@tearleads/client-sdk 0.1.59 → 0.1.61

package/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAK/B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,GAO1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAyB,KAAK,EAAE,MAAM,SAAS,CAAC;AAgDvD,OAAO,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,QAAQ,GAKT,MAAM,YAAY,CAAC;AAuBpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,MAAM,GAGP,MAAM,UAAU,CAAC;AASlB,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAyB9B,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,gCAAgC,EAChC,OAAO,GAIR,MAAM,WAAW,CAAC;AA8CnB,OAAO,EAAE,8CAA8C,EAAE,MAAM,iCAAiC,CAAC;AAajG,OAAO,EACL,eAAe,GAEhB,MAAM,mBAAmB,CAAC","sourcesContent":["export {\n  createDomainScope,\n  type DomainScope,\n} from \"../data/shared/domainScope\";\nexport type {\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n} from \"../stores/local-projection\";\nexport {\n  enqueueReconciliationForEvents,\n  type ReconciliationService,\n} from \"../sync/reconciliation\";\nexport {\n  createUnavailableDirectCheckout,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n} from \"./billing/directCheckout\";\nexport {\n  createRevenueCatPurchases,\n  createUnavailablePurchases,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n} from \"./billing/purchases\";\nexport { type BlobStoreFactory, Blobs } from \"./blobs\";\nexport type {\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentInfo,\n  DocumentInfoInput,\n  LinkDocumentToContainerInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n} from \"./containerContents\";\nexport { createContainerDocumentObjectSyncState } from \"./containerContents\";\nexport {\n  Database,\n  type DatabaseListener,\n  type DatabaseOptions,\n  type DatabaseSnapshot,\n  type DatabaseStatus,\n} from \"./database\";\nexport type {\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  LocalProjectionView,\n} from \"./deviceFirst\";\nexport type {\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentContextValue,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  ListDocumentsInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  PersistedDocumentListener,\n} from \"./documents\";\nexport { DEFAULT_DOCUMENT_ID } from \"./documents\";\nexport {\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n} from \"./events\";\nexport type { FileSaver, SaveFileRequest } from \"./fileSaver\";\nexport type {\n  Identity,\n  IdentityGenerationResult,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n} from \"./identity\";\nexport {\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  type IdentityKeyPackage,\n} from \"./identityKeyPackage\";\nexport type {\n  BrowserLocalKeyringOptions,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  NormalizedLocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./localKeyring\";\nexport {\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createWebViewLocalKeyring,\n  decodeLocalKeyringSqliteKey,\n  encodeLocalKeyringSqliteKey,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  normalizeLocalKeyringScope,\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./localKeyring\";\nexport type {\n  LocalKeyringPinCode,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n} from \"./localKeyring/localKeyringPinCode\";\nexport {\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  isPinCodeWrappedLocalSecretEnvelope,\n} from \"./localKeyring/localKeyringPinCode\";\nexport type { Logger } from \"./logger\";\nexport {\n  createBrowserNetworkStatusSource,\n  Network,\n  type NetworkListener,\n  type NetworkMode,\n  type NetworkStatusSource,\n} from \"./network\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  RemoveOrganizationGroupUserInput,\n} from \"./organizations\";\nexport type {\n  PrincipalHistoryKeyProvider,\n  PrincipalHistoryKeyScope,\n} from \"./principalHistoryProtection\";\nexport type {\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n} from \"./securityIncidents\";\nexport { PurgedOrganizationRecoveryBillingRequiredError } from \"./session/sessionRecoveryErrors\";\nexport type {\n  CreateOrganizationOptions,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  UserSession,\n} from \"./session/sessionTypes\";\nexport {\n  SyncBillingGate,\n  type SyncBillingGateListener,\n} from \"./syncBillingGate\";\nexport type {\n  ResolvedUserIdentity,\n  UserIdentities,\n} from \"./userIdentities\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAK/B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,GAO1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAyB,KAAK,EAAE,MAAM,SAAS,CAAC;AAgDvD,OAAO,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AAuB7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAUlD,OAAO,EACL,2BAA2B,GAE5B,MAAM,uBAAuB,CAAC;AA6B/B,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,oCAAoC,CAAC;AAoC5C,OAAO,EACL,QAAQ,GAKT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,MAAM,GAGP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gCAAgC,EAChC,OAAO,GAIR,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,eAAe,GAEhB,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EAAE,8CAA8C,EAAE,MAAM,iCAAiC,CAAC","sourcesContent":["export {\n  createDomainScope,\n  type DomainScope,\n} from \"../data/shared/domainScope\";\nexport type {\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n} from \"../stores/local-projection\";\nexport {\n  enqueueReconciliationForEvents,\n  type ReconciliationService,\n} from \"../sync/reconciliation\";\nexport {\n  createUnavailableDirectCheckout,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n} from \"./billing/directCheckout\";\nexport {\n  createRevenueCatPurchases,\n  createUnavailablePurchases,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n} from \"./billing/purchases\";\nexport { type BlobStoreFactory, Blobs } from \"./blobs\";\nexport type {\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentInfo,\n  DocumentInfoInput,\n  LinkDocumentToContainerInput,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  OpenContainerDocumentInput,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n} from \"./containerContents\";\nexport { createContainerDocumentObjectSyncState } from \"./containerContents\";\nexport type {\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  LocalProjectionView,\n} from \"./deviceFirst\";\nexport type {\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentContextValue,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  ListDocumentsInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  PersistedDocumentListener,\n} from \"./documents\";\nexport { DEFAULT_DOCUMENT_ID } from \"./documents\";\nexport type { FileSaver, SaveFileRequest } from \"./host/fileSaver\";\nexport type { Logger } from \"./host/logger\";\nexport type {\n  Identity,\n  IdentityGenerationResult,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n} from \"./identity\";\nexport {\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  type IdentityKeyPackage,\n} from \"./identity/keyPackage\";\nexport type {\n  ResolvedUserIdentity,\n  UserIdentities,\n} from \"./identity/userIdentities\";\nexport type {\n  BrowserLocalKeyringOptions,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  NormalizedLocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./localKeyring\";\nexport {\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createWebViewLocalKeyring,\n  decodeLocalKeyringSqliteKey,\n  encodeLocalKeyringSqliteKey,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  normalizeLocalKeyringScope,\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./localKeyring\";\nexport type {\n  LocalKeyringPinCode,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n} from \"./localKeyring/localKeyringPinCode\";\nexport {\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  isPinCodeWrappedLocalSecretEnvelope,\n} from \"./localKeyring/localKeyringPinCode\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  Organizations,\n  OrganizationUserDetail,\n  RemoveOrganizationGroupUserInput,\n} from \"./organizations\";\nexport {\n  Database,\n  type DatabaseListener,\n  type DatabaseOptions,\n  type DatabaseSnapshot,\n  type DatabaseStatus,\n} from \"./runtime/database\";\nexport {\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n} from \"./runtime/events\";\nexport {\n  createBrowserNetworkStatusSource,\n  Network,\n  type NetworkListener,\n  type NetworkMode,\n  type NetworkStatusSource,\n} from \"./runtime/network\";\nexport type {\n  PrincipalHistoryKeyProvider,\n  PrincipalHistoryKeyScope,\n} from \"./runtime/principalHistoryProtection\";\nexport {\n  SyncBillingGate,\n  type SyncBillingGateListener,\n} from \"./runtime/syncBillingGate\";\nexport type {\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n} from \"./securityIncidents\";\nexport { PurgedOrganizationRecoveryBillingRequiredError } from \"./session/sessionRecoveryErrors\";\nexport type {\n  CreateOrganizationOptions,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  UserSession,\n} from \"./session/sessionTypes\";\n"]}

