npm - @tearleads/client-sdk - Versions diffs - 0.1.16 → 0.1.17 - Mend

@tearleads/client-sdk 0.1.16 → 0.1.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (128) hide show

package/client/organizations/organizationReadModels.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAClG,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA4CJ,MAAM,oCAAoC;IAYX;IATZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACa,oBAAoB,GAAG,IAAI,OAAO,EAGhD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CAAC,MAAqC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,MAAqC,EACrC,SAEC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACrH,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,kCAAkC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjE,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC/B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,0BAA0B,CAAU,KAKjD;QACC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,qDAAqD,EACrD,KAAK,CACN,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAEH,CAAC;QACF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,oCAAoC,CAAC;gBACrD,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;gBAClC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC3C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,oDAAoD,EACpD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,uDAAuD,EACvD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,OAAe,EAAE,cAAuB;QACnE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,0BAA0B,CAAC;YACrC,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,CACd,uCAAuC,CAAC;gBACtC,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,OAAO;gBACP,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;YACJ,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,cAAuB;QACzD,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC;YACpD,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,CACd,kCAAkC,CAAC;gBACjC,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;YACJ,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,wBAAwB,CAAC;YAC9B,WAAW;YACX,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO;YACP,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;YACH,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupMembers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n type OrganizationContainerGrants,\n type OrganizationDirectoryAndGroups,\n type OrganizationGroupContainers,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationPolicyHistory,\n type OrganizationUserDetail,\n reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport { loadPolicyHistoryDetails } from \"../../workflows/organizations/loadPolicyHistoryDetails\";\nimport {\n organizationAccessScopeKey,\n wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null>;\n loadLocalGroupMembers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupMembers \| null>;\n loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupPolicyHistory \| null>;\n loadOrganizationPolicyHistory(\n organizationId?: string \| undefined,\n ): Promise<OrganizationPolicyHistory \| null>;\n loadLocalGrants(\n organizationId?: string \| undefined,\n ): Promise<OrganizationContainerGrants \| null>;\n loadLocalGroupContainers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupContainers \| null>;\n loadLocalUserDetail(\n userId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationUserDetail \| null>;\n /*\n Resolves `undefined` when the runtime declines without I/O (offline,\n * database not ready, organization mismatch) or when the feed failed with\n * no locally retained projection — passes that must not count as caught\n * up; `null` when the reconcile completed but produced nothing presentable\n * — including an authoritative denial that purged the projection, which\n * consumers must repaint.\n */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n reconcileAfterMutation(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n implements OrganizationReadModelCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDirectoryAndGroups \| null \| undefined>>\n >();\n private readonly policyWarmersByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<void>>\n >();\n\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n private policyWarmerMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.policyWarmersByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.policyWarmersByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n private async warmPolicyReference(\n active: ActiveOrganizationDataRuntime,\n reference: NonNullable<\n Awaited<ReturnType<typeof loadLocalOrganizationPolicyReference>>\n >,\n ): Promise<void> {\n if (!active.runtime.state.online) {\n return;\n }\n const byKey = this.policyWarmerMap(active);\n const key = `${active.organizationId}\\0${reference.principalType}\\0${reference.principalId}\\0${reference.stateHash}`;\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n const warming = createRuntimePrincipalPolicyWarmer(active.runtime)({\n organizationId: active.organizationId,\n references: [reference],\n }).finally(() => {\n if (byKey.get(key) === warming) {\n byKey.delete(key);\n }\n });\n byKey.set(key, warming);\n return warming;\n }\n\n private async loadPolicyHistoryAfterWarm<History>(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly loadLocal: () => Promise<History \| null>;\n readonly principalId: string;\n readonly principalType: \"group\" \| \"organization\";\n }): Promise<History \| null> {\n try {\n const local = await input.loadLocal();\n if (local) {\n return local;\n }\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to load verified organization policy history\",\n error,\n );\n }\n if (!input.active.runtime.state.online) {\n return null;\n }\n\n let reference: Awaited<\n ReturnType<typeof