npm - @tearleads/client-sdk - Versions diffs - 0.1.15 → 0.1.17 - Mend

@tearleads/client-sdk 0.1.15 → 0.1.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (244) hide show

package/client/organizations/organizationGroupNameHydration.js CHANGED Viewed

@@ -1,10 +1,17 @@
 import { loadLocalOrganizationPolicyReference } from "../../workflows/organizations/index.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../workflows/organizations/currentGroupMetadataAuthority.js";
 import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
 import { hydrateOrganizationGroupNames } from "../../workflows/organizations/organizationGroupNames.js";
+import { createRuntimePrincipalPolicyCurrentResolver } from "../../workflows/principals/runtimePolicyRecovery.js";
 import { isOrganizationDataRuntimeCurrent, } from "./organizationWorkflowRuntime.js";
 export async function hydrateOrganizationGroupNamesForRuntime(runtimeService, active, domainScope, directoryAndGroups) {
     if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {
         const stillCurrent = () => isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);
+        // Labels and their metadata root belong to this one reconciliation view.
+        const currentRecovery = {
+            resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(active.runtime),
+            recoveryBatch: {},
+        };
         return hydrateOrganizationGroupNames({
             apiClient: active.runtime.apiClient,
             directory: directoryAndGroups,
@@ -18,8 +25,14 @@ export async function hydrateOrganizationGroupNamesForRuntime(runtimeService, ac
                 principalType: "organization",
             }),
             reportSecurityIncident: active.runtime.util.reportSecurityIncident,
-            readEncryptedName: createRuntimeGroupMetadataAccess(active.runtime, active.organizationId, stillCurrent).readName,
+            createCurrentNameReader: (authority) => createRuntimeGroupMetadataAccess(active.runtime, active.organizationId, stillCurrent, createSelectedCurrentGroupMetadataContainerVerifier({
+                authority,
+                organizationId: active.organizationId,
+                stillCurrent,
+            })).readName,
+            readEncryptedName: createRuntimeGroupMetadataAccess(active.runtime, active.organizationId, stillCurrent, undefined, currentRecovery).readName,
             resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,
+            ...currentRecovery,
             stillCurrent,
         });
     }

package/client/organizations/organizationGroupNameHydration.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;~~AAGrG~~,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,~~CACb~~,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n runtimeService: InternalRuntime,\n active: ActiveOrganizationDataRuntime,\n domainScope: DomainScope,\n directoryAndGroups: OrganizationDirectoryAndGroups \| null \| undefined,\n) {\n if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n return hydrateOrganizationGroupNames({\n apiClient: active.runtime.apiClient,\n directory: directoryAndGroups,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: active.organizationId,\n principalType: \"organization\",\n }),\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n readEncryptedName: createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n ).readName,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n stillCurrent,\n });\n }\n return directoryAndGroups;\n}\n"]}
1	+ {"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n runtimeService: InternalRuntime,\n active: ActiveOrganizationDataRuntime,\n domainScope: DomainScope,\n directoryAndGroups: OrganizationDirectoryAndGroups \| null \| undefined,\n) {\n if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n // Labels and their metadata root belong to this one reconciliation view.\n const currentRecovery = {\n resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n active.runtime,\n ),\n recoveryBatch: {},\n };\n return hydrateOrganizationGroupNames({\n apiClient: active.runtime.apiClient,\n directory: directoryAndGroups,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: active.organizationId,\n principalType: \"organization\",\n }),\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n createCurrentNameReader: (authority) =>\n createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n createSelectedCurrentGroupMetadataContainerVerifier({\n authority,\n organizationId: active.organizationId,\n stillCurrent,\n }),\n ).readName,\n readEncryptedName: createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n undefined,\n currentRecovery,\n ).readName,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n ...currentRecovery,\n stillCurrent,\n });\n }\n return directoryAndGroups;\n}\n"]}

package/client/organizations/organizationGroupPresentation.d.ts CHANGED Viewed

@@ -2,6 +2,7 @@ import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
 import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";
 export declare function loadOrganizationGroupPresentationDetails(input: {
     readonly groupId: string;
+    readonly beforeVersion?: number | undefined;
     readonly readModelCoordinator: OrganizationReadModelCoordinator;
     readonly runtime: InternalWorkflowRuntimeInput;
 }): Promise<{

package/client/organizations/organizationGroupPresentation.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
 export async function loadOrganizationGroupPresentationDetails(input) {
     const organizationId = input.runtime.auth.organizationId;
     if (!input.runtime.auth.isAuthenticated ||
@@ -9,8 +10,21 @@ export async function loadOrganizationGroupPresentationDetails(input) {
         };
     }
     const [members, policyHistory] = await Promise.all([
-        input.readModelCoordinator.loadLocalGroupMembers(input.groupId, organizationId),
-        input.readModelCoordinator.loadGroupPolicyHistory(input.groupId, organizationId),
+        input.beforeVersion === undefined
+            ? input.readModelCoordinator.loadLocalGroupMembers(input.groupId, organizationId)
+            : Promise.resolve(null),
+        input.readModelCoordinator
+            .loadGroupPolicyHistory(input.groupId, organizationId, input.beforeVersion)
+            .catch((error) => {
+            // Missing history must not hide the independent member projection.
+            // Older-page failures remain explicit so the caller can retry them.
+            if (input.beforeVersion === undefined &&
+                error instanceof ProjectionDependencyUnavailableError) {
+                input.runtime.util.logError("Group history is unavailable", error);
+                return null;
+            }
+            throw error;
+        }),
     ]);
     return { members, policyHistory };
 }