package/client/organizations/currentPrincipalMutations.js.map

@@ -1 +1 @@
-{"version":3,"file":"currentPrincipalMutations.js","sourceRoot":"","sources":["currentPrincipalMutations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,iCAAiC,GAElC,MAAM,2DAA2D,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAyBnF,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,CAAC,OAAe,EAAE,QAA8B,EAAE,EAAE,CACzD,MAAM,CACJ;QACE,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,KAAK,EACzB,QAA4C,EAC5C,MAA4B,EAC5B,EAAE,CAAC,CAAC;YACJ,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM,2BAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;YACnE,yBAAyB,EAAE,CACzB,UAEkB,EAClB,SAEiB,EACjB,EAAE,CACF,kCAAkC,CAAC;gBACjC,SAAS;gBACT,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,UAAU;gBACV,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;gBACxD,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,sBAAsB,EAAE,KAAK,CAAC,YAAY;gBAC1C,+BAA+B,EAC7B,QAAQ,CAAC,+BAA+B;gBAC1C,kBAAkB,EAChB,MAAM,CAAC,IAAI,KAAK,QAAQ;oBACtB,CAAC,CAAC,MAAM,CAAC,kBAAkB;oBAC3B,CAAC,CAAC,SAAS;aAChB,CAAC;SACL,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,MAA6D,CAAC;QAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC/D,IACE,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CAClD,EACD,CAAC;gBACD,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;oBACpC,GAAG,QAAQ;oBACX,iBAAiB,EAAE,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO;YACP,GAAG,OAAO;YACV,MAAM;YACN,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;SACrE,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAoC,EACpC,OAA2C,EAC3C,QAA8B;IAE9B,MAAM,MAAM,GAAG;QACb,GAAG,OAAO;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAC7B,OAAO,CAAC,aAAa,EACrB,QAAQ,CAAC,iBAAiB,EAC1B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAE,EAAE,CAClD,6BAA6B,CAAC;QAC5B,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,OAAO;KACR,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAC3D,IAAI,OAAkC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;QACvD,IAAI,CAAC,oBAAoB;YACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;YACpC,GAAG,iBAAiB,CAAC,UAAU,CAAC;YAChC,QAAQ,CAAC,YAAY;SACtB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzE,OAAO,GAAG,MAAM,8BAA8B,CAAC;YAC7C,GAAG,MAAM;YACT,oBAAoB;YACpB,UAAU;YACV,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SAClE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,GAAG,MAAM,iCAAiC,CAAC;YAChD,GAAG,MAAM;YACT,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,cAAc,EAAE,MAAM,YAAY,CAChC,iBAAiB,CACf,UAAU,CAAC,MAAM,CACf,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CACrD,CACF,CACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,sCAAsC,CAAC;YACrD,GAAG,MAAM;YACT,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,YAAY,EAAE,MAAM,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { commitCurrentGroupPolicyMutation } from \"../../workflows/organizations/commitCurrentGroupPolicyMutation\";\nimport { assertGroupMembershipName } from \"../../workflows/organizations/groupMembershipName\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport {\n  buildAddGroupUserPolicyRequest,\n  buildGroupAccessSetShrinkPolicyRequest,\n  buildRemoveGroupUserPolicyRequest,\n} from \"../../workflows/organizations/groupPolicyRequests\";\nimport {\n  createRuntimeCurrentGroupMutation,\n  type RuntimeCurrentGroupMutationContext,\n} from \"../../workflows/organizations/runtimeCurrentGroupMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../../workflows/organizations/trustedOrganizationUsers\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\ntype CurrentGroupMutation =\n  | {\n      readonly kind: \"add\";\n      readonly expectedGroupName: string;\n      readonly targetUserId: string;\n    }\n  | {\n      readonly kind: \"remove\";\n      readonly expectedGroupName: string;\n      readonly removedUserId: string;\n    }\n  | { readonly kind: \"revoke\"; readonly revokedContainerId: string };\n\n/** Built-in hosts with private custody use bounded current-policy mutation work. */\ninterface CurrentPrincipalMutationInput {\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent: () => boolean;\n}\n\nexport function createCurrentPrincipalMutation(\n  input: CurrentPrincipalMutationInput,\n) {\n  const mutate = createRuntimeCurrentGroupMutation(input.runtime);\n  if (!mutate) return undefined;\n  return (groupId: string, mutation: CurrentGroupMutation) =>\n    mutate(\n      {\n        groupId,\n        organizationId: input.organizationId,\n        signerUserId: input.signerUserId,\n        stillCurrent: input.stillCurrent,\n      },\n      async (context) => {\n        const prepareChange = async (\n          selected: RuntimeCurrentGroupMutationContext,\n          change: CurrentGroupMutation,\n        ) => ({\n          context: selected,\n          request: await buildCurrentMutationRequest(input, selected, change),\n          prepareContainerMutations: (\n            nextPolicy: Parameters<\n              typeof preparePrincipalContainerMutations\n            >[0][\"nextPolicy\"],\n            preceding?: Parameters<\n              typeof preparePrincipalContainerMutations\n            >[0][\"preceding\"],\n          ) =>\n            preparePrincipalContainerMutations({\n              preceding,\n              currentPolicy: selected.currentPolicy,\n              nextPolicy,\n              groupId: selected.currentPolicy.currentState.principalId,\n              organizationId: input.organizationId,\n              runtime: input.runtime,\n              stillCurrent: selected.stillCurrent,\n              recitationStillCurrent: input.stillCurrent,\n              resolveAuthoredPolicyReferences:\n                selected.resolveAuthoredPolicyReferences,\n              revokedContainerId:\n                change.kind === \"revoke\"\n                  ? change.revokedContainerId\n                  : undefined,\n            }),\n        });\n        const primary = await prepareChange(context, mutation);\n        let member: Awaited<ReturnType<typeof prepareChange>> | undefined;\n        if (mutation.kind === \"add\" && groupId !== context.memberGroupId) {\n          const members = await context.loadGroup(context.memberGroupId);\n          if (\n            !members.currentPolicy.currentProjection.some(\n              (entry) => entry.userId === mutation.targetUserId,\n            )\n          ) {\n            member = await prepareChange(members, {\n              ...mutation,\n              expectedGroupName: \"Members\",\n            });\n          }\n        }\n        assertProjectionVerificationCurrent(context.stillCurrent);\n        const response = await commitCurrentGroupPolicyMutation({\n          ...input,\n          apiClient: input.runtime.apiClient,\n          groupId,\n          ...primary,\n          member,\n          resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        });\n        return {\n          response,\n          memberGroupId: context.memberGroupId,\n          enrolled: Boolean(member),\n        };\n      },\n    );\n}\n\nasync function buildCurrentMutationRequest(\n  input: CurrentPrincipalMutationInput,\n  context: RuntimeCurrentGroupMutationContext,\n  mutation: CurrentGroupMutation,\n): Promise<PutPrincipalPolicyRequest> {\n  const shared = {\n    ...context,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n  if (mutation.kind !== \"revoke\") {\n    await assertGroupMembershipName(\n      context.currentPolicy,\n      mutation.expectedGroupName,\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        input.organizationId,\n        context.stillCurrent,\n        context.verifyMetadataContainer,\n      ).readName,\n    );\n  }\n  const resolveUsers = (userIds: readonly string[]) =>\n    resolveRequiredUserIdentities({\n      resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n      userIds,\n    });\n  const projection = context.currentPolicy.currentProjection;\n  let request: PutPrincipalPolicyRequest;\n  if (mutation.kind === \"add\") {\n    const currentUserSecretKey =\n      input.runtime.crypto.encapsulationKeyPair?.secretKey;\n    if (!currentUserSecretKey)\n      throw new Error(\"Organization encryption context is unavailable\");\n    const identities = await resolveUsers([\n      ...projectionUserIds(projection),\n      mutation.targetUserId,\n    ]);\n    const targetUser = identities.find(\n      (identity) => identity.userId === mutation.targetUserId,\n    );\n    if (!targetUser) throw new Error(\"Group target identity is unavailable\");\n    request = await buildAddGroupUserPolicyRequest({\n      ...shared,\n      currentUserSecretKey,\n      targetUser,\n      currentUsers: identities.filter(\n        (identity) => identity.userId !== mutation.targetUserId,\n      ),\n      reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    });\n  } else if (mutation.kind === \"remove\") {\n    request = await buildRemoveGroupUserPolicyRequest({\n      ...shared,\n      removedUserId: mutation.removedUserId,\n      remainingUsers: await resolveUsers(\n        projectionUserIds(\n          projection.filter(\n            (member) => member.userId !== mutation.removedUserId,\n          ),\n        ),\n      ),\n    });\n  } else {\n    request = await buildGroupAccessSetShrinkPolicyRequest({\n      ...shared,\n      revokedContainerId: mutation.revokedContainerId,\n      currentUsers: await resolveUsers(projectionUserIds(projection)),\n    });\n  }\n\n  return request;\n}\n"]}
+{"version":3,"file":"currentPrincipalMutations.js","sourceRoot":"","sources":["currentPrincipalMutations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,gCAAgC,EAAE,MAAM,gEAAgE,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,iCAAiC,GAElC,MAAM,2DAA2D,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAyBnF,MAAM,UAAU,8BAA8B,CAC5C,KAAoC;IAEpC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,CAAC,OAAe,EAAE,QAA8B,EAAE,EAAE,CACzD,MAAM,CACJ;QACE,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,KAAK,EACzB,QAA4C,EAC5C,MAA4B,EAC5B,EAAE,CAAC,CAAC;YACJ,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM,2BAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;YACnE,yBAAyB,EAAE,CACzB,UAEkB,EAClB,SAEiB,EACjB,EAAE,CACF,kCAAkC,CAAC;gBACjC,SAAS;gBACT,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,UAAU;gBACV,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW;gBACxD,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,sBAAsB,EAAE,KAAK,CAAC,YAAY;gBAC1C,+BAA+B,EAC7B,QAAQ,CAAC,+BAA+B;gBAC1C,kBAAkB,EAChB,MAAM,CAAC,IAAI,KAAK,QAAQ;oBACtB,CAAC,CAAC,MAAM,CAAC,kBAAkB;oBAC3B,CAAC,CAAC,SAAS;aAChB,CAAC;SACL,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,MAA6D,CAAC;QAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC/D,IACE,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CAClD,EACD,CAAC;gBACD,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;oBACpC,GAAG,QAAQ;oBACX,iBAAiB,EAAE,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,mCAAmC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO;YACP,GAAG,OAAO;YACV,MAAM;YACN,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;SACrE,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;SAC1B,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAoC,EACpC,OAA2C,EAC3C,QAA8B;IAE9B,MAAM,MAAM,GAAG;QACb,GAAG,OAAO;QACV,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,yBAAyB,CAC7B,OAAO,CAAC,aAAa,EACrB,QAAQ,CAAC,iBAAiB,EAC1B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,uBAAuB,CAChC,CAAC,QAAQ,CACX,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAE,EAAE,CAClD,6BAA6B,CAAC;QAC5B,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,OAAO;KACR,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;IAC3D,IAAI,OAAkC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GACxB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;QACvD,IAAI,CAAC,oBAAoB;YACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC;YACpC,GAAG,iBAAiB,CAAC,UAAU,CAAC;YAChC,QAAQ,CAAC,YAAY;SACtB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzE,OAAO,GAAG,MAAM,8BAA8B,CAAC;YAC7C,GAAG,MAAM;YACT,oBAAoB;YACpB,UAAU;YACV,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CACxD;YACD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;SAClE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,GAAG,MAAM,iCAAiC,CAAC;YAChD,GAAG,MAAM;YACT,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,cAAc,EAAE,MAAM,YAAY,CAChC,iBAAiB,CACf,UAAU,CAAC,MAAM,CACf,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CACrD,CACF,CACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,sCAAsC,CAAC;YACrD,GAAG,MAAM;YACT,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,YAAY,EAAE,MAAM,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { SigningKeyPair } from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport { commitCurrentGroupPolicyMutation } from \"../../workflows/organizations/commitCurrentGroupPolicyMutation\";\nimport { assertGroupMembershipName } from \"../../workflows/organizations/groupMembershipName\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport {\n  buildAddGroupUserPolicyRequest,\n  buildGroupAccessSetShrinkPolicyRequest,\n  buildRemoveGroupUserPolicyRequest,\n} from \"../../workflows/organizations/groupPolicyRequests\";\nimport {\n  createRuntimeCurrentGroupMutation,\n  type RuntimeCurrentGroupMutationContext,\n} from \"../../workflows/organizations/runtimeCurrentGroupMutation\";\nimport {\n  projectionUserIds,\n  resolveRequiredUserIdentities,\n} from \"../../workflows/organizations/trustedOrganizationUsers\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport { preparePrincipalContainerMutations } from \"./principalContainerMutations\";\n\ntype CurrentGroupMutation =\n  | {\n      readonly kind: \"add\";\n      readonly expectedGroupName: string;\n      readonly targetUserId: string;\n    }\n  | {\n      readonly kind: \"remove\";\n      readonly expectedGroupName: string;\n      readonly removedUserId: string;\n    }\n  | { readonly kind: \"revoke\"; readonly revokedContainerId: string };\n\n/** Built-in hosts with private custody use bounded current-policy mutation work. */\ninterface CurrentPrincipalMutationInput {\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly organizationId: string;\n  readonly signerUserId: string;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: SigningKeyPair;\n  readonly stillCurrent: () => boolean;\n}\n\nexport function createCurrentPrincipalMutation(\n  input: CurrentPrincipalMutationInput,\n) {\n  const mutate = createRuntimeCurrentGroupMutation(input.runtime);\n  if (!mutate) return undefined;\n  return (groupId: string, mutation: CurrentGroupMutation) =>\n    mutate(\n      {\n        groupId,\n        organizationId: input.organizationId,\n        signerUserId: input.signerUserId,\n        stillCurrent: input.stillCurrent,\n      },\n      async (context) => {\n        const prepareChange = async (\n          selected: RuntimeCurrentGroupMutationContext,\n          change: CurrentGroupMutation,\n        ) => ({\n          context: selected,\n          request: await buildCurrentMutationRequest(input, selected, change),\n          prepareContainerMutations: (\n            nextPolicy: Parameters<\n              typeof preparePrincipalContainerMutations\n            >[0][\"nextPolicy\"],\n            preceding?: Parameters<\n              typeof preparePrincipalContainerMutations\n            >[0][\"preceding\"],\n          ) =>\n            preparePrincipalContainerMutations({\n              preceding,\n              currentPolicy: selected.currentPolicy,\n              nextPolicy,\n              groupId: selected.currentPolicy.currentState.principalId,\n              organizationId: input.organizationId,\n              runtime: input.runtime,\n              stillCurrent: selected.stillCurrent,\n              recitationStillCurrent: input.stillCurrent,\n              resolveAuthoredPolicyReferences:\n                selected.resolveAuthoredPolicyReferences,\n              revokedContainerId:\n                change.kind === \"revoke\"\n                  ? change.revokedContainerId\n                  : undefined,\n            }),\n        });\n        const primary = await prepareChange(context, mutation);\n        let member: Awaited<ReturnType<typeof prepareChange>> | undefined;\n        if (mutation.kind === \"add\" && groupId !== context.memberGroupId) {\n          const members = await context.loadGroup(context.memberGroupId);\n          if (\n            !members.currentPolicy.currentProjection.some(\n              (entry) => entry.userId === mutation.targetUserId,\n            )\n          ) {\n            member = await prepareChange(members, {\n              ...mutation,\n              expectedGroupName: \"Members\",\n            });\n          }\n        }\n        assertProjectionVerificationCurrent(context.stillCurrent);\n        const response = await commitCurrentGroupPolicyMutation({\n          ...input,\n          apiClient: input.runtime.apiClient,\n          groupId,\n          ...primary,\n          member,\n          resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n        });\n        return {\n          response,\n          memberGroupId: context.memberGroupId,\n          enrolled: Boolean(member),\n        };\n      },\n    );\n}\n\nasync function buildCurrentMutationRequest(\n  input: CurrentPrincipalMutationInput,\n  context: RuntimeCurrentGroupMutationContext,\n  mutation: CurrentGroupMutation,\n): Promise<PutPrincipalPolicyRequest> {\n  const shared = {\n    ...context,\n    signerUserId: input.signerUserId,\n    signingFingerprint: input.signingFingerprint,\n    signingKeyPair: input.signingKeyPair,\n  };\n  if (mutation.kind !== \"revoke\") {\n    await assertGroupMembershipName(\n      context.currentPolicy,\n      mutation.expectedGroupName,\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        input.organizationId,\n        context.stillCurrent,\n        context.verifyMetadataContainer,\n      ).readName,\n    );\n  }\n  const resolveUsers = (userIds: readonly string[]) =>\n    resolveRequiredUserIdentities({\n      resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n      userIds,\n    });\n  const projection = context.currentPolicy.currentProjection;\n  let request: PutPrincipalPolicyRequest;\n  if (mutation.kind === \"add\") {\n    const currentUserSecretKey =\n      input.runtime.crypto.encapsulationKeyPair?.secretKey;\n    if (!currentUserSecretKey)\n      throw new Error(\"Organization encryption context is unavailable\");\n    const identities = await resolveUsers([\n      ...projectionUserIds(projection),\n      mutation.targetUserId,\n    ]);\n    const targetUser = identities.find(\n      (identity) => identity.userId === mutation.targetUserId,\n    );\n    if (!targetUser) throw new Error(\"Group target identity is unavailable\");\n    request = await buildAddGroupUserPolicyRequest({\n      ...shared,\n      currentUserSecretKey,\n      targetUser,\n      currentUsers: identities.filter(\n        (identity) => identity.userId !== mutation.targetUserId,\n      ),\n      reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    });\n  } else if (mutation.kind === \"remove\") {\n    request = await buildRemoveGroupUserPolicyRequest({\n      ...shared,\n      removedUserId: mutation.removedUserId,\n      remainingUsers: await resolveUsers(\n        projectionUserIds(\n          projection.filter(\n            (member) => member.userId !== mutation.removedUserId,\n          ),\n        ),\n      ),\n    });\n  } else {\n    request = await buildGroupAccessSetShrinkPolicyRequest({\n      ...shared,\n      revokedContainerId: mutation.revokedContainerId,\n      currentUsers: await resolveUsers(projectionUserIds(projection)),\n    });\n  }\n\n  return request;\n}\n"]}

