@tearleads/client-sdk 0.1.111 → 0.1.113

package/client/organizations/index.js

@@ -1,5 +1,6 @@
 import { runWithSecurityIncidentReporting } from "../../data/keyingProjectionVerification/error.js";
-import { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, listLocalOrganizations, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry, withVerifiedDirectoryUser, } from "../../workflows/organizations/index.js";
+import { DatabaseUnavailableError } from "../../data/sync/databaseUnavailable.js";
+import { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createStripeCheckout, createStripeCheckoutSession, listLocalOrganizations, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry, withVerifiedDirectoryUser, } from "../../workflows/organizations/index.js";
 import { createOrganizationDataUsageCoordinator, } from "./organizationDataUsage.js";
 import { loadOrganizationGroupPresentationDetails } from "./organizationGroupPresentation.js";
 import { createOrganizationMemberships, } from "./organizationMemberships.js";
@@ -25,11 +26,20 @@ class OrganizationsService {
         this.memberships = createOrganizationMemberships(this.runtimeService, this.containerContents, openReconciler);
     }
     async addUserToGroup(input) {
+        // Group membership admits a user: only a verified identity link or this
+        // device's own keys can establish the identity it is granted to.
+        // The check reads the trust store of the scope this mutation captured, and
+        // that scope must still be current once it returns.
+        const mutation = currentOrganizationMutation(this.runtimeService);
+        await this.runtimeService.identityLinks.requireVerified(input.targetUserId, mutation.runtime.infra.execSql);
+        if (!mutation.stillCurrent()) {
+            throw new DatabaseUnavailableError("The active database changed while admitting this user. Try again.");
+        }
         return addUserToOrganizationGroup({
             ...input,
             containerContents: this.containerContents,
             readModelCoordinator: this.readModelCoordinator,
-            ...currentOrganizationMutation(this.runtimeService),
+            ...mutation,
         });
     }
     readPendingPolicyMutation(organizationId) {
@@ -56,13 +66,6 @@ class OrganizationsService {
             ...currentOrganizationMutation(this.runtimeService),
         });
     }
-    importUserById(userId) {
-        const runtime = this.runtimeService.workflowInput();
-        return importOrganizationUser({
-            resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,
-            userId,
-        });
-    }
     loadBilling() {
         return runForOrganization(this.runtimeService, loadOrganizationBilling);
     }

package/client/organizations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,6BAA6B,GAG9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAmD9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC,EACpC,cAAmD;IAEnD,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,oBAAoB;IAML;IACA;IANV,WAAW,CAA0B;IAC7B,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC,EACrD,cAAmD;QAFlC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAGrD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,6BAA6B,CAC9C,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,aAAsB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,aAAa;YACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB,CAAC,aAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,CACrD,SAAS,EACT,aAAa,CACd,CACJ,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC;YAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;QACH,uEAAuE;QACvE,yDAAyD;QACzD,OAAO,CACL,IAAI;YACJ,yBAAyB,CACvB,cAAc,EACd,IAAI,EACJ,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE;gBACjD,cAAc;gBACd,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE;aAClC,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  listLocalOrganizations,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n  withVerifiedDirectoryUser,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n  createOrganizationDataUsageCoordinator,\n  type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n  createOrganizationMemberships,\n  type OrganizationContentReconciler,\n  type OrganizationMemberships,\n} from \"./organizationMemberships\";\nimport {\n  createOrganizationReadModelCoordinator,\n  leaveRequestVerifier,\n  type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n  authenticatedOrganizationId,\n  runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n  type AbandonOrganizationPolicyMutationInput,\n  abandonPendingOrganizationPolicyMutation,\n  type DiscardUnreadableOrganizationPolicyMutationInput,\n  discardUnreadableOrganizationPolicyMutation,\n  readPendingOrganizationPolicyMutation,\n  retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n  type AddOrganizationGroupUserInput,\n  addUserToOrganizationGroup,\n  createGroupForOrganization,\n  deleteGroupForOrganization,\n  type OrganizationGrantRef,\n  type RemoveOrganizationGroupUserInput,\n  removeUserFromOrganizationGroup,\n  revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationLeaveRequestResult,\n  OrganizationMembership,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type {\n  OrganizationContentReconciler,\n  OrganizationMemberships,\n} from \"./organizationMemberships\";\nexport type {\n  OrganizationGroupMutationReceipt,\n  Organizations,\n} from \"./organizationsTypes\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n  AddOrganizationGroupUserInput,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n  runtime: InternalRuntime,\n  containerContents: ContainerContents,\n  openReconciler: () => OrganizationContentReconciler,\n): Organizations {\n  return new OrganizationsService(runtime, containerContents, openReconciler);\n}\n\nclass OrganizationsService implements Organizations {\n  readonly memberships: OrganizationMemberships;\n  private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n  private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n    openReconciler: () => OrganizationContentReconciler,\n  ) {\n    this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n      this.runtimeService,\n    );\n    this.readModelCoordinator = createOrganizationReadModelCoordinator(\n      this.runtimeService,\n    );\n    this.memberships = createOrganizationMemberships(\n      this.runtimeService,\n      this.containerContents,\n      openReconciler,\n    );\n  }\n\n  async addUserToGroup(input: AddOrganizationGroupUserInput) {\n    return addUserToOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  readPendingPolicyMutation(organizationId: string) {\n    return readPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  discardUnreadablePolicyMutation(\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) {\n    return discardUnreadableOrganizationPolicyMutation(\n      this.runtimeService,\n      input,\n    );\n  }\n\n  retryPendingPolicyMutation(organizationId: string) {\n    return retryPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n    return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n  }\n\n  createGroup(name: string) {\n    return createGroupForOrganization({\n      name,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  deleteGroup(groupId: string) {\n    return deleteGroupForOrganization({\n      groupId,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  importUserById(userId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    return importOrganizationUser({\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      userId,\n    });\n  }\n\n  loadBilling() {\n    return runForOrganization(this.runtimeService, loadOrganizationBilling);\n  }\n\n  loadBillingForOrganization(organizationId: string) {\n    // Gated on an authenticated session rather than on the target being the\n    // active org. The server still enforces membership, so an org the caller\n    // cannot reach resolves to `null`.\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBilling,\n      organizationId,\n    );\n  }\n\n  loadBillingHistory() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingHistory,\n    );\n  }\n\n  loadBillingManagementUrl() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingManagementUrl,\n    );\n  }\n\n  loadStripeCheckoutOptions(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      loadStripeCheckoutOptions,\n      organizationId,\n    );\n  }\n\n  createStripeCheckout(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      createStripeCheckout,\n      organizationId,\n    );\n  }\n\n  createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n      organizationId,\n    );\n  }\n\n  cancelStripeSubscription() {\n    return runForOrganization(this.runtimeService, cancelStripeSubscription);\n  }\n\n  claimNativeSubscription(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => claimNativeOrganizationSubscription({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  checkNativePurchaseEligibility(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => checkNativePurchaseEligibility({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  loadDataUsage() {\n    return this.dataUsageCoordinator.reconcile();\n  }\n\n  loadLocalDataUsage() {\n    return this.dataUsageCoordinator.loadLocal();\n  }\n\n  loadDirectoryAndGroups() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcile(),\n    );\n  }\n\n  loadDirectoryAndGroupsAfterMutation() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile_after_mutation\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcileAfterMutation(),\n    );\n  }\n\n  loadLocalDirectoryAndGroups() {\n    return this.readModelCoordinator.loadLocal();\n  }\n\n  loadGroupMembers(groupId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || groupId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return runtime.apiClient.listOrganizationGroupMembers(\n      organizationId,\n      groupId,\n    );\n  }\n\n  loadGroupPresentationDetails(groupId: string, beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: groupId,\n        objectKind: \"principal\",\n        operation: \"group.presentation.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        loadOrganizationGroupPresentationDetails({\n          groupId,\n          beforeVersion,\n          readModelCoordinator: this.readModelCoordinator,\n          runtime,\n        }),\n    );\n  }\n\n  loadGrants() {\n    return this.readModelCoordinator.loadLocalGrants();\n  }\n\n  loadGroupContainers(groupId: string) {\n    return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n  }\n\n  listLocalOrganizations() {\n    const runtime = this.runtimeService.workflowInput();\n    if (runtime.infra.dbStatus !== \"ready\") {\n      return Promise.resolve([]);\n    }\n\n    return listLocalOrganizations({ execSql: runtime.infra.execSql });\n  }\n\n  loadPolicyHistory(beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        this.readModelCoordinator.loadOrganizationPolicyHistory(\n          undefined,\n          beforeVersion,\n        ),\n    );\n  }\n\n  loadUserDetail(userId: string) {\n    return this.readModelCoordinator.loadLocalUserDetail(userId);\n  }\n\n  async updateRosterEntry(userId: string, profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || userId.length === 0) {\n      return null;\n    }\n\n    const user = await updateOrganizationRosterEntry({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n      userId,\n    });\n    // Callers store this response as directory state, so its leave request\n    // passes the same check as one read from the read model.