@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/organizations/readModel/localReadModelDetails.js

@@ -0,0 +1,182 @@
+import { loadContainerDisplayNamesByIds } from "../../../data/persistence/containers/containerPersistence.js";
+import { loadOrganizationGroupDisplayNames } from "../../../data/persistence/organizations/organizationGroupNamePersistence.js";
+import { loadOrganizationReadModelProjection } from "../../../data/persistence/organizations/organizationReadModelPersistence.js";
+import { loadPrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
+import { loadVerifiedOrganizationGroupRoles } from "../../../data/principals/organizationGroupRoles.js";
+import { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "../policyHistory/policyHistoryReadModel.js";
+import { runOrganizationPresentationRead } from "./organizationPresentationAccessState.js";
+const DISPLAY_NAME_BATCH_SIZE = 400;
+function uniqueContainerIds(grants) {
+    return [...new Set(grants.map((grant) => grant.containerId))];
+}
+async function enrichGrants(execSql, grants, organizationId) {
+    const containerIds = uniqueContainerIds(grants);
+    const groupNames = await loadOrganizationGroupDisplayNames(execSql, organizationId);
+    const groupRoles = await loadVerifiedOrganizationGroupRoles(execSql, organizationId);
+    const displayNames = new Map();
+    for (let index = 0; index < containerIds.length; index += DISPLAY_NAME_BATCH_SIZE) {
+        const batch = await loadContainerDisplayNamesByIds(execSql, containerIds.slice(index, index + DISPLAY_NAME_BATCH_SIZE));
+        for (const [containerId, displayName] of batch) {
+            displayNames.set(containerId, displayName);
+        }
+    }
+    return grants.map((grant) => ({
+        ...grant,
+        containerDisplayName: displayNames.get(grant.containerId) ?? null,
+        groupName: grant.subjectType === "group"
+            ? (groupRoles.get(grant.subjectId) ??
+                groupNames.get(grant.subjectId) ??
+                null)
+            : null,
+    }));
+}
+function toGroupContainer(grant) {
+    return {
+        accessLevel: grant.accessLevel,
+        containerId: grant.containerId,
+        containerDisplayName: grant.containerDisplayName,
+        createdAt: grant.createdAt,
+        depth: grant.depth,
+        isBuiltin: grant.isBuiltin,
+        metadataAccessEpoch: grant.metadataAccessEpoch,
+        metadataAccessStateHash: grant.metadataAccessStateHash,
+        metadataDocumentId: grant.metadataDocumentId,
+        parentId: grant.parentId,
+        updatedAt: grant.updatedAt,
+    };
+}
+/**
+ * The groups a user belongs to is exactly the set naming them as a member.
+ *
+ * This used to be a breadth-first walk over group-in-group edges. Groups
+ * contain only users now, so the walk had no second level to visit.
+ */
+function reachableGroupIds(input) {
+    return new Set(input.edges
+        .filter((edge) => edge.userId === input.userId)
+        .map((edge) => edge.groupId));
+}
+export async function loadLocalOrganizationContainerGrants(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        return {
+            organizationId: input.organizationId,
+            grants: await enrichGrants(input.execSql, projection.grants.grants, input.organizationId),
+        };
+    });
+}
+export async function loadLocalOrganizationGroupContainers(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        const groupIsInOrganization = input.groupId === projection.groups.memberGroupId ||
+            projection.groups.groups.some((group) => group.groupId === input.groupId);
+        if (!groupIsInOrganization) {
+            return null;
+        }
+        const grants = projection.grants.grants.filter((grant) => grant.subjectType === "group" && grant.subjectId === input.groupId);
+        return {
+            organizationId: input.organizationId,
+            groupId: input.groupId,
+            containers: (await enrichGrants(input.execSql, grants, input.organizationId)).map(toGroupContainer),
+        };
+    });
+}
+export async function loadLocalOrganizationGroupPolicyHistory(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        const projectedHead = projection.policyHeads.find((head) => head.principalType === "group" && head.principalId === input.groupId);
+        if (!projectedHead) {
+            return null;
+        }
+        const bundle = await loadPrincipalPolicyBundle(input.execSql, "group", input.groupId);
+        return policyBundleMatchesProjectedHead(bundle, projectedHead)
+            ? buildOrganizationGroupPolicyHistory(bundle, input.organizationId)
+            : null;
+    });
+}
+function policyBundleMatchesProjectedHead(bundle, projectedHead) {
+    const storedHead = bundle?.currentState;
+    return Boolean(storedHead &&
+        storedHead.principalType === projectedHead.principalType &&
+        storedHead.principalId === projectedHead.principalId &&
+        storedHead.stateHash === projectedHead.stateHash &&
+        storedHead.version === projectedHead.version &&
+        storedHead.keyEpoch === projectedHead.keyEpoch &&
+        storedHead.keyFingerprint === projectedHead.keyFingerprint &&
+        storedHead.memberCount === projectedHead.memberCount);
+}
+export async function loadLocalOrganizationPolicyHistory(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        const projectedHead = projection.policyHeads.find((head) => head.principalType === "organization" &&
+            head.principalId === input.organizationId);
+        if (!projectedHead) {
+            return null;
+        }
+        const bundle = await loadPrincipalPolicyBundle(input.execSql, "organization", input.organizationId);
+        return policyBundleMatchesProjectedHead(bundle, projectedHead)
+            ? buildOrganizationPolicyHistory(bundle)
+            : null;
+    });
+}
+export async function loadLocalOrganizationPolicyReference(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        if (!projection?.requester) {
+            return null;
+        }
+        const head = projection.policyHeads.find((candidate) => candidate.principalType === input.principalType &&
+            candidate.principalId === input.principalId);
+        return head
+            ? {
+                principalType: head.principalType,
+                principalId: head.principalId,
+                stateHash: head.stateHash,