package/client/organizations/index.d.ts

@@ -1,5 +1,5 @@
-import type { ContainerContents } from "../containerContents.js";
-import type { InternalRuntime } from "../workflowRuntime.js";
+import type { ContainerContents } from "../containerContents/index.js";
+import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 import type { Organizations } from "./organizationsTypes.js";
 export type { ImportedOrganizationUser, LocalOrganizationSummary, OrganizationBilling, OrganizationBillingHistory, OrganizationBillingHistoryEntry, OrganizationBillingManagementUrl, OrganizationBillingView, OrganizationContainerGrant, OrganizationContainerGrants, OrganizationDataUsage, OrganizationDirectory, OrganizationDirectoryAndGroups, OrganizationDirectoryUser, OrganizationGroupContainer, OrganizationGroupContainers, OrganizationGroupDetails, OrganizationGroupMember, OrganizationGroupMembers, OrganizationGroupPolicyHistory, OrganizationGroupSummary, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationProfile, OrganizationUserDetail, } from "../../workflows/organizations/index.js";
 export type { OrganizationGroupMutationReceipt, Organizations, } from "./organizationsTypes.js";

package/client/organizations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,sCAAsC,GAEvC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AA4C9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC;IAEpC,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,oBAAoB;IAKL;IACA;IALF,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC;QADpC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAErD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,aAAsB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,aAAa;YACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB,CAAC,aAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,CACrD,SAAS,EACT,aAAa,CACd,CACJ,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  listLocalOrganizations,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  createOrganizationDataUsageCoordinator,\n  type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n  createOrganizationReadModelCoordinator,\n  type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n  authenticatedOrganizationId,\n  runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n  type AbandonOrganizationPolicyMutationInput,\n  abandonPendingOrganizationPolicyMutation,\n  type DiscardUnreadableOrganizationPolicyMutationInput,\n  discardUnreadableOrganizationPolicyMutation,\n  readPendingOrganizationPolicyMutation,\n  retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n  type AddOrganizationGroupUserInput,\n  addUserToOrganizationGroup,\n  createGroupForOrganization,\n  deleteGroupForOrganization,\n  type OrganizationGrantRef,\n  type RemoveOrganizationGroupUserInput,\n  removeUserFromOrganizationGroup,\n  revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type {\n  OrganizationGroupMutationReceipt,\n  Organizations,\n} from \"./organizationsTypes\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n  AddOrganizationGroupUserInput,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n  runtime: InternalRuntime,\n  containerContents: ContainerContents,\n): Organizations {\n  return new OrganizationsService(runtime, containerContents);\n}\n\nclass OrganizationsService implements Organizations {\n  private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n  private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n  ) {\n    this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n      this.runtimeService,\n    );\n    this.readModelCoordinator = createOrganizationReadModelCoordinator(\n      this.runtimeService,\n    );\n  }\n\n  async addUserToGroup(input: AddOrganizationGroupUserInput) {\n    return addUserToOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  readPendingPolicyMutation(organizationId: string) {\n    return readPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  discardUnreadablePolicyMutation(\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) {\n    return discardUnreadableOrganizationPolicyMutation(\n      this.runtimeService,\n      input,\n    );\n  }\n\n  retryPendingPolicyMutation(organizationId: string) {\n    return retryPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n    return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n  }\n\n  createGroup(name: string) {\n    return createGroupForOrganization({\n      name,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  deleteGroup(groupId: string) {\n    return deleteGroupForOrganization({\n      groupId,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  importUserById(userId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    return importOrganizationUser({\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      userId,\n    });\n  }\n\n  loadBilling() {\n    return runForOrganization(this.runtimeService, loadOrganizationBilling);\n  }\n\n  loadBillingForOrganization(organizationId: string) {\n    // Gated on an authenticated session rather than on the target being the\n    // active org. The server still enforces membership, so an org the caller\n    // cannot reach resolves to `null`.\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBilling,\n      organizationId,\n    );\n  }\n\n  loadBillingHistory() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingHistory,\n    );\n  }\n\n  loadBillingManagementUrl() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingManagementUrl,\n    );\n  }\n\n  loadStripeCheckoutOptions(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      loadStripeCheckoutOptions,\n      organizationId,\n    );\n  }\n\n  createStripeCheckout(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      createStripeCheckout,\n      organizationId,\n    );\n  }\n\n  createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n      organizationId,\n    );\n  }\n\n  cancelStripeSubscription() {\n    return runForOrganization(this.runtimeService, cancelStripeSubscription);\n  }\n\n  claimNativeSubscription(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => claimNativeOrganizationSubscription({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  checkNativePurchaseEligibility(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => checkNativePurchaseEligibility({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  loadDataUsage() {\n    return this.dataUsageCoordinator.reconcile();\n  }\n\n  loadLocalDataUsage() {\n    return this.dataUsageCoordinator.loadLocal();\n  }\n\n  loadDirectoryAndGroups() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcile(),\n    );\n  }\n\n  loadDirectoryAndGroupsAfterMutation() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile_after_mutation\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcileAfterMutation(),\n    );\n  }\n\n  loadLocalDirectoryAndGroups() {\n    return this.readModelCoordinator.loadLocal();\n  }\n\n  loadGroupMembers(groupId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || groupId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return runtime.apiClient.listOrganizationGroupMembers(\n      organizationId,\n      groupId,\n    );\n  }\n\n  loadGroupPresentationDetails(groupId: string, beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: groupId,\n        objectKind: \"principal\",\n        operation: \"group.presentation.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        loadOrganizationGroupPresentationDetails({\n          groupId,\n          beforeVersion,\n          readModelCoordinator: this.readModelCoordinator,\n          runtime,\n        }),\n    );\n  }\n\n  loadGrants() {\n    return this.readModelCoordinator.loadLocalGrants();\n  }\n\n  loadGroupContainers(groupId: string) {\n    return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n  }\n\n  listLocalOrganizations() {\n    const runtime = this.runtimeService.workflowInput();\n    if (runtime.infra.dbStatus !== \"ready\") {\n      return Promise.resolve([]);\n    }\n\n    return listLocalOrganizations({ execSql: runtime.infra.execSql });\n  }\n\n  loadPolicyHistory(beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        this.readModelCoordinator.loadOrganizationPolicyHistory(\n          undefined,\n          beforeVersion,\n        ),\n    );\n  }\n\n  loadUserDetail(userId: string) {\n    return this.readModelCoordinator.loadLocalUserDetail(userId);\n  }\n\n  updateRosterEntry(userId: string, profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || userId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationRosterEntry({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n      userId,\n    });\n  }\n\n  updateProfile(profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationProfile({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n    });\n  }\n\n  async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n    return removeUserFromOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  async revokeGrant(grant: OrganizationGrantRef) {\n    return revokeOrganizationGrant({\n      ...grant,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  startTrial(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      startOrganizationTrial,\n      organizationId,\n    );\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,mCAAmC,EACnC,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,sCAAsC,GAEvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EACL,sCAAsC,GAEvC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EAExC,2CAA2C,EAC3C,qCAAqC,EACrC,sCAAsC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAEL,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAG1B,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AA4C9B,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,iBAAoC;IAEpC,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,oBAAoB;IAKL;IACA;IALF,oBAAoB,CAAmC;IACvD,oBAAoB,CAAmC;IAExE,YACmB,cAA+B,EAC/B,iBAAoC;QADpC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAErD,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,sCAAsC,CAChE,IAAI,CAAC,cAAc,CACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QACvD,OAAO,0BAA0B,CAAC;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,cAAsB;QAC9C,OAAO,qCAAqC,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,+BAA+B,CAC7B,KAAuD;QAEvD,OAAO,2CAA2C,CAChD,IAAI,CAAC,cAAc,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,OAAO,sCAAsC,CAC3C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,KAA6C;QACxE,OAAO,wCAAwC,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,0BAA0B,CAAC;YAChC,IAAI;YACJ,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,0BAA0B,CAAC;YAChC,OAAO;YACP,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,0BAA0B,CAAC,cAAsB;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,mCAAmC;QACnC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,uBAAuB,EACvB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,cAAuB;QAC/C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,yBAAyB,EACzB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,cAAuB;QAC1C,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,oBAAoB,EACpB,cAAc,CACf,CAAC;IACJ,CAAC;IAED,2BAA2B,CAAC,SAAiB,EAAE,cAAuB;QACpE,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAED,uBAAuB,CACrB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EACnE,cAAc,CACf,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,cAAsB,EACtB,KAA8B;QAE9B,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,mCAAmC;YAC9C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,mCAAmC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,4BAA4B,CACnD,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,aAAsB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,yBAAyB;YACpC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,wCAAwC,CAAC;YACvC,OAAO;YACP,aAAa;YACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;SACR,CAAC,CACL,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB,CAAC,aAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YACrC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;SAC5C,EACD,GAAG,EAAE,CACH,IAAI,CAAC,oBAAoB,CAAC,6BAA6B,CACrD,SAAS,EACT,aAAa,CACd,CACJ,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,iBAAgC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;YACjB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,iBAAgC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuC;QAC/D,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,OAAO,uBAAuB,CAAC;YAC7B,GAAG,KAAK;YACR,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,cAAuB;QAChC,OAAO,kBAAkB,CACvB,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,cAAc,CACf,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport { runWithSecurityIncidentReporting } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  listLocalOrganizations,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { ContainerContents } from \"../containerContents\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n  createOrganizationDataUsageCoordinator,\n  type OrganizationDataUsageCoordinator,\n} from \"./organizationDataUsage\";\nimport { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport {\n  createOrganizationReadModelCoordinator,\n  type OrganizationReadModelCoordinator,\n} from \"./organizationReadModels\";\nimport type { Organizations } from \"./organizationsTypes\";\nimport {\n  authenticatedOrganizationId,\n  runForOrganization,\n} from \"./organizationWorkflowRuntime\";\nimport {\n  type AbandonOrganizationPolicyMutationInput,\n  abandonPendingOrganizationPolicyMutation,\n  type DiscardUnreadableOrganizationPolicyMutationInput,\n  discardUnreadableOrganizationPolicyMutation,\n  readPendingOrganizationPolicyMutation,\n  retryPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\nimport {\n  type AddOrganizationGroupUserInput,\n  addUserToOrganizationGroup,\n  createGroupForOrganization,\n  deleteGroupForOrganization,\n  type OrganizationGrantRef,\n  type RemoveOrganizationGroupUserInput,\n  removeUserFromOrganizationGroup,\n  revokeOrganizationGrant,\n} from \"./principalMutations\";\n\nexport type {\n  ImportedOrganizationUser,\n  LocalOrganizationSummary,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationUserDetail,\n} from \"../../workflows/organizations\";\nexport type {\n  OrganizationGroupMutationReceipt,\n  Organizations,\n} from \"./organizationsTypes\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n} from \"./principalMutationRecovery\";\nexport type {\n  AddOrganizationGroupUserInput,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\nexport function createOrganizations(\n  runtime: InternalRuntime,\n  containerContents: ContainerContents,\n): Organizations {\n  return new OrganizationsService(runtime, containerContents);\n}\n\nclass OrganizationsService implements Organizations {\n  private readonly dataUsageCoordinator: OrganizationDataUsageCoordinator;\n  private readonly readModelCoordinator: OrganizationReadModelCoordinator;\n\n  constructor(\n    private readonly runtimeService: InternalRuntime,\n    private readonly containerContents: ContainerContents,\n  ) {\n    this.dataUsageCoordinator = createOrganizationDataUsageCoordinator(\n      this.runtimeService,\n    );\n    this.readModelCoordinator = createOrganizationReadModelCoordinator(\n      this.runtimeService,\n    );\n  }\n\n  async addUserToGroup(input: AddOrganizationGroupUserInput) {\n    return addUserToOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  readPendingPolicyMutation(organizationId: string) {\n    return readPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  discardUnreadablePolicyMutation(\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) {\n    return discardUnreadableOrganizationPolicyMutation(\n      this.runtimeService,\n      input,\n    );\n  }\n\n  retryPendingPolicyMutation(organizationId: string) {\n    return retryPendingOrganizationPolicyMutation(\n      this.runtimeService,\n      organizationId,\n    );\n  }\n\n  abandonPendingPolicyMutation(input: AbandonOrganizationPolicyMutationInput) {\n    return abandonPendingOrganizationPolicyMutation(this.runtimeService, input);\n  }\n\n  createGroup(name: string) {\n    return createGroupForOrganization({\n      name,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  deleteGroup(groupId: string) {\n    return deleteGroupForOrganization({\n      groupId,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  importUserById(userId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    return importOrganizationUser({\n      resolveTrustedUserIdentity: runtime.resolveTrustedUserIdentity,\n      userId,\n    });\n  }\n\n  loadBilling() {\n    return runForOrganization(this.runtimeService, loadOrganizationBilling);\n  }\n\n  loadBillingForOrganization(organizationId: string) {\n    // Gated on an authenticated session rather than on the target being the\n    // active org. The server still enforces membership, so an org the caller\n    // cannot reach resolves to `null`.\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBilling,\n      organizationId,\n    );\n  }\n\n  loadBillingHistory() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingHistory,\n    );\n  }\n\n  loadBillingManagementUrl() {\n    return runForOrganization(\n      this.runtimeService,\n      loadOrganizationBillingManagementUrl,\n    );\n  }\n\n  loadStripeCheckoutOptions(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      loadStripeCheckoutOptions,\n      organizationId,\n    );\n  }\n\n  createStripeCheckout(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      createStripeCheckout,\n      organizationId,\n    );\n  }\n\n  createStripeCheckoutSession(returnUrl: string, organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => createStripeCheckoutSession({ ...input, returnUrl }),\n      organizationId,\n    );\n  }\n\n  cancelStripeSubscription() {\n    return runForOrganization(this.runtimeService, cancelStripeSubscription);\n  }\n\n  claimNativeSubscription(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => claimNativeOrganizationSubscription({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  checkNativePurchaseEligibility(\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) {\n    return runForOrganization(\n      this.runtimeService,\n      (input) => checkNativePurchaseEligibility({ ...input, store }),\n      organizationId,\n    );\n  }\n\n  loadDataUsage() {\n    return this.dataUsageCoordinator.reconcile();\n  }\n\n  loadLocalDataUsage() {\n    return this.dataUsageCoordinator.loadLocal();\n  }\n\n  loadDirectoryAndGroups() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcile(),\n    );\n  }\n\n  loadDirectoryAndGroupsAfterMutation() {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.read_model.reconcile_after_mutation\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () => this.readModelCoordinator.reconcileAfterMutation(),\n    );\n  }\n\n  loadLocalDirectoryAndGroups() {\n    return this.readModelCoordinator.loadLocal();\n  }\n\n  loadGroupMembers(groupId: string) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || groupId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return runtime.apiClient.listOrganizationGroupMembers(\n      organizationId,\n      groupId,\n    );\n  }\n\n  loadGroupPresentationDetails(groupId: string, beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: groupId,\n        objectKind: \"principal\",\n        operation: \"group.presentation.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        loadOrganizationGroupPresentationDetails({\n          groupId,\n          beforeVersion,\n          readModelCoordinator: this.readModelCoordinator,\n          runtime,\n        }),\n    );\n  }\n\n  loadGrants() {\n    return this.readModelCoordinator.loadLocalGrants();\n  }\n\n  loadGroupContainers(groupId: string) {\n    return this.readModelCoordinator.loadLocalGroupContainers(groupId);\n  }\n\n  listLocalOrganizations() {\n    const runtime = this.runtimeService.workflowInput();\n    if (runtime.infra.dbStatus !== \"ready\") {\n      return Promise.resolve([]);\n    }\n\n    return listLocalOrganizations({ execSql: runtime.infra.execSql });\n  }\n\n  loadPolicyHistory(beforeVersion?: number) {\n    const runtime = this.runtimeService.workflowInput();\n    return runWithSecurityIncidentReporting(\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: runtime.auth.organizationId,\n        objectKind: \"principal\",\n        operation: \"organization.policy_history.load\",\n        organizationId: runtime.auth.organizationId,\n      },\n      () =>\n        this.readModelCoordinator.loadOrganizationPolicyHistory(\n          undefined,\n          beforeVersion,\n        ),\n    );\n  }\n\n  loadUserDetail(userId: string) {\n    return this.readModelCoordinator.loadLocalUserDetail(userId);\n  }\n\n  updateRosterEntry(userId: string, profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId || userId.length === 0) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationRosterEntry({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n      userId,\n    });\n  }\n\n  updateProfile(profileDocumentId: string | null) {\n    const runtime = this.runtimeService.workflowInput();\n    const organizationId = authenticatedOrganizationId(runtime);\n    if (!organizationId) {\n      return Promise.resolve(null);\n    }\n\n    return updateOrganizationProfile({\n      apiClient: runtime.apiClient,\n      organizationId,\n      profileDocumentId,\n    });\n  }\n\n  async removeUserFromGroup(input: RemoveOrganizationGroupUserInput) {\n    return removeUserFromOrganizationGroup({\n      ...input,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  async revokeGrant(grant: OrganizationGrantRef) {\n    return revokeOrganizationGrant({\n      ...grant,\n      containerContents: this.containerContents,\n      readModelCoordinator: this.readModelCoordinator,\n      ...currentOrganizationMutation(this.runtimeService),\n    });\n  }\n\n  startTrial(organizationId?: string) {\n    return runForOrganization(\n      this.runtimeService,\n      startOrganizationTrial,\n      organizationId,\n    );\n  }\n}\n"]}