\n    return (\n      user &&\n      withVerifiedDirectoryUser(\n        organizationId,\n        user,\n        leaveRequestVerifier(this.runtimeService, runtime, {\n          organizationId,\n          userId: runtime.auth.userId ?? \"\",\n        }),\n      )\n    );\n  }\n\n  updateProfile(profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationProfile({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n    });\n  }\n\n  async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n    return removeUserFromOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  async revokeGrant(grant: OrganizationGrantRef) {\n    return revokeOrganizationGrant({\n      ...grant,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  startTrial(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      startOrganizationTrial,\n      organizationId,\n    );\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,6BAA6B,GAG9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAkD9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC,EACpC,cAAmD;IAEnD,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,oBAAoB;IAML;IACA;IANV,WAAW,CAA0B;IAC7B,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC,EACrD,cAAmD;QAFlC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAGrD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,6BAA6B,CAC9C,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,wEAAwE;QACxE,iEAAiE;QACjE,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,eAAe,CACrD,KAAK,CAAC,YAAY,EAClB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC/B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,wBAAwB,CAChC,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,QAAQ;SACZ,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,aAAsB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,aAAa;YACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB,CAAC,aAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,CACrD,SAAS,EACT,aAAa,CACd,CACJ,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC;YAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;QACH,uEAAuE;QACvE,yDAAyD;QACzD,OAAO,CACL,IAAI;YACJ,yBAAyB,CACvB,cAAc,EACd,IAAI,EACJ,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE;gBACjD,cAAc;gBACd,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE;aAClC,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport { DatabaseUnavailableError } from \"../../data/sync/databaseUnavailable\";\nimport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  listLocalOrganizations,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n  withVerifiedDirectoryUser,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n  createOrganizationDataUsageCoordinator,\n  type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n  createOrganizationMemberships,\n  type OrganizationContentReconciler,\n  type OrganizationMemberships,\n} from \"./organizationMemberships\";\nimport {\n  createOrganizationReadModelCoordinator,\n  leaveRequestVerifier,\n  type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n  authenticatedOrganizationId,\n  runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n  type AbandonOrganizationPolicyMutationInput,\n  abandonPendingOrganizationPolicyMutation,\n  type DiscardUnreadableOrganizationPolicyMutationInput,\n  discardUnreadableOrganizationPolicyMutation,\n  readPendingOrganizationPolicyMutation,\n  retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n  type AddOrganizationGroupUserInput,\n  addUserToOrganizationGroup,\n  createGroupForOrganization,\n  deleteGroupForOrganization,\n  type OrganizationGrantRef,\n  type RemoveOrganizationGroupUserInput,\n  removeUserFromOrganizationGroup,\n  revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationLeaveRequestResult,\n  OrganizationMembership,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type {\n  OrganizationContentReconciler,\n  OrganizationMemberships,\n} from \"./organizationMemberships\";\nexport type {\n  OrganizationGroupMutationReceipt,\n  Organizations,\n} from \"./organizationsTypes\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n  AddOrganizationGroupUserInput,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n  runtime: InternalRuntime,\n  containerContents: ContainerContents,\n  openReconciler: () => OrganizationContentReconciler,\n): Organizations {\n  return new OrganizationsService(runtime, containerContents, openReconciler);\n}\n\nclass OrganizationsService implements Organizations {\n  readonly memberships: OrganizationMemberships;\n  private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n  private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n    openReconciler: () => OrganizationContentReconciler,\n  ) {\n    this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n      this.runtimeService,\n    );\n    this.readModelCoordinator = createOrganizationReadModelCoordinator(\n      this.runtimeService,\n    );\n    this.memberships = createOrganizationMemberships(\n      this.runtimeService,\n      this.containerContents,\n      openReconciler,\n    );\n  }\n\n  async addUserToGroup(input: AddOrganizationGroupUserInput) {\n    // Group membership admits a user: only a verified identity link or this\n    // device's own keys can establish the identity it is granted to.\n    // The check reads the trust store of the scope this mutation captured, and\n    // that scope must still be current once it returns.\n    const mutation = currentOrganizationMutation(this.runtimeService);\n    await this.runtimeService.identityLinks.requireVerified(\n      input.targetUserId,\n      mutation.runtime.infra.execSql,\n    );\n    if (!mutation.stillCurrent()) {\n      throw new DatabaseUnavailableError(\n        \"The active database changed while admitting this user. Try again.\",\n      );\n    }\n    return addUserToOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...mutation,\n    });\n  }\n\n  readPendingPolicyMutation(organizationId: string) {\n    return readPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  discardUnreadablePolicyMutation(\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) {\n    return discardUnreadableOrganizationPolicyMutation(\n      this.runtimeService,\n      input,\n    );\n  }\n\n  retryPendingPolicyMutation(organizationId: string) {\n    return retryPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n    return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n  }\n\n  createGroup(name: string) {\n    return createGroupForOrganization({\n      name,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  deleteGroup(groupId: string) {\n    return deleteGroupForOrganization({\n      groupId,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  loadBilling() {\n    return runForOrganization(this.runtimeService, loadOrganizationBilling);\n  }\n\n  loadBillingForOrganization(organizationId: string) {\n    // Gated on an authenticated session rather than on the target being the\n    // active org. The server still enforces membership, so an org the caller\n    // cannot reach resolves to `null`.\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBilling,\n      organizationId,\n    );\n  }\n\n  loadBillingHistory() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingHistory,\n    );\n  }\n\n  loadBillingManagementUrl() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingManagementUrl,\n    );\n  }\n\n  loadStripeCheckoutOptions(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      loadStripeCheckoutOptions,\n      organizationId,\n    );\n  }\n\n  createStripeCheckout(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      createStripeCheckout,\n      organizationId,\n    );\n  }\n\n  createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n      organizationId,\n    );\n  }\n\n  cancelStripeSubscription() {\n    return runForOrganization(this.runtimeService, cancelStripeSubscription);\n  }\n\n  claimNativeSubscription(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => claimNativeOrganizationSubscription({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  checkNativePurchaseEligibility(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => checkNativePurchaseEligibility({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  loadDataUsage() {\n    return this.dataUsageCoordinator.reconcile();\n  }\n\n  loadLocalDataUsage() {\n    return this.dataUsageCoordinator.loadLocal();\n  }\n\n  loadDirectoryAndGroups() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcile(),\n    );\n  }\n\n  loadDirectoryAndGroupsAfterMutation() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile_after_mutation\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcileAfterMutation(),\n    );\n  }\n\n  loadLocalDirectoryAndGroups() {\n    return this.readModelCoordinator.loadLocal();\n  }\n\n  loadGroupMembers(groupId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || groupId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return runtime.apiClient.listOrganizationGroupMembers(\n      organizationId,\n      groupId,\n    );\n  }\n\n  loadGroupPresentationDetails(groupId: string, beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: groupId,\n        objectKind: \"principal\",\n        operation: \"group.presentation.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        loadOrganizationGroupPresentationDetails({\n          groupId,\n          beforeVersion,\n          readModelCoordinator: this.readModelCoordinator,\n          runtime,\n        }),\n    );\n  }\n\n  loadGrants() {\n    return this.readModelCoordinator.loadLocalGrants();\n  }\n\n  loadGroupContainers(groupId: string) {\n    return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n  }\n\n  listLocalOrganizations() {\n    const runtime = this.runtimeService.workflowInput();\n    if (runtime.infra.dbStatus !== \"ready\") {\n      return Promise.resolve([]);\n    }\n\n    return listLocalOrganizations({ execSql: runtime.infra.execSql });\n  }\n\n  loadPolicyHistory(beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        this.readModelCoordinator.loadOrganizationPolicyHistory(\n          undefined,\n          beforeVersion,\n        ),\n    );\n  }\n\n  loadUserDetail(userId: string) {\n    return this.readModelCoordinator.loadLocalUserDetail(userId);\n  }\n\n  async updateRosterEntry(userId: string, profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || userId.length === 0) {\n      return null;\n    }\n\n    const user = await updateOrganizationRosterEntry({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n      userId,\n    });\n    // Callers store this response as directory state, so its leave request\n    // passes the same check as one read from the read model.\n    return (\n      user &&\n      withVerifiedDirectoryUser(\n        organizationId,\n        user,\n        leaveRequestVerifier(this.runtimeService, runtime, {\n          organizationId,\n          userId: runtime.auth.userId ?? \"\",\n        }),\n      )\n    );\n  }\n\n  updateProfile(profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationProfile({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n    });\n  }\n\n  async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n    return removeUserFromOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  async revokeGrant(grant: OrganizationGrantRef) {\n    return revokeOrganizationGrant({\n      ...grant,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  startTrial(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      startOrganizationTrial,\n      organizationId,\n    );\n  }\n}\n"]}

package/client/organizations/organizationsTypes.d.ts

@@ -1,6 +1,6 @@
 import type { NativeSubscriptionStore } from "../../internal/validators/billing.js";
 import type { PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
-import type { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, revokeOrganizationContainerGrant, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
+import type { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, revokeOrganizationContainerGrant, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
 import type { InternalWorkflowRuntimeInput } from "../runtime/workflowRuntime.js";
 import type { OrganizationDataUsageCoordinator } from "./organizationDataUsage.js";
 import type { loadOrganizationGroupPresentationDetails } from "./organizationGroupPresentation.js";
@@ -18,7 +18,6 @@ export interface Organizations {
     addUserToGroup: (input: AddOrganizationGroupUserInput) => Promise<OrganizationGroupMutationReceipt>;
     createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;
     deleteGroup: (groupId: string) => ReturnType<typeof deleteGroupForOrganization>;
-    importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;
     loadBilling: () => ReturnType<typeof loadOrganizationBilling>;
     /** Billing for an organization the session is not currently switched to. */
     loadBillingForOrganization: (organizationId: string) => ReturnType<typeof loadOrganizationBilling>;