package/client/organizations/organizationGroupPresentation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationGroupPresentation.js","sourceRoot":"","sources":["organizationGroupPresentation.ts"],"names":[],"mappings":"~~AAGA~~,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,~~KAI9D~~;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,cAAc;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CACf;~~QACD~~,KAAK,CAAC,oBAAoB,~~CAAC,~~sBAAsB,~~CAC/C~~,KAAK,CAAC,OAAO,EACb,cAAc,~~CACf~~;~~KACF~~,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport async function loadOrganizationGroupPresentationDetails(input: {\n readonly groupId: string;\n readonly readModelCoordinator: OrganizationReadModelCoordinator;\n readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n const organizationId = input.runtime.auth.organizationId;\n if (\n !input.runtime.auth.isAuthenticated \|\|\n !organizationId \|\|\n input.groupId.length === 0\n ) {\n return {\n members: null,\n policyHistory: null,\n };\n }\n\n const [members, policyHistory] = await Promise.all([\n input.readModelCoordinator.loadLocalGroupMembers(\n input.groupId,\n organizationId,\n ),\n input.readModelCoordinator.loadGroupPolicyHistory(\n input.groupId,\n organizationId,\n ),\n ]);\n return { members, policyHistory };\n}\n"]}
1	+ {"version":3,"file":"organizationGroupPresentation.js","sourceRoot":"","sources":["organizationGroupPresentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AAIrH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAK9D;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,cAAc;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CACf;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,KAAK,CAAC,oBAAoB;aACvB,sBAAsB,CACrB,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,aAAa,CACpB;aACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,mEAAmE;YACnE,oEAAoE;YACpE,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;gBACjC,KAAK,YAAY,oCAAoC,EACrD,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;KACL,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport async function loadOrganizationGroupPresentationDetails(input: {\n readonly groupId: string;\n readonly beforeVersion?: number \| undefined;\n readonly readModelCoordinator: OrganizationReadModelCoordinator;\n readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n const organizationId = input.runtime.auth.organizationId;\n if (\n !input.runtime.auth.isAuthenticated \|\|\n !organizationId \|\|\n input.groupId.length === 0\n ) {\n return {\n members: null,\n policyHistory: null,\n };\n }\n\n const [members, policyHistory] = await Promise.all([\n input.beforeVersion === undefined\n ? input.readModelCoordinator.loadLocalGroupMembers(\n input.groupId,\n organizationId,\n )\n : Promise.resolve(null),\n input.readModelCoordinator\n .loadGroupPolicyHistory(\n input.groupId,\n organizationId,\n input.beforeVersion,\n )\n .catch((error: unknown) => {\n // Missing history must not hide the independent member projection.\n // Older-page failures remain explicit so the caller can retry them.\n if (\n input.beforeVersion === undefined &&\n error instanceof ProjectionDependencyUnavailableError\n ) {\n input.runtime.util.logError(\"Group history is unavailable\", error);\n return null;\n }\n throw error;\n }),\n ]);\n return { members, policyHistory };\n}\n"]}

package/client/organizations/organizationReadModels.d.ts CHANGED Viewed

@@ -3,7 +3,7 @@ import type { InternalRuntime } from "../workflowRuntime.js";
 export interface OrganizationReadModelCoordinator {
     loadLocal(organizationId?: string | undefined): Promise<OrganizationDirectoryAndGroups | null>;
     loadLocalGroupMembers(groupId: string, organizationId?: string | undefined): Promise<OrganizationGroupMembers | null>;
-    loadGroupPolicyHistory(groupId: string, organizationId?: string | undefined): Promise<OrganizationGroupPolicyHistory | null>;
+    loadGroupPolicyHistory(groupId: string, organizationId?: string | undefined, beforeVersion?: number | undefined): Promise<OrganizationGroupPolicyHistory | null>;
     loadOrganizationPolicyHistory(organizationId?: string | undefined): Promise<OrganizationPolicyHistory | null>;
     loadLocalGrants(organizationId?: string | undefined): Promise<OrganizationContainerGrants | null>;
     loadLocalGroupContainers(groupId: string, organizationId?: string | undefined): Promise<OrganizationGroupContainers | null>;

package/client/organizations/organizationReadModels.js CHANGED Viewed

@@ -3,6 +3,7 @@ import { loadPolicyHistoryDetails } from "../../workflows/organizations/loadPoli
 import { organizationAccessScopeKey, wasOrganizationPresentationAccessDeniedByServer, } from "../../workflows/organizations/organizationPresentationAccessState.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
 import { recoverOrganizationAccess } from "./organizationAccessRestoration.js";
+import { loadBoundedOrganizationGroupHistory } from "./organizationGroupHistory.js";
 import { hydrateOrganizationGroupNamesForRuntime } from "./organizationGroupNameHydration.js";
 import { activeOrganizationDataRuntime, isOrganizationDataRuntimeCurrent, } from "./organizationWorkflowRuntime.js";
 const coordinatorsByRuntime = new WeakMap();
@@ -137,11 +138,20 @@ class OrganizationReadModelCoordinatorImpl {
             organizationId: active.organizationId,
         });
     }
-    async loadGroupPolicyHistory(groupId, organizationId) {
+    async loadGroupPolicyHistory(groupId, organizationId, beforeVersion) {
         const active = activeOrganizationDataRuntime(this.runtimeService, organizationId);
         if (!active || groupId.length === 0) {
             return null;
         }
+        const domainScope = active.runtime.state.domainScope;
+        const bounded = await loadBoundedOrganizationGroupHistory({
+            active,
+            groupId,
+            beforeVersion,
+            stillCurrent: () => isOrganizationDataRuntimeCurrent(this.runtimeService, active, domainScope),
+        });
+        if (bounded !== undefined)
+            return bounded;
         return this.loadPolicyHistoryAfterWarm({
             active,
             loadLocal: () => loadLocalOrganizationGroupPolicyHistory({