package/client/organizations/organizationDataUsage.d.ts

@@ -1,5 +1,5 @@
 import { type OrganizationDataUsage } from "../../workflows/organizations/index.js";
-import type { InternalRuntime } from "../workflowRuntime.js";
+import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 export interface OrganizationDataUsageCoordinator {
     loadLocal(organizationId?: string | undefined): Promise<OrganizationDataUsage | null>;
     /** Undefined means no authoritative result was available for this runtime. */

package/client/organizations/organizationDataUsage.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationDataUsage.js","sourceRoot":"","sources":["organizationDataUsage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAE9B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mEAAmE,CAAC;AAE/G,OAAO,EAEL,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AAYJ,MAAM,oCAAoC;IAQX;IALZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,8BAA8B,CAAC;gBAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE,MAAM,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAC1B,8CAA8C,EAC9C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,cAAuB;QAC/B,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,cAAc,GAAG,8BAA8B,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n  loadLocalOrganizationDataUsage,\n  type OrganizationDataUsage,\n  reconcileOrganizationDataUsage,\n} from \"../../workflows/organizations\";\nimport { organizationAccessScopeKey } from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationDataUsageCoordinator\n>();\n\nexport interface OrganizationDataUsageCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDataUsage | null>;\n  /** Undefined means no authoritative result was available for this runtime. */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDataUsage | null | undefined>;\n}\n\nclass OrganizationDataUsageCoordinatorImpl\n  implements OrganizationDataUsageCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDataUsage | null | undefined>>\n  >();\n\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n\n    try {\n      return await loadLocalOrganizationDataUsage({\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      });\n    } catch (error) {\n      active.runtime.util.logError(\n        \"Failed to load local organization data usage\",\n        error,\n      );\n      return null;\n    }\n  }\n\n  reconcile(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return Promise.resolve(undefined);\n    }\n    if (!active.runtime.state.online) {\n      return this.loadLocal(active.organizationId).then(\n        (local) => local ?? undefined,\n      );\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    const reconciliation = reconcileOrganizationDataUsage({\n      apiClient: active.runtime.apiClient,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n      requesterUserId: active.userId,\n    }).finally(() => {\n      if (byKey.get(key) === reconciliation) {\n        byKey.delete(key);\n      }\n    });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n}\n\nexport function createOrganizationDataUsageCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationDataUsageCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationDataUsageCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}
+{"version":3,"file":"organizationDataUsage.js","sourceRoot":"","sources":["organizationDataUsage.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAE9B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mEAAmE,CAAC;AAE/G,OAAO,EAEL,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AAYJ,MAAM,oCAAoC;IAQX;IALZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IAEJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,8BAA8B,CAAC;gBAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE,MAAM,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAC1B,8CAA8C,EAC9C,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,CAAC,cAAuB;QAC/B,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,SAAS,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,cAAc,GAAG,8BAA8B,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n  loadLocalOrganizationDataUsage,\n  type OrganizationDataUsage,\n  reconcileOrganizationDataUsage,\n} from \"../../workflows/organizations\";\nimport { organizationAccessScopeKey } from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationDataUsageCoordinator\n>();\n\nexport interface OrganizationDataUsageCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDataUsage | null>;\n  /** Undefined means no authoritative result was available for this runtime. */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDataUsage | null | undefined>;\n}\n\nclass OrganizationDataUsageCoordinatorImpl\n  implements OrganizationDataUsageCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDataUsage | null | undefined>>\n  >();\n\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n\n    try {\n      return await loadLocalOrganizationDataUsage({\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      });\n    } catch (error) {\n      active.runtime.util.logError(\n        \"Failed to load local organization data usage\",\n        error,\n      );\n      return null;\n    }\n  }\n\n  reconcile(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return Promise.resolve(undefined);\n    }\n    if (!active.runtime.state.online) {\n      return this.loadLocal(active.organizationId).then(\n        (local) => local ?? undefined,\n      );\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    const reconciliation = reconcileOrganizationDataUsage({\n      apiClient: active.runtime.apiClient,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n      requesterUserId: active.userId,\n    }).finally(() => {\n      if (byKey.get(key) === reconciliation) {\n        byKey.delete(key);\n      }\n    });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n}\n\nexport function createOrganizationDataUsageCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationDataUsageCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationDataUsageCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}

