npm - @tearleads/client-sdk - Versions diffs - 0.1.62 → 0.1.63 - Mend

@tearleads/client-sdk 0.1.62 → 0.1.63

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (653) hide show

package/workflows/organizations/principalPolicy/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAoBlE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,GAE/B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACL,8BAA8B,EAC9B,sCAAsC,EACtC,iCAAiC,EACjC,wCAAwC,GACzC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,4CAA4C,EAC5C,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,CAAC;AA8ChF,SAAS,+BAA+B,CACtC,eAAyC;IAEzC,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,GAAG,EAAE;QACV,eAAe,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,8BAA8B,CAC3C,KAA6C,EAC7C,YAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC;QACrD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,MAAM,0BAA0B,CAAC;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAA6C;IAE7C,MAAM,YAAY,GAAG,+BAA+B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,KAAK,CAAC,kBAAkB,EAAE,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,kBAAkB,GAAG,MAAM,8BAA8B,CAC7D,KAAK,EACL,YAAY,CACb,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,aAAa,CAAC,yBAAyB;QACvE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;QAC1B,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,MAAM,4CAA4C,CAAC;QACjD,eAAe,EAAE,mBAAmB;QACpC,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,wBAAwB;QAC3D,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB;QACtD,UAAU,EAAE,4BAA4B,CAAC;YACvC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,sBAAsB;YACtD,QAAQ,EAAE,YAAY;SACvB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY;QAC9C,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,kBAAkB;QAC1D,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc;KACnD,CAAC,CAAC;IACL,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,qBAAqB,EAAE,kBAAkB,EAAE,KAAK;QAChD,mBAAmB,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,IAAI,EAAE;QACxE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,wBAAwB;QAChE,mBAAmB;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;KACb,CAAC,CAAC;IACH,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,IAAI,kBAAkB,EAAE,WAAW,EAAE,CAAC;QACpC,MAAM,kBAAkB,CAAC,WAAW,CAClC,kBAAkB,CAAC,kBAAkB,EACrC,YAAY,CACb,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,KAAK,CAAC,4BAA4B,EAAE,EAAE,CAAC;IAC7C,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,MAAM,gBAAgB,CAAC;QACrB,2BAA2B,EAAE,kBAAkB,CAAC,sBAAsB;QACtE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE;YACrB,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY;KACb,CAAC,CAAC;IACH,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1B,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAyB9C;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,yBAAyB,CAC7B,aAAa,CAAC,aAAa,EAC3B,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE;YACP,GAAG,iBAAiB,CAAC,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC;YACnE,KAAK,CAAC,YAAY;SACnB;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CACrD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,CAAC,YAAY,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,GAAG,aAAa;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,UAAU,CAAC,MAAM,CAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CACrD;QACD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,UAAU;KACX,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;SAC3C,CAAC;QACJ,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAuBjD;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,yBAAyB,CAC7B,aAAa,CAAC,aAAa,EAC3B,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,iBAAiB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC;IACvC,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CACrE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CACzC,CAAC;IACF,IACE,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,6BAA6B,CAAC;QACzD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,UAAU,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC;QACtD,GAAG,aAAa;QAChB,cAAc;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;SAC3C,CAAC;QACJ,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAaxD;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,wCAAwC,CAAC;QAC7D,GAAG,aAAa;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAW/D;IACC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;QACvD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC;KAC1E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,sCAAsC,CAAC;QAC3D,GAAG,aAAa;QAChB,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa;QACb,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["export { createOrganizationGroup } from \"../groups/groupCreation\";\n\nimport type {\n PrincipalPolicyExternalAuthority,\n ReferencedPrincipalHead,\n SigningKeyPair,\n VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type {\n ContainerMutationRequest,\n PutPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerMutationResponse,\n PrincipalPolicyBundleResponse,\n PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport type { SecurityIncidentReporter } from \"../../../data/shared/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { assertGroupMembershipName } from \"../groupNames/groupMembershipName\";\nimport { prepareAuthoredGroupPolicy } from \"../groupPolicy/groupPolicyMutationAcknowledgement\";\nimport {\n cacheGroupPolicy,\n commitGroupPolicyMutation,\n loadGroupPolicyMutationContext,\n type PrincipalPolicyReadWriteApi,\n} from \"../groupPolicy/groupPolicyMutationContext\";\nimport { groupPolicyMutationHead } from \"../groupPolicy/groupPolicyMutationHead\";\nimport {\n buildAddGroupUserPolicyRequest,\n buildGroupAccessSetShrinkPolicyRequest,\n buildRemoveGroupUserPolicyRequest,\n buildSetGroupContainerGrantPolicyRequest,\n} from \"../groupPolicy/groupPolicyRequests\";\nimport {\n buildOrganizationGroupDirectoryPolicyRequest,\n replaceOrganizationGroupHead,\n} from \"../groups/organizationGroupDirectory\";\nimport {\n projectionUserIds,\n resolveRequiredUserIdentities,\n} from \"../trustedOrganizationUsers\";\nimport type { GroupPolicyNameReader } from \"./principalPolicyRequest\";\nimport {\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n} from \"./principalPolicyRequest\";\n\nexport { buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest };\n\ninterface PreparedGroupContainerMutations {\n readonly retiredContainerIds: readonly string[];\n readonly acknowledge: (\n responses: readonly ContainerMutationResponse[],\n stillCurrent?: (() => boolean) | undefined,\n ) => Promise<void>;\n /** Sign the descendant rekeys a refused commit named; see `carry` there. */\n readonly carry?:\n | ((\n requiredContainerIds: readonly string[],\n ) => Promise<readonly ContainerMutationRequest[]>)\n | undefined;\n readonly requests: readonly ContainerMutationRequest[];\n}\n\ntype PrepareGroupContainerMutations = (input: {\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly nextPolicy: VerifiedPrincipalPolicy;\n}) => Promise<\n readonly ContainerMutationRequest[] | PreparedGroupContainerMutations\n>;\n\ninterface CommitAndCacheGroupPolicyMutationInput {\n readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n readonly apiClient: PrincipalPolicyReadWriteApi;\n readonly assertCanCommit?: (() => void) | undefined;\n readonly beforePolicyCommit?:\n | ((head: ReferencedPrincipalHead) => void)\n | undefined;\n readonly currentPolicy: PrincipalPolicyBundleResponse;\n readonly execSql: ExecSql;\n readonly externalAuthority: PrincipalPolicyExternalAuthority | undefined;\n readonly groupId: string;\n readonly organizationId: string;\n readonly policyContext: Awaited<\n ReturnType<typeof loadGroupPolicyMutationContext>\n >;\n readonly prepareContainerMutations?:\n | PrepareGroupContainerMutations\n | undefined;\n readonly request: PutPrincipalPolicyRequest;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n}\n\nfunction createPolicyMutationCommitGuard(\n assertCanCommit: (() => void) | undefined,\n): (() => boolean) | undefined {\n if (!assertCanCommit) return undefined;\n return () => {\n assertCanCommit();\n return true;\n };\n}\n\n/**\n * Plan the container mutations the policy change rematerializes and place their\n * requests on the policy request. A bare request list has nothing to\n * acknowledge or carry; a prepared batch does both.\n */\nasync function prepareGroupContainerMutations(\n input: CommitAndCacheGroupPolicyMutationInput,\n expectedHead: ReferencedPrincipalHead,\n): Promise<Partial<PreparedGroupContainerMutations> | null> {\n if (!input.prepareContainerMutations) return null;\n const prepared = await input.prepareContainerMutations({\n currentPolicy: input.currentPolicy,\n nextPolicy: await prepareAuthoredGroupPolicy({\n currentPolicy: input.currentPolicy,\n expectedHead,\n request: input.request,\n }),\n });\n if (\"requests\" in prepared) {\n input.request.containerMutations = [...prepared.requests];\n return prepared;\n }\n input.request.containerMutations = [...prepared];\n return {};\n}\n\nasync function commitAndCacheGroupPolicyMutation(\n input: CommitAndCacheGroupPolicyMutationInput,\n): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n const stillCurrent = createPolicyMutationCommitGuard(input.assertCanCommit);\n const expectedHead = await groupPolicyMutationHead(input.request);\n input.beforePolicyCommit?.(expectedHead);\n const containerMutations = await prepareGroupContainerMutations(\n input,\n expectedHead,\n );\n const nextAdminProjection = input.policyContext.isOrganizationAdminsGroup\n ? input.request.projection\n : input.policyContext.adminPolicyBundle.currentProjection;\n const adminUsers = await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(nextAdminProjection),\n });\n const organizationRequest =\n await buildOrganizationGroupDirectoryPolicyRequest({\n adminProjection: nextAdminProjection,\n adminUsers,\n currentPolicy: input.policyContext.organizationPolicyBundle,\n descriptor: input.policyContext.organizationDescriptor,\n groupHeads: replaceOrganizationGroupHead({\n descriptor: input.policyContext.organizationDescriptor,\n nextHead: expectedHead,\n }),\n signerUserId: input.policyContext.signerUserId,\n signingFingerprint: input.policyContext.signingFingerprint,\n signingKeyPair: input.policyContext.signingKeyPair,\n });\n input.assertCanCommit?.();\n const acknowledgedBundle = await commitGroupPolicyMutation({\n apiClient: input.apiClient,\n carryDescendantRekeys: containerMutations?.carry,\n retiredContainerIds: () => containerMutations?.retiredContainerIds ?? [],\n currentPolicy: input.currentPolicy,\n execSql: input.execSql,\n expectedHead,\n groupId: input.groupId,\n organizationId: input.organizationId,\n organizationPolicy: input.policyContext.organizationPolicyBundle,\n organizationRequest,\n request: input.request,\n stillCurrent,\n });\n input.assertCanCommit?.();\n if (containerMutations?.acknowledge) {\n await containerMutations.acknowledge(\n acknowledgedBundle.containerMutations,\n stillCurrent,\n );\n }\n input.assertCanCommit?.();\n await input.afterPolicyCommitBeforeCache?.();\n input.assertCanCommit?.();\n await cacheGroupPolicy({\n acknowledgedMemberEnvelopes: acknowledgedBundle.currentMemberEnvelopes,\n apiClient: input.apiClient,\n execSql: input.execSql,\n expectedCurrentHead: expectedHead,\n externalAuthority: input.externalAuthority,\n groupId: input.groupId,\n localPolicyCheckpoint: {\n principalId: expectedHead.principalId,\n principalType: expectedHead.principalType,\n stateHash: expectedHead.stateHash,\n version: expectedHead.version,\n },\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n stillCurrent,\n });\n input.assertCanCommit?.();\n return acknowledgedBundle;\n}\n\nexport async function addOrganizationGroupUser(input: {\n readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n readonly apiClient: PrincipalPolicyReadWriteApi;\n readonly currentUserSecretKey: Uint8Array;\n readonly execSql: ExecSql;\n readonly expectedGroupName: string;\n readonly readEncryptedName?: GroupPolicyNameReader;\n readonly groupId: string;\n readonly organizationId: string;\n readonly reportSecurityIncident?: SecurityIncidentReporter | undefined;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly targetUserId: string;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly beforePolicyCommit: (\n head: ReferencedPrincipalHead,\n authority: {\n readonly adminGroupId: string;\n readonly memberGroupId: string;\n },\n ) => void;\n readonly prepareContainerMutations?:\n | PrepareGroupContainerMutations\n | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n const policyContext = await loadGroupPolicyMutationContext(input);\n await assertGroupMembershipName(\n policyContext.currentPolicy,\n input.expectedGroupName,\n input.readEncryptedName,\n );\n const identities = await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: [\n ...projectionUserIds(policyContext.currentPolicy.currentProjection),\n input.targetUserId,\n ],\n });\n const targetUser = identities.find(\n (identity) => identity.userId === input.targetUserId,\n );\n if (!targetUser) {\n throw new Error(\n `User identity could not be loaded for ${input.targetUserId}`,\n );\n }\n const request = await buildAddGroupUserPolicyRequest({\n ...policyContext,\n currentUserSecretKey: input.currentUserSecretKey,\n currentUsers: identities.filter(\n (identity) => identity.userId !== input.targetUserId,\n ),\n reportSecurityIncident: input.reportSecurityIncident,\n targetUser,\n });\n return commitAndCacheGroupPolicyMutation({\n afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,\n apiClient: input.apiClient,\n beforePolicyCommit: (head) =>\n input.beforePolicyCommit(head, {\n adminGroupId: policyContext.adminGroupId,\n memberGroupId: policyContext.memberGroupId,\n }),\n currentPolicy: policyContext.currentPolicy,\n execSql: input.execSql,\n externalAuthority: policyContext.externalAuthority,\n groupId: input.groupId,\n prepareContainerMutations: input.prepareContainerMutations,\n request,\n organizationId: input.organizationId,\n policyContext,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n}\n\nexport async function removeOrganizationGroupUser(input: {\n readonly afterPolicyCommitBeforeCache?: (() => Promise<void>) | undefined;\n readonly apiClient: PrincipalPolicyReadWriteApi;\n readonly execSql: ExecSql;\n readonly expectedGroupName: string;\n readonly readEncryptedName?: GroupPolicyNameReader;\n readonly groupId: string;\n readonly organizationId: string;\n readonly removedUserId: string;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n readonly beforePolicyCommit: (\n head: ReferencedPrincipalHead,\n authority: {\n readonly adminGroupId: string;\n readonly memberGroupId: string;\n },\n ) => void;\n readonly prepareContainerMutations?:\n | PrepareGroupContainerMutations\n | undefined;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n const policyContext = await loadGroupPolicyMutationContext(input);\n await assertGroupMembershipName(\n policyContext.currentPolicy,\n input.expectedGroupName,\n input.readEncryptedName,\n );\n const removedKey = input.removedUserId;\n const projection = policyContext.currentPolicy.currentProjection.filter(\n (member) => member.userId !== removedKey,\n );\n if (\n projection.length === policyContext.currentPolicy.currentProjection.length\n ) {\n throw new Error(\"User is not a group member\");\n }\n const remainingUsers = await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(projection),\n });\n const request = await buildRemoveGroupUserPolicyRequest({\n ...policyContext,\n remainingUsers,\n removedUserId: input.removedUserId,\n });\n return commitAndCacheGroupPolicyMutation({\n afterPolicyCommitBeforeCache: input.afterPolicyCommitBeforeCache,\n apiClient: input.apiClient,\n beforePolicyCommit: (head) =>\n input.beforePolicyCommit(head, {\n adminGroupId: policyContext.adminGroupId,\n memberGroupId: policyContext.memberGroupId,\n }),\n currentPolicy: policyContext.currentPolicy,\n execSql: input.execSql,\n externalAuthority: policyContext.externalAuthority,\n groupId: input.groupId,\n prepareContainerMutations: input.prepareContainerMutations,\n request,\n organizationId: input.organizationId,\n policyContext,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n}\n\n/**\n * Adds or changes one container in the group's signed complete grant set and\n * commits every resulting container rematerialization in the same request.\n */\nexport async function setOrganizationGroupContainerGrant(input: {\n readonly accessLevel: \"admin\" | \"read\" | \"write\";\n readonly apiClient: PrincipalPolicyReadWriteApi;\n readonly assertCanCommit?: (() => void) | undefined;\n readonly containerId: string;\n readonly execSql: ExecSql;\n readonly groupId: string;\n readonly organizationId: string;\n readonly prepareContainerMutations: PrepareGroupContainerMutations;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n const policyContext = await loadGroupPolicyMutationContext({\n apiClient: input.apiClient,\n execSql: input.execSql,\n groupId: input.groupId,\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n const request = await buildSetGroupContainerGrantPolicyRequest({\n ...policyContext,\n accessLevel: input.accessLevel,\n containerId: input.containerId,\n });\n return commitAndCacheGroupPolicyMutation({\n apiClient: input.apiClient,\n assertCanCommit: input.assertCanCommit,\n currentPolicy: policyContext.currentPolicy,\n execSql: input.execSql,\n externalAuthority: policyContext.externalAuthority,\n groupId: input.groupId,\n prepareContainerMutations: input.prepareContainerMutations,\n request,\n organizationId: input.organizationId,\n policyContext,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n}\n\n/**\n * A group losing a container grant rotates its own key in the same request as\n * that container revoke and the rekeys of all remaining grants. This prevents\n * a later member from using the group's still-current key to open a retained\n * wrap from before the revoke.\n */\nexport async function rotateOrganizationGroupForAccessSetShrink(input: {\n readonly apiClient: PrincipalPolicyReadWriteApi;\n readonly execSql: ExecSql;\n readonly groupId: string;\n readonly organizationId: string;\n readonly revokedContainerId: string;\n readonly prepareContainerMutations: PrepareGroupContainerMutations;\n readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n readonly signerUserId: string;\n readonly signingFingerprint: string;\n readonly signingKeyPair: SigningKeyPair;\n}): Promise<PrincipalPolicyBundleResponse & PrincipalPolicyMutationResponse> {\n const policyContext = await loadGroupPolicyMutationContext({\n apiClient: input.apiClient,\n execSql: input.execSql,\n groupId: input.groupId,\n organizationId: input.organizationId,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n signerUserId: input.signerUserId,\n signingFingerprint: input.signingFingerprint,\n signingKeyPair: input.signingKeyPair,\n });\n const currentUsers = await resolveRequiredUserIdentities({\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n userIds: projectionUserIds(policyContext.currentPolicy.currentProjection),\n });\n const request = await buildGroupAccessSetShrinkPolicyRequest({\n ...policyContext,\n currentUsers,\n revokedContainerId: input.revokedContainerId,\n });\n return commitAndCacheGroupPolicyMutation({\n apiClient: input.apiClient,\n currentPolicy: policyContext.currentPolicy,\n execSql: input.execSql,\n externalAuthority: policyContext.externalAuthority,\n groupId: input.groupId,\n prepareContainerMutations: input.prepareContainerMutations,\n request,\n organizationId: input.organizationId,\n policyContext,\n resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n });\n}\n"]}