package/client/organizations/organizationReadModels.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAClG,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA4CJ,MAAM,oCAAoC;IAYX;IATZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACa,oBAAoB,GAAG,IAAI,OAAO,EAGhD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CAAC,MAAqC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,MAAqC,EACrC,SAEC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACrH,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,kCAAkC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjE,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC/B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,0BAA0B,CAAU,KAKjD;QACC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,qDAAqD,EACrD,KAAK,CACN,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAEH,CAAC;QACF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,oCAAoC,CAAC;gBACrD,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;gBAClC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC3C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,oDAAoD,EACpD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,uDAAuD,EACvD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,OAAe,EAAE,cAAuB;QACnE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,0BAA0B,CAAC;YACrC,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,CACd,uCAAuC,CAAC;gBACtC,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,OAAO;gBACP,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;YACJ,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,cAAuB;QACzD,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC;YACpD,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,CACd,kCAAkC,CAAC;gBACjC,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;YACJ,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,wBAAwB,CAAC;YAC9B,WAAW;YACX,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO;YACP,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;YACH,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupMembers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n type OrganizationContainerGrants,\n type OrganizationDirectoryAndGroups,\n type OrganizationGroupContainers,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationPolicyHistory,\n type OrganizationUserDetail,\n reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport { loadPolicyHistoryDetails } from \"../../workflows/organizations/loadPolicyHistoryDetails\";\nimport {\n organizationAccessScopeKey,\n wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null>;\n loadLocalGroupMembers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupMembers \| null>;\n loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupPolicyHistory \| null>;\n loadOrganizationPolicyHistory(\n organizationId?: string \| undefined,\n ): Promise<OrganizationPolicyHistory \| null>;\n loadLocalGrants(\n organizationId?: string \| undefined,\n ): Promise<OrganizationContainerGrants \| null>;\n loadLocalGroupContainers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupContainers \| null>;\n loadLocalUserDetail(\n userId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationUserDetail \| null>;\n /*\n Resolves `undefined` when the runtime declines without I/O (offline,\n * database not ready, organization mismatch) or when the feed failed with\n * no locally retained projection — passes that must not count as caught\n * up; `null` when the reconcile completed but produced nothing presentable\n * — including an authoritative denial that purged the projection, which\n * consumers must repaint.\n */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n reconcileAfterMutation(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n implements OrganizationReadModelCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDirectoryAndGroups \| null \| undefined>>\n >();\n private readonly policyWarmersByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<void>>\n >();\n\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n private policyWarmerMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.policyWarmersByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.policyWarmersByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n private async warmPolicyReference(\n active: ActiveOrganizationDataRuntime,\n reference: NonNullable<\n Awaited<ReturnType<typeof loadLocalOrganizationPolicyReference>>\n >,\n ): Promise<void> {\n if (!active.runtime.state.online) {\n return;\n }\n const byKey = this.policyWarmerMap(active);\n const key = `${active.organizationId}\\0${reference.principalType}\\0${reference.principalId}\\0${reference.stateHash}`;\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n const warming = createRuntimePrincipalPolicyWarmer(active.runtime)({\n organizationId: active.organizationId,\n references: [reference],\n }).finally(() => {\n if (byKey.get(key) === warming) {\n byKey.delete(key);\n }\n });\n byKey.set(key, warming);\n return warming;\n }\n\n private async loadPolicyHistoryAfterWarm<History>(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly loadLocal: () => Promise<History \| null>;\n readonly principalId: string;\n readonly principalType: \"group\" \| \"organization\";\n }): Promise<History \| null> {\n try {\n const local = await input.loadLocal();\n if (local) {\n return local;\n }\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to load verified organization policy history\",\n error,\n );\n }\n if (!input.active.runtime.state.online) {\n return null;\n }\n\n let reference: Awaited<\n ReturnType<typeof loadLocalOrganizationPolicyReference>\n >;\n try {\n reference = await loadLocalOrganizationPolicyReference({\n currentUserId: input.active.userId,\n execSql: input.active.runtime.infra.execSql,\n organizationId: input.active.organizationId,\n principalId: input.principalId,\n principalType: input.principalType,\n });\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to load organization policy-head projection\",\n error,\n );\n return null;\n }\n if (!reference) {\n return null;\n }\n\n await this.warmPolicyReference(input.active, reference);\n try {\n return await input.loadLocal();\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to reload verified organization policy history\",\n error,\n );\n return null;\n }\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationDirectoryAndGroups({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGrants(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationContainerGrants({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupContainers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupMembers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadGroupPolicyHistory(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return this.loadPolicyHistoryAfterWarm({\n active,\n loadLocal: () =>\n loadLocalOrganizationGroupPolicyHistory({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n }),\n principalId: groupId,\n principalType: \"group\",\n });\n }\n\n async loadOrganizationPolicyHistory(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n const history = await this.loadPolicyHistoryAfterWarm({\n active,\n loadLocal: () =>\n loadLocalOrganizationPolicyHistory({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n }),\n principalId: active.organizationId,\n principalType: \"organization\",\n });\n if (!history \|\| !active.runtime.state.online) return history;\n const domainScope = active.runtime.state.domainScope;\n return loadPolicyHistoryDetails({\n domainScope,\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n history,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n logError: active.runtime.util.logError,\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n });\n }\n\n async loadLocalUserDetail(userId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| userId.length === 0) {\n return null;\n }\n return loadLocalOrganizationUserDetail({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n userId,\n });\n }\n\n reconcile(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return Promise.resolve(undefined);\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n // Snapshot the server-denied flag before reconciling. A reconcile that\n // flips it back to readable means org access was just restored (e.g. the\n // user was re-added to a group), and any write lanes idled by\n // permission-denied submissions have no self re-arm — regaining access is\n // their retry signal, mirroring how billing recovery re-requests all\n // lanes. Only a genuine server denial counts: a local session reset also\n // marks scopes denied, and re-arming on its first reconcile would race the\n // startup sync passes (e.g. pending-create adoption between panes).\n const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n {\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n },\n \"readModel\",\n );\n const domainScope = active.runtime.state.domainScope;\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n );\n\n const reconciliation = reconcileOrganizationDirectoryAndGroups({\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n })\n .then(async (directoryAndGroups) => {\n if (!stillCurrent()) return null;\n // Feed success restores retry eligibility even if name decryption fails.\n const accessWasRestored =\n accessWasDenied &&\n directoryAndGroups !== null &&\n directoryAndGroups !== undefined;\n if (accessWasRestored)\n await recoverOrganizationAccess({\n active,\n domainScope,\n stillCurrent,\n });\n if (!stillCurrent()) return null;\n return hydrateOrganizationGroupNamesForRuntime(\n this.runtimeService,\n active,\n domainScope,\n directoryAndGroups,\n );\n })\n .finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n\n async reconcileAfterMutation(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return undefined;\n }\n const existing = this.reconciliationMap(active).get(\n organizationAccessScopeKey(active.organizationId, active.userId),\n );\n if (existing) {\n await existing.catch(() => null);\n }\n return this.reconcile(active.organizationId);\n }\n}\n\nexport function createOrganizationReadModelCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}
