@tearleads/client-sdk 0.1.38 → 0.1.40

package/data/persistence/organizations/organizationReadModelMembershipPersistence.js

@@ -1,13 +1,22 @@
-import { and, eq, inArray } from "drizzle-orm";
-import { organizationReadModelGroupMembers, organizationReadModelGroupMemberships, organizationReadModelGroups, } from "../../sqlite/organizationReadModelSchema.js";
-const GROUP_MEMBERSHIP_BATCH_SIZE = 90;
-const GROUP_MEMBER_INSERT_BATCH_SIZE = 30;
+import { and, eq, inArray, sql } from "drizzle-orm";
+import { organizationReadModelGroupMembers, organizationReadModelGroups, } from "../../sqlite/organizationReadModelSchema.js";
+import { sqliteInsertBatchSize, sqliteRowsPerStatement, } from "../../sqlite/sqliteBindBudget.js";
+// Group ID lists bind one value per group; the head-clearing update also
+// binds its null value beside the organization ID.
+const GROUP_MEMBERSHIP_BATCH_SIZE = sqliteRowsPerStatement(1, 2);
+// Each head binds two values in its CASE arm and one in the IN list, plus the
+// organization ID.
+const GROUP_HEAD_UPDATE_BATCH_SIZE = sqliteRowsPerStatement(3, 1);
+const GROUP_MEMBER_INSERT_BATCH_SIZE = sqliteInsertBatchSize(organizationReadModelGroupMembers);
 export class OrganizationReadModelBindingError extends Error {
     constructor(message) {
         super(message);
         this.name = "OrganizationReadModelBindingError";
     }
 }
+function membershipCoverageError() {
+    return new OrganizationReadModelBindingError("Organization group membership coverage is inconsistent");
+}
 function membershipMemberKey(member) {
     return member.userId;
 }
@@ -36,8 +45,9 @@ async function clearMembershipRows(input) {
         .where(eq(organizationReadModelGroupMembers.organizationId, input.organizationId))
         .run();
     await input.tx
-        .delete(organizationReadModelGroupMemberships)
-        .where(eq(organizationReadModelGroupMemberships.organizationId, input.organizationId))
+        .update(organizationReadModelGroups)
+        .set({ membersStateHash: null })
+        .where(eq(organizationReadModelGroups.organizationId, input.organizationId))
         .run();
 }
 async function deleteMembershipRows(input, groupIds) {
@@ -48,8 +58,9 @@ async function deleteMembershipRows(input, groupIds) {
             .where(and(eq(organizationReadModelGroupMembers.organizationId, input.organizationId), inArray(organizationReadModelGroupMembers.groupId, groupIdBatch)))
             .run();
         await input.tx
-            .delete(organizationReadModelGroupMemberships)
-            .where(and(eq(organizationReadModelGroupMemberships.organizationId, input.organizationId), inArray(organizationReadModelGroupMemberships.groupId, groupIdBatch)))
+            .update(organizationReadModelGroups)
+            .set({ membersStateHash: null })
+            .where(and(eq(organizationReadModelGroups.organizationId, input.organizationId), inArray(organizationReadModelGroups.groupId, groupIdBatch)))
             .run();
     }
 }
@@ -66,21 +77,38 @@ async function removeExistingMembershipRows(input) {
         await deleteMembershipRows(input, removedGroupIds);
     }
 }
-async function insertMembershipRows(input) {
-    if (input.lane.groups.length === 0) {
-        return;
-    }
-    const membershipRows = input.lane.groups.map((group) => ({
-        organizationId: input.organizationId,
-        groupId: group.groupId,
-        stateHash: group.stateHash,
-    }));
-    for (let index = 0; index < membershipRows.length; index += GROUP_MEMBERSHIP_BATCH_SIZE) {
+/**
+ * Record each visible group's membership head on its catalog row. A head for
+ * a group the catalog does not list cannot be bound and fails the page. The
+ * reserved Members head binds to the state row instead; the catalog normally
+ * omits Members, so its row is updated only when one exists.
+ */
+async function writeVisibleGroupHeads(input) {
+    const memberGroupHead = input.lane.groups.find((group) => group.groupId === input.memberGroupId);
+    if (memberGroupHead) {
         await input.tx
-            .insert(organizationReadModelGroupMemberships)
-            .values(membershipRows.slice(index, index + GROUP_MEMBERSHIP_BATCH_SIZE))
+            .update(organizationReadModelGroups)
+            .set({ membersStateHash: memberGroupHead.stateHash })
+            .where(and(eq(organizationReadModelGroups.organizationId, input.organizationId), eq(organizationReadModelGroups.groupId, input.memberGroupId)))
             .run();
     }
+    const heads = input.lane.groups.filter((group) => group.groupId !== input.memberGroupId);
+    for (let index = 0; index < heads.length; index += GROUP_HEAD_UPDATE_BATCH_SIZE) {
+        const batch = heads.slice(index, index + GROUP_HEAD_UPDATE_BATCH_SIZE);
+        const arms = sql.join(batch.map((head) => sql `WHEN ${head.groupId} THEN ${head.stateHash}`), sql ` `);
+        const updated = await input.tx
+            .update(organizationReadModelGroups)
+            .set({
+            membersStateHash: sql `CASE ${organizationReadModelGroups.groupId} ${arms} END`,
+        })
+            .where(and(eq(organizationReadModelGroups.organizationId, input.organizationId), inArray(organizationReadModelGroups.groupId, batch.map((head) => head.groupId))))
+            .returning({ groupId: organizationReadModelGroups.groupId });
+        if (updated.length !== batch.length) {
+            throw membershipCoverageError();
+        }
+    }
+}
+async function insertMemberRows(input) {
     const memberRows = input.lane.groups.flatMap((group) => group.members.map((member, sortOrder) => ({
         organizationId: input.organizationId,
         groupId: group.groupId,
@@ -88,10 +116,6 @@ async function insertMembershipRows(input) {
         sortOrder,
         stateHash: group.stateHash,
         role: member.role,
-        signingKeyFingerprint: member.signingKeyFingerprint,
-        signingPublicKey: member.signingPublicKey,
-        encapsulationPublicKey: member.encapsulationPublicKey,
-        encapsulationKeyFingerprint: member.encapsulationKeyFingerprint,
     })));
     for (let index = 0; index < memberRows.length; index += GROUP_MEMBER_INSERT_BATCH_SIZE) {
         await input.tx
@@ -100,27 +124,59 @@ async function insertMembershipRows(input) {
             .run();
     }
 }
+function nextMemberGroupStateHash(input) {
+    const head = input.lane.groups.find((group) => group.groupId === input.memberGroupId);
+    if (head) {
+        return head.stateHash;
+    }
+    return input.replaceAll ||
+        input.lane.deletedGroupIds.includes(input.memberGroupId)
+        ? null
+        : input.currentMemberGroupStateHash;
+}
+/**
+ * Apply one groupMemberships lane and return the reserved Members head, which
+ * the caller persists on the organization state row.