package/workflows/organizations/{principalPolicyApi.d.ts → principalPolicy/principalPolicyApi.d.ts} RENAMED Viewed

@@ -1,7 +1,7 @@
-import type { RequestFailureKind } from "../../internal/api-client/index.js";
-import type { CommitOrganizationGroupPolicyRequest, CreateOrganizationGroupWithPolicyRequest } from "../../internal/validators/request/index.js";
-import type { CommitOrganizationGroupPolicyResponse, CreateOrganizationGroupResponse } from "../../internal/validators/response/index.js";
-import type { CurrentPrincipalPolicyReader } from "../principals/currentPrincipalPolicyReader.js";
+import type { RequestFailureKind } from "../../../internal/api-client/index.js";
+import type { CommitOrganizationGroupPolicyRequest, CreateOrganizationGroupWithPolicyRequest } from "../../../internal/validators/request/index.js";
+import type { CommitOrganizationGroupPolicyResponse, CreateOrganizationGroupResponse } from "../../../internal/validators/response/index.js";
+import type { CurrentPrincipalPolicyReader } from "../../principals/currentPrincipalPolicyReader.js";
 export interface PrincipalPolicyReadApi extends CurrentPrincipalPolicyReader {
     /** Resolve authored work before reading the state for a new mutation. */
     readonly recoverPendingPrincipalMutation?: ((organizationId: string) => Promise<void>) | undefined;

package/workflows/organizations/principalPolicy/principalPolicyApi.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalPolicyApi.js","sourceRoot":"","sources":["principalPolicyApi.ts"],"names":[],"mappings":"","sourcesContent":["import type { RequestFailureKind } from \"@tearleads/api-client\";\nimport type {\n CommitOrganizationGroupPolicyRequest,\n CreateOrganizationGroupWithPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n CommitOrganizationGroupPolicyResponse,\n CreateOrganizationGroupResponse,\n} from \"@tearleads/validators/response\";\nimport type { CurrentPrincipalPolicyReader } from \"../../principals/currentPrincipalPolicyReader\";\n\nexport interface PrincipalPolicyReadApi extends CurrentPrincipalPolicyReader {\n /** Resolve authored work before reading the state for a new mutation. */\n readonly recoverPendingPrincipalMutation?:\n | ((organizationId: string) => Promise<void>)\n | undefined;\n}\n\nexport interface PrincipalPolicyReadWriteApi extends PrincipalPolicyReadApi {\n commitOrganizationGroupPolicy: (\n organizationId: string,\n groupId: string,\n input: CommitOrganizationGroupPolicyRequest,\n ) => Promise<CommitOrganizationGroupPolicyResponse | null>;\n /**\n * Optional status-bearing variant. A rematerialized rotation the server\n * refuses for stranding a granted path names the descendant rekeys the batch\n * must carry; without this the refusal is a plain failure.\n */\n commitOrganizationGroupPolicyResult?: (\n organizationId: string,\n groupId: string,\n input: CommitOrganizationGroupPolicyRequest,\n options?: { readonly reportErrors?: boolean | undefined },\n ) => Promise<\n | {\n readonly ok: true;\n readonly data: CommitOrganizationGroupPolicyResponse;\n }\n | {\n readonly ok: false;\n readonly kind?: RequestFailureKind | undefined;\n readonly message?: string | undefined;\n readonly code?: string | undefined;\n readonly report?: (() => void) | undefined;\n readonly requiredContainerIds?: readonly string[] | undefined;\n readonly status: number | null;\n }\n >;\n}\n\nexport interface OrganizationPrincipalPolicyApi extends PrincipalPolicyReadApi {\n createOrganizationGroup: (\n organizationId: string,\n input: CreateOrganizationGroupWithPolicyRequest,\n ) => Promise<CreateOrganizationGroupResponse | null>;\n}\n"]}

package/workflows/organizations/{principalPolicyReceiptArtifacts.js → principalPolicy/principalPolicyReceiptArtifacts.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { compareCanonicalStrings, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../internal/crypto/index.js";
-import { canonicalKeyingJsonString } from "../../data/keying/canonicalJson.js";
+import { compareCanonicalStrings, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, } from "../../../internal/crypto/index.js";
+import { canonicalKeyingJsonString } from "../../../data/keying/canonicalJson.js";
 function sortedCanonicalValues(values, label) {
     return [...values].sort((left, right) => compareCanonicalStrings(canonicalKeyingJsonString(left, label), canonicalKeyingJsonString(right, label)));
 }

