npm - @tearleads/client-sdk - Versions diffs - 0.1.58 → 0.1.60 - Mend

@tearleads/client-sdk 0.1.58 → 0.1.60

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (477) hide show

package/client/organizations/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,sCAAsC,GAEvC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AA4C9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC;IAEpC,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,oBAAoB;IAKL;IACA;IALF,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC;QADpC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAErD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,aAAsB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,aAAa;YACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB,CAAC,aAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,CACrD,SAAS,EACT,aAAa,CACd,CACJ,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createStripeCheckout,\n createStripeCheckoutSession,\n importOrganizationUser,\n listLocalOrganizations,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n startOrganizationTrial,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n createOrganizationDataUsageCoordinator,\n type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n createOrganizationReadModelCoordinator,\n type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n authenticatedOrganizationId,\n runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n type AbandonOrganizationPolicyMutationInput,\n abandonPendingOrganizationPolicyMutation,\n type DiscardUnreadableOrganizationPolicyMutationInput,\n discardUnreadableOrganizationPolicyMutation,\n readPendingOrganizationPolicyMutation,\n retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n type AddOrganizationGroupUserInput,\n addUserToOrganizationGroup,\n createGroupForOrganization,\n deleteGroupForOrganization,\n type OrganizationGrantRef,\n type RemoveOrganizationGroupUserInput,\n removeUserFromOrganizationGroup,\n revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n ImportedOrganizationUser,\n LocalOrganizationSummary,\n OrganizationBilling,\n OrganizationBillingHistory,\n OrganizationBillingHistoryEntry,\n OrganizationBillingManagementUrl,\n OrganizationBillingView,\n OrganizationContainerGrant,\n OrganizationContainerGrants,\n OrganizationDataUsage,\n OrganizationDirectory,\n OrganizationDirectoryAndGroups,\n OrganizationDirectoryUser,\n OrganizationGroupContainer,\n OrganizationGroupContainers,\n OrganizationGroupDetails,\n OrganizationGroupMember,\n OrganizationGroupMembers,\n OrganizationGroupPolicyHistory,\n OrganizationGroupSummary,\n OrganizationPolicyGrantChange,\n OrganizationPolicyGroupChange,\n OrganizationPolicyHistory,\n OrganizationPolicyHistoryEntry,\n OrganizationProfile,\n OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type {\n OrganizationGroupMutationReceipt,\n Organizations,\n} from \"./organizationsTypes\";\nexport type {\n AbandonOrganizationPolicyMutationInput,\n DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n AddOrganizationGroupUserInput,\n OrganizationGrantRef,\n RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n runtime: InternalRuntime,\n containerContents: ContainerContents,\n): Organizations {\n return new OrganizationsService(runtime, containerContents);\n}\n\nclass OrganizationsService implements Organizations {\n private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n constructor(\n private readonly runtimeService: InternalRuntime,\n private readonly containerContents: ContainerContents,\n ) {\n this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n this.runtimeService,\n );\n this.readModelCoordinator = createOrganizationReadModelCoordinator(\n this.runtimeService,\n );\n }\n\n async addUserToGroup(input: AddOrganizationGroupUserInput) {\n return addUserToOrganizationGroup({\n ...input,\n containerContents: this.containerContents,\n readModelCoordinator: this.readModelCoordinator,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n readPendingPolicyMutation(organizationId: string) {\n return readPendingOrganizationPolicyMutation(\n this.runtimeService,\n organizationId,\n );\n }\n\n discardUnreadablePolicyMutation(\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n ) {\n return discardUnreadableOrganizationPolicyMutation(\n this.runtimeService,\n input,\n );\n }\n\n retryPendingPolicyMutation(organizationId: string) {\n return retryPendingOrganizationPolicyMutation(\n this.runtimeService,\n organizationId,\n );\n }\n\n abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n }\n\n createGroup(name: string) {\n return createGroupForOrganization({\n name,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n deleteGroup(groupId: string) {\n return deleteGroupForOrganization({\n groupId,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n importUserById(userId: string) {\n const runtime = this.runtimeService.workflowInput();\n return importOrganizationUser({\n resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n userId,\n });\n }\n\n loadBilling() {\n return runForOrganization(this.runtimeService, loadOrganizationBilling);\n }\n\n loadBillingForOrganization(organizationId: string) {\n // Gated on an authenticated session rather than on the target being the\n // active org. The server still enforces membership, so an org the caller\n // cannot reach resolves to `null`.\n return runForOrganization(\n this.runtimeService,\n loadOrganizationBilling,\n organizationId,\n );\n }\n\n loadBillingHistory() {\n return runForOrganization(\n this.runtimeService,\n loadOrganizationBillingHistory,\n );\n }\n\n loadBillingManagementUrl() {\n return runForOrganization(\n this.runtimeService,\n loadOrganizationBillingManagementUrl,\n );\n }\n\n loadStripeCheckoutOptions(organizationId?: string) {\n return runForOrganization(\n this.runtimeService,\n loadStripeCheckoutOptions,\n organizationId,\n );\n }\n\n createStripeCheckout(organizationId?: string) {\n return runForOrganization(\n this.runtimeService,\n createStripeCheckout,\n organizationId,\n );\n }\n\n createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n return runForOrganization(\n this.runtimeService,\n (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n organizationId,\n );\n }\n\n cancelStripeSubscription() {\n return runForOrganization(this.runtimeService, cancelStripeSubscription);\n }\n\n claimNativeSubscription(\n organizationId: string,\n store: NativeSubscriptionStore,\n ) {\n return runForOrganization(\n this.runtimeService,\n (input) => claimNativeOrganizationSubscription({ ...input, store }),\n organizationId,\n );\n }\n\n checkNativePurchaseEligibility(\n organizationId: string,\n store: NativeSubscriptionStore,\n ) {\n return runForOrganization(\n this.runtimeService,\n (input) => checkNativePurchaseEligibility({ ...input, store }),\n organizationId,\n );\n }\n\n loadDataUsage() {\n return this.dataUsageCoordinator.reconcile();\n }\n\n loadLocalDataUsage() {\n return this.dataUsageCoordinator.loadLocal();\n }\n\n loadDirectoryAndGroups() {\n const runtime = this.runtimeService.workflowInput();\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: runtime.auth.organizationId,\n objectKind: \"principal\",\n operation: \"organization.read_model.reconcile\",\n organizationId: runtime.auth.organizationId,\n },\n () => this.readModelCoordinator.reconcile(),\n );\n }\n\n loadDirectoryAndGroupsAfterMutation() {\n const runtime = this.runtimeService.workflowInput();\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: runtime.auth.organizationId,\n objectKind: \"principal\",\n operation: \"organization.read_model.reconcile_after_mutation\",\n organizationId: runtime.auth.organizationId,\n },\n () => this.readModelCoordinator.reconcileAfterMutation(),\n );\n }\n\n loadLocalDirectoryAndGroups() {\n return this.readModelCoordinator.loadLocal();\n }\n\n loadGroupMembers(groupId: string) {\n const runtime = this.runtimeService.workflowInput();\n const organizationId = authenticatedOrganizationId(runtime);\n if (!organizationId \|\| groupId.length === 0) {\n return Promise.resolve(null);\n }\n\n return runtime.apiClient.listOrganizationGroupMembers(\n organizationId,\n groupId,\n );\n }\n\n loadGroupPresentationDetails(groupId: string, beforeVersion?: number) {\n const runtime = this.runtimeService.workflowInput();\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: groupId,\n objectKind: \"principal\",\n operation: \"group.presentation.load\",\n organizationId: runtime.auth.organizationId,\n },\n () =>\n loadOrganizationGroupPresentationDetails({\n groupId,\n beforeVersion,\n readModelCoordinator: this.readModelCoordinator,\n runtime,\n }),\n );\n }\n\n loadGrants() {\n return this.readModelCoordinator.loadLocalGrants();\n }\n\n loadGroupContainers(groupId: string) {\n return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n }\n\n listLocalOrganizations() {\n const runtime = this.runtimeService.workflowInput();\n if (runtime.infra.dbStatus !== \"ready\") {\n return Promise.resolve([]);\n }\n\n return listLocalOrganizations({ execSql: runtime.infra.execSql });\n }\n\n loadPolicyHistory(beforeVersion?: number) {\n const runtime = this.runtimeService.workflowInput();\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: runtime.auth.organizationId,\n objectKind: \"principal\",\n operation: \"organization.policy_history.load\",\n organizationId: runtime.auth.organizationId,\n },\n () =>\n this.readModelCoordinator.loadOrganizationPolicyHistory(\n undefined,\n beforeVersion,\n ),\n );\n }\n\n loadUserDetail(userId: string) {\n return this.readModelCoordinator.loadLocalUserDetail(userId);\n }\n\n updateRosterEntry(userId: string, profileDocumentId: string \| null) {\n const runtime = this.runtimeService.workflowInput();\n const organizationId = authenticatedOrganizationId(runtime);\n if (!organizationId \|\| userId.length === 0) {\n return Promise.resolve(null);\n }\n\n return updateOrganizationRosterEntry({\n apiClient: runtime.apiClient,\n organizationId,\n profileDocumentId,\n userId,\n });\n }\n\n updateProfile(profileDocumentId: string \| null) {\n const runtime = this.runtimeService.workflowInput();\n const organizationId = authenticatedOrganizationId(runtime);\n if (!organizationId) {\n return Promise.resolve(null);\n }\n\n return updateOrganizationProfile({\n apiClient: runtime.apiClient,\n organizationId,\n profileDocumentId,\n });\n }\n\n async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n return removeUserFromOrganizationGroup({\n ...input,\n containerContents: this.containerContents,\n readModelCoordinator: this.readModelCoordinator,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n async revokeGrant(grant: OrganizationGrantRef) {\n return revokeOrganizationGrant({\n ...grant,\n containerContents: this.containerContents,\n readModelCoordinator: this.readModelCoordinator,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n startTrial(organizationId?: string) {\n return runForOrganization(\n this.runtimeService,\n startOrganizationTrial,\n organizationId,\n );\n }\n}\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,sCAAsC,GAEvC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AA4C9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC;IAEpC,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,oBAAoB;IAKL;IACA;IALF,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC;QADpC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAErD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,aAAsB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,aAAa;YACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB,CAAC,aAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,CACrD,SAAS,EACT,aAAa,CACd,CACJ,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createStripeCheckout,\n createStripeCheckoutSession,\n importOrganizationUser,\n listLocalOrganizations,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n startOrganizationTrial,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n createOrganizationDataUsageCoordinator,\n type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n createOrganizationReadModelCoordinator,\n type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n authenticatedOrganizationId,\n runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n type AbandonOrganizationPolicyMutationInput,\n abandonPendingOrganizationPolicyMutation,\n type DiscardUnreadableOrganizationPolicyMutationInput,\n discardUnreadableOrganizationPolicyMutation,\n readPendingOrganizationPolicyMutation,\n retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n type AddOrganizationGroupUserInput,\n addUserToOrganizationGroup,\n createGroupForOrganization,\n deleteGroupForOrganization,\n type OrganizationGrantRef,\n type RemoveOrganizationGroupUserInput,\n removeUserFromOrganizationGroup,\n revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n ImportedOrganizationUser,\n LocalOrganizationSummary,\n OrganizationBilling,\n OrganizationBillingHistory,\n OrganizationBillingHistoryEntry,\n OrganizationBillingManagementUrl,\n OrganizationBillingView,\n OrganizationContainerGrant,\n OrganizationContainerGrants,\n OrganizationDataUsage,\n OrganizationDirectory,\n OrganizationDirectoryAndGroups,\n OrganizationDirectoryUser,\n OrganizationGroupContainer,\n OrganizationGroupContainers,\n OrganizationGroupDetails,\n OrganizationGroupMember,\n OrganizationGroupMembers,\n OrganizationGroupPolicyHistory,\n OrganizationGroupSummary,\n OrganizationPolicyGrantChange,\n OrganizationPolicyGroupChange,\n OrganizationPolicyHistory,\n OrganizationPolicyHistoryEntry,\n OrganizationProfile,\n OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type {\n OrganizationGroupMutationReceipt,\n Organizations,\n} from \"./organizationsTypes\";\nexport type {\n AbandonOrganizationPolicyMutationInput,\n DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n AddOrganizationGroupUserInput,\n OrganizationGrantRef,\n RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n runtime: InternalRuntime,\n containerContents: ContainerContents,\n): Organizations {\n return new OrganizationsService(runtime, containerContents);\n}\n\nclass OrganizationsService implements Organizations {\n private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n constructor(\n private readonly runtimeService: InternalRuntime,\n private readonly containerContents: ContainerContents,\n ) {\n this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n this.runtimeService,\n );\n this.readModelCoordinator = createOrganizationReadModelCoordinator(\n this.runtimeService,\n );\n }\n\n async addUserToGroup(input: AddOrganizationGroupUserInput) {\n return addUserToOrganizationGroup({\n ...input,\n containerContents: this.containerContents,\n readModelCoordinator: this.readModelCoordinator,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n readPendingPolicyMutation(organizationId: string) {\n return readPendingOrganizationPolicyMutation(\n this.runtimeService,\n organizationId,\n );\n }\n\n discardUnreadablePolicyMutation(\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n ) {\n return discardUnreadableOrganizationPolicyMutation(\n this.runtimeService,\n input,\n );\n }\n\n retryPendingPolicyMutation(organizationId: string) {\n return retryPendingOrganizationPolicyMutation(\n this.runtimeService,\n organizationId,\n );\n }\n\n abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n }\n\n createGroup(name: string) {\n return createGroupForOrganization({\n name,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n deleteGroup(groupId: string) {\n return deleteGroupForOrganization({\n groupId,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n importUserById(userId: string) {\n const runtime = this.runtimeService.workflowInput();\n return importOrganizationUser({\n resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n userId,\n });\n }\n\n loadBilling() {\n return runForOrganization(this.runtimeService, loadOrganizationBilling);\n }\n\n loadBillingForOrganization(organizationId: string) {\n // Gated on an authenticated session rather than on the target being the\n // active org. The server still enforces membership, so an org the caller\n // cannot reach resolves to `null`.\n return runForOrganization(\n this.runtimeService,\n loadOrganizationBilling,\n organizationId,\n );\n }\n\n loadBillingHistory() {\n return runForOrganization(\n this.runtimeService,\n loadOrganizationBillingHistory,\n );\n }\n\n loadBillingManagementUrl() {\n return runForOrganization(\n this.runtimeService,\n loadOrganizationBillingManagementUrl,\n );\n }\n\n loadStripeCheckoutOptions(organizationId?: string) {\n return runForOrganization(\n this.runtimeService,\n loadStripeCheckoutOptions,\n organizationId,\n );\n }\n\n createStripeCheckout(organizationId?: string) {\n return runForOrganization(\n this.runtimeService,\n createStripeCheckout,\n organizationId,\n );\n }\n\n createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n return runForOrganization(\n this.runtimeService,\n (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n organizationId,\n );\n }\n\n cancelStripeSubscription() {\n return runForOrganization(this.runtimeService, cancelStripeSubscription);\n }\n\n claimNativeSubscription(\n organizationId: string,\n store: NativeSubscriptionStore,\n ) {\n return runForOrganization(\n this.runtimeService,\n (input) => claimNativeOrganizationSubscription({ ...input, store }),\n organizationId,\n );\n }\n\n checkNativePurchaseEligibility(\n organizationId: string,\n store: NativeSubscriptionStore,\n ) {\n return runForOrganization(\n this.runtimeService,\n (input) => checkNativePurchaseEligibility({ ...input, store }),\n organizationId,\n );\n }\n\n loadDataUsage() {\n return this.dataUsageCoordinator.reconcile();\n }\n\n loadLocalDataUsage() {\n return this.dataUsageCoordinator.loadLocal();\n }\n\n loadDirectoryAndGroups() {\n const runtime = this.runtimeService.workflowInput();\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: runtime.auth.organizationId,\n objectKind: \"principal\",\n operation: \"organization.read_model.reconcile\",\n organizationId: runtime.auth.organizationId,\n },\n () => this.readModelCoordinator.reconcile(),\n );\n }\n\n loadDirectoryAndGroupsAfterMutation() {\n const runtime = this.runtimeService.workflowInput();\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: runtime.auth.organizationId,\n objectKind: \"principal\",\n operation: \"organization.read_model.reconcile_after_mutation\",\n organizationId: runtime.auth.organizationId,\n },\n () => this.readModelCoordinator.reconcileAfterMutation(),\n );\n }\n\n loadLocalDirectoryAndGroups() {\n return this.readModelCoordinator.loadLocal();\n }\n\n loadGroupMembers(groupId: string) {\n const runtime = this.runtimeService.workflowInput();\n const organizationId = authenticatedOrganizationId(runtime);\n if (!organizationId \|\| groupId.length === 0) {\n return Promise.resolve(null);\n }\n\n return runtime.apiClient.listOrganizationGroupMembers(\n organizationId,\n groupId,\n );\n }\n\n loadGroupPresentationDetails(groupId: string, beforeVersion?: number) {\n const runtime = this.runtimeService.workflowInput();\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: groupId,\n objectKind: \"principal\",\n operation: \"group.presentation.load\",\n organizationId: runtime.auth.organizationId,\n },\n () =>\n loadOrganizationGroupPresentationDetails({\n groupId,\n beforeVersion,\n readModelCoordinator: this.readModelCoordinator,\n runtime,\n }),\n );\n }\n\n loadGrants() {\n return this.readModelCoordinator.loadLocalGrants();\n }\n\n loadGroupContainers(groupId: string) {\n return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n }\n\n listLocalOrganizations() {\n const runtime = this.runtimeService.workflowInput();\n if (runtime.infra.dbStatus !== \"ready\") {\n return Promise.resolve([]);\n }\n\n return listLocalOrganizations({ execSql: runtime.infra.execSql });\n }\n\n loadPolicyHistory(beforeVersion?: number) {\n const runtime = this.runtimeService.workflowInput();\n return runWithSecurityIncidentReporting(\n runtime.util.reportSecurityIncident,\n {\n objectId: runtime.auth.organizationId,\n objectKind: \"principal\",\n operation: \"organization.policy_history.load\",\n organizationId: runtime.auth.organizationId,\n },\n () =>\n this.readModelCoordinator.loadOrganizationPolicyHistory(\n undefined,\n beforeVersion,\n ),\n );\n }\n\n loadUserDetail(userId: string) {\n return this.readModelCoordinator.loadLocalUserDetail(userId);\n }\n\n updateRosterEntry(userId: string, profileDocumentId: string \| null) {\n const runtime = this.runtimeService.workflowInput();\n const organizationId = authenticatedOrganizationId(runtime);\n if (!organizationId \|\| userId.length === 0) {\n return Promise.resolve(null);\n }\n\n return updateOrganizationRosterEntry({\n apiClient: runtime.apiClient,\n organizationId,\n profileDocumentId,\n userId,\n });\n }\n\n updateProfile(profileDocumentId: string \| null) {\n const runtime = this.runtimeService.workflowInput();\n const organizationId = authenticatedOrganizationId(runtime);\n if (!organizationId) {\n return Promise.resolve(null);\n }\n\n return updateOrganizationProfile({\n apiClient: runtime.apiClient,\n organizationId,\n profileDocumentId,\n });\n }\n\n async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n return removeUserFromOrganizationGroup({\n ...input,\n containerContents: this.containerContents,\n readModelCoordinator: this.readModelCoordinator,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n async revokeGrant(grant: OrganizationGrantRef) {\n return revokeOrganizationGrant({\n ...grant,\n containerContents: this.containerContents,\n readModelCoordinator: this.readModelCoordinator,\n ...currentOrganizationMutation(this.runtimeService),\n });\n }\n\n startTrial(organizationId?: string) {\n return runForOrganization(\n this.runtimeService,\n startOrganizationTrial,\n organizationId,\n );\n }\n}\n"]}