package/client/organizations/organizationsTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createOrganizationGroup,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  LocalOrganizationSummary,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationMemberships } from \"./organizationMemberships\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n  AddOrganizationGroupUserInput,\n  deleteGroupForOrganization,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. */\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n  discardUnreadablePolicyMutation: (\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  readPendingPolicyMutation: (\n    organizationId: string,\n  ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n  retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n  abandonPendingPolicyMutation: (\n    input: AbandonOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  addUserToGroup: (\n    input: AddOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n  deleteGroup: (\n    groupId: string,\n  ) => ReturnType<typeof deleteGroupForOrganization>;\n  importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n  loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n  /** Billing for an organization the session is not currently switched to. */\n  loadBillingForOrganization: (\n    organizationId: string,\n  ) => ReturnType<typeof loadOrganizationBilling>;\n  loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n  loadBillingManagementUrl: () => ReturnType<\n    typeof loadOrganizationBillingManagementUrl\n  >;\n  /** Direct Stripe checkout (issue #1654): options, start, and cancel. */\n  loadStripeCheckoutOptions: (\n    organizationId?: string,\n  ) => ReturnType<typeof loadStripeCheckoutOptions>;\n  createStripeCheckout: (\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckout>;\n  createStripeCheckoutSession: (\n    returnUrl: string,\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckoutSession>;\n  cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n  claimNativeSubscription: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n  checkNativePurchaseEligibility: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof checkNativePurchaseEligibility>;\n  loadDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"reconcile\"]\n  >;\n  loadLocalDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"loadLocal\"]\n  >;\n  loadDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcile\"]\n  >;\n  loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n  >;\n  loadLocalDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocal\"]\n  >;\n  loadGroupMembers: (\n    groupId: string,\n  ) => ReturnType<\n    InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n  >;\n  loadGroupPresentationDetails(\n    groupId: string,\n    beforeVersion?: number,\n  ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n  loadGroupContainers: (\n    groupId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n  loadGrants: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n  >;\n  listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n  /** The user's own memberships and per-organization sync choices. */\n  readonly memberships: OrganizationMemberships;\n  loadPolicyHistory: (\n    beforeVersion?: number,\n  ) => ReturnType<\n    OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n  >;\n  loadUserDetail: (\n    userId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n  updateRosterEntry: (\n    userId: string,\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationRosterEntry>;\n  updateProfile: (\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationProfile>;\n  removeUserFromGroup: (\n    input: RemoveOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  revokeGrant: (\n    grant: OrganizationGrantRef,\n  ) => Promise<\n    | Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n    | OrganizationGroupMutationReceipt\n  >;\n  startTrial: (\n    organizationId?: string,\n  ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}
+{"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createOrganizationGroup,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  LocalOrganizationSummary,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationMemberships } from \"./organizationMemberships\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n  AddOrganizationGroupUserInput,\n  deleteGroupForOrganization,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. */\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n  discardUnreadablePolicyMutation: (\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  readPendingPolicyMutation: (\n    organizationId: string,\n  ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n  retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n  abandonPendingPolicyMutation: (\n    input: AbandonOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  addUserToGroup: (\n    input: AddOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n  deleteGroup: (\n    groupId: string,\n  ) => ReturnType<typeof deleteGroupForOrganization>;\n  loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n  /** Billing for an organization the session is not currently switched to. */\n  loadBillingForOrganization: (\n    organizationId: string,\n  ) => ReturnType<typeof loadOrganizationBilling>;\n  loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n  loadBillingManagementUrl: () => ReturnType<\n    typeof loadOrganizationBillingManagementUrl\n  >;\n  /** Direct Stripe checkout (issue #1654): options, start, and cancel. */\n  loadStripeCheckoutOptions: (\n    organizationId?: string,\n  ) => ReturnType<typeof loadStripeCheckoutOptions>;\n  createStripeCheckout: (\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckout>;\n  createStripeCheckoutSession: (\n    returnUrl: string,\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckoutSession>;\n  cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n  claimNativeSubscription: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n  checkNativePurchaseEligibility: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof checkNativePurchaseEligibility>;\n  loadDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"reconcile\"]\n  >;\n  loadLocalDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"loadLocal\"]\n  >;\n  loadDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcile\"]\n  >;\n  loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n  >;\n  loadLocalDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocal\"]\n  >;\n  loadGroupMembers: (\n    groupId: string,\n  ) => ReturnType<\n    InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n  >;\n  loadGroupPresentationDetails(\n    groupId: string,\n    beforeVersion?: number,\n  ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n  loadGroupContainers: (\n    groupId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n  loadGrants: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n  >;\n  listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n  /** The user's own memberships and per-organization sync choices. */\n  readonly memberships: OrganizationMemberships;\n  loadPolicyHistory: (\n    beforeVersion?: number,\n  ) => ReturnType<\n    OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n  >;\n  loadUserDetail: (\n    userId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n  updateRosterEntry: (\n    userId: string,\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationRosterEntry>;\n  updateProfile: (\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationProfile>;\n  removeUserFromGroup: (\n    input: RemoveOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  revokeGrant: (\n    grant: OrganizationGrantRef,\n  ) => Promise<\n    | Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n    | OrganizationGroupMutationReceipt\n  >;\n  startTrial: (\n    organizationId?: string,\n  ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}

package/client/runtime/workflowRuntime.d.ts

@@ -32,7 +32,7 @@ export interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {
     readonly withPrincipalHistoryProtection?: PrincipalHistoryProtectionLease | undefined;
 }
 export interface InternalRuntime {
-    identityLinks: Pick<TrustedUserIdentityService, "createLink" | "verifyLink" | "resolvePinned">;
+    identityLinks: Pick<TrustedUserIdentityService, "createLink" | "verifyLink" | "resolvePinned" | "resolveVerified" | "requireVerified">;
     retirePrincipalHistoryProtection(): void;
     readonly sessionGeneration: number;
     readonly adoptRootContainer: ContainerContentsRootAdopter;

package/client/runtime/workflowRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAIjG,OAAO,EAAgB,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAEhC,sBAAsB,GAGvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,uCAAuC,GAExC,MAAM,0DAA0D,CAAC;AAWlE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAqEpE,SAAS,wBAAwB,CAC/B,YAAyC,EACzC,cAA4B;IAE5B,OAAO,iCAAiC,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,0BAA0B,EAAE,YAAY,CAAC,0BAA0B;QACnE,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;YACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,cAAc;gBACf,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACnE,UAAU,EAAE,cAAc,EAAE;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,cAAc;gBACd,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAkB;IAElB,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;QACtD,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;KAClD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,+BAA+B,CACtC,YAAyC,EACzC,SAA4D,EAC5D,YAAkC;IAElC,OAAO,uCAAuC,CAAC;QAC7C,SAAS;QACT,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAC5C,YAAY,CAAC,mBAAmB;YAC9B,CAAC,CAAC,sBAAsB,CAAC;gBACrB,OAAO;gBACP,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,MAAM;aACP,CAAC;YACJ,CAAC,CAAC,IAAI;QACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB;KACnE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;QACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC;QACrE,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,EACtB,wBAAwB,CACtB,YAAY,EACZ,GAAG,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAC7C,CAAC,IAAI,CACP,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,0BAA0B;QACzC,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,gCAAgC,EAAE,+BAA+B,CAC/D,YAAY,EACZ,iBAAiB,CAAC,IAAI,EACtB,YAAY,CACb;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC;YAAE,kBAAkB,IAAI,CAAC,CAAC;QACxE,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE,EACxE,eAA2C;IAE3C,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,eAAe,EAAE;YAC5B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../../data/documents/documentKinds\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport { type ExecSql, unavailableExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  loadPinnedUserIdentity,\n  type TrustedUserIdentityResolver,\n  type TrustedUserIdentityService,\n} from \"../../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../../workflows/container-contents\";\nimport {\n  createProvisionedPrincipalHistoryPrimer,\n  type ProvisionedPrincipalHistoryPrimer,\n} from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../../workflows/shared/runtimeInput\";\nimport type { Blobs } from \"../blobs\";\nimport type { Identity } from \"../identity\";\nimport { acknowledgedSessionRoot } from \"../session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"../session/sessionTypes\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport {\n  createPrincipalMutationApiCustody,\n  type PrincipalMutationApi,\n} from \"./principalMutationApi\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: PrincipalMutationApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  identityLinks: Pick<\n    TrustedUserIdentityService,\n    \"createLink\" | \"verifyLink\" | \"resolvePinned\"\n  >;\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  readonly primeProvisionedPrincipalHistory: ProvisionedPrincipalHistoryPrimer;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  principalMutationTimeoutMs?: number | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nfunction createRuntimeMutationApi(\n  dependencies: WorkflowRuntimeDependencies,\n  readGeneration: () => number,\n) {\n  return createPrincipalMutationApiCustody({\n    api: dependencies.api,\n    principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,\n    readScope: () => {\n      const { signingKeyPair, signingFingerprint } = dependencies.identity;\n      const { userId, isAuthenticated } = dependencies.session;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !isAuthenticated ||\n        !userId ||\n        !signingKeyPair ||\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        database: dependencies.getDomainScope(),\n        execSql: dependencies.database.requireExecSql(\"principal mutation\"),\n        generation: readGeneration(),\n        identityTrustDomain,\n        signingFingerprint,\n        signingKeyPair,\n        userId,\n      };\n    },\n  });\n}\n\nfunction localIdentityCandidate(\n  identity: Identity,\n): LocalUserIdentityCandidate | null {\n  const { encapsulationKeyPair, signingKeyPair } = identity;\n  if (!encapsulationKeyPair || !signingKeyPair) return null;\n  return {\n    encapsulationPublicKey: encapsulationKeyPair.publicKey,\n    signingKeyFingerprint: identity.signingFingerprint,\n    signingPublicKey: signingKeyPair.signingPublicKey,\n  };\n}\n\n/** Priming reads the runtime's database, identity and trust pins; it pins nothing. */\nfunction createRuntimeProvisioningPrimer(\n  dependencies: WorkflowRuntimeDependencies,\n  bindLease: () => PrincipalHistoryProtectionLease | undefined,\n  readyExecSql: () => ExecSql | null,\n): ProvisionedPrincipalHistoryPrimer {\n  return createProvisionedPrincipalHistoryPrimer({\n    bindLease,\n    execSqlFor: (database) =>\n      dependencies.database.client === database ? readyExecSql() : null,\n    loadPinnedIdentity: async (execSql, userId) =>\n      dependencies.identityTrustDomain\n        ? loadPinnedUserIdentity({\n            execSql,\n            identityTrustDomain: dependencies.identityTrustDomain,\n            userId,\n          })\n        : null,\n    logError: dependencies.logError,\n    signingFingerprint: () => dependencies.identity.signingFingerprint,\n  });\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const readyExecSql = () =>\n    dependencies.database.status === \"ready\"\n      ? dependencies.database.requireExecSql(\"trusted user identity\")\n      : null;\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: readyExecSql,\n    getLocalIdentity: () => localIdentityCandidate(dependencies.identity),\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n    createRuntimeMutationApi(\n      dependencies,\n      () => runtimeSubscription.mutationGeneration,\n    ).bind,\n  );\n\n  return {\n    identityLinks: trustedUserIdentityService,\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    primeProvisionedPrincipalHistory: createRuntimeProvisioningPrimer(\n      dependencies,\n      historyProtection.bind,\n      readyExecSql,\n    ),\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let mutationGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    mutationGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    if (sessionScopeChanged(sessionSnapshot, next)) mutationGeneration += 1;\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get mutationGeneration() {\n      return mutationGeneration;\n    },\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken || sessionScopeChanged(previous, next)\n  );\n}\n\n// A transport token renewal cannot turn a definite write refusal into saved work.\n// Journal custody still expires on every change to its identity or storage scope.\nfunction sessionScopeChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n  bindMutationApi: () => PrincipalMutationApi,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: bindMutationApi(),\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}