package/client/organizations/organizationGroupNameHydration.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n  runtimeService: InternalRuntime,\n  active: ActiveOrganizationDataRuntime,\n  domainScope: DomainScope,\n  directoryAndGroups: OrganizationDirectoryAndGroups | null | undefined,\n) {\n  if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n    // Labels and their metadata root belong to this one reconciliation view.\n    const currentRecovery = {\n      resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n        active.runtime,\n      ),\n      recoveryBatch: {},\n    };\n    return hydrateOrganizationGroupNames({\n      apiClient: active.runtime.apiClient,\n      directory: directoryAndGroups,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n        currentUserId: active.userId,\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        principalId: active.organizationId,\n        principalType: \"organization\",\n      }),\n      reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n      createCurrentNameReader: (authority) =>\n        createRuntimeGroupMetadataAccess(\n          active.runtime,\n          active.organizationId,\n          stillCurrent,\n          createSelectedCurrentGroupMetadataContainerVerifier({\n            authority,\n            organizationId: active.organizationId,\n            stillCurrent,\n          }),\n        ).readName,\n      readEncryptedName: createRuntimeGroupMetadataAccess(\n        active.runtime,\n        active.organizationId,\n        stillCurrent,\n        undefined,\n        currentRecovery,\n      ).readName,\n      resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n      ...currentRecovery,\n      stillCurrent,\n    });\n  }\n  return directoryAndGroups;\n}\n"]}
+{"version":3,"file":"organizationGroupNameHydration.js","sourceRoot":"","sources":["organizationGroupNameHydration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,mDAAmD,EAAE,MAAM,6DAA6D,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AAErG,OAAO,EAAE,2CAA2C,EAAE,MAAM,kDAAkD,CAAC;AAE/G,OAAO,EAEL,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,cAA+B,EAC/B,MAAqC,EACrC,WAAwB,EACxB,kBAAqE;IAErE,IAAI,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,yEAAyE;QACzE,MAAM,eAAe,GAAG;YACtB,oBAAoB,EAAE,2CAA2C,CAC/D,MAAM,CAAC,OAAO,CACf;YACD,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,OAAO,6BAA6B,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,SAAS,EAAE,kBAAkB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;gBACtE,aAAa,EAAE,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;YAClE,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CACrC,gCAAgC,CAC9B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,mDAAmD,CAAC;gBAClD,SAAS;gBACT,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;aACb,CAAC,CACH,CAAC,QAAQ;YACZ,iBAAiB,EAAE,gCAAgC,CACjD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,SAAS,EACT,eAAe,CAChB,CAAC,QAAQ;YACV,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B;YACrE,GAAG,eAAe;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport { loadLocalOrganizationPolicyReference } from \"../../workflows/organizations\";\nimport { createSelectedCurrentGroupMetadataContainerVerifier } from \"../../workflows/organizations/currentGroupMetadataAuthority\";\nimport { createRuntimeGroupMetadataAccess } from \"../../workflows/organizations/groupMetadataRuntime\";\nimport { hydrateOrganizationGroupNames } from \"../../workflows/organizations/organizationGroupNames\";\nimport type { OrganizationDirectoryAndGroups } from \"../../workflows/organizations/readModel\";\nimport { createRuntimePrincipalPolicyCurrentResolver } from \"../../workflows/principals/runtimePolicyRecovery\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nexport async function hydrateOrganizationGroupNamesForRuntime(\n  runtimeService: InternalRuntime,\n  active: ActiveOrganizationDataRuntime,\n  domainScope: DomainScope,\n  directoryAndGroups: OrganizationDirectoryAndGroups | null | undefined,\n) {\n  if (directoryAndGroups && active.runtime.crypto.encapsulationKeyPair) {\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(runtimeService, active, domainScope);\n    // Labels and their metadata root belong to this one reconciliation view.\n    const currentRecovery = {\n      resolveCurrentPolicy: createRuntimePrincipalPolicyCurrentResolver(\n        active.runtime,\n      ),\n      recoveryBatch: {},\n    };\n    return hydrateOrganizationGroupNames({\n      apiClient: active.runtime.apiClient,\n      directory: directoryAndGroups,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      organizationPolicyReference: await loadLocalOrganizationPolicyReference({\n        currentUserId: active.userId,\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        principalId: active.organizationId,\n        principalType: \"organization\",\n      }),\n      reportSecurityIncident: active.runtime.util.reportSecurityIncident,\n      createCurrentNameReader: (authority) =>\n        createRuntimeGroupMetadataAccess(\n          active.runtime,\n          active.organizationId,\n          stillCurrent,\n          createSelectedCurrentGroupMetadataContainerVerifier({\n            authority,\n            organizationId: active.organizationId,\n            stillCurrent,\n          }),\n        ).readName,\n      readEncryptedName: createRuntimeGroupMetadataAccess(\n        active.runtime,\n        active.organizationId,\n        stillCurrent,\n        undefined,\n        currentRecovery,\n      ).readName,\n      resolveTrustedUserIdentity: active.runtime.resolveTrustedUserIdentity,\n      ...currentRecovery,\n      stillCurrent,\n    });\n  }\n  return directoryAndGroups;\n}\n"]}

package/client/organizations/organizationGroupPresentation.d.ts

@@ -1,4 +1,4 @@
-import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
+import type { InternalWorkflowRuntimeInput } from "../runtime/workflowRuntime.js";
 import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";
 export declare function loadOrganizationGroupPresentationDetails(input: {
     readonly groupId: string;

package/client/organizations/organizationGroupPresentation.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationGroupPresentation.js","sourceRoot":"","sources":["organizationGroupPresentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AAIrH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAK9D;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,cAAc;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CACf;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,KAAK,CAAC,oBAAoB;aACvB,sBAAsB,CACrB,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,aAAa,CACpB;aACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,mEAAmE;YACnE,oEAAoE;YACpE,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;gBACjC,KAAK,YAAY,oCAAoC,EACrD,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;KACL,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport async function loadOrganizationGroupPresentationDetails(input: {\n  readonly groupId: string;\n  readonly beforeVersion?: number | undefined;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const organizationId = input.runtime.auth.organizationId;\n  if (\n    !input.runtime.auth.isAuthenticated ||\n    !organizationId ||\n    input.groupId.length === 0\n  ) {\n    return {\n      members: null,\n      policyHistory: null,\n    };\n  }\n\n  const [members, policyHistory] = await Promise.all([\n    input.beforeVersion === undefined\n      ? input.readModelCoordinator.loadLocalGroupMembers(\n          input.groupId,\n          organizationId,\n        )\n      : Promise.resolve(null),\n    input.readModelCoordinator\n      .loadGroupPolicyHistory(\n        input.groupId,\n        organizationId,\n        input.beforeVersion,\n      )\n      .catch((error: unknown) => {\n        // Missing history must not hide the independent member projection.\n        // Older-page failures remain explicit so the caller can retry them.\n        if (\n          input.beforeVersion === undefined &&\n          error instanceof ProjectionDependencyUnavailableError\n        ) {\n          input.runtime.util.logError(\"Group history is unavailable\", error);\n          return null;\n        }\n        throw error;\n      }),\n  ]);\n  return { members, policyHistory };\n}\n"]}
+{"version":3,"file":"organizationGroupPresentation.js","sourceRoot":"","sources":["organizationGroupPresentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AAIrH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAK9D;IACC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QACnC,CAAC,cAAc;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAC9C,KAAK,CAAC,OAAO,EACb,cAAc,CACf;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,KAAK,CAAC,oBAAoB;aACvB,sBAAsB,CACrB,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,aAAa,CACpB;aACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,mEAAmE;YACnE,oEAAoE;YACpE,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;gBACjC,KAAK,YAAY,oCAAoC,EACrD,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;KACL,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\n\nexport async function loadOrganizationGroupPresentationDetails(input: {\n  readonly groupId: string;\n  readonly beforeVersion?: number | undefined;\n  readonly readModelCoordinator: OrganizationReadModelCoordinator;\n  readonly runtime: InternalWorkflowRuntimeInput;\n}) {\n  const organizationId = input.runtime.auth.organizationId;\n  if (\n    !input.runtime.auth.isAuthenticated ||\n    !organizationId ||\n    input.groupId.length === 0\n  ) {\n    return {\n      members: null,\n      policyHistory: null,\n    };\n  }\n\n  const [members, policyHistory] = await Promise.all([\n    input.beforeVersion === undefined\n      ? input.readModelCoordinator.loadLocalGroupMembers(\n          input.groupId,\n          organizationId,\n        )\n      : Promise.resolve(null),\n    input.readModelCoordinator\n      .loadGroupPolicyHistory(\n        input.groupId,\n        organizationId,\n        input.beforeVersion,\n      )\n      .catch((error: unknown) => {\n        // Missing history must not hide the independent member projection.\n        // Older-page failures remain explicit so the caller can retry them.\n        if (\n          input.beforeVersion === undefined &&\n          error instanceof ProjectionDependencyUnavailableError\n        ) {\n          input.runtime.util.logError(\"Group history is unavailable\", error);\n          return null;\n        }\n        throw error;\n      }),\n  ]);\n  return { members, policyHistory };\n}\n"]}

package/client/organizations/organizationReadModels.d.ts

@@ -1,5 +1,5 @@
 import { type OrganizationContainerGrants, type OrganizationDirectoryAndGroups, type OrganizationGroupContainers, type OrganizationGroupMembers, type OrganizationGroupPolicyHistory, type OrganizationPolicyHistory, type OrganizationUserDetail } from "../../workflows/organizations/index.js";
-import type { InternalRuntime } from "../workflowRuntime.js";
+import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 export interface OrganizationReadModelCoordinator {
     loadLocal(organizationId?: string | undefined): Promise<OrganizationDirectoryAndGroups | null>;
     loadLocalGroupMembers(groupId: string, organizationId?: string | undefined): Promise<OrganizationGroupMembers | null>;