package/client/organizations/organizationAccessRestoration.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationAccessRestoration.js","sourceRoot":"","sources":["organizationAccessRestoration.ts"],"names":[],"mappings":"~~AACA~~,OAAO,EAAE,gCAAgC,EAAE,MAAM,yEAAyE,CAAC;AAC3H,OAAO,EAAE,uCAAuC,EAAE,MAAM,gEAAgE,CAAC;~~AACzH~~,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAG/F,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACpD,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,iEAAiE;IACjE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,gCAAgC;IAChC,IACE,CAAC,CAAC,MAAM,+BAA+B,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC,MAAM,gCAAgC,CAAC,oBAAoB,CAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC,CAAC;QACL,YAAY,EAAE,EACd,CAAC;QACD,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,gCAAgC,CAAC,sBAAsB,CAC3D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC;QACF,IAAI,YAAY,EAAE;YAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,sEAAsE;IACtE,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,0BAA0B,GAC9B,MAAM,uCAAuC,CAC3C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B;YACE,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CACF,CAAC;QACJ,IAAI,0BAA0B,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;YACrD,qBAAqB,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import ~~type~~ { ~~DomainScope~~ } from \"../../data/~~domainScope~~\";\nimport { ~~sqlDocumentMoveIntentPersistence~~ } from \"../../data/persistence/container-contents/~~documentMoveIntentPersistence~~\";\nimport { ~~requestDormantMetadataRestorationSweeps~~ } from \"../../data/~~persistence~~/~~container-contents/dormantMetadataSweep~~\";\nimport { hasRecordedTerminalSyncFailures } from \"../../data/sqlite/documentPersistence\";\nimport {\n requestAllDomainSyncLanes,\n requestDomainSyncLane,\n} from \"../../data/sync/syncCoordinator\";\nimport { CONTAINER_CONTENTS_SYNC_LANE_KEY } from \"../../workflows/container-contents/syncLane\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\n/** Recover parked work before optional presentation hydration can fail. */\nexport async function recoverOrganizationAccess(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly domainScope: DomainScope;\n readonly stillCurrent: () => boolean;\n}): Promise<void> {\n const { active, domainScope, stillCurrent } = input;\n if (!stillCurrent()) return;\n // The evidence gate: re-arm only when some queued write actually\n // recorded a terminal failure. A transient denial during bootstrap\n // (e.g. a read-model 403 before grants propagate) also flips the\n // denied flag, and re-arming then would race the startup sync passes.\n // A failed pass (`undefined`) proves nothing about restored access,\n // so it must not re-arm either.\n if (\n ((await hasRecordedTerminalSyncFailures(active.runtime.infra.execSql)) \|\|\n (await sqlDocumentMoveIntentPersistence.hasDeniedMoveIntents(\n active.runtime.infra.execSql,\n { organizationId: active.organizationId },\n ))) &&\n stillCurrent()\n ) {\n // Parked permission-denied moves (row 7) only replay once flipped\n // back to pending; restore them before re-arming the lanes.\n await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(\n active.runtime.infra.execSql,\n { organizationId: active.organizationId },\n );\n if (stillCurrent()) requestAllDomainSyncLanes(domainScope);\n }\n // Keep dormant cleanup independent from the write-lane evidence gate,\n // but run it afterward so a SQLite failure cannot suppress the\n // pre-existing denied-write and move-intent recovery signal.\n if (stillCurrent()) {\n const requestedDormantSweepCount =\n await requestDormantMetadataRestorationSweeps(\n active.runtime.infra.execSql,\n {\n requesterUserId: active.userId,\n },\n );\n if (requestedDormantSweepCount > 0 && stillCurrent()) {\n requestDomainSyncLane(domainScope, CONTAINER_CONTENTS_SYNC_LANE_KEY);\n }\n }\n}\n"]}
1	+ {"version":3,"file":"organizationAccessRestoration.js","sourceRoot":"","sources":["organizationAccessRestoration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yEAAyE,CAAC;AAC3H,OAAO,EAAE,uCAAuC,EAAE,MAAM,gEAAgE,CAAC;AAEzH,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAG/F,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACpD,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,iEAAiE;IACjE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,gCAAgC;IAChC,IACE,CAAC,CAAC,MAAM,+BAA+B,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC,MAAM,gCAAgC,CAAC,oBAAoB,CAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC,CAAC;QACL,YAAY,EAAE,EACd,CAAC;QACD,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,gCAAgC,CAAC,sBAAsB,CAC3D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC;QACF,IAAI,YAAY,EAAE;YAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,sEAAsE;IACtE,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,0BAA0B,GAC9B,MAAM,uCAAuC,CAC3C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B;YACE,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CACF,CAAC;QACJ,IAAI,0BAA0B,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;YACrD,qBAAqB,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { sqlDocumentMoveIntentPersistence } from \"../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { requestDormantMetadataRestorationSweeps } from \"../../data/persistence/container-contents/dormantMetadataSweep\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport { hasRecordedTerminalSyncFailures } from \"../../data/sqlite/documentPersistence\";\nimport {\n requestAllDomainSyncLanes,\n requestDomainSyncLane,\n} from \"../../data/sync/syncCoordinator\";\nimport { CONTAINER_CONTENTS_SYNC_LANE_KEY } from \"../../workflows/container-contents/syncLane\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\n/** Recover parked work before optional presentation hydration can fail. */\nexport async function recoverOrganizationAccess(input: {\n readonly active: ActiveOrganizationDataRuntime;\n readonly domainScope: DomainScope;\n readonly stillCurrent: () => boolean;\n}): Promise<void> {\n const { active, domainScope, stillCurrent } = input;\n if (!stillCurrent()) return;\n // The evidence gate: re-arm only when some queued write actually\n // recorded a terminal failure. A transient denial during bootstrap\n // (e.g. a read-model 403 before grants propagate) also flips the\n // denied flag, and re-arming then would race the startup sync passes.\n // A failed pass (`undefined`) proves nothing about restored access,\n // so it must not re-arm either.\n if (\n ((await hasRecordedTerminalSyncFailures(active.runtime.infra.execSql)) \|\|\n (await sqlDocumentMoveIntentPersistence.hasDeniedMoveIntents(\n active.runtime.infra.execSql,\n { organizationId: active.organizationId },\n ))) &&\n stillCurrent()\n ) {\n // Parked permission-denied moves (row 7) only replay once flipped\n // back to pending; restore them before re-arming the lanes.\n await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(\n active.runtime.infra.execSql,\n { organizationId: active.organizationId },\n );\n if (stillCurrent()) requestAllDomainSyncLanes(domainScope);\n }\n // Keep dormant cleanup independent from the write-lane evidence gate,\n // but run it afterward so a SQLite failure cannot suppress the\n // pre-existing denied-write and move-intent recovery signal.\n if (stillCurrent()) {\n const requestedDormantSweepCount =\n await requestDormantMetadataRestorationSweeps(\n active.runtime.infra.execSql,\n {\n requesterUserId: active.userId,\n },\n );\n if (requestedDormantSweepCount > 0 && stillCurrent()) {\n requestDomainSyncLane(domainScope, CONTAINER_CONTENTS_SYNC_LANE_KEY);\n }\n }\n}\n"]}

