@tearleads/client-sdk 0.1.16 → 0.1.17

package/client/index.d.ts

@@ -20,7 +20,7 @@ export type { LocalKeyringPinCode, PinCodeBrowserLocalKeyringOptions, PinCodeWra
 export { createPinCodeBrowserLocalKeyring, createPinCodeWrappingKeyKeystore, isPinCodeWrappedLocalSecretEnvelope, } from "./localKeyring/localKeyringPinCode.js";
 export type { Logger } from "./logger.js";
 export { createBrowserNetworkStatusSource, Network, type NetworkListener, type NetworkMode, type NetworkStatusSource, } from "./network.js";
-export type { AbandonOrganizationPolicyMutationInput, AddOrganizationGroupUserInput, DiscardUnreadableOrganizationPolicyMutationInput, ImportedOrganizationUser, LocalOrganizationSummary, OrganizationBilling, OrganizationBillingHistory, OrganizationBillingHistoryEntry, OrganizationBillingManagementUrl, OrganizationBillingView, OrganizationContainerGrant, OrganizationContainerGrants, OrganizationDataUsage, OrganizationDirectory, OrganizationDirectoryAndGroups, OrganizationDirectoryUser, OrganizationGrantRef, OrganizationGroupContainer, OrganizationGroupContainers, OrganizationGroupDetails, OrganizationGroupMember, OrganizationGroupMembers, OrganizationGroupPolicyHistory, OrganizationGroupSummary, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationProfile, Organizations, OrganizationUserDetail, RemoveOrganizationGroupUserInput, } from "./organizations/index.js";
+export type { AbandonOrganizationPolicyMutationInput, AddOrganizationGroupUserInput, DiscardUnreadableOrganizationPolicyMutationInput, ImportedOrganizationUser, LocalOrganizationSummary, OrganizationBilling, OrganizationBillingHistory, OrganizationBillingHistoryEntry, OrganizationBillingManagementUrl, OrganizationBillingView, OrganizationContainerGrant, OrganizationContainerGrants, OrganizationDataUsage, OrganizationDirectory, OrganizationDirectoryAndGroups, OrganizationDirectoryUser, OrganizationGrantRef, OrganizationGroupContainer, OrganizationGroupContainers, OrganizationGroupDetails, OrganizationGroupMember, OrganizationGroupMembers, OrganizationGroupMutationReceipt, OrganizationGroupPolicyHistory, OrganizationGroupSummary, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationProfile, Organizations, OrganizationUserDetail, RemoveOrganizationGroupUserInput, } from "./organizations/index.js";
 export type { PrincipalHistoryKeyProvider, PrincipalHistoryKeyScope, } from "./principalHistoryProtection.js";
 export type { SecurityIncident, SecurityIncidentListener, SecurityIncidentObjectKind, SecurityIncidents, } from "./securityIncidents.js";
 export { PurgedOrganizationRecoveryBillingRequiredError } from "./session/sessionRecoveryErrors.js";

