict handling never replaces the existing
- * row: the winning pin is re-read and every identity field is compared before
- * this function returns.
+ * keys: the winning pin is re-read and every identity field is compared before
+ * this function returns. When the keys match and the candidate's provenance
+ * ranks higher (an identity link confirming an observed pin), only the
+ * provenance is raised; it is never lowered.
  */
 export async function compareOrInsertTrustedUserIdentityPin(input) {
     assertCandidatePin(input.pin);
@@ -245,7 +262,16 @@ export async function compareOrInsertTrustedUserIdentityPin(input) {
             if (differingFields.length > 0) {
                 throw new TrustedUserIdentityPinMismatchError(stored, input.pin, differingFields);
             }
-            return stored;
+            if (provenanceRank[input.pin.provenance] <=
+                provenanceRank[stored.provenance]) {
+                return stored;
+            }
+            await tx
+                .update(trustedUserIdentityPins)
+                .set({ provenance: input.pin.provenance })
+                .where(and(eq(trustedUserIdentityPins.identityTrustDomain, input.pin.identityTrustDomain), eq(trustedUserIdentityPins.userId, input.pin.userId)))
+                .run();
+            return { ...stored, provenance: input.pin.provenance };
         }, { behavior: "immediate" });
     });
 }

package/data/persistence/trustedUserIdentityPinPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"trustedUserIdentityPinPersistence.js","sourceRoot":"","sources":["trustedUserIdentityPinPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,yCAAyC,EACzC,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAwC3F,MAAM,iBAAiB,GAAgC;IACrD,QAAQ;IACR,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB;IACpB,wBAAwB;IACxB,6BAA6B;CAC9B,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,qBAAqB;IACrB,QAAQ;IACR,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB;IACpB,wBAAwB;IACxB,6BAA6B;CAC+B,CAAC;AAE/D,SAAS,aAAa,CAAC,GAA2B;IAChD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IACnD,IAAI,GAAG,oCAAoC,CAAC;IAC5C,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,QAAQ,CAAgB;IACxB,SAAS,CAAgB;IACzB,eAAe,CAA8B;IAEtD,YACE,QAAgC,EAChC,SAAiC,EACjC,eAA4C;QAE5C,KAAK,CACH,qCAAqC,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,mBAAmB,KAAK,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC,mBAAmB,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAClD,IAAI,GAAG,mCAAmC,CAAC;IAC3C,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,YAAY,KAAe,EAAE,MAAc;QACzC,KAAK,CACH,8CAA8C,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,mBAAmB,KAAK,MAAM,EAAE,CACxG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,IAAI,GAAG,yCAAyC,CAAC;IACjD,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,YAAY,KAAe,EAAE,MAAc;QACzC,KAAK,CAAC,2CAA2C,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO;QACL,mBAAmB,EACjB,OAAO,mBAAmB,KAAK,QAAQ;YACrC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,WAAW;QACjB,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC1D,IAAI,aAAa,KAAK,oCAAoC,EAAE,CAAC;QAC3D,OAAO,yBAAyB,oCAAoC,EAAE,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,GAAG,KAAK,6BAA6B,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,mCAAmC,EAC1E,CAAC;QACD,OAAO,wBAAwB,mCAAmC,EAAE,CAAC;IACvE,CAAC;IACD,IACE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACxC,yCAAyC,EACzC,CAAC;QACD,OAAO,8BAA8B,yCAAyC,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACtD,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAa,EACb,KAA4D;IAE5D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,uBAAuB,KAAK,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC1D,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA2B;IACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,gCAAgC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,KAAe;IAEf,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,kCAAkC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,kCAAkC,CAC1C,KAAK,EACL,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAA2B;QAClC,mBAAmB,EAAE,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,CAAC;QACvE,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC7C,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC;QAC5C,YAAY,EAAE,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC;QACzD,gBAAgB,EAAE,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACjE,qBAAqB,EAAE,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,CAAC;QAC3E,kBAAkB,EAAE,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACrE,sBAAsB,EAAE,oBAAoB,CAC1C,KAAK,EACL,wBAAwB,CACzB;QACD,2BAA2B,EAAE,oBAAoB,CAC/C,KAAK,EACL,6BAA6B,CAC9B;QACD,WAAW,EAAE,oBAAoB,CAAC,KAAK,EAAE,aAAa,CAAC;KACxD,CAAC;IACF,IACE,GAAG,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACrD,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAC3B,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,KAAK,EACL,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,EAAuD,EACvD,KAAe;IAEf,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,mBAAmB,CAC1B,EACD,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACjD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAgC,EAChC,SAAiC;IAEjC,OAAO,iBAAiB,CAAC,MAAM,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,MAAM,KAAK,GAAa;QACtB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACnE,OAAO,eAAe,CACpB,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EACnD,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC;SAChE,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC;SACrD,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,mBAAmB,CAC1B,EACD,