+                version: head.version,
+                keyEpoch: head.keyEpoch,
+                keyFingerprint: head.keyFingerprint,
+            }
+            : null;
+    });
+}
+export async function loadLocalOrganizationUserDetail(input) {
+    return runOrganizationPresentationRead({ ...input, requesterUserId: input.currentUserId }, "readModel", async () => {
+        const projection = await loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
+        const user = projection?.directory.users.find((candidate) => candidate.userId === input.userId);
+        if (!projection?.requester || !user) {
+            return null;
+        }
+        const reachable = reachableGroupIds({
+            edges: projection.membershipEdges,
+            userId: input.userId,
+        });
+        const groups = projection.groups.groups
+            .filter((group) => reachable.has(group.groupId))
+            .map((group) => ({ ...group, nameUnreadable: false }));
+        const relevantGrants = projection.grants.grants.filter((grant) => (grant.subjectType === "user" && grant.subjectId === input.userId) ||
+            (grant.subjectType === "group" && reachable.has(grant.subjectId)));
+        const grants = await enrichGrants(input.execSql, relevantGrants, input.organizationId);
+        return {
+            organizationId: input.organizationId,
+            user,
+            groups,
+            grants: {
+                directGrants: grants.filter((grant) => grant.subjectType === "user" && grant.subjectId === input.userId),
+                groupGrants: grants.filter((grant) => grant.subjectType === "group" && reachable.has(grant.subjectId)),
+            },
+        };
+    });
+}
+//# sourceMappingURL=localReadModelDetails.js.map

package/workflows/organizations/readModel/localReadModelDetails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localReadModelDetails.js","sourceRoot":"","sources":["localReadModelDetails.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,2DAA2D,CAAC;AAC3G,OAAO,EAAE,iCAAiC,EAAE,MAAM,0EAA0E,CAAC;AAC7H,OAAO,EAAE,mCAAmC,EAAE,MAAM,0EAA0E,CAAC;AAC/H,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AAErG,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AAUjD,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAUxF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,SAAS,kBAAkB,CACzB,MAAqD;IAErD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,MAAqD,EACrD,cAAsB;IAEtB,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,iCAAiC,CACxD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,kCAAkC,CACzD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,YAAY,CAAC,MAAM,EAC3B,KAAK,IAAI,uBAAuB,EAChC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAChD,OAAO,EACP,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAAC,CAC3D,CAAC;QACF,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,KAAK;QACR,oBAAoB,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI;QACjE,SAAS,EACP,KAAK,CAAC,WAAW,KAAK,OAAO;YAC3B,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAChC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC/B,IAAI,CAAC;YACP,CAAC,CAAC,IAAI;KACX,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAiC;IAEjC,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAM1B;IACC,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,KAAK;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,MAAM,YAAY,CACxB,KAAK,CAAC,OAAO,EACb,UAAU,CAAC,MAAM,CAAC,MAAM,EACxB,KAAK,CAAC,cAAc,CACrB;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,qBAAqB,GACzB,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;YACjD,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAC3C,CAAC;QACJ,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CACrE,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,CACV,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAChE,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CACvE,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,mCAAmC,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,MAA4C,EAC5C,aAQC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,YAAY,CAAC;IACxC,OAAO,OAAO,CACZ,UAAU;QACR,UAAU,CAAC,aAAa,KAAK,aAAa,CAAC,aAAa;QACxD,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW;QACpD,UAAU,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS;QAChD,UAAU,CAAC,OAAO,KAAK,aAAa,CAAC,OAAO;QAC5C,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ;QAC9C,UAAU,CAAC,cAAc,KAAK,aAAa,CAAC,cAAc;QAC1D,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW,CACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,cAAc;YACrC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAC5C,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAGC;IAED,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CACtC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC/C,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC9C,CAAC;QACF,OAAO,IAAI;YACT,CAAC,CAAC;gBACE,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAwD;IAExD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CACjD,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,eAAe;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC;YAClE,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACpE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI;YACJ,MAAM;YACN,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CACnE;gBACD,WAAW,EAAE,MAAM,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAClE;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  OrganizationContainerGrantResponse,\n  PrincipalPolicyBundleResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { loadContainerDisplayNamesByIds } from \"../../../data/persistence/containers/containerPersistence\";\nimport { loadOrganizationGroupDisplayNames } from \"../../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport { loadOrganizationReadModelProjection } from \"../../../data/persistence/organizations/organizationReadModelPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../../../data/persistence/principalPolicyPersistence\";\nimport { loadVerifiedOrganizationGroupRoles } from \"../../../data/principals/organizationGroupRoles\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationPolicyHistory,\n} from \"../policyHistory/policyHistoryReadModel\";\nimport type {\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupPolicyHistory,\n  OrganizationPolicyHistory,\n  OrganizationUserDetail,\n} from \"./index\";\nimport { runOrganizationPresentationRead } from \"./organizationPresentationAccessState\";\n\ninterface LocalReadModelInput {\n  readonly currentUserId: string;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n}\n\ntype PolicyPrincipalType = ReferencedPrincipalStateResponse[\"principalType\"];\n\nconst DISPLAY_NAME_BATCH_SIZE = 400;\n\nfunction uniqueContainerIds(\n  grants: readonly OrganizationContainerGrantResponse[],\n): string[] {\n  return [...new Set(grants.map((grant) => grant.containerId))];\n}\n\nasync function enrichGrants(\n  execSql: ExecSql,\n  grants: readonly OrganizationContainerGrantResponse[],\n  organizationId: string,\n): Promise<OrganizationContainerGrant[]> {\n  const containerIds = uniqueContainerIds(grants);\n  const groupNames = await loadOrganizationGroupDisplayNames(\n    execSql,\n    organizationId,\n  );\n  const groupRoles = await loadVerifiedOrganizationGroupRoles(\n    execSql,\n    organizationId,\n  );\n  const displayNames = new Map<string, string>();\n  for (\n    let index = 0;\n    index < containerIds.length;\n    index += DISPLAY_NAME_BATCH_SIZE\n  ) {\n    const batch = await loadContainerDisplayNamesByIds(\n      execSql,\n      containerIds.slice(index, index + DISPLAY_NAME_BATCH_SIZE),\n    );\n    for (const [containerId, displayName] of batch) {\n      displayNames.set(containerId, displayName);\n    }\n  }\n  return grants.map((grant) => ({\n    ...grant,\n    containerDisplayName: displayNames.get(grant.containerId) ?? null,\n    groupName:\n      grant.subjectType === \"group\"\n        ? (groupRoles.get(grant.subjectId) ??\n          groupNames.get(grant.subjectId) ??\n          null)\n        : null,\n  }));\n}\n\nfunction toGroupContainer(\n  grant: OrganizationContainerGrant,\n): OrganizationGroupContainer {\n  return {\n    accessLevel: grant.accessLevel,\n    containerId: grant.containerId,\n    containerDisplayName: grant.containerDisplayName,\n    createdAt: grant.createdAt,\n    depth: grant.depth,\n    isBuiltin: grant.isBuiltin,\n    metadataAccessEpoch: grant.metadataAccessEpoch,\n    metadataAccessStateHash: grant.metadataAccessStateHash,\n    metadataDocumentId: grant.metadataDocumentId,\n    parentId: grant.parentId,\n    updatedAt: grant.updatedAt,\n  };\n}\n\n/**\n * The groups a user belongs to is exactly the set naming them as a member.\n *\n * This used to be a breadth-first walk over group-in-group edges. Groups\n * contain only users now, so the walk had no second level to visit.\n */\nfunction reachableGroupIds(input: {\n  readonly edges: ReadonlyArray<{\n    readonly groupId: string;\n    readonly userId: string;\n  }>;\n  readonly userId: string;\n}): Set<string> {\n  return new Set(\n    input.edges\n      .filter((edge) => edge.userId === input.userId)\n      .map((edge) => edge.groupId),\n  );\n}\n\nexport async function loadLocalOrganizationContainerGrants(\n  input: LocalReadModelInput,\n): Promise<OrganizationContainerGrants | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      return {\n        organizationId: input.organizationId,\n        grants: await enrichGrants(\n          input.execSql,\n          projection.grants.grants,\n          input.organizationId,\n        ),\n      };\n    },\n  );\n}\n\nexport async function loadLocalOrganizationGroupContainers(\n  input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupContainers | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      const groupIsInOrganization =\n        input.groupId === projection.groups.memberGroupId ||\n        projection.groups.groups.some(\n          (group) => group.groupId === input.groupId,\n        );\n      if (!groupIsInOrganization) {\n        return null;\n      }\n      const grants = projection.grants.grants.filter(\n        (grant) =>\n          grant.subjectType === \"group\" && grant.subjectId === input.groupId,\n      );\n      return {\n        organizationId: input.organizationId,\n        groupId: input.groupId,\n        containers: (\n          await enrichGrants(input.execSql, grants, input.organizationId)\n        ).map(toGroupContainer),\n      };\n    },\n  );\n}\n\nexport async function loadLocalOrganizationGroupPolicyHistory(\n  input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupPolicyHistory | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n\n      const projectedHead = projection.policyHeads.find(\n        (head) =>\n          head.principalType === \"group\" && head.principalId === input.groupId,\n      );\n      if (!projectedHead) {\n        return null;\n      }\n\n      const bundle = await loadPrincipalPolicyBundle(\n        input.execSql,\n        \"group\",\n        input.groupId,\n      );\n      return policyBundleMatchesProjectedHead(bundle, projectedHead)\n        ? buildOrganizationGroupPolicyHistory(bundle, input.organizationId)\n        : null;\n    },\n  );\n}\n\nfunction policyBundleMatchesProjectedHead(\n  bundle: PrincipalPolicyBundleResponse | null,\n  projectedHead: {\n    readonly keyEpoch: number;\n    readonly keyFingerprint: string;\n    readonly memberCount: number;\n    readonly principalId: string;\n    readonly principalType: PolicyPrincipalType;\n    readonly stateHash: string;\n    readonly version: number;\n  },\n): bundle is PrincipalPolicyBundleResponse {\n  const storedHead = bundle?.currentState;\n  return Boolean(\n    storedHead &&\n      storedHead.principalType === projectedHead.principalType &&\n      storedHead.principalId === projectedHead.principalId &&\n      storedHead.stateHash === projectedHead.stateHash &&\n      storedHead.version === projectedHead.version &&\n      storedHead.keyEpoch === projectedHead.keyEpoch &&\n      storedHead.keyFingerprint === projectedHead.keyFingerprint &&\n      storedHead.memberCount === projectedHead.memberCount,\n  );\n}\n\nexport async function loadLocalOrganizationPolicyHistory(\n  input: LocalReadModelInput,\n): Promise<OrganizationPolicyHistory | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      const projectedHead = projection.policyHeads.find(\n        (head) =>\n          head.principalType === \"organization\" &&\n          head.principalId === input.organizationId,\n      );\n      if (!projectedHead) {\n        return null;\n      }\n      const bundle = await loadPrincipalPolicyBundle(\n        input.execSql,\n        \"organization\",\n        input.organizationId,\n      );\n      return