+ */
 export async function applyGroupMembershipsLane(input) {
     assertUniqueMembershipRows(input.lane);
     await removeExistingMembershipRows(input);
-    await insertMembershipRows(input);
+    await writeVisibleGroupHeads(input);
+    await insertMemberRows(input);
+    return nextMemberGroupStateHash(input);
+}
+function membershipHeadsByGroupId(input) {
+    if (input.memberGroupStateHash === null) {
+        throw membershipCoverageError();
+    }
+    const heads = new Map([[input.memberGroupId, input.memberGroupStateHash]]);
+    for (const group of input.groups) {
+        if (group.membersStateHash === null) {
+            continue;
+        }
+        // A head is expected exactly for stateful visible groups; a listed
+        // Members row must carry the same head as the state row.
+        const isMemberGroup = group.groupId === input.memberGroupId;
+        if (group.stateHash === null ||
+            (isMemberGroup
+                ? group.membersStateHash !== input.memberGroupStateHash
+                : heads.has(group.groupId))) {
+            throw membershipCoverageError();
+        }
+        heads.set(group.groupId, group.membersStateHash);
+    }
+    return heads;
 }
 export async function assertStoredGroupMembershipBindings(input) {
     const groups = await input.tx
         .select({
         groupId: organizationReadModelGroups.groupId,
         memberCount: organizationReadModelGroups.memberCount,
+        membersStateHash: organizationReadModelGroups.membersStateHash,
         stateHash: organizationReadModelGroups.stateHash,
     })
         .from(organizationReadModelGroups)
         .where(eq(organizationReadModelGroups.organizationId, input.organizationId));
-    const heads = await input.tx
-        .select({
-        groupId: organizationReadModelGroupMemberships.groupId,
-        stateHash: organizationReadModelGroupMemberships.stateHash,
-    })
-        .from(organizationReadModelGroupMemberships)
-        .where(eq(organizationReadModelGroupMemberships.organizationId, input.organizationId));
     const members = await input.tx
         .select({
         groupId: organizationReadModelGroupMembers.groupId,
@@ -128,30 +184,19 @@ export async function assertStoredGroupMembershipBindings(input) {
     })
         .from(organizationReadModelGroupMembers)
         .where(eq(organizationReadModelGroupMembers.organizationId, input.organizationId));
-    const headsByGroupId = new Map(heads.map((head) => [head.groupId, head]));
-    const expectedHeadIds = new Set([
-        input.memberGroupId,
-        ...groups.flatMap((group) => (group.stateHash ? [group.groupId] : [])),
-    ]);
-    if (heads.length !== expectedHeadIds.size ||
-        heads.some((head) => !expectedHeadIds.has(head.groupId))) {
-        throw new OrganizationReadModelBindingError("Organization group membership coverage is inconsistent");
-    }
+    const headsByGroupId = membershipHeadsByGroupId({ ...input, groups });
     const memberCountsByGroupId = new Map();
     for (const member of members) {
-        const head = headsByGroupId.get(member.groupId);
-        if (!head || head.stateHash !== member.stateHash) {
+        if (headsByGroupId.get(member.groupId) !== member.stateHash) {
             throw new OrganizationReadModelBindingError("Organization group membership member state is inconsistent");
         }
         memberCountsByGroupId.set(member.groupId, (memberCountsByGroupId.get(member.groupId) ?? 0) + 1);
     }
     for (const group of groups) {
-        const head = headsByGroupId.get(group.groupId);
         if (group.stateHash === null) {
             continue;
         }
-        if (!head ||
-            head.stateHash !== group.stateHash ||
+        if (group.membersStateHash !== group.stateHash ||
             group.memberCount === null ||
             group.memberCount !== (memberCountsByGroupId.get(group.groupId) ?? 0)) {
             throw new OrganizationReadModelBindingError("Organization group membership state hash is inconsistent");

package/data/persistence/organizations/organizationReadModelMembershipPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationReadModelMembershipPersistence.js","sourceRoot":"","sources":["organizationReadModelMembershipPersistence.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,iCAAiC,EACjC,qCAAqC,EACrC,2BAA2B,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAE1C,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAC1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,MAAuD;IAEvD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,0BAA0B,CACjC,IAAmD;IAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC1D,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AASD,KAAK,UAAU,mBAAmB,CAChC,KAAqC;IAErC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,iCAAiC,CAAC;SACzC,KAAK,CACJ,EAAE,CACA,iCAAiC,CAAC,cAAc,EAChD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,qCAAqC,CAAC;SAC7C,KAAK,CACJ,EAAE,CACA,qCAAqC,CAAC,cAAc,EACpD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;AACX,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAqC,EACrC,QAAkB;IAElB,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,QAAQ,CAAC,MAAM,EACvB,KAAK,IAAI,2BAA2B,EACpC,CAAC;QACD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CACjC,KAAK,EACL,KAAK,GAAG,2BAA2B,CACpC,CAAC;QACF,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,iCAAiC,CAAC;aACzC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,iCAAiC,CAAC,cAAc,EAChD,KAAK,CAAC,cAAc,CACrB,EACD,OAAO,CAAC,iCAAiC,CAAC,OAAO,EAAE,YAAY,CAAC,CACjE,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,qCAAqC,CAAC;aAC7C,KAAK,CACJ,GAAG,CACD,EAAE,CACA,qCAAqC,CAAC,cAAc,EACpD,KAAK,CAAC,cAAc,CACrB,EACD,OAAO,CAAC,qCAAqC,CAAC,OAAO,EAAE,YAAY,CAAC,CACrE,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAqC;IAErC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,oBAAoB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAqC;IAErC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC,CAAC;IACJ,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,cAAc,CAAC,MAAM,EAC7B,KAAK,IAAI,2BAA2B,EACpC,CAAC;QACD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,qCAAqC,CAAC;aAC7C,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,2BAA2B,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACrD,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,2BAA2B,EAAE,MAAM,CAAC,2BAA2B;KAChE,CAAC,CAAC,CACJ,CAAC;IACF,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,UAAU,CAAC,MAAM,EACzB,KAAK,IAAI,8BAA8B,EACvC,CAAC;QACD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,iCAAiC,CAAC;aACzC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,8BAA8B,CAAC,CAAC;aACvE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAqC;IAErC,