EAAE,CACA,uBAAuB,CAAC,qBAAqB,EAC7C,KAAK,CAAC,qBAAqB,CAC5B,CACF,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAG3D;IACC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,oCAAoC,CAAC,KAAK,IAAI,EAAE;QACrD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,WAAW,CACxB,KAAK,EAAE,EAAE,EAAE,EAAE;YACX,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,EAAE;iBACR,IAAI,CAAC,uBAAuB,CAAC;iBAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAC9B,EACD,EAAE,CACA,uBAAuB,CAAC,qBAAqB,EAC7C,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAChC,CACF,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/C,MAAM,IAAI,mCAAmC,CAC3C,cAAc,CAAC,KAAK,EAAE;oBACpB,mBAAmB,EAAE,KAAK,CAAC,GAAG,CAAC,mBAAmB;oBAClD,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,EACF,KAAK,CAAC,GAAG,EACT,CAAC,QAAQ,CAAC,CACX,CAAC;YACJ,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,oDAAoD;YACpD,MAAM,EAAE;iBACL,MAAM,CAAC,uBAAuB,CAAC;iBAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;iBACjB,mBAAmB,CAAC;gBACnB,MAAM,EAAE;oBACN,uBAAuB,CAAC,mBAAmB;oBAC3C,uBAAuB,CAAC,MAAM;iBAC/B;aACF,CAAC;iBACD,GAAG,EAAE,CAAC;YAET,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,kCAAkC,CAC1C,KAAK,CAAC,GAAG,EACT,wCAAwC,CACzC,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,mCAAmC,CAC3C,MAAM,EACN,KAAK,CAAC,GAAG,EACT,eAAe,CAChB,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport {\n  trustedUserIdentityPins,\n  trustedUserIdentityPinTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n  TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n  TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n} from \"../trustedUserIdentity/types\";\nimport { runTrustedUserIdentityPinTransaction } from \"./trustedUserIdentityPinTransaction\";\n\nexport interface TrustedUserIdentityPin {\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly formatVersion: number;\n  readonly signingSuite: string;\n  readonly signingPublicKey: string;\n  readonly signingKeyFingerprint: string;\n  readonly encapsulationSuite: string;\n  readonly encapsulationPublicKey: string;\n  readonly encapsulationKeyFingerprint: string;\n  readonly firstSeenAt: string;\n}\n\ntype ComparedPinField =\n  | \"userId\"\n  | \"formatVersion\"\n  | \"signingSuite\"\n  | \"signingPublicKey\"\n  | \"signingKeyFingerprint\"\n  | \"encapsulationSuite\"\n  | \"encapsulationPublicKey\"\n  | \"encapsulationKeyFingerprint\";\n\ninterface PinDiagnostic {\n  readonly userId: string;\n  readonly formatVersion: number;\n  readonly signingSuite: string;\n  readonly signingKeyFingerprint: string;\n  readonly encapsulationSuite: string;\n  readonly encapsulationKeyFingerprint: string;\n  readonly firstSeenAt: string;\n}\n\ninterface PinScope {\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n}\n\nconst comparedPinFields: readonly ComparedPinField[] = [\n  \"userId\",\n  \"formatVersion\",\n  \"signingSuite\",\n  \"signingPublicKey\",\n  \"signingKeyFingerprint\",\n  \"encapsulationSuite\",\n  \"encapsulationPublicKey\",\n  \"encapsulationKeyFingerprint\",\n];\n\nconst requiredStringFields = [\n  \"identityTrustDomain\",\n  \"userId\",\n  \"signingSuite\",\n  \"signingPublicKey\",\n  \"signingKeyFingerprint\",\n  \"encapsulationSuite\",\n  \"encapsulationPublicKey\",\n  \"encapsulationKeyFingerprint\",\n] as const satisfies readonly (keyof TrustedUserIdentityPin)[];\n\nfunction pinDiagnostic(pin: TrustedUserIdentityPin): PinDiagnostic {\n  return {\n    userId: pin.userId,\n    formatVersion: pin.formatVersion,\n    signingSuite: pin.signingSuite,\n    signingKeyFingerprint: pin.signingKeyFingerprint,\n    encapsulationSuite: pin.encapsulationSuite,\n    encapsulationKeyFingerprint: pin.encapsulationKeyFingerprint,\n    firstSeenAt: pin.firstSeenAt,\n  };\n}\n\nexport class TrustedUserIdentityPinMismatchError extends Error {\n  readonly code = \"trusted_user_identity_pin_mismatch\";\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly existing: PinDiagnostic;\n  readonly candidate: PinDiagnostic;\n  readonly differingFields: readonly ComparedPinField[];\n\n  constructor(\n    existing: TrustedUserIdentityPin,\n    candidate: TrustedUserIdentityPin,\n    differingFields: readonly ComparedPinField[],\n  ) {\n    super(\n      `Trusted identity pin mismatch for ${candidate.userId} in ${candidate.identityTrustDomain}: ${differingFields.join(\", \")}`,\n    );\n    this.name = \"TrustedUserIdentityPinMismatchError\";\n    this.identityTrustDomain = candidate.identityTrustDomain;\n    this.userId = candidate.userId;\n    this.existing = pinDiagnostic(existing);\n    this.candidate = pinDiagnostic(candidate);\n    this.differingFields = differingFields;\n  }\n}\n\nexport class TrustedUserIdentityPinCorruptError extends Error {\n  readonly code = \"trusted_user_identity_pin_corrupt\";\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly reason: string;\n\n  constructor(scope: PinScope, reason: string) {\n    super(\n      `Stored trusted identity pin is corrupt for ${scope.userId} in ${scope.identityTrustDomain}: ${reason}`,\n    );\n    this.name = \"TrustedUserIdentityPinCorruptError\";\n    this.identityTrustDomain = scope.identityTrustDomain;\n    this.userId = scope.userId;\n    this.reason = reason;\n  }\n}\n\nexport class TrustedUserIdentityPinInputError extends Error {\n  readonly code = \"trusted_user_identity_pin_invalid_input\";\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly reason: string;\n\n  constructor(scope: PinScope, reason: string) {\n    super(`Invalid trusted identity pin candidate: ${reason}`);\n    this.name = \"TrustedUserIdentityPinInputError\";\n    this.identityTrustDomain = scope.identityTrustDomain;\n    this.userId = scope.userId;\n    this.reason = reason;\n  }\n}\n\nfunction pinScope(value: unknown): PinScope {\n  if (typeof value !