package/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AAK1E,OAAO,EACL,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAK/B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,GAO1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAyB,KAAK,EAAE,MAAM,SAAS,CAAC;AAgDvD,OAAO,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,QAAQ,GAKT,MAAM,YAAY,CAAC;AAuBpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,MAAM,GAGP,MAAM,UAAU,CAAC;AASlB,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAyB9B,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,gCAAgC,EAChC,OAAO,GAIR,MAAM,WAAW,CAAC;AA6CnB,OAAO,EAAE,8CAA8C,EAAE,MAAM,iCAAiC,CAAC;AAajG,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,SAAS,GACV,MAAM,aAAa,CAAC","sourcesContent":["export { createDomainScope, type DomainScope } from \"../data/domainScope\";\nexport type {\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n} from \"../stores/local-projection\";\nexport {\n  enqueueReconciliationForEvents,\n  type ReconciliationService,\n} from \"../sync/reconciliation\";\nexport {\n  createUnavailableDirectCheckout,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n} from \"./billing/directCheckout\";\nexport {\n  createRevenueCatPurchases,\n  createUnavailablePurchases,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n} from \"./billing/purchases\";\nexport { type BlobStoreFactory, Blobs } from \"./blobs\";\nexport type {\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentInfo,\n  DocumentInfoInput,\n  LinkDocumentToContainerInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n} from \"./containerContents\";\nexport { createContainerDocumentObjectSyncState } from \"./containerContents\";\nexport {\n  Database,\n  type DatabaseListener,\n  type DatabaseOptions,\n  type DatabaseSnapshot,\n  type DatabaseStatus,\n} from \"./database\";\nexport type {\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  LocalProjectionView,\n} from \"./deviceFirst\";\nexport type {\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentContextValue,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  ListDocumentsInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  PersistedDocumentListener,\n} from \"./documents\";\nexport { DEFAULT_DOCUMENT_ID } from \"./documents\";\nexport {\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n} from \"./events\";\nexport type { FileSaver, SaveFileRequest } from \"./fileSaver\";\nexport type {\n  Identity,\n  IdentityGenerationResult,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n} from \"./identity\";\nexport {\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  type IdentityKeyPackage,\n} from \"./identityKeyPackage\";\nexport type {\n  BrowserLocalKeyringOptions,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  NormalizedLocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./localKeyring\";\nexport {\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createWebViewLocalKeyring,\n  decodeLocalKeyringSqliteKey,\n  encodeLocalKeyringSqliteKey,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  normalizeLocalKeyringScope,\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./localKeyring\";\nexport type {\n  LocalKeyringPinCode,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n} from \"./localKeyring/localKeyringPinCode\";\nexport {\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  isPinCodeWrappedLocalSecretEnvelope,\n} from \"./localKeyring/localKeyringPinCode\";\nexport type { Logger } from \"./logger\";\nexport {\n  createBrowserNetworkStatusSource,\n  Network,\n  type NetworkListener,\n  type NetworkMode,\n  type NetworkStatusSource,\n} from \"./network\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  RemoveOrganizationGroupUserInput,\n} from \"./organizations\";\nexport type {\n  PrincipalHistoryKeyProvider,\n  PrincipalHistoryKeyScope,\n} from \"./principalHistoryProtection\";\nexport type {\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n} from \"./securityIncidents\";\nexport { PurgedOrganizationRecoveryBillingRequiredError } from \"./session/sessionRecoveryErrors\";\nexport type {\n  CreateOrganizationOptions,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  UserSession,\n} from \"./session/sessionTypes\";\nexport {\n  SyncBillingGate,\n  type SyncBillingGateListener,\n} from \"./syncBillingGate\";\nexport {\n  type ClientDatabaseOptions,\n  type ClientOptions,\n  Tearleads,\n} from \"./Tearleads\";\nexport type {\n  ResolvedUserIdentity,\n  UserIdentities,\n} from \"./userIdentities\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AAK1E,OAAO,EACL,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAK/B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,GAO1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAyB,KAAK,EAAE,MAAM,SAAS,CAAC;AAgDvD,OAAO,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,QAAQ,GAKT,MAAM,YAAY,CAAC;AAuBpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,MAAM,GAGP,MAAM,UAAU,CAAC;AASlB,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAyB9B,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,gCAAgC,EAChC,OAAO,GAIR,MAAM,WAAW,CAAC;AA8CnB,OAAO,EAAE,8CAA8C,EAAE,MAAM,iCAAiC,CAAC;AAajG,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,SAAS,GACV,MAAM,aAAa,CAAC","sourcesContent":["export { createDomainScope, type DomainScope } from \"../data/domainScope\";\nexport type {\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n} from \"../stores/local-projection\";\nexport {\n  enqueueReconciliationForEvents,\n  type ReconciliationService,\n} from \"../sync/reconciliation\";\nexport {\n  createUnavailableDirectCheckout,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n} from \"./billing/directCheckout\";\nexport {\n  createRevenueCatPurchases,\n  createUnavailablePurchases,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n} from \"./billing/purchases\";\nexport { type BlobStoreFactory, Blobs } from \"./blobs\";\nexport type {\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentInfo,\n  DocumentInfoInput,\n  LinkDocumentToContainerInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n} from \"./containerContents\";\nexport { createContainerDocumentObjectSyncState } from \"./containerContents\";\nexport {\n  Database,\n  type DatabaseListener,\n  type DatabaseOptions,\n  type DatabaseSnapshot,\n  type DatabaseStatus,\n} from \"./database\";\nexport type {\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  LocalProjectionView,\n} from \"./deviceFirst\";\nexport type {\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentContextValue,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  ListDocumentsInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  PersistedDocumentListener,\n} from \"./documents\";\nexport { DEFAULT_DOCUMENT_ID } from \"./documents\";\nexport {\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n} from \"./events\";\nexport type { FileSaver, SaveFileRequest } from \"./fileSaver\";\nexport type {\n  Identity,\n  IdentityGenerationResult,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n} from \"./identity\";\nexport {\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  type IdentityKeyPackage,\n} from \"./identityKeyPackage\";\nexport type {\n  BrowserLocalKeyringOptions,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  NormalizedLocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./localKeyring\";\nexport {\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createWebViewLocalKeyring,\n  decodeLocalKeyringSqliteKey,\n  encodeLocalKeyringSqliteKey,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  normalizeLocalKeyringScope,\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./localKeyring\";\nexport type {\n  LocalKeyringPinCode,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n} from \"./localKeyring/localKeyringPinCode\";\nexport {\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  isPinCodeWrappedLocalSecretEnvelope,\n} from \"./localKeyring/localKeyringPinCode\";\nexport type { Logger } from \"./logger\";\nexport {\n  createBrowserNetworkStatusSource,\n  Network,\n  type NetworkListener,\n  type NetworkMode,\n  type NetworkStatusSource,\n} from \"./network\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  RemoveOrganizationGroupUserInput,\n} from \"./organizations\";\nexport type {\n  PrincipalHistoryKeyProvider,\n  PrincipalHistoryKeyScope,\n} from \"./principalHistoryProtection\";\nexport type {\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n} from \"./securityIncidents\";\nexport { PurgedOrganizationRecoveryBillingRequiredError } from \"./session/sessionRecoveryErrors\";\nexport type {\n  CreateOrganizationOptions,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  UserSession,\n} from \"./session/sessionTypes\";\nexport {\n  SyncBillingGate,\n  type SyncBillingGateListener,\n} from \"./syncBillingGate\";\nexport {\n  type ClientDatabaseOptions,\n  type ClientOptions,\n  Tearleads,\n} from \"./Tearleads\";\nexport type {\n  ResolvedUserIdentity,\n  UserIdentities,\n} from \"./userIdentities\";\n"]}

package/client/organizations/currentPrincipalMutations.js

@@ -0,0 +1,96 @@
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { commitCurrentGroupPolicyMutation } from "../../workflows/organizations/commitCurrentGroupPolicyMutation.js";
+import { assertGroupMembershipName } from "../../workflows/organizations/groupMembershipName.js";
+import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
+import { buildAddGroupUserPolicyRequest, buildGroupAccessSetShrinkPolicyRequest, buildRemoveGroupUserPolicyRequest, } from "../../workflows/organizations/groupPolicyRequests.js";
+import { createRuntimeCurrentGroupMutation, } from "../../workflows/organizations/runtimeCurrentGroupMutation.js";
+import { projectionUserIds, resolveRequiredUserIdentities, } from "../../workflows/organizations/trustedOrganizationUsers.js";
+import { preparePrincipalContainerMutations } from "./principalContainerMutations.js";
+export function createCurrentPrincipalMutation(input) {
+    const mutate = createRuntimeCurrentGroupMutation(input.runtime);
+    if (!mutate)
+        return undefined;
+    return (groupId, mutation) => mutate({
+        groupId,
+        organizationId: input.organizationId,
+        signerUserId: input.signerUserId,
+        stillCurrent: input.stillCurrent,
+    }, async (context) => {
+        const request = await buildCurrentMutationRequest(input, context, mutation);
+        assertProjectionVerificationCurrent(context.stillCurrent);
+        const response = await commitCurrentGroupPolicyMutation({
+            ...input,
+            apiClient: input.runtime.apiClient,
+            groupId,
+            context,
+            request,
+            resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+            prepareContainerMutations: (nextPolicy) => preparePrincipalContainerMutations({
+                currentPolicy: context.currentPolicy,
+                nextPolicy,
+                groupId,
+                organizationId: input.organizationId,
+                runtime: input.runtime,
+                stillCurrent: context.stillCurrent,
+                recitationStillCurrent: input.stillCurrent,
+                resolveAuthoredPolicyReferences: context.resolveAuthoredPolicyReferences,
+                revokedContainerId: mutation.kind === "revoke"
+                    ? mutation.revokedContainerId
+                    : undefined,
+            }),
+        });
+        return { response, memberGroupId: context.memberGroupId };
+    });
+}
+async function buildCurrentMutationRequest(input, context, mutation) {
+    const shared = {
+        ...context,
+        signerUserId: input.signerUserId,
+        signingFingerprint: input.signingFingerprint,
+        signingKeyPair: input.signingKeyPair,
+    };
+    if (mutation.kind !== "revoke") {
+        await assertGroupMembershipName(context.currentPolicy, mutation.expectedGroupName, createRuntimeGroupMetadataAccess(input.runtime, input.organizationId, context.stillCurrent, context.verifyMetadataContainer).readName);
+    }
+    const resolveUsers = (userIds) => resolveRequiredUserIdentities({
+        resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
+        userIds,
+    });
+    const projection = context.currentPolicy.currentProjection;
+    let request;
+    if (mutation.kind === "add") {
+        const currentUserSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;
+        if (!currentUserSecretKey)
+            throw new Error("Organization encryption context is unavailable");
+        const identities = await resolveUsers([
+            ...projectionUserIds(projection),
+            mutation.targetUserId,
+        ]);
+        const targetUser = identities.find((identity) => identity.userId === mutation.targetUserId);
+        if (!targetUser)
+            throw new Error("Group target identity is unavailable");
+        request = await buildAddGroupUserPolicyRequest({
+            ...shared,
+            currentUserSecretKey,
+            targetUser,
+            currentUsers: identities.filter((identity) => identity.userId !== mutation.targetUserId),
+            reportSecurityIncident: input.runtime.util.reportSecurityIncident,
+        });
+    }
+    else if (mutation.kind === "remove") {
+        request = await buildRemoveGroupUserPolicyRequest({
+            ...shared,
+            removedUserId: mutation.removedUserId,
+            remainingUsers: await resolveUsers(projectionUserIds(projection.filter((member) => member.userId !== mutation.removedUserId))),
+        });
+    }
+    else {
+        request = await buildGroupAccessSetShrinkPolicyRequest({
+            ...shared,
+            revokedContainerId: mutation.revokedContainerId,
+            currentUsers: await resolveUsers(projectionUserIds(projection)),
+        });
+    }
+    return request;
+}
+//# sourceMappingURL=currentPrincipalMutations.js.map