package/workflows/organizations/principalPolicy/principalPolicyReceiptArtifacts.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalPolicyReceiptArtifacts.js","sourceRoot":"","sources":["principalPolicyReceiptArtifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,mCAAmC,GAEpC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,SAAS,qBAAqB,CAAI,MAAoB,EAAE,KAAa;IACnE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtC,uBAAuB,CACrB,yBAAyB,CAAC,IAAI,EAAE,KAAK,CAAC,EACtC,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CACxC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,QAAiD,EACjD,QAAiD;IAEjD,MAAM,UAAU,GAAG,CAAC,KAA8C,EAAE,EAAE,CAAC,CAAC;QACtE,GAAG,KAAK;QACR,SAAS,EAAE,qBAAqB,CAC9B,KAAK,CAAC,SAAS,EACf,2BAA2B,CAC5B;KACF,CAAC,CAAC;IACH,IACE,yBAAyB,CACvB,UAAU,CAAC,QAAQ,CAAC,EACpB,qCAAqC,CACtC;QACD,yBAAyB,CACvB,UAAU,CAAC,QAAQ,CAAC,EACpB,iCAAiC,CAClC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,uCAAuC,CAAC,KAKhD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,CAAC;SACvE,CAAC;QACF,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI;YACxC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK;YAC1C,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ;YACxC,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,QAAQ;YAC1C,KAAK,EAAE,qBAAqB,CAC1B,QAAQ,CAAC,YAAY,CAAC,KAAK,EAC3B,uBAAuB,CACxB;SACF,CAAC;QACF,IACE,yBAAyB,CACvB,QAAQ,EACR,wCAAwC,CACzC;YACD,yBAAyB,CACvB,QAAQ,EACR,0CAA0C,CAC3C,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qCAAqC,CAAC,KAIrD;IACC,uCAAuC,CAAC;QACtC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE;QAChD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,eAAe,EAAE,GACxD,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,MAAM,eAAe,GAAG;QACtB,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa;QAChD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB;KAClC,CAAC;IAEF,IACE,yBAAyB,CACvB,eAAe,EACf,6BAA6B,CAC9B;QACC,yBAAyB,CACvB,eAAe,EACf,+BAA+B,CAChC;QACH,yBAAyB,CACvB,mCAAmC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EACrE,gCAAgC,CACjC;YACC,yBAAyB,CACvB,mCAAmC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAC7D,kCAAkC,CACnC;QACH,yBAAyB,CACvB,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC/D,4BAA4B,CAC7B;YACC,yBAAyB,CACvB,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACvD,8BAA8B,CAC/B,EACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,8CAA8C,CAC5C;QACE,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa;QAChD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC5C,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QACvC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ;QACnC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;KACzC,EACD,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CACtC,CAAC;AACJ,CAAC","sourcesContent":["import {\n compareCanonicalStrings,\n normalizePrincipalContainerGrants,\n normalizePrincipalProjectionMembers,\n type ReferencedPrincipalHead,\n} from \"@tearleads/crypto\";\nimport type { PutPrincipalPolicyRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerMutationResponse,\n CurrentPrincipalMemberEnvelopesResponse,\n PrincipalPolicyMutationResponse,\n} from \"@tearleads/validators/response\";\nimport { canonicalKeyingJsonString } from \"../../../data/keying/canonicalJson\";\n\nfunction sortedCanonicalValues<T>(values: readonly T[], label: string): T[] {\n return [...values].sort((left, right) =>\n compareCanonicalStrings(\n canonicalKeyingJsonString(left, label),\n canonicalKeyingJsonString(right, label),\n ),\n );\n}\n\nexport function assertGroupPolicyEnvelopesMatchAcknowledgement(\n expected: CurrentPrincipalMemberEnvelopesResponse,\n observed: CurrentPrincipalMemberEnvelopesResponse,\n): void {\n const normalized = (value: CurrentPrincipalMemberEnvelopesResponse) => ({\n ...value,\n envelopes: sortedCanonicalValues(\n value.envelopes,\n \"principal member envelope\",\n ),\n });\n if (\n canonicalKeyingJsonString(\n normalized(expected),\n \"acknowledged group member envelopes\",\n ) !==\n canonicalKeyingJsonString(\n normalized(observed),\n \"observed group member envelopes\",\n )\n ) {\n throw new Error(\"Group member envelopes changed after acknowledgement\");\n }\n}\n\nfunction assertContainerMutationAcknowledgements(input: {\n readonly requests: readonly NonNullable<\n PutPrincipalPolicyRequest[\"containerMutations\"]\n >[number][];\n readonly responses: readonly ContainerMutationResponse[] | undefined;\n}): void {\n if (!input.responses || input.responses.length !== input.requests.length) {\n throw new Error(\n \"Group policy container acknowledgement batch is incomplete\",\n );\n }\n for (const [index, request] of input.requests.entries()) {\n const response = input.responses[index];\n if (!response) {\n throw new Error(\n \"Group policy container acknowledgement batch is incomplete\",\n );\n }\n const expected = {\n body: request.body,\n event: request.event,\n keyEpoch: request.keyEpoch,\n manifest: request.manifest,\n wraps: sortedCanonicalValues(request.wraps, \"authored container wrap\"),\n };\n const observed = {\n body: response.accessManifest.event.body,\n event: response.accessManifest.event.event,\n keyEpoch: response.containerKek.keyEpoch,\n manifest: response.accessManifest.manifest,\n wraps: sortedCanonicalValues(\n response.containerKek.wraps,\n \"stored container wrap\",\n ),\n };\n if (\n canonicalKeyingJsonString(\n observed,\n \"stored group policy container mutation\",\n ) !==\n canonicalKeyingJsonString(\n expected,\n \"authored group policy container mutation\",\n )\n ) {\n throw new Error(\"Group policy container acknowledgement mismatch\");\n }\n }\n}\n\n/** Compare receipt artifacts without manufacturing predecessor history or pins. */\nexport function assertPrincipalPolicyReceiptArtifacts(input: {\n readonly expectedHead: ReferencedPrincipalHead;\n readonly request: PutPrincipalPolicyRequest;\n readonly response: PrincipalPolicyMutationResponse;\n}): void {\n assertContainerMutationAcknowledgements({\n requests: input.request.containerMutations ?? [],\n responses: input.response.containerMutations,\n });\n const { createdAt: _payloadCreatedAt, ...observedPayload } =\n input.response.currentPayload;\n const expectedPayload = {\n principalType: input.request.state.principalType,\n principalId: input.request.state.principalId,\n stateHash: input.expectedHead.stateHash,\n ...input.request.encryptedPayload,\n };\n\n if (\n canonicalKeyingJsonString(\n observedPayload,\n \"stored group policy payload\",\n ) !==\n canonicalKeyingJsonString(\n expectedPayload,\n \"authored group policy payload\",\n ) ||\n canonicalKeyingJsonString(\n normalizePrincipalProjectionMembers(input.response.currentProjection),\n \"stored group policy projection\",\n ) !==\n canonicalKeyingJsonString(\n normalizePrincipalProjectionMembers(input.request.projection),\n \"authored group policy projection\",\n ) ||\n canonicalKeyingJsonString(\n normalizePrincipalContainerGrants(input.response.currentGrants),\n \"stored group policy grants\",\n ) !==\n canonicalKeyingJsonString(\n normalizePrincipalContainerGrants(input.request.grants),\n \"authored group policy grants\",\n )\n ) {\n throw new Error(\"Group policy bundle acknowledgement mismatch\");\n }\n\n assertGroupPolicyEnvelopesMatchAcknowledgement(\n {\n principalType: input.request.state.principalType,\n principalId: input.request.state.principalId,\n stateHash: input.expectedHead.stateHash,\n epoch: input.request.state.keyEpoch,\n envelopes: input.request.memberEnvelopes,\n },\n input.response.currentMemberEnvelopes,\n );\n}\n"]}

package/workflows/organizations/{principalPolicyRecipients.js → principalPolicy/principalPolicyRecipients.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { wrapDekForRecipients } from "../../internal/crypto/index.js";
-import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+import { wrapDekForRecipients } from "../../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../../internal/encoding/index.js";
 function toPrincipalMemberEnvelopeRequest(input) {
     return {
         userId: input.userId,

package/workflows/organizations/principalPolicy/principalPolicyRecipients.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalPolicyRecipients.js","sourceRoot":"","sources":["principalPolicyRecipients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAanE,SAAS,gCAAgC,CAAC,KAOzC;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QACnD,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC1D,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,SAAyD;IAEzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClC,cAAc,EAAE,QAAQ,CAAC,oBAAoB;QAC7C,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,SAAS,uBAAuB,CAAC,KAGhC;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1E,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO;YACL,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAClD,KAAK,CAAC,SAAS,EACf,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAChE,CAAC;IAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAC/C,gCAAgC,CAAC;QAC/B,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,EAAE;KACxC,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { wrapDekForRecipients } from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport type {\n PrincipalMemberEnvelopeRequest,\n PrincipalProjectionMemberRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalMemberEnvelopeResponse } from \"@tearleads/validators/response\";\nimport type { TrustedUserIdentity } from \"../../../data/trustedUserIdentity\";\n\ntype PrincipalRekeyRecipient = {\n readonly encapsulationPublicKey: Uint8Array;\n readonly userId: string;\n};\n\nfunction toPrincipalMemberEnvelopeRequest(input: {\n readonly envelope: {\n readonly keyFingerprint: string;\n readonly kemCipherText: Uint8Array;\n readonly wrappedKey: Uint8Array;\n };\n readonly userId: string;\n}): PrincipalMemberEnvelopeRequest {\n return {\n userId: input.userId,\n memberKeyFingerprint: input.envelope.keyFingerprint,\n kemCipherText: bytesToBase64(input.envelope.kemCipherText),\n wrappedKey: bytesToBase64(input.envelope.wrappedKey),\n };\n}\n\nexport function toRecipientEntries(\n envelopes: ReadonlyArray<PrincipalMemberEnvelopeResponse>,\n) {\n return envelopes.map((envelope) => ({\n keyFingerprint: envelope.memberKeyFingerprint,\n kemCipherText: base64ToBytes(envelope.kemCipherText),\n wrappedKey: base64ToBytes(envelope.wrappedKey),\n }));\n}\n\n/** Every projected member is a user, so there is no group recipient branch. */\nfunction toRekeyRecipientEntries(input: {\n readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;\n readonly users: ReadonlyArray<TrustedUserIdentity>;\n}): PrincipalRekeyRecipient[] {\n const usersById = new Map(input.users.map((user) => [user.userId, user]));\n\n return input.projection.map((member) => {\n const user = usersById.get(member.userId);\n if (!user) {\n throw new Error(`Missing recipient key for user ${member.userId}`);\n }\n\n return {\n encapsulationPublicKey: user.encapsulationPublicKey,\n userId: user.userId,\n };\n });\n}\n\nexport async function rewrapProjectionMemberEnvelopes(input: {\n readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;\n readonly secretKey: Uint8Array;\n readonly users: ReadonlyArray<TrustedUserIdentity>;\n}): Promise<PrincipalMemberEnvelopeRequest[]> {\n const recipients = toRekeyRecipientEntries(input);\n if (recipients.length === 0) {\n return [];\n }\n const wrappedRecipients = await wrapDekForRecipients(\n input.secretKey,\n recipients.map((recipient) => recipient.encapsulationPublicKey),\n );\n\n return wrappedRecipients.map((envelope, index) =>\n toPrincipalMemberEnvelopeRequest({\n envelope,\n userId: recipients[index]?.userId ?? \"\",\n }),\n );\n}\n"]}

package/workflows/organizations/{principalPolicyRequest.d.ts → principalPolicy/principalPolicyRequest.d.ts} RENAMED Viewed

@@ -1,6 +1,6 @@
-import { type EncapsulationKeyPair, type GroupMetadataKey, type PrincipalContainerGrant, type PrincipalPolicyExternalAuthority, type SigningKeyPair } from "../../internal/crypto/index.js";
-import type { CreateOrganizationGroupRequest, PrincipalMemberEnvelopeRequest, PrincipalProjectionMemberRequest, PutPrincipalPolicyRequest } from "../../internal/validators/request/index.js";
-import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
+import { type EncapsulationKeyPair, type GroupMetadataKey, type PrincipalContainerGrant, type PrincipalPolicyExternalAuthority, type SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { CreateOrganizationGroupRequest, PrincipalMemberEnvelopeRequest, PrincipalProjectionMemberRequest, PutPrincipalPolicyRequest } from "../../../internal/validators/request/index.js";
+import type { PrincipalPolicyBundleResponse } from "../../../internal/validators/response/index.js";
 interface BuildInitialGroupPolicyInput {
     readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;
     readonly externalAuthority?: PrincipalPolicyExternalAuthority["currentHead"] | null;

package/workflows/organizations/{principalPolicyRequest.js → principalPolicy/principalPolicyRequest.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { buildPrincipalStateSigningInput, encodeBuiltinGroupMetadata, encryptGroupMetadata, generateKemSeedAndKeyPair, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, readGroupMetadata, signPrincipalState, toFingerprint, wrapDekForRecipients, } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
+import { buildPrincipalStateSigningInput, encodeBuiltinGroupMetadata, encryptGroupMetadata, generateKemSeedAndKeyPair, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, readGroupMetadata, signPrincipalState, toFingerprint, wrapDekForRecipients, } from "../../../internal/crypto/index.js";
+import { bytesToBase64 } from "../../../internal/encoding/index.js";
 export function userProjectionMember(userId, role) {
     return { userId: userId, role };
 }

package/workflows/organizations/{createOrganization.d.ts → provisioning/createOrganization.d.ts} RENAMED Viewed