== \"object\" || value === null) {\n    return { identityTrustDomain: \"<invalid>\", userId: \"<invalid>\" };\n  }\n  const identityTrustDomain = Reflect.get(value, \"identityTrustDomain\");\n  const userId = Reflect.get(value, \"userId\");\n  return {\n    identityTrustDomain:\n      typeof identityTrustDomain === \"string\"\n        ? identityTrustDomain\n        : \"<invalid>\",\n    userId: typeof userId === \"string\" ? userId : \"<invalid>\",\n  };\n}\n\nfunction validationFailure(value: unknown): string | null {\n  if (typeof value !== \"object\" || value === null) {\n    return \"row must be an object\";\n  }\n  const formatVersion = Reflect.get(value, \"formatVersion\");\n  if (formatVersion !== TRUSTED_USER_IDENTITY_FORMAT_VERSION) {\n    return `formatVersion must be ${TRUSTED_USER_IDENTITY_FORMAT_VERSION}`;\n  }\n  for (const field of requiredStringFields) {\n    const fieldValue = Reflect.get(value, field);\n    if (typeof fieldValue !== \"string\" || fieldValue.trim().length === 0) {\n      return `${field} must be a non-empty string`;\n    }\n  }\n  if (\n    Reflect.get(value, \"signingSuite\") !== TRUSTED_USER_IDENTITY_SIGNING_SUITE\n  ) {\n    return `signingSuite must be ${TRUSTED_USER_IDENTITY_SIGNING_SUITE}`;\n  }\n  if (\n    Reflect.get(value, \"encapsulationSuite\") !==\n    TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE\n  ) {\n    return `encapsulationSuite must be ${TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE}`;\n  }\n  const firstSeenAt = Reflect.get(value, \"firstSeenAt\");\n  if (\n    typeof firstSeenAt !== \"string\" ||\n    !Number.isFinite(Date.parse(firstSeenAt))\n  ) {\n    return \"firstSeenAt must be a valid timestamp\";\n  }\n  return null;\n}\n\nfunction validatedStringField(\n  value: object,\n  field: (typeof requiredStringFields)[number] | \"firstSeenAt\",\n): string {\n  const fieldValue = Reflect.get(value, field);\n  if (typeof fieldValue !== \"string\") {\n    throw new TypeError(`Validated pin field ${field} is not a string`);\n  }\n  return fieldValue;\n}\n\nfunction validatedFormatVersion(value: object): number {\n  const formatVersion = Reflect.get(value, \"formatVersion\");\n  if (typeof formatVersion !== \"number\") {\n    throw new TypeError(\"Validated pin formatVersion is not a number\");\n  }\n  return formatVersion;\n}\n\nfunction assertCandidatePin(pin: TrustedUserIdentityPin): void {\n  const failure = validationFailure(pin);\n  if (failure) {\n    throw new TrustedUserIdentityPinInputError(pinScope(pin), failure);\n  }\n}\n\nfunction parseStoredPin(\n  value: unknown,\n  scope: PinScope,\n): TrustedUserIdentityPin {\n  const failure = validationFailure(value);\n  if (failure) {\n    throw new TrustedUserIdentityPinCorruptError(scope, failure);\n  }\n  if (typeof value !== \"object\" || value === null) {\n    throw new TrustedUserIdentityPinCorruptError(\n      scope,\n      \"row must be an object\",\n    );\n  }\n  const pin: TrustedUserIdentityPin = {\n    identityTrustDomain: validatedStringField(value, \"identityTrustDomain\"),\n    userId: validatedStringField(value, \"userId\"),\n    formatVersion: validatedFormatVersion(value),\n    signingSuite: validatedStringField(value, \"signingSuite\"),\n    signingPublicKey: validatedStringField(value, \"signingPublicKey\"),\n    signingKeyFingerprint: validatedStringField(value, \"signingKeyFingerprint\"),\n    encapsulationSuite: validatedStringField(value, \"encapsulationSuite\"),\n    encapsulationPublicKey: validatedStringField(\n      value,\n      \"encapsulationPublicKey\",\n    ),\n    encapsulationKeyFingerprint: validatedStringField(\n      value,\n      \"encapsulationKeyFingerprint\",\n    ),\n    firstSeenAt: validatedStringField(value, \"firstSeenAt\"),\n  };\n  if (\n    pin.identityTrustDomain !== scope.identityTrustDomain ||\n    pin.userId !== scope.userId\n  ) {\n    throw new TrustedUserIdentityPinCorruptError(\n      scope,\n      \"primary-key scope does not match the requested pin\",\n    );\n  }\n  return pin;\n}\n\nasync function selectStoredPin(\n  db: ClientSQLiteDatabase | ClientSQLiteTransactionScope,\n  scope: PinScope,\n): Promise<TrustedUserIdentityPin | null> {\n  const rows = await db\n    .select()\n    .from(trustedUserIdentityPins)\n    .where(\n      and(\n        eq(\n          trustedUserIdentityPins.identityTrustDomain,\n          scope.identityTrustDomain,\n        ),\n        eq(trustedUserIdentityPins.userId, scope.userId),\n      ),\n    )\n    .limit(1);\n  const row = rows[0];\n  return row ? parseStoredPin(row, scope) : null;\n}\n\nfunction differingPinFields(\n  existing: TrustedUserIdentityPin,\n  candidate: TrustedUserIdentityPin,\n): readonly ComparedPinField[] {\n  return comparedPinFields.filter(\n    (field) => existing[field] !== candidate[field],\n  );\n}\n\nexport async function loadTrustedUserIdentityPin(input: {\n  readonly execSql: ExecSql;\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n}): Promise<TrustedUserIdentityPin | null> {\n  const scope: PinScope = {\n    identityTrustDomain: input.identityTrustDomain,\n    userId: input.userId,\n  };\n  await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);\n  return selectStoredPin(\n    getClientSQLitePersistenceRuntime(input.execSql).db,\n    scope,\n  );\n}\n\n/**\n * The user a signing key is already bound to in this trust domain, if any.\n * Each key has at most one such user: the reverse binding is unique.