package/client/organizations/organizationDataUsage.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { type OrganizationDataUsage } from "../../workflows/organizations/index.js";
-import type { InternalRuntime } from "../workflowRuntime.js";
+import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 export interface OrganizationDataUsageCoordinator {
     loadLocal(organizationId?: string | undefined): Promise<OrganizationDataUsage | null>;
     /** Undefined means no authoritative result was available for this runtime. */

package/client/organizations/organizationDataUsage.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationDataUsage.js","sourceRoot":"","sources":["organizationDataUsage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAE9B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mEAAmE,CAAC;AAE/G,OAAO,EAEL,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AAYJ,MAAM,oCAAoC;IAQX;IALZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,8BAA8B,CAAC;gBAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE,MAAM,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAC1B,8CAA8C,EAC9C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,cAAuB;QAC/B,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,cAAc,GAAG,8BAA8B,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport {\n loadLocalOrganizationDataUsage,\n type OrganizationDataUsage,\n reconcileOrganizationDataUsage,\n} from \"../../workflows/organizations\";\nimport { organizationAccessScopeKey } from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationDataUsageCoordinator\n>();\n\nexport interface OrganizationDataUsageCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDataUsage \| null>;\n /** Undefined means no authoritative result was available for this runtime. */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDataUsage \| null \| undefined>;\n}\n\nclass OrganizationDataUsageCoordinatorImpl\n implements OrganizationDataUsageCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDataUsage \| null \| undefined>>\n >();\n\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n\n try {\n return await loadLocalOrganizationDataUsage({\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n });\n } catch (error) {\n active.runtime.util.logError(\n \"Failed to load local organization data usage\",\n error,\n );\n return null;\n }\n }\n\n reconcile(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return Promise.resolve(undefined);\n }\n if (!active.runtime.state.online) {\n return this.loadLocal(active.organizationId).then(\n (local) => local ?? undefined,\n );\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n const reconciliation = reconcileOrganizationDataUsage({\n apiClient: active.runtime.apiClient,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n }).finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n}\n\nexport function createOrganizationDataUsageCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationDataUsageCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationDataUsageCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}
1	+ {"version":3,"file":"organizationDataUsage.js","sourceRoot":"","sources":["organizationDataUsage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAE9B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mEAAmE,CAAC;AAE/G,OAAO,EAEL,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AAYJ,MAAM,oCAAoC;IAQX;IALZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,8BAA8B,CAAC;gBAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE,MAAM,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAC1B,8CAA8C,EAC9C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,cAAuB;QAC/B,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,cAAc,GAAG,8BAA8B,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n loadLocalOrganizationDataUsage,\n type OrganizationDataUsage,\n reconcileOrganizationDataUsage,\n} from \"../../workflows/organizations\";\nimport { organizationAccessScopeKey } from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationDataUsageCoordinator\n>();\n\nexport interface OrganizationDataUsageCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDataUsage \| null>;\n /** Undefined means no authoritative result was available for this runtime. */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDataUsage \| null \| undefined>;\n}\n\nclass OrganizationDataUsageCoordinatorImpl\n implements OrganizationDataUsageCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDataUsage \| null \| undefined>>\n >();\n\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n\n try {\n return await loadLocalOrganizationDataUsage({\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n });\n } catch (error) {\n active.runtime.util.logError(\n \"Failed to load local organization data usage\",\n error,\n );\n return null;\n }\n }\n\n reconcile(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return Promise.resolve(undefined);\n }\n if (!active.runtime.state.online) {\n return this.loadLocal(active.organizationId).then(\n (local) => local ?? undefined,\n );\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n const reconciliation = reconcileOrganizationDataUsage({\n apiClient: active.runtime.apiClient,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n }).finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n}\n\nexport function createOrganizationDataUsageCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationDataUsageCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationDataUsageCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}

package/client/organizations/organizationGroupNameHydration.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n runtimeService: InternalRuntime,\n active: ActiveOrganizationDataRuntime,\n domainScope: DomainScope,\n directoryAndGroups: OrganizationDirectoryAndGroups \| null \| undefined,\n) {\n if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n // Labels and their metadata root belong to this one reconciliation view.\n const currentRecovery = {\n resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n active.runtime,\n ),\n recoveryBatch: {},\n };\n return hydrateOrganizationGroupNames({\n apiClient: active.runtime.apiClient,\n directory: directoryAndGroups,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: active.organizationId,\n principalType: \"organization\",\n }),\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n createCurrentNameReader: (authority) =>\n createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n createSelectedCurrentGroupMetadataContainerVerifier({\n authority,\n organizationId: active.organizationId,\n stillCurrent,\n }),\n ).readName,\n readEncryptedName: createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n undefined,\n currentRecovery,\n ).readName,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n ...currentRecovery,\n stillCurrent,\n });\n }\n return directoryAndGroups;\n}\n"]}
1	+ {"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n type ActiveOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n runtimeService: InternalRuntime,\n active: ActiveOrganizationDataRuntime,\n domainScope: DomainScope,\n directoryAndGroups: OrganizationDirectoryAndGroups \| null \| undefined,\n) {\n if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n // Labels and their metadata root belong to this one reconciliation view.\n const currentRecovery = {\n resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n active.runtime,\n ),\n recoveryBatch: {},\n };\n return hydrateOrganizationGroupNames({\n apiClient: active.runtime.apiClient,\n directory: directoryAndGroups,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n principalId: active.organizationId,\n principalType: \"organization\",\n }),\n reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n createCurrentNameReader: (authority) =>\n createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n createSelectedCurrentGroupMetadataContainerVerifier({\n authority,\n organizationId: active.organizationId,\n stillCurrent,\n }),\n ).readName,\n readEncryptedName: createRuntimeGroupMetadataAccess(\n active.runtime,\n active.organizationId,\n stillCurrent,\n undefined,\n currentRecovery,\n ).readName,\n resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n ...currentRecovery,\n stillCurrent,\n });\n }\n return directoryAndGroups;\n}\n"]}

package/client/organizations/organizationGroupPresentation.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
+import type { InternalWorkflowRuntimeInput } from "../runtime/workflowRuntime.js";
 import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";
 export declare function loadOrganizationGroupPresentationDetails(input: {
     readonly groupId: string;

package/client/organizations/organizationGroupPresentation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationGroupPresentation.js","sourceRoot":"","sources":["organizationGroupPresentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AAIrH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAK9D;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,cAAc;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CACf;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,KAAK,CAAC,oBAAoB;aACvB,sBAAsB,CACrB,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,aAAa,CACpB;aACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,mEAAmE;YACnE,oEAAoE;YACpE,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;gBACjC,KAAK,YAAY,oCAAoC,EACrD,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;KACL,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport async function loadOrganizationGroupPresentationDetails(input: {\n readonly groupId: string;\n readonly beforeVersion?: number \| undefined;\n readonly readModelCoordinator: OrganizationReadModelCoordinator;\n readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n const organizationId = input.runtime.auth.organizationId;\n if (\n !input.runtime.auth.isAuthenticated \|\|\n !organizationId \|\|\n input.groupId.length === 0\n ) {\n return {\n members: null,\n policyHistory: null,\n };\n }\n\n const [members, policyHistory] = await Promise.all([\n input.beforeVersion === undefined\n ? input.readModelCoordinator.loadLocalGroupMembers(\n input.groupId,\n organizationId,\n )\n : Promise.resolve(null),\n input.readModelCoordinator\n .loadGroupPolicyHistory(\n input.groupId,\n organizationId,\n input.beforeVersion,\n )\n .catch((error: unknown) => {\n // Missing history must not hide the independent member projection.\n // Older-page failures remain explicit so the caller can retry them.\n if (\n input.beforeVersion === undefined &&\n error instanceof ProjectionDependencyUnavailableError\n ) {\n input.runtime.util.logError(\"Group history is unavailable\", error);\n return null;\n }\n throw error;\n }),\n ]);\n return { members, policyHistory };\n}\n"]}
1	+ {"version":3,"file":"organizationGroupPresentation.js","sourceRoot":"","sources":["organizationGroupPresentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AAIrH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAK9D;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,cAAc;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CACf;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,KAAK,CAAC,oBAAoB;aACvB,sBAAsB,CACrB,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,aAAa,CACpB;aACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,mEAAmE;YACnE,oEAAoE;YACpE,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;gBACjC,KAAK,YAAY,oCAAoC,EACrD,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;KACL,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport async function loadOrganizationGroupPresentationDetails(input: {\n readonly groupId: string;\n readonly beforeVersion?: number \| undefined;\n readonly readModelCoordinator: OrganizationReadModelCoordinator;\n readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n const organizationId = input.runtime.auth.organizationId;\n if (\n !input.runtime.auth.isAuthenticated \|\|\n !organizationId \|\|\n input.groupId.length === 0\n ) {\n return {\n members: null,\n policyHistory: null,\n };\n }\n\n const [members, policyHistory] = await Promise.all([\n input.beforeVersion === undefined\n ? input.readModelCoordinator.loadLocalGroupMembers(\n input.groupId,\n organizationId,\n )\n : Promise.resolve(null),\n input.readModelCoordinator\n .loadGroupPolicyHistory(\n input.groupId,\n organizationId,\n input.beforeVersion,\n )\n .catch((error: unknown) => {\n // Missing history must not hide the independent member projection.\n // Older-page failures remain explicit so the caller can retry them.\n if (\n input.beforeVersion === undefined &&\n error instanceof ProjectionDependencyUnavailableError\n ) {\n input.runtime.util.logError(\"Group history is unavailable\", error);\n return null;\n }\n throw error;\n }),\n ]);\n return { members, policyHistory };\n}\n"]}