@@ -1,10 +1,10 @@
-import { type EncapsulationKeyPair, type SigningKeyPair } from "../../internal/crypto/index.js";
-import type { CreateOrganizationRequest } from "../../internal/validators/request/index.js";
-import type { CreateOrganizationResponse } from "../../internal/validators/response/index.js";
-import type { DocumentProjectorRegistryInput } from "../../data/documents/documentKinds.js";
-import type { ExecSqlClientLike } from "../../data/sqlite/sqlSchema.js";
-import type { ProvisionedPrincipalHistoryPrimer } from "../registration/provisionedPrincipalHistory.js";
-import { type ProvisionedSystemContainerSpec } from "../registration/registerIdentity.js";
+import { type EncapsulationKeyPair, type SigningKeyPair } from "../../../internal/crypto/index.js";
+import type { CreateOrganizationRequest } from "../../../internal/validators/request/index.js";
+import type { CreateOrganizationResponse } from "../../../internal/validators/response/index.js";
+import type { DocumentProjectorRegistryInput } from "../../../data/documents/documentKinds.js";
+import type { ExecSqlClientLike } from "../../../data/sqlite/sqlSchema.js";
+import type { ProvisionedPrincipalHistoryPrimer } from "../../registration/provisionedPrincipalHistory.js";
+import { type ProvisionedSystemContainerSpec } from "../../registration/registerIdentity.js";
 import { removeNativeSubscriptionRestoreProvisioningAttempt } from "./organizationProvisioningAttempt.js";
 export { removeNativeSubscriptionRestoreProvisioningAttempt };
 export interface CreateOrganizationApi {

package/workflows/organizations/{createOrganization.js → provisioning/createOrganization.js} RENAMED Viewed

@@ -1,6 +1,6 @@
-import { signOrganizationReplacementAuthorization, } from "../../internal/crypto/index.js";
-import { createExecSql } from "../../data/sqlite/sqlSchema.js";
-import { buildOrganizationProvisioningArtifacts, persistOrganizationProvisioningState, } from "../registration/registerIdentity.js";
+import { signOrganizationReplacementAuthorization, } from "../../../internal/crypto/index.js";
+import { createExecSql } from "../../../data/sqlite/sqlSchema.js";
+import { buildOrganizationProvisioningArtifacts, persistOrganizationProvisioningState, } from "../../registration/registerIdentity.js";
 import { makeOrganizationProvisioningAttemptDurable, removeNativeSubscriptionRestoreProvisioningAttempt, } from "./organizationProvisioningAttempt.js";
 import { pinOrganizationReplacementResponse } from "./organizationReplacementVerification.js";
 export { removeNativeSubscriptionRestoreProvisioningAttempt };

package/workflows/organizations/provisioning/createOrganization.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"createOrganization.js","sourceRoot":"","sources":["createOrganization.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,OAAO,EACL,sCAAsC,EAItC,oCAAoC,GACrC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0CAA0C,EAC1C,kDAAkD,GACnD,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kCAAkC,EAAE,MAAM,uCAAuC,CAAC;AAE3F,OAAO,EAAE,kDAAkD,EAAE,CAAC;AAoD9D,SAAS,4BAA4B,CAAC,KAIrC;IACC,IACE,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;QAC9D,KAAK,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,OAAO,CAAC,eAAe,EAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB;QACtC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAClB,qCAAqC,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,CACtE,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAA8B,EAC9B,eAAuB;IAEvB,MAAM,cAAc,GAA2C;QAC7D,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,eAAe;QACf,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,SAAS,GACb,MAAM,sCAAsC,CAAC,cAAc,CAAC,CAAC;IAE/D,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,SAAS,CAAC,wBAAwB;YAChC,MAAM,wCAAwC,CAC5C;gBACE,GAAG,SAAS;gBACZ,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,eAAe;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,EACD,KAAK,CAAC,cAAc,CACrB,CAAC;IACN,CAAC;IAED,IACE,KAAK,CAAC,sBAAsB;QAC5B,KAAK,CAAC,iBAAiB;QACvB,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAC1B,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,CACT,0EAA0E,CAC3E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,KAAK,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,CAAC;IAExC,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAG,MAAM,0BAA0B,CACzD,KAAK,EACL,eAAe,CAChB,CAAC;IAEF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,cAAc,GAAG,MAAM,0CAA0C,CAAC;QACtE,SAAS,EAAE,kBAAkB;QAC7B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,eAAe;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,KAAK,CAAC,GAAG,EAAE,CACT,yEAAyE,CAC1E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EACJ,SAAS,EACT,OAAO,EACP,eAAe,EAAE,sBAAsB,GACxC,GAAG,cAAc,CAAC;IAEnB,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CACT,qEAAqE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CACT,sEAAsE,CACvE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,KAAK,CAAC,sBAAsB;QAC5B,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,QAAQ;YACR,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,gBAAgB;YACvD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;YACtC,YAAY,EAAE,KAAK,CAAC,iBAAiB;SACtC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IAEd,IAAI,4BAA4B,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,CAAC,yBAAyB,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC;IACjE,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,uBAAuB,EAAE,KAAK,CAAC,iBAAiB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,sBAAsB;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,6BAA6B,EAAE,SAAS,CAAC,6BAA6B;QACtE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;KAC/D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import {\n type EncapsulationKeyPair,\n type SigningKeyPair,\n signOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport type { CreateOrganizationRequest } from \"@tearleads/validators/request\";\nimport type { CreateOrganizationResponse } from \"@tearleads/validators/response\";\nimport type { DocumentProjectorRegistryInput } from \"../../../data/documents/documentKinds\";\nimport type { ExecSqlClientLike } from \"../../../data/sqlite/sqlSchema\";\nimport { createExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { ProvisionedPrincipalHistoryPrimer } from \"../../registration/provisionedPrincipalHistory\";\nimport {\n buildOrganizationProvisioningArtifacts,\n type OrganizationProvisioningArtifacts,\n type OrganizationProvisioningArtifactsInput,\n type ProvisionedSystemContainerSpec,\n persistOrganizationProvisioningState,\n} from \"../../registration/registerIdentity\";\nimport {\n makeOrganizationProvisioningAttemptDurable,\n removeNativeSubscriptionRestoreProvisioningAttempt,\n} from \"./organizationProvisioningAttempt\";\nimport { pinOrganizationReplacementResponse } from \"./organizationReplacementVerification\";\n\nexport { removeNativeSubscriptionRestoreProvisioningAttempt };\n\nexport interface CreateOrganizationApi {\n createOrganization(\n request: CreateOrganizationRequest,\n ): Promise<CreateOrganizationResponse | null>;\n}\n\nexport interface CreateOrganizationInput {\n apiClient: CreateOrganizationApi;\n dbClient: ExecSqlClientLike;\n documentProjectors?: DocumentProjectorRegistryInput | undefined;\n encapsulationKeyPair: EncapsulationKeyPair;\n /**\n * Returns false once the identity that supplied the key pairs is no longer\n * active. Checked before the remote create (so a stale request is never\n * submitted) and again before local persistence: an identity switch closes\n * or renews the captured database client, so persisting would write another\n * identity's bootstrap — or throw — after the org already exists remotely.\n * The caller discards the result.\n */\n isIdentityCurrent?: (() => boolean) | undefined;\n /** @internal Forwarded to the bootstrap persist; test-only seam. */\n onPersistQueued?: (() => void) | undefined;\n log?: ((message: string) => void) | undefined;\n logError?: ((message: string | Error, cause?: unknown) => void) | undefined;\n /** Overrides the seeded organization profile name; see registration. */\n organizationProfileName?: string | undefined;\n /** Seeds verified recovery progress for the founding policy heads. */\n primePrincipalHistory?: ProvisionedPrincipalHistoryPrimer | undefined;\n /**\n * App-owned system containers to provision atomically with the new\n * organization (e.g. a trash bin). See registration.\n */\n provisionedSystemContainers?:\n | ReadonlyArray<ProvisionedSystemContainerSpec>\n | undefined;\n /** Purged organization whose personal-org generation this replaces. */\n replacesOrganizationId?: string | undefined;\n /** Marks and durably replays a fresh native-subscription restore target. */\n nativeSubscriptionRestore?: boolean | undefined;\n /** Overrides the seeded self roster-profile nickname; see registration. */\n rosterProfileNickname?: string | undefined;\n signingKeyPair: SigningKeyPair;\n /**\n * The already-registered user creating the organization; they become its\n * founding admin. The server independently requires this to match the\n * authenticated session.\n */\n userId: string;\n}\n\nfunction isAdoptedReplacementResponse(input: {\n creation: CreateOrganizationInput;\n request: CreateOrganizationRequest;\n response: CreateOrganizationResponse;\n}): boolean {\n if (\n input.response.organizationId === input.request.organizationId &&\n input.response.rootContainerId === input.request.rootContainerId\n ) {\n return false;\n }\n if (\n !input.creation.replacesOrganizationId ||\n input.response.userId !== input.creation.userId\n ) {\n throw new Error(\n \"Organization provisioning returned an unexpected organization\",\n );\n }\n input.creation.log?.(\n `Organization replacement adopted (${input.response.organizationId})`,\n );\n return true;\n}\n\nasync function buildOrganizationCandidate(\n input: CreateOrganizationInput,\n rootContainerId: string,\n): Promise<OrganizationProvisioningArtifacts | null> {\n const artifactsInput: OrganizationProvisioningArtifactsInput = {\n encapsulationKeyPair: input.encapsulationKeyPair,\n organizationProfileName: input.organizationProfileName,\n provisionedSystemContainers: input.provisionedSystemContainers,\n rootContainerId,\n rosterProfileNickname: input.rosterProfileNickname,\n signingKeyPair: input.signingKeyPair,\n userId: input.userId,\n };\n const artifacts: OrganizationProvisioningArtifacts =\n await buildOrganizationProvisioningArtifacts(artifactsInput);\n\n if (input.replacesOrganizationId) {\n artifacts.replacementAuthorization =\n await signOrganizationReplacementAuthorization(\n {\n ...artifacts,\n replacesOrganizationId: input.replacesOrganizationId,\n rootContainerId,\n userId: input.userId,\n },\n input.signingKeyPair,\n );\n }\n\n if (\n input.replacesOrganizationId &&\n input.isIdentityCurrent &&\n !input.isIdentityCurrent()\n ) {\n input.log?.(\n \"Organization creation aborted: identity changed while building artifacts\",\n );\n return null;\n }\n\n return artifacts;\n}\n\n/**\n * Provisions an additional organization for an already-registered user, reusing\n * the exact artifact-build and local-persistence path as registration\n * ({@link buildOrganizationProvisioningArtifacts} /\n * {@link persistOrganizationProvisioningState}). Unlike registration it mints a\n * fresh root container id, signs with the caller's existing identity, and needs\n * no auth challenge — the user is already authenticated.\n */\nexport async function createOrganization(\n input: CreateOrganizationInput,\n): Promise<CreateOrganizationResponse | null> {\n input.log?.(\"Creating organization...\");\n\n const rootContainerId = crypto.randomUUID();\n const candidateArtifacts = await buildOrganizationCandidate(\n input,\n rootContainerId,\n );\n\n if (!candidateArtifacts) return null;\n\n const durableAttempt = await makeOrganizationProvisioningAttemptDurable({\n artifacts: candidateArtifacts,\n canStartDurableMutation: input.isIdentityCurrent,\n dbClient: input.dbClient,\n nativeSubscriptionRestore: input.nativeSubscriptionRestore,\n replacesOrganizationId: input.replacesOrganizationId,\n rootContainerId,\n userId: input.userId,\n });\n if (!durableAttempt) {\n input.log?.(\n \"Organization creation aborted: identity changed before saving artifacts\",\n );\n return null;\n }\n const {\n artifacts,\n request,\n rootContainerId: durableRootContainerId,\n } = durableAttempt;\n\n if (input.isIdentityCurrent && !input.isIdentityCurrent()) {\n input.log?.(\n \"Organization creation aborted: identity changed before provisioning\",\n );\n return null;\n }\n\n const response = await input.apiClient.createOrganization(request);\n if (!response) {\n return null;\n }\n\n if (input.isIdentityCurrent && !input.isIdentityCurrent()) {\n input.log?.(\n \"Organization creation discarded: identity changed while provisioning\",\n );\n return null;\n }\n\n if (\n input.replacesOrganizationId &&\n !(await pinOrganizationReplacementResponse({\n replacesOrganizationId: input.replacesOrganizationId,\n response,\n signingPublicKey: input.signingKeyPair.signingPublicKey,\n userId: input.userId,\n execSql: createExecSql(input.dbClient),\n stillCurrent: input.isIdentityCurrent,\n }))\n )\n return null;\n\n if (isAdoptedReplacementResponse({ creation: input, request, response })) {\n // Another device authorized this winning genesis with the same identity.\n // Its encrypted bootstrap will hydrate normally; persisting\n // this device's losing candidate would instead create an unrelated local\n // root. The session reset rebinds retained local data to the winning ids.\n return response;\n }\n\n input.log?.(`Organization created (${response.organizationId})`);\n await persistOrganizationProvisioningState({\n bootstrap: artifacts.bootstrap,\n canStartDurableMutation: input.isIdentityCurrent,\n onPersistQueued: input.onPersistQueued,\n containerId: durableRootContainerId,\n dbClient: input.dbClient,\n documentProjectors: input.documentProjectors,\n initialAdminGroup: artifacts.initialAdminGroup,\n initialMemberGroup: artifacts.initialMemberGroup,\n initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n log: input.log,\n logError: input.logError,\n organizationMetadataBootstrap: artifacts.organizationMetadataBootstrap,\n primePrincipalHistory: input.primePrincipalHistory,\n response,\n rootContainer: artifacts.rootContainer,\n rootMetadataDocument: artifacts.rootMetadataDocument,\n rootMetadataDocumentRequest: artifacts.rootMetadataDocumentRequest,\n rosterProfileBootstrap: artifacts.rosterProfileBootstrap,\n systemContainerBootstraps: artifacts.systemContainerBootstraps,\n });\n\n return response;\n}\n"]}

package/workflows/organizations/{organizationProvisioningAttempt.d.ts → provisioning/organizationProvisioningAttempt.d.ts} RENAMED Viewed