\n */\nexport async function loadTrustedUserIdForSigningKey(input: {\n  readonly execSql: ExecSql;\n  readonly identityTrustDomain: string;\n  readonly signingKeyFingerprint: string;\n}): Promise<string | null> {\n  await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);\n  const rows = await getClientSQLitePersistenceRuntime(input.execSql)\n    .db.select({ userId: trustedUserIdentityPins.userId })\n    .from(trustedUserIdentityPins)\n    .where(\n      and(\n        eq(\n          trustedUserIdentityPins.identityTrustDomain,\n          input.identityTrustDomain,\n        ),\n        eq(\n          trustedUserIdentityPins.signingKeyFingerprint,\n          input.signingKeyFingerprint,\n        ),\n      ),\n    )\n    .limit(1);\n  return rows[0]?.userId ?? null;\n}\n\n/**\n * Atomically establishes or verifies a trust-on-first-use identity pin.\n *\n * The immediate transaction serializes first contact across SDK instances that\n * share the SQLite database. Conflict handling never replaces the existing\n * row: the winning pin is re-read and every identity field is compared before\n * this function returns.\n */\nexport async function compareOrInsertTrustedUserIdentityPin(input: {\n  readonly execSql: ExecSql;\n  readonly pin: TrustedUserIdentityPin;\n}): Promise<TrustedUserIdentityPin> {\n  assertCandidatePin(input.pin);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  return runTrustedUserIdentityPinTransaction(async () => {\n    await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);\n    return runtime.transaction(\n      async (tx) => {\n        const aliases = await tx\n          .select()\n          .from(trustedUserIdentityPins)\n          .where(\n            and(\n              eq(\n                trustedUserIdentityPins.identityTrustDomain,\n                input.pin.identityTrustDomain,\n              ),\n              eq(\n                trustedUserIdentityPins.signingKeyFingerprint,\n                input.pin.signingKeyFingerprint,\n              ),\n            ),\n          )\n          .limit(1);\n        const alias = aliases[0];\n        if (alias && alias.userId !== input.pin.userId) {\n          throw new TrustedUserIdentityPinMismatchError(\n            parseStoredPin(alias, {\n              identityTrustDomain: input.pin.identityTrustDomain,\n              userId: alias.userId,\n            }),\n            input.pin,\n            [\"userId\"],\n          );\n        }\n        // Targets the primary key only: re-pinning the same user is a no-op,\n        // but a write that would bind this key to a second user must fail at\n        // the unique index rather than be silently skipped.\n        await tx\n          .insert(trustedUserIdentityPins)\n          .values(input.pin)\n          .onConflictDoNothing({\n            target: [\n              trustedUserIdentityPins.identityTrustDomain,\n              trustedUserIdentityPins.userId,\n            ],\n          })\n          .run();\n\n        const stored = await selectStoredPin(tx, input.pin);\n        if (!stored) {\n          throw new TrustedUserIdentityPinCorruptError(\n            input.pin,\n            \"row is missing after compare-or-insert\",\n          );\n        }\n\n        const differingFields = differingPinFields(stored, input.pin);\n        if (differingFields.length > 0) {\n          throw new TrustedUserIdentityPinMismatchError(\n            stored,\n            input.pin,\n            differingFields,\n          );\n        }\n        return stored;\n      },\n      { behavior: \"immediate\" },\n    );\n  });\n}\n"]}
+{"version":3,"file":"trustedUserIdentityPinPersistence.js","sourceRoot":"","sources":["trustedUserIdentityPinPersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,iCAAiC,GAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,yCAAyC,EACzC,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAU3F,MAAM,cAAc,GAEhB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEtC,SAAS,kCAAkC,CACzC,KAAc;IAEd,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,UAAU,CAAC;AACtE,CAAC;AAyCD,MAAM,iBAAiB,GAAgC;IACrD,QAAQ;IACR,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB;IACpB,wBAAwB;IACxB,6BAA6B;CAC9B,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,qBAAqB;IACrB,QAAQ;IACR,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB;IACpB,wBAAwB;IACxB,6BAA6B;CAC+B,CAAC;AAE/D,SAAS,aAAa,CAAC,GAA2B;IAChD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IACnD,IAAI,GAAG,oCAAoC,CAAC;IAC5C,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,QAAQ,CAAgB;IACxB,SAAS,CAAgB;IACzB,eAAe,CAA8B;IAEtD,YACE,QAAgC,EAChC,SAAiC,EACjC,eAA4C;QAE5C,KAAK,CACH,qCAAqC,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,mBAAmB,KAAK,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC,mBAAmB,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAClD,IAAI,GAAG,mCAAmC,CAAC;IAC3C,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,YAAY,KAAe,EAAE,MAAc;QACzC,KAAK,CACH,8CAA8C,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,mBAAmB,KAAK,MAAM,EAAE,CACxG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,IAAI,GAAG,yCAAyC,CAAC;IACjD,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,YAAY,KAAe,EAAE,MAAc;QACzC,KAAK,CAAC,2CAA2C,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO;QACL,mBAAmB,EACjB,OAAO,mBAAmB,KAAK,QAAQ;YACrC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,WAAW;QACjB,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC1D,IAAI,aAAa,KAAK,oCAAoC,EAAE,CAAC;QAC3D,OAAO,yBAAyB,oCAAoC,EAAE,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,GAAG,KAAK,6BAA6B,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,mCAAmC,EAC1E,CAAC;QACD,OAAO,wBAAwB,mCAAmC,EAAE,CAAC;IACvE,CAAC;IACD,IACE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACxC,yCAAyC,EACzC,CAAC;QACD,OAAO,8BAA8B,yCAAyC,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACtD,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,4CAA4C,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAa,EACb,KAA4D;IAE5D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,uBAAuB,KAAK,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC1D,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,kCAAkC,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA2B;IACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,gCAAgC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,KAAe;IAEf,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,kCAAkC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,kCAAkC,CAC1C,KAAK,EACL,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAA2B;QAClC,mBAAmB,EAAE,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,CAAC;QACvE,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC7C,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC;QAC5C,YAAY,EAAE,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC;QACzD,gBAAgB,EAAE,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACjE,qBAAqB,EAAE,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,CAAC;QAC3E,kBAAkB,EAAE,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACrE,sBAAsB,EAAE,oBAAoB,CAC1C,KAAK,EACL,wBAAwB,CACzB;QACD,2BAA2B,EAAE,oBAAoB,CAC/C,KAAK,EACL,6BAA6B,CAC9B;QACD,WAAW,EAAE,oBAAoB,CAAC,KAAK,EAAE,aAAa,CAAC;QACvD,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC;KACvC,CAAC;IACF,IACE,GAAG,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACrD,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAC3B,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,KAAK,EACL,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,EAAuD,EACvD,KAAe;IAEf,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,mBAAmB,CAC1B,EACD,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACjD,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAgC,EAChC,SAAiC;IAEjC,OAAO,iBAAiB,CAAC,MAAM,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,MAAM,KAAK,GAAa;QACtB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACnE,OAAO,eAAe,CACpB,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EACnD,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IACC,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC;SAChE,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC;SACrD,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,mBAAmB,CAC1B,EACD,EAAE,CACA,uBAAuB,CAAC,qBAAqB,EAC7C,KAAK,CAAC,qBAAqB,CAC5B,CACF,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAG3D;IACC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,oCAAoC,CAAC,KAAK,IAAI,EAAE;QACrD,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,WAAW,CACxB,KAAK,EAAE,EAAE,EAAE,EAAE;YACX,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,EAAE;iBACR,IAAI,CAAC,uBAAuB,CAAC;iBAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAC9B,EACD,EAAE,CACA,uBAAuB,CAAC,qBAAqB,EAC7C,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAChC,CACF,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/C,MAAM,IAAI,mCAAmC,CAC3C,cAAc,CAAC,KAAK,EAAE;oBACpB,mBAAmB,EAAE,KAAK,CAAC,GAAG,CAAC,mBAAmB;oBAClD,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,EACF,KAAK,CAAC,GAAG,EACT,CAAC,QAAQ,CAAC,CACX,CAAC;YACJ,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,oDAAoD;YACpD,MAAM,EAAE;iBACL,MAAM,CAAC,uBAAuB,CAAC;iBAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;iBACjB,mBAAmB,CAAC;gBACnB,MAAM,EAAE;oBACN,uBAAuB,CAAC,mBAAmB;oBAC3C,uBAAuB,CAAC,MAAM;iBAC/B;aACF,CAAC;iBACD,GAAG,EAAE,CAAC;YAET,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,kCAAkC,CAC1C,KAAK,CAAC,GAAG,EACT,wCAAwC,CACzC,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,mCAAmC,CAC3C,MAAM,EACN,KAAK,CAAC,GAAG,EACT,eAAe,CAChB,CAAC;YACJ,CAAC;YACD,IACE,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;gBACpC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,EACjC,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,EAAE;iBACL,MAAM,CAAC,uBAAuB,CAAC;iBAC/B,GAAG,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;iBACzC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,uBAAuB,CAAC,mBAAmB,EAC3C,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAC9B,EACD,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CACrD,CACF;iBACA,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACzD,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport {\n  trustedUserIdentityPins,\n  trustedUserIdentityPinTables,\n} from \"../sqlite/schema\";\nimport {\n  type ClientSQLiteDatabase,\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../sqlite/sqlSchema\";\nimport {\n  TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE,\n  TRUSTED_USER_IDENTITY_FORMAT_VERSION,\n  TRUSTED_USER_IDENTITY_SIGNING_SUITE,\n} from \"../trustedUserIdentity/types\";\nimport { runTrustedUserIdentityPinTransaction } from \"./trustedUserIdentityPinTransaction\";\n\n/**\n * How this device came to trust a pin. `self` is the user's own local keys,\n * `link` an independently exchanged identity link, and `observed` the first\n * server answer for a user already referenced by signed state. Only `self` and\n * `link` admit a user; provenance only ever rises, and never changes the keys.