package/client/organizations/currentPrincipalMutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentPrincipalMutations.js","sourceRoot":"","sources":["currentPrincipalMutations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,iCAAiC,GAElC,MAAM,2DAA2D,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAyBnF,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,CAAC,OAAe,EAAE,QAA8B,EAAE,EAAE,CACzD,MAAM,CACJ;QACE,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAC/C,KAAK,EACL,OAAO,EACP,QAAQ,CACT,CAAC;QACF,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO;YACP,OAAO;YACP,OAAO;YACP,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;YACpE,yBAAyB,EAAE,CAAC,UAAU,EAAE,EAAE,CACxC,kCAAkC,CAAC;gBACjC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU;gBACV,OAAO;gBACP,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,sBAAsB,EAAE,KAAK,CAAC,YAAY;gBAC1C,+BAA+B,EAC7B,OAAO,CAAC,+BAA+B;gBACzC,kBAAkB,EAChB,QAAQ,CAAC,IAAI,KAAK,QAAQ;oBACxB,CAAC,CAAC,QAAQ,CAAC,kBAAkB;oBAC7B,CAAC,CAAC,SAAS;aAChB,CAAC;SACL,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IAC5D,CAAC,CACF,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAoC,EACpC,OAA2C,EAC3C,QAA8B;IAE9B,MAAM,MAAM,GAAG;QACb,GAAG,OAAO;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAC7B,OAAO,CAAC,aAAa,EACrB,QAAQ,CAAC,iBAAiB,EAC1B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAE,EAAE,CAClD,6BAA6B,CAAC;QAC5B,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,OAAO;KACR,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAC3D,IAAI,OAAkC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;QACvD,IAAI,CAAC,oBAAoB;YACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;YACpC,GAAG,iBAAiB,CAAC,UAAU,CAAC;YAChC,QAAQ,CAAC,YAAY;SACtB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzE,OAAO,GAAG,MAAM,8BAA8B,CAAC;YAC7C,GAAG,MAAM;YACT,oBAAoB;YACpB,UAAU;YACV,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SAClE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,GAAG,MAAM,iCAAiC,CAAC;YAChD,GAAG,MAAM;YACT,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,cAAc,EAAE,MAAM,YAAY,CAChC,iBAAiB,CACf,UAAU,CAAC,MAAM,CACf,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CACrD,CACF,CACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,sCAAsC,CAAC;YACrD,GAAG,MAAM;YACT,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,YAAY,EAAE,MAAM,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { commitCurrentGroupPolicyMutation } from \"../../workflows/organizations/commitCurrentGroupPolicyMutation\";\nimport { assertGroupMembershipName } from \"../../workflows/organizations/groupMembershipName\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport {\n  buildAddGroupUserPolicyRequest,\n  buildGroupAccessSetShrinkPolicyRequest,\n  buildRemoveGroupUserPolicyRequest,\n} from \"../../workflows/organizations/groupPolicyRequests\";\nimport {\n  createRuntimeCurrentGroupMutation,\n  type RuntimeCurrentGroupMutationContext,\n} from \"../../workflows/organizations/runtimeCurrentGroupMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../../workflows/organizations/trustedOrganizationUsers\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\ntype CurrentGroupMutation =\n  | {\n      readonly kind: \"add\";\n      readonly expectedGroupName: string;\n      readonly targetUserId: string;\n    }\n  | {\n      readonly kind: \"remove\";\n      readonly expectedGroupName: string;\n      readonly removedUserId: string;\n    }\n  | { readonly kind: \"revoke\"; readonly revokedContainerId: string };\n\n/** Built-in hosts with private custody use bounded current-policy mutation work. */\ninterface CurrentPrincipalMutationInput {\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent: () => boolean;\n}\n\nexport function createCurrentPrincipalMutation(\n  input: CurrentPrincipalMutationInput,\n) {\n  const mutate = createRuntimeCurrentGroupMutation(input.runtime);\n  if (!mutate) return undefined;\n  return (groupId: string, mutation: CurrentGroupMutation) =>\n    mutate(\n      {\n        groupId,\n        organizationId: input.organizationId,\n        signerUserId: input.signerUserId,\n        stillCurrent: input.stillCurrent,\n      },\n      async (context) => {\n        const request = await buildCurrentMutationRequest(\n          input,\n          context,\n          mutation,\n        );\n        assertProjectionVerificationCurrent(context.stillCurrent);\n        const response = await commitCurrentGroupPolicyMutation({\n          ...input,\n          apiClient: input.runtime.apiClient,\n          groupId,\n          context,\n          request,\n          resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n          prepareContainerMutations: (nextPolicy) =>\n            preparePrincipalContainerMutations({\n              currentPolicy: context.currentPolicy,\n              nextPolicy,\n              groupId,\n              organizationId: input.organizationId,\n              runtime: input.runtime,\n              stillCurrent: context.stillCurrent,\n              recitationStillCurrent: input.stillCurrent,\n              resolveAuthoredPolicyReferences:\n                context.resolveAuthoredPolicyReferences,\n              revokedContainerId:\n                mutation.kind === \"revoke\"\n                  ? mutation.revokedContainerId\n                  : undefined,\n            }),\n        });\n        return { response, memberGroupId: context.memberGroupId };\n      },\n    );\n}\n\nasync function buildCurrentMutationRequest(\n  input: CurrentPrincipalMutationInput,\n  context: RuntimeCurrentGroupMutationContext,\n  mutation: CurrentGroupMutation,\n): Promise<PutPrincipalPolicyRequest> {\n  const shared = {\n    ...context,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n  if (mutation.kind !== \"revoke\") {\n    await assertGroupMembershipName(\n      context.currentPolicy,\n      mutation.expectedGroupName,\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        input.organizationId,\n        context.stillCurrent,\n        context.verifyMetadataContainer,\n      ).readName,\n    );\n  }\n  const resolveUsers = (userIds: readonly string[]) =>\n    resolveRequiredUserIdentities({\n      resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n      userIds,\n    });\n  const projection = context.currentPolicy.currentProjection;\n  let request: PutPrincipalPolicyRequest;\n  if (mutation.kind === \"add\") {\n    const currentUserSecretKey =\n      input.runtime.crypto.encapsulationKeyPair?.secretKey;\n    if (!currentUserSecretKey)\n      throw new Error(\"Organization encryption context is unavailable\");\n    const identities = await resolveUsers([\n      ...projectionUserIds(projection),\n      mutation.targetUserId,\n    ]);\n    const targetUser = identities.find(\n      (identity) => identity.userId === mutation.targetUserId,\n    );\n    if (!targetUser) throw new Error(\"Group target identity is unavailable\");\n    request = await buildAddGroupUserPolicyRequest({\n      ...shared,\n      currentUserSecretKey,\n      targetUser,\n      currentUsers: identities.filter(\n        (identity) => identity.userId !== mutation.targetUserId,\n      ),\n      reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    });\n  } else if (mutation.kind === \"remove\") {\n    request = await buildRemoveGroupUserPolicyRequest({\n      ...shared,\n      removedUserId: mutation.removedUserId,\n      remainingUsers: await resolveUsers(\n        projectionUserIds(\n          projection.filter(\n            (member) => member.userId !== mutation.removedUserId,\n          ),\n        ),\n      ),\n    });\n  } else {\n    request = await buildGroupAccessSetShrinkPolicyRequest({\n      ...shared,\n      revokedContainerId: mutation.revokedContainerId,\n      currentUsers: await resolveUsers(projectionUserIds(projection)),\n    });\n  }\n\n  return request;\n}\n"]}