@@ -1,6 +1,6 @@
-import { type CreateOrganizationRequest } from "../../internal/validators/request/index.js";
-import type { ExecSql, ExecSqlClientLike } from "../../data/sqlite/sqlSchema.js";
-import type { OrganizationProvisioningArtifacts } from "../registration/registerIdentity.js";
+import { type CreateOrganizationRequest } from "../../../internal/validators/request/index.js";
+import type { ExecSql, ExecSqlClientLike } from "../../../data/sqlite/sqlSchema.js";
+import type { OrganizationProvisioningArtifacts } from "../../registration/registerIdentity.js";
 interface DurableOrganizationProvisioningAttempt {
     readonly artifacts: OrganizationProvisioningArtifacts;
     readonly request: CreateOrganizationRequest;

package/workflows/organizations/{organizationProvisioningAttempt.js → provisioning/organizationProvisioningAttempt.js} RENAMED Viewed

@@ -1,9 +1,9 @@
-import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
-import { isPlainObject } from "../../internal/validators/isPlainObject.js";
-import { isCreateOrganizationRequest, } from "../../internal/validators/request/index.js";
-import { isOrganizationReplacementAuthorization } from "../../internal/validators/util/index.js";
-import { sqlOrganizationProvisioningAttemptPersistence } from "../../data/persistence/organizations/organizationProvisioningAttemptPersistence.js";
-import { createExecSql } from "../../data/sqlite/sqlSchema.js";
+import { base64ToBytes, bytesToBase64 } from "../../../internal/encoding/index.js";
+import { isPlainObject } from "../../../internal/validators/isPlainObject.js";
+import { isCreateOrganizationRequest, } from "../../../internal/validators/request/index.js";
+import { isOrganizationReplacementAuthorization } from "../../../internal/validators/util/index.js";
+import { sqlOrganizationProvisioningAttemptPersistence } from "../../../data/persistence/organizations/organizationProvisioningAttemptPersistence.js";
+import { createExecSql } from "../../../data/sqlite/sqlSchema.js";
 const BYTE_MARKER = "__tearleadsProvisioningBytes";
 function buildCreateOrganizationRequest(input) {
     const { artifacts } = input;

package/workflows/organizations/provisioning/organizationProvisioningAttempt.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"organizationProvisioningAttempt.js","sourceRoot":"","sources":["organizationProvisioningAttempt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAEL,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,sCAAsC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,6CAA6C,EAAE,MAAM,oFAAoF,CAAC;AAKnJ,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAG/D,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAQnD,SAAS,8BAA8B,CAAC,KAOvC;IACC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,SAAS,CAAC,wBAAwB;YACpC,CAAC,CAAC,EAAE,wBAAwB,EAAE,SAAS,CAAC,wBAAwB,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,6BAA6B,EAC3B,SAAS,CAAC,sBAAsB,CAAC,gBAAgB;QACnD,4BAA4B,EAC1B,SAAS,CAAC,sBAAsB,CAAC,sBAAsB;QACzD,oCAAoC,EAClC,SAAS,CAAC,6BAA6B,CAAC,gBAAgB;QAC1D,kCAAkC,EAChC,SAAS,CAAC,6BAA6B;aACpC,kCAAkC;QACvC,uBAAuB,EAAE,SAAS,CAAC,yBAAyB,CAAC,GAAG,CAC9D,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,gBAAgB,CACtD;QACD,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,yBAAyB;YACjC,CAAC,CAAC,EAAE,yBAAyB,EAAE,IAAa,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,sBAAsB;YAC9B,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,EAAE;YAC1D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAAC,KAIpE;IACC,MAAM,MAAM,GAAG,MAAM,6CAA6C,CAAC,IAAI,CACrE,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC7C,SAAS;QACT,mBAAmB,EAAE,IAAI;QACzB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,IACE,SAAS,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAClD,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAChD,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe;QAClD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,SAA4C;IACtE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE;QACxD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,GAAW;IAC5D,OAAO,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,KAA8B,EAAE,GAAW;IAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,UAAU,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,CACL,aAAa,CAAC,KAAK,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;QAC7B,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,CACL,aAAa,CAAC,KAAK,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;QAC/B,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAA8B;IAC/D,OAAO,CACL,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,QAAQ;QACrD,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;QACvE,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC;QACjD,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,SAAS,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC,CAC1C,KAAc;IAEd,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IACzE,OAAO,CACL,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,0BAA0B,CAAC,KAAK,IAAI;QACtD,sCAAsC,CACpC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAC/C,CAAC;QACJ,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,QAAQ;QACxD,aAAa,CAAC,SAAS,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,CAAC,KAAK,QAAQ;QAChE,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACrC,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACtC,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC;QAC7C,SAAS,CAAC,KAAK,EAAE,sBAAsB,CAAC;QACxC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;QAClE,SAAS,CAAC,KAAK,EAAE,6BAA6B,CAAC;QAC/C,aAAa,CAAC,MAAM,CAAC;QACrB,yBAAyB,CAAC,MAAM,CAAC;QACjC,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAC9D,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;QAChD,SAAS,CAAC,MAAM,EAAE,wBAAwB,CAAC;QAC3C,aAAa,CAAC,QAAQ,CAAC;QACvB,yBAAyB,CAAC,QAAQ,CAAC;QACnC,sBAAsB,CACpB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CACrD;QACD,SAAS,CAAC,QAAQ,EAAE,oCAAoC,CAAC;QACzD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,6BAA6B,CAAC,KAAK,QAAQ;QACxE,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC/B,gBAAgB,CAAC,KAAK,CACpB,CAAC,SAAS,EAAE,EAAE,CACZ,aAAa,CAAC,SAAS,CAAC,IAAI,yBAAyB,CAAC,SAAS,CAAC,CACnE,CACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAa;IAEb,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAkB,EAAE,EAAE;QACrE,IACE,OAAO,SAAS,KAAK,QAAQ;YAC7B,SAAS,KAAK,IAAI;YAClB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;YACnC,WAAW,IAAI,SAAS,EACxB,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,mCAAmC,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,KAQhE;IACC,MAAM,UAAU,GACd,KAAK,CAAC,sBAAsB;QAC5B,CAAC,KAAK,CAAC,yBAAyB;YAC9B,CAAC,CAAC,+BAA+B,KAAK,CAAC,MAAM,EAAE;YAC/C,CAAC,CAAC,IAAI,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,8BAA8B,CAAC,KAAK,CAAC;YAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,6CAA6C,CAAC,UAAU,CAC3E,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B;QACE,sBAAsB,EAAE,UAAU;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,cAAc;QAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,mBAAmB,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC;KACzD,EACD,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC7C,SAAS;QACT,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,IACE,SAAS,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAClD,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAChD,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe;QAClD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kDAAkD,CAAC,KAKxE;IACC,MAAM,UAAU,GAAG,+BAA+B,KAAK,CAAC,MAAM,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,6CAA6C,CAAC,IAAI,CACrE,OAAO,EACP,UAAU,CACX,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IACE,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC9B,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,qCAAqC,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,UAAU;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAM3D;IACC,OAAO,6CAA6C,CAAC,MAAM,CACzD,KAAK,CAAC,OAAO,EACb,KAAK,EACL,KAAK,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport {\n type CreateOrganizationRequest,\n isCreateOrganizationRequest,\n} from \"@tearleads/validators/request\";\nimport { isOrganizationReplacementAuthorization } from \"@tearleads/validators/util\";\nimport { sqlOrganizationProvisioningAttemptPersistence } from \"../../../data/persistence/organizations/organizationProvisioningAttemptPersistence\";\nimport type {\n ExecSql,\n ExecSqlClientLike,\n} from \"../../../data/sqlite/sqlSchema\";\nimport { createExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { OrganizationProvisioningArtifacts } from \"../../registration/registerIdentity\";\n\nconst BYTE_MARKER = \"__tearleadsProvisioningBytes\";\n\ninterface DurableOrganizationProvisioningAttempt {\n readonly artifacts: OrganizationProvisioningArtifacts;\n readonly request: CreateOrganizationRequest;\n readonly rootContainerId: string;\n}\n\nfunction buildCreateOrganizationRequest(input: {\n artifacts: OrganizationProvisioningArtifacts;\n finalizeReplacement?: boolean | undefined;\n nativeSubscriptionRestore?: boolean | undefined;\n replacesOrganizationId?: string | undefined;\n rootContainerId: string;\n userId: string;\n}): CreateOrganizationRequest {\n const { artifacts } = input;\n return {\n userId: input.userId,\n ...(artifacts.replacementAuthorization\n ? { replacementAuthorization: artifacts.replacementAuthorization }\n : {}),\n organizationId: artifacts.organizationId,\n rootContainerId: input.rootContainerId,\n initialAdminGroup: artifacts.initialAdminGroup,\n initialMemberGroup: artifacts.initialMemberGroup,\n initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n initialRootContainer: artifacts.initialRootContainer,\n initialRootMetadataDocument: artifacts.rootMetadataDocumentRequest,\n initialRosterProfileContainer:\n artifacts.rosterProfileBootstrap.containerRequest,\n initialRosterProfileDocument:\n artifacts.rosterProfileBootstrap.profileDocumentRequest,\n initialOrganizationMetadataContainer:\n artifacts.organizationMetadataBootstrap.containerRequest,\n initialOrganizationProfileDocument:\n artifacts.organizationMetadataBootstrap\n .organizationProfileDocumentRequest,\n initialSystemContainers: artifacts.systemContainerBootstraps.map(\n (systemContainer) => systemContainer.containerRequest,\n ),\n ...(input.finalizeReplacement ? { finalizeReplacement: true } : {}),\n ...(input.nativeSubscriptionRestore\n ? { nativeSubscriptionRestore: true as const }\n : {}),\n ...(input.replacesOrganizationId\n ? { replacesOrganizationId: input.replacesOrganizationId }\n : {}),\n };\n}\n\nexport async function loadOrganizationReplacementFinalizationRequest(input: {\n execSql: ExecSql;\n replacedOrganizationId: string;\n userId: string;\n}): Promise<CreateOrganizationRequest> {\n const stored = await sqlOrganizationProvisioningAttemptPersistence.load(\n input.execSql,\n input.replacedOrganizationId,\n );\n if (!stored) {\n throw new Error(\"Organization replacement attempt is unavailable\");\n }\n if (stored.userId !== input.userId) {\n throw new Error(\n \"Stored organization provisioning attempt belongs to another user\",\n );\n }\n const artifacts = deserializeArtifacts(stored.serializedArtifacts);\n const request = buildCreateOrganizationRequest({\n artifacts,\n finalizeReplacement: true,\n replacesOrganizationId: input.replacedOrganizationId,\n rootContainerId: stored.rootContainerId,\n userId: stored.userId,\n });\n if (\n artifacts.organizationId !== stored.organizationId ||\n request.organizationId !== stored.organizationId ||\n request.rootContainerId !== stored.rootContainerId ||\n !isCreateOrganizationRequest(request)\n ) {\n throw new Error(\"Stored organization provisioning attempt is inconsistent\");\n }\n return request;\n}\n\nfunction serializeArtifacts(artifacts: OrganizationProvisioningArtifacts) {\n return JSON.stringify(artifacts, (_key, value: unknown) => {\n if (value instanceof Uint8Array) {\n return { [BYTE_MARKER]: bytesToBase64(value) };\n }\n return value;\n });\n}\n\nfunction hasRecord(value: Record<string, unknown>, key: string): boolean {\n return isPlainObject(Reflect.get(value, key));\n}\n\nfunction hasBytes(value: Record<string, unknown>, key: string): boolean {\n return Reflect.get(value, key) instanceof Uint8Array;\n}\n\nfunction isMaterializedDocument(value: unknown): boolean {\n return (\n isPlainObject(value) &&\n hasBytes(value, \"contentKey\") &&\n hasRecord(value, \"plan\")\n );\n}\n\nfunction isMaterializedContainer(value: unknown): boolean {\n return (\n isPlainObject(value) &&\n hasBytes(value, \"containerKey\") &&\n hasRecord(value, \"plan\")\n );\n}\n\nfunction hasContainerBootstrapCore(value: Record<string, unknown>): boolean {\n return (\n typeof Reflect.get(value, \"containerId\") === \"string\" &&\n isMaterializedDocument(Reflect.get(value, \"containerMetadataDocument\")) &&\n hasBytes(value, \"containerMetadataInitialUpdate\") &&\n isMaterializedContainer(Reflect.get(value, \"containerPlan\")) &&\n hasRecord(value, \"containerRequest\") &&\n Reflect.get(value, \"systemSlot\") !== undefined\n );\n}\n\nfunction isOrganizationProvisioningArtifacts(\n value: unknown,\n): value is OrganizationProvisioningArtifacts {\n if (!isPlainObject(value)) return false;\n const bootstrap = Reflect.get(value, \"bootstrap\");\n const roster = Reflect.get(value, \"rosterProfileBootstrap\");\n const metadata = Reflect.get(value, \"organizationMetadataBootstrap\");\n const systemContainers = Reflect.get(value, \"systemContainerBootstraps\");\n return (\n (Reflect.get(value, \"replacementAuthorization\") === null ||\n isOrganizationReplacementAuthorization(\n Reflect.get(value, \"replacementAuthorization\"),\n )) &&\n typeof Reflect.get(value, \"organizationId\") === \"string\" &&\n isPlainObject(bootstrap) &&\n hasBytes(bootstrap, \"initialUpdate\") &&\n typeof Reflect.get(bootstrap, \"metadataDocumentId\") === \"string\" &&\n hasRecord(value, \"initialAdminGroup\") &&\n hasRecord(value, \"initialMemberGroup\") &&\n hasRecord(value, \"initialOrganizationPolicy\") &&\n hasRecord(value, \"initialRootContainer\") &&\n isMaterializedContainer(Reflect.get(value, \"rootContainer\")) &&\n isMaterializedDocument(Reflect.get(value, \"rootMetadataDocument\")) &&\n hasRecord(value, \"rootMetadataDocumentRequest\") &&\n isPlainObject(roster) &&\n hasContainerBootstrapCore(roster) &&\n isMaterializedDocument(Reflect.get(roster, \"profileDocument\")) &&\n hasBytes(roster, \"profileDocumentInitialUpdate\") &&\n hasRecord(roster, \"profileDocumentRequest\") &&\n isPlainObject(metadata) &&\n hasContainerBootstrapCore(metadata) &&\n isMaterializedDocument(\n Reflect.get(metadata, \"organizationProfileDocument\"),\n ) &&\n hasRecord(metadata, \"organizationProfileDocumentRequest\") &&\n typeof Reflect.get(metadata, \"organizationProfileSnapshot\") === \"string\" &&\n Array.isArray(systemContainers) &&\n systemContainers.every(\n (container) =>\n isPlainObject(container) && hasContainerBootstrapCore(container),\n )\n );\n}\n\nfunction deserializeArtifacts(\n value: string,\n): OrganizationProvisioningArtifacts {\n const parsed: unknown = JSON.parse(value, (_key, candidate: unknown) => {\n if (\n typeof candidate === \"object\" &&\n candidate !== null &&\n Object.keys(candidate).length === 1 &&\n BYTE_MARKER in candidate\n ) {\n const encoded = Reflect.get(candidate, BYTE_MARKER);\n if (typeof encoded === \"string\") {\n return base64ToBytes(encoded);\n }\n }\n return candidate;\n });\n if (!isOrganizationProvisioningArtifacts(parsed)) {\n throw new Error(\"Stored organization provisioning attempt is invalid\");\n }\n return parsed;\n}\n\nexport async function makeOrganizationProvisioningAttemptDurable(input: {\n artifacts: OrganizationProvisioningArtifacts;\n canStartDurableMutation?: (() => boolean) | undefined;\n dbClient: ExecSqlClientLike;\n nativeSubscriptionRestore?: boolean | undefined;\n replacesOrganizationId?: string | undefined;\n rootContainerId: string;\n userId: string;\n}): Promise<DurableOrganizationProvisioningAttempt | null> {\n const attemptKey =\n input.replacesOrganizationId ??\n (input.nativeSubscriptionRestore\n ? `native-subscription-restore:${input.userId}`\n : null);\n if (!attemptKey) {\n return {\n artifacts: input.artifacts,\n request: buildCreateOrganizationRequest(input),\n rootContainerId: input.rootContainerId,\n };\n }\n const stored = await sqlOrganizationProvisioningAttemptPersistence.loadOrSave(\n createExecSql(input.dbClient),\n {\n replacedOrganizationId: attemptKey,\n userId: input.userId,\n organizationId: input.artifacts.organizationId,\n rootContainerId: input.rootContainerId,\n serializedArtifacts: serializeArtifacts(input.artifacts),\n },\n input.canStartDurableMutation,\n );\n if (!stored) return null;\n if (stored.userId !== input.userId) {\n throw new Error(\n \"Stored organization provisioning attempt belongs to another user\",\n );\n }\n const artifacts = deserializeArtifacts(stored.serializedArtifacts);\n const request = buildCreateOrganizationRequest({\n artifacts,\n nativeSubscriptionRestore: input.nativeSubscriptionRestore,\n replacesOrganizationId: input.replacesOrganizationId,\n rootContainerId: stored.rootContainerId,\n userId: stored.userId,\n });\n if (\n artifacts.organizationId !== stored.organizationId ||\n request.organizationId !== stored.organizationId ||\n request.rootContainerId !== stored.rootContainerId ||\n !isCreateOrganizationRequest(request)\n ) {\n throw new Error(\"Stored organization provisioning attempt is inconsistent\");\n }\n return { artifacts, request, rootContainerId: stored.rootContainerId };\n}\n\nexport async function removeNativeSubscriptionRestoreProvisioningAttempt(input: {\n canCommit?: (() => boolean) | undefined;\n dbClient: ExecSqlClientLike;\n organizationId: string;\n userId: string;\n}): Promise<boolean> {\n const attemptKey = `native-subscription-restore:${input.userId}`;\n const execSql = createExecSql(input.dbClient);\n const stored = await sqlOrganizationProvisioningAttemptPersistence.load(\n execSql,\n attemptKey,\n );\n if (!stored) return true;\n if (\n stored.userId !== input.userId ||\n stored.organizationId !== input.organizationId\n ) {\n throw new Error(\n \"Stored native restore organization provisioning attempt is inconsistent\",\n );\n }\n return removeOrganizationProvisioningAttempt({\n canCommit: input.canCommit,\n execSql,\n organizationId: input.organizationId,\n replacedOrganizationId: attemptKey,\n userId: input.userId,\n });\n}\n\nexport async function removeOrganizationProvisioningAttempt(input: {\n canCommit?: (() => boolean) | undefined;\n execSql: ExecSql;\n organizationId?: string | undefined;\n replacedOrganizationId: string;\n userId: string;\n}): Promise<boolean> {\n return sqlOrganizationProvisioningAttemptPersistence.remove(\n input.execSql,\n input,\n input.canCommit,\n );\n}\n"]}