package/client/organizations/organizationMetadataProfileSync.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { errorMessage } from "../../data/errorMessage.js";
+import { errorMessage } from "../../data/shared/errorMessage.js";
 import { getOrganizationProfileDocumentLocalId } from "../../workflows/organizations/organizationProfile.js";
 import { deriveOrganizationMetadataContainerSystemSlot } from "../../workflows/organizations/rosterProfileContainer.js";
 /**

package/client/organizations/organizationMetadataProfileSync.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationMetadataProfileSync.js","sourceRoot":"","sources":["organizationMetadataProfileSync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,~~yBAAyB~~,CAAC;~~AACvD~~,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,6CAA6C,EAAE,MAAM,sDAAsD,CAAC;AAGrH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,6CAA6C,CAAC;YACrE,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,IAAI;aACD,WAAW,EAAE;aACb,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACpE,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,GAAG,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CACP,+DAA+D,KAAK,CAAC,cAAc,wBAAwB,CAC5G,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,mBAAmB,CAAC;YAC1C,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,OAAO,EAAE,qCAAqC,CAAC;gBAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,GAAG,CACP,uEAAuE,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CACtH,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { errorMessage } from \"../../data/errorMessage\";\nimport { getOrganizationProfileDocumentLocalId } from \"../../workflows/organizations/organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"../../workflows/organizations/rosterProfileContainer\";\nimport type { ContainerContents } from \"../containerContents\";\n\n/*\n Push the locally-authored organization profile after Members changes. Key\n * rematerialization is already part of the policy transaction; this is only an\n * idempotent content sync and never creates or changes a grant.\n */\nexport async function syncOrganizationMetadataProfile(input: {\n readonly containerContents: ContainerContents;\n readonly log: (message: string) => void;\n readonly organizationId: string;\n}): Promise<void> {\n try {\n const systemSlot = await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.organizationId,\n });\n const tree = input.containerContents.openTree();\n const findNode = () =>\n tree\n .getSnapshot()\n .nodes.find((candidate) => candidate.systemSlot === systemSlot);\n let node = findNode();\n if (!node) {\n await tree.refresh();\n node = findNode();\n }\n if (!node) {\n input.log(\n `Organizations: org metadata container not reachable for org ${input.organizationId}; skipped profile sync`,\n );\n return;\n }\n\n input.containerContents.pullDocumentContent({\n containerId: node.id,\n localId: getOrganizationProfileDocumentLocalId({\n organizationId: input.organizationId,\n }),\n });\n } catch (error) {\n input.log(\n `Organizations: best-effort org metadata profile sync failed for org ${input.organizationId}: ${errorMessage(error)}`,\n );\n }\n}\n"]}
1	+ {"version":3,"file":"organizationMetadataProfileSync.js","sourceRoot":"","sources":["organizationMetadataProfileSync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,6CAA6C,EAAE,MAAM,sDAAsD,CAAC;AAGrH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,6CAA6C,CAAC;YACrE,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,IAAI;aACD,WAAW,EAAE;aACb,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACpE,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,GAAG,QAAQ,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CACP,+DAA+D,KAAK,CAAC,cAAc,wBAAwB,CAC5G,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,mBAAmB,CAAC;YAC1C,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,OAAO,EAAE,qCAAqC,CAAC;gBAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,GAAG,CACP,uEAAuE,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CACtH,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { errorMessage } from \"../../data/shared/errorMessage\";\nimport { getOrganizationProfileDocumentLocalId } from \"../../workflows/organizations/organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"../../workflows/organizations/rosterProfileContainer\";\nimport type { ContainerContents } from \"../containerContents\";\n\n/*\n Push the locally-authored organization profile after Members changes. Key\n * rematerialization is already part of the policy transaction; this is only an\n * idempotent content sync and never creates or changes a grant.\n */\nexport async function syncOrganizationMetadataProfile(input: {\n readonly containerContents: ContainerContents;\n readonly log: (message: string) => void;\n readonly organizationId: string;\n}): Promise<void> {\n try {\n const systemSlot = await deriveOrganizationMetadataContainerSystemSlot({\n organizationId: input.organizationId,\n });\n const tree = input.containerContents.openTree();\n const findNode = () =>\n tree\n .getSnapshot()\n .nodes.find((candidate) => candidate.systemSlot === systemSlot);\n let node = findNode();\n if (!node) {\n await tree.refresh();\n node = findNode();\n }\n if (!node) {\n input.log(\n `Organizations: org metadata container not reachable for org ${input.organizationId}; skipped profile sync`,\n );\n return;\n }\n\n input.containerContents.pullDocumentContent({\n containerId: node.id,\n localId: getOrganizationProfileDocumentLocalId({\n organizationId: input.organizationId,\n }),\n });\n } catch (error) {\n input.log(\n `Organizations: best-effort org metadata profile sync failed for org ${input.organizationId}: ${errorMessage(error)}`,\n );\n }\n}\n"]}

package/client/organizations/organizationReadModels.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { type OrganizationContainerGrants, type OrganizationDirectoryAndGroups, type OrganizationGroupContainers, type OrganizationGroupMembers, type OrganizationGroupPolicyHistory, type OrganizationPolicyHistory, type OrganizationUserDetail } from "../../workflows/organizations/index.js";
-import type { InternalRuntime } from "../workflowRuntime.js";
+import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 export interface OrganizationReadModelCoordinator {
     loadLocal(organizationId?: string | undefined): Promise<OrganizationDirectoryAndGroups | null>;
     loadLocalGroupMembers(groupId: string, organizationId?: string | undefined): Promise<OrganizationGroupMembers | null>;