+{"version":3,"file":"workflowRuntime.js","sourceRoot":"","sources":["workflowRuntime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAIjG,OAAO,EAAgB,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAEhC,sBAAsB,GAGvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,uCAAuC,GAExC,MAAM,0DAA0D,CAAC;AAWlE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,uCAAuC,GAExC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAyEpE,SAAS,wBAAwB,CAC/B,YAAyC,EACzC,cAA4B;IAE5B,OAAO,iCAAiC,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,0BAA0B,EAAE,YAAY,CAAC,0BAA0B;QACnE,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;YACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,cAAc;gBACf,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACnE,UAAU,EAAE,cAAc,EAAE;gBAC5B,mBAAmB;gBACnB,kBAAkB;gBAClB,cAAc;gBACd,MAAM;aACP,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAkB;IAElB,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAC1D,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;QACtD,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;KAClD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,+BAA+B,CACtC,YAAyC,EACzC,SAA4D,EAC5D,YAAkC;IAElC,OAAO,uCAAuC,CAAC;QAC7C,SAAS;QACT,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAC5C,YAAY,CAAC,mBAAmB;YAC9B,CAAC,CAAC,sBAAsB,CAAC;gBACrB,OAAO;gBACP,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,MAAM;aACP,CAAC;YACJ,CAAC,CAAC,IAAI;QACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB;KACnE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAyC;IAEzC,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;QACtC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,uBAAuB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;QAClE,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC;QACrE,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACjD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,YAAY,EAAE,2BAA2B,CAAC,YAAY,CAAC,GAAG,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,0BAA0B,GAAgC,CAAC,MAAM,EAAE,EAAE,CACzE,gCAAgC,CAC9B,YAAY,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,uBAAuB;QAClC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;KACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CACjD,CAAC;IACJ,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;QAChE,WAAW,EAAE,YAAY,CAAC,2BAA2B;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACpE,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,IACE,CAAC,kBAAkB;gBACnB,CAAC,mBAAmB;gBACpB,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAExC,OAAO,IAAI,CAAC;YACd,OAAO;gBACL,kBAAkB;gBAClB,mBAAmB;gBACnB,QAAQ,EAAE,YAAY,CAAC,cAAc,EAAE;gBACvC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAC5C,YAAY,EACZ,0BAA0B,EAC1B,iBAAiB,CAAC,IAAI,EACtB,wBAAwB,CACtB,YAAY,EACZ,GAAG,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAC7C,CAAC,IAAI,CACP,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,0BAA0B;QACzC,gCAAgC,EAAE,iBAAiB,CAAC,MAAM;QAC1D,IAAI,iBAAiB;YACnB,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QACD,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,CAAC,qBAAqB,EAAE,EAAE,CACrC,0BAA0B,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC/D,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS;YAC1C,MAAM,gCAAgC,CACpC,YAAY,CAAC,sBAAsB,EACnC;gBACE,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yBAAyB;gBACpC,cAAc,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc;aACpD,EACD,GAAG,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,gCAAgC,EAAE,+BAA+B,CAC/D,YAAY,EACZ,iBAAiB,CAAC,IAAI,EACtB,YAAY,CACb;QACD,aAAa,EAAE;YACb,IAAI,OAAO;gBACT,OAAO,mBAAmB,CAAC,OAAO,CAAC;YACrC,CAAC;YACD,KAAK,EAAE,YAAY,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB,CAAC,SAAS;SACzC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,YAAyC;IAC1E,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,CAAC;QACb,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;QACxB,kBAAkB,IAAI,CAAC,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC/C,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,uBAAuB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,iBAAiB,IAAI,CAAC,CAAC;YACvB,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC;YAAE,kBAAkB,IAAI,CAAC,CAAC;QACxE,eAAe,GAAG,IAAI,CAAC;QACvB,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,kBAAkB;YACpB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,IAAI,iBAAiB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,QAAyB;YACjC,OAAO,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,gBAAgB,CAAC,EACxB,OAAO,EACP,QAAQ,GACoB;IAC5B,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAChE,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAC9B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,IAAqB;IAErB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC/C,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAyC,EACzC,0BAAuD,EACvD,qBAAwE,EACxE,eAA2C;IAE3C,IAAI,IAA0C,CAAC;IAC/C,IAAI,MAA8C,CAAC;IACnD,IAAI,KAA4C,CAAC;IACjD,IAAI,KAA4C,CAAC;IACjD,IAAI,IAA0C,CAAC;IAC/C,IAAI,QAAkD,CAAC;IAEvD,MAAM,aAAa,GAAG,CACpB,WAAuC,EACT,EAAE;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;YAClB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,yBAAyB,CAAC;YACjE,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,eAAe,GACnB,CAAC,WAAW,KAAK,SAAS;YACxB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE3B,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,oBAAoB;YAChE,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,kBAAkB;YAC5D,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc;SACrD,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK;YACnC,QAAQ;YACR,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,mEAAmE;YACnE,mEAAmE;YACnE,OAAO;SACR,CAAC,CAAC;QACH,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACjC,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;YAClC,2EAA2E;YAC3E,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW;YACvE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,IAAI;YACzC,gCAAgC,EAC9B,YAAY,CAAC,MAAM,CAAC,oBAAoB;SAC3C,CAAC,CAAC;QACH,IACE,CAAC,IAAI;YACL,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;YAC7B,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;YACvC,IAAI,CAAC,sBAAsB,KAAK,YAAY,CAAC,sBAAsB,EACnE,CAAC;YACD,IAAI,GAAG;gBACL,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtC,YAAY,CAAC,eAAe,EAAE,wBAAwB,CACpD,cAAc,CACf,IAAI,KAAK;gBACZ,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,eAAe,EAAE;YAC5B,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,IAAI;YACJ,0BAA0B;YAC1B,8BAA8B,EAAE,qBAAqB,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,WAAW;YACnB,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,0BAA0B,EAAE,2BAA2B,EACvD,8BAA8B,EAAE,+BAA+B,EAC/D,IAAI,EAAE,YAAY,EAClB,GAAG,KAAK,EACT,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC/B,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE;gBACvC,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;gBACrD,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,IAAO;IAEP,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { ApiClient } from \"@tearleads/api-client\";\nimport type { DocumentProjectorRegistry } from \"../../data/documents/documentKinds\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport type { PrincipalHistoryProtectionLease } from \"../../data/principals/principalHistoryProtection\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\nimport { type ExecSql, unavailableExecSql } from \"../../data/sqlite/sqlSchema\";\nimport {\n  createApiUserIdentitySource,\n  createTrustedUserIdentityService,\n  type LocalUserIdentityCandidate,\n  loadPinnedUserIdentity,\n  type TrustedUserIdentityResolver,\n  type TrustedUserIdentityService,\n} from \"../../data/trustedUserIdentity\";\nimport type { ContainerContentsRootAdopter } from \"../../workflows/container-contents\";\nimport {\n  createProvisionedPrincipalHistoryPrimer,\n  type ProvisionedPrincipalHistoryPrimer,\n} from \"../../workflows/registration/provisionedPrincipalHistory\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n  WorkflowRuntimeGroups,\n  WorkflowRuntimeInfraInput,\n  WorkflowRuntimeStateInput,\n  WorkflowRuntimeUtilInput,\n} from \"../../workflows/shared/runtimeInput\";\nimport type { Blobs } from \"../blobs\";\nimport type { Identity } from \"../identity\";\nimport { acknowledgedSessionRoot } from \"../session/sessionRootAuthority\";\nimport type { Session, SessionSnapshot } from \"../session/sessionTypes\";\nimport type { Database } from \"./database\";\nimport type { Events } from \"./events\";\nimport { createListenerSet } from \"./listenerSet\";\nimport type { Network } from \"./network\";\nimport {\n  createPrincipalHistoryProtectionCustody,\n  type PrincipalHistoryKeyProvider,\n} from \"./principalHistoryProtection\";\nimport {\n  createPrincipalMutationApiCustody,\n  type PrincipalMutationApi,\n} from \"./principalMutationApi\";\nimport { adoptSessionRootContainer } from \"./rootContainerAdoption\";\nimport type { SyncBillingGate } from \"./syncBillingGate\";\n\ntype HostWorkflowRuntimeUtilInput = Omit<\n  WorkflowRuntimeUtilInput,\n  \"reportSecurityIncident\"\n>;\n\nexport interface WorkflowRuntimeInput\n  extends Omit<WorkflowRuntimeGroups, \"util\"> {\n  readonly util: HostWorkflowRuntimeUtilInput;\n}\n\nexport type RuntimeListener = () => void;\n\nexport interface Runtime {\n  readonly version: number;\n  input(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  subscribe(listener: RuntimeListener): () => void;\n}\n\nexport interface InternalWorkflowRuntimeInput extends WorkflowRuntimeGroups {\n  readonly apiClient: PrincipalMutationApi;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly withPrincipalHistoryProtection?:\n    | PrincipalHistoryProtectionLease\n    | undefined;\n}\n\nexport interface InternalRuntime {\n  identityLinks: Pick<\n    TrustedUserIdentityService,\n    | \"createLink\"\n    | \"verifyLink\"\n    | \"resolvePinned\"\n    | \"resolveVerified\"\n    | \"requireVerified\"\n  >;\n  retirePrincipalHistoryProtection(): void;\n  readonly sessionGeneration: number;\n  readonly adoptRootContainer: ContainerContentsRootAdopter;\n  readonly publicRuntime: Runtime;\n  boundUserId(signingKeyFingerprint: string): Promise<string | null>;\n  pinLocalUserIdentity(\n    userId: string,\n    candidate: LocalUserIdentityCandidate,\n  ): Promise<void>;\n  readonly primeProvisionedPrincipalHistory: ProvisionedPrincipalHistoryPrimer;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\ninterface WorkflowRuntimeDependencies {\n  api: ApiClient;\n  blobs: Blobs;\n  database: Database;\n  documentProjectors: DocumentProjectorRegistry;\n  events: Events;\n  getDomainScope: () => DomainScope;\n  identity: Identity;\n  identityTrustDomain: string | null;\n  log: (message: string) => void;\n  logError: (message: string | Error, cause?: unknown) => void;\n  network: Network;\n  peerScope?: string | null;\n  principalHistoryKeyProvider?: PrincipalHistoryKeyProvider | undefined;\n  principalMutationTimeoutMs?: number | undefined;\n  reportSecurityIncident: SecurityIncidentReporter;\n  session: Session;\n  syncBillingGate?: SyncBillingGate | undefined;\n}\n\nfunction createRuntimeMutationApi(\n  dependencies: WorkflowRuntimeDependencies,\n  readGeneration: () => number,\n) {\n  return createPrincipalMutationApiCustody({\n    api: dependencies.api,\n    principalMutationTimeoutMs: dependencies.principalMutationTimeoutMs,\n    readScope: () => {\n      const { signingKeyPair, signingFingerprint } = dependencies.identity;\n      const { userId, isAuthenticated } = dependencies.session;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !isAuthenticated ||\n        !userId ||\n        !signingKeyPair ||\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        database: dependencies.getDomainScope(),\n        execSql: dependencies.database.requireExecSql(\"principal mutation\"),\n        generation: readGeneration(),\n        identityTrustDomain,\n        signingFingerprint,\n        signingKeyPair,\n        userId,\n      };\n    },\n  });\n}\n\nfunction localIdentityCandidate(\n  identity: Identity,\n): LocalUserIdentityCandidate | null {\n  const { encapsulationKeyPair, signingKeyPair } = identity;\n  if (!encapsulationKeyPair || !signingKeyPair) return null;\n  return {\n    encapsulationPublicKey: encapsulationKeyPair.publicKey,\n    signingKeyFingerprint: identity.signingFingerprint,\n    signingPublicKey: signingKeyPair.signingPublicKey,\n  };\n}\n\n/** Priming reads the runtime's