package/workflows/organizations/{organizationReplacementVerification.js → provisioning/organizationReplacementVerification.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { KeyingVerificationError, verifyOrganizationReplacementAuthorization, } from "../../internal/crypto/index.js";
-import { persistOrganizationReplacementCheckpoints } from "../../data/persistence/organizationReplacementCheckpointPersistence.js";
+import { KeyingVerificationError, verifyOrganizationReplacementAuthorization, } from "../../../internal/crypto/index.js";
+import { persistOrganizationReplacementCheckpoints } from "../../../data/persistence/organizationReplacementCheckpointPersistence.js";
 /** The API's user/organization echoes are not authority to rehome local data. */
 export function verifyOrganizationReplacementResponse(input) {
     const { response } = input;

package/workflows/organizations/provisioning/organizationReplacementVerification.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"organizationReplacementVerification.js","sourceRoot":"","sources":["organizationReplacementVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,0CAA0C,GAC3C,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yCAAyC,EAAE,MAAM,wEAAwE,CAAC;AAGnI,iFAAiF;AACjF,MAAM,UAAU,qCAAqC,CAAC,KAKrD;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,aAAa,GAAG,0CAA0C,CAC9D,QAAQ,CAAC,wBAAwB,EACjC,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IACE,aAAa,CAAC,sBAAsB,KAAK,KAAK,CAAC,sBAAsB;QACrE,aAAa,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACrC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAChC,aAAa,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QACxD,aAAa,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QAC1D,aAAa,CAAC,gBAAgB,KAAK,QAAQ,CAAC,2BAA2B;QACvE,aAAa,CAAC,sBAAsB,KAAK,QAAQ,CAAC,sBAAsB;QACxE,QAAQ,CAAC,uBAAuB,KAAK,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAGC;IAED,OAAO,yCAAyC,CAAC;QAC/C,aAAa,EAAE,qCAAqC,CAAC,KAAK,CAAC;QAC3D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n KeyingVerificationError,\n type VerifiedOrganizationReplacementAuthorization,\n verifyOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport type { CreateOrganizationResponse } from \"@tearleads/validators/response\";\nimport { persistOrganizationReplacementCheckpoints } from \"../../../data/persistence/organizationReplacementCheckpointPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/** The API's user/organization echoes are not authority to rehome local data. */\nexport function verifyOrganizationReplacementResponse(input: {\n readonly replacesOrganizationId: string;\n readonly response: CreateOrganizationResponse;\n readonly signingPublicKey: Uint8Array;\n readonly userId: string;\n}): VerifiedOrganizationReplacementAuthorization {\n const { response } = input;\n const authorization = verifyOrganizationReplacementAuthorization(\n response.replacementAuthorization,\n input.signingPublicKey,\n );\n if (\n authorization.replacesOrganizationId !== input.replacesOrganizationId ||\n authorization.userId !== input.userId ||\n response.userId !== input.userId ||\n authorization.organizationId !== response.organizationId ||\n authorization.rootContainerId !== response.rootContainerId ||\n authorization.rootManifestHash !== response.rootMetadataAccessStateHash ||\n authorization.rootMetadataDocumentId !== response.rootMetadataDocumentId ||\n response.rootMetadataAccessEpoch !== 1\n ) {\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Organization replacement response does not match its signed authorization\",\n );\n }\n return authorization;\n}\n\nexport async function pinOrganizationReplacementResponse(\n input: Parameters<typeof verifyOrganizationReplacementResponse>[0] & {\n readonly execSql: ExecSql;\n readonly stillCurrent?: (() => boolean) | undefined;\n },\n): Promise<boolean> {\n return persistOrganizationReplacementCheckpoints({\n authorization: verifyOrganizationReplacementResponse(input),\n execSql: input.execSql,\n stillCurrent: input.stillCurrent,\n });\n}\n"]}

package/workflows/organizations/{dataUsageReadModel.d.ts → readModel/dataUsageReadModel.d.ts} RENAMED Viewed