package/client/organizations/index.d.ts

@@ -2,7 +2,7 @@ import type { ContainerContents } from "../containerContents.js";
 import type { InternalRuntime } from "../workflowRuntime.js";
 import type { Organizations } from "./organizationsTypes.js";
 export type { ImportedOrganizationUser, LocalOrganizationSummary, OrganizationBilling, OrganizationBillingHistory, OrganizationBillingHistoryEntry, OrganizationBillingManagementUrl, OrganizationBillingView, OrganizationContainerGrant, OrganizationContainerGrants, OrganizationDataUsage, OrganizationDirectory, OrganizationDirectoryAndGroups, OrganizationDirectoryUser, OrganizationGroupContainer, OrganizationGroupContainers, OrganizationGroupDetails, OrganizationGroupMember, OrganizationGroupMembers, OrganizationGroupPolicyHistory, OrganizationGroupSummary, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationProfile, OrganizationUserDetail, } from "../../workflows/organizations/index.js";
-export type { Organizations } from "./organizationsTypes.js";
+export type { OrganizationGroupMutationReceipt, Organizations, } from "./organizationsTypes.js";
 export type { AbandonOrganizationPolicyMutationInput, DiscardUnreadableOrganizationPolicyMutationInput, } from "./principalMutationRecovery.js";
 export type { AddOrganizationGroupUserInput, OrganizationGrantRef, RemoveOrganizationGroupUserInput, } from "./principalMutations.js";
 export declare function createOrganizations(runtime: InternalRuntime, containerContents: ContainerContents): Organizations;

package/client/organizations/index.js

@@ -44,13 +44,13 @@ class OrganizationsService {
     createGroup(name) {
         return createGroupForOrganization({
             name,
-            runtime: this.runtimeService.workflowInput(),
+            ...currentOrganizationMutation(this.runtimeService),
         });
     }
     deleteGroup(groupId) {
         return deleteGroupForOrganization({
             groupId,
-            runtime: this.runtimeService.workflowInput(),
+            ...currentOrganizationMutation(this.runtimeService),
         });
     }
     importUserById(userId) {
@@ -128,7 +128,7 @@ class OrganizationsService {
         }
         return runtime.apiClient.listOrganizationGroupMembers(organizationId, groupId);
     }
-    loadGroupPresentationDetails(groupId) {
+    loadGroupPresentationDetails(groupId, beforeVersion) {
         const runtime = this.runtimeService.workflowInput();
         return runWithSecurityIncidentReporting(runtime.util.reportSecurityIncident, {
             objectId: groupId,
@@ -137,6 +137,7 @@ class OrganizationsService {
             organizationId: runtime.auth.organizationId,
         }, () => loadOrganizationGroupPresentationDetails({
             groupId,
+            beforeVersion,
             readModelCoordinator: this.readModelCoordinator,
             runtime,
         }));