loadLocalOrganizationPolicyReference>\n >;\n try {\n reference = await loadLocalOrganizationPolicyReference({\n currentUserId: input.active.userId,\n execSql: input.active.runtime.infra.execSql,\n organizationId: input.active.organizationId,\n principalId: input.principalId,\n principalType: input.principalType,\n });\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to load organization policy-head projection\",\n error,\n );\n return null;\n }\n if (!reference) {\n return null;\n }\n\n await this.warmPolicyReference(input.active, reference);\n try {\n return await input.loadLocal();\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to reload verified organization policy history\",\n error,\n );\n return null;\n }\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationDirectoryAndGroups({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGrants(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationContainerGrants({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupContainers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupMembers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadGroupPolicyHistory(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return this.loadPolicyHistoryAfterWarm({\n active,\n loadLocal: () =>\n loadLocalOrganizationGroupPolicyHistory({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n }),\n principalId: groupId,\n principalType: \"group\",\n });\n }\n\n async loadOrganizationPolicyHistory(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n const history = await this.loadPolicyHistoryAfterWarm({\n active,\n loadLocal: () =>\n loadLocalOrganizationPolicyHistory({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n }),\n principalId: active.organizationId,\n principalType: \"organization\",\n });\n if (!history \|\| !active.runtime.state.online) return history;\n const domainScope = active.runtime.state.domainScope;\n return loadPolicyHistoryDetails({\n domainScope,\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n history,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n logError: active.runtime.util.logError,\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n });\n }\n\n async loadLocalUserDetail(userId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| userId.length === 0) {\n return null;\n }\n return loadLocalOrganizationUserDetail({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n userId,\n });\n }\n\n reconcile(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return Promise.resolve(undefined);\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n // Snapshot the server-denied flag before reconciling. A reconcile that\n // flips it back to readable means org access was just restored (e.g. the\n // user was re-added to a group), and any write lanes idled by\n // permission-denied submissions have no self re-arm — regaining access is\n // their retry signal, mirroring how billing recovery re-requests all\n // lanes. Only a genuine server denial counts: a local session reset also\n // marks scopes denied, and re-arming on its first reconcile would race the\n // startup sync passes (e.g. pending-create adoption between panes).\n const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n {\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n },\n \"readModel\",\n );\n const domainScope = active.runtime.state.domainScope;\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n );\n\n const reconciliation = reconcileOrganizationDirectoryAndGroups({\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n })\n .then(async (directoryAndGroups) => {\n if (!stillCurrent()) return null;\n // Feed success restores retry eligibility even if name decryption fails.\n const accessWasRestored =\n accessWasDenied &&\n directoryAndGroups !== null &&\n directoryAndGroups !== undefined;\n if (accessWasRestored)\n await recoverOrganizationAccess({\n active,\n domainScope,\n stillCurrent,\n });\n if (!stillCurrent()) return null;\n return hydrateOrganizationGroupNamesForRuntime(\n this.runtimeService,\n active,\n domainScope,\n directoryAndGroups,\n );\n })\n .finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n\n async reconcileAfterMutation(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return undefined;\n }\n const existing = this.reconciliationMap(active).get(\n organizationAccessScopeKey(active.organizationId, active.userId),\n );\n if (existing) {\n await existing.catch(() => null);\n }\n return this.reconcile(active.organizationId);\n }\n}\n\nexport function createOrganizationReadModelCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}
1	+ {"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,uCAAuC,EACvC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAClG,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA6CJ,MAAM,oCAAoC;IAYX;IATZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACa,oBAAoB,GAAG,IAAI,OAAO,EAGhD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CAAC,MAAqC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,MAAqC,EACrC,SAEC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACrH,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,kCAAkC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjE,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC/B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,0BAA0B,CAAU,KAKjD;QACC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,qDAAqD,EACrD,KAAK,CACN,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAEH,CAAC;QACF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,oCAAoC,CAAC;gBACrD,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;gBAClC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC3C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC3C,