database, identity and trust pins; it pins nothing. */\nfunction createRuntimeProvisioningPrimer(\n  dependencies: WorkflowRuntimeDependencies,\n  bindLease: () => PrincipalHistoryProtectionLease | undefined,\n  readyExecSql: () => ExecSql | null,\n): ProvisionedPrincipalHistoryPrimer {\n  return createProvisionedPrincipalHistoryPrimer({\n    bindLease,\n    execSqlFor: (database) =>\n      dependencies.database.client === database ? readyExecSql() : null,\n    loadPinnedIdentity: async (execSql, userId) =>\n      dependencies.identityTrustDomain\n        ? loadPinnedUserIdentity({\n            execSql,\n            identityTrustDomain: dependencies.identityTrustDomain,\n            userId,\n          })\n        : null,\n    logError: dependencies.logError,\n    signingFingerprint: () => dependencies.identity.signingFingerprint,\n  });\n}\n\nexport function createRuntime(\n  dependencies: WorkflowRuntimeDependencies,\n): InternalRuntime {\n  const readyExecSql = () =>\n    dependencies.database.status === \"ready\"\n      ? dependencies.database.requireExecSql(\"trusted user identity\")\n      : null;\n  const trustedUserIdentityService = createTrustedUserIdentityService({\n    getExecSql: readyExecSql,\n    getLocalIdentity: () => localIdentityCandidate(dependencies.identity),\n    getLocalUserId: () => dependencies.session.userId,\n    identityTrustDomain: dependencies.identityTrustDomain,\n    remoteSource: createApiUserIdentitySource(dependencies.api),\n  });\n  const resolveTrustedUserIdentity: TrustedUserIdentityResolver = (userId) =>\n    runWithSecurityIncidentReporting(\n      dependencies.reportSecurityIncident,\n      {\n        objectId: userId,\n        objectKind: \"user\",\n        operation: \"user.identity.resolve\",\n        organizationId: dependencies.session.organizationId,\n      },\n      () => trustedUserIdentityService.resolve(userId),\n    );\n  const runtimeSubscription = createRuntimeSubscription(dependencies);\n  const historyProtection = createPrincipalHistoryProtectionCustody({\n    keyProvider: dependencies.principalHistoryKeyProvider,\n    readScope: () => {\n      const signingFingerprint = dependencies.identity.signingFingerprint;\n      const identityTrustDomain = dependencies.identityTrustDomain;\n      if (\n        !signingFingerprint ||\n        !identityTrustDomain ||\n        dependencies.database.status !== \"ready\"\n      )\n        return null;\n      return {\n        signingFingerprint,\n        identityTrustDomain,\n        database: dependencies.getDomainScope(),\n        generation: runtimeSubscription.recoveryGeneration,\n      };\n    },\n  });\n  const runtimeInput = createRuntimeInputFactory(\n    dependencies,\n    resolveTrustedUserIdentity,\n    historyProtection.bind,\n    createRuntimeMutationApi(\n      dependencies,\n      () => runtimeSubscription.mutationGeneration,\n    ).bind,\n  );\n\n  return {\n    identityLinks: trustedUserIdentityService,\n    retirePrincipalHistoryProtection: historyProtection.retire,\n    get sessionGeneration() {\n      return runtimeSubscription.sessionGeneration;\n    },\n    adoptRootContainer: (input) =>\n      adoptSessionRootContainer(dependencies, input),\n    boundUserId: (signingKeyFingerprint) =>\n      trustedUserIdentityService.boundUserId(signingKeyFingerprint),\n    async pinLocalUserIdentity(userId, candidate) {\n      await runWithSecurityIncidentReporting(\n        dependencies.reportSecurityIncident,\n        {\n          objectId: userId,\n          objectKind: \"user\",\n          operation: \"user.identity.pin_local\",\n          organizationId: dependencies.session.organizationId,\n        },\n        () => trustedUserIdentityService.pinLocal(userId, candidate),\n      );\n    },\n    primeProvisionedPrincipalHistory: createRuntimeProvisioningPrimer(\n      dependencies,\n      historyProtection.bind,\n      readyExecSql,\n    ),\n    publicRuntime: {\n      get version() {\n        return runtimeSubscription.version;\n      },\n      input: runtimeInput.hostInput,\n      subscribe: runtimeSubscription.subscribe,\n    },\n    workflowInput: runtimeInput.workflowInput,\n  };\n}\n\nfunction createRuntimeSubscription(dependencies: WorkflowRuntimeDependencies) {\n  const listeners = createListenerSet();\n  let version = 0;\n  let sessionGeneration = 0;\n  let recoveryGeneration = 0;\n  let mutationGeneration = 0;\n  let sessionSnapshot = dependencies.session.snapshot;\n  const notifyListeners = () => {\n    version += 1;\n    listeners.notify();\n  };\n\n  const notifyAuthority = () => {\n    recoveryGeneration += 1;\n    mutationGeneration += 1;\n    notifyListeners();\n  };\n  dependencies.database.subscribe(notifyAuthority);\n  dependencies.events.subscribe(notifyListeners);\n  dependencies.identity.subscribe(notifyAuthority);\n  dependencies.network.subscribe(() => notifyListeners());\n  dependencies.session.subscribe(() => {\n    const next = dependencies.session.snapshot;\n    if (sessionAuthorityChanged(sessionSnapshot, next)) {\n      sessionGeneration += 1;\n      recoveryGeneration += 1;\n    }\n    if (sessionScopeChanged(sessionSnapshot, next)) mutationGeneration += 1;\n    sessionSnapshot = next;\n    notifyListeners();\n  });\n  dependencies.syncBillingGate?.subscribe(notifyListeners);\n\n  return {\n    get mutationGeneration() {\n      return mutationGeneration;\n    },\n    get recoveryGeneration() {\n      return recoveryGeneration;\n    },\n    get sessionGeneration() {\n      return sessionGeneration;\n    },\n    get version() {\n      return version;\n    },\n    subscribe(listener: RuntimeListener): () => void {\n      return listeners.subscribe(listener);\n    },\n  };\n}\n\ninterface RuntimeInputFactory {\n  hostInput(containerId?: string | null | undefined): WorkflowRuntimeInput;\n  workflowInput(\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput;\n}\n\nfunction sessionAuthInput({\n  session,\n  identity,\n}: WorkflowRuntimeDependencies): WorkflowRuntimeAuthInput {\n  const signingFingerprint = identity.snapshot.signingFingerprint;\n  return {\n    defaultOrganizationId: session.defaultOrganizationId,\n    rootContainerId: acknowledgedSessionRoot(session, signingFingerprint),\n    isAuthenticated: session.isAuthenticated,\n    isRoot: session.isRoot,\n    organizationId: session.organizationId,\n    userId: session.userId,\n  };\n}\n\n/** Fields whose change invalidates work keyed on the session's authority. */\nfunction sessionAuthorityChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.authToken !== previous.authToken || sessionScopeChanged(previous, next)\n  );\n}\n\n// A transport token renewal cannot turn a definite write refusal into saved work.\n// Journal custody still expires on every change to its identity or storage scope.\nfunction sessionScopeChanged(\n  previous: SessionSnapshot,\n  next: SessionSnapshot,\n): boolean {\n  return (\n    next.isAuthenticated !== previous.isAuthenticated ||\n    next.isRoot !== previous.isRoot ||\n    next.organizationId !== previous.organizationId ||\n    next.userId !== previous.userId\n  );\n}\n\nfunction createRuntimeInputFactory(\n  dependencies: WorkflowRuntimeDependencies,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n  bindHistoryProtection: () => PrincipalHistoryProtectionLease | undefined,\n  bindMutationApi: () => PrincipalMutationApi,\n): RuntimeInputFactory {\n  let auth: WorkflowRuntimeAuthInput | undefined;\n  let crypto: WorkflowRuntimeCryptoInput | undefined;\n  let infra: WorkflowRuntimeInfraInput | undefined;\n  let state: WorkflowRuntimeStateInput | undefined;\n  let util: WorkflowRuntimeUtilInput | undefined;\n  let hostUtil: HostWorkflowRuntimeUtilInput | undefined;\n\n  const workflowInput = (\n    containerId?: string | null | undefined,\n  ): InternalWorkflowRuntimeInput => {\n    const dbStatus = dependencies.database.status;\n    const execSql =\n      dbStatus === \"ready\"\n        ? dependencies.database.requireExecSql(\"tearleads.runtime.input\")\n        : unavailableExecSql;\n    const nextContainerId =\n      (containerId === undefined\n        ? dependencies.session.containerId\n        : containerId) ?? null;\n\n    auth = reuseIfShallowEqual(auth, sessionAuthInput(dependencies));\n    crypto = reuseIfShallowEqual(crypto, {\n      encapsulationKeyPair: dependencies.identity.encapsulationKeyPair,\n      signingFingerprint: dependencies.identity.signingFingerprint,\n      signingKeyPair: dependencies.identity.signingKeyPair,\n    });\n    infra = reuseIfShallowEqual(infra, {\n      blobStore: dependencies.blobs.store,\n      dbStatus,\n      documentProjectors: dependencies.documentProjectors,\n      // Runtime consumers branch on dbStatus before touching SQLite. The\n      // fallback preserves the runtime shape and catches lifecycle bugs.\n      execSql,\n    });\n    state = reuseIfShallowEqual(state, {\n      containerId: nextContainerId,\n      domainScope: dependencies.getDomainScope(),\n      events: dependencies.events.events,\n      // Resolved sync-online: workflows treat local-only mode exactly like being\n      // offline (no server I/O), while `tearleads.network` stays the truthful\n      // connectivity signal for host/UI. See Session.syncEnabled.\n      online: dependencies.network.online && dependencies.session.syncEnabled,\n      peerScope: dependencies.peerScope ?? null,\n      serverEventsConnectionGeneration:\n        dependencies.events.connectionGeneration,\n    });\n    if (\n      !util ||\n      util.log !== dependencies.log ||\n      util.logError !== dependencies.logError ||\n      util.reportSecurityIncident !== dependencies.reportSecurityIncident\n    ) {\n      util = {\n        isRemoteSyncBlocked: (organizationId) =>\n          dependencies.syncBillingGate?.isBlockedForOrganization(\n            organizationId,\n          ) ?? false,\n        log: dependencies.log,\n        logError: dependencies.logError,\n        reportSecurityIncident: dependencies.reportSecurityIncident,\n      };\n    }\n\n    return {\n      apiClient: bindMutationApi(),\n      auth,\n      crypto,\n      infra,\n      state,\n      util,\n      resolveTrustedUserIdentity,\n      withPrincipalHistoryProtection: bindHistoryProtection(),\n    };\n  };\n\n  return {\n    hostInput(containerId) {\n      const {\n        apiClient: _apiClient,\n        resolveTrustedUserIdentity: _resolveTrustedUserIdentity,\n        withPrincipalHistoryProtection: _withPrincipalHistoryProtection,\n        util: workflowUtil,\n        ...input\n      } = workflowInput(containerId);\n      hostUtil = reuseIfShallowEqual(hostUtil, {\n        isRemoteSyncBlocked: workflowUtil.isRemoteSyncBlocked,\n        log: workflowUtil.log,\n        logError: workflowUtil.logError,\n      });\n      return { ...input, util: hostUtil };\n    },\n    workflowInput,\n  };\n}\n\n/**\n * Reuses the current runtime-input group when every field of the freshly\n * constructed `next` literal is reference-equal, so unchanged groups keep a\n * stable identity across runtime reads.\n */\nfunction reuseIfShallowEqual<T extends object>(\n  current: T | undefined,\n  next: T,\n): T {\n  if (!current) {\n    return next;\n  }\n  for (const key of Object.keys(next)) {\n    if (Reflect.get(current, key) !== Reflect.get(next, key)) {\n      return next;\n    }\n  }\n  return current;\n}\n"]}

package/data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js

@@ -3,11 +3,11 @@ import { keyingCheckpointTables, principalPolicyTables, } from "../../sqlite/sch
 import { verifiedManifestBundleTables } from "../../sqlite/schema/verifiedManifestBundleSchema.js";
 import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
-import { assertContainerNotRetired } from "../principalKeys/principalGrantRetirementPersistence.js";
+import { loadContainerRetirementCheck } from "../principalKeys/principalGrantRetirementPersistence.js";
 import { verifiedManifestBundleRows, writeVerifiedManifestBundlesInTransaction, } from "../verifiedManifestBundlePersistence.js";
 import { storeDocumentPurgeCheckpointInTransaction, } from "./documentPurgeCheckpointPersistence.js";
 import { validateAccessManifestCheckpointEvidence } from "./keyingCheckpointEvidence.js";
-import { accessManifestObjectKey, loadStoredAccessManifestCheckpoint, loadStoredPrincipalPolicyCheckpoint, principalPolicyKey, upsertAccessManifestCheckpointInTransaction, upsertPrincipalPolicyCheckpointInTransaction, } from "./keyingCheckpointPersistence.js";
+import { accessManifestObjectKey, loadAccessManifestCheckpointRows, loadStoredPrincipalPolicyCheckpoints, principalPolicyKey, upsertAccessManifestCheckpointsInTransaction, upsertPrincipalPolicyCheckpointsInTransaction, } from "./keyingCheckpointPersistence.js";
 import { validatePrincipalAuthorizationCheckpoints } from "./principalAuthorizationCheckpoints.js";
 function validateAccessAdvance(advance, localCheckpoint) {
     const current = {
@@ -40,13 +40,21 @@ function validateAccessAdvance(advance, localCheckpoint) {
 }
 async function validateAccessAdvances(tx, advances) {
     const pending = new Map();
+    if (advances.length === 0)
+        return pending;
+    // Set reads first; the checks then replay in order, so the same advance
+    // fails first with the same error.