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAIzD;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE;SAC1B,MAAM,CAAC;QACN,OAAO,EAAE,2BAA2B,CAAC,OAAO;QAC5C,WAAW,EAAE,2BAA2B,CAAC,WAAW;QACpD,SAAS,EAAE,2BAA2B,CAAC,SAAS;KACjD,CAAC;SACD,IAAI,CAAC,2BAA2B,CAAC;SACjC,KAAK,CACJ,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CACrE,CAAC;IACJ,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE;SACzB,MAAM,CAAC;QACN,OAAO,EAAE,qCAAqC,CAAC,OAAO;QACtD,SAAS,EAAE,qCAAqC,CAAC,SAAS;KAC3D,CAAC;SACD,IAAI,CAAC,qCAAqC,CAAC;SAC3C,KAAK,CACJ,EAAE,CACA,qCAAqC,CAAC,cAAc,EACpD,KAAK,CAAC,cAAc,CACrB,CACF,CAAC;IACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,EAAE;SAC3B,MAAM,CAAC;QACN,OAAO,EAAE,iCAAiC,CAAC,OAAO;QAClD,SAAS,EAAE,iCAAiC,CAAC,SAAS;KACvD,CAAC;SACD,IAAI,CAAC,iCAAiC,CAAC;SACvC,KAAK,CACJ,EAAE,CACA,iCAAiC,CAAC,cAAc,EAChD,KAAK,CAAC,cAAc,CACrB,CACF,CAAC;IACJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;QAC9B,KAAK,CAAC,aAAa;QACnB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KACvE,CAAC,CAAC;IACH,IACE,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,IAAI;QACrC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,iCAAiC,CACzC,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,qBAAqB,CAAC,GAAG,CACvB,MAAM,CAAC,OAAO,EACd,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CACrD,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,IACE,CAAC,IAAI;YACL,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YAClC,KAAK,CAAC,WAAW,KAAK,IAAI;YAC1B,KAAK,CAAC,WAAW,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EACrE,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,0DAA0D,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import type {\n  OrganizationGroupMemberResponse,\n  OrganizationReadModelGroupMembershipsResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq, inArray } from \"drizzle-orm\";\nimport {\n  organizationReadModelGroupMembers,\n  organizationReadModelGroupMemberships,\n  organizationReadModelGroups,\n} from \"../../sqlite/organizationReadModelSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\n\nconst GROUP_MEMBERSHIP_BATCH_SIZE = 90;\nconst GROUP_MEMBER_INSERT_BATCH_SIZE = 30;\n\nexport class OrganizationReadModelBindingError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"OrganizationReadModelBindingError\";\n  }\n}\n\nfunction membershipMemberKey(\n  member: Pick<OrganizationGroupMemberResponse, \"userId\">,\n): string {\n  return member.userId;\n}\n\nfunction assertUniqueMembershipRows(\n  lane: OrganizationReadModelGroupMembershipsResponse,\n): void {\n  const groupIds = lane.groups.map((group) => group.groupId);\n  if (new Set(groupIds).size !== groupIds.length) {\n    throw new Error(\n      \"Organization read-model group memberships contain duplicate groups\",\n    );\n  }\n  if (new Set(lane.deletedGroupIds).size !== lane.deletedGroupIds.length) {\n    throw new Error(\n      \"Organization read-model group memberships contain duplicate deletions\",\n    );\n  }\n  const deletedGroupIds = new Set(lane.deletedGroupIds);\n  if (groupIds.some((groupId) => deletedGroupIds.has(groupId))) {\n    throw new Error(\n      \"Organization read-model group membership is both replaced and deleted\",\n    );\n  }\n  for (const group of lane.groups) {\n    const memberKeys = group.members.map(membershipMemberKey);\n    if (new Set(memberKeys).size !== memberKeys.length) {\n      throw new Error(\n        \"Organization read-model group membership contains duplicate members\",\n      );\n    }\n  }\n}\n\ninterface ApplyGroupMembershipsLaneInput {\n  readonly lane: OrganizationReadModelGroupMembershipsResponse;\n  readonly organizationId: string;\n  readonly replaceAll: boolean;\n  readonly tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearMembershipRows(\n  input: ApplyGroupMembershipsLaneInput,\n): Promise<void> {\n  await input.tx\n    .delete(organizationReadModelGroupMembers)\n    .where(\n      eq(\n        organizationReadModelGroupMembers.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .delete(organizationReadModelGroupMemberships)\n    .where(\n      eq(\n        organizationReadModelGroupMemberships.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n}\n\nasync function deleteMembershipRows(\n  input: ApplyGroupMembershipsLaneInput,\n  groupIds: string[],\n): Promise<void> {\n  for (\n    let index = 0;\n    index < groupIds.length;\n    index += GROUP_MEMBERSHIP_BATCH_SIZE\n  ) {\n    const groupIdBatch = groupIds.slice(\n      index,\n      index + GROUP_MEMBERSHIP_BATCH_SIZE,\n    );\n    await input.tx\n      .delete(organizationReadModelGroupMembers)\n      .where(\n        and(\n          eq(\n            organizationReadModelGroupMembers.organizationId,\n            input.organizationId,\n          ),\n          inArray(organizationReadModelGroupMembers.groupId, groupIdBatch),\n        ),\n      )\n      .run();\n    await input.tx\n      .delete(organizationReadModelGroupMemberships)\n      .where(\n        and(\n          eq(\n            organizationReadModelGroupMemberships.organizationId,\n            input.organizationId,\n          ),\n          inArray(organizationReadModelGroupMemberships.groupId, groupIdBatch),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function removeExistingMembershipRows(\n  input: ApplyGroupMembershipsLaneInput,\n): Promise<void> {\n  if (input.replaceAll) {\n    if (input.lane.deletedGroupIds.length > 0) {\n      throw new Error(\"Organization membership snapshot contains deletions\");\n    }\n    return clearMembershipRows(input);\n  }\n  const replacedGroupIds = input.lane.groups.map((group) => group.groupId);\n  const removedGroupIds = [...replacedGroupIds, ...input.lane.deletedGroupIds];\n  if (removedGroupIds.length > 0) {\n    await deleteMembershipRows(input, removedGroupIds);\n  }\n}\n\nasync function insertMembershipRows(\n  input: ApplyGroupMembershipsLaneInput,\n): Promise<void> {\n  if (input.lane.groups.length === 0) {\n    return;\n  }\n  const membershipRows = input.lane.groups.map((group) => ({\n    organizationId: input.organizationId,\n    groupId: group.groupId,\n    stateHash: group.stateHash,\n  }));\n  for (\n    let index = 0;\n    index < membershipRows.length;\n    index += GROUP_MEMBERSHIP_BATCH_SIZE\n  ) {\n    await input.tx\n      .insert(organizationReadModelGroupMemberships)\n      .values(membershipRows.slice(index, index + GROUP_MEMBERSHIP_BATCH_SIZE))\n      .run();\n  }\n\n  const memberRows = input.lane.groups.flatMap((group) =>\n    group.members.map((member, sortOrder) => ({\n      organizationId: input.organizationId,\n      groupId: group.groupId,\n      userId: member.userId,\n      sortOrder,\n      stateHash: group.stateHash,\n      role: member.role,\n      signingKeyFingerprint: member.signingKeyFingerprint,\n      signingPublicKey: member.signingPublicKey,\n      encapsulationPublicKey: member.encapsulationPublicKey,\n      encapsulationKeyFingerprint: member.encapsulationKeyFingerprint,\n    })),\n  );\n  for (\n    let index = 0;\n    index < memberRows.length;\n    index += GROUP_MEMBER_INSERT_BATCH_SIZE\n  ) {\n    await input.tx\n      .insert(organizationReadModelGroupMembers)\n      .values(memberRows.slice(index, index + GROUP_MEMBER_INSERT_BATCH_SIZE))\n      .run();\n  }\n}\n\nexport async function applyGroupMembershipsLane(\n  input: ApplyGroupMembershipsLaneInput,\n): Promise<void> {\n  assertUniqueMembershipRows(input.lane);\n  await removeExistingMembershipRows(input);\n  await insertMembershipRows(input);\n}\n\nexport async function assertStoredGroupMembershipBindings(input: {\n  readonly memberGroupId: string;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const groups = await input.tx\n    .select({\n      groupId: organizationReadModelGroups.groupId,\n      memberCount: organizationReadModelGroups.memberCount,\n      stateHash: organizationReadModelGroups.stateHash,\n    })\n    .from(organizationReadModelGroups)\n    .where(\n      eq(organizationReadModelGroups.organizationId, input.organizationId),\n    );\n  const heads = await input.tx\n    .select({\n      groupId: organizationReadModelGroupMemberships.groupId,\n      stateHash: organizationReadModelGroupMemberships.stateHash,\n    })\n    .from(organizationReadModelGroupMemberships)\n    .where(\n      eq(\n        organizationReadModelGroupMemberships.organizationId,\n        input.organizationId,\n      ),\n    );\n  const members = await input.tx\n    .select({\n      groupId: organizationReadModelGroupMembers.groupId,\n      stateHash: organizationReadModelGroupMembers.stateHash,\n    })\n    .from(organizationReadModelGroupMembers)\n    .where(\n      eq(\n        organizationReadModelGroupMembers.organizationId,\n        input.organizationId,\n      ),\n    );\n  const headsByGroupId = new Map(heads.map((head) => [head.groupId, head]));\n  const expectedHeadIds = new Set([\n    input.memberGroupId,\n    ...groups.flatMap((group) => (group.stateHash ? [group.groupId] : [])),\n  ]);\n  if (\n    heads.length !== expectedHeadIds.size ||\n    heads.some((head) => !expectedHeadIds.has(head.groupId))\n  ) {\n    throw new OrganizationReadModelBindingError(\n      \"Organization group membership coverage is inconsistent\",\n    );\n  }\n\n  const memberCountsByGroupId = new Map<string, number>();\n  for (const member of members) {\n    const head = headsByGroupId.get(member.groupId);\n    if (!head || head.stateHash !== member.stateHash) {\n      throw new OrganizationReadModelBindingError(\n        \"Organization group membership member state is inconsistent\",\n      );\n    }\n    memberCountsByGroupId.set(\n      member.groupId,\n      (memberCountsByGroupId.get(member.groupId) ?? 0) + 1,\n    );\n  }\n\n  for (const group of groups) {\n    const head = headsByGroupId.get(group.groupId);\n    if (group.stateHash === null) {\n      continue;\n    }\n    if (\n      !head ||\n      head.stateHash !== group.stateHash ||\n      group.memberCount === null ||\n      group.memberCount !== (memberCountsByGroupId.get(group.groupId) ?? 0)\n    ) {\n      throw new OrganizationReadModelBindingError(\n        \"Organization group membership state hash is inconsistent\",\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"organizationReadModelMembershipPersistence.js","sourceRoot":"","sources":["organizationReadModelMembershipPersistence.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,iCAAiC,EACjC,2BAA2B,GAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AAGvC,yEAAyE;AACzE,mDAAmD;AACnD,MAAM,2BAA2B,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,8EAA8E;AAC9E,mBAAmB;AACnB,MAAM,4BAA4B,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAClE,MAAM,8BAA8B,GAAG,qBAAqB,CAC1D,iCAAiC,CAClC,CAAC;AAEF,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAC1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED,SAAS,uBAAuB;IAC9B,OAAO,IAAI,iCAAiC,CAC1C,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAgE;IAEhE,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,0BAA0B,CACjC,IAAmD;IAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC1D,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAYD,KAAK,UAAU,mBAAmB,CAChC,KAAqC;IAErC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,iCAAiC,CAAC;SACzC,KAAK,CACJ,EAAE,CACA,iCAAiC,CAAC,cAAc,EAChD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,2BAA2B,CAAC;SACnC,GAAG,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;SAC/B,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC3E,GAAG,EAAE,CAAC;AACX,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAqC,EACrC,QAAkB;IAElB,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,QAAQ,CAAC,MAAM,EACvB,KAAK,IAAI,2BAA2B,EACpC,CAAC;QACD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CACjC,KAAK,EACL,KAAK,GAAG,2BAA2B,CACpC,CAAC;QACF,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,iCAAiC,CAAC;aACzC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,iCAAiC,CAAC,cAAc,EAChD,KAAK,CAAC,cAAc,CACrB,EACD,OAAO,CAAC,iCAAiC,CAAC,OAAO,EAAE,YAAY,CAAC,CACjE,CACF;aACA,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,2BAA2B,CAAC;aACnC,GAAG,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;aAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACpE,OAAO,CAAC,2BAA2B,CAAC,OAAO,EAAE,YAAY,CAAC,CAC3D,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAqC;IAErC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,oBAAoB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CACnC,KAAqC;IAErC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,aAAa,CACjD,CAAC;IACF,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,2BAA2B,CAAC;aACnC,GAAG,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;aACpD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACpE,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAC7D,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,aAAa,CACjD,CAAC;IACF,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,KAAK,CAAC,MAAM,EACpB,KAAK,IAAI,4BAA4B,EACrC,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,4BAA4B,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CACnB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAA,QAAQ,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC,EACrE,GAAG,CAAA,GAAG,CACP,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,EAAE;aAC3B,MAAM,CAAC,2BAA2B,CAAC;aACnC,GAAG,CAAC;YACH,gBAAgB,EAAE,GAAG,CAAA,QAAQ,2BAA2B,CAAC,OAAO,IAAI,IAAI,MAAM;SAC/E,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACpE,OAAO,CACL,2BAA2B,CAAC,OAAO,EACnC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAClC,CACF,CACF;aACA,SAAS,CAAC,EAAE,OAAO,EAAE,2BAA2B,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,uBAAuB,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAqC;IAErC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACrD,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC,CACJ,CAAC;IACF,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,UAAU,CAAC,MAAM,EACzB,KAAK,IAAI,8BAA8B,EACvC,CAAC;QACD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,iCAAiC,CAAC;aACzC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,8BAA8B,CAAC,CAAC;aACvE,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAqC;IAErC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,aAAa,CACjD,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC,UAAU;QACrB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC;QACxD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAqC;IAErC,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AASD,SAAS,wBAAwB,CAAC,KAIjC;IACC,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,uBAAuB,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACpC,SAAS;QACX,CAAC;QACD,mEAAmE;QACnE,yDAAyD;QACzD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,aAAa,CAAC;QAC5D,IACE,KAAK,CAAC,SAAS,KAAK,IAAI;YACxB,CAAC,aAAa;gBACZ,CAAC,CAAC,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,oBAAoB;gBACvD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAC7B,CAAC;YACD,MAAM,uBAAuB,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,KAKzD;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE;SAC1B,MAAM,CAAC;QACN,OAAO,EAAE,2BAA2B,CAAC,OAAO;QAC5C,WAAW,EAAE,2BAA2B,CAAC,WAAW;QACpD,gBAAgB,EAAE,2BAA2B,CAAC,gBAAgB;QAC9D,SAAS,EAAE,2BAA2B,CAAC,SAAS;KACjD,CAAC;SACD,IAAI,CAAC,2BAA2B,CAAC;SACjC,KAAK,CACJ,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CACrE,CAAC;IACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,EAAE;SAC3B,MAAM,CAAC;QACN,OAAO,EAAE,iCAAiC,CAAC,OAAO;QAClD,SAAS,EAAE,iCAAiC,CAAC,SAAS;KACvD,CAAC;SACD,IAAI,CAAC,iCAAiC,CAAC;SACvC,KAAK,CACJ,EAAE,CACA,iCAAiC,CAAC,cAAc,EAChD,KAAK,CAAC,cAAc,CACrB,CACF,CAAC;IACJ,MAAM,cAAc,GAAG,wBAAwB,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtE,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5D,MAAM,IAAI,iCAAiC,CACzC,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,qBAAqB,CAAC,GAAG,CACvB,MAAM,CAAC,OAAO,EACd,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CACrD,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,IACE,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,SAAS;YAC1C,KAAK,CAAC,WAAW,KAAK,IAAI;YAC1B,KAAK,CAAC,WAAW,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EACrE,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,0DAA0D,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import type {\n  OrganizationReadModelGroupMemberResponse,\n  OrganizationReadModelGroupMembershipsResponse,\n} from \"@tearleads/validators/response\";\nimport { and, eq, inArray, sql } from \"drizzle-orm\";\nimport {\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n} from \"../../sqlite/organizationReadModelSchema\";\nimport {\n  sqliteInsertBatchSize,\n  sqliteRowsPerStatement,\n} from \"../../sqlite/sqliteBindBudget\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\n\n// Group ID lists bind one value per group; the head-clearing update also\n// binds its null value beside the organization ID.\nconst GROUP_MEMBERSHIP_BATCH_SIZE = sqliteRowsPerStatement(1, 2);\n// Each head binds two values in its CASE arm and one in the IN list, plus the\n// organization ID.\nconst GROUP_HEAD_UPDATE_BATCH_SIZE = sqliteRowsPerStatement(3, 1);\nconst GROUP_MEMBER_INSERT_BATCH_SIZE = sqliteInsertBatchSize(\n  organizationReadModelGroupMembers,\n);\n\nexport class OrganizationReadModelBindingError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"OrganizationReadModelBindingError\";\n  }\n}\n\nfunction membershipCoverageError(): OrganizationReadModelBindingError {\n  return new OrganizationReadModelBindingError(\n    \"Organization group membership coverage is inconsistent\",\n  );\n}\n\nfunction membershipMemberKey(\n  member: Pick<OrganizationReadModelGroupMemberResponse, \"userId\">,\n): string {\n  return member.userId;\n}\n\nfunction assertUniqueMembershipRows(\n  lane: OrganizationReadModelGroupMembershipsResponse,\n): void {\n  const groupIds = lane.groups.map((group) => group.groupId);\n  if (new Set(groupIds).size !== groupIds.length) {\n    throw new Error(\n      \"Organization read-model group memberships contain duplicate groups\",\n    );\n  }\n  if (new Set(lane.deletedGroupIds).size !== lane.deletedGroupIds.length) {\n    throw new Error(\n      \"Organization read-model group memberships contain duplicate deletions\",\n    );\n  }\n  const deletedGroupIds = new Set(lane.deletedGroupIds);\n  if (groupIds.some((groupId) => deletedGroupIds.has(groupId))) {\n    throw new Error(\n      \"Organization read-model group membership is both replaced and deleted\",\n    );\n  }\n  for (const group of lane.groups) {\n    const memberKeys = group.members.map(membershipMemberKey);\n    if (new Set(memberKeys).size !== memberKeys.length) {\n      throw new Error(\n        \"Organization read-model group membership contains duplicate members\",\n      );\n    }\n  }\n}\n\ninterface ApplyGroupMembershipsLaneInput {\n  /** The reserved Members head before this lane applies. */\n  readonly currentMemberGroupStateHash: string | null;\n  readonly lane: OrganizationReadModelGroupMembershipsResponse;\n  readonly memberGroupId: string;\n  readonly organizationId: string;\n  readonly replaceAll: boolean;\n  readonly tx: ClientSQLiteTransactionScope;\n}\n\nasync function clearMembershipRows(\n  input: ApplyGroupMembershipsLaneInput,\n): Promise<void> {\n  await input.tx\n    .delete(organizationReadModelGroupMembers)\n    .where(\n      eq(\n        organizationReadModelGroupMembers.