package/client/organizations/organizationReadModels.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n  loadLocalOrganizationContainerGrants,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadLocalOrganizationGroupContainers,\n  loadLocalOrganizationGroupMembers,\n  loadLocalOrganizationUserDetail,\n  type OrganizationContainerGrants,\n  type OrganizationDirectoryAndGroups,\n  type OrganizationGroupContainers,\n  type OrganizationGroupMembers,\n  type OrganizationGroupPolicyHistory,\n  type OrganizationPolicyHistory,\n  type OrganizationUserDetail,\n  reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n  organizationAccessScopeKey,\n  wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null>;\n  loadLocalGroupMembers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupMembers | null>;\n  loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationGroupPolicyHistory | null>;\n  loadOrganizationPolicyHistory(\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationPolicyHistory | null>;\n  loadLocalGrants(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationContainerGrants | null>;\n  loadLocalGroupContainers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupContainers | null>;\n  loadLocalUserDetail(\n    userId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationUserDetail | null>;\n  /**\n   * Resolves `undefined` when the runtime declines without I/O (offline,\n   * database not ready, organization mismatch) or when the feed failed with\n   * no locally retained projection — passes that must not count as caught\n   * up; `null` when the reconcile completed but produced nothing presentable\n   * — including an authoritative denial that purged the projection, which\n   * consumers must repaint.\n   */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n  reconcileAfterMutation(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n  implements OrganizationReadModelCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDirectoryAndGroups | null | undefined>>\n  >();\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationDirectoryAndGroups({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGrants(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationContainerGrants({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupContainers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupMembers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationGroupHistory({\n      active,\n      groupId,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadOrganizationPolicyHistory(\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) return null;\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationHistory({\n      active,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadLocalUserDetail(userId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || userId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationUserDetail({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      userId,\n    });\n  }\n\n  reconcile(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return Promise.resolve(undefined);\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    // Snapshot the server-denied flag before reconciling. A reconcile that\n    // flips it back to readable means org access was just restored (e.g. the\n    // user was re-added to a group), and any write lanes idled by\n    // permission-denied submissions have no self re-arm — regaining access is\n    // their retry signal, mirroring how billing recovery re-requests all\n    // lanes. Only a genuine server denial counts: a local session reset also\n    // marks scopes denied, and re-arming on its first reconcile would race the\n    // startup sync passes (e.g. pending-create adoption between panes).\n    const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n      {\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      },\n      \"readModel\",\n    );\n    const domainScope = active.runtime.state.domainScope;\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(\n        this.runtimeService,\n        active,\n        domainScope,\n      );\n\n    const reconciliation = reconcileOrganizationDirectoryAndGroups({\n      apiClient: active.runtime.apiClient,\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n    })\n      .then(async (directoryAndGroups) => {\n        if (!stillCurrent()) return null;\n        // Feed success restores retry eligibility even if name decryption fails.\n        const accessWasRestored =\n          accessWasDenied &&\n          directoryAndGroups !== null &&\n          directoryAndGroups !== undefined;\n        if (accessWasRestored)\n          await recoverOrganizationAccess({\n            active,\n            domainScope,\n            stillCurrent,\n          });\n        if (!stillCurrent()) return null;\n        return hydrateOrganizationGroupNamesForRuntime(\n          this.runtimeService,\n          active,\n          domainScope,\n          directoryAndGroups,\n        );\n      })\n      .finally(() => {\n        if (byKey.get(key) === reconciliation) {\n          byKey.delete(key);\n        }\n      });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n\n  async reconcileAfterMutation(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return undefined;\n    }\n    const existing = this.reconciliationMap(active).get(\n      organizationAccessScopeKey(active.organizationId, active.userId),\n    );\n    if (existing) {\n      await existing.catch(() => null);\n    }\n    return this.reconcile(active.organizationId);\n  }\n}\n\nexport function createOrganizationReadModelCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}
+{"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n  loadLocalOrganizationContainerGrants,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadLocalOrganizationGroupContainers,\n  loadLocalOrganizationGroupMembers,\n  loadLocalOrganizationUserDetail,\n  type OrganizationContainerGrants,\n  type OrganizationDirectoryAndGroups,\n  type OrganizationGroupContainers,\n  type OrganizationGroupMembers,\n  type OrganizationGroupPolicyHistory,\n  type OrganizationPolicyHistory,\n  type OrganizationUserDetail,\n  reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n  organizationAccessScopeKey,\n  wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null>;\n  loadLocalGroupMembers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupMembers | null>;\n  loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationGroupPolicyHistory | null>;\n  loadOrganizationPolicyHistory(\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationPolicyHistory | null>;\n  loadLocalGrants(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationContainerGrants | null>;\n  loadLocalGroupContainers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupContainers | null>;\n  loadLocalUserDetail(\n    userId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationUserDetail | null>;\n  /**\n   * Resolves `undefined` when the runtime declines without I/O (offline,\n   * database not ready, organization mismatch) or when the feed failed with\n   * no locally retained projection — passes that must not count as caught\n   * up; `null` when the reconcile completed but produced nothing presentable\n   * — including an authoritative denial that purged the projection, which\n   * consumers must repaint.\n   */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n  reconcileAfterMutation(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n  implements OrganizationReadModelCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDirectoryAndGroups | null | undefined>>\n  >();\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationDirectoryAndGroups({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGrants(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationContainerGrants({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupContainers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupMembers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationGroupHistory({\n      active,\n      groupId,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadOrganizationPolicyHistory(\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) return null;\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationHistory({\n      active,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadLocalUserDetail(userId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || userId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationUserDetail({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      userId,\n    });\n  }\n\n  reconcile(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return Promise.resolve(undefined);\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    // Snapshot the server-denied flag before reconciling. A reconcile that\n    // flips it back to readable means org access was just restored (e.g. the\n    // user was re-added to a group), and any write lanes idled by\n    // permission-denied submissions have no self re-arm — regaining access is\n    // their retry signal, mirroring how billing recovery re-requests all\n    // lanes. Only a genuine server denial counts: a local session reset also\n    // marks scopes denied, and re-arming on its first reconcile would race the\n    // startup sync passes (e.g. pending-create adoption between panes).\n    const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n      {\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      },\n      \"readModel\",\n    );\n    const domainScope = active.runtime.state.domainScope;\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(\n        this.runtimeService,\n        active,\n        domainScope,\n      );\n\n    const reconciliation = reconcileOrganizationDirectoryAndGroups({\n      apiClient: active.runtime.apiClient,\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n    })\n      .then(async (directoryAndGroups) => {\n        if (!stillCurrent()) return null;\n        // Feed success restores retry eligibility even if name decryption fails.\n        const accessWasRestored =\n          accessWasDenied &&\n          directoryAndGroups !== null &&\n          directoryAndGroups !== undefined;\n        if (accessWasRestored)\n          await recoverOrganizationAccess({\n            active,\n            domainScope,\n            stillCurrent,\n          });\n        if (!stillCurrent()) return null;\n        return hydrateOrganizationGroupNamesForRuntime(\n          this.runtimeService,\n          active,\n          domainScope,\n          directoryAndGroups,\n        );\n      })\n      .finally(() => {\n        if (byKey.get(key) === reconciliation) {\n          byKey.delete(key);\n        }\n      });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n\n  async reconcileAfterMutation(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return undefined;\n    }\n    const existing = this.reconciliationMap(active).get(\n      organizationAccessScopeKey(active.organizationId, active.userId),\n    );\n    if (existing) {\n      await existing.catch(() => null);\n    }\n    return this.reconcile(active.organizationId);\n  }\n}\n\nexport function createOrganizationReadModelCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}

package/client/organizations/organizationWorkflowRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationWorkflowRuntime.js","sourceRoot":"","sources":["organizationWorkflowRuntime.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe;QAChE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC7B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,cAA+B,EAC/B,QAAiC,EACjC,oBAA6B;IAE7B,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC/C,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,cAAc,GAClB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,oBAAoB,CAAC;IAC3B,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;AACpE,CAAC;AAQD,MAAM,UAAU,6BAA6B,CAC3C,cAA+B,EAC/B,sBAA+B;IAE/B,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IACnC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAC7B,CAAC,cAAc;QACf,CAAC,MAAM;QACP,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;QAClC,CAAC,sBAAsB,KAAK,SAAS;YACnC,cAAc,KAAK,sBAAsB,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,cAA+B,EAC/B,MAAqC,EACrC,WAAwB;IAExB,MAAM,OAAO,GAAG,6BAA6B,CAC3C,cAAc,EACd,MAAM,CAAC,cAAc,CACtB,CAAC;IACF,OAAO,CACL,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM;QACjC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAClD,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport type {\n  InternalRuntime,\n  InternalWorkflowRuntimeInput,\n} from \"../workflowRuntime\";\n\ntype OrganizationWorkflow<T> = (input: {\n  readonly apiClient: InternalWorkflowRuntimeInput[\"apiClient\"];\n  readonly organizationId: string;\n}) => Promise<T>;\n\nexport function authenticatedOrganizationId(\n  runtime: InternalWorkflowRuntimeInput,\n): string | null {\n  return runtime.auth.organizationId && runtime.auth.isAuthenticated\n    ? runtime.auth.organizationId\n    : null;\n}\n\nexport function runForOrganization<T>(\n  runtimeService: InternalRuntime,\n  workflow: OrganizationWorkflow<T>,\n  targetOrganizationId?: string,\n): Promise<T | null> {\n  const runtime = runtimeService.workflowInput();\n  const activeOrganizationId = authenticatedOrganizationId(runtime);\n  const organizationId =\n    targetOrganizationId === undefined\n      ? activeOrganizationId\n      : targetOrganizationId;\n  if (!activeOrganizationId || !organizationId) {\n    return Promise.resolve(null);\n  }\n\n  return workflow({ apiClient: runtime.apiClient, organizationId });\n}\n\nexport interface ActiveOrganizationDataRuntime {\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly organizationId: string;\n  readonly userId: string;\n}\n\nexport function activeOrganizationDataRuntime(\n  runtimeService: InternalRuntime,\n  expectedOrganizationId?: string,\n): ActiveOrganizationDataRuntime | null {\n  const runtime = runtimeService.workflowInput();\n  const organizationId = runtime.auth.organizationId;\n  const userId = runtime.auth.userId;\n  if (\n    !runtime.auth.isAuthenticated ||\n    !organizationId ||\n    !userId ||\n    runtime.infra.dbStatus !== \"ready\" ||\n    (expectedOrganizationId !== undefined &&\n      organizationId !== expectedOrganizationId)\n  ) {\n    return null;\n  }\n\n  return { runtime, organizationId, userId };\n}\n\nexport function isOrganizationDataRuntimeCurrent(\n  runtimeService: InternalRuntime,\n  active: ActiveOrganizationDataRuntime,\n  domainScope: DomainScope,\n): boolean {\n  const current = activeOrganizationDataRuntime(\n    runtimeService,\n    active.organizationId,\n  );\n  return (\n    current?.userId === active.userId &&\n    current.runtime.infra.execSql === active.runtime.infra.execSql &&\n    current.runtime.state.domainScope === domainScope\n  );\n}\n"]}
+{"version":3,"file":"organizationWorkflowRuntime.js","sourceRoot":"","sources":["organizationWorkflowRuntime.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe;QAChE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc;QAC7B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,cAA+B,EAC/B,QAAiC,EACjC,oBAA6B;IAE7B,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC/C,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,cAAc,GAClB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,oBAAoB,CAAC;IAC3B,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;AACpE,CAAC;AAQD,MAAM,UAAU,6BAA6B,CAC3C,cAA+B,EAC/B,sBAA+B;IAE/B,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IACnC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe;QAC7B,CAAC,cAAc;QACf,CAAC,MAAM;QACP,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;QAClC,CAAC,sBAAsB,KAAK,SAAS;YACnC,cAAc,KAAK,sBAAsB,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,cAA+B,EAC/B,MAAqC,EACrC,WAAwB;IAExB,MAAM,OAAO,GAAG,6BAA6B,CAC3C,cAAc,EACd,MAAM,CAAC,cAAc,CACtB,CAAC;IACF,OAAO,CACL,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM;QACjC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAClD,CAAC;AACJ,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport type {\n  InternalRuntime,\n  InternalWorkflowRuntimeInput,\n} from \"../runtime/workflowRuntime\";\n\ntype OrganizationWorkflow<T> = (input: {\n  readonly apiClient: InternalWorkflowRuntimeInput[\"apiClient\"];\n  readonly organizationId: string;\n}) => Promise<T>;\n\nexport function authenticatedOrganizationId(\n  runtime: InternalWorkflowRuntimeInput,\n): string | null {\n  return runtime.auth.organizationId && runtime.auth.isAuthenticated\n    ? runtime.auth.organizationId\n    : null;\n}\n\nexport function runForOrganization<T>(\n  runtimeService: InternalRuntime,\n  workflow: OrganizationWorkflow<T>,\n  targetOrganizationId?: string,\n): Promise<T | null> {\n  const runtime = runtimeService.workflowInput();\n  const activeOrganizationId = authenticatedOrganizationId(runtime);\n  const organizationId =\n    targetOrganizationId === undefined\n      ? activeOrganizationId\n      : targetOrganizationId;\n  if (!activeOrganizationId || !organizationId) {\n    return Promise.resolve(null);\n  }\n\n  return workflow({ apiClient: runtime.apiClient, organizationId });\n}\n\nexport interface ActiveOrganizationDataRuntime {\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly organizationId: string;\n  readonly userId: string;\n}\n\nexport function activeOrganizationDataRuntime(\n  runtimeService: InternalRuntime,\n  expectedOrganizationId?: string,\n): ActiveOrganizationDataRuntime | null {\n  const runtime = runtimeService.workflowInput();\n  const organizationId = runtime.auth.organizationId;\n  const userId = runtime.auth.userId;\n  if (\n    !runtime.auth.isAuthenticated ||\n    !organizationId ||\n    !userId ||\n    runtime.infra.dbStatus !== \"ready\" ||\n    (expectedOrganizationId !== undefined &&\n      organizationId !== expectedOrganizationId)\n  ) {\n    return null;\n  }\n\n  return { runtime, organizationId, userId };\n}\n\nexport function isOrganizationDataRuntimeCurrent(\n  runtimeService: InternalRuntime,\n  active: ActiveOrganizationDataRuntime,\n  domainScope: DomainScope,\n): boolean {\n  const current = activeOrganizationDataRuntime(\n    runtimeService,\n    active.organizationId,\n  );\n  return (\n    current?.userId === active.userId &&\n    current.runtime.infra.execSql === active.runtime.infra.execSql &&\n    current.runtime.state.domainScope === domainScope\n  );\n}\n"]}