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,oDAAoD,EACpD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAChC,uDAAuD,EACvD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;YACxD,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC1C,OAAO,IAAI,CAAC,0BAA0B,CAAC;YACrC,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,CACd,uCAAuC,CAAC;gBACtC,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,OAAO;gBACP,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;YACJ,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,cAAuB;QACzD,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC;YACpD,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,CACd,kCAAkC,CAAC;gBACjC,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;YACJ,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,wBAAwB,CAAC;YAC9B,WAAW;YACX,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO;YACP,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;YACH,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupMembers,\n loadLocalOrganizationGroupPolicyHistory,\n loadLocalOrganizationPolicyHistory,\n loadLocalOrganizationPolicyReference,\n loadLocalOrganizationUserDetail,\n type OrganizationContainerGrants,\n type OrganizationDirectoryAndGroups,\n type OrganizationGroupContainers,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationPolicyHistory,\n type OrganizationUserDetail,\n reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport { loadPolicyHistoryDetails } from \"../../workflows/organizations/loadPolicyHistoryDetails\";\nimport {\n organizationAccessScopeKey,\n wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null>;\n loadLocalGroupMembers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupMembers \| null>;\n loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationGroupPolicyHistory \| null>;\n loadOrganizationPolicyHistory(\n organizationId?: string \| undefined,\n ): Promise<OrganizationPolicyHistory \| null>;\n loadLocalGrants(\n organizationId?: string \| undefined,\n ): Promise<OrganizationContainerGrants \| null>;\n loadLocalGroupContainers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupContainers \| null>;\n loadLocalUserDetail(\n userId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationUserDetail \| null>;\n /*\n Resolves `undefined` when the runtime declines without I/O (offline,\n * database not ready, organization mismatch) or when the feed failed with\n * no locally retained projection — passes that must not count as caught\n * up; `null` when the reconcile completed but produced nothing presentable\n * — including an authoritative denial that purged the projection, which\n * consumers must repaint.\n */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n reconcileAfterMutation(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n implements OrganizationReadModelCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDirectoryAndGroups \| null \| undefined>>\n >();\n private readonly policyWarmersByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<void>>\n >();\n\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n private policyWarmerMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.policyWarmersByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.policyWarmersByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n private async warmPolicyReference(\n active: ActiveOrganizationDataRuntime,\n reference: NonNullable<\n Awaited<ReturnType<typeof loadLocalOrganizationPolicyReference>>\n >,\n ): Promise<void> {\n if (!active.runtime.state.online) {\n return;\n }\n const byKey = this.policyWarmerMap(active);\n const key = `${active.organizationId}\\0${reference.principalType}\\0${reference.principalId}\\0${reference.stateHash}`;\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n const warming = createRuntimePrincipalPolicyWarmer(active.runtime)({\n organizationId: active.organizationId,\n references: [reference],\n }).finally(() => {\n if (byKey.get(key) === warming) {\n byKey.delete(key);\n }\n });\n byKey.set(key, warming);\n return warming;\n }\n\n private async loadPolicyHistoryAfterWarm<History>(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly loadLocal: () => Promise<History \| null>;\n readonly principalId: string;\n readonly principalType: \"group\" \| \"organization\";\n }): Promise<History \| null> {\n try {\n const local = await input.loadLocal();\n if (local) {\n return local;\n }\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to load verified organization policy history\",\n error,\n );\n }\n if (!input.active.runtime.state.online) {\n return null;\n }\n\n let reference: Awaited<\n ReturnType<typeof loadLocalOrganizationPolicyReference>\n >;\n try {\n reference = await loadLocalOrganizationPolicyReference({\n currentUserId: input.active.userId,\n execSql: input.active.runtime.infra.execSql,\n organizationId: input.active.organizationId,\n principalId: input.principalId,\n principalType: input.principalType,\n });\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to load organization policy-head projection\",\n error,\n );\n return null;\n }\n if (!reference) {\n return null;\n }\n\n await this.warmPolicyReference(input.active, reference);\n try {\n return await input.loadLocal();\n } catch (error) {\n input.active.runtime.util.logError(\n \"Failed to reload verified organization policy history\",\n error,\n );\n return null;\n }\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationDirectoryAndGroups({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGrants(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationContainerGrants({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupContainers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupMembers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n const domainScope = active.runtime.state.domainScope;\n const bounded = await loadBoundedOrganizationGroupHistory({\n active,\n groupId,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n if (bounded !