package/client/organizations/organizationReadModels.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupMembers,\n loadLocalOrganizationUserDetail,\n type OrganizationContainerGrants,\n type OrganizationDirectoryAndGroups,\n type OrganizationGroupContainers,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationPolicyHistory,\n type OrganizationUserDetail,\n reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n organizationAccessScopeKey,\n wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null>;\n loadLocalGroupMembers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupMembers \| null>;\n loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationGroupPolicyHistory \| null>;\n loadOrganizationPolicyHistory(\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationPolicyHistory \| null>;\n loadLocalGrants(\n organizationId?: string \| undefined,\n ): Promise<OrganizationContainerGrants \| null>;\n loadLocalGroupContainers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupContainers \| null>;\n loadLocalUserDetail(\n userId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationUserDetail \| null>;\n /*\n Resolves `undefined` when the runtime declines without I/O (offline,\n * database not ready, organization mismatch) or when the feed failed with\n * no locally retained projection — passes that must not count as caught\n * up; `null` when the reconcile completed but produced nothing presentable\n * — including an authoritative denial that purged the projection, which\n * consumers must repaint.\n */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n reconcileAfterMutation(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n implements OrganizationReadModelCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDirectoryAndGroups \| null \| undefined>>\n >();\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationDirectoryAndGroups({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGrants(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationContainerGrants({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupContainers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupMembers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n const domainScope = active.runtime.state.domainScope;\n return loadBoundedOrganizationGroupHistory({\n active,\n groupId,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n }\n\n async loadOrganizationPolicyHistory(\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) return null;\n const domainScope = active.runtime.state.domainScope;\n return loadBoundedOrganizationHistory({\n active,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n }\n\n async loadLocalUserDetail(userId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| userId.length === 0) {\n return null;\n }\n return loadLocalOrganizationUserDetail({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n userId,\n });\n }\n\n reconcile(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return Promise.resolve(undefined);\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n // Snapshot the server-denied flag before reconciling. A reconcile that\n // flips it back to readable means org access was just restored (e.g. the\n // user was re-added to a group), and any write lanes idled by\n // permission-denied submissions have no self re-arm — regaining access is\n // their retry signal, mirroring how billing recovery re-requests all\n // lanes. Only a genuine server denial counts: a local session reset also\n // marks scopes denied, and re-arming on its first reconcile would race the\n // startup sync passes (e.g. pending-create adoption between panes).\n const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n {\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n },\n \"readModel\",\n );\n const domainScope = active.runtime.state.domainScope;\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n );\n\n const reconciliation = reconcileOrganizationDirectoryAndGroups({\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n })\n .then(async (directoryAndGroups) => {\n if (!stillCurrent()) return null;\n // Feed success restores retry eligibility even if name decryption fails.\n const accessWasRestored =\n accessWasDenied &&\n directoryAndGroups !== null &&\n directoryAndGroups !== undefined;\n if (accessWasRestored)\n await recoverOrganizationAccess({\n active,\n domainScope,\n stillCurrent,\n });\n if (!stillCurrent()) return null;\n return hydrateOrganizationGroupNamesForRuntime(\n this.runtimeService,\n active,\n domainScope,\n directoryAndGroups,\n );\n })\n .finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n\n async reconcileAfterMutation(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return undefined;\n }\n const existing = this.reconciliationMap(active).get(\n organizationAccessScopeKey(active.organizationId, active.userId),\n );\n if (existing) {\n await existing.catch(() => null);\n }\n return this.reconcile(active.organizationId);\n }\n}\n\nexport function createOrganizationReadModelCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}
1	+ {"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n loadLocalOrganizationContainerGrants,\n loadLocalOrganizationDirectoryAndGroups,\n loadLocalOrganizationGroupContainers,\n loadLocalOrganizationGroupMembers,\n loadLocalOrganizationUserDetail,\n type OrganizationContainerGrants,\n type OrganizationDirectoryAndGroups,\n type OrganizationGroupContainers,\n type OrganizationGroupMembers,\n type OrganizationGroupPolicyHistory,\n type OrganizationPolicyHistory,\n type OrganizationUserDetail,\n reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n organizationAccessScopeKey,\n wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n type ActiveOrganizationDataRuntime,\n activeOrganizationDataRuntime,\n isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n InternalRuntime,\n OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n loadLocal(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null>;\n loadLocalGroupMembers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupMembers \| null>;\n loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationGroupPolicyHistory \| null>;\n loadOrganizationPolicyHistory(\n organizationId?: string \| undefined,\n beforeVersion?: number \| undefined,\n ): Promise<OrganizationPolicyHistory \| null>;\n loadLocalGrants(\n organizationId?: string \| undefined,\n ): Promise<OrganizationContainerGrants \| null>;\n loadLocalGroupContainers(\n groupId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationGroupContainers \| null>;\n loadLocalUserDetail(\n userId: string,\n organizationId?: string \| undefined,\n ): Promise<OrganizationUserDetail \| null>;\n /*\n Resolves `undefined` when the runtime declines without I/O (offline,\n * database not ready, organization mismatch) or when the feed failed with\n * no locally retained projection — passes that must not count as caught\n * up; `null` when the reconcile completed but produced nothing presentable\n * — including an authoritative denial that purged the projection, which\n * consumers must repaint.\n */\n reconcile(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n reconcileAfterMutation(\n organizationId?: string \| undefined,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n implements OrganizationReadModelCoordinator\n{\n private readonly reconciliationsByScope = new WeakMap<\n DomainScope,\n Map<string, Promise<OrganizationDirectoryAndGroups \| null \| undefined>>\n >();\n constructor(private readonly runtimeService: InternalRuntime) {}\n\n private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n const scope = active.runtime.state.domainScope;\n let byKey = this.reconciliationsByScope.get(scope);\n if (!byKey) {\n byKey = new Map();\n this.reconciliationsByScope.set(scope, byKey);\n }\n return byKey;\n }\n\n async loadLocal(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationDirectoryAndGroups({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGrants(organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) {\n return null;\n }\n return loadLocalOrganizationContainerGrants({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupContainers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n return loadLocalOrganizationGroupMembers({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n groupId,\n organizationId: active.organizationId,\n });\n }\n\n async loadGroupPolicyHistory(\n groupId: string,\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| groupId.length === 0) {\n return null;\n }\n const domainScope = active.runtime.state.domainScope;\n return loadBoundedOrganizationGroupHistory({\n active,\n groupId,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n }\n\n async loadOrganizationPolicyHistory(\n organizationId?: string,\n beforeVersion?: number,\n ) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active) return null;\n const domainScope = active.runtime.state.domainScope;\n return loadBoundedOrganizationHistory({\n active,\n beforeVersion,\n stillCurrent: () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n ),\n });\n }\n\n async loadLocalUserDetail(userId: string, organizationId?: string) {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active \|\| userId.length === 0) {\n return null;\n }\n return loadLocalOrganizationUserDetail({\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n userId,\n });\n }\n\n reconcile(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return Promise.resolve(undefined);\n }\n\n const byKey = this.reconciliationMap(active);\n const key = organizationAccessScopeKey(\n active.organizationId,\n active.userId,\n );\n const existing = byKey.get(key);\n if (existing) {\n return existing;\n }\n\n // Snapshot the server-denied flag before reconciling. A reconcile that\n // flips it back to readable means org access was just restored (e.g. the\n // user was re-added to a group), and any write lanes idled by\n // permission-denied submissions have no self re-arm — regaining access is\n // their retry signal, mirroring how billing recovery re-requests all\n // lanes. Only a genuine server denial counts: a local session reset also\n // marks scopes denied, and re-arming on its first reconcile would race the\n // startup sync passes (e.g. pending-create adoption between panes).\n const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n {\n execSql: active.runtime.infra.execSql,\n organizationId: active.organizationId,\n requesterUserId: active.userId,\n },\n \"readModel\",\n );\n const domainScope = active.runtime.state.domainScope;\n const stillCurrent = () =>\n isOrganizationDataRuntimeCurrent(\n this.runtimeService,\n active,\n domainScope,\n );\n\n const reconciliation = reconcileOrganizationDirectoryAndGroups({\n apiClient: active.runtime.apiClient,\n currentUserId: active.userId,\n execSql: active.runtime.infra.execSql,\n logError: active.runtime.util.logError,\n organizationId: active.organizationId,\n })\n .then(async (directoryAndGroups) => {\n if (!stillCurrent()) return null;\n // Feed success restores retry eligibility even if name decryption fails.\n const accessWasRestored =\n accessWasDenied &&\n directoryAndGroups !== null &&\n directoryAndGroups !== undefined;\n if (accessWasRestored)\n await recoverOrganizationAccess({\n active,\n domainScope,\n stillCurrent,\n });\n if (!stillCurrent()) return null;\n return hydrateOrganizationGroupNamesForRuntime(\n this.runtimeService,\n active,\n domainScope,\n directoryAndGroups,\n );\n })\n .finally(() => {\n if (byKey.get(key) === reconciliation) {\n byKey.delete(key);\n }\n });\n byKey.set(key, reconciliation);\n return reconciliation;\n }\n\n async reconcileAfterMutation(\n organizationId?: string,\n ): Promise<OrganizationDirectoryAndGroups \| null \| undefined> {\n const active = activeOrganizationDataRuntime(\n this.runtimeService,\n organizationId,\n );\n if (!active?.runtime.state.online) {\n return undefined;\n }\n const existing = this.reconciliationMap(active).get(\n organizationAccessScopeKey(active.organizationId, active.userId),\n );\n if (existing) {\n await existing.catch(() => null);\n }\n return this.reconcile(active.organizationId);\n }\n}\n\nexport function createOrganizationReadModelCoordinator(\n runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n const existing = coordinatorsByRuntime.get(runtimeService);\n if (existing) {\n return existing;\n }\n\n const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n coordinatorsByRuntime.set(runtimeService, coordinator);\n return coordinator;\n}\n"]}

package/client/organizations/organizationWorkflowRuntime.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationWorkflowRuntime.js","sourceRoot":"","sources":["organizationWorkflowRuntime.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe;QAChE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC7B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,cAA+B,EAC/B,QAAiC,EACjC,oBAA6B;IAE7B,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC/C,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,cAAc,GAClB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,oBAAoB,CAAC;IAC3B,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;AACpE,CAAC;AAQD,MAAM,UAAU,6BAA6B,CAC3C,cAA+B,EAC/B,sBAA+B;IAE/B,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IACnC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAC7B,CAAC,cAAc;QACf,CAAC,MAAM;QACP,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;QAClC,CAAC,sBAAsB,KAAK,SAAS;YACnC,cAAc,KAAK,sBAAsB,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,cAA+B,EAC/B,MAAqC,EACrC,WAAwB;IAExB,MAAM,OAAO,GAAG,6BAA6B,CAC3C,cAAc,EACd,MAAM,CAAC,cAAc,CACtB,CAAC;IACF,OAAO,CACL,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM;QACjC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAClD,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/domainScope\";\nimport type {\n InternalRuntime,\n InternalWorkflowRuntimeInput,\n} from \"../workflowRuntime\";\n\ntype OrganizationWorkflow<T> = (input: {\n readonly apiClient: InternalWorkflowRuntimeInput[\"apiClient\"];\n readonly organizationId: string;\n}) => Promise<T>;\n\nexport function authenticatedOrganizationId(\n runtime: InternalWorkflowRuntimeInput,\n): string \| null {\n return runtime.auth.organizationId && runtime.auth.isAuthenticated\n ? runtime.auth.organizationId\n : null;\n}\n\nexport function runForOrganization<T>(\n runtimeService: InternalRuntime,\n workflow: OrganizationWorkflow<T>,\n targetOrganizationId?: string,\n): Promise<T \| null> {\n const runtime = runtimeService.workflowInput();\n const activeOrganizationId = authenticatedOrganizationId(runtime);\n const organizationId =\n targetOrganizationId === undefined\n ? activeOrganizationId\n : targetOrganizationId;\n if (!activeOrganizationId \|\| !organizationId) {\n return Promise.resolve(null);\n }\n\n return workflow({ apiClient: runtime.apiClient, organizationId });\n}\n\nexport interface ActiveOrganizationDataRuntime {\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly organizationId: string;\n readonly userId: string;\n}\n\nexport function activeOrganizationDataRuntime(\n runtimeService: InternalRuntime,\n expectedOrganizationId?: string,\n): ActiveOrganizationDataRuntime \| null {\n const runtime = runtimeService.workflowInput();\n const organizationId = runtime.auth.organizationId;\n const userId = runtime.auth.userId;\n if (\n !runtime.auth.isAuthenticated \|\|\n !organizationId \|\|\n !userId \|\|\n runtime.infra.dbStatus !== \"ready\" \|\|\n (expectedOrganizationId !== undefined &&\n organizationId !== expectedOrganizationId)\n ) {\n return null;\n }\n\n return { runtime, organizationId, userId };\n}\n\nexport function isOrganizationDataRuntimeCurrent(\n runtimeService: InternalRuntime,\n active: ActiveOrganizationDataRuntime,\n domainScope: DomainScope,\n): boolean {\n const current = activeOrganizationDataRuntime(\n runtimeService,\n active.organizationId,\n );\n return (\n current?.userId === active.userId &&\n current.runtime.infra.execSql === active.runtime.infra.execSql &&\n current.runtime.state.domainScope === domainScope\n );\n}\n"]}
1	+ {"version":3,"file":"organizationWorkflowRuntime.js","sourceRoot":"","sources":["organizationWorkflowRuntime.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe;QAChE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC7B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,cAA+B,EAC/B,QAAiC,EACjC,oBAA6B;IAE7B,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC/C,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,cAAc,GAClB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,oBAAoB,CAAC;IAC3B,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;AACpE,CAAC;AAQD,MAAM,UAAU,6BAA6B,CAC3C,cAA+B,EAC/B,sBAA+B;IAE/B,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IACnC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAC7B,CAAC,cAAc;QACf,CAAC,MAAM;QACP,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;QAClC,CAAC,sBAAsB,KAAK,SAAS;YACnC,cAAc,KAAK,sBAAsB,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,cAA+B,EAC/B,MAAqC,EACrC,WAAwB;IAExB,MAAM,OAAO,GAAG,6BAA6B,CAC3C,cAAc,EACd,MAAM,CAAC,cAAc,CACtB,CAAC;IACF,OAAO,CACL,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM;QACjC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAClD,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport type {\n InternalRuntime,\n InternalWorkflowRuntimeInput,\n} from \"../runtime/workflowRuntime\";\n\ntype OrganizationWorkflow<T> = (input: {\n readonly apiClient: InternalWorkflowRuntimeInput[\"apiClient\"];\n readonly organizationId: string;\n}) => Promise<T>;\n\nexport function authenticatedOrganizationId(\n runtime: InternalWorkflowRuntimeInput,\n): string \| null {\n return runtime.auth.organizationId && runtime.auth.isAuthenticated\n ? runtime.auth.organizationId\n : null;\n}\n\nexport function runForOrganization<T>(\n runtimeService: InternalRuntime,\n workflow: OrganizationWorkflow<T>,\n targetOrganizationId?: string,\n): Promise<T \| null> {\n const runtime = runtimeService.workflowInput();\n const activeOrganizationId = authenticatedOrganizationId(runtime);\n const organizationId =\n targetOrganizationId === undefined\n ? activeOrganizationId\n : targetOrganizationId;\n if (!activeOrganizationId \|\| !organizationId) {\n return Promise.resolve(null);\n }\n\n return workflow({ apiClient: runtime.apiClient, organizationId });\n}\n\nexport interface ActiveOrganizationDataRuntime {\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly organizationId: string;\n readonly userId: string;\n}\n\nexport function activeOrganizationDataRuntime(\n runtimeService: InternalRuntime,\n expectedOrganizationId?: string,\n): ActiveOrganizationDataRuntime \| null {\n const runtime = runtimeService.workflowInput();\n const organizationId = runtime.auth.organizationId;\n const userId = runtime.auth.userId;\n if (\n !runtime.auth.isAuthenticated \|\|\n !organizationId \|\|\n !userId \|\|\n runtime.infra.dbStatus !== \"ready\" \|\|\n (expectedOrganizationId !== undefined &&\n organizationId !== expectedOrganizationId)\n ) {\n return null;\n }\n\n return { runtime, organizationId, userId };\n}\n\nexport function isOrganizationDataRuntimeCurrent(\n runtimeService: InternalRuntime,\n active: ActiveOrganizationDataRuntime,\n domainScope: DomainScope,\n): boolean {\n const current = activeOrganizationDataRuntime(\n runtimeService,\n active.organizationId,\n );\n return (\n current?.userId === active.userId &&\n current.runtime.infra.execSql === active.runtime.infra.execSql &&\n current.runtime.state.domainScope === domainScope\n );\n}\n"]}