policyBundleMatchesProjectedHead(bundle, projectedHead)\n        ? buildOrganizationPolicyHistory(bundle)\n        : null;\n    },\n  );\n}\n\nexport async function loadLocalOrganizationPolicyReference(\n  input: LocalReadModelInput & {\n    readonly principalId: string;\n    readonly principalType: PolicyPrincipalType;\n  },\n): Promise<ReferencedPrincipalStateResponse | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      if (!projection?.requester) {\n        return null;\n      }\n      const head = projection.policyHeads.find(\n        (candidate) =>\n          candidate.principalType === input.principalType &&\n          candidate.principalId === input.principalId,\n      );\n      return head\n        ? {\n            principalType: head.principalType,\n            principalId: head.principalId,\n            stateHash: head.stateHash,\n            version: head.version,\n            keyEpoch: head.keyEpoch,\n            keyFingerprint: head.keyFingerprint,\n          }\n        : null;\n    },\n  );\n}\n\nexport async function loadLocalOrganizationUserDetail(\n  input: LocalReadModelInput & { readonly userId: string },\n): Promise<OrganizationUserDetail | null> {\n  return runOrganizationPresentationRead(\n    { ...input, requesterUserId: input.currentUserId },\n    \"readModel\",\n    async () => {\n      const projection = await loadOrganizationReadModelProjection(\n        input.execSql,\n        input.organizationId,\n        input.currentUserId,\n      );\n      const user = projection?.directory.users.find(\n        (candidate) => candidate.userId === input.userId,\n      );\n      if (!projection?.requester || !user) {\n        return null;\n      }\n\n      const reachable = reachableGroupIds({\n        edges: projection.membershipEdges,\n        userId: input.userId,\n      });\n      const groups = projection.groups.groups\n        .filter((group) => reachable.has(group.groupId))\n        .map((group) => ({ ...group, nameUnreadable: false }));\n      const relevantGrants = projection.grants.grants.filter(\n        (grant) =>\n          (grant.subjectType === \"user\" && grant.subjectId === input.userId) ||\n          (grant.subjectType === \"group\" && reachable.has(grant.subjectId)),\n      );\n      const grants = await enrichGrants(\n        input.execSql,\n        relevantGrants,\n        input.organizationId,\n      );\n      return {\n        organizationId: input.organizationId,\n        user,\n        groups,\n        grants: {\n          directGrants: grants.filter(\n            (grant) =>\n              grant.subjectType === \"user\" && grant.subjectId === input.userId,\n          ),\n          groupGrants: grants.filter(\n            (grant) =>\n              grant.subjectType === \"group\" && reachable.has(grant.subjectId),\n          ),\n        },\n      };\n    },\n  );\n}\n"]}

package/workflows/organizations/readModel/organizationPresentationAccessState.js

@@ -0,0 +1,173 @@
+import { hasOrganizationPresentationDenial } from "../../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
+const accessByExecutor = new WeakMap();
+export function organizationAccessScopeKey(organizationId, requesterUserId) {
+    return JSON.stringify([organizationId, requesterUserId]);
+}
+function accessExecutorState(execSql) {
+    let state = accessByExecutor.get(execSql);
+    if (!state) {
+        state = {
+            generationByOrganization: new Map(),
+            resetDepthByOrganization: new Map(),
+            scopes: new Map(),
+        };
+        accessByExecutor.set(execSql, state);
+    }
+    return state;
+}
+function newProjectionState(denied) {
+    return { denied, deniedByServer: false, generation: 0 };
+}
+function organizationResetDepth(executor, organizationId) {
+    return executor.resetDepthByOrganization.get(organizationId) ?? 0;
+}
+function organizationGeneration(executor, organizationId) {
+    return executor.generationByOrganization.get(organizationId) ?? 0;
+}
+function accessScopeState(executor, organizationId, requesterUserId) {
+    const key = organizationAccessScopeKey(organizationId, requesterUserId);
+    let scope = executor.scopes.get(key);
+    if (!scope) {
+        const denied = organizationResetDepth(executor, organizationId) > 0;
+        scope = {
+            organizationId,
+            readModel: newProjectionState(denied),
+            usage: newProjectionState(denied),
+        };
+        executor.scopes.set(key, scope);
+    }
+    return scope;
+}
+function projectionState(scope, projection) {
+    return scope[projection];
+}
+export function captureOrganizationPresentationAccessAttempt(input, projection) {
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), projection);
+    return {
+        executorGeneration: organizationGeneration(executor, input.organizationId),
+        projection,
+        projectionGeneration: state.generation,
+        startedDenied: state.denied,
+        startedDuringReset: organizationResetDepth(executor, input.organizationId) > 0,
+    };
+}
+export function isOrganizationPresentationAccessAttemptCurrent(input, attempt) {
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), attempt.projection);
+    return (!attempt.startedDuringReset &&
+        organizationResetDepth(executor, input.organizationId) === 0 &&
+        organizationGeneration(executor, input.organizationId) ===
+            attempt.executorGeneration &&
+        state.generation === attempt.projectionGeneration);
+}
+export function isOrganizationPresentationAccessReadable(input, projection) {
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), projection);
+    return (organizationResetDepth(executor, input.organizationId) === 0 &&
+        !state.denied);
+}
+export function denyOrganizationPresentationAccess(input, projections) {
+    const executor = accessExecutorState(input.execSql);
+    const scope = accessScopeState(executor, input.organizationId, input.requesterUserId);
+    for (const projection of new Set(projections)) {
+        const state = projectionState(scope, projection);
+        state.denied = true;
+        state.deniedByServer = true;
+        state.generation += 1;
+    }
+}
+/**
+ * Whether the scope's projection is currently denied because the server
+ * refused it (as opposed to a local session reset). The flip back to readable
+ * after this returns true is the "org access was just restored" edge.