== undefined) return bounded;\n return this.loadPolicyHistoryAfterWarm({\n active,\n loadLocal: () =>\n loadLocalOrganizationGroupPolicyHistory({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n }),\n principalId: groupId,\n principalType: \"group\",\n });\n }\n\n async loadOrganizationPolicyHistory(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n const history = await this.loadPolicyHistoryAfterWarm({\n active,\n loadLocal: () =>\n loadLocalOrganizationPolicyHistory({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n }),\n principalId: active.organizationId,\n principalType: \"organization\",\n });\n if (!history \|\| !active.runtime.state.online) return history;\n const domainScope = active.runtime.state.domainScope;\n return loadPolicyHistoryDetails({\n domainScope,\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n history,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n logError: active.runtime.util.logError,\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n });\n }\n\n async loadLocalUserDetail(userId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| userId.length === 0) {\n return null;\n }\n return loadLocalOrganizationUserDetail({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n userId,\n });\n }\n\n reconcile(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return Promise.resolve(undefined);\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n // Snapshot the server-denied flag before reconciling. A reconcile that\n // flips it back to readable means org access was just restored (e.g. the\n // user was re-added to a group), and any write lanes idled by\n // permission-denied submissions have no self re-arm — regaining access is\n // their retry signal, mirroring how billing recovery re-requests all\n // lanes. Only a genuine server denial counts: a local session reset also\n // marks scopes denied, and re-arming on its first reconcile would race the\n // startup sync passes (e.g. pending-create adoption between panes).\n const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n {\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n },\n \"readModel\",\n );\n const domainScope = active.runtime.state.domainScope;\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n );\n\n const reconciliation = reconcileOrganizationDirectoryAndGroups({\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n })\n .then(async (directoryAndGroups) => {\n if (!stillCurrent()) return null;\n // Feed success restores retry eligibility even if name decryption fails.\n const accessWasRestored =\n accessWasDenied &&\n directoryAndGroups !== null &&\n directoryAndGroups !== undefined;\n if (accessWasRestored)\n await recoverOrganizationAccess({\n active,\n domainScope,\n stillCurrent,\n });\n if (!stillCurrent()) return null;\n return hydrateOrganizationGroupNamesForRuntime(\n this.runtimeService,\n active,\n domainScope,\n directoryAndGroups,\n );\n })\n .finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n\n async reconcileAfterMutation(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return undefined;\n }\n const existing = this.reconciliationMap(active).get(\n organizationAccessScopeKey(active.organizationId, active.userId),\n );\n if (existing) {\n await existing.catch(() => null);\n }\n return this.reconcile(active.organizationId);\n }\n}\n\nexport function createOrganizationReadModelCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}

package/client/organizations/organizationsTypes.d.ts CHANGED Viewed

@@ -1,17 +1,20 @@
 import type { NativeSubscriptionStore } from "../../internal/validators/billing.js";
-import type { addOrganizationGroupUser, cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, removeOrganizationGroupUser, revokeOrganizationContainerGrant, rotateOrganizationGroupForAccessSetShrink, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
+import type { PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
+import type { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, revokeOrganizationContainerGrant, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
 import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
 import type { OrganizationDataUsageCoordinator } from "./organizationDataUsage.js";
 import type { loadOrganizationGroupPresentationDetails } from "./organizationGroupPresentation.js";
 import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";
 import type { AbandonOrganizationPolicyMutationInput, DiscardUnreadableOrganizationPolicyMutationInput, readPendingOrganizationPolicyMutation } from "./principalMutationRecovery.js";
 import type { AddOrganizationGroupUserInput, deleteGroupForOrganization, OrganizationGrantRef, RemoveOrganizationGroupUserInput } from "./principalMutations.js";
+/** Exact current artifacts and container receipts; no historical prefix. */
+export type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;
 export interface Organizations {
     discardUnreadablePolicyMutation: (input: DiscardUnreadableOrganizationPolicyMutationInput) => Promise<boolean>;
     readPendingPolicyMutation: (organizationId: string) => ReturnType<typeof readPendingOrganizationPolicyMutation>;
     retryPendingPolicyMutation: (organizationId: string) => Promise<void>;
     abandonPendingPolicyMutation: (input: AbandonOrganizationPolicyMutationInput) => Promise<boolean>;
-    addUserToGroup: (input: AddOrganizationGroupUserInput) => ReturnType<typeof addOrganizationGroupUser>;
+    addUserToGroup: (input: AddOrganizationGroupUserInput) => Promise<OrganizationGroupMutationReceipt>;
     createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;
     deleteGroup: (groupId: string) => ReturnType<typeof deleteGroupForOrganization>;
     importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;
@@ -33,7 +36,7 @@ export interface Organizations {
     loadDirectoryAndGroupsAfterMutation: () => ReturnType<OrganizationReadModelCoordinator["reconcileAfterMutation"]>;
     loadLocalDirectoryAndGroups: () => ReturnType<OrganizationReadModelCoordinator["loadLocal"]>;
     loadGroupMembers: (groupId: string) => ReturnType<InternalWorkflowRuntimeInput["apiClient"]["listOrganizationGroupMembers"]>;
-    loadGroupPresentationDetails(groupId: string): ReturnType<typeof loadOrganizationGroupPresentationDetails>;
+    loadGroupPresentationDetails(groupId: string, beforeVersion?: number): ReturnType<typeof loadOrganizationGroupPresentationDetails>;
     loadGroupContainers: (groupId: string) => ReturnType<OrganizationReadModelCoordinator["loadLocalGroupContainers"]>;
     loadGrants: () => ReturnType<OrganizationReadModelCoordinator["loadLocalGrants"]>;
     listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;
@@ -41,7 +44,7 @@ export interface Organizations {
     loadUserDetail: (userId: string) => ReturnType<OrganizationReadModelCoordinator["loadLocalUserDetail"]>;
     updateRosterEntry: (userId: string, profileDocumentId: string | null) => ReturnType<typeof updateOrganizationRosterEntry>;
     updateProfile: (profileDocumentId: string | null) => ReturnType<typeof updateOrganizationProfile>;
-    removeUserFromGroup: (input: RemoveOrganizationGroupUserInput) => ReturnType<typeof removeOrganizationGroupUser>;
-    revokeGrant: (grant: OrganizationGrantRef) => Promise<Awaited<ReturnType<typeof revokeOrganizationContainerGrant>> | Awaited<ReturnType<typeof rotateOrganizationGroupForAccessSetShrink>>>;
+    removeUserFromGroup: (input: RemoveOrganizationGroupUserInput) => Promise<OrganizationGroupMutationReceipt>;
+    revokeGrant: (grant: OrganizationGrantRef) => Promise<Awaited<ReturnType<typeof revokeOrganizationContainerGrant>> | OrganizationGroupMutationReceipt>;
     startTrial: (organizationId?: string) => ReturnType<typeof startOrganizationTrial>;
 }

package/client/organizations/organizationsTypes.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type {\n ~~addOrganizationGroupUser,\n~~ cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createOrganizationGroup,\n createStripeCheckout,\n createStripeCheckoutSession,\n importOrganizationUser,\n LocalOrganizationSummary,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n ~~removeOrganizationGroupUser,\n~~ revokeOrganizationContainerGrant,\n ~~rotateOrganizationGroupForAccessSetShrink,\n~~ startOrganizationTrial,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n AbandonOrganizationPolicyMutationInput,\n DiscardUnreadableOrganizationPolicyMutationInput,\n readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n AddOrganizationGroupUserInput,\n deleteGroupForOrganization,\n OrganizationGrantRef,\n RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport interface Organizations {\n discardUnreadablePolicyMutation: (\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n readPendingPolicyMutation: (\n organizationId: string,\n ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n abandonPendingPolicyMutation: (\n input: AbandonOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n addUserToGroup: (\n input: AddOrganizationGroupUserInput,\n ) => ~~ReturnType~~<~~typeof addOrganizationGroupUser~~>;\n createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n deleteGroup: (\n groupId: string,\n ) => ReturnType<typeof deleteGroupForOrganization>;\n importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n /** Billing for an organization the session is not currently switched to. /\n loadBillingForOrganization: (\n organizationId: string,\n ) => ReturnType<typeof loadOrganizationBilling>;\n loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n loadBillingManagementUrl: () => ReturnType<\n typeof loadOrganizationBillingManagementUrl\n >;\n /* Direct Stripe checkout (issue #1654): options, start, and cancel. */\n loadStripeCheckoutOptions: (\n organizationId?: string,\n ) => ReturnType<typeof loadStripeCheckoutOptions>;\n createStripeCheckout: (\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckout>;\n createStripeCheckoutSession: (\n returnUrl: string,\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckoutSession>;\n cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n claimNativeSubscription: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n checkNativePurchaseEligibility: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof checkNativePurchaseEligibility>;\n loadDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"reconcile\"]\n >;\n loadLocalDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"loadLocal\"]\n >;\n loadDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcile\"]\n >;\n loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n >;\n loadLocalDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocal\"]\n >;\n loadGroupMembers: (\n groupId: string,\n ) => ReturnType<\n InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n >;\n loadGroupPresentationDetails(\n groupId: string,\n ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n loadGroupContainers: (\n groupId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n loadGrants: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n >;\n listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n loadPolicyHistory: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n >;\n loadUserDetail: (\n userId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n updateRosterEntry: (\n userId: string,\n profileDocumentId: string \| null,\n ) => ReturnType<typeof updateOrganizationRosterEntry>;\n updateProfile: (\n profileDocumentId: string \| null,\n ) => ReturnType<typeof updateOrganizationProfile>;\n removeUserFromGroup: (\n input: RemoveOrganizationGroupUserInput,\n ) => ~~ReturnType~~<~~typeof removeOrganizationGroupUser~~>;\n revokeGrant: (\n grant: OrganizationGrantRef,\n ) => Promise<\n \| Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n \| ~~Awaited<ReturnType<typeof rotateOrganizationGroupForAccessSetShrink>>\~~n >;\n startTrial: (\n organizationId?: string,\n ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}