1	+ {"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAClG,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA6CJ,MAAM,oCAAoC;IAYX;IATZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACa,oBAAoB,GAAG,IAAI,OAAO,EAGhD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CAAC,MAAqC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,MAAqC,EACrC,SAEC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACrH,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,kCAAkC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjE,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC/B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,0BAA0B,CAAU,KAKjD;QACC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,qDAAqD,EACrD,KAAK,CACN,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAEH,CAAC;QACF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,oCAAoC,CAAC;gBACrD,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;gBAClC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC3C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,oDAAoD,EACpD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,uDAAuD,EACvD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;YACxD,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC1C,OAAO,IAAI,CAAC,0BAA0B,CAAC;YACrC,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,CACd,uCAAuC,CAAC;gBACtC,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,OAAO;gBACP,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;YACJ,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,cAAuB;QACzD,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC;YACpD,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,CACd,kCAAkC,CAAC;gBACjC,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;YACJ,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,wBAAwB,CAAC;YAC9B,WAAW;YACX,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO;YACP,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;YACH,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupMembers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n type OrganizationContainerGrants,\n type OrganizationDirectoryAndGroups,\n type OrganizationGroupContainers,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationPolicyHistory,\n type OrganizationUserDetail,\n reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport { loadPolicyHistoryDetails } from \"../../workflows/organizations/loadPolicyHistoryDetails\";\nimport {\n organizationAccessScopeKey,\n wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null>;\n loadLocalGroupMembers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupMembers \| null>;\n loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationGroupPolicyHistory \| null>;\n loadOrganizationPolicyHistory(\n organizationId?: string \| undefined,\n ): Promise<OrganizationPolicyHistory \| null>;\n loadLocalGrants(\n organizationId?: string \| undefined,\n ): Promise<OrganizationContainerGrants \| null>;\n loadLocalGroupContainers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupContainers \| null>;\n loadLocalUserDetail(\n userId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationUserDetail \| null>;\n /*\n Resolves `undefined` when the runtime declines without I/O (offline,\n * database not ready, organization mismatch) or when the feed failed with\n * no locally retained projection — passes that must not count as caught\n * up; `null` when the reconcile completed but produced nothing presentable\n * — including an authoritative denial that purged the projection, which\n * consumers must repaint.\n */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n reconcileAfterMutation(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n implements OrganizationReadModelCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDirectoryAndGroups \| null \| undefined>>\n >();\n private readonly policyWarmersByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<void>>\n >();\n\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n private policyWarmerMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.policyWarmersByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.policyWarmersByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n private async warmPolicyReference(\n active: ActiveOrganizationDataRuntime,\n reference: NonNullable<\n Awaited<ReturnType<typeof loadLocalOrganizationPolicyReference>>\n >,\n ): Promise<void> {\n if (!active.runtime.state.online) {\n return;\n }\n const byKey = this.policyWarmerMap(active);\n const key = `${active.organizationId}\\0${reference.principalType}\\0${reference.principalId}\\0${reference.stateHash}`;\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n const warming = createRuntimePrincipalPolicyWarmer(active.runtime)({\n organizationId: active.organizationId,\n references: [reference],\n }).finally(() => {\n if (byKey.get(key) === warming) {\n byKey.delete(key);\n }\n });\n byKey.set(key, warming);\n return warming;\n }\n\n private async loadPolicyHistoryAfterWarm<History>(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly loadLocal: () => Promise<History \| null>;\n readonly principalId: string;\n readonly principalType: \"group\" \| \"organization\";\n }): Promise<History \| null> {\n try {\n const local = await input.loadLocal();\n if (local) {\n return local;\n }\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to load verified organization policy history\",\n error,\n );\n }\n if (!input.active.runtime.state.online) {\n return null;\n }\n\n let reference: Awaited<\n ReturnType<typeof loadLocalOrganizationPolicyReference>\n >;\n try {\n reference = await loadLocalOrganizationPolicyReference({\n currentUserId: input.active.userId,\n execSql: input.active.runtime.infra.execSql,\n organizationId: input.active.organizationId,\n principalId: input.principalId,\n principalType: input.principalType,\n });\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to load organization policy-head projection\",\n error,\n );\n return null;\n }\n if (!reference) {\n return null;\n }\n\n await this.warmPolicyReference(input.active, reference);\n try {\n return await input.loadLocal();\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to reload verified organization policy history\",\n error,\n );\n return null;\n }\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationDirectoryAndGroups({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGrants(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationContainerGrants({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupContainers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupMembers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n const domainScope = active.runtime.state.domainScope;\n const bounded = await loadBoundedOrganizationGroupHistory({\n active,\n groupId,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n if (bounded !== undefined) return bounded;\n return this.loadPolicyHistoryAfterWarm({\n active,\n loadLocal: () =>\n loadLocalOrganizationGroupPolicyHistory({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n }),\n principalId: groupId,\n principalType: \"group\",\n });\n }\n\n async loadOrganizationPolicyHistory(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n const history = await this.loadPolicyHistoryAfterWarm({\n active,\n loadLocal: () =>\n loadLocalOrganizationPolicyHistory({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n }),\n principalId: active.organizationId,\n principalType: \"organization\",\n });\n if (!history \|\| !active.runtime.state.online) return history;\n const domainScope = active.runtime.state.domainScope;\n return loadPolicyHistoryDetails({\n domainScope,\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n history,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n logError: active.runtime.util.logError,\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n });\n }\n\n async loadLocalUserDetail(userId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| userId.length === 0) {\n return null;\n }\n return loadLocalOrganizationUserDetail({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n userId,\n });\n }\n\n reconcile(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return Promise.resolve(undefined);\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n // Snapshot the server-denied flag before reconciling. A reconcile that\n // flips it back to readable means org access was just restored (e.g. the\n // user was re-added to a group), and any write lanes idled by\n // permission-denied submissions have no self re-arm — regaining access is\n // their retry signal, mirroring how billing recovery re-requests all\n // lanes. Only a genuine server denial counts: a local session reset also\n // marks scopes denied, and re-arming on its first reconcile would race the\n // startup sync passes (e.g. pending-create adoption between panes).\n const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n {\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n },\n \"readModel\",\n );\n const domainScope = active.runtime.state.domainScope;\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n );\n\n const reconciliation = reconcileOrganizationDirectoryAndGroups({\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n })\n .then(async (directoryAndGroups) => {\n if (!stillCurrent()) return null;\n // Feed success restores retry eligibility even if name decryption fails.\n const accessWasRestored =\n accessWasDenied &&\n directoryAndGroups !== null &&\n directoryAndGroups !== undefined;\n if (accessWasRestored)\n await recoverOrganizationAccess({\n active,\n domainScope,\n stillCurrent,\n });\n if (!stillCurrent()) return null;\n return hydrateOrganizationGroupNamesForRuntime(\n this.runtimeService,\n active,\n domainScope,\n directoryAndGroups,\n );\n })\n .finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n\n async reconcileAfterMutation(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return undefined;\n }\n const existing = this.reconciliationMap(active).get(\n organizationAccessScopeKey(active.organizationId, active.userId),\n );\n if (existing) {\n await existing.catch(() => null);\n }\n return this.reconcile(active.organizationId);\n }\n}\n\nexport function createOrganizationReadModelCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}