package/client/organizations/organizationsTypes.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import type { NativeSubscriptionStore } from "../../internal/validators/billing.js";
 import type { PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
 import type { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, revokeOrganizationContainerGrant, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
-import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
+import type { InternalWorkflowRuntimeInput } from "../runtime/workflowRuntime.js";
 import type { OrganizationDataUsageCoordinator } from "./organizationDataUsage.js";
 import type { loadOrganizationGroupPresentationDetails } from "./organizationGroupPresentation.js";
 import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";

package/client/organizations/organizationsTypes.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createOrganizationGroup,\n createStripeCheckout,\n createStripeCheckoutSession,\n importOrganizationUser,\n LocalOrganizationSummary,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n revokeOrganizationContainerGrant,\n startOrganizationTrial,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n AbandonOrganizationPolicyMutationInput,\n DiscardUnreadableOrganizationPolicyMutationInput,\n readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n AddOrganizationGroupUserInput,\n deleteGroupForOrganization,\n OrganizationGrantRef,\n RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. /\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n discardUnreadablePolicyMutation: (\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n readPendingPolicyMutation: (\n organizationId: string,\n ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n abandonPendingPolicyMutation: (\n input: AbandonOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n addUserToGroup: (\n input: AddOrganizationGroupUserInput,\n ) => Promise<OrganizationGroupMutationReceipt>;\n createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n deleteGroup: (\n groupId: string,\n ) => ReturnType<typeof deleteGroupForOrganization>;\n importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n /* Billing for an organization the session is not currently switched to. /\n loadBillingForOrganization: (\n organizationId: string,\n ) => ReturnType<typeof loadOrganizationBilling>;\n loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n loadBillingManagementUrl: () => ReturnType<\n typeof loadOrganizationBillingManagementUrl\n >;\n /* Direct Stripe checkout (issue #1654): options, start, and cancel. */\n loadStripeCheckoutOptions: (\n organizationId?: string,\n ) => ReturnType<typeof loadStripeCheckoutOptions>;\n createStripeCheckout: (\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckout>;\n createStripeCheckoutSession: (\n returnUrl: string,\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckoutSession>;\n cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n claimNativeSubscription: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n checkNativePurchaseEligibility: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof checkNativePurchaseEligibility>;\n loadDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"reconcile\"]\n >;\n loadLocalDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"loadLocal\"]\n >;\n loadDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcile\"]\n >;\n loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n >;\n loadLocalDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocal\"]\n >;\n loadGroupMembers: (\n groupId: string,\n ) => ReturnType<\n InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n >;\n loadGroupPresentationDetails(\n groupId: string,\n beforeVersion?: number,\n ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n loadGroupContainers: (\n groupId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n loadGrants: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n >;\n listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n loadPolicyHistory: (\n beforeVersion?: number,\n ) => ReturnType<\n OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n >;\n loadUserDetail: (\n userId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n updateRosterEntry: (\n userId: string,\n profileDocumentId: string \| null,\n ) => ReturnType<typeof updateOrganizationRosterEntry>;\n updateProfile: (\n profileDocumentId: string \| null,\n ) => ReturnType<typeof updateOrganizationProfile>;\n removeUserFromGroup: (\n input: RemoveOrganizationGroupUserInput,\n ) => Promise<OrganizationGroupMutationReceipt>;\n revokeGrant: (\n grant: OrganizationGrantRef,\n ) => Promise<\n \| Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n \| OrganizationGroupMutationReceipt\n >;\n startTrial: (\n organizationId?: string,\n ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}
1	+ {"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n cancelStripeSubscription,\n checkNativePurchaseEligibility,\n claimNativeOrganizationSubscription,\n createOrganizationGroup,\n createStripeCheckout,\n createStripeCheckoutSession,\n importOrganizationUser,\n LocalOrganizationSummary,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n loadStripeCheckoutOptions,\n revokeOrganizationContainerGrant,\n startOrganizationTrial,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n AbandonOrganizationPolicyMutationInput,\n DiscardUnreadableOrganizationPolicyMutationInput,\n readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n AddOrganizationGroupUserInput,\n deleteGroupForOrganization,\n OrganizationGrantRef,\n RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. /\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n discardUnreadablePolicyMutation: (\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n readPendingPolicyMutation: (\n organizationId: string,\n ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n abandonPendingPolicyMutation: (\n input: AbandonOrganizationPolicyMutationInput,\n ) => Promise<boolean>;\n addUserToGroup: (\n input: AddOrganizationGroupUserInput,\n ) => Promise<OrganizationGroupMutationReceipt>;\n createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n deleteGroup: (\n groupId: string,\n ) => ReturnType<typeof deleteGroupForOrganization>;\n importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n /* Billing for an organization the session is not currently switched to. /\n loadBillingForOrganization: (\n organizationId: string,\n ) => ReturnType<typeof loadOrganizationBilling>;\n loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n loadBillingManagementUrl: () => ReturnType<\n typeof loadOrganizationBillingManagementUrl\n >;\n /* Direct Stripe checkout (issue #1654): options, start, and cancel. */\n loadStripeCheckoutOptions: (\n organizationId?: string,\n ) => ReturnType<typeof loadStripeCheckoutOptions>;\n createStripeCheckout: (\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckout>;\n createStripeCheckoutSession: (\n returnUrl: string,\n organizationId?: string,\n ) => ReturnType<typeof createStripeCheckoutSession>;\n cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n claimNativeSubscription: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n checkNativePurchaseEligibility: (\n organizationId: string,\n store: NativeSubscriptionStore,\n ) => ReturnType<typeof checkNativePurchaseEligibility>;\n loadDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"reconcile\"]\n >;\n loadLocalDataUsage: () => ReturnType<\n OrganizationDataUsageCoordinator[\"loadLocal\"]\n >;\n loadDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcile\"]\n >;\n loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n >;\n loadLocalDirectoryAndGroups: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocal\"]\n >;\n loadGroupMembers: (\n groupId: string,\n ) => ReturnType<\n InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n >;\n loadGroupPresentationDetails(\n groupId: string,\n beforeVersion?: number,\n ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n loadGroupContainers: (\n groupId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n loadGrants: () => ReturnType<\n OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n >;\n listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n loadPolicyHistory: (\n beforeVersion?: number,\n ) => ReturnType<\n OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n >;\n loadUserDetail: (\n userId: string,\n ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n updateRosterEntry: (\n userId: string,\n profileDocumentId: string \| null,\n ) => ReturnType<typeof updateOrganizationRosterEntry>;\n updateProfile: (\n profileDocumentId: string \| null,\n ) => ReturnType<typeof updateOrganizationProfile>;\n removeUserFromGroup: (\n input: RemoveOrganizationGroupUserInput,\n ) => Promise<OrganizationGroupMutationReceipt>;\n revokeGrant: (\n grant: OrganizationGrantRef,\n ) => Promise<\n \| Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n \| OrganizationGroupMutationReceipt\n >;\n startTrial: (\n organizationId?: string,\n ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}

package/client/organizations/principalContainerMutations.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n type PreparedPrincipalContainerRematerializationBatch,\n preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../../workflows/organizations/principalContainerRematerializationPlanning\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n readonly preceding?: PrincipalRematerializationPredecessor \| undefined;\n readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n readonly groupId: string;\n readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n readonly resolveAuthoredPolicyReferences?:\n \| CurrentPolicyReferenceResolver\n \| undefined;\n readonly organizationId: string;\n readonly revokedContainerId?: string \| undefined;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n readonly recitationStillCurrent?: (() => boolean) \| undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n const author = resolveDocumentCreateAuthor(input.runtime);\n const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !targetSecretKey) {\n throw new Error(\n \"Organization container rematerialization context is unavailable\",\n );\n }\n return preparePrincipalContainerRematerializationBatch({\n preceding: input.preceding,\n stillCurrent: input.stillCurrent,\n recitationStillCurrent: input.recitationStillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n author,\n execSql: input.runtime.infra.execSql,\n grants: [\n ...new Map(\n [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n (grant) => [grant.containerId, grant] as const,\n ),\n ).values(),\n ],\n groupId: input.groupId,\n nextPolicy: input.nextPolicy,\n resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n revokedContainerId: input.revokedContainerId,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n}\n"]}
1	+ {"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n type PreparedPrincipalContainerRematerializationBatch,\n preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../../workflows/organizations/principalContainerRematerializationPlanning\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n readonly preceding?: PrincipalRematerializationPredecessor \| undefined;\n readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n readonly groupId: string;\n readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n readonly resolveAuthoredPolicyReferences?:\n \| CurrentPolicyReferenceResolver\n \| undefined;\n readonly organizationId: string;\n readonly revokedContainerId?: string \| undefined;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n readonly recitationStillCurrent?: (() => boolean) \| undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n const author = resolveDocumentCreateAuthor(input.runtime);\n const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n if (!author \|\| !targetSecretKey) {\n throw new Error(\n \"Organization container rematerialization context is unavailable\",\n );\n }\n return preparePrincipalContainerRematerializationBatch({\n preceding: input.preceding,\n stillCurrent: input.stillCurrent,\n recitationStillCurrent: input.recitationStillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n author,\n execSql: input.runtime.infra.execSql,\n grants: [\n ...new Map(\n [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n (grant) => [grant.containerId, grant] as const,\n ),\n ).values(),\n ],\n groupId: input.groupId,\n nextPolicy: input.nextPolicy,\n resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n revokedContainerId: input.revokedContainerId,\n resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n targetSecretKey,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n });\n}\n"]}

package/client/organizations/principalMutationRecovery.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { AuthoredPrincipalMutation } from "../../data/principals/principalMutationJournal.js";
-import type { InternalRuntime } from "../workflowRuntime.js";
+import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 export interface AbandonOrganizationPolicyMutationInput {
     readonly organizationId: string;
     readonly mutation: AuthoredPrincipalMutation;