package/client/organizations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,sCAAsC,GAEvC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAyC9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC;IAEpC,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,oBAAoB;IAKL;IACA;IALF,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC;QADpC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAErD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  listLocalOrganizations,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  createOrganizationDataUsageCoordinator,\n  type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n  createOrganizationReadModelCoordinator,\n  type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n  authenticatedOrganizationId,\n  runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n  type AbandonOrganizationPolicyMutationInput,\n  abandonPendingOrganizationPolicyMutation,\n  type DiscardUnreadableOrganizationPolicyMutationInput,\n  discardUnreadableOrganizationPolicyMutation,\n  readPendingOrganizationPolicyMutation,\n  retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n  type AddOrganizationGroupUserInput,\n  addUserToOrganizationGroup,\n  createGroupForOrganization,\n  deleteGroupForOrganization,\n  type OrganizationGrantRef,\n  type RemoveOrganizationGroupUserInput,\n  removeUserFromOrganizationGroup,\n  revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type { Organizations } from \"./organizationsTypes\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n  AddOrganizationGroupUserInput,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n  runtime: InternalRuntime,\n  containerContents: ContainerContents,\n): Organizations {\n  return new OrganizationsService(runtime, containerContents);\n}\n\nclass OrganizationsService implements Organizations {\n  private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n  private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n  ) {\n    this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n      this.runtimeService,\n    );\n    this.readModelCoordinator = createOrganizationReadModelCoordinator(\n      this.runtimeService,\n    );\n  }\n\n  async addUserToGroup(input: AddOrganizationGroupUserInput) {\n    return addUserToOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  readPendingPolicyMutation(organizationId: string) {\n    return readPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  discardUnreadablePolicyMutation(\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) {\n    return discardUnreadableOrganizationPolicyMutation(\n      this.runtimeService,\n      input,\n    );\n  }\n\n  retryPendingPolicyMutation(organizationId: string) {\n    return retryPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n    return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n  }\n\n  createGroup(name: string) {\n    return createGroupForOrganization({\n      name,\n      runtime: this.runtimeService.workflowInput(),\n    });\n  }\n\n  deleteGroup(groupId: string) {\n    return deleteGroupForOrganization({\n      groupId,\n      runtime: this.runtimeService.workflowInput(),\n    });\n  }\n\n  importUserById(userId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    return importOrganizationUser({\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      userId,\n    });\n  }\n\n  loadBilling() {\n    return runForOrganization(this.runtimeService, loadOrganizationBilling);\n  }\n\n  loadBillingForOrganization(organizationId: string) {\n    // Gated on an authenticated session rather than on the target being the\n    // active org. The server still enforces membership, so an org the caller\n    // cannot reach resolves to `null`.\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBilling,\n      organizationId,\n    );\n  }\n\n  loadBillingHistory() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingHistory,\n    );\n  }\n\n  loadBillingManagementUrl() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingManagementUrl,\n    );\n  }\n\n  loadStripeCheckoutOptions(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      loadStripeCheckoutOptions,\n      organizationId,\n    );\n  }\n\n  createStripeCheckout(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      createStripeCheckout,\n      organizationId,\n    );\n  }\n\n  createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n      organizationId,\n    );\n  }\n\n  cancelStripeSubscription() {\n    return runForOrganization(this.runtimeService, cancelStripeSubscription);\n  }\n\n  claimNativeSubscription(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => claimNativeOrganizationSubscription({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  checkNativePurchaseEligibility(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => checkNativePurchaseEligibility({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  loadDataUsage() {\n    return this.dataUsageCoordinator.reconcile();\n  }\n\n  loadLocalDataUsage() {\n    return this.dataUsageCoordinator.loadLocal();\n  }\n\n  loadDirectoryAndGroups() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcile(),\n    );\n  }\n\n  loadDirectoryAndGroupsAfterMutation() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile_after_mutation\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcileAfterMutation(),\n    );\n  }\n\n  loadLocalDirectoryAndGroups() {\n    return this.readModelCoordinator.loadLocal();\n  }\n\n  loadGroupMembers(groupId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || groupId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return runtime.apiClient.listOrganizationGroupMembers(\n      organizationId,\n      groupId,\n    );\n  }\n\n  loadGroupPresentationDetails(groupId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: groupId,\n        objectKind: \"principal\",\n        operation: \"group.presentation.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        loadOrganizationGroupPresentationDetails({\n          groupId,\n          readModelCoordinator: this.readModelCoordinator,\n          runtime,\n        }),\n    );\n  }\n\n  loadGrants() {\n    return this.readModelCoordinator.loadLocalGrants();\n  }\n\n  loadGroupContainers(groupId: string) {\n    return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n  }\n\n  listLocalOrganizations() {\n    const runtime = this.runtimeService.workflowInput();\n    if (runtime.infra.dbStatus !== \"ready\") {\n      return Promise.resolve([]);\n    }\n\n    return listLocalOrganizations({ execSql: runtime.infra.execSql });\n  }\n\n  loadPolicyHistory() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.loadOrganizationPolicyHistory(),\n    );\n  }\n\n  loadUserDetail(userId: string) {\n    return this.readModelCoordinator.loadLocalUserDetail(userId);\n  }\n\n  updateRosterEntry(userId: string, profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || userId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationRosterEntry({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n      userId,\n    });\n  }\n\n  updateProfile(profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationProfile({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n    });\n  }\n\n  async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n    return removeUserFromOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  async revokeGrant(grant: OrganizationGrantRef) {\n    return revokeOrganizationGrant({\n      ...grant,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  startTrial(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      startOrganizationTrial,\n      organizationId,\n    );\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,sCAAsC,GAEvC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AA4C9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC;IAEpC,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,oBAAoB;IAKL;IACA;IALF,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC;QADpC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAErD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,aAAsB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,aAAa;YACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  listLocalOrganizations,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  createOrganizationDataUsageCoordinator,\n  type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n  createOrganizationReadModelCoordinator,\n  type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n  authenticatedOrganizationId,\n  runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n  type AbandonOrganizationPolicyMutationInput,\n  abandonPendingOrganizationPolicyMutation,\n  type DiscardUnreadableOrganizationPolicyMutationInput,\n  discardUnreadableOrganizationPolicyMutation,\n  readPendingOrganizationPolicyMutation,\n  retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n  type AddOrganizationGroupUserInput,\n  addUserToOrganizationGroup,\n  createGroupForOrganization,\n  deleteGroupForOrganization,\n  type OrganizationGrantRef,\n  type RemoveOrganizationGroupUserInput,\n  removeUserFromOrganizationGroup,\n  revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type {\n  OrganizationGroupMutationReceipt,\n  Organizations,\n} from \"./organizationsTypes\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n  AddOrganizationGroupUserInput,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n  runtime: InternalRuntime,\n  containerContents: ContainerContents,\n): Organizations {\n  return new OrganizationsService(runtime, containerContents);\n}\n\nclass OrganizationsService implements Organizations {\n  private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n  private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n  ) {\n    this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n      this.runtimeService,\n    );\n    this.readModelCoordinator = createOrganizationReadModelCoordinator(\n      this.runtimeService,\n    );\n  }\n\n  async addUserToGroup(input: AddOrganizationGroupUserInput) {\n    return addUserToOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  readPendingPolicyMutation(organizationId: string) {\n    return readPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  discardUnreadablePolicyMutation(\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) {\n    return discardUnreadableOrganizationPolicyMutation(\n      this.runtimeService,\n      input,\n    );\n  }\n\n  retryPendingPolicyMutation(organizationId: string) {\n    return retryPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n    return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n  }\n\n  createGroup(name: string) {\n    return createGroupForOrganization({\n      name,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  deleteGroup(groupId: string) {\n    return deleteGroupForOrganization({\n      groupId,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  importUserById(userId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    return importOrganizationUser({\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      userId,\n    });\n  }\n\n  loadBilling() {\n    return runForOrganization(this.runtimeService, loadOrganizationBilling);\n  }\n\n  loadBillingForOrganization(organizationId: string) {\n    // Gated on an authenticated session rather than on the target being the\n    // active org. The server still enforces membership, so an org the caller\n    // cannot reach resolves to `null`.\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBilling,\n      organizationId,\n    );\n  }\n\n  loadBillingHistory() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingHistory,\n    );\n  }\n\n  loadBillingManagementUrl() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingManagementUrl,\n    );\n  }\n\n  loadStripeCheckoutOptions(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      loadStripeCheckoutOptions,\n      organizationId,\n    );\n  }\n\n  createStripeCheckout(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      createStripeCheckout,\n      organizationId,\n    );\n  }\n\n  createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n      organizationId,\n    );\n  }\n\n  cancelStripeSubscription() {\n    return runForOrganization(this.runtimeService, cancelStripeSubscription);\n  }\n\n  claimNativeSubscription(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => claimNativeOrganizationSubscription({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  checkNativePurchaseEligibility(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => checkNativePurchaseEligibility({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  loadDataUsage() {\n    return this.dataUsageCoordinator.reconcile();\n  }\n\n  loadLocalDataUsage() {\n    return this.dataUsageCoordinator.loadLocal();\n  }\n\n  loadDirectoryAndGroups() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcile(),\n    );\n  }\n\n  loadDirectoryAndGroupsAfterMutation() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile_after_mutation\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcileAfterMutation(),\n    );\n  }\n\n  loadLocalDirectoryAndGroups() {\n    return this.readModelCoordinator.loadLocal();\n  }\n\n  loadGroupMembers(groupId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || groupId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return runtime.apiClient.listOrganizationGroupMembers(\n      organizationId,\n      groupId,\n    );\n  }\n\n  loadGroupPresentationDetails(groupId: string, beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: groupId,\n        objectKind: \"principal\",\n        operation: \"group.presentation.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        loadOrganizationGroupPresentationDetails({\n          groupId,\n          beforeVersion,\n          readModelCoordinator: this.readModelCoordinator,\n          runtime,\n        }),\n    );\n  }\n\n  loadGrants() {\n    return this.readModelCoordinator.loadLocalGrants();\n  }\n\n  loadGroupContainers(groupId: string) {\n    return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n  }\n\n  listLocalOrganizations() {\n    const runtime = this.runtimeService.workflowInput();\n    if (runtime.infra.dbStatus !== \"ready\") {\n      return Promise.resolve([]);\n    }\n\n    return listLocalOrganizations({ execSql: runtime.infra.execSql });\n  }\n\n  loadPolicyHistory() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.loadOrganizationPolicyHistory(),\n    );\n  }\n\n  loadUserDetail(userId: string) {\n    return this.readModelCoordinator.loadLocalUserDetail(userId);\n  }\n\n  updateRosterEntry(userId: string, profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || userId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationRosterEntry({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n      userId,\n    });\n  }\n\n  updateProfile(profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationProfile({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n    });\n  }\n\n  async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n    return removeUserFromOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  async revokeGrant(grant: OrganizationGrantRef) {\n    return revokeOrganizationGrant({\n      ...grant,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  startTrial(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      startOrganizationTrial,\n      organizationId,\n    );\n  }\n}\n"]}