package/client/organizations/organizationsTypes.d.ts ADDED Viewed

@@ -0,0 +1,50 @@
+import type { NativeSubscriptionStore } from "../../internal/validators/billing.js";
+import type { PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
+import type { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, revokeOrganizationContainerGrant, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
+import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
+import type { OrganizationDataUsageCoordinator } from "./organizationDataUsage.js";
+import type { loadOrganizationGroupPresentationDetails } from "./organizationGroupPresentation.js";
+import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";
+import type { AbandonOrganizationPolicyMutationInput, DiscardUnreadableOrganizationPolicyMutationInput, readPendingOrganizationPolicyMutation } from "./principalMutationRecovery.js";
+import type { AddOrganizationGroupUserInput, deleteGroupForOrganization, OrganizationGrantRef, RemoveOrganizationGroupUserInput } from "./principalMutations.js";
+/** Exact current artifacts and container receipts; no historical prefix. */
+export type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;
+export interface Organizations {
+    discardUnreadablePolicyMutation: (input: DiscardUnreadableOrganizationPolicyMutationInput) => Promise<boolean>;
+    readPendingPolicyMutation: (organizationId: string) => ReturnType<typeof readPendingOrganizationPolicyMutation>;
+    retryPendingPolicyMutation: (organizationId: string) => Promise<void>;
+    abandonPendingPolicyMutation: (input: AbandonOrganizationPolicyMutationInput) => Promise<boolean>;
+    addUserToGroup: (input: AddOrganizationGroupUserInput) => Promise<OrganizationGroupMutationReceipt>;
+    createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;
+    deleteGroup: (groupId: string) => ReturnType<typeof deleteGroupForOrganization>;
+    importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;
+    loadBilling: () => ReturnType<typeof loadOrganizationBilling>;
+    /** Billing for an organization the session is not currently switched to. */
+    loadBillingForOrganization: (organizationId: string) => ReturnType<typeof loadOrganizationBilling>;
+    loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;
+    loadBillingManagementUrl: () => ReturnType<typeof loadOrganizationBillingManagementUrl>;
+    /** Direct Stripe checkout (issue #1654): options, start, and cancel. */
+    loadStripeCheckoutOptions: (organizationId?: string) => ReturnType<typeof loadStripeCheckoutOptions>;
+    createStripeCheckout: (organizationId?: string) => ReturnType<typeof createStripeCheckout>;
+    createStripeCheckoutSession: (returnUrl: string, organizationId?: string) => ReturnType<typeof createStripeCheckoutSession>;
+    cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;
+    claimNativeSubscription: (organizationId: string, store: NativeSubscriptionStore) => ReturnType<typeof claimNativeOrganizationSubscription>;
+    checkNativePurchaseEligibility: (organizationId: string, store: NativeSubscriptionStore) => ReturnType<typeof checkNativePurchaseEligibility>;
+    loadDataUsage: () => ReturnType<OrganizationDataUsageCoordinator["reconcile"]>;
+    loadLocalDataUsage: () => ReturnType<OrganizationDataUsageCoordinator["loadLocal"]>;
+    loadDirectoryAndGroups: () => ReturnType<OrganizationReadModelCoordinator["reconcile"]>;
+    loadDirectoryAndGroupsAfterMutation: () => ReturnType<OrganizationReadModelCoordinator["reconcileAfterMutation"]>;
+    loadLocalDirectoryAndGroups: () => ReturnType<OrganizationReadModelCoordinator["loadLocal"]>;
+    loadGroupMembers: (groupId: string) => ReturnType<InternalWorkflowRuntimeInput["apiClient"]["listOrganizationGroupMembers"]>;
+    loadGroupPresentationDetails(groupId: string, beforeVersion?: number): ReturnType<typeof loadOrganizationGroupPresentationDetails>;
+    loadGroupContainers: (groupId: string) => ReturnType<OrganizationReadModelCoordinator["loadLocalGroupContainers"]>;
+    loadGrants: () => ReturnType<OrganizationReadModelCoordinator["loadLocalGrants"]>;
+    listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;
+    loadPolicyHistory: () => ReturnType<OrganizationReadModelCoordinator["loadOrganizationPolicyHistory"]>;
+    loadUserDetail: (userId: string) => ReturnType<OrganizationReadModelCoordinator["loadLocalUserDetail"]>;
+    updateRosterEntry: (userId: string, profileDocumentId: string | null) => ReturnType<typeof updateOrganizationRosterEntry>;
+    updateProfile: (profileDocumentId: string | null) => ReturnType<typeof updateOrganizationProfile>;
+    removeUserFromGroup: (input: RemoveOrganizationGroupUserInput) => Promise<OrganizationGroupMutationReceipt>;
+    revokeGrant: (grant: OrganizationGrantRef) => Promise<Awaited<ReturnType<typeof revokeOrganizationContainerGrant>> | OrganizationGroupMutationReceipt>;
+    startTrial: (organizationId?: string) => ReturnType<typeof startOrganizationTrial>;
+}