+ */
+export function wasOrganizationPresentationAccessDeniedByServer(input, projection) {
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), projection);
+    return state.denied && state.deniedByServer;
+}
+export function restoreOrganizationPresentationAccess(input, attempt) {
+    if (!isOrganizationPresentationAccessAttemptCurrent(input, attempt)) {
+        return false;
+    }
+    const executor = accessExecutorState(input.execSql);
+    const state = projectionState(accessScopeState(executor, input.organizationId, input.requesterUserId), attempt.projection);
+    state.denied = false;
+    state.deniedByServer = false;
+    return true;
+}
+export async function runOrganizationPresentationRead(input, projection, operation) {
+    const attempt = captureOrganizationPresentationAccessAttempt(input, projection);
+    if (!isOrganizationPresentationAccessReadable(input, projection)) {
+        return null;
+    }
+    // In-memory denial dies with the process. The durable marker keeps a
+    // revoked projection unreadable when its purge failed and the app
+    // restarted; a successful reconcile clears it.
+    if (await hasOrganizationPresentationDenial(input, projection)) {
+        return null;
+    }
+    const value = await operation();
+    return isOrganizationPresentationAccessAttemptCurrent(input, attempt) &&
+        isOrganizationPresentationAccessReadable(input, projection)
+        ? value
+        : null;
+}
+function beginOrganizationPresentationAccessReset(execSql, organizationId) {
+    const executor = accessExecutorState(execSql);
+    executor.generationByOrganization.set(organizationId, organizationGeneration(executor, organizationId) + 1);
+    executor.resetDepthByOrganization.set(organizationId, organizationResetDepth(executor, organizationId) + 1);
+    for (const scope of executor.scopes.values()) {
+        if (scope.organizationId !== organizationId)
+            continue;
+        // A reset denies presentation locally but is not a server denial: the next
+        // session re-derives server state, and startup sync already re-drives the
+        // lanes, so the lost-access memory must not survive into it.
+        scope.readModel.denied = true;
+        scope.readModel.deniedByServer = false;
+        scope.usage.denied = true;
+        scope.usage.deniedByServer = false;
+    }
+}
+function finishOrganizationPresentationAccessReset(execSql, organizationId) {
+    const executor = accessExecutorState(execSql);
+    const nextDepth = Math.max(0, organizationResetDepth(executor, organizationId) - 1);
+    if (nextDepth === 0) {
+        executor.resetDepthByOrganization.delete(organizationId);
+    }
+    else {
+        executor.resetDepthByOrganization.set(organizationId, nextDepth);
+    }
+}
+export async function runOrganizationPresentationMutation(execSql, operation) {
+    const executor = accessExecutorState(execSql);
+    const previous = executor.mutationQueue ?? Promise.resolve();
+    let releaseCurrent = () => { };
+    const current = new Promise((resolve) => {
+        releaseCurrent = resolve;
+    });
+    const waitForPrevious = previous.catch(() => undefined);
+    const queuedCurrent = waitForPrevious.then(() => current);
+    executor.mutationQueue = queuedCurrent;
+    await waitForPrevious;
+    try {
+        return await operation();
+    }
+    finally {
+        releaseCurrent();
+        if (executor.mutationQueue === queuedCurrent) {
+            executor.mutationQueue = undefined;
+        }
+    }
+}
+export async function runOrganizationPresentationReset(execSql, organizationId, operation) {
+    beginOrganizationPresentationAccessReset(execSql, organizationId);
+    try {
+        return await runOrganizationPresentationMutation(execSql, operation);
+    }
+    finally {
+        finishOrganizationPresentationAccessReset(execSql, organizationId);
+    }
+}
+//# sourceMappingURL=organizationPresentationAccessState.js.map

package/workflows/organizations/readModel/organizationPresentationAccessState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationPresentationAccessState.js","sourceRoot":"","sources":["organizationPresentationAccessState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,mFAAmF,CAAC;AA4CtI,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAgC,CAAC;AAErE,MAAM,UAAU,0BAA0B,CACxC,cAAsB,EACtB,eAAuB;IAEvB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG;YACN,wBAAwB,EAAE,IAAI,GAAG,EAAE;YACnC,wBAAwB,EAAE,IAAI,GAAG,EAAE;YACnC,MAAM,EAAE,IAAI,GAAG,EAAE;SAClB,CAAC;QACF,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IACzC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,cAAsB;IAEtB,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,cAAsB;IAEtB,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA6B,EAC7B,cAAsB,EACtB,eAAuB;IAEvB,MAAM,GAAG,GAAG,0BAA0B,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;QACpE,KAAK,GAAG;YACN,cAAc;YACd,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC;YACrC,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC;SAClC,CAAC;QACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CACtB,KAAuB,EACvB,UAA8C;IAE9C,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