package/client/organizations/organizationGroupHistory.js

@@ -0,0 +1,44 @@
+import { KeyingVerificationError } from "../../internal/crypto/index.js";
+import { assertProjectionVerificationCurrent } from "../../data/keyingProjectionVerification/types.js";
+import { loadLocalOrganizationPolicyReference } from "../../workflows/organizations/index.js";
+import { buildOrganizationGroupPolicyHistoryPage } from "../../workflows/organizations/groupPolicyHistoryPage.js";
+import { createRuntimePrincipalPolicyCurrentResolver } from "../../workflows/principals/runtimePolicyRecovery.js";
+/** Undefined means the host lacks paged recovery; a failed capability never downgrades. */
+export async function loadBoundedOrganizationGroupHistory(input) {
+    const { active } = input;
+    const resolve = createRuntimePrincipalPolicyCurrentResolver(active.runtime);
+    if (!resolve) {
+        if (input.beforeVersion !== undefined)
+            throw new KeyingVerificationError("invalid_shape", "This host cannot resolve a group history page cursor");
+        return undefined;
+    }
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    const reference = await loadLocalOrganizationPolicyReference({
+        currentUserId: active.userId,
+        execSql: active.runtime.infra.execSql,
+        organizationId: active.organizationId,
+        principalId: input.groupId,
+        principalType: "group",
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    if (!reference)
+        return null;
+    const resolved = await resolve({
+        organizationId: active.organizationId,
+        reference,
+        preferLocalCurrent: true,
+        stillCurrent: input.stillCurrent,
+        historyPage: input.beforeVersion === undefined
+            ? {}
+            : { beforeVersion: input.beforeVersion },
+    });
+    assertProjectionVerificationCurrent(input.stillCurrent);
+    if (!resolved.historyPage)
+        throw new Error("Verified history page is missing");
+    return buildOrganizationGroupPolicyHistoryPage({
+        page: resolved.historyPage,
+        groupId: input.groupId,
+        organizationId: active.organizationId,
+    });
+}
+//# sourceMappingURL=organizationGroupHistory.js.map