\n */\nexport type TrustedUserIdentityPinProvenance = \"self\" | \"link\" | \"observed\";\n\nconst provenanceRank: Readonly<\n  Record<TrustedUserIdentityPinProvenance, number>\n> = { observed: 0, link: 1, self: 2 };\n\nfunction isTrustedUserIdentityPinProvenance(\n  value: unknown,\n): value is TrustedUserIdentityPinProvenance {\n  return value === \"self\" || value === \"link\" || value === \"observed\";\n}\n\nexport interface TrustedUserIdentityPin {\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly formatVersion: number;\n  readonly signingSuite: string;\n  readonly signingPublicKey: string;\n  readonly signingKeyFingerprint: string;\n  readonly encapsulationSuite: string;\n  readonly encapsulationPublicKey: string;\n  readonly encapsulationKeyFingerprint: string;\n  readonly firstSeenAt: string;\n  readonly provenance: TrustedUserIdentityPinProvenance;\n}\n\ntype ComparedPinField =\n  | \"userId\"\n  | \"formatVersion\"\n  | \"signingSuite\"\n  | \"signingPublicKey\"\n  | \"signingKeyFingerprint\"\n  | \"encapsulationSuite\"\n  | \"encapsulationPublicKey\"\n  | \"encapsulationKeyFingerprint\";\n\ninterface PinDiagnostic {\n  readonly userId: string;\n  readonly formatVersion: number;\n  readonly signingSuite: string;\n  readonly signingKeyFingerprint: string;\n  readonly encapsulationSuite: string;\n  readonly encapsulationKeyFingerprint: string;\n  readonly firstSeenAt: string;\n}\n\ninterface PinScope {\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n}\n\nconst comparedPinFields: readonly ComparedPinField[] = [\n  \"userId\",\n  \"formatVersion\",\n  \"signingSuite\",\n  \"signingPublicKey\",\n  \"signingKeyFingerprint\",\n  \"encapsulationSuite\",\n  \"encapsulationPublicKey\",\n  \"encapsulationKeyFingerprint\",\n];\n\nconst requiredStringFields = [\n  \"identityTrustDomain\",\n  \"userId\",\n  \"signingSuite\",\n  \"signingPublicKey\",\n  \"signingKeyFingerprint\",\n  \"encapsulationSuite\",\n  \"encapsulationPublicKey\",\n  \"encapsulationKeyFingerprint\",\n] as const satisfies readonly (keyof TrustedUserIdentityPin)[];\n\nfunction pinDiagnostic(pin: TrustedUserIdentityPin): PinDiagnostic {\n  return {\n    userId: pin.userId,\n    formatVersion: pin.formatVersion,\n    signingSuite: pin.signingSuite,\n    signingKeyFingerprint: pin.signingKeyFingerprint,\n    encapsulationSuite: pin.encapsulationSuite,\n    encapsulationKeyFingerprint: pin.encapsulationKeyFingerprint,\n    firstSeenAt: pin.firstSeenAt,\n  };\n}\n\nexport class TrustedUserIdentityPinMismatchError extends Error {\n  readonly code = \"trusted_user_identity_pin_mismatch\";\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly existing: PinDiagnostic;\n  readonly candidate: PinDiagnostic;\n  readonly differingFields: readonly ComparedPinField[];\n\n  constructor(\n    existing: TrustedUserIdentityPin,\n    candidate: TrustedUserIdentityPin,\n    differingFields: readonly ComparedPinField[],\n  ) {\n    super(\n      `Trusted identity pin mismatch for ${candidate.userId} in ${candidate.identityTrustDomain}: ${differingFields.join(\", \")}`,\n    );\n    this.name = \"TrustedUserIdentityPinMismatchError\";\n    this.identityTrustDomain = candidate.identityTrustDomain;\n    this.userId = candidate.userId;\n    this.existing = pinDiagnostic(existing);\n    this.candidate = pinDiagnostic(candidate);\n    this.differingFields = differingFields;\n  }\n}\n\nexport class TrustedUserIdentityPinCorruptError extends Error {\n  readonly code = \"trusted_user_identity_pin_corrupt\";\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly reason: string;\n\n  constructor(scope: PinScope, reason: string) {\n    super(\n      `Stored trusted identity pin is corrupt for ${scope.userId} in ${scope.identityTrustDomain}: ${reason}`,\n    );\n    this.name = \"TrustedUserIdentityPinCorruptError\";\n    this.identityTrustDomain = scope.identityTrustDomain;\n    this.userId = scope.userId;\n    this.reason = reason;\n  }\n}\n\nexport class TrustedUserIdentityPinInputError extends Error {\n  readonly code = \"trusted_user_identity_pin_invalid_input\";\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n  readonly reason: string;\n\n  constructor(scope: PinScope, reason: string) {\n    super(`Invalid trusted identity pin candidate: ${reason}`);\n    this.name = \"TrustedUserIdentityPinInputError\";\n    this.identityTrustDomain = scope.identityTrustDomain;\n    this.userId = scope.userId;\n    this.reason = reason;\n  }\n}\n\nfunction pinScope(value: unknown): PinScope {\n  if (typeof value !== \"object\" || value === null) {\n    return { identityTrustDomain: \"<invalid>\", userId: \"<invalid>\" };\n  }\n  const identityTrustDomain = Reflect.get(value, \"identityTrustDomain\");\n  const userId = Reflect.get(value, \"userId\");\n  return {\n    identityTrustDomain:\n      typeof identityTrustDomain === \"string\"\n        ? identityTrustDomain\n        : \"<invalid>\",\n    userId: typeof userId === \"string\" ? userId : \"<invalid>\",\n  };\n}\n\nfunction validationFailure(value: unknown): string | null {\n  if (typeof value !== \"object\" || value === null) {\n    return \"row must be an object\";\n  }\n  const formatVersion = Reflect.get(value, \"formatVersion\");\n  if (formatVersion !== TRUSTED_USER_IDENTITY_FORMAT_VERSION) {\n    return `formatVersion must be ${TRUSTED_USER_IDENTITY_FORMAT_VERSION}`;\n  }\n  for (const field of requiredStringFields) {\n    const fieldValue = Reflect.get(value, field);\n    if (typeof fieldValue !== \"string\" || fieldValue.trim().length === 0) {\n      return `${field} must be a non-empty string`;\n    }\n  }\n  if (\n    Reflect.get(value, \"signingSuite\") !== TRUSTED_USER_IDENTITY_SIGNING_SUITE\n  ) {\n    return `signingSuite must be ${TRUSTED_USER_IDENTITY_SIGNING_SUITE}`;\n  }\n  if (\n    Reflect.get(value, \"encapsulationSuite\") !