+    const heads = advances.map((advance) => advance.head.checkpoint);
+    const assertNotRetired = await loadContainerRetirementCheck(tx, heads);
+    const stored = await loadAccessManifestCheckpointRows(tx, heads);
     for (const advance of advances) {
-        await assertContainerNotRetired(tx, advance.head.checkpoint);
+        assertNotRetired(advance.head.checkpoint);
         const key = accessManifestObjectKey(advance.head.checkpoint);
         if (pending.has(key)) {
             throw new KeyingVerificationError("equivocation", `projection declares multiple access checkpoint heads for ${key}`);
         }
-        const localCheckpoint = await loadStoredAccessManifestCheckpoint(tx, advance.head.checkpoint);
+        const row = stored.get(key);
+        const localCheckpoint = row ? { ...advance.head.checkpoint, ...row } : null;
         pending.set(key, validateAccessAdvance(advance, localCheckpoint));
     }
     return pending;
@@ -72,6 +80,7 @@ export async function validatePrincipalPolicyCheckpointAdvances(tx, policies) {
         policiesByPrincipal.set(key, candidates);
     }
     const pending = new Map();
+    const stored = await loadStoredPrincipalPolicyCheckpoints(tx, policies);
     for (const key of [...policiesByPrincipal.keys()].sort()) {
         const candidates = policiesByPrincipal.get(key) ?? [];
         const maxVersion = Math.max(...candidates.map((policy) => policy.version));
@@ -91,7 +100,7 @@ export async function validatePrincipalPolicyCheckpointAdvances(tx, policies) {
                 throw new KeyingVerificationError("stale_predecessor", `principal policy head does not extend observed state for ${key}`);
             }
         }
-        const localCheckpoint = await loadStoredPrincipalPolicyCheckpoint(tx, head);
+        const localCheckpoint = stored.get(key) ?? null;
         verifyPrincipalPolicyCheckpoint({
             chain: "retainedHistory" in head ? head.retainedHistory : (head.history ?? []),
             currentState: head.state,
@@ -102,15 +111,11 @@ export async function validatePrincipalPolicyCheckpointAdvances(tx, policies) {
     return pending;
 }
 async function writeAccessCheckpoints(tx, pending, updatedAt) {
-    for (const { checkpoint } of pending.values()) {
-        await upsertAccessManifestCheckpointInTransaction(tx, checkpoint, updatedAt);
-    }
+    await upsertAccessManifestCheckpointsInTransaction(tx, [...pending.values()].map(({ checkpoint }) => checkpoint), updatedAt);
 }
 /** Pins the heads `validatePrincipalPolicyCheckpointAdvances` returned. */
 export async function writePrincipalPolicyCheckpoints(tx, pending, updatedAt, organizationId) {
-    for (const policy of pending.values()) {
-        await upsertPrincipalPolicyCheckpointInTransaction(tx, policy.checkpoint, updatedAt, organizationId);
-    }
+    await upsertPrincipalPolicyCheckpointsInTransaction(tx, [...pending.values()].map((policy) => policy.checkpoint), updatedAt, organizationId);
 }
 /**
  * Digests the verified bundles and ensures every table the batch touches,

package/data/persistence/keyingCheckpoints/keyingCheckpointAdvancePersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"keyingCheckpointAdvancePersistence.js","sourceRoot":"","sources":["keyingCheckpointAdvancePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,EAIvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAGL,0BAA0B,EAC1B,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wCAAwC,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,mCAAmC,EACnC,kBAAkB,EAClB,2CAA2C,EAC3C,4CAA4C,GAC7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AA8BhG,SAAS,qBAAqB,CAC5B,OAAwC,EACxC,eAAgD;IAEhD,MAAM,OAAO,GAAG;QACd,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU;QAC1B,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACjE,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAChE,CAAC;IAEF,IAAI,eAAe,IAAI,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9D,mCAAmC,CAAC;YAClC,OAAO;YACP,eAAe;YACf,sBAAsB,EAAE,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC,CAAC;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY;QACZ,eAAe;KAChB,CAAC,CAAC;IAEH,mCAAmC,CAAC;QAClC,OAAO;QACP,eAAe;QACf,sBAAsB,EAAE,YAAY,CAAC,MAAM,CACzC,CAAC,QAAQ,EAAE,EAAE,CACX,eAAe,KAAK,IAAI;YACxB,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;YACjD,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAC5C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAoD;IAEpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4DAA4D,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,kCAAkC,CAC9D,EAAE,EACF,OAAO,CAAC,IAAI,CAAC,UAAU,CACxB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,SAA2B;IAE3B,MAAM,OAAO,GACX,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,OAAO,EAAE,IAAI,CACX,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAC1C,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAAqC;IAErC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,GAAG,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,+BAA+B,CAAC;YAC9B,KAAK,EACH,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACzE,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAqD,EACrD,SAAiB;IAEjB,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,2CAA2C,CAC/C,EAAE,EACF,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,EAAgC,EAChC,OAA8C,EAC9C,SAAiB,EACjB,cAAmC;IAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,4CAA4C,CAChD,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,SAAS,EACT,cAAc,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CACzC,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CACjD,KAAK,CAAC,eAAe,IAAI,EAAE,CAC5B,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,KAAK,CAAC,qBAAqB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,sBAAsB;QACzB,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC1D,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,yCAAyC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QACF,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE;YAC7D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAGC;IAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,EAAE,EACF,KAAK,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QAEF,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,+BAA+B,CACnC,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,uBAAuB,EAC7B,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../../sqlite/schema\";\nimport { verifiedManifestBundleTables } from \"../../sqlite/schema/verifiedManifestBundleSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { assertContainerNotRetired } from \"../principalKeys/principalGrantRetirementPersistence\";\nimport {\n  type VerifiedManifestBundle,\n  type VerifiedManifestBundleRow,\n  verifiedManifestBundleRows,\n  writeVerifiedManifestBundlesInTransaction,\n} from \"../verifiedManifestBundlePersistence\";\nimport {\n  type DocumentPurgeCheckpoint,\n  storeDocumentPurgeCheckpointInTransaction,\n} from \"./documentPurgeCheckpointPersistence\";\nimport { validateAccessManifestCheckpointEvidence } from \"./keyingCheckpointEvidence\";\nimport {\n  accessManifestObjectKey,\n  loadStoredAccessManifestCheckpoint,\n  loadStoredPrincipalPolicyCheckpoint,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointInTransaction,\n  upsertPrincipalPolicyCheckpointInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { validatePrincipalAuthorizationCheckpoints } from \"./principalAuthorizationCheckpoints\";\n\nexport interface AccessManifestCheckpointAdvance {\n  readonly head: VerifiedAccessManifestCheckpointEvidence;\n  readonly predecessors: readonly VerifiedAccessManifestCheckpointEvidence[];\n}\n\ntype CheckpointPolicy =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\ninterface KeyingCheckpointValidationInput {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly execSql: ExecSql;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  /**\n   * Bundles this projection verified. They are stored for later citation in\n   * the same transaction, so they commit only with the batch they verified.\n   */\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n}\n\ninterface PendingAccessCheckpoint {\n  readonly checkpoint: AccessManifestCheckpoint;\n}\n\nfunction validateAccessAdvance(\n  advance: AccessManifestCheckpointAdvance,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): PendingAccessCheckpoint {\n  const current = {\n    ...advance.head.checkpoint,\n    previousManifestHash: advance.head.manifest.previousManifestHash,\n  };\n  const predecessors = [...advance.predecessors].sort(\n    (left, right) => left.checkpoint.epoch - right.checkpoint.epoch,\n  );\n\n  if (localCheckpoint && current.epoch <= localCheckpoint.epoch) {\n    verifyAccessManifestLocalCheckpoint({\n      current,\n      localCheckpoint,\n      checkpointPredecessors: undefined,\n    });\n  }\n\n  validateAccessManifestCheckpointEvidence({\n    head: advance.head,\n    predecessors,\n    localCheckpoint,\n  });\n\n  verifyAccessManifestLocalCheckpoint({\n    current,\n    localCheckpoint,\n    checkpointPredecessors: predecessors.filter(\n      (manifest) =>\n        localCheckpoint !== null &&\n        manifest.checkpoint.epoch > localCheckpoint.epoch &&\n        manifest.checkpoint.epoch < current.epoch,\n    ),\n  });\n\n  return {\n    checkpoint: advance.head.checkpoint,\n  };\n}\n\nasync function validateAccessAdvances(\n  tx: ClientSQLiteTransactionScope,\n  advances: readonly AccessManifestCheckpointAdvance[],\n): Promise<Map<string, PendingAccessCheckpoint>> {\n  const pending = new Map<string, PendingAccessCheckpoint>();\n\n  for (const advance of advances) {\n    await assertContainerNotRetired(tx, advance.head.checkpoint);\n    const key = accessManifestObjectKey(advance.head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares multiple access checkpoint heads for ${key}`,\n      );\n    }\n    const localCheckpoint = await loadStoredAccessManifestCheckpoint(\n      tx,\n      advance.head.checkpoint,\n    );\n    pending.set(key, validateAccessAdvance(advance, localCheckpoint));\n  }\n\n  return pending;\n}\n\nfunction extendsObservedPolicy(\n  head: CheckpointPolicy,\n  candidate: CheckpointPolicy,\n): boolean {\n  const history =\n    \"retainedHistory\" in head ? head.retainedHistory : head.history;\n  return (\n    history?.some(\n      ({ state }) =>\n        state.principalType === candidate.principalType &&\n        state.principalId === candidate.principalId &&\n        state.version === candidate.version &&\n        state.stateHash === candidate.stateHash,\n    ) ?? false\n  );\n}\n\n/**\n * Checks, inside the caller's transaction, that each principal's newest policy\n * extends every other candidate and its durable checkpoint. Returns the heads\n * to pin, keyed by principal.