package/client/organizations/organizationsTypes.js ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=organizationsTypes.js.map

package/client/organizations/organizationsTypes.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createOrganizationGroup,\n createStripeCheckout,\n createStripeCheckoutSession,\n importOrganizationUser,\n LocalOrganizationSummary,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n revokeOrganizationContainerGrant,\n startOrganizationTrial,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n AbandonOrganizationPolicyMutationInput,\n DiscardUnreadableOrganizationPolicyMutationInput,\n readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n AddOrganizationGroupUserInput,\n deleteGroupForOrganization,\n OrganizationGrantRef,\n RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. */\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n discardUnreadablePolicyMutation: (\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n readPendingPolicyMutation: (\n organizationId: string,\n ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n abandonPendingPolicyMutation: (\n input: AbandonOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n addUserToGroup: (\n input: AddOrganizationGroupUserInput,\n ) => Promise<OrganizationGroupMutationReceipt>;\n createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n deleteGroup: (\n groupId: string,\n ) => ReturnType<typeof deleteGroupForOrganization>;\n importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n /** Billing for an organization the session is not currently switched to. */\n loadBillingForOrganization: (\n organizationId: string,\n ) => ReturnType<typeof loadOrganizationBilling>;\n loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n loadBillingManagementUrl: () => ReturnType<\n typeof loadOrganizationBillingManagementUrl\n >;\n /** Direct Stripe checkout (issue #1654): options, start, and cancel. */\n loadStripeCheckoutOptions: (\n organizationId?: string,\n ) => ReturnType<typeof loadStripeCheckoutOptions>;\n createStripeCheckout: (\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckout>;\n createStripeCheckoutSession: (\n returnUrl: string,\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckoutSession>;\n cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n claimNativeSubscription: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n checkNativePurchaseEligibility: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof checkNativePurchaseEligibility>;\n loadDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"reconcile\"]\n >;\n loadLocalDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"loadLocal\"]\n >;\n loadDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcile\"]\n >;\n loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n >;\n loadLocalDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocal\"]\n >;\n loadGroupMembers: (\n groupId: string,\n ) => ReturnType<\n InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n >;\n loadGroupPresentationDetails(\n groupId: string,\n beforeVersion?: number,\n ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n loadGroupContainers: (\n groupId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n loadGrants: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n >;\n listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n loadPolicyHistory: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n >;\n loadUserDetail: (\n userId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n updateRosterEntry: (\n userId: string,\n profileDocumentId: string | null,\n ) => ReturnType<typeof updateOrganizationRosterEntry>;\n updateProfile: (\n profileDocumentId: string | null,\n ) => ReturnType<typeof updateOrganizationProfile>;\n removeUserFromGroup: (\n input: RemoveOrganizationGroupUserInput,\n ) => Promise<OrganizationGroupMutationReceipt>;\n revokeGrant: (\n grant: OrganizationGrantRef,\n ) => Promise<\n | Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n | OrganizationGroupMutationReceipt\n >;\n startTrial: (\n organizationId?: string,\n ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}

package/client/organizations/principalContainerMutations.js CHANGED Viewed

@@ -9,6 +9,7 @@ export async function preparePrincipalContainerMutations(input) {
     }
     return preparePrincipalContainerRematerializationBatch({
         stillCurrent: input.stillCurrent,
+        recitationStillCurrent: input.recitationStillCurrent,
         reportSecurityIncident: input.runtime.util.reportSecurityIncident,
         apiClient: input.runtime.apiClient,
         author,
@@ -18,6 +19,7 @@ export async function preparePrincipalContainerMutations(input) {
         ],
         groupId: input.groupId,
         nextPolicy: input.nextPolicy,
+        resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,
         revokedContainerId: input.revokedContainerId,
         resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
         targetSecretKey,