==\n    TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE\n  ) {\n    return `encapsulationSuite must be ${TRUSTED_USER_IDENTITY_ENCAPSULATION_SUITE}`;\n  }\n  const firstSeenAt = Reflect.get(value, \"firstSeenAt\");\n  if (\n    typeof firstSeenAt !== \"string\" ||\n    !Number.isFinite(Date.parse(firstSeenAt))\n  ) {\n    return \"firstSeenAt must be a valid timestamp\";\n  }\n  if (!isTrustedUserIdentityPinProvenance(Reflect.get(value, \"provenance\"))) {\n    return \"provenance must be self, link, or observed\";\n  }\n  return null;\n}\n\nfunction validatedStringField(\n  value: object,\n  field: (typeof requiredStringFields)[number] | \"firstSeenAt\",\n): string {\n  const fieldValue = Reflect.get(value, field);\n  if (typeof fieldValue !== \"string\") {\n    throw new TypeError(`Validated pin field ${field} is not a string`);\n  }\n  return fieldValue;\n}\n\nfunction validatedFormatVersion(value: object): number {\n  const formatVersion = Reflect.get(value, \"formatVersion\");\n  if (typeof formatVersion !== \"number\") {\n    throw new TypeError(\"Validated pin formatVersion is not a number\");\n  }\n  return formatVersion;\n}\n\nfunction validatedProvenance(value: object): TrustedUserIdentityPinProvenance {\n  const provenance = Reflect.get(value, \"provenance\");\n  if (!isTrustedUserIdentityPinProvenance(provenance)) {\n    throw new TypeError(\"Validated pin provenance is not a provenance\");\n  }\n  return provenance;\n}\n\nfunction assertCandidatePin(pin: TrustedUserIdentityPin): void {\n  const failure = validationFailure(pin);\n  if (failure) {\n    throw new TrustedUserIdentityPinInputError(pinScope(pin), failure);\n  }\n}\n\nfunction parseStoredPin(\n  value: unknown,\n  scope: PinScope,\n): TrustedUserIdentityPin {\n  const failure = validationFailure(value);\n  if (failure) {\n    throw new TrustedUserIdentityPinCorruptError(scope, failure);\n  }\n  if (typeof value !== \"object\" || value === null) {\n    throw new TrustedUserIdentityPinCorruptError(\n      scope,\n      \"row must be an object\",\n    );\n  }\n  const pin: TrustedUserIdentityPin = {\n    identityTrustDomain: validatedStringField(value, \"identityTrustDomain\"),\n    userId: validatedStringField(value, \"userId\"),\n    formatVersion: validatedFormatVersion(value),\n    signingSuite: validatedStringField(value, \"signingSuite\"),\n    signingPublicKey: validatedStringField(value, \"signingPublicKey\"),\n    signingKeyFingerprint: validatedStringField(value, \"signingKeyFingerprint\"),\n    encapsulationSuite: validatedStringField(value, \"encapsulationSuite\"),\n    encapsulationPublicKey: validatedStringField(\n      value,\n      \"encapsulationPublicKey\",\n    ),\n    encapsulationKeyFingerprint: validatedStringField(\n      value,\n      \"encapsulationKeyFingerprint\",\n    ),\n    firstSeenAt: validatedStringField(value, \"firstSeenAt\"),\n    provenance: validatedProvenance(value),\n  };\n  if (\n    pin.identityTrustDomain !== scope.identityTrustDomain ||\n    pin.userId !== scope.userId\n  ) {\n    throw new TrustedUserIdentityPinCorruptError(\n      scope,\n      \"primary-key scope does not match the requested pin\",\n    );\n  }\n  return pin;\n}\n\nasync function selectStoredPin(\n  db: ClientSQLiteDatabase | ClientSQLiteTransactionScope,\n  scope: PinScope,\n): Promise<TrustedUserIdentityPin | null> {\n  const rows = await db\n    .select()\n    .from(trustedUserIdentityPins)\n    .where(\n      and(\n        eq(\n          trustedUserIdentityPins.identityTrustDomain,\n          scope.identityTrustDomain,\n        ),\n        eq(trustedUserIdentityPins.userId, scope.userId),\n      ),\n    )\n    .limit(1);\n  const row = rows[0];\n  return row ? parseStoredPin(row, scope) : null;\n}\n\nfunction differingPinFields(\n  existing: TrustedUserIdentityPin,\n  candidate: TrustedUserIdentityPin,\n): readonly ComparedPinField[] {\n  return comparedPinFields.filter(\n    (field) => existing[field] !== candidate[field],\n  );\n}\n\nexport async function loadTrustedUserIdentityPin(input: {\n  readonly execSql: ExecSql;\n  readonly identityTrustDomain: string;\n  readonly userId: string;\n}): Promise<TrustedUserIdentityPin | null> {\n  const scope: PinScope = {\n    identityTrustDomain: input.identityTrustDomain,\n    userId: input.userId,\n  };\n  await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);\n  return selectStoredPin(\n    getClientSQLitePersistenceRuntime(input.execSql).db,\n    scope,\n  );\n}\n\n/**\n * The user a signing key is already bound to in this trust domain, if any.\n * Each key has at most one such user: the reverse binding is unique.\n */\nexport async function loadTrustedUserIdForSigningKey(input: {\n  readonly execSql: ExecSql;\n  readonly identityTrustDomain: string;\n  readonly signingKeyFingerprint: string;\n}): Promise<string | null> {\n  await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);\n  const rows = await getClientSQLitePersistenceRuntime(input.execSql)\n    .db.select({ userId: trustedUserIdentityPins.userId })\n    .from(trustedUserIdentityPins)\n    .where(\n      and(\n        eq(\n          trustedUserIdentityPins.identityTrustDomain,\n          input.identityTrustDomain,\n        ),\n        eq(\n          trustedUserIdentityPins.signingKeyFingerprint,\n          input.signingKeyFingerprint,\n        ),\n      ),\n    )\n    .limit(1);\n  return rows[0]?.userId ?? null;\n}\n\n/**\n * Atomically establishes or verifies a durable identity pin.\n *\n * The immediate transaction serializes first contact across SDK instances that\n * share the SQLite database. Conflict handling never replaces the existing\n * keys: the winning pin is re-read and every identity field is compared before\n * this function returns. When the keys match and the candidate's provenance\n * ranks higher (an identity link confirming an observed pin), only the\n * provenance is raised; it is never lowered.