package/client/organizations/organizationsTypes.d.ts

@@ -1,7 +1,7 @@
 import type { NativeSubscriptionStore } from "../../internal/validators/billing.js";
 import type { PrincipalPolicyMutationResponse } from "../../internal/validators/response/index.js";
 import type { cancelStripeSubscription, checkNativePurchaseEligibility, claimNativeOrganizationSubscription, createOrganizationGroup, createStripeCheckout, createStripeCheckoutSession, importOrganizationUser, LocalOrganizationSummary, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, loadStripeCheckoutOptions, revokeOrganizationContainerGrant, startOrganizationTrial, updateOrganizationProfile, updateOrganizationRosterEntry } from "../../workflows/organizations/index.js";
-import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
+import type { InternalWorkflowRuntimeInput } from "../runtime/workflowRuntime.js";
 import type { OrganizationDataUsageCoordinator } from "./organizationDataUsage.js";
 import type { loadOrganizationGroupPresentationDetails } from "./organizationGroupPresentation.js";
 import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";

package/client/organizations/organizationsTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createOrganizationGroup,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  LocalOrganizationSummary,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n  AddOrganizationGroupUserInput,\n  deleteGroupForOrganization,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. */\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n  discardUnreadablePolicyMutation: (\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  readPendingPolicyMutation: (\n    organizationId: string,\n  ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n  retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n  abandonPendingPolicyMutation: (\n    input: AbandonOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  addUserToGroup: (\n    input: AddOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n  deleteGroup: (\n    groupId: string,\n  ) => ReturnType<typeof deleteGroupForOrganization>;\n  importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n  loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n  /** Billing for an organization the session is not currently switched to. */\n  loadBillingForOrganization: (\n    organizationId: string,\n  ) => ReturnType<typeof loadOrganizationBilling>;\n  loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n  loadBillingManagementUrl: () => ReturnType<\n    typeof loadOrganizationBillingManagementUrl\n  >;\n  /** Direct Stripe checkout (issue #1654): options, start, and cancel. */\n  loadStripeCheckoutOptions: (\n    organizationId?: string,\n  ) => ReturnType<typeof loadStripeCheckoutOptions>;\n  createStripeCheckout: (\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckout>;\n  createStripeCheckoutSession: (\n    returnUrl: string,\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckoutSession>;\n  cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n  claimNativeSubscription: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n  checkNativePurchaseEligibility: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof checkNativePurchaseEligibility>;\n  loadDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"reconcile\"]\n  >;\n  loadLocalDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"loadLocal\"]\n  >;\n  loadDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcile\"]\n  >;\n  loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n  >;\n  loadLocalDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocal\"]\n  >;\n  loadGroupMembers: (\n    groupId: string,\n  ) => ReturnType<\n    InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n  >;\n  loadGroupPresentationDetails(\n    groupId: string,\n    beforeVersion?: number,\n  ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n  loadGroupContainers: (\n    groupId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n  loadGrants: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n  >;\n  listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n  loadPolicyHistory: (\n    beforeVersion?: number,\n  ) => ReturnType<\n    OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n  >;\n  loadUserDetail: (\n    userId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n  updateRosterEntry: (\n    userId: string,\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationRosterEntry>;\n  updateProfile: (\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationProfile>;\n  removeUserFromGroup: (\n    input: RemoveOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  revokeGrant: (\n    grant: OrganizationGrantRef,\n  ) => Promise<\n    | Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n    | OrganizationGroupMutationReceipt\n  >;\n  startTrial: (\n    organizationId?: string,\n  ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}
+{"version":3,"file":"organizationsTypes.js","sourceRoot":"","sources":["organizationsTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { NativeSubscriptionStore } from \"@tearleads/validators/billing\";\nimport type { PrincipalPolicyMutationResponse } from \"@tearleads/validators/response\";\nimport type {\n  cancelStripeSubscription,\n  checkNativePurchaseEligibility,\n  claimNativeOrganizationSubscription,\n  createOrganizationGroup,\n  createStripeCheckout,\n  createStripeCheckoutSession,\n  importOrganizationUser,\n  LocalOrganizationSummary,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  loadStripeCheckoutOptions,\n  revokeOrganizationContainerGrant,\n  startOrganizationTrial,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"../../workflows/organizations\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\nimport type { OrganizationDataUsageCoordinator } from \"./organizationDataUsage\";\nimport type { loadOrganizationGroupPresentationDetails } from \"./organizationGroupPresentation\";\nimport type { OrganizationReadModelCoordinator } from \"./organizationReadModels\";\nimport type {\n  AbandonOrganizationPolicyMutationInput,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  readPendingOrganizationPolicyMutation,\n} from \"./principalMutationRecovery\";\nimport type {\n  AddOrganizationGroupUserInput,\n  deleteGroupForOrganization,\n  OrganizationGrantRef,\n  RemoveOrganizationGroupUserInput,\n} from \"./principalMutations\";\n\n/** Exact current artifacts and container receipts; no historical prefix. */\nexport type OrganizationGroupMutationReceipt = PrincipalPolicyMutationResponse;\n\nexport interface Organizations {\n  discardUnreadablePolicyMutation: (\n    input: DiscardUnreadableOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  readPendingPolicyMutation: (\n    organizationId: string,\n  ) => ReturnType<typeof readPendingOrganizationPolicyMutation>;\n  retryPendingPolicyMutation: (organizationId: string) => Promise<void>;\n  abandonPendingPolicyMutation: (\n    input: AbandonOrganizationPolicyMutationInput,\n  ) => Promise<boolean>;\n  addUserToGroup: (\n    input: AddOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  createGroup: (name: string) => ReturnType<typeof createOrganizationGroup>;\n  deleteGroup: (\n    groupId: string,\n  ) => ReturnType<typeof deleteGroupForOrganization>;\n  importUserById: (userId: string) => ReturnType<typeof importOrganizationUser>;\n  loadBilling: () => ReturnType<typeof loadOrganizationBilling>;\n  /** Billing for an organization the session is not currently switched to. */\n  loadBillingForOrganization: (\n    organizationId: string,\n  ) => ReturnType<typeof loadOrganizationBilling>;\n  loadBillingHistory: () => ReturnType<typeof loadOrganizationBillingHistory>;\n  loadBillingManagementUrl: () => ReturnType<\n    typeof loadOrganizationBillingManagementUrl\n  >;\n  /** Direct Stripe checkout (issue #1654): options, start, and cancel. */\n  loadStripeCheckoutOptions: (\n    organizationId?: string,\n  ) => ReturnType<typeof loadStripeCheckoutOptions>;\n  createStripeCheckout: (\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckout>;\n  createStripeCheckoutSession: (\n    returnUrl: string,\n    organizationId?: string,\n  ) => ReturnType<typeof createStripeCheckoutSession>;\n  cancelStripeSubscription: () => ReturnType<typeof cancelStripeSubscription>;\n  claimNativeSubscription: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof claimNativeOrganizationSubscription>;\n  checkNativePurchaseEligibility: (\n    organizationId: string,\n    store: NativeSubscriptionStore,\n  ) => ReturnType<typeof checkNativePurchaseEligibility>;\n  loadDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"reconcile\"]\n  >;\n  loadLocalDataUsage: () => ReturnType<\n    OrganizationDataUsageCoordinator[\"loadLocal\"]\n  >;\n  loadDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcile\"]\n  >;\n  loadDirectoryAndGroupsAfterMutation: () => ReturnType<\n    OrganizationReadModelCoordinator[\"reconcileAfterMutation\"]\n  >;\n  loadLocalDirectoryAndGroups: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocal\"]\n  >;\n  loadGroupMembers: (\n    groupId: string,\n  ) => ReturnType<\n    InternalWorkflowRuntimeInput[\"apiClient\"][\"listOrganizationGroupMembers\"]\n  >;\n  loadGroupPresentationDetails(\n    groupId: string,\n    beforeVersion?: number,\n  ): ReturnType<typeof loadOrganizationGroupPresentationDetails>;\n  loadGroupContainers: (\n    groupId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalGroupContainers\"]>;\n  loadGrants: () => ReturnType<\n    OrganizationReadModelCoordinator[\"loadLocalGrants\"]\n  >;\n  listLocalOrganizations: () => Promise<LocalOrganizationSummary[]>;\n  loadPolicyHistory: (\n    beforeVersion?: number,\n  ) => ReturnType<\n    OrganizationReadModelCoordinator[\"loadOrganizationPolicyHistory\"]\n  >;\n  loadUserDetail: (\n    userId: string,\n  ) => ReturnType<OrganizationReadModelCoordinator[\"loadLocalUserDetail\"]>;\n  updateRosterEntry: (\n    userId: string,\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationRosterEntry>;\n  updateProfile: (\n    profileDocumentId: string | null,\n  ) => ReturnType<typeof updateOrganizationProfile>;\n  removeUserFromGroup: (\n    input: RemoveOrganizationGroupUserInput,\n  ) => Promise<OrganizationGroupMutationReceipt>;\n  revokeGrant: (\n    grant: OrganizationGrantRef,\n  ) => Promise<\n    | Awaited<ReturnType<typeof revokeOrganizationContainerGrant>>\n    | OrganizationGroupMutationReceipt\n  >;\n  startTrial: (\n    organizationId?: string,\n  ) => ReturnType<typeof startOrganizationTrial>;\n}\n"]}

package/client/organizations/principalContainerMutations.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../../workflows/organizations/principalContainerRematerializationPlanning\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n  readonly groupId: string;\n  readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly organizationId: string;\n  readonly revokedContainerId?: string | undefined;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n  const author = resolveDocumentCreateAuthor(input.runtime);\n  const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !targetSecretKey) {\n    throw new Error(\n      \"Organization container rematerialization context is unavailable\",\n    );\n  }\n  return preparePrincipalContainerRematerializationBatch({\n    preceding: input.preceding,\n    stillCurrent: input.stillCurrent,\n    recitationStillCurrent: input.recitationStillCurrent,\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient: input.runtime.apiClient,\n    author,\n    execSql: input.runtime.infra.execSql,\n    grants: [\n      ...new Map(\n        [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: input.groupId,\n    nextPolicy: input.nextPolicy,\n    resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n    revokedContainerId: input.revokedContainerId,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n}\n"]}
+{"version":3,"file":"principalContainerMutations.js","sourceRoot":"","sources":["principalContainerMutations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAEL,+CAA+C,GAChD,MAAM,mEAAmE,CAAC;AAE3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAGpG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,+CAA+C,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAU,CAC/C,CACF,CAAC,MAAM,EAAE;SACX;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { CurrentPolicyReferenceResolver } from \"../../data/principals/currentPolicyReferenceResolver\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../data/principals/principalPolicyEvidence\";\nimport { resolveDocumentCreateAuthor } from \"../../workflows/documents\";\nimport {\n  type PreparedPrincipalContainerRematerializationBatch,\n  preparePrincipalContainerRematerializationBatch,\n} from \"../../workflows/organizations/principalContainerRematerialization\";\nimport type { PrincipalRematerializationPredecessor } from \"../../workflows/organizations/principalContainerRematerializationPlanning\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../workflows/principals/runtimePolicyWarmer\";\nimport type { InternalWorkflowRuntimeInput } from \"../runtime/workflowRuntime\";\n\nexport async function preparePrincipalContainerMutations(input: {\n  readonly preceding?: PrincipalRematerializationPredecessor | undefined;\n  readonly currentPolicy: Pick<PrincipalPolicyBundleResponse, \"currentGrants\">;\n  readonly groupId: string;\n  readonly nextPolicy: PrincipalPolicyCurrentEvidence;\n  readonly resolveAuthoredPolicyReferences?:\n    | CurrentPolicyReferenceResolver\n    | undefined;\n  readonly organizationId: string;\n  readonly revokedContainerId?: string | undefined;\n  readonly runtime: InternalWorkflowRuntimeInput;\n  readonly stillCurrent: () => boolean;\n  readonly recitationStillCurrent?: (() => boolean) | undefined;\n}): Promise<PreparedPrincipalContainerRematerializationBatch> {\n  const author = resolveDocumentCreateAuthor(input.runtime);\n  const targetSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !targetSecretKey) {\n    throw new Error(\n      \"Organization container rematerialization context is unavailable\",\n    );\n  }\n  return preparePrincipalContainerRematerializationBatch({\n    preceding: input.preceding,\n    stillCurrent: input.stillCurrent,\n    recitationStillCurrent: input.recitationStillCurrent,\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient: input.runtime.apiClient,\n    author,\n    execSql: input.runtime.infra.execSql,\n    grants: [\n      ...new Map(\n        [...input.currentPolicy.currentGrants, ...input.nextPolicy.grants].map(\n          (grant) => [grant.containerId, grant] as const,\n        ),\n      ).values(),\n    ],\n    groupId: input.groupId,\n    nextPolicy: input.nextPolicy,\n    resolveAuthoredPolicyReferences: input.resolveAuthoredPolicyReferences,\n    revokedContainerId: input.revokedContainerId,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n}\n"]}