\n */\nexport async function validatePrincipalPolicyCheckpointAdvances(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly CheckpointPolicy[],\n): Promise<Map<string, CheckpointPolicy>> {\n  const policiesByPrincipal = new Map<string, CheckpointPolicy[]>();\n  for (const policy of policies) {\n    const key = principalPolicyKey(policy);\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    candidates.push(policy);\n    policiesByPrincipal.set(key, candidates);\n  }\n\n  const pending = new Map<string, CheckpointPolicy>();\n  for (const key of [...policiesByPrincipal.keys()].sort()) {\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    const maxVersion = Math.max(...candidates.map((policy) => policy.version));\n    const heads = candidates.filter((policy) => policy.version === maxVersion);\n    const head = heads[0];\n    if (!head) {\n      continue;\n    }\n    if (heads.some((candidate) => candidate.stateHash !== head.stateHash)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `principal policy declares conflicting heads for ${key}`,\n      );\n    }\n    for (const candidate of candidates) {\n      if (candidate.version === head.version) {\n        continue;\n      }\n      if (!extendsObservedPolicy(head, candidate)) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          `principal policy head does not extend observed state for ${key}`,\n        );\n      }\n    }\n\n    const localCheckpoint = await loadStoredPrincipalPolicyCheckpoint(tx, head);\n    verifyPrincipalPolicyCheckpoint({\n      chain:\n        \"retainedHistory\" in head ? head.retainedHistory : (head.history ?? []),\n      currentState: head.state,\n      localCheckpoint,\n    });\n    pending.set(key, head);\n  }\n\n  return pending;\n}\n\nasync function writeAccessCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, PendingAccessCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  for (const { checkpoint } of pending.values()) {\n    await upsertAccessManifestCheckpointInTransaction(\n      tx,\n      checkpoint,\n      updatedAt,\n    );\n  }\n}\n\n/** Pins the heads `validatePrincipalPolicyCheckpointAdvances` returned. */\nexport async function writePrincipalPolicyCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, CheckpointPolicy>,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  for (const policy of pending.values()) {\n    await upsertPrincipalPolicyCheckpointInTransaction(\n      tx,\n      policy.checkpoint,\n      updatedAt,\n      organizationId,\n    );\n  }\n}\n\n/**\n * Digests the verified bundles and ensures every table the batch touches,\n * all before its transaction begins.\n */\nasync function prepareKeyingCheckpointBatch(\n  input: KeyingCheckpointValidationInput,\n): Promise<VerifiedManifestBundleRow[]> {\n  const bundleRows = await verifiedManifestBundleRows(\n    input.verifiedBundles ?? [],\n  );\n  await ensureSqlTables(input.execSql, [\n    ...(input.policies.length > 0 ||\n    (input.authorizationPolicies?.length ?? 0) > 0\n      ? principalPolicyTables\n      : []),\n    ...keyingCheckpointTables,\n    ...(bundleRows.length > 0 ? verifiedManifestBundleTables : []),\n  ]);\n  return bundleRows;\n}\n\n/**\n * Re-checks verified candidates against durable pins without advancing them.\n * Only the verified bundles' citation rows are written.\n */\nexport async function validateKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const verifiedAt = new Date().toISOString();\n  const validate = async (tx: ClientSQLiteTransactionScope) => {\n    await validateAccessAdvances(tx, input.access);\n    await validatePrincipalPolicyCheckpointAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, verifiedAt);\n  };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(validate, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(validate, { behavior: \"immediate\" });\n}\n\n/**\n * Re-check every verified projection candidate against the latest durable pins\n * and advance the complete batch atomically. Signature verification and remote\n * fetching happen before this short transaction; only checkpoint comparison\n * and persistence, with the batch's verified bundles, are serialized here.\n */\nexport async function advanceKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput & {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly organizationId?: string | undefined;\n  },\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const updatedAt = new Date().toISOString();\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const advance = async (tx: ClientSQLiteTransactionScope) => {\n    const access = await validateAccessAdvances(tx, input.access);\n    const policies = await validatePrincipalPolicyCheckpointAdvances(\n      tx,\n      input.policies,\n    );\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n\n    await writeAccessCheckpoints(tx, access, updatedAt);\n    await writePrincipalPolicyCheckpoints(\n      tx,\n      policies,\n      updatedAt,\n      input.organizationId,\n    );\n    if (input.documentPurgeCheckpoint) {\n      await storeDocumentPurgeCheckpointInTransaction(\n        tx,\n        input.documentPurgeCheckpoint,\n        updatedAt,\n      );\n    }\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, updatedAt);\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(advance, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(advance, { behavior: \"immediate\" });\n}\n"]}
+{"version":3,"file":"keyingCheckpointAdvancePersistence.js","sourceRoot":"","sources":["keyingCheckpointAdvancePersistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,EAIvB,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACpG,OAAO,EAGL,0BAA0B,EAC1B,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wCAAwC,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,oCAAoC,EACpC,kBAAkB,EAClB,4CAA4C,EAC5C,6CAA6C,GAC9C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AA8BhG,SAAS,qBAAqB,CAC5B,OAAwC,EACxC,eAAgD;IAEhD,MAAM,OAAO,GAAG;QACd,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU;QAC1B,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;KACjE,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAChE,CAAC;IAEF,IAAI,eAAe,IAAI,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9D,mCAAmC,CAAC;YAClC,OAAO;YACP,eAAe;YACf,sBAAsB,EAAE,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC,CAAC;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY;QACZ,eAAe;KAChB,CAAC,CAAC;IAEH,mCAAmC,CAAC;QAClC,OAAO;QACP,eAAe;QACf,sBAAsB,EAAE,YAAY,CAAC,MAAM,CACzC,CAAC,QAAQ,EAAE,EAAE,CACX,eAAe,KAAK,IAAI;YACxB,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;YACjD,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAC5C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,QAAoD;IAEpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1C,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAEjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4DAA4D,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,eAAe,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,SAA2B;IAE3B,MAAM,OAAO,GACX,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,OAAO,EAAE,IAAI,CACX,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACZ,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;QAC/C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC3C,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;QACnC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAC1C,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,EAAgC,EAChC,QAAqC;IAErC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,mDAAmD,GAAG,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,4DAA4D,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAChD,+BAA+B,CAAC;YAC9B,KAAK,EACH,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACzE,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAgC,EAChC,OAAqD,EACrD,SAAiB;IAEjB,MAAM,4CAA4C,CAChD,EAAE,EACF,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EACzD,SAAS,CACV,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,EAAgC,EAChC,OAA8C,EAC9C,SAAiB,EACjB,cAAmC;IAEnC,MAAM,6CAA6C,CACjD,EAAE,EACF,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EACxD,SAAS,EACT,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CACzC,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CACjD,KAAK,CAAC,eAAe,IAAI,EAAE,CAC5B,CAAC;IACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,KAAK,CAAC,qBAAqB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,sBAAsB;QACzB,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAsC;IAEtC,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QAC1D,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,yCAAyC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QACF,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE;YAC7D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAGC;IAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,EAAgC,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,yCAAyC,CAC9D,EAAE,EACF,KAAK,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;QAEF,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,+BAA+B,CACnC,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,yCAAyC,CAC7C,EAAE,EACF,KAAK,CAAC,uBAAuB,EAC7B,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,yCAAyC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE;YAC5D,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import {\n  type AccessManifestCheckpoint,\n  type AnyVerifiedPrincipalPolicy,\n  KeyingVerificationError,\n  type VerifiedAccessManifestCheckpointEvidence,\n  type VerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicySelection,\n  verifyAccessManifestLocalCheckpoint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport {\n  keyingCheckpointTables,\n  principalPolicyTables,\n} from \"../../sqlite/schema\";\nimport { verifiedManifestBundleTables } from \"../../sqlite/schema/verifiedManifestBundleSchema\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { loadContainerRetirementCheck } from \"../principalKeys/principalGrantRetirementPersistence\";\nimport {\n  type VerifiedManifestBundle,\n  type VerifiedManifestBundleRow,\n  verifiedManifestBundleRows,\n  writeVerifiedManifestBundlesInTransaction,\n} from \"../verifiedManifestBundlePersistence\";\nimport {\n  type DocumentPurgeCheckpoint,\n  storeDocumentPurgeCheckpointInTransaction,\n} from \"./documentPurgeCheckpointPersistence\";\nimport { validateAccessManifestCheckpointEvidence } from \"./keyingCheckpointEvidence\";\nimport {\n  accessManifestObjectKey,\n  loadAccessManifestCheckpointRows,\n  loadStoredPrincipalPolicyCheckpoints,\n  principalPolicyKey,\n  upsertAccessManifestCheckpointsInTransaction,\n  upsertPrincipalPolicyCheckpointsInTransaction,\n} from \"./keyingCheckpointPersistence\";\nimport { validatePrincipalAuthorizationCheckpoints } from \"./principalAuthorizationCheckpoints\";\n\nexport interface AccessManifestCheckpointAdvance {\n  readonly head: VerifiedAccessManifestCheckpointEvidence;\n  readonly predecessors: readonly VerifiedAccessManifestCheckpointEvidence[];\n}\n\ntype CheckpointPolicy =\n  | AnyVerifiedPrincipalPolicy\n  | VerifiedPrincipalPolicyCurrent;\n\ninterface KeyingCheckpointValidationInput {\n  readonly access: readonly AccessManifestCheckpointAdvance[];\n  readonly execSql: ExecSql;\n  readonly policies: readonly CheckpointPolicy[];\n  readonly authorizationPolicies?:\n    | readonly VerifiedPrincipalPolicySelection[]\n    | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  /**\n   * Bundles this projection verified. They are stored for later citation in\n   * the same transaction, so they commit only with the batch they verified.