package/client/organizations/principalMutationRecovery.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalMutationRecovery.js","sourceRoot":"","sources":["principalMutationRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAIpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAcvE,KAAK,UAAU,WAAW,CACxB,OAAwB,EACxB,cAAsB,EACtB,GAAsD;IAEtD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACzC,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,cAAc,CACvE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,OAAwB,EACxB,KAAuD;IAEvD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,kCAAkC,CACpC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,4BAA4B,CAAC,cAAc,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,+BAA+B,CAAC,cAAc,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAwB,EACxB,KAA6C;IAE7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,+BAA+B,CACjC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport type { PrincipalMutationRecoveryApi } from \"../../workflows/organizations/principalMutationJournalManagement\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\n\nexport interface AbandonOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly mutation: AuthoredPrincipalMutation;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nexport interface DiscardUnreadableOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly recordId: string;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nasync function runRecovery<T>(\n service: InternalRuntime,\n organizationId: string,\n run: (api: PrincipalMutationRecoveryApi) => Promise<T>,\n): Promise<T> {\n const active = currentOrganizationMutation(service, true);\n const { runtime, stillCurrent } = active;\n assertProjectionVerificationCurrent(\n () => stillCurrent() && runtime.auth.organizationId === organizationId,\n );\n const result = await run(runtime.apiClient);\n assertProjectionVerificationCurrent(stillCurrent);\n return result;\n}\n\nexport function discardUnreadableOrganizationPolicyMutation(\n service: InternalRuntime,\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.discardUnreadablePrincipalMutation(\n input.organizationId,\n input.recordId,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n\nexport function readPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.readPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function retryPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.recoverPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function abandonPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n input: AbandonOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.abandonPendingPrincipalMutation(\n input.organizationId,\n input.mutation,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n"]}
1	+ {"version":3,"file":"principalMutationRecovery.js","sourceRoot":"","sources":["principalMutationRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAIpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAcvE,KAAK,UAAU,WAAW,CACxB,OAAwB,EACxB,cAAsB,EACtB,GAAsD;IAEtD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACzC,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,cAAc,CACvE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,OAAwB,EACxB,KAAuD;IAEvD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,kCAAkC,CACpC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,4BAA4B,CAAC,cAAc,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,+BAA+B,CAAC,cAAc,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAwB,EACxB,KAA6C;IAE7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,+BAA+B,CACjC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport type { PrincipalMutationRecoveryApi } from \"../../workflows/organizations/principalMutationJournalManagement\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\n\nexport interface AbandonOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly mutation: AuthoredPrincipalMutation;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nexport interface DiscardUnreadableOrganizationPolicyMutationInput {\n readonly organizationId: string;\n readonly recordId: string;\n readonly acknowledgeUnknownOutcome: true;\n}\n\nasync function runRecovery<T>(\n service: InternalRuntime,\n organizationId: string,\n run: (api: PrincipalMutationRecoveryApi) => Promise<T>,\n): Promise<T> {\n const active = currentOrganizationMutation(service, true);\n const { runtime, stillCurrent } = active;\n assertProjectionVerificationCurrent(\n () => stillCurrent() && runtime.auth.organizationId === organizationId,\n );\n const result = await run(runtime.apiClient);\n assertProjectionVerificationCurrent(stillCurrent);\n return result;\n}\n\nexport function discardUnreadableOrganizationPolicyMutation(\n service: InternalRuntime,\n input: DiscardUnreadableOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.discardUnreadablePrincipalMutation(\n input.organizationId,\n input.recordId,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n\nexport function readPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.readPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function retryPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n organizationId: string,\n) {\n return runRecovery(service, organizationId, (api) =>\n api.recoverPendingPrincipalMutation(organizationId),\n );\n}\n\nexport function abandonPendingOrganizationPolicyMutation(\n service: InternalRuntime,\n input: AbandonOrganizationPolicyMutationInput,\n) {\n return runRecovery(service, input.organizationId, (api) =>\n api.abandonPendingPrincipalMutation(\n input.organizationId,\n input.mutation,\n input.acknowledgeUnknownOutcome,\n ),\n );\n}\n"]}

package/client/organizations/principalMutationScope.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalMutationScope.js","sourceRoot":"","sources":["principalMutationScope.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CACzC,OAAqE,EACrE,iBAAiB,GAAG,KAAK;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,OAAO;QACL,OAAO;QACP,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO;YACL,gEAAgE;YAChE,iEAAiE;YACjE,CAAC,iBAAiB;gBAChB,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACzC,CAAC,CAAC,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,CAAC;gBACpD,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;gBAClC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW;gBACvD,OAAO,CAAC,IAAI,CAAC,eAAe;gBAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3D,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3C,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,kBAAkB,CACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { InternalRuntime } from \"../workflowRuntime\";\n\n/** Capture a mutation's identity/database lifetime without freezing live status. */\nexport function currentOrganizationMutation(\n service: Pick<InternalRuntime, \"workflowInput\" \| \"sessionGeneration\">,\n allowTokenRenewal = false,\n) {\n const runtime = service.workflowInput();\n const sessionGeneration = service.sessionGeneration;\n return {\n runtime,\n stillCurrent: () => {\n const current = service.workflowInput();\n return (\n // Journal API custody survives token renewal, but its identity,\n // organization and storage generation are still bound immutably.\n (allowTokenRenewal\n ? current.apiClient === runtime.apiClient\n : service.sessionGeneration === sessionGeneration) &&\n current.infra.dbStatus === \"ready\" &&\n current.infra.execSql === runtime.infra.execSql &&\n current.state.domainScope === runtime.state.domainScope &&\n current.auth.isAuthenticated &&\n current.auth.organizationId === runtime.auth.organizationId &&\n current.auth.userId === runtime.auth.userId &&\n current.crypto.signingFingerprint === runtime.crypto.signingFingerprint\n );\n },\n };\n}\n"]}
1	+ {"version":3,"file":"principalMutationScope.js","sourceRoot":"","sources":["principalMutationScope.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CACzC,OAAqE,EACrE,iBAAiB,GAAG,KAAK;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,OAAO;QACL,OAAO;QACP,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO;YACL,gEAAgE;YAChE,iEAAiE;YACjE,CAAC,iBAAiB;gBAChB,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACzC,CAAC,CAAC,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,CAAC;gBACpD,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;gBAClC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW;gBACvD,OAAO,CAAC,IAAI,CAAC,eAAe;gBAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3D,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3C,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,kBAAkB,CACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { InternalRuntime } from \"../runtime/workflowRuntime\";\n\n/** Capture a mutation's identity/database lifetime without freezing live status. */\nexport function currentOrganizationMutation(\n service: Pick<InternalRuntime, \"workflowInput\" \| \"sessionGeneration\">,\n allowTokenRenewal = false,\n) {\n const runtime = service.workflowInput();\n const sessionGeneration = service.sessionGeneration;\n return {\n runtime,\n stillCurrent: () => {\n const current = service.workflowInput();\n return (\n // Journal API custody survives token renewal, but its identity,\n // organization and storage generation are still bound immutably.\n (allowTokenRenewal\n ? current.apiClient === runtime.apiClient\n : service.sessionGeneration === sessionGeneration) &&\n current.infra.dbStatus === \"ready\" &&\n current.infra.execSql === runtime.infra.execSql &&\n current.state.domainScope === runtime.state.domainScope &&\n current.auth.isAuthenticated &&\n current.auth.organizationId === runtime.auth.organizationId &&\n current.auth.userId === runtime.auth.userId &&\n current.crypto.signingFingerprint === runtime.crypto.signingFingerprint\n );\n },\n };\n}\n"]}

package/client/organizations/principalMutations.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import type { ContainerGrantSubjectType } from "../../internal/crypto/index.js";
-import type { ContainerContents } from "../containerContents.js";
-import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
+import type { ContainerContents } from "../containerContents/index.js";
+import type { InternalWorkflowRuntimeInput } from "../runtime/workflowRuntime.js";
 import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";
 export interface OrganizationGrantRef {
     containerId: string;