1	+ {"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createOrganizationGroup,\n createStripeCheckout,\n createStripeCheckoutSession,\n importOrganizationUser,\n LocalOrganizationSummary,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n revokeOrganizationContainerGrant,\n startOrganizationTrial,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n AbandonOrganizationPolicyMutationInput,\n DiscardUnreadableOrganizationPolicyMutationInput,\n readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n AddOrganizationGroupUserInput,\n deleteGroupForOrganization,\n OrganizationGrantRef,\n RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. /\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n discardUnreadablePolicyMutation: (\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n readPendingPolicyMutation: (\n organizationId: string,\n ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n abandonPendingPolicyMutation: (\n input: AbandonOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n addUserToGroup: (\n input: AddOrganizationGroupUserInput,\n ) => Promise<OrganizationGroupMutationReceipt>;\n createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n deleteGroup: (\n groupId: string,\n ) => ReturnType<typeof deleteGroupForOrganization>;\n importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n /* Billing for an organization the session is not currently switched to. /\n loadBillingForOrganization: (\n organizationId: string,\n ) => ReturnType<typeof loadOrganizationBilling>;\n loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n loadBillingManagementUrl: () => ReturnType<\n typeof loadOrganizationBillingManagementUrl\n >;\n /* Direct Stripe checkout (issue #1654): options, start, and cancel. */\n loadStripeCheckoutOptions: (\n organizationId?: string,\n ) => ReturnType<typeof loadStripeCheckoutOptions>;\n createStripeCheckout: (\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckout>;\n createStripeCheckoutSession: (\n returnUrl: string,\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckoutSession>;\n cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n claimNativeSubscription: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n checkNativePurchaseEligibility: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof checkNativePurchaseEligibility>;\n loadDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"reconcile\"]\n >;\n loadLocalDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"loadLocal\"]\n >;\n loadDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcile\"]\n >;\n loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n >;\n loadLocalDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocal\"]\n >;\n loadGroupMembers: (\n groupId: string,\n ) => ReturnType<\n InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n >;\n loadGroupPresentationDetails(\n groupId: string,\n beforeVersion?: number,\n ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n loadGroupContainers: (\n groupId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n loadGrants: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n >;\n listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n loadPolicyHistory: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n >;\n loadUserDetail: (\n userId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n updateRosterEntry: (\n userId: string,\n profileDocumentId: string \| null,\n ) => ReturnType<typeof updateOrganizationRosterEntry>;\n updateProfile: (\n profileDocumentId: string \| null,\n ) => ReturnType<typeof updateOrganizationProfile>;\n removeUserFromGroup: (\n input: RemoveOrganizationGroupUserInput,\n ) => Promise<OrganizationGroupMutationReceipt>;\n revokeGrant: (\n grant: OrganizationGrantRef,\n ) => Promise<\n \| Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n \| OrganizationGroupMutationReceipt\n >;\n startTrial: (\n organizationId?: string,\n ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}

package/client/organizations/principalContainerMutations.js CHANGED Viewed

@@ -9,6 +9,7 @@ export async function preparePrincipalContainerMutations(input) {
     }
     return preparePrincipalContainerRematerializationBatch({
         stillCurrent: input.stillCurrent,
+        recitationStillCurrent: input.recitationStillCurrent,
         reportSecurityIncident: input.runtime.util.reportSecurityIncident,
         apiClient: input.runtime.apiClient,
         author,
@@ -18,6 +19,7 @@ export async function preparePrincipalContainerMutations(input) {
         ],
         groupId: input.groupId,
         nextPolicy: input.nextPolicy,
+        resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,
         revokedContainerId: input.revokedContainerId,
         resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,
         targetSecretKey,