package/client/organizations/principalContainerMutations.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"~~AAEA~~,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,~~KAQxD~~;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ~~VerifiedPrincipalPolicy~~ } from \"@tearleads/~~crypto~~\";\nimport type { ~~PrincipalPolicyBundleResponse~~ } from \"~~@tearleads~~/~~validators~~/~~response~~\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n type PreparedPrincipalContainerRematerializationBatch,\n preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly groupId: string;\n readonly nextPolicy: ~~VerifiedPrincipalPolicy~~;\n readonly organizationId: string;\n readonly revokedContainerId?: string \| undefined;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n const author = resolveDocumentCreateAuthor(input.runtime);\n const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !targetSecretKey) {\n throw new Error(\n \"Organization container rematerialization context is unavailable\",\n );\n }\n return preparePrincipalContainerRematerializationBatch({\n stillCurrent: input.stillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n author,\n execSql: input.runtime.infra.execSql,\n grants: [\n ...new Map(\n [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n (grant) => [grant.containerId, grant] as const,\n ),\n ).values(),\n ],\n groupId: input.groupId,\n nextPolicy: input.nextPolicy,\n revokedContainerId: input.revokedContainerId,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n}\n"]}
1	+ {"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAYxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n type PreparedPrincipalContainerRematerializationBatch,\n preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n readonly groupId: string;\n readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n readonly resolveAuthoredPolicyReferences?:\n \| CurrentPolicyReferenceResolver\n \| undefined;\n readonly organizationId: string;\n readonly revokedContainerId?: string \| undefined;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n readonly recitationStillCurrent?: (() => boolean) \| undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n const author = resolveDocumentCreateAuthor(input.runtime);\n const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !targetSecretKey) {\n throw new Error(\n \"Organization container rematerialization context is unavailable\",\n );\n }\n return preparePrincipalContainerRematerializationBatch({\n stillCurrent: input.stillCurrent,\n recitationStillCurrent: input.recitationStillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n author,\n execSql: input.runtime.infra.execSql,\n grants: [\n ...new Map(\n [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n (grant) => [grant.containerId, grant] as const,\n ),\n ).values(),\n ],\n groupId: input.groupId,\n nextPolicy: input.nextPolicy,\n resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n revokedContainerId: input.revokedContainerId,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n}\n"]}

package/client/organizations/principalMutationRecovery.d.ts ADDED Viewed

@@ -0,0 +1,16 @@
+import type { AuthoredPrincipalMutation } from "../../data/principals/principalMutationJournal.js";
+import type { InternalRuntime } from "../workflowRuntime.js";
+export interface AbandonOrganizationPolicyMutationInput {
+    readonly organizationId: string;
+    readonly mutation: AuthoredPrincipalMutation;
+    readonly acknowledgeUnknownOutcome: true;
+}
+export interface DiscardUnreadableOrganizationPolicyMutationInput {
+    readonly organizationId: string;
+    readonly recordId: string;
+    readonly acknowledgeUnknownOutcome: true;
+}
+export declare function discardUnreadableOrganizationPolicyMutation(service: InternalRuntime, input: DiscardUnreadableOrganizationPolicyMutationInput): Promise<boolean>;
+export declare function readPendingOrganizationPolicyMutation(service: InternalRuntime, organizationId: string): Promise<AuthoredPrincipalMutation | null>;
+export declare function retryPendingOrganizationPolicyMutation(service: InternalRuntime, organizationId: string): Promise<void>;
+export declare function abandonPendingOrganizationPolicyMutation(service: InternalRuntime, input: AbandonOrganizationPolicyMutationInput): Promise<boolean>;

package/client/organizations/principalMutationRecovery.js ADDED Viewed

@@ -0,0 +1,23 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { currentOrganizationMutation } from "./principalMutationScope.js";
+async function runRecovery(service, organizationId, run) {
+    const active = currentOrganizationMutation(service, true);
+    const { runtime, stillCurrent } = active;
+    assertProjectionVerificationCurrent(() => stillCurrent() && runtime.auth.organizationId === organizationId);
+    const result = await run(runtime.apiClient);
+    assertProjectionVerificationCurrent(stillCurrent);
+    return result;
+}
+export function discardUnreadableOrganizationPolicyMutation(service, input) {
+    return runRecovery(service, input.organizationId, (api) => api.discardUnreadablePrincipalMutation(input.organizationId, input.recordId, input.acknowledgeUnknownOutcome));
+}
+export function readPendingOrganizationPolicyMutation(service, organizationId) {
+    return runRecovery(service, organizationId, (api) => api.readPendingPrincipalMutation(organizationId));
+}
+export function retryPendingOrganizationPolicyMutation(service, organizationId) {
+    return runRecovery(service, organizationId, (api) => api.recoverPendingPrincipalMutation(organizationId));
+}
+export function abandonPendingOrganizationPolicyMutation(service, input) {
+    return runRecovery(service, input.organizationId, (api) => api.abandonPendingPrincipalMutation(input.organizationId, input.mutation, input.acknowledgeUnknownOutcome));
+}
+//# sourceMappingURL=principalMutationRecovery.js.map