\n   */\n  readonly verifiedBundles?: readonly VerifiedManifestBundle[] | undefined;\n}\n\ninterface PendingAccessCheckpoint {\n  readonly checkpoint: AccessManifestCheckpoint;\n}\n\nfunction validateAccessAdvance(\n  advance: AccessManifestCheckpointAdvance,\n  localCheckpoint: AccessManifestCheckpoint | null,\n): PendingAccessCheckpoint {\n  const current = {\n    ...advance.head.checkpoint,\n    previousManifestHash: advance.head.manifest.previousManifestHash,\n  };\n  const predecessors = [...advance.predecessors].sort(\n    (left, right) => left.checkpoint.epoch - right.checkpoint.epoch,\n  );\n\n  if (localCheckpoint && current.epoch <= localCheckpoint.epoch) {\n    verifyAccessManifestLocalCheckpoint({\n      current,\n      localCheckpoint,\n      checkpointPredecessors: undefined,\n    });\n  }\n\n  validateAccessManifestCheckpointEvidence({\n    head: advance.head,\n    predecessors,\n    localCheckpoint,\n  });\n\n  verifyAccessManifestLocalCheckpoint({\n    current,\n    localCheckpoint,\n    checkpointPredecessors: predecessors.filter(\n      (manifest) =>\n        localCheckpoint !== null &&\n        manifest.checkpoint.epoch > localCheckpoint.epoch &&\n        manifest.checkpoint.epoch < current.epoch,\n    ),\n  });\n\n  return {\n    checkpoint: advance.head.checkpoint,\n  };\n}\n\nasync function validateAccessAdvances(\n  tx: ClientSQLiteTransactionScope,\n  advances: readonly AccessManifestCheckpointAdvance[],\n): Promise<Map<string, PendingAccessCheckpoint>> {\n  const pending = new Map<string, PendingAccessCheckpoint>();\n  if (advances.length === 0) return pending;\n  // Set reads first; the checks then replay in order, so the same advance\n  // fails first with the same error.\n  const heads = advances.map((advance) => advance.head.checkpoint);\n  const assertNotRetired = await loadContainerRetirementCheck(tx, heads);\n  const stored = await loadAccessManifestCheckpointRows(tx, heads);\n\n  for (const advance of advances) {\n    assertNotRetired(advance.head.checkpoint);\n    const key = accessManifestObjectKey(advance.head.checkpoint);\n    if (pending.has(key)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `projection declares multiple access checkpoint heads for ${key}`,\n      );\n    }\n    const row = stored.get(key);\n    const localCheckpoint = row ? { ...advance.head.checkpoint, ...row } : null;\n    pending.set(key, validateAccessAdvance(advance, localCheckpoint));\n  }\n\n  return pending;\n}\n\nfunction extendsObservedPolicy(\n  head: CheckpointPolicy,\n  candidate: CheckpointPolicy,\n): boolean {\n  const history =\n    \"retainedHistory\" in head ? head.retainedHistory : head.history;\n  return (\n    history?.some(\n      ({ state }) =>\n        state.principalType === candidate.principalType &&\n        state.principalId === candidate.principalId &&\n        state.version === candidate.version &&\n        state.stateHash === candidate.stateHash,\n    ) ?? false\n  );\n}\n\n/**\n * Checks, inside the caller's transaction, that each principal's newest policy\n * extends every other candidate and its durable checkpoint. Returns the heads\n * to pin, keyed by principal.\n */\nexport async function validatePrincipalPolicyCheckpointAdvances(\n  tx: ClientSQLiteTransactionScope,\n  policies: readonly CheckpointPolicy[],\n): Promise<Map<string, CheckpointPolicy>> {\n  const policiesByPrincipal = new Map<string, CheckpointPolicy[]>();\n  for (const policy of policies) {\n    const key = principalPolicyKey(policy);\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    candidates.push(policy);\n    policiesByPrincipal.set(key, candidates);\n  }\n\n  const pending = new Map<string, CheckpointPolicy>();\n  const stored = await loadStoredPrincipalPolicyCheckpoints(tx, policies);\n  for (const key of [...policiesByPrincipal.keys()].sort()) {\n    const candidates = policiesByPrincipal.get(key) ?? [];\n    const maxVersion = Math.max(...candidates.map((policy) => policy.version));\n    const heads = candidates.filter((policy) => policy.version === maxVersion);\n    const head = heads[0];\n    if (!head) {\n      continue;\n    }\n    if (heads.some((candidate) => candidate.stateHash !== head.stateHash)) {\n      throw new KeyingVerificationError(\n        \"equivocation\",\n        `principal policy declares conflicting heads for ${key}`,\n      );\n    }\n    for (const candidate of candidates) {\n      if (candidate.version === head.version) {\n        continue;\n      }\n      if (!extendsObservedPolicy(head, candidate)) {\n        throw new KeyingVerificationError(\n          \"stale_predecessor\",\n          `principal policy head does not extend observed state for ${key}`,\n        );\n      }\n    }\n\n    const localCheckpoint = stored.get(key) ?? null;\n    verifyPrincipalPolicyCheckpoint({\n      chain:\n        \"retainedHistory\" in head ? head.retainedHistory : (head.history ?? []),\n      currentState: head.state,\n      localCheckpoint,\n    });\n    pending.set(key, head);\n  }\n\n  return pending;\n}\n\nasync function writeAccessCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, PendingAccessCheckpoint>,\n  updatedAt: string,\n): Promise<void> {\n  await upsertAccessManifestCheckpointsInTransaction(\n    tx,\n    [...pending.values()].map(({ checkpoint }) => checkpoint),\n    updatedAt,\n  );\n}\n\n/** Pins the heads `validatePrincipalPolicyCheckpointAdvances` returned. */\nexport async function writePrincipalPolicyCheckpoints(\n  tx: ClientSQLiteTransactionScope,\n  pending: ReadonlyMap<string, CheckpointPolicy>,\n  updatedAt: string,\n  organizationId?: string | undefined,\n): Promise<void> {\n  await upsertPrincipalPolicyCheckpointsInTransaction(\n    tx,\n    [...pending.values()].map((policy) => policy.checkpoint),\n    updatedAt,\n    organizationId,\n  );\n}\n\n/**\n * Digests the verified bundles and ensures every table the batch touches,\n * all before its transaction begins.\n */\nasync function prepareKeyingCheckpointBatch(\n  input: KeyingCheckpointValidationInput,\n): Promise<VerifiedManifestBundleRow[]> {\n  const bundleRows = await verifiedManifestBundleRows(\n    input.verifiedBundles ?? [],\n  );\n  await ensureSqlTables(input.execSql, [\n    ...(input.policies.length > 0 ||\n    (input.authorizationPolicies?.length ?? 0) > 0\n      ? principalPolicyTables\n      : []),\n    ...keyingCheckpointTables,\n    ...(bundleRows.length > 0 ? verifiedManifestBundleTables : []),\n  ]);\n  return bundleRows;\n}\n\n/**\n * Re-checks verified candidates against durable pins without advancing them.\n * Only the verified bundles' citation rows are written.\n */\nexport async function validateKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput,\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const verifiedAt = new Date().toISOString();\n  const validate = async (tx: ClientSQLiteTransactionScope) => {\n    await validateAccessAdvances(tx, input.access);\n    await validatePrincipalPolicyCheckpointAdvances(tx, input.policies);\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, verifiedAt);\n  };\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(validate, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(validate, { behavior: \"immediate\" });\n}\n\n/**\n * Re-check every verified projection candidate against the latest durable pins\n * and advance the complete batch atomically. Signature verification and remote\n * fetching happen before this short transaction; only checkpoint comparison\n * and persistence, with the batch's verified bundles, are serialized here.\n */\nexport async function advanceKeyingCheckpointsAtomically(\n  input: KeyingCheckpointValidationInput & {\n    readonly documentPurgeCheckpoint?: DocumentPurgeCheckpoint | undefined;\n    readonly organizationId?: string | undefined;\n  },\n): Promise<void> {\n  const bundleRows = await prepareKeyingCheckpointBatch(input);\n  const updatedAt = new Date().toISOString();\n\n  const runtime = getClientSQLitePersistenceRuntime(input.execSql);\n  const advance = async (tx: ClientSQLiteTransactionScope) => {\n    const access = await validateAccessAdvances(tx, input.access);\n    const policies = await validatePrincipalPolicyCheckpointAdvances(\n      tx,\n      input.policies,\n    );\n    await validatePrincipalAuthorizationCheckpoints(\n      tx,\n      input.authorizationPolicies ?? [],\n    );\n\n    await writeAccessCheckpoints(tx, access, updatedAt);\n    await writePrincipalPolicyCheckpoints(\n      tx,\n      policies,\n      updatedAt,\n      input.organizationId,\n    );\n    if (input.documentPurgeCheckpoint) {\n      await storeDocumentPurgeCheckpointInTransaction(\n        tx,\n        input.documentPurgeCheckpoint,\n        updatedAt,\n      );\n    }\n    await writeVerifiedManifestBundlesInTransaction(tx, bundleRows, updatedAt);\n  };\n  if (input.stillCurrent) {\n    await runtime.guardedTransaction(advance, input.stillCurrent, {\n      behavior: \"immediate\",\n    });\n    return;\n  }\n  await runtime.transaction(advance, { behavior: \"immediate\" });\n}\n"]}