package/client/organizations/principalContainerMutations.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"~~AAEA~~,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,~~KAQxD~~;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ~~VerifiedPrincipalPolicy~~ } from \"@tearleads/~~crypto~~\";\nimport type { ~~PrincipalPolicyBundleResponse~~ } from \"~~@tearleads~~/~~validators~~/~~response~~\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n type PreparedPrincipalContainerRematerializationBatch,\n preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly groupId: string;\n readonly nextPolicy: ~~VerifiedPrincipalPolicy~~;\n readonly organizationId: string;\n readonly revokedContainerId?: string \| undefined;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n const author = resolveDocumentCreateAuthor(input.runtime);\n const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !targetSecretKey) {\n throw new Error(\n \"Organization container rematerialization context is unavailable\",\n );\n }\n return preparePrincipalContainerRematerializationBatch({\n stillCurrent: input.stillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n author,\n execSql: input.runtime.infra.execSql,\n grants: [\n ...new Map(\n [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n (grant) => [grant.containerId, grant] as const,\n ),\n ).values(),\n ],\n groupId: input.groupId,\n nextPolicy: input.nextPolicy,\n revokedContainerId: input.revokedContainerId,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n}\n"]}
1	+ {"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAYxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n type PreparedPrincipalContainerRematerializationBatch,\n preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n readonly groupId: string;\n readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n readonly resolveAuthoredPolicyReferences?:\n \| CurrentPolicyReferenceResolver\n \| undefined;\n readonly organizationId: string;\n readonly revokedContainerId?: string \| undefined;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n readonly recitationStillCurrent?: (() => boolean) \| undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n const author = resolveDocumentCreateAuthor(input.runtime);\n const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !targetSecretKey) {\n throw new Error(\n \"Organization container rematerialization context is unavailable\",\n );\n }\n return preparePrincipalContainerRematerializationBatch({\n stillCurrent: input.stillCurrent,\n recitationStillCurrent: input.recitationStillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n author,\n execSql: input.runtime.infra.execSql,\n grants: [\n ...new Map(\n [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n (grant) => [grant.containerId, grant] as const,\n ),\n ).values(),\n ],\n groupId: input.groupId,\n nextPolicy: input.nextPolicy,\n resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n revokedContainerId: input.revokedContainerId,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n}\n"]}

package/client/organizations/principalMutations.d.ts CHANGED Viewed

@@ -24,108 +24,6 @@ interface PrincipalMutationRuntime {
     readonly runtime: InternalWorkflowRuntimeInput;
 }
 export declare function addUserToOrganizationGroup(input: PrincipalMutationRuntime & AddOrganizationGroupUserInput): Promise<{
-    previousStates: {
-        grants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        projection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        state: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
-    }[];
-    currentGrants: {
-        accessLevel: "admin" | "read" | "write";
-        containerId: string;
-    }[];
-    currentMemberEnvelopes: {
-        envelopes: {
-            kemCipherText: string;
-            memberKeyFingerprint: string;
-            userId: string;
-            wrappedKey: string;
-        }[];
-        epoch: number;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentPayload: {
-        cipherSuite: "aes-256-gcm";
-        ciphertext: string;
-        ciphertextHash: string;
-        createdAt: string;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentProjection: {
-        role: "member" | "admin";
-        userId: string;
-    }[];
-    currentState: {
-        createdAt: string;
-        encapsulationPublicKey: string;
-        externalAuthority: {
-            keyEpoch: number;
-            keyFingerprint: string;
-            principalId: string;
-            principalType: "group";
-            stateHash: string;
-            version: number;
-        } | null;
-        grantCount: number;
-        grantRoot: string;
-        keyEpoch: number;
-        keyFingerprint: string;
-        memberCount: number;
-        memberEnvelopesRoot: string;
-        membershipMode: "projection";
-        membershipRoot: string;
-        payloadCiphertextHash: string;
-        prevStateHash: string | null;
-        principalId: string;
-        principalType: "group" | "organization";
-        projectionRoot: string;
-        signature: string;
-        signedAt: string;
-        signerUserId: string;
-        signerUserKeyFingerprint: string;
-        stateHash: string;
-        version: number;
-    };
-} & {
     containerMutations: {
         createdAt: string;
         manifestHead: {
@@ -250,10 +148,12 @@ export declare function addUserToOrganizationGroup(input: PrincipalMutationRunti
 export declare function createGroupForOrganization(input: {
     readonly name: string;
     readonly runtime: InternalWorkflowRuntimeInput;
+    readonly stillCurrent: () => boolean;
 }): Promise<import("./index.js").OrganizationGroupSummary>;
 export declare function deleteGroupForOrganization(input: {
     readonly groupId: string;
     readonly runtime: InternalWorkflowRuntimeInput;
+    readonly stillCurrent: () => boolean;
 }): Promise<{
     deleted: true;
     groupId: string;
@@ -382,108 +282,6 @@ export declare function deleteGroupForOrganization(input: {