@@ -1,6 +1,6 @@
-import type { RequestResult, RequestResultOptions } from "../../internal/api-client/index.js";
-import type { OrganizationDataUsageResponse } from "../../internal/validators/response/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { RequestResult, RequestResultOptions } from "../../../internal/api-client/index.js";
+import type { OrganizationDataUsageResponse } from "../../../internal/validators/response/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 export type OrganizationDataUsage = OrganizationDataUsageResponse;
 interface OrganizationDataUsageApi {
     getOrganizationDataUsageResult(organizationId: string, options?: RequestResultOptions): Promise<RequestResult<OrganizationDataUsageResponse>>;

package/workflows/organizations/{dataUsageReadModel.js → readModel/dataUsageReadModel.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { loadOrganizationDataUsageProjection, purgeOrganizationDataUsageProjection, saveOrganizationDataUsageProjection, } from "../../data/persistence/organizations/organizationDataUsagePersistence.js";
-import { recordOrganizationPresentationDenials } from "../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
+import { loadOrganizationDataUsageProjection, purgeOrganizationDataUsageProjection, saveOrganizationDataUsageProjection, } from "../../../data/persistence/organizations/organizationDataUsagePersistence.js";
+import { recordOrganizationPresentationDenials } from "../../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
 import { captureOrganizationPresentationAccessAttempt, denyOrganizationPresentationAccess, isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, restoreOrganizationPresentationAccess, runOrganizationPresentationMutation, runOrganizationPresentationRead, } from "./organizationPresentationAccessState.js";
 import { isOrganizationPresentationAccessDeniedFailure } from "./organizationPresentationFailures.js";
 export async function loadLocalOrganizationDataUsage(input) {

package/workflows/organizations/readModel/dataUsageReadModel.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"dataUsageReadModel.js","sourceRoot":"","sources":["dataUsageReadModel.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mCAAmC,EACnC,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mFAAmF,CAAC;AAE1I,OAAO,EACL,4CAA4C,EAC5C,kCAAkC,EAClC,8CAA8C,EAC9C,wCAAwC,EAExC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,6CAA6C,EAAE,MAAM,oCAAoC,CAAC;AAyBnG,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAA2C;IAE3C,OAAO,+BAA+B,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAC1D,mCAAmC,CACjC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA2C,EAC3C,OAA8C,EAC9C,KAAQ;IAER,OAAO,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC;QACnE,wCAAwC,CAAC,KAAK,EAAE,OAAO,CAAC;QACxD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAA0C;IAE1C,MAAM,OAAO,GAAG,4CAA4C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,8BAA8B,CACjE,KAAK,CAAC,cAAc,EACpB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,6CAA6C,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,kCAAkC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,qEAAqE;YACrE,gCAAgC;YAChC,IAAI,CAAC;gBACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,qCAAqC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,CAAC,QAAQ,EAAE,CACd,iDAAiD,EACjD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,oCAAoC,CAClC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,CAAC,QAAQ,EAAE,CACd,gDAAgD,EAChD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QACxD,KAAK,CAAC,QAAQ,EAAE,CACd,yDAAyD,KAAK,CAAC,cAAc,EAAE,CAChF,CAAC;QACF,OAAO,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACnE,IAAI,CAAC,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,mCAAmC,CAAC;gBACxC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,QAAQ,EAAE,MAAM,CAAC,IAAI;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,QAAQ,EAAE,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;YACrE,OAAO,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,qCAAqC,CAAC,KAAK,EAAE,OAAO,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n RequestResult,\n RequestResultOptions,\n} from \"@tearleads/api-client\";\nimport type { OrganizationDataUsageResponse } from \"@tearleads/validators/response\";\nimport {\n loadOrganizationDataUsageProjection,\n purgeOrganizationDataUsageProjection,\n saveOrganizationDataUsageProjection,\n} from \"../../../data/persistence/organizations/organizationDataUsagePersistence\";\nimport { recordOrganizationPresentationDenials } from \"../../../data/persistence/organizations/organizationPresentationDenialPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n captureOrganizationPresentationAccessAttempt,\n denyOrganizationPresentationAccess,\n isOrganizationPresentationAccessAttemptCurrent,\n isOrganizationPresentationAccessReadable,\n type OrganizationPresentationAccessAttempt,\n restoreOrganizationPresentationAccess,\n runOrganizationPresentationMutation,\n runOrganizationPresentationRead,\n} from \"./organizationPresentationAccessState\";\nimport { isOrganizationPresentationAccessDeniedFailure } from \"./organizationPresentationFailures\";\n\nexport type OrganizationDataUsage = OrganizationDataUsageResponse;\n\ninterface OrganizationDataUsageApi {\n getOrganizationDataUsageResult(\n organizationId: string,\n options?: RequestResultOptions,\n ): Promise<RequestResult<OrganizationDataUsageResponse>>;\n}\n\ninterface OrganizationDataUsageProjectionInput {\n readonly execSql: ExecSql;\n readonly organizationId: string;\n readonly requesterUserId: string;\n}\n\nexport interface ReconcileOrganizationDataUsageInput\n extends OrganizationDataUsageProjectionInput {\n readonly apiClient: OrganizationDataUsageApi;\n readonly logError?:\n | ((message: string | Error, cause?: unknown) => void)\n | undefined;\n}\n\nexport async function loadLocalOrganizationDataUsage(\n input: OrganizationDataUsageProjectionInput,\n): Promise<OrganizationDataUsage | null> {\n return runOrganizationPresentationRead(input, \"usage\", () =>\n loadOrganizationDataUsageProjection(\n input.execSql,\n input.organizationId,\n input.requesterUserId,\n ),\n );\n}\n\nfunction retainedIfUsageReadable<T>(\n input: OrganizationDataUsageProjectionInput,\n attempt: OrganizationPresentationAccessAttempt,\n value: T,\n): T | null {\n return isOrganizationPresentationAccessAttemptCurrent(input, attempt) &&\n isOrganizationPresentationAccessReadable(input, \"usage\")\n ? value\n : null;\n}\n\nexport async function reconcileOrganizationDataUsage(\n input: ReconcileOrganizationDataUsageInput,\n): Promise<OrganizationDataUsage | null> {\n const attempt = captureOrganizationPresentationAccessAttempt(input, \"usage\");\n const local = await loadLocalOrganizationDataUsage(input);\n const result = await input.apiClient.getOrganizationDataUsageResult(\n input.organizationId,\n { reportErrors: false },\n );\n if (!result.ok) {\n if (isOrganizationPresentationAccessDeniedFailure(result)) {\n denyOrganizationPresentationAccess(input, [\"usage\"]);\n // Durable marker first: a failed purge plus a restart must not serve\n // the revoked usage projection.\n try {\n await runOrganizationPresentationMutation(input.execSql, () =>\n recordOrganizationPresentationDenials(input, [\"usage\"]),\n );\n } catch (error) {\n input.logError?.(\n \"Failed to record denied organization data usage\",\n error,\n );\n }\n try {\n await runOrganizationPresentationMutation(input.execSql, () =>\n purgeOrganizationDataUsageProjection(\n input.execSql,\n input.organizationId,\n input.requesterUserId,\n ),\n );\n } catch (error) {\n input.logError?.(\n \"Failed to purge denied organization data usage\",\n error,\n );\n }\n return null;\n }\n\n result.report();\n return retainedIfUsageReadable(input, attempt, local);\n }\n\n if (result.data.organizationId !== input.organizationId) {\n input.logError?.(\n `Organization data-usage response scope does not match ${input.organizationId}`,\n );\n return retainedIfUsageReadable(input, attempt, local);\n }\n\n return runOrganizationPresentationMutation(input.execSql, async () => {\n if (!isOrganizationPresentationAccessAttemptCurrent(input, attempt)) {\n return null;\n }\n try {\n await saveOrganizationDataUsageProjection({\n execSql: input.execSql,\n requesterUserId: input.requesterUserId,\n response: result.data,\n });\n } catch (error) {\n input.logError?.(\"Failed to persist organization data usage\", error);\n return retainedIfUsageReadable(input, attempt, local);\n }\n return restoreOrganizationPresentationAccess(input, attempt)\n ? result.data\n : null;\n });\n}\n"]}

package/workflows/organizations/{readModel.d.ts → readModel/index.d.ts} RENAMED Viewed

@@ -1,8 +1,8 @@
-import type { UpdateOrganizationProfileRequest, UpdateOrganizationRosterEntryRequest } from "../../internal/validators/request/index.js";
-import type { OrganizationContainerGrantResponse, OrganizationContainerGrantsResponse, OrganizationDirectoryResponse, OrganizationDirectoryUserResponse, OrganizationGroupContainerResponse, OrganizationGroupContainersResponse, OrganizationGroupSummaryResponse, OrganizationProfileResponse, OrganizationReadModelGroupMemberResponse, OrganizationUserDetailResponse } from "../../internal/validators/response/index.js";
-import type { OrganizationGroupPolicyHistory } from "./policyHistoryReadModel.js";
-export type { OrganizationGroupPolicyHistory, OrganizationGroupPolicyHistoryEntry, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationPrincipalMemberChange, OrganizationPrincipalMemberChangeType, OrganizationPrincipalPolicyHistory, OrganizationPrincipalPolicyHistoryEntry, } from "./policyHistoryReadModel.js";
-export { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "./policyHistoryReadModel.js";
+import type { UpdateOrganizationProfileRequest, UpdateOrganizationRosterEntryRequest } from "../../../internal/validators/request/index.js";
+import type { OrganizationContainerGrantResponse, OrganizationContainerGrantsResponse, OrganizationDirectoryResponse, OrganizationDirectoryUserResponse, OrganizationGroupContainerResponse, OrganizationGroupContainersResponse, OrganizationGroupSummaryResponse, OrganizationProfileResponse, OrganizationReadModelGroupMemberResponse, OrganizationUserDetailResponse } from "../../../internal/validators/response/index.js";
+import type { OrganizationGroupPolicyHistory } from "../policyHistory/policyHistoryReadModel.js";
+export type { OrganizationGroupPolicyHistory, OrganizationGroupPolicyHistoryEntry, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationPrincipalMemberChange, OrganizationPrincipalMemberChangeType, OrganizationPrincipalPolicyHistory, OrganizationPrincipalPolicyHistoryEntry, } from "../policyHistory/policyHistoryReadModel.js";
+export { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "../policyHistory/policyHistoryReadModel.js";
 export type OrganizationDirectory = OrganizationDirectoryResponse;
 export type OrganizationDirectoryUser = OrganizationDirectoryUserResponse;
 export type OrganizationProfile = OrganizationProfileResponse;

package/workflows/organizations/{readModel.js → readModel/index.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-export { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "./policyHistoryReadModel.js";
+export { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "../policyHistory/policyHistoryReadModel.js";
 export async function updateOrganizationRosterEntry(input) {
     return input.apiClient.updateOrganizationRosterEntry(input.organizationId, input.userId, { profileDocumentId: input.profileDocumentId });
 }
@@ -7,4 +7,4 @@ export async function updateOrganizationProfile(input) {
         profileDocumentId: input.profileDocumentId,
     });
 }
-//# sourceMappingURL=readModel.js.map
+//# sourceMappingURL=index.js.map