package/client/organizations/principalMutationRecovery.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalMutationRecovery.js","sourceRoot":"","sources":["principalMutationRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAIpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAcvE,KAAK,UAAU,WAAW,CACxB,OAAwB,EACxB,cAAsB,EACtB,GAAsD;IAEtD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACzC,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,cAAc,CACvE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,OAAwB,EACxB,KAAuD;IAEvD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,kCAAkC,CACpC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,4BAA4B,CAAC,cAAc,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,+BAA+B,CAAC,cAAc,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAwB,EACxB,KAA6C;IAE7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,+BAA+B,CACjC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport type { PrincipalMutationRecoveryApi } from \"../../workflows/organizations/principalMutationJournalManagement\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\n\nexport interface AbandonOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly mutation: AuthoredPrincipalMutation;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nexport interface DiscardUnreadableOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly recordId: string;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nasync function runRecovery<T>(\n service: InternalRuntime,\n organizationId: string,\n run: (api: PrincipalMutationRecoveryApi) => Promise<T>,\n): Promise<T> {\n const active = currentOrganizationMutation(service, true);\n const { runtime, stillCurrent } = active;\n assertProjectionVerificationCurrent(\n () => stillCurrent() && runtime.auth.organizationId === organizationId,\n );\n const result = await run(runtime.apiClient);\n assertProjectionVerificationCurrent(stillCurrent);\n return result;\n}\n\nexport function discardUnreadableOrganizationPolicyMutation(\n service: InternalRuntime,\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.discardUnreadablePrincipalMutation(\n input.organizationId,\n input.recordId,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n\nexport function readPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.readPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function retryPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.recoverPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function abandonPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n input: AbandonOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.abandonPendingPrincipalMutation(\n input.organizationId,\n input.mutation,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n"]}

package/client/organizations/principalMutationScope.js CHANGED Viewed

@@ -1,12 +1,17 @@
 /** Capture a mutation's identity/database lifetime without freezing live status. */
-export function currentOrganizationMutation(service) {
+export function currentOrganizationMutation(service, allowTokenRenewal = false) {
     const runtime = service.workflowInput();
     const sessionGeneration = service.sessionGeneration;
     return {
         runtime,
         stillCurrent: () => {
             const current = service.workflowInput();
-            return (service.sessionGeneration === sessionGeneration &&
+            return (
+            // Journal API custody survives token renewal, but its identity,
+            // organization and storage generation are still bound immutably.
+            (allowTokenRenewal
+                ? current.apiClient === runtime.apiClient
+                : service.sessionGeneration === sessionGeneration) &&
                 current.infra.dbStatus === "ready" &&
                 current.infra.execSql === runtime.infra.execSql &&
                 current.state.domainScope === runtime.state.domainScope &&

package/client/organizations/principalMutationScope.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalMutationScope.js","sourceRoot":"","sources":["principalMutationScope.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CACzC,OAAqE;~~IAErE~~,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,OAAO;QACL,OAAO;QACP,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO,~~CACL~~,OAAO,CAAC,iBAAiB,KAAK,iBAAiB;~~gBAC/C~~,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;gBAClC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW;gBACvD,OAAO,CAAC,IAAI,CAAC,eAAe;gBAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3D,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3C,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,kBAAkB,CACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { InternalRuntime } from \"../workflowRuntime\";\n\n/** Capture a mutation's identity/database lifetime without freezing live status. */\nexport function currentOrganizationMutation(\n service: Pick<InternalRuntime, \"workflowInput\" \| \"sessionGeneration\">,\n) {\n const runtime = service.workflowInput();\n const sessionGeneration = service.sessionGeneration;\n return {\n runtime,\n stillCurrent: () => {\n const current = service.workflowInput();\n return (\n service.sessionGeneration === sessionGeneration &&\n current.infra.dbStatus === \"ready\" &&\n current.infra.execSql === runtime.infra.execSql &&\n current.state.domainScope === runtime.state.domainScope &&\n current.auth.isAuthenticated &&\n current.auth.organizationId === runtime.auth.organizationId &&\n current.auth.userId === runtime.auth.userId &&\n current.crypto.signingFingerprint === runtime.crypto.signingFingerprint\n );\n },\n };\n}\n"]}
1	+ {"version":3,"file":"principalMutationScope.js","sourceRoot":"","sources":["principalMutationScope.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CACzC,OAAqE,EACrE,iBAAiB,GAAG,KAAK;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,OAAO;QACL,OAAO;QACP,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO;YACL,gEAAgE;YAChE,iEAAiE;YACjE,CAAC,iBAAiB;gBAChB,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACzC,CAAC,CAAC,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,CAAC;gBACpD,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;gBAClC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW;gBACvD,OAAO,CAAC,IAAI,CAAC,eAAe;gBAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3D,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3C,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,kBAAkB,CACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { InternalRuntime } from \"../workflowRuntime\";\n\n/** Capture a mutation's identity/database lifetime without freezing live status. */\nexport function currentOrganizationMutation(\n service: Pick<InternalRuntime, \"workflowInput\" \| \"sessionGeneration\">,\n allowTokenRenewal = false,\n) {\n const runtime = service.workflowInput();\n const sessionGeneration = service.sessionGeneration;\n return {\n runtime,\n stillCurrent: () => {\n const current = service.workflowInput();\n return (\n // Journal API custody survives token renewal, but its identity,\n // organization and storage generation are still bound immutably.\n (allowTokenRenewal\n ? current.apiClient === runtime.apiClient\n : service.sessionGeneration === sessionGeneration) &&\n current.infra.dbStatus === \"ready\" &&\n current.infra.execSql === runtime.infra.execSql &&\n current.state.domainScope === runtime.state.domainScope &&\n current.auth.isAuthenticated &&\n current.auth.organizationId === runtime.auth.organizationId &&\n current.auth.userId === runtime.auth.userId &&\n current.crypto.signingFingerprint === runtime.crypto.signingFingerprint\n );\n },\n };\n}\n"]}