package/client/organizations/principalMutationRecovery.d.ts

@@ -1,5 +1,5 @@
 import type { AuthoredPrincipalMutation } from "../../data/principals/principalMutationJournal.js";
-import type { InternalRuntime } from "../workflowRuntime.js";
+import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 export interface AbandonOrganizationPolicyMutationInput {
     readonly organizationId: string;
     readonly mutation: AuthoredPrincipalMutation;

package/client/organizations/principalMutationRecovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalMutationRecovery.js","sourceRoot":"","sources":["principalMutationRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAIpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAcvE,KAAK,UAAU,WAAW,CACxB,OAAwB,EACxB,cAAsB,EACtB,GAAsD;IAEtD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACzC,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,cAAc,CACvE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,OAAwB,EACxB,KAAuD;IAEvD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,kCAAkC,CACpC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,4BAA4B,CAAC,cAAc,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,+BAA+B,CAAC,cAAc,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAwB,EACxB,KAA6C;IAE7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,+BAA+B,CACjC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport type { PrincipalMutationRecoveryApi } from \"../../workflows/organizations/principalMutationJournalManagement\";\nimport type { InternalRuntime } from \"../workflowRuntime\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\n\nexport interface AbandonOrganizationPolicyMutationInput {\n  readonly organizationId: string;\n  readonly mutation: AuthoredPrincipalMutation;\n  readonly acknowledgeUnknownOutcome: true;\n}\n\nexport interface DiscardUnreadableOrganizationPolicyMutationInput {\n  readonly organizationId: string;\n  readonly recordId: string;\n  readonly acknowledgeUnknownOutcome: true;\n}\n\nasync function runRecovery<T>(\n  service: InternalRuntime,\n  organizationId: string,\n  run: (api: PrincipalMutationRecoveryApi) => Promise<T>,\n): Promise<T> {\n  const active = currentOrganizationMutation(service, true);\n  const { runtime, stillCurrent } = active;\n  assertProjectionVerificationCurrent(\n    () => stillCurrent() && runtime.auth.organizationId === organizationId,\n  );\n  const result = await run(runtime.apiClient);\n  assertProjectionVerificationCurrent(stillCurrent);\n  return result;\n}\n\nexport function discardUnreadableOrganizationPolicyMutation(\n  service: InternalRuntime,\n  input: DiscardUnreadableOrganizationPolicyMutationInput,\n) {\n  return runRecovery(service, input.organizationId, (api) =>\n    api.discardUnreadablePrincipalMutation(\n      input.organizationId,\n      input.recordId,\n      input.acknowledgeUnknownOutcome,\n    ),\n  );\n}\n\nexport function readPendingOrganizationPolicyMutation(\n  service: InternalRuntime,\n  organizationId: string,\n) {\n  return runRecovery(service, organizationId, (api) =>\n    api.readPendingPrincipalMutation(organizationId),\n  );\n}\n\nexport function retryPendingOrganizationPolicyMutation(\n  service: InternalRuntime,\n  organizationId: string,\n) {\n  return runRecovery(service, organizationId, (api) =>\n    api.recoverPendingPrincipalMutation(organizationId),\n  );\n}\n\nexport function abandonPendingOrganizationPolicyMutation(\n  service: InternalRuntime,\n  input: AbandonOrganizationPolicyMutationInput,\n) {\n  return runRecovery(service, input.organizationId, (api) =>\n    api.abandonPendingPrincipalMutation(\n      input.organizationId,\n      input.mutation,\n      input.acknowledgeUnknownOutcome,\n    ),\n  );\n}\n"]}
+{"version":3,"file":"principalMutationRecovery.js","sourceRoot":"","sources":["principalMutationRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAIpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAcvE,KAAK,UAAU,WAAW,CACxB,OAAwB,EACxB,cAAsB,EACtB,GAAsD;IAEtD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACzC,mCAAmC,CACjC,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,cAAc,CACvE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,OAAwB,EACxB,KAAuD;IAEvD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,kCAAkC,CACpC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,4BAA4B,CAAC,cAAc,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,OAAwB,EACxB,cAAsB;IAEtB,OAAO,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,GAAG,CAAC,+BAA+B,CAAC,cAAc,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAwB,EACxB,KAA6C;IAE7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,+BAA+B,CACjC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,yBAAyB,CAChC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { assertProjectionVerificationCurrent } from \"../../data/keyingProjectionVerification/types\";\nimport type { AuthoredPrincipalMutation } from \"../../data/principals/principalMutationJournal\";\nimport type { PrincipalMutationRecoveryApi } from \"../../workflows/organizations/principalMutationJournalManagement\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { currentOrganizationMutation } from \"./principalMutationScope\";\n\nexport interface AbandonOrganizationPolicyMutationInput {\n  readonly organizationId: string;\n  readonly mutation: AuthoredPrincipalMutation;\n  readonly acknowledgeUnknownOutcome: true;\n}\n\nexport interface DiscardUnreadableOrganizationPolicyMutationInput {\n  readonly organizationId: string;\n  readonly recordId: string;\n  readonly acknowledgeUnknownOutcome: true;\n}\n\nasync function runRecovery<T>(\n  service: InternalRuntime,\n  organizationId: string,\n  run: (api: PrincipalMutationRecoveryApi) => Promise<T>,\n): Promise<T> {\n  const active = currentOrganizationMutation(service, true);\n  const { runtime, stillCurrent } = active;\n  assertProjectionVerificationCurrent(\n    () => stillCurrent() && runtime.auth.organizationId === organizationId,\n  );\n  const result = await run(runtime.apiClient);\n  assertProjectionVerificationCurrent(stillCurrent);\n  return result;\n}\n\nexport function discardUnreadableOrganizationPolicyMutation(\n  service: InternalRuntime,\n  input: DiscardUnreadableOrganizationPolicyMutationInput,\n) {\n  return runRecovery(service, input.organizationId, (api) =>\n    api.discardUnreadablePrincipalMutation(\n      input.organizationId,\n      input.recordId,\n      input.acknowledgeUnknownOutcome,\n    ),\n  );\n}\n\nexport function readPendingOrganizationPolicyMutation(\n  service: InternalRuntime,\n  organizationId: string,\n) {\n  return runRecovery(service, organizationId, (api) =>\n    api.readPendingPrincipalMutation(organizationId),\n  );\n}\n\nexport function retryPendingOrganizationPolicyMutation(\n  service: InternalRuntime,\n  organizationId: string,\n) {\n  return runRecovery(service, organizationId, (api) =>\n    api.recoverPendingPrincipalMutation(organizationId),\n  );\n}\n\nexport function abandonPendingOrganizationPolicyMutation(\n  service: InternalRuntime,\n  input: AbandonOrganizationPolicyMutationInput,\n) {\n  return runRecovery(service, input.organizationId, (api) =>\n    api.abandonPendingPrincipalMutation(\n      input.organizationId,\n      input.mutation,\n      input.acknowledgeUnknownOutcome,\n    ),\n  );\n}\n"]}

package/client/organizations/principalMutationScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalMutationScope.js","sourceRoot":"","sources":["principalMutationScope.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CACzC,OAAqE,EACrE,iBAAiB,GAAG,KAAK;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,OAAO;QACL,OAAO;QACP,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO;YACL,gEAAgE;YAChE,iEAAiE;YACjE,CAAC,iBAAiB;gBAChB,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACzC,CAAC,CAAC,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,CAAC;gBACpD,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;gBAClC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW;gBACvD,OAAO,CAAC,IAAI,CAAC,eAAe;gBAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3D,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3C,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,kBAAkB,CACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { InternalRuntime } from \"../workflowRuntime\";\n\n/** Capture a mutation's identity/database lifetime without freezing live status. */\nexport function currentOrganizationMutation(\n  service: Pick<InternalRuntime, \"workflowInput\" | \"sessionGeneration\">,\n  allowTokenRenewal = false,\n) {\n  const runtime = service.workflowInput();\n  const sessionGeneration = service.sessionGeneration;\n  return {\n    runtime,\n    stillCurrent: () => {\n      const current = service.workflowInput();\n      return (\n        // Journal API custody survives token renewal, but its identity,\n        // organization and storage generation are still bound immutably.\n        (allowTokenRenewal\n          ? current.apiClient === runtime.apiClient\n          : service.sessionGeneration === sessionGeneration) &&\n        current.infra.dbStatus === \"ready\" &&\n        current.infra.execSql === runtime.infra.execSql &&\n        current.state.domainScope === runtime.state.domainScope &&\n        current.auth.isAuthenticated &&\n        current.auth.organizationId === runtime.auth.organizationId &&\n        current.auth.userId === runtime.auth.userId &&\n        current.crypto.signingFingerprint === runtime.crypto.signingFingerprint\n      );\n    },\n  };\n}\n"]}
+{"version":3,"file":"principalMutationScope.js","sourceRoot":"","sources":["principalMutationScope.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CACzC,OAAqE,EACrE,iBAAiB,GAAG,KAAK;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,OAAO;QACL,OAAO;QACP,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO;YACL,gEAAgE;YAChE,iEAAiE;YACjE,CAAC,iBAAiB;gBAChB,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACzC,CAAC,CAAC,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,CAAC;gBACpD,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO;gBAClC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC/C,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW;gBACvD,OAAO,CAAC,IAAI,CAAC,eAAe;gBAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3D,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3C,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,kBAAkB,CACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { InternalRuntime } from \"../runtime/workflowRuntime\";\n\n/** Capture a mutation's identity/database lifetime without freezing live status. */\nexport function currentOrganizationMutation(\n  service: Pick<InternalRuntime, \"workflowInput\" | \"sessionGeneration\">,\n  allowTokenRenewal = false,\n) {\n  const runtime = service.workflowInput();\n  const sessionGeneration = service.sessionGeneration;\n  return {\n    runtime,\n    stillCurrent: () => {\n      const current = service.workflowInput();\n      return (\n        // Journal API custody survives token renewal, but its identity,\n        // organization and storage generation are still bound immutably.\n        (allowTokenRenewal\n          ? current.apiClient === runtime.apiClient\n          : service.sessionGeneration === sessionGeneration) &&\n        current.infra.dbStatus === \"ready\" &&\n        current.infra.execSql === runtime.infra.execSql &&\n        current.state.domainScope === runtime.state.domainScope &&\n        current.auth.isAuthenticated &&\n        current.auth.organizationId === runtime.auth.organizationId &&\n        current.auth.userId === runtime.auth.userId &&\n        current.crypto.signingFingerprint === runtime.crypto.signingFingerprint\n      );\n    },\n  };\n}\n"]}

package/client/organizations/principalMutations.d.ts

@@ -1,6 +1,6 @@
 import type { ContainerGrantSubjectType } from "../../internal/crypto/index.js";
-import type { ContainerContents } from "../containerContents.js";
-import type { InternalWorkflowRuntimeInput } from "../workflowRuntime.js";
+import type { ContainerContents } from "../containerContents/index.js";
+import type { InternalWorkflowRuntimeInput } from "../runtime/workflowRuntime.js";
 import type { OrganizationReadModelCoordinator } from "./organizationReadModels.js";
 export interface OrganizationGrantRef {
     containerId: string;