,KAA0C,EAC1C,UAA8C;IAE9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,UAAU,CACX,CAAC;IACF,OAAO;QACL,kBAAkB,EAAE,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC;QAC1E,UAAU;QACV,oBAAoB,EAAE,KAAK,CAAC,UAAU;QACtC,aAAa,EAAE,KAAK,CAAC,MAAM;QAC3B,kBAAkB,EAChB,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,KAA0C,EAC1C,OAA8C;IAE9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,OAAO,CACL,CAAC,OAAO,CAAC,kBAAkB;QAC3B,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;QAC5D,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC;YACpD,OAAO,CAAC,kBAAkB;QAC5B,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,KAA0C,EAC1C,UAA8C;IAE9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,UAAU,CACX,CAAC;IACF,OAAO,CACL,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;QAC5D,CAAC,KAAK,CAAC,MAAM,CACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAA0C,EAC1C,WAA0D;IAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,gBAAgB,CAC5B,QAAQ,EACR,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjD,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC5B,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+CAA+C,CAC7D,KAA0C,EAC1C,UAA8C;IAE9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,UAAU,CACX,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,KAA0C,EAC1C,OAA8C;IAE9C,IAAI,CAAC,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,EACvE,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA0C,EAC1C,UAA8C,EAC9C,SAA2B;IAE3B,MAAM,OAAO,GAAG,4CAA4C,CAC1D,KAAK,EACL,UAAU,CACX,CAAC;IACF,IAAI,CAAC,wCAAwC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,qEAAqE;IACrE,kEAAkE;IAClE,+CAA+C;IAC/C,IAAI,MAAM,iCAAiC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC;QACnE,wCAAwC,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,wCAAwC,CAC/C,OAAgB,EAChB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CACnC,cAAc,EACd,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CACrD,CAAC;IACF,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CACnC,cAAc,EACd,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CACrD,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc;YAAE,SAAS;QACtD,2EAA2E;QAC3E,0EAA0E;QAC1E,6DAA6D;QAC7D,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;QAC9B,KAAK,CAAC,SAAS,CAAC,cAAc,GAAG,KAAK,CAAC;QACvC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1B,KAAK,CAAC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAChD,OAAgB,EAChB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,CAAC,EACD,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CACrD,CAAC;IACF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,OAAgB,EAChB,SAA2B;IAE3B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7D,IAAI,cAAc,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1D,QAAQ,CAAC,aAAa,GAAG,aAAa,CAAC;IACvC,MAAM,eAAe,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;YAC7C,QAAQ,CAAC,aAAa,GAAG,SAAS,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAgB,EAChB,cAAsB,EACtB,SAA2B;IAE3B,wCAAwC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,mCAAmC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,yCAAyC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACrE,CAAC;AACH,CAAC","sourcesContent":["import { hasOrganizationPresentationDenial } from \"../../../data/persistence/organizations/organizationPresentationDenialPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\nexport type OrganizationPresentationProjection = \"readModel\" | \"usage\";\n\nexport interface OrganizationPresentationAccessInput {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly requesterUserId: string;\n}\n\ninterface ProjectionAccessState {\n  denied: boolean;\n  /**\n   * True only when the server itself denied the projection (a 403/404 read).\n   * A session reset also flips `denied`, but that is a local lifecycle event —\n   * consumers reacting specifically to lost-then-regained org access (e.g.\n   * re-arming write lanes) must not treat a routine reset as a denial.\n   */\n  deniedByServer: boolean;\n  generation: number;\n}\n\ninterface AccessScopeState {\n  readonly organizationId: string;\n  readonly readModel: ProjectionAccessState;\n  readonly usage: ProjectionAccessState;\n}\n\ninterface AccessExecutorState {\n  readonly generationByOrganization: Map<string, number>;\n  mutationQueue?: Promise<void> | undefined;\n  readonly resetDepthByOrganization: Map<string, number>;\n  readonly scopes: Map<string, AccessScopeState>;\n}\n\nexport interface OrganizationPresentationAccessAttempt {\n  readonly executorGeneration: number;\n  readonly projection: OrganizationPresentationProjection;\n  readonly projectionGeneration: number;\n  readonly startedDenied: boolean;\n  readonly startedDuringReset: boolean;\n}\n\nconst accessByExecutor = new WeakMap<ExecSql, AccessExecutorState>();\n\nexport function organizationAccessScopeKey(\n  organizationId: string,\n  requesterUserId: string,\n): string {\n  return JSON.stringify([organizationId, requesterUserId]);\n}\n\nfunction accessExecutorState(execSql: ExecSql): AccessExecutorState {\n  let state = accessByExecutor.get(execSql);\n  if (!state) {\n    state = {\n      generationByOrganization: new Map(),\n      resetDepthByOrganization: new Map(),\n      scopes: new Map(),\n    };\n    accessByExecutor.set(execSql, state);\n  }\n  return state;\n}\n\nfunction newProjectionState(denied: boolean): ProjectionAccessState {\n  return { denied, deniedByServer: false, generation: 0 };\n}\n\nfunction organizationResetDepth(\n  executor: AccessExecutorState,\n  organizationId: string,\n): number {\n  return executor.resetDepthByOrganization.get(organizationId) ?? 