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n  await input.tx\n    .update(organizationReadModelGroups)\n    .set({ membersStateHash: null })\n    .where(eq(organizationReadModelGroups.organizationId, input.organizationId))\n    .run();\n}\n\nasync function deleteMembershipRows(\n  input: ApplyGroupMembershipsLaneInput,\n  groupIds: string[],\n): Promise<void> {\n  for (\n    let index = 0;\n    index < groupIds.length;\n    index += GROUP_MEMBERSHIP_BATCH_SIZE\n  ) {\n    const groupIdBatch = groupIds.slice(\n      index,\n      index + GROUP_MEMBERSHIP_BATCH_SIZE,\n    );\n    await input.tx\n      .delete(organizationReadModelGroupMembers)\n      .where(\n        and(\n          eq(\n            organizationReadModelGroupMembers.organizationId,\n            input.organizationId,\n          ),\n          inArray(organizationReadModelGroupMembers.groupId, groupIdBatch),\n        ),\n      )\n      .run();\n    await input.tx\n      .update(organizationReadModelGroups)\n      .set({ membersStateHash: null })\n      .where(\n        and(\n          eq(organizationReadModelGroups.organizationId, input.organizationId),\n          inArray(organizationReadModelGroups.groupId, groupIdBatch),\n        ),\n      )\n      .run();\n  }\n}\n\nasync function removeExistingMembershipRows(\n  input: ApplyGroupMembershipsLaneInput,\n): Promise<void> {\n  if (input.replaceAll) {\n    if (input.lane.deletedGroupIds.length > 0) {\n      throw new Error(\"Organization membership snapshot contains deletions\");\n    }\n    return clearMembershipRows(input);\n  }\n  const replacedGroupIds = input.lane.groups.map((group) => group.groupId);\n  const removedGroupIds = [...replacedGroupIds, ...input.lane.deletedGroupIds];\n  if (removedGroupIds.length > 0) {\n    await deleteMembershipRows(input, removedGroupIds);\n  }\n}\n\n/**\n * Record each visible group's membership head on its catalog row. A head for\n * a group the catalog does not list cannot be bound and fails the page. The\n * reserved Members head binds to the state row instead; the catalog normally\n * omits Members, so its row is updated only when one exists.\n */\nasync function writeVisibleGroupHeads(\n  input: ApplyGroupMembershipsLaneInput,\n): Promise<void> {\n  const memberGroupHead = input.lane.groups.find(\n    (group) => group.groupId === input.memberGroupId,\n  );\n  if (memberGroupHead) {\n    await input.tx\n      .update(organizationReadModelGroups)\n      .set({ membersStateHash: memberGroupHead.stateHash })\n      .where(\n        and(\n          eq(organizationReadModelGroups.organizationId, input.organizationId),\n          eq(organizationReadModelGroups.groupId, input.memberGroupId),\n        ),\n      )\n      .run();\n  }\n  const heads = input.lane.groups.filter(\n    (group) => group.groupId !== input.memberGroupId,\n  );\n  for (\n    let index = 0;\n    index < heads.length;\n    index += GROUP_HEAD_UPDATE_BATCH_SIZE\n  ) {\n    const batch = heads.slice(index, index + GROUP_HEAD_UPDATE_BATCH_SIZE);\n    const arms = sql.join(\n      batch.map((head) => sql`WHEN ${head.groupId} THEN ${head.stateHash}`),\n      sql` `,\n    );\n    const updated = await input.tx\n      .update(organizationReadModelGroups)\n      .set({\n        membersStateHash: sql`CASE ${organizationReadModelGroups.groupId} ${arms} END`,\n      })\n      .where(\n        and(\n          eq(organizationReadModelGroups.organizationId, input.organizationId),\n          inArray(\n            organizationReadModelGroups.groupId,\n            batch.map((head) => head.groupId),\n          ),\n        ),\n      )\n      .returning({ groupId: organizationReadModelGroups.groupId });\n    if (updated.length !== batch.length) {\n      throw membershipCoverageError();\n    }\n  }\n}\n\nasync function insertMemberRows(\n  input: ApplyGroupMembershipsLaneInput,\n): Promise<void> {\n  const memberRows = input.lane.groups.flatMap((group) =>\n    group.members.map((member, sortOrder) => ({\n      organizationId: input.organizationId,\n      groupId: group.groupId,\n      userId: member.userId,\n      sortOrder,\n      stateHash: group.stateHash,\n      role: member.role,\n    })),\n  );\n  for (\n    let index = 0;\n    index < memberRows.length;\n    index += GROUP_MEMBER_INSERT_BATCH_SIZE\n  ) {\n    await input.tx\n      .insert(organizationReadModelGroupMembers)\n      .values(memberRows.slice(index, index + GROUP_MEMBER_INSERT_BATCH_SIZE))\n      .run();\n  }\n}\n\nfunction nextMemberGroupStateHash(\n  input: ApplyGroupMembershipsLaneInput,\n): string | null {\n  const head = input.lane.groups.find(\n    (group) => group.groupId === input.memberGroupId,\n  );\n  if (head) {\n    return head.stateHash;\n  }\n  return input.replaceAll ||\n    input.lane.deletedGroupIds.includes(input.memberGroupId)\n    ? null\n    : input.currentMemberGroupStateHash;\n}\n\n/**\n * Apply one groupMemberships lane and return the reserved Members head, which\n * the caller persists on the organization state row.\n */\nexport async function applyGroupMembershipsLane(\n  input: ApplyGroupMembershipsLaneInput,\n): Promise<string | null> {\n  assertUniqueMembershipRows(input.lane);\n  await removeExistingMembershipRows(input);\n  await writeVisibleGroupHeads(input);\n  await insertMemberRows(input);\n  return nextMemberGroupStateHash(input);\n}\n\ninterface StoredGroupHead {\n  readonly groupId: string;\n  readonly memberCount: number | null;\n  readonly membersStateHash: string | null;\n  readonly stateHash: string | null;\n}\n\nfunction membershipHeadsByGroupId(input: {\n  readonly groups: readonly StoredGroupHead[];\n  readonly memberGroupId: string;\n  readonly memberGroupStateHash: string | null;\n}): Map<string, string> {\n  if (input.memberGroupStateHash === null) {\n    throw membershipCoverageError();\n  }\n  const heads = new Map([[input.memberGroupId, input.memberGroupStateHash]]);\n  for (const group of input.groups) {\n    if (group.membersStateHash === null) {\n      continue;\n    }\n    // A head is expected exactly for stateful visible groups; a listed\n    // Members row must carry the same head as the state row.\n    const isMemberGroup = group.groupId === input.memberGroupId;\n    if (\n      group.stateHash === null ||\n      (isMemberGroup\n        ? group.membersStateHash !== input.memberGroupStateHash\n        : heads.has(group.groupId))\n    ) {\n      throw membershipCoverageError();\n    }\n    heads.set(group.groupId, group.membersStateHash);\n  }\n  return heads;\n}\n\nexport async function assertStoredGroupMembershipBindings(input: {\n  readonly memberGroupId: string;\n  readonly memberGroupStateHash: string | null;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const groups = await input.tx\n    .select({\n      groupId: organizationReadModelGroups.groupId,\n      memberCount: organizationReadModelGroups.memberCount,\n      membersStateHash: organizationReadModelGroups.membersStateHash,\n      stateHash: organizationReadModelGroups.stateHash,\n    })\n    .from(organizationReadModelGroups)\n    .where(\n      eq(organizationReadModelGroups.organizationId, input.organizationId),\n    );\n  const members = await input.tx\n    .select({\n      groupId: organizationReadModelGroupMembers.groupId,\n      stateHash: organizationReadModelGroupMembers.stateHash,\n    })\n    .from(organizationReadModelGroupMembers)\n    .where(\n      eq(\n        organizationReadModelGroupMembers.organizationId,\n        input.organizationId,\n      ),\n    );\n  const headsByGroupId = membershipHeadsByGroupId({ ...input, groups });\n\n  const memberCountsByGroupId = new Map<string, number>();\n  for (const member of members) {\n    if (headsByGroupId.get(member.groupId) !== member.stateHash) {\n      throw new OrganizationReadModelBindingError(\n        \"Organization group membership member state is inconsistent\",\n      );\n    }\n    memberCountsByGroupId.set(\n      member.groupId,\n      (memberCountsByGroupId.get(member.groupId) ?? 0) + 1,\n    );\n  }\n\n  for (const group of groups) {\n    if (group.stateHash === null) {\n      continue;\n    }\n    if (\n      group.membersStateHash !== group.stateHash ||\n      group.memberCount === null ||\n      group.memberCount !== (memberCountsByGroupId.get(group.groupId) ?? 0)\n    ) {\n      throw new OrganizationReadModelBindingError(\n        \"Organization group membership state hash is inconsistent\",\n      );\n    }\n  }\n}\n"]}