\n */\nexport async function compareOrInsertTrustedUserIdentityPin(input: {\n  readonly execSql: ExecSql;\n  readonly pin: TrustedUserIdentityPin;\n}): Promise<TrustedUserIdentityPin> {\n  assertCandidatePin(input.pin);\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  return runTrustedUserIdentityPinTransaction(async () => {\n    await ensureSqlTables(input.execSql, trustedUserIdentityPinTables);\n    return runtime.transaction(\n      async (tx) => {\n        const aliases = await tx\n          .select()\n          .from(trustedUserIdentityPins)\n          .where(\n            and(\n              eq(\n                trustedUserIdentityPins.identityTrustDomain,\n                input.pin.identityTrustDomain,\n              ),\n              eq(\n                trustedUserIdentityPins.signingKeyFingerprint,\n                input.pin.signingKeyFingerprint,\n              ),\n            ),\n          )\n          .limit(1);\n        const alias = aliases[0];\n        if (alias && alias.userId !== input.pin.userId) {\n          throw new TrustedUserIdentityPinMismatchError(\n            parseStoredPin(alias, {\n              identityTrustDomain: input.pin.identityTrustDomain,\n              userId: alias.userId,\n            }),\n            input.pin,\n            [\"userId\"],\n          );\n        }\n        // Targets the primary key only: re-pinning the same user is a no-op,\n        // but a write that would bind this key to a second user must fail at\n        // the unique index rather than be silently skipped.\n        await tx\n          .insert(trustedUserIdentityPins)\n          .values(input.pin)\n          .onConflictDoNothing({\n            target: [\n              trustedUserIdentityPins.identityTrustDomain,\n              trustedUserIdentityPins.userId,\n            ],\n          })\n          .run();\n\n        const stored = await selectStoredPin(tx, input.pin);\n        if (!stored) {\n          throw new TrustedUserIdentityPinCorruptError(\n            input.pin,\n            \"row is missing after compare-or-insert\",\n          );\n        }\n\n        const differingFields = differingPinFields(stored, input.pin);\n        if (differingFields.length > 0) {\n          throw new TrustedUserIdentityPinMismatchError(\n            stored,\n            input.pin,\n            differingFields,\n          );\n        }\n        if (\n          provenanceRank[input.pin.provenance] <=\n          provenanceRank[stored.provenance]\n        ) {\n          return stored;\n        }\n        await tx\n          .update(trustedUserIdentityPins)\n          .set({ provenance: input.pin.provenance })\n          .where(\n            and(\n              eq(\n                trustedUserIdentityPins.identityTrustDomain,\n                input.pin.identityTrustDomain,\n              ),\n              eq(trustedUserIdentityPins.userId, input.pin.userId),\n            ),\n          )\n          .run();\n        return { ...stored, provenance: input.pin.provenance };\n      },\n      { behavior: \"immediate\" },\n    );\n  });\n}\n"]}

package/data/sqlite/schema/index.d.ts

@@ -1046,13 +1046,15 @@ export declare const documentPurgeCheckpoints: import("drizzle-orm/sqlite-core")
     dialect: "sqlite";
 }>;
 /**
- * Durable trust-on-first-use pins for remote user identity bundles.
+ * Durable pins for user identity bundles.
  *
- * The first validated identity observed for a user in a configured API trust
+ * The first validated identity accepted for a user in a configured API trust
  * domain is inserted once. Later observations must match every suite, public
- * key, and fingerprint exactly; the persistence adapter never updates these
- * rows. `firstSeenAt` records when the local trust decision was made and is
- * likewise immutable.
+ * key, and fingerprint exactly; the persistence adapter never changes those
+ * columns. `firstSeenAt` records when the local trust decision was made and is
+ * likewise immutable. `provenance` (`self`, `link`, or `observed`) records how
+ * the pin was established; only `self` and `link` admit a user, and it only
+ * rises. A table without it is an obsolete local database.
  *
  * Indexes:
  * - `(identityTrustDomain, userId)` is the primary key and scopes a user pin to
@@ -1258,6 +1260,25 @@ export declare const trustedUserIdentityPins: import("drizzle-orm/sqlite-core").
         }, {}, {
             length: number | undefined;
         }>;
+        provenance: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "provenance";
+            tableName: "trusted_user_identity_pins";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "link" | "self" | "observed";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["self", "link", "observed"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
     };
     dialect: "sqlite";
 }>;
@@ -7925,6 +7946,25 @@ export declare const clientSQLiteSchema: {
             }, {}, {
                 length: number | undefined;
             }>;
+            provenance: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "provenance";
+                tableName: "trusted_user_identity_pins";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: "link" | "self" | "observed";
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: ["self", "link", "observed"];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
         };
         dialect: "sqlite";
     }>;