0;\n}\n\nfunction organizationGeneration(\n  executor: AccessExecutorState,\n  organizationId: string,\n): number {\n  return executor.generationByOrganization.get(organizationId) ?? 0;\n}\n\nfunction accessScopeState(\n  executor: AccessExecutorState,\n  organizationId: string,\n  requesterUserId: string,\n): AccessScopeState {\n  const key = organizationAccessScopeKey(organizationId, requesterUserId);\n  let scope = executor.scopes.get(key);\n  if (!scope) {\n    const denied = organizationResetDepth(executor, organizationId) > 0;\n    scope = {\n      organizationId,\n      readModel: newProjectionState(denied),\n      usage: newProjectionState(denied),\n    };\n    executor.scopes.set(key, scope);\n  }\n  return scope;\n}\n\nfunction projectionState(\n  scope: AccessScopeState,\n  projection: OrganizationPresentationProjection,\n): ProjectionAccessState {\n  return scope[projection];\n}\n\nexport function captureOrganizationPresentationAccessAttempt(\n  input: OrganizationPresentationAccessInput,\n  projection: OrganizationPresentationProjection,\n): OrganizationPresentationAccessAttempt {\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    projection,\n  );\n  return {\n    executorGeneration: organizationGeneration(executor, input.organizationId),\n    projection,\n    projectionGeneration: state.generation,\n    startedDenied: state.denied,\n    startedDuringReset:\n      organizationResetDepth(executor, input.organizationId) > 0,\n  };\n}\n\nexport function isOrganizationPresentationAccessAttemptCurrent(\n  input: OrganizationPresentationAccessInput,\n  attempt: OrganizationPresentationAccessAttempt,\n): boolean {\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    attempt.projection,\n  );\n  return (\n    !attempt.startedDuringReset &&\n    organizationResetDepth(executor, input.organizationId) === 0 &&\n    organizationGeneration(executor, input.organizationId) ===\n      attempt.executorGeneration &&\n    state.generation === attempt.projectionGeneration\n  );\n}\n\nexport function isOrganizationPresentationAccessReadable(\n  input: OrganizationPresentationAccessInput,\n  projection: OrganizationPresentationProjection,\n): boolean {\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    projection,\n  );\n  return (\n    organizationResetDepth(executor, input.organizationId) === 0 &&\n    !state.denied\n  );\n}\n\nexport function denyOrganizationPresentationAccess(\n  input: OrganizationPresentationAccessInput,\n  projections: readonly OrganizationPresentationProjection[],\n): void {\n  const executor = accessExecutorState(input.execSql);\n  const scope = accessScopeState(\n    executor,\n    input.organizationId,\n    input.requesterUserId,\n  );\n  for (const projection of new Set(projections)) {\n    const state = projectionState(scope, projection);\n    state.denied = true;\n    state.deniedByServer = true;\n    state.generation += 1;\n  }\n}\n\n/**\n * Whether the scope's projection is currently denied because the server\n * refused it (as opposed to a local session reset). The flip back to readable\n * after this returns true is the \"org access was just restored\" edge.\n */\nexport function wasOrganizationPresentationAccessDeniedByServer(\n  input: OrganizationPresentationAccessInput,\n  projection: OrganizationPresentationProjection,\n): boolean {\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    projection,\n  );\n  return state.denied && state.deniedByServer;\n}\n\nexport function restoreOrganizationPresentationAccess(\n  input: OrganizationPresentationAccessInput,\n  attempt: OrganizationPresentationAccessAttempt,\n): boolean {\n  if (!isOrganizationPresentationAccessAttemptCurrent(input, attempt)) {\n    return false;\n  }\n  const executor = accessExecutorState(input.execSql);\n  const state = projectionState(\n    accessScopeState(executor, input.organizationId, input.requesterUserId),\n    attempt.projection,\n  );\n  state.denied = false;\n  state.deniedByServer = false;\n  return true;\n}\n\nexport async function runOrganizationPresentationRead<T>(\n  input: OrganizationPresentationAccessInput,\n  projection: OrganizationPresentationProjection,\n  operation: () => Promise<T>,\n): Promise<T | null> {\n  const attempt = captureOrganizationPresentationAccessAttempt(\n    input,\n    projection,\n  );\n  if (!isOrganizationPresentationAccessReadable(input, projection)) {\n    return null;\n  }\n  // In-memory denial dies with the process. The durable marker keeps a\n  // revoked projection unreadable when its purge failed and the app\n  // restarted; a successful reconcile clears it.