package/data/persistence/organizations/organizationReadModelPersistence.js

@@ -3,17 +3,17 @@ import { invalidatePrincipalRecovery } from "../../principals/principalRecoveryE
 import { organizationDataUsageTables } from "../../sqlite/organizationDataUsageSchema.js";
 import { organizationReadModelDirectoryUsers, organizationReadModelGroups, organizationReadModelRequesters, organizationReadModelState, } from "../../sqlite/organizationReadModelSchema.js";
 import { organizationReadModelTables } from "../../sqlite/schema.js";
+import { sqliteInsertBatchSize } from "../../sqlite/sqliteBindBudget.js";
 import { getClientSQLitePersistenceRuntime, } from "../../sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../../sqlite/sqlSchema.js";
 import { clearOrganizationPresentationDenialInTransaction } from "./organizationPresentationDenialPersistence.js";
 import { applyOrganizationReadModelGrantsLane } from "./organizationReadModelGrantPersistence.js";
-import { applyGroupMembershipsLane, assertStoredGroupMembershipBindings, } from "./organizationReadModelMembershipPersistence.js";
-import { applyOrganizationPolicyLane, replaceGroupPolicyHeads, } from "./organizationReadModelPolicyHeadPersistence.js";
+import { applyGroupMembershipsLane, assertStoredGroupMembershipBindings, OrganizationReadModelBindingError, } from "./organizationReadModelMembershipPersistence.js";
 import { loadOrganizationReadModelProjectionInTransaction, } from "./organizationReadModelProjection.js";
 import { loadWithOrganizationReadModelIntegrityPurge, pruneInactiveOrganizationRequestersInTransaction, purgeOrganizationReadModelProjectionInTransaction, } from "./organizationReadModelPurge.js";
 import { assertOrganizationReadModelResponse } from "./organizationReadModelResponseAssertions.js";
-const DIRECTORY_INSERT_BATCH_SIZE = 64;
-const GROUP_INSERT_BATCH_SIZE = 90;
+const DIRECTORY_INSERT_BATCH_SIZE = sqliteInsertBatchSize(organizationReadModelDirectoryUsers);
+const GROUP_INSERT_BATCH_SIZE = sqliteInsertBatchSize(organizationReadModelGroups);
 async function replaceDirectoryLane(input) {
     await input.tx
         .delete(organizationReadModelDirectoryUsers)
@@ -73,43 +73,35 @@ async function upsertRequester(input) {
         tx: input.tx,
     });
 }
-/** The directory lane is the authoritative roster: requester rows for users
- * it no longer lists as active must fall with it. */
-async function pruneRequestersForDirectoryLane(input) {
-    await pruneInactiveOrganizationRequestersInTransaction({
-        activeUserIds: input.directory.users
-            .filter((user) => user.status === "active")
-            .map((user) => user.userId),
-        organizationId: input.organizationId,
-        retainUserId: input.currentUserId,
-        tx: input.tx,
-    });
-}
 async function replaceGroupsLane(input) {
+    // Hydrated names and delivered membership heads outlive a catalog
+    // replacement; the groupMemberships lane rebinds any head that changed.
     const previousGroups = await input.tx
         .select({
         groupId: organizationReadModelGroups.groupId,
+        membersStateHash: organizationReadModelGroups.membersStateHash,
         name: organizationReadModelGroups.name,
     })
         .from(organizationReadModelGroups)
         .where(eq(organizationReadModelGroups.organizationId, input.organizationId));
-    const names = new Map(previousGroups.map((group) => [group.groupId, group.name]));
+    const previousById = new Map(previousGroups.map((group) => [group.groupId, group]));
     await input.tx
         .delete(organizationReadModelGroups)
         .where(eq(organizationReadModelGroups.organizationId, input.organizationId))
         .run();
-    await replaceGroupPolicyHeads(input);
     const rows = input.groups.groups.map((group, sortOrder) => ({
         organizationId: input.organizationId,
         groupId: group.groupId,
         sortOrder,
-        name: names.get(group.groupId) ?? "",
+        name: previousById.get(group.groupId)?.name ?? "",
         createdAt: group.createdAt,
         isBuiltin: group.isBuiltin,
         stateHash: group.currentState?.stateHash ?? null,
         stateVersion: group.currentState?.version ?? null,
         keyEpoch: group.currentState?.keyEpoch ?? null,
+        keyFingerprint: group.currentState?.keyFingerprint ?? null,
         memberCount: group.currentState?.memberCount ?? null,
+        membersStateHash: previousById.get(group.groupId)?.membersStateHash ?? null,
     }));
     for (let index = 0; index < rows.length; index += GROUP_INSERT_BATCH_SIZE) {
         await input.tx
@@ -122,13 +114,32 @@ async function loadCurrentState(tx, organizationId) {
     const [current] = await tx
         .select({
         cursor: organizationReadModelState.cursor,
+        keyEpoch: organizationReadModelState.organizationKeyEpoch,
+        keyFingerprint: organizationReadModelState.organizationKeyFingerprint,
+        memberCount: organizationReadModelState.organizationMemberCount,
         memberGroupId: organizationReadModelState.memberGroupId,
+        memberGroupStateHash: organizationReadModelState.memberGroupStateHash,
         profileDocumentId: organizationReadModelState.profileDocumentId,
+        stateHash: organizationReadModelState.organizationStateHash,
+        version: organizationReadModelState.organizationStateVersion,
     })
         .from(organizationReadModelState)
         .where(eq(organizationReadModelState.organizationId, organizationId))
         .limit(1);
-    return current ?? null;
+    if (!current) {
+        return null;
+    }
+    const { keyEpoch, keyFingerprint, memberCount, stateHash, version, ...rest } = current;
+    return {
+        ...rest,
+        organizationHead: {
+            keyEpoch,
+            keyFingerprint,
+            memberCount,
+            stateHash,
+            version,
+        },
+    };
 }
 function resolveApplyDisposition(input) {
     const currentCursor = input.current?.cursor ?? null;