package/client/organizations/principalMutations.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,kEAAkE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAiCpF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EACJ,aAAa,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,GACT,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;YACrC,IAAI,EAAE,KAAK;YACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,IAAI,QAAQ,EAAE,CAAC;YAChD,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,2BAA2B,GAAG,2BAA2B,CAC7D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,2BAA2B;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,OAAO,CAAC,YAAY,EACpB,mDAAmD,CAAC;gBAClD,SAAS,EAAE,OAAO;gBAClB,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CACH;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7D,KAAK,CAAC,OAAO,EACb;YACE,IAAI,EAAE,QAAQ;YACd,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CACF,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,8BAA8B,CAAC;oBACnD,GAAG,cAAc;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,aAAa;oBAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;gBACJ,OAAO,CACL,MAAM,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE;oBACnC,IAAI,EAAE,QAAQ;oBACd,kBAAkB,EAAE,KAAK,CAAC,WAAW;iBACtC,CAAC,CACH,CAAC,QAAQ,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,gCAAgC,CAAC;oBACtC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;oBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,oBAAoB;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,cAAc,EAAE;wBACd,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B;oBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;oBACD,GAAG,cAAc;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport { revokeOrganizationContainerGrant } from \"../../workflows/organizations\";\nimport { createCurrentOrganizationGroup } from \"../../workflows/organizations/createCurrentOrganizationGroup\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { deleteCurrentOrganizationGroup } from \"../../workflows/organizations/deleteCurrentOrganizationGroup\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimeCurrentOrganizationMutation } from \"../../workflows/organizations/runtimeCurrentOrganizationMutation\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { createCurrentPrincipalMutation } from \"./currentPrincipalMutations\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport interface OrganizationGrantRef {\n containerId: string;\n subjectId: string;\n subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n groupId: string;\n expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n extends OrganizationGroupUserMutationInput {\n targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n extends OrganizationGroupUserMutationInput {\n removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n organizationId: string;\n signerUserId: string;\n signingFingerprint: string;\n signingKeyPair: NonNullable<\n InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n >;\n}\n\nfunction requireSigningContext(\n runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n if (\n !runtime.auth.organizationId \|\|\n !runtime.auth.userId \|\|\n !runtime.crypto.signingFingerprint \|\|\n !runtime.crypto.signingKeyPair\n ) {\n throw new Error(\"Organization signing context is unavailable\");\n }\n\n return {\n organizationId: runtime.auth.organizationId,\n signerUserId: runtime.auth.userId,\n signingFingerprint: runtime.crypto.signingFingerprint,\n signingKeyPair: runtime.crypto.signingKeyPair,\n };\n}\n\nfunction requireEncapsulationKeyPair(\n runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n if (!runtime.crypto.encapsulationKeyPair) {\n throw new Error(\"Organization encryption context is unavailable\");\n }\n\n return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n readonly stillCurrent: () => boolean;\n readonly containerContents: ContainerContents;\n readonly readModelCoordinator: OrganizationReadModelCoordinator;\n readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.member.add\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n const {\n memberGroupId,\n response: bundle,\n enrolled,\n } = await mutateCurrent(input.groupId, {\n kind: \"add\",\n expectedGroupName: input.expectedGroupName,\n targetUserId: input.targetUserId,\n });\n if (input.groupId === memberGroupId \|\| enrolled) {\n await syncOrganizationMetadataProfile({\n containerContents: input.containerContents,\n log: input.runtime.util.log,\n organizationId: signingContext.organizationId,\n });\n }\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return bundle;\n },\n );\n}\n\nexport function createGroupForOrganization(input: {\n readonly name: string;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: signingContext.organizationId,\n objectKind: \"principal\",\n operation: \"group.create\",\n organizationId: signingContext.organizationId,\n },\n () => {\n const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(\n input.runtime,\n );\n const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n if (!mutate)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return mutate(\n { ...signingContext, stillCurrent: input.stillCurrent },\n (context) =>\n createCurrentOrganizationGroup({\n ...signingContext,\n context,\n apiClient: input.runtime.apiClient,\n creatorEncapsulationKeyPair,\n execSql: input.runtime.infra.execSql,\n name: input.name,\n metadataAccess: createRuntimeGroupMetadataAccess(\n input.runtime,\n signingContext.organizationId,\n context.stillCurrent,\n createSelectedCurrentGroupMetadataContainerVerifier({\n authority: context,\n organizationId: signingContext.organizationId,\n stillCurrent: context.stillCurrent,\n }),\n ),\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n }),\n );\n },\n );\n}\n\nexport function deleteGroupForOrganization(input: {\n readonly groupId: string;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.delete\",\n organizationId: signingContext.organizationId,\n },\n () => {\n const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n if (!mutate)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return mutate(\n { ...signingContext, stillCurrent: input.stillCurrent },\n (context) =>\n deleteCurrentOrganizationGroup({\n ...signingContext,\n context,\n groupId: input.groupId,\n apiClient: input.runtime.apiClient,\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n }),\n );\n },\n );\n}\n\nexport async function removeUserFromOrganizationGroup(\n input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.member.remove\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n const { memberGroupId, response: bundle } = await mutateCurrent(\n input.groupId,\n {\n kind: \"remove\",\n expectedGroupName: input.expectedGroupName,\n removedUserId: input.removedUserId,\n },\n );\n if (input.groupId === memberGroupId) {\n await syncOrganizationMetadataProfile({\n containerContents: input.containerContents,\n log: input.runtime.util.log,\n organizationId: signingContext.organizationId,\n });\n }\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return bundle;\n },\n );\n}\n\nexport async function revokeOrganizationGrant(\n input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n const signingContext = requireSigningContext(input.runtime);\n const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n if (input.runtime.infra.dbStatus !== \"ready\") {\n throw new Error(\"Organization local database is unavailable\");\n }\n\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.subjectId,\n objectKind: \"principal\",\n operation: \"principal.grant.revoke\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const revoke = async () => {\n if (input.subjectType === \"group\") {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return (\n await mutateCurrent(input.subjectId, {\n kind: \"revoke\",\n revokedContainerId: input.containerId,\n })\n ).response;\n } else {\n return revokeOrganizationContainerGrant({\n stillCurrent: input.stillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n containerId: input.containerId,\n encapsulationKeyPair,\n execSql: input.runtime.infra.execSql,\n revokedSubject: {\n subjectId: input.subjectId,\n subjectType: input.subjectType,\n },\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n ...signingContext,\n });\n }\n };\n const response = await revoke();\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return response;\n },\n );\n}\n"]}
1	+ {"version":3,"file":"principalMutations.js","sourceRoot":"","sources":["principalMutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,kEAAkE,CAAC;AAC5H,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAiCpF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC5B,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;QAClC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;QAC3C,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QACjC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;QACrD,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC7C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA+D;IAE/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,kBAAkB;QAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EACJ,aAAa,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,GACT,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;YACrC,IAAI,EAAE,KAAK;YACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,IAAI,QAAQ,EAAE,CAAC;YAChD,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,cAAc,CAAC,cAAc;QACvC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,2BAA2B,GAAG,2BAA2B,CAC7D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,2BAA2B;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,gCAAgC,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CAAC,cAAc,EAC7B,OAAO,CAAC,YAAY,EACpB,mDAAmD,CAAC;gBAClD,SAAS,EAAE,OAAO;gBAClB,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CACH;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YACjE,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,OAAO,MAAM,CACX,EAAE,GAAG,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EACvD,CAAC,OAAO,EAAE,EAAE,CACV,8BAA8B,CAAC;YAC7B,GAAG,cAAc;YACjB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;SAC3C,CAAC,CACL,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkE;IAElE,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;QACJ,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7D,KAAK,CAAC,OAAO,EACb;YACE,IAAI,EAAE,QAAQ;YACd,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CACF,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,+BAA+B,CAAC;gBACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;gBAC3B,cAAc,EAAE,cAAc,CAAC,cAAc;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsD;IAEtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,gCAAgC,CACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;QACE,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,cAAc,CAAC,cAAc;KAC9C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,8BAA8B,CAAC;oBACnD,GAAG,cAAc;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,aAAa;oBAChB,MAAM,IAAI,oCAAoC,CAC5C,2CAA2C,CAC5C,CAAC;gBACJ,OAAO,CACL,MAAM,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE;oBACnC,IAAI,EAAE,QAAQ;oBACd,kBAAkB,EAAE,KAAK,CAAC,WAAW;iBACtC,CAAC,CACH,CAAC,QAAQ,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,gCAAgC,CAAC;oBACtC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;oBACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,oBAAoB;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACpC,cAAc,EAAE;wBACd,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B;oBACD,0BAA0B,EACxB,KAAK,CAAC,OAAO,CAAC,0BAA0B;oBAC1C,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;oBACD,GAAG,cAAc;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,oBAAoB,CAAC,sBAAsB,CACrD,cAAc,CAAC,cAAc,CAC9B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ContainerGrantSubjectType } from \"@tearleads/crypto\";\nimport { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport { revokeOrganizationContainerGrant } from \"../../workflows/organizations\";\nimport { createCurrentOrganizationGroup } from \"../../workflows/organizations/createCurrentOrganizationGroup\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { deleteCurrentOrganizationGroup } from \"../../workflows/organizations/deleteCurrentOrganizationGroup\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { createRuntimeCurrentOrganizationMutation } from \"../../workflows/organizations/runtimeCurrentOrganizationMutation\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport { createCurrentPrincipalMutation } from \"./currentPrincipalMutations\";\nimport { syncOrganizationMetadataProfile } from \"./organizationMetadataProfileSync\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport interface OrganizationGrantRef {\n containerId: string;\n subjectId: string;\n subjectType: ContainerGrantSubjectType;\n}\n\nexport interface OrganizationGroupUserMutationInput {\n groupId: string;\n expectedGroupName: string;\n}\n\nexport interface AddOrganizationGroupUserInput\n extends OrganizationGroupUserMutationInput {\n targetUserId: string;\n}\n\nexport interface RemoveOrganizationGroupUserInput\n extends OrganizationGroupUserMutationInput {\n removedUserId: string;\n}\n\ninterface OrganizationSigningContext {\n organizationId: string;\n signerUserId: string;\n signingFingerprint: string;\n signingKeyPair: NonNullable<\n InternalWorkflowRuntimeInput[\"crypto\"][\"signingKeyPair\"]\n >;\n}\n\nfunction requireSigningContext(\n runtime: InternalWorkflowRuntimeInput,\n): OrganizationSigningContext {\n if (\n !runtime.auth.organizationId \|\|\n !runtime.auth.userId \|\|\n !runtime.crypto.signingFingerprint \|\|\n !runtime.crypto.signingKeyPair\n ) {\n throw new Error(\"Organization signing context is unavailable\");\n }\n\n return {\n organizationId: runtime.auth.organizationId,\n signerUserId: runtime.auth.userId,\n signingFingerprint: runtime.crypto.signingFingerprint,\n signingKeyPair: runtime.crypto.signingKeyPair,\n };\n}\n\nfunction requireEncapsulationKeyPair(\n runtime: InternalWorkflowRuntimeInput,\n): NonNullable<InternalWorkflowRuntimeInput[\"crypto\"][\"encapsulationKeyPair\"]> {\n if (!runtime.crypto.encapsulationKeyPair) {\n throw new Error(\"Organization encryption context is unavailable\");\n }\n\n return runtime.crypto.encapsulationKeyPair;\n}\n\ninterface PrincipalMutationRuntime {\n readonly stillCurrent: () => boolean;\n readonly containerContents: ContainerContents;\n readonly readModelCoordinator: OrganizationReadModelCoordinator;\n readonly runtime: InternalWorkflowRuntimeInput;\n}\n\nexport async function addUserToOrganizationGroup(\n input: PrincipalMutationRuntime & AddOrganizationGroupUserInput,\n) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.member.add\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n const {\n memberGroupId,\n response: bundle,\n enrolled,\n } = await mutateCurrent(input.groupId, {\n kind: \"add\",\n expectedGroupName: input.expectedGroupName,\n targetUserId: input.targetUserId,\n });\n if (input.groupId === memberGroupId \|\| enrolled) {\n await syncOrganizationMetadataProfile({\n containerContents: input.containerContents,\n log: input.runtime.util.log,\n organizationId: signingContext.organizationId,\n });\n }\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return bundle;\n },\n );\n}\n\nexport function createGroupForOrganization(input: {\n readonly name: string;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: signingContext.organizationId,\n objectKind: \"principal\",\n operation: \"group.create\",\n organizationId: signingContext.organizationId,\n },\n () => {\n const creatorEncapsulationKeyPair = requireEncapsulationKeyPair(\n input.runtime,\n );\n const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n if (!mutate)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return mutate(\n { ...signingContext, stillCurrent: input.stillCurrent },\n (context) =>\n createCurrentOrganizationGroup({\n ...signingContext,\n context,\n apiClient: input.runtime.apiClient,\n creatorEncapsulationKeyPair,\n execSql: input.runtime.infra.execSql,\n name: input.name,\n metadataAccess: createRuntimeGroupMetadataAccess(\n input.runtime,\n signingContext.organizationId,\n context.stillCurrent,\n createSelectedCurrentGroupMetadataContainerVerifier({\n authority: context,\n organizationId: signingContext.organizationId,\n stillCurrent: context.stillCurrent,\n }),\n ),\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n }),\n );\n },\n );\n}\n\nexport function deleteGroupForOrganization(input: {\n readonly groupId: string;\n readonly runtime: InternalWorkflowRuntimeInput;\n readonly stillCurrent: () => boolean;\n}) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.delete\",\n organizationId: signingContext.organizationId,\n },\n () => {\n const mutate = createRuntimeCurrentOrganizationMutation(input.runtime);\n if (!mutate)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return mutate(\n { ...signingContext, stillCurrent: input.stillCurrent },\n (context) =>\n deleteCurrentOrganizationGroup({\n ...signingContext,\n context,\n groupId: input.groupId,\n apiClient: input.runtime.apiClient,\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n }),\n );\n },\n );\n}\n\nexport async function removeUserFromOrganizationGroup(\n input: PrincipalMutationRuntime & RemoveOrganizationGroupUserInput,\n) {\n const signingContext = requireSigningContext(input.runtime);\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.groupId,\n objectKind: \"principal\",\n operation: \"group.member.remove\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n const { memberGroupId, response: bundle } = await mutateCurrent(\n input.groupId,\n {\n kind: \"remove\",\n expectedGroupName: input.expectedGroupName,\n removedUserId: input.removedUserId,\n },\n );\n if (input.groupId === memberGroupId) {\n await syncOrganizationMetadataProfile({\n containerContents: input.containerContents,\n log: input.runtime.util.log,\n organizationId: signingContext.organizationId,\n });\n }\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return bundle;\n },\n );\n}\n\nexport async function revokeOrganizationGrant(\n input: PrincipalMutationRuntime & OrganizationGrantRef,\n) {\n const signingContext = requireSigningContext(input.runtime);\n const encapsulationKeyPair = requireEncapsulationKeyPair(input.runtime);\n if (input.runtime.infra.dbStatus !== \"ready\") {\n throw new Error(\"Organization local database is unavailable\");\n }\n\n return runWithSecurityIncidentReporting(\n input.runtime.util.reportSecurityIncident,\n {\n objectId: input.subjectId,\n objectKind: \"principal\",\n operation: \"principal.grant.revoke\",\n organizationId: signingContext.organizationId,\n },\n async () => {\n const revoke = async () => {\n if (input.subjectType === \"group\") {\n const mutateCurrent = createCurrentPrincipalMutation({\n ...signingContext,\n runtime: input.runtime,\n stillCurrent: input.stillCurrent,\n });\n if (!mutateCurrent)\n throw new ProjectionDependencyUnavailableError(\n \"Principal history recovery is unavailable\",\n );\n return (\n await mutateCurrent(input.subjectId, {\n kind: \"revoke\",\n revokedContainerId: input.containerId,\n })\n ).response;\n } else {\n return revokeOrganizationContainerGrant({\n stillCurrent: input.stillCurrent,\n reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n apiClient: input.runtime.apiClient,\n containerId: input.containerId,\n encapsulationKeyPair,\n execSql: input.runtime.infra.execSql,\n revokedSubject: {\n subjectId: input.subjectId,\n subjectType: input.subjectType,\n },\n resolveTrustedUserIdentity:\n input.runtime.resolveTrustedUserIdentity,\n warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n input.runtime,\n ),\n ...signingContext,\n });\n }\n };\n const response = await revoke();\n await input.readModelCoordinator.reconcileAfterMutation(\n signingContext.organizationId,\n );\n return response;\n },\n );\n}\n"]}