     organizationId: string;
 }>;
 export declare function removeUserFromOrganizationGroup(input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput): Promise<{
-    previousStates: {
-        grants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        projection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        state: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
-    }[];
-    currentGrants: {
-        accessLevel: "admin" | "read" | "write";
-        containerId: string;
-    }[];
-    currentMemberEnvelopes: {
-        envelopes: {
-            kemCipherText: string;
-            memberKeyFingerprint: string;
-            userId: string;
-            wrappedKey: string;
-        }[];
-        epoch: number;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentPayload: {
-        cipherSuite: "aes-256-gcm";
-        ciphertext: string;
-        ciphertextHash: string;
-        createdAt: string;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentProjection: {
-        role: "member" | "admin";
-        userId: string;
-    }[];
-    currentState: {
-        createdAt: string;
-        encapsulationPublicKey: string;
-        externalAuthority: {
-            keyEpoch: number;
-            keyFingerprint: string;
-            principalId: string;
-            principalType: "group";
-            stateHash: string;
-            version: number;
-        } | null;
-        grantCount: number;
-        grantRoot: string;
-        keyEpoch: number;
-        keyFingerprint: string;
-        memberCount: number;
-        memberEnvelopesRoot: string;
-        membershipMode: "projection";
-        membershipRoot: string;
-        payloadCiphertextHash: string;
-        prevStateHash: string | null;
-        principalId: string;
-        principalType: "group" | "organization";
-        projectionRoot: string;
-        signature: string;
-        signedAt: string;
-        signerUserId: string;
-        signerUserKeyFingerprint: string;
-        stateHash: string;
-        version: number;
-    };
-} & {
     containerMutations: {
         createdAt: string;
         manifestHead: {
@@ -664,109 +462,7 @@ export declare function revokeOrganizationGrant(input: PrincipalMutationRuntime
         wraps: Record<string, unknown>[];
     };
     systemSlot?: string | null | undefined;
-} | ({
-    previousStates: {
-        grants: {
-            accessLevel: "admin" | "read" | "write";
-            containerId: string;
-        }[];
-        projection: {
-            role: "member" | "admin";
-            userId: string;
-        }[];
-        state: {
-            createdAt: string;
-            encapsulationPublicKey: string;
-            externalAuthority: {
-                keyEpoch: number;
-                keyFingerprint: string;
-                principalId: string;
-                principalType: "group";
-                stateHash: string;
-                version: number;
-            } | null;
-            grantCount: number;
-            grantRoot: string;
-            keyEpoch: number;
-            keyFingerprint: string;
-            memberCount: number;
-            memberEnvelopesRoot: string;
-            membershipMode: "projection";
-            membershipRoot: string;
-            payloadCiphertextHash: string;
-            prevStateHash: string | null;
-            principalId: string;
-            principalType: "group" | "organization";
-            projectionRoot: string;
-            signature: string;
-            signedAt: string;
-            signerUserId: string;
-            signerUserKeyFingerprint: string;
-            stateHash: string;
-            version: number;
-        };
-    }[];
-    currentGrants: {
-        accessLevel: "admin" | "read" | "write";
-        containerId: string;
-    }[];
-    currentMemberEnvelopes: {
-        envelopes: {
-            kemCipherText: string;
-            memberKeyFingerprint: string;
-            userId: string;
-            wrappedKey: string;
-        }[];
-        epoch: number;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentPayload: {
-        cipherSuite: "aes-256-gcm";
-        ciphertext: string;
-        ciphertextHash: string;
-        createdAt: string;
-        principalId: string;
-        principalType: "group" | "organization";
-        stateHash: string;
-    };
-    currentProjection: {
-        role: "member" | "admin";
-        userId: string;
-    }[];
-    currentState: {
-        createdAt: string;
-        encapsulationPublicKey: string;
-        externalAuthority: {
-            keyEpoch: number;
-            keyFingerprint: string;
-            principalId: string;
-            principalType: "group";
-            stateHash: string;
-            version: number;
-        } | null;
-        grantCount: number;
-        grantRoot: string;
-        keyEpoch: number;
-        keyFingerprint: string;
-        memberCount: number;
-        memberEnvelopesRoot: string;
-        membershipMode: "projection";
-        membershipRoot: string;
-        payloadCiphertextHash: string;
-        prevStateHash: string | null;
-        principalId: string;
-        principalType: "group" | "organization";
-        projectionRoot: string;
-        signature: string;
-        signedAt: string;
-        signerUserId: string;
-        signerUserKeyFingerprint: string;
-        stateHash: string;
-        version: number;
-    };
-} & {
+} | {
     containerMutations: {
         createdAt: string;
         manifestHead: {
@@ -887,5 +583,5 @@ export declare function revokeOrganizationGrant(input: PrincipalMutationRuntime
         stateHash: string;
         version: number;
     };
-})>;
+}>;
 export {};