@@ -142,67 +153,92 @@ function resolveApplyDisposition(input) {
     }
     return null;
 }
+/** Apply every carried lane and return the reserved Members head. */
 async function replaceResponseLanes(input) {
+    const { organizationId } = input.response;
     const directory = input.response.lanes.directory;
     if (directory) {
-        await replaceDirectoryLane({
-            directory,
-            organizationId: input.response.organizationId,
-            tx: input.tx,
-        });
+        await replaceDirectoryLane({ directory, organizationId, tx: input.tx });
     }
     const groups = input.response.lanes.groups;
     if (groups) {
-        await replaceGroupsLane({
-            groups,
-            organizationId: input.response.organizationId,
-            tx: input.tx,
-        });
-    }
-    const organizationPolicy = input.response.lanes.organizationPolicy;
-    if (organizationPolicy) {
-        await applyOrganizationPolicyLane({
-            organizationId: input.response.organizationId,
-            organizationPolicy,
-            tx: input.tx,
-        });
+        await replaceGroupsLane({ groups, organizationId, tx: input.tx });
     }
     const groupMemberships = input.response.lanes.groupMemberships;
-    if (groupMemberships) {
-        await applyGroupMembershipsLane({
+    const memberGroupStateHash = groupMemberships
+        ? await applyGroupMembershipsLane({
+            currentMemberGroupStateHash: input.current?.memberGroupStateHash ?? null,
             lane: groupMemberships,
-            organizationId: input.response.organizationId,
+            memberGroupId: input.memberGroupId,
+            organizationId,
             replaceAll: input.response.mode === "snapshot",
             tx: input.tx,
-        });
-    }
+        })
+        : (input.current?.memberGroupStateHash ?? null);
     const grants = input.response.lanes.grants;
     if (grants) {
         await applyOrganizationReadModelGrantsLane({
             lane: grants,
-            organizationId: input.response.organizationId,
+            organizationId,
             tx: input.tx,
         });
     }
+    return memberGroupStateHash;
 }
 async function applyResponseLanes(input) {
-    await replaceResponseLanes({ response: input.response, tx: input.tx });
-    const directoryLane = input.response.lanes.directory;
-    if (directoryLane) {
-        await pruneRequestersForDirectoryLane({
-            currentUserId: input.currentUserId,
-            directory: directoryLane,
+    const memberGroupStateHash = await replaceResponseLanes(input);
+    // The directory lane is the authoritative roster, already persisted above:
+    // requester rows for users it no longer lists as active fall with it.
+    if (input.response.lanes.directory) {
+        await pruneInactiveOrganizationRequestersInTransaction({
             organizationId: input.response.organizationId,
+            retainUserId: input.currentUserId,
             tx: input.tx,
         });
     }
     if (input.response.lanes.groups || input.response.lanes.groupMemberships) {
         await assertStoredGroupMembershipBindings({
             memberGroupId: input.memberGroupId,
+            memberGroupStateHash,
             organizationId: input.response.organizationId,
             tx: input.tx,
         });
     }
+    return memberGroupStateHash;
+}
+/**
+ * Write the cursor with the organization policy head and the reserved Members
+ * head in one row, so a failure anywhere in the page rolls them back together.
+ */
+async function upsertOrganizationReadModelState(input) {
+    const organizationHead = input.response.lanes.organizationPolicy?.currentState ??
+        input.current?.organizationHead;
+    if (!organizationHead || input.memberGroupStateHash === null) {
+        throw new OrganizationReadModelBindingError("Organization read-model policy or Members head is missing");
+    }
+    const directoryLane = input.response.lanes.directory;
+    const values = {
+        cursor: input.response.nextCursor,
+        profileDocumentId: directoryLane !== undefined
+            ? directoryLane.profileDocumentId
+            : (input.current?.profileDocumentId ?? null),
+        memberGroupId: input.memberGroupId,
+        memberGroupStateHash: input.memberGroupStateHash,
+        organizationStateHash: organizationHead.stateHash,
+        organizationStateVersion: organizationHead.version,
+        organizationKeyEpoch: organizationHead.keyEpoch,
+        organizationKeyFingerprint: organizationHead.keyFingerprint,
+        organizationMemberCount: organizationHead.memberCount,
+        updatedAt: input.now,
+    };
+    await input.tx
+        .insert(organizationReadModelState)
+        .values({ ...values, organizationId: input.response.organizationId })
+        .onConflictDoUpdate({
+        target: organizationReadModelState.organizationId,
+        set: values,
+    })
+        .run();
 }
 function requireMemberGroupId(input) {
     const memberGroupId = input.response.lanes.groups?.memberGroupId ?? input.current?.memberGroupId;
@@ -257,35 +293,21 @@ export async function applyOrganizationReadModelResponse(input) {
             current,
             response: input.response,
         });
-        await applyResponseLanes({
+        const memberGroupStateHash = await applyResponseLanes({
+            current,
             currentUserId: input.currentUserId,
             memberGroupId,
             response: input.response,
             tx,
         });
-        const directoryLane = input.response.lanes.directory;
-        const stateRow = {
-            organizationId: input.response.organizationId,
-            cursor: input.response.nextCursor,
-            profileDocumentId: directoryLane !== undefined
-                ? directoryLane.profileDocumentId
-                : (current?.profileDocumentId ?? null),
+        await upsertOrganizationReadModelState({
+            current,
             memberGroupId,
-            updatedAt: now,
-        };
-        await tx
-            .insert(organizationReadModelState)
-            .values(stateRow)
-            .onConflictDoUpdate({
-            target: organizationReadModelState.organizationId,
-            set: {
-                cursor: stateRow.cursor,
-                profileDocumentId: stateRow.profileDocumentId,
-                memberGroupId: stateRow.memberGroupId,
-                updatedAt: stateRow.updatedAt,
-            },
-        })
-            .run();
+            memberGroupStateHash,
+            now,
+            response: input.response,
+            tx,
+        });
         return "applied";
     });
     // An applied change follows an organization hint or mutation; in-flight