\n  if (await hasOrganizationPresentationDenial(input, projection)) {\n    return null;\n  }\n  const value = await operation();\n  return isOrganizationPresentationAccessAttemptCurrent(input, attempt) &&\n    isOrganizationPresentationAccessReadable(input, projection)\n    ? value\n    : null;\n}\n\nfunction beginOrganizationPresentationAccessReset(\n  execSql: ExecSql,\n  organizationId: string,\n): void {\n  const executor = accessExecutorState(execSql);\n  executor.generationByOrganization.set(\n    organizationId,\n    organizationGeneration(executor, organizationId) + 1,\n  );\n  executor.resetDepthByOrganization.set(\n    organizationId,\n    organizationResetDepth(executor, organizationId) + 1,\n  );\n  for (const scope of executor.scopes.values()) {\n    if (scope.organizationId !== organizationId) continue;\n    // A reset denies presentation locally but is not a server denial: the next\n    // session re-derives server state, and startup sync already re-drives the\n    // lanes, so the lost-access memory must not survive into it.\n    scope.readModel.denied = true;\n    scope.readModel.deniedByServer = false;\n    scope.usage.denied = true;\n    scope.usage.deniedByServer = false;\n  }\n}\n\nfunction finishOrganizationPresentationAccessReset(\n  execSql: ExecSql,\n  organizationId: string,\n): void {\n  const executor = accessExecutorState(execSql);\n  const nextDepth = Math.max(\n    0,\n    organizationResetDepth(executor, organizationId) - 1,\n  );\n  if (nextDepth === 0) {\n    executor.resetDepthByOrganization.delete(organizationId);\n  } else {\n    executor.resetDepthByOrganization.set(organizationId, nextDepth);\n  }\n}\n\nexport async function runOrganizationPresentationMutation<T>(\n  execSql: ExecSql,\n  operation: () => Promise<T>,\n): Promise<T> {\n  const executor = accessExecutorState(execSql);\n  const previous = executor.mutationQueue ?? Promise.resolve();\n  let releaseCurrent = () => {};\n  const current = new Promise<void>((resolve) => {\n    releaseCurrent = resolve;\n  });\n  const waitForPrevious = previous.catch(() => undefined);\n  const queuedCurrent = waitForPrevious.then(() => current);\n  executor.mutationQueue = queuedCurrent;\n  await waitForPrevious;\n\n  try {\n    return await operation();\n  } finally {\n    releaseCurrent();\n    if (executor.mutationQueue === queuedCurrent) {\n      executor.mutationQueue = undefined;\n    }\n  }\n}\n\nexport async function runOrganizationPresentationReset<T>(\n  execSql: ExecSql,\n  organizationId: string,\n  operation: () => Promise<T>,\n): Promise<T> {\n  beginOrganizationPresentationAccessReset(execSql, organizationId);\n  try {\n    return await runOrganizationPresentationMutation(execSql, operation);\n  } finally {\n    finishOrganizationPresentationAccessReset(execSql, organizationId);\n  }\n}\n"]}

package/workflows/organizations/readModel/organizationPresentationFailures.js

@@ -0,0 +1,7 @@
+import { ORGANIZATION_PRESENTATION_ERROR_CODES } from "../../../internal/validators/response/index.js";
+export function isOrganizationPresentationAccessDeniedFailure(failure) {
+    return (failure.kind === "http" &&
+        (failure.status === 403 || failure.status === 404) &&
+        failure.code === ORGANIZATION_PRESENTATION_ERROR_CODES.accessDenied);
+}
+//# sourceMappingURL=organizationPresentationFailures.js.map

package/workflows/organizations/readModel/readModelProjection.d.ts

@@ -0,0 +1,29 @@
+import type { RequestResult, RequestResultOptions } from "../../../internal/api-client/index.js";
+import { type OrganizationReadModelResponse } from "../../../internal/validators/response/index.js";
+import { type OrganizationReadModelGroupMembers } from "../../../data/persistence/organizations/organizationReadModelMemberLoad.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { OrganizationDirectoryAndGroups } from "./index.js";
+interface OrganizationReadModelApi {
+    getOrganizationReadModelResult(organizationId: string, cursor?: string, options?: RequestResultOptions): Promise<RequestResult<OrganizationReadModelResponse>>;
+}
+interface OrganizationReadModelProjectionInput {
+    readonly currentUserId: string;
+    readonly execSql: ExecSql;
+    readonly organizationId: string;
+}
+export interface ReconcileOrganizationDirectoryAndGroupsInput extends OrganizationReadModelProjectionInput {
+    readonly apiClient: OrganizationReadModelApi;
+    readonly logError?: ((message: string | Error, cause?: unknown) => void) | undefined;
+}
+export declare function loadLocalOrganizationDirectoryAndGroups(input: OrganizationReadModelProjectionInput): Promise<OrganizationDirectoryAndGroups | null>;
+export declare function loadLocalOrganizationGroupMembers(input: OrganizationReadModelProjectionInput & {
+    readonly groupId: string;
+}): Promise<OrganizationReadModelGroupMembers | null>;
+/**
+ * Resolves the reconciled projection, `null` when the pass completed
+ * authoritatively with nothing presentable (including a denial that purged
+ * the projection), or `undefined` when the feed failed and no local
+ * projection was retained — a pass that must not count as caught up.
+ */
+export declare function reconcileOrganizationDirectoryAndGroups(input: ReconcileOrganizationDirectoryAndGroupsInput): Promise<OrganizationDirectoryAndGroups | null | undefined>;
+export {};