package/client/organizations/organizationGroupHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationGroupHistory.js","sourceRoot":"","sources":["organizationGroupHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,uCAAuC,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAG/G,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAKzD;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,2CAA2C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YACnC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sDAAsD,CACvD,CAAC;QACJ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,oCAAoC,CAAC;QAC3D,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS;QACT,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EACT,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;KAC7C,CAAC,CAAC;IACH,mCAAmC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,WAAW;QACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,OAAO,uCAAuC,CAAC;QAC7C,IAAI,EAAE,QAAQ,CAAC,WAAW;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { buildOrganizationGroupPolicyHistoryPage } from \"../../workflows/organizations/groupPolicyHistoryPage\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\n/** Undefined means the host lacks paged recovery; a failed capability never downgrades. */\nexport async function loadBoundedOrganizationGroupHistory(input: {\n  readonly active: ActiveOrganizationDataRuntime;\n  readonly groupId: string;\n  readonly beforeVersion?: number | undefined;\n  readonly stillCurrent: () => boolean;\n}) {\n  const { active } = input;\n  const resolve = createRuntimePrincipalPolicyCurrentResolver(active.runtime);\n  if (!resolve) {\n    if (input.beforeVersion !== undefined)\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"This host cannot resolve a group history page cursor\",\n      );\n    return undefined;\n  }\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  const reference = await loadLocalOrganizationPolicyReference({\n    currentUserId: active.userId,\n    execSql: active.runtime.infra.execSql,\n    organizationId: active.organizationId,\n    principalId: input.groupId,\n    principalType: \"group\",\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (!reference) return null;\n  const resolved = await resolve({\n    organizationId: active.organizationId,\n    reference,\n    preferLocalCurrent: true,\n    stillCurrent: input.stillCurrent,\n    historyPage:\n      input.beforeVersion === undefined\n        ? {}\n        : { beforeVersion: input.beforeVersion },\n  });\n  assertProjectionVerificationCurrent(input.stillCurrent);\n  if (!resolved.historyPage)\n    throw new Error(\"Verified history page is missing\");\n  return buildOrganizationGroupPolicyHistoryPage({\n    page: resolved.historyPage,\n    groupId: input.groupId,\n    organizationId: active.organizationId,\n  });\n}\n"]}

package/client/organizations/organizationGroupNameHydration.js

@@ -1,4 +1,5 @@
 import { loadLocalOrganizationPolicyReference } from "../../workflows/organizations/index.js";
+import { createSelectedCurrentGroupMetadataContainerVerifier } from "../../workflows/organizations/currentGroupMetadataAuthority.js";
 import { createRuntimeGroupMetadataAccess } from "../../workflows/organizations/groupMetadataRuntime.js";
 import { hydrateOrganizationGroupNames } from "../../workflows/organizations/organizationGroupNames.js";
 import { createRuntimePrincipalPolicyCurrentResolver } from "../../workflows/principals/runtimePolicyRecovery.js";
@@ -24,7 +25,12 @@ export async function hydrateOrganizationGroupNamesForRuntime(runtimeService, ac
                 principalType: "organization",
             }),
             reportSecurityIncident: active.runtime.util.reportSecurityIncident,
-            readEncryptedName: createRuntimeGroupMetadataAccess(active.runtime, active.organizationId, stillCurrent, currentRecovery).readName,
+            createCurrentNameReader: (authority) => createRuntimeGroupMetadataAccess(active.runtime, active.organizationId, stillCurrent, createSelectedCurrentGroupMetadataContainerVerifier({
+                authority,
+                organizationId: active.organizationId,
+                stillCurrent,
+            })).readName,
+            readEncryptedName: createRuntimeGroupMetadataAccess(active.runtime, active.organizationId, stillCurrent, undefined, currentRecovery).readName,
             resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,
             ...currentRecovery,
             stillCurrent,

package/client/organizations/organizationGroupNameHydration.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n  runtimeService: InternalRuntime,\n  active: ActiveOrganizationDataRuntime,\n  domainScope: DomainScope,\n  directoryAndGroups: OrganizationDirectoryAndGroups | null | undefined,\n) {\n  if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n    // Labels and their metadata root belong to this one reconciliation view.\n    const currentRecovery = {\n      resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n        active.runtime,\n      ),\n      recoveryBatch: {},\n    };\n    return hydrateOrganizationGroupNames({\n      apiClient: active.runtime.apiClient,\n      directory: directoryAndGroups,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n        currentUserId: active.userId,\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        principalId: active.organizationId,\n        principalType: \"organization\",\n      }),\n      reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n      readEncryptedName: createRuntimeGroupMetadataAccess(\n        active.runtime,\n        active.organizationId,\n        stillCurrent,\n        currentRecovery,\n      ).readName,\n      resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n      ...currentRecovery,\n      stillCurrent,\n    });\n  }\n  return directoryAndGroups;\n}\n"]}
+{"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n  runtimeService: InternalRuntime,\n  active: ActiveOrganizationDataRuntime,\n  domainScope: DomainScope,\n  directoryAndGroups: OrganizationDirectoryAndGroups | null | undefined,\n) {\n  if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n    // Labels and their metadata root belong to this one reconciliation view.\n    const currentRecovery = {\n      resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n        active.runtime,\n      ),\n      recoveryBatch: {},\n    };\n    return hydrateOrganizationGroupNames({\n      apiClient: active.runtime.apiClient,\n      directory: directoryAndGroups,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n        currentUserId: active.userId,\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        principalId: active.organizationId,\n        principalType: \"organization\",\n      }),\n      reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n      createCurrentNameReader: (authority) =>\n        createRuntimeGroupMetadataAccess(\n          active.runtime,\n          active.organizationId,\n          stillCurrent,\n          createSelectedCurrentGroupMetadataContainerVerifier({\n            authority,\n            organizationId: active.organizationId,\n            stillCurrent,\n          }),\n        ).readName,\n      readEncryptedName: createRuntimeGroupMetadataAccess(\n        active.runtime,\n        active.organizationId,\n        stillCurrent,\n        undefined,\n        currentRecovery,\n      ).readName,\n      resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n      ...currentRecovery,\n      stillCurrent,\n    });\n  }\n  return directoryAndGroups;\n}\n"]}

package/client/organizations/organizationGroupPresentation.d.ts

@@ -2,6 +2,7 @@ import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
 import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";
 export declare function loadOrganizationGroupPresentationDetails(input: {
     readonly groupId: string;
+    readonly beforeVersion?: number | undefined;
     readonly readModelCoordinator: OrganizationReadModelCoordinator;
     readonly runtime: InternalWorkflowRuntimeInput;
 }): Promise<{

package/client/organizations/organizationGroupPresentation.js

@@ -1,3 +1,4 @@
+import { ProjectionDependencyUnavailableError } from "../../data/keyingProjectionVerification/dependencyUnavailable.js";
 export async function loadOrganizationGroupPresentationDetails(input) {
     const organizationId = input.runtime.auth.organizationId;
     if (!input.runtime.auth.isAuthenticated ||
@@ -9,8 +10,21 @@ export async function loadOrganizationGroupPresentationDetails(input) {
         };
     }
     const [members, policyHistory] = await Promise.all([
-        input.readModelCoordinator.loadLocalGroupMembers(input.groupId, organizationId),
-        input.readModelCoordinator.loadGroupPolicyHistory(input.groupId, organizationId),
+        input.beforeVersion === undefined
+            ? input.readModelCoordinator.loadLocalGroupMembers(input.groupId, organizationId)
+            : Promise.resolve(null),
+        input.readModelCoordinator
+            .loadGroupPolicyHistory(input.groupId, organizationId, input.beforeVersion)
+            .catch((error) => {
+            // Missing history must not hide the independent member projection.
+            // Older-page failures remain explicit so the caller can retry them.
+            if (input.beforeVersion === undefined &&
+                error instanceof ProjectionDependencyUnavailableError) {
+                input.runtime.util.logError("Group history is unavailable", error);
+                return null;
+            }
+            throw error;
+        }),
     ]);
     return { members, policyHistory };
 }

package/client/organizations/organizationGroupPresentation.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationGroupPresentation.js","sourceRoot":"","sources":["organizationGroupPresentation.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAI9D;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,cAAc;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CACf;QACD,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CAC/C,KAAK,CAAC,OAAO,EACb,cAAc,CACf;KACF,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport async function loadOrganizationGroupPresentationDetails(input: {\n  readonly groupId: string;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const organizationId = input.runtime.auth.organizationId;\n  if (\n    !input.runtime.auth.isAuthenticated ||\n    !organizationId ||\n    input.groupId.length === 0\n  ) {\n    return {\n      members: null,\n      policyHistory: null,\n    };\n  }\n\n  const [members, policyHistory] = await Promise.all([\n    input.readModelCoordinator.loadLocalGroupMembers(\n      input.groupId,\n      organizationId,\n    ),\n    input.readModelCoordinator.loadGroupPolicyHistory(\n      input.groupId,\n      organizationId,\n    ),\n  ]);\n  return { members, policyHistory };\n}\n"]}
+{"version":3,"file":"organizationGroupPresentation.js","sourceRoot":"","sources":["organizationGroupPresentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AAIrH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAK9D;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,cAAc;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CACf;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,KAAK,CAAC,oBAAoB;aACvB,sBAAsB,CACrB,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,aAAa,CACpB;aACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,mEAAmE;YACnE,oEAAoE;YACpE,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;gBACjC,KAAK,YAAY,oCAAoC,EACrD,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;KACL,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport async function loadOrganizationGroupPresentationDetails(input: {\n  readonly groupId: string;\n  readonly beforeVersion?: number | undefined;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const organizationId = input.runtime.auth.organizationId;\n  if (\n    !input.runtime.auth.isAuthenticated ||\n    !organizationId ||\n    input.groupId.length === 0\n  ) {\n    return {\n      members: null,\n      policyHistory: null,\n    };\n  }\n\n  const [members, policyHistory] = await Promise.all([\n    input.beforeVersion === undefined\n      ? input.readModelCoordinator.loadLocalGroupMembers(\n          input.groupId,\n          organizationId,\n        )\n      : Promise.resolve(null),\n    input.readModelCoordinator\n      .loadGroupPolicyHistory(\n        input.groupId,\n        organizationId,\n        input.beforeVersion,\n      )\n      .catch((error: unknown) => {\n        // Missing history must not hide the independent member projection.\n        // Older-page failures remain explicit so the caller can retry them.\n        if (\n          input.beforeVersion === undefined &&\n          error instanceof ProjectionDependencyUnavailableError\n        ) {\n          input.runtime.util.logError(\"Group history is unavailable\", error);\n          return null;\n        }\n        throw error;\n      }),\n  ]);\n  return { members, policyHistory };\n}\n"]}

package/client/organizations/organizationReadModels.d.ts

@@ -3,7 +3,7 @@ import type { InternalRuntime } from "../workflowRuntime.js";
 export interface OrganizationReadModelCoordinator {
     loadLocal(organizationId?: string | undefined): Promise<OrganizationDirectoryAndGroups | null>;
     loadLocalGroupMembers(groupId: string, organizationId?: string | undefined): Promise<OrganizationGroupMembers | null>;
-    loadGroupPolicyHistory(groupId: string, organizationId?: string | undefined): Promise<OrganizationGroupPolicyHistory | null>;
+    loadGroupPolicyHistory(groupId: string, organizationId?: string | undefined, beforeVersion?: number | undefined): Promise<OrganizationGroupPolicyHistory | null>;
     loadOrganizationPolicyHistory(organizationId?: string | undefined): Promise<OrganizationPolicyHistory | null>;
     loadLocalGrants(organizationId?: string | undefined): Promise<OrganizationContainerGrants | null>;
     loadLocalGroupContainers(groupId: string, organizationId?: string | undefined): Promise<OrganizationGroupContainers | null>;

package/client/organizations/organizationReadModels.js

@@ -3,6 +3,7 @@ import { loadPolicyHistoryDetails } from "../../workflows/organizations/loadPoli
 import { organizationAccessScopeKey, wasOrganizationPresentationAccessDeniedByServer, } from "../../workflows/organizations/organizationPresentationAccessState.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../workflows/principals/runtimePolicyWarmer.js";
 import { recoverOrganizationAccess } from "./organizationAccessRestoration.js";
+import { loadBoundedOrganizationGroupHistory } from "./organizationGroupHistory.js";
 import { hydrateOrganizationGroupNamesForRuntime } from "./organizationGroupNameHydration.js";
 import { activeOrganizationDataRuntime, isOrganizationDataRuntimeCurrent, } from "./organizationWorkflowRuntime.js";
 const coordinatorsByRuntime = new WeakMap();
@@ -137,11 +138,20 @@ class OrganizationReadModelCoordinatorImpl {
             organizationId: active.organizationId,
         });
     }
-    async loadGroupPolicyHistory(groupId, organizationId) {
+    async loadGroupPolicyHistory(groupId, organizationId, beforeVersion) {
         const active = activeOrganizationDataRuntime(this.runtimeService, organizationId);
         if (!active || groupId.length === 0) {
             return null;
         }
+        const domainScope = active.runtime.state.domainScope;
+        const bounded = await loadBoundedOrganizationGroupHistory({
+            active,
+            groupId,
+            beforeVersion,
+            stillCurrent: () => isOrganizationDataRuntimeCurrent(this.runtimeService, active, domainScope),
+        });
+        if (bounded !== undefined)
+            return bounded;
         return this.loadPolicyHistoryAfterWarm({
             active,
             loadLocal: () => loadLocalOrganizationGroupPolicyHistory({