package/workflows/organizations/readModel/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AAqEjD,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAQnD;IACC,OAAO,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAClD,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,MAAM,EACZ,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,OAAO,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,KAAK,CAAC,cAAc,EAAE;QACrE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n UpdateOrganizationProfileRequest,\n UpdateOrganizationRosterEntryRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n OrganizationContainerGrantResponse,\n OrganizationContainerGrantsResponse,\n OrganizationDirectoryResponse,\n OrganizationDirectoryUserResponse,\n OrganizationGroupContainerResponse,\n OrganizationGroupContainersResponse,\n OrganizationGroupSummaryResponse,\n OrganizationProfileResponse,\n OrganizationReadModelGroupMemberResponse,\n OrganizationUserDetailResponse,\n} from \"@tearleads/validators/response\";\nimport type { OrganizationGroupPolicyHistory } from \"../policyHistory/policyHistoryReadModel\";\n\nexport type {\n OrganizationGroupPolicyHistory,\n OrganizationGroupPolicyHistoryEntry,\n OrganizationPolicyGrantChange,\n OrganizationPolicyGroupChange,\n OrganizationPolicyHistory,\n OrganizationPolicyHistoryEntry,\n OrganizationPrincipalMemberChange,\n OrganizationPrincipalMemberChangeType,\n OrganizationPrincipalPolicyHistory,\n OrganizationPrincipalPolicyHistoryEntry,\n} from \"../policyHistory/policyHistoryReadModel\";\nexport {\n buildOrganizationGroupPolicyHistory,\n buildOrganizationPolicyHistory,\n} from \"../policyHistory/policyHistoryReadModel\";\n\nexport type OrganizationDirectory = OrganizationDirectoryResponse;\nexport type OrganizationDirectoryUser = OrganizationDirectoryUserResponse;\nexport type OrganizationProfile = OrganizationProfileResponse;\nexport type OrganizationGroupContainer = OrganizationGroupContainerResponse & {\n readonly containerDisplayName: string | null;\n};\nexport type OrganizationContainerGrant = OrganizationContainerGrantResponse & {\n readonly groupName: string | null;\n readonly containerDisplayName: string | null;\n};\nexport interface OrganizationGroupContainers\n extends Omit<OrganizationGroupContainersResponse, \"containers\"> {\n readonly containers: OrganizationGroupContainer[];\n}\nexport interface OrganizationContainerGrants\n extends Omit<OrganizationContainerGrantsResponse, \"grants\"> {\n readonly grants: OrganizationContainerGrant[];\n}\nexport interface OrganizationUserDetail\n extends Omit<OrganizationUserDetailResponse, \"grants\" | \"groups\"> {\n readonly groups: OrganizationGroupSummary[];\n readonly grants: {\n readonly directGrants: OrganizationContainerGrant[];\n readonly groupGrants: OrganizationContainerGrant[];\n };\n}\n/** A projected group member: public keys live in the directory lane only. */\nexport type OrganizationGroupMember = OrganizationReadModelGroupMemberResponse;\nexport interface OrganizationGroupMembers {\n readonly groupId: string;\n readonly members: OrganizationGroupMember[];\n readonly organizationId: string;\n}\nexport type OrganizationGroupSummary = OrganizationGroupSummaryResponse & {\n readonly name: string;\n /**\n * The group's signed name does not open under the metadata key this member\n * holds; only a dishonest admin signs such a name. `name` is then empty, and\n * the group must not be offered for selection by name.\n */\n readonly nameUnreadable: boolean;\n};\nexport interface OrganizationDirectoryAndGroups {\n readonly directory: OrganizationDirectory;\n readonly groups: ReadonlyArray<OrganizationGroupSummary>;\n readonly memberGroupId: string;\n readonly readModelCursor: string;\n}\n\nexport interface OrganizationGroupDetails {\n readonly members: OrganizationGroupMembers | null;\n readonly containers: OrganizationGroupContainers | null;\n readonly policyHistory: OrganizationGroupPolicyHistory | null;\n}\n\ninterface OrganizationReadApi {\n readonly updateOrganizationRosterEntry: (\n organizationId: string,\n userId: string,\n input: UpdateOrganizationRosterEntryRequest,\n ) => Promise<OrganizationDirectoryUserResponse | null>;\n readonly updateOrganizationProfile: (\n organizationId: string,\n input: UpdateOrganizationProfileRequest,\n ) => Promise<OrganizationProfileResponse | null>;\n}\n\nexport async function updateOrganizationRosterEntry(input: {\n readonly apiClient: Pick<\n OrganizationReadApi,\n \"updateOrganizationRosterEntry\"\n >;\n readonly organizationId: string;\n readonly profileDocumentId: string | null;\n readonly userId: string;\n}): Promise<OrganizationDirectoryUser | null> {\n return input.apiClient.updateOrganizationRosterEntry(\n input.organizationId,\n input.userId,\n { profileDocumentId: input.profileDocumentId },\n );\n}\n\nexport async function updateOrganizationProfile(input: {\n readonly apiClient: Pick<OrganizationReadApi, \"updateOrganizationProfile\">;\n readonly organizationId: string;\n readonly profileDocumentId: string | null;\n}): Promise<OrganizationProfileResponse | null> {\n return input.apiClient.updateOrganizationProfile(input.organizationId, {\n profileDocumentId: input.profileDocumentId,\n });\n}\n"]}

package/workflows/organizations/{listLocalOrganizations.d.ts → readModel/listLocalOrganizations.d.ts} RENAMED Viewed

@@ -1,4 +1,4 @@
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
 /**
  * A locally-known organization the user belongs to, derived from its persisted
  * root container. `name` is the decrypted organization-profile display name when

package/workflows/organizations/{listLocalOrganizations.js → readModel/listLocalOrganizations.js} RENAMED Viewed

@@ -1,11 +1,11 @@
-import { readStoredDocumentState } from "../../data/documents/documentKinds.js";
-import { sqlContainerContentsPersistence } from "../../data/persistence/container-contents/containerContentsPersistence.js";
-import { DOCUMENTS_APP_KIND, sqlDocumentsPersistence, } from "../../data/persistence/documents/documentsPersistence.js";
-import { loadOrganizationProfileDocumentIds } from "../../data/persistence/organizations/organizationProfileDocumentPointers.js";
-import { findLocalIdByDocumentId } from "../../data/sqlite/documentPersistence.js";
-import { loadPersistedDocumentContent } from "../documents/historyContent.js";
-import { getOrganizationProfileDocumentLocalId, readOrganizationProfileName, } from "./organizationProfile.js";
-import { deriveOrganizationMetadataContainerSystemSlot } from "./rosterProfileContainer.js";
+import { readStoredDocumentState } from "../../../data/documents/documentKinds.js";
+import { sqlContainerContentsPersistence } from "../../../data/persistence/container-contents/containerContentsPersistence.js";
+import { DOCUMENTS_APP_KIND, sqlDocumentsPersistence, } from "../../../data/persistence/documents/documentsPersistence.js";
+import { loadOrganizationProfileDocumentIds } from "../../../data/persistence/organizations/organizationProfileDocumentPointers.js";
+import { findLocalIdByDocumentId } from "../../../data/sqlite/documentPersistence.js";
+import { loadPersistedDocumentContent } from "../../documents/historyContent.js";
+import { getOrganizationProfileDocumentLocalId, readOrganizationProfileName, } from "../organizationProfile.js";
+import { deriveOrganizationMetadataContainerSystemSlot } from "../rosterProfileContainer.js";
 // Reads and decrypts the `name` field of the organization_profile document
 // persisted under `documentLocalId`, or null if it is absent, empty, or
 // unparseable. A single corrupt profile must not break the whole list, so every

package/workflows/organizations/readModel/listLocalOrganizations.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"listLocalOrganizations.js","sourceRoot":"","sources":["listLocalOrganizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,6EAA6E,CAAC;AACjI,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EACL,qCAAqC,EACrC,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6CAA6C,EAAE,MAAM,2BAA2B,CAAC;AAoB1F,2EAA2E;AAC3E,wEAAwE;AACxE,gFAAgF;AAChF,sDAAsD;AACtD,KAAK,UAAU,gCAAgC,CAC7C,OAAgB,EAChB,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAAC;YAC7C,OAAO;YACP,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,uBAAuB;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,2BAA2B,CAChC,uBAAuB,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,yBAAyB,CACtC,OAAgB,EAChB,cAAsB,EACtB,sBAAkE,EAClE,iBAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,gCAAgC,CACtD,OAAO,EACP,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;IACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,EACP,kBAAkB,EAClB,iBAAiB,CAClB,CAAC;QACF,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,MAAM,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GACtB,MAAM,6CAA6C,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CACnD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,kBAAkB,CAC3D,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GACpB,MAAM,uBAAuB,CAAC,iCAAiC,CAC7D,OAAO,EACP,iBAAiB,CAAC,EAAE,CACrB,CAAC;IACJ,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,gCAAgC,CACjD,OAAO,EACP,eAAe,CAChB,CAAC;QACF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,cAAc,CACrE,KAAK,CAAC,OAAO,CACd,CAAC;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,kCAAkC,GACtC,MAAM,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAC3D,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAChC,CAAC;IAEJ,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAGvC,CAAC;IACJ,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAgC;YACzC,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI;SACzC,CAAC;QACF,MAAM,KAAK,GAAG,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACzD,IACE,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC3B,SAAS,CAAC,UAAU;YACpB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,EAClC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,aAAa,CACjD,KAAK,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CACrC;QACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CACzC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC/B;QACD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CACtD,CAAC;IAEF,gFAAgF;IAChF,2EAA2E;IAC3E,2BAA2B;IAC3B,OAAO,OAAO,CAAC,GAAG,CAChB,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,MAAM,yBAAyB,CACnC,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,cAAc,EACxB,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,EAC9D,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC;YAC9D,IAAI,CACP;QACD,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,eAAe,EAAE,SAAS,CAAC,EAAE;KAC9B,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import { readStoredDocumentState } from \"../../../data/documents/documentKinds\";\nimport { sqlContainerContentsPersistence } from \"../../../data/persistence/container-contents/containerContentsPersistence\";\nimport {\n DOCUMENTS_APP_KIND,\n sqlDocumentsPersistence,\n} from \"../../../data/persistence/documents/documentsPersistence\";\nimport { loadOrganizationProfileDocumentIds } from \"../../../data/persistence/organizations/organizationProfileDocumentPointers\";\nimport { findLocalIdByDocumentId } from \"../../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { loadPersistedDocumentContent } from \"../../documents/historyContent\";\nimport {\n getOrganizationProfileDocumentLocalId,\n readOrganizationProfileName,\n} from \"../organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"../rosterProfileContainer\";\n\n// Just the container fields this module needs to locate an org's metadata\n// container among the locally-persisted containers.\ninterface LocalContainerForNameLookup {\n id: string;\n systemSlot: string | null;\n}\n\n/**\n * A locally-known organization the user belongs to, derived from its persisted\n * root container. `name` is the decrypted organization-profile display name when\n * one is stored locally, or null when it has not synced yet.\n */\nexport interface LocalOrganizationSummary {\n name: string | null;\n organizationId: string;\n rootContainerId: string;\n}\n\n// Reads and decrypts the `name` field of the organization_profile document\n// persisted under `documentLocalId`, or null if it is absent, empty, or\n// unparseable. A single corrupt profile must not break the whole list, so every\n// failure collapses to a null (unnamed) organization.\nasync function readOrganizationNameFromDocument(\n execSql: ExecSql,\n documentLocalId: string,\n): Promise<string | null> {\n try {\n const doc = await loadPersistedDocumentContent({\n execSql,\n localId: documentLocalId,\n persistence: sqlDocumentsPersistence,\n });\n if (!doc) {\n return null;\n }\n\n return readOrganizationProfileName(\n readStoredDocumentState(doc).structuredFields,\n );\n } catch {\n return null;\n }\n}\n\n/**\n * Resolves an organization's decrypted display name from local state.\n *\n * The same organization_profile document is addressed by several different\n * local-id conventions depending on how it arrived, so one lookup by id is not\n * enough:\n *\n * - The org's own **provisioner** (and any admin who later edits the name)\n * writes the document under the deterministic alias\n * `org-profile:<organizationId>` — resolved by the fast path below.\n * - A **device that only synced it** — a member of another org, or this same\n * user's freshly re-hydrated device after an identity restore — never runs\n * that write. The sync ingest keys the document under the server documentId\n * (there is no local alias to reuse — see `upsertDiscoveredDocumentWithExec`),\n * so the alias lookup misses.\n *\n * Two fallbacks cover the synced case, in order of authority:\n *\n * 1. The **organization read model** records the org's `profileDocumentId`.\n * That pointer is container-independent, so it resolves the name wherever\n * the document happens to be linked — including a profile document created\n * by an admin through the org-manager editor rather than by provisioning.\n * 2. Failing that, locate the org's metadata container by its deterministic\n * system slot and read whichever profile document is linked there. Keying on\n * the system slot (rather than the document kind) keeps it correct even\n * before the projected document kind has been rebuilt from a freshly-synced\n * snapshot, and it still works before the read model has been projected.\n */\nasync function readLocalOrganizationName(\n execSql: ExecSql,\n organizationId: string,\n organizationContainers: ReadonlyArray<LocalContainerForNameLookup>,\n profileDocumentId: string | null,\n): Promise<string | null> {\n const aliasName = await readOrganizationNameFromDocument(\n execSql,\n getOrganizationProfileDocumentLocalId({ organizationId }),\n );\n if (aliasName !== null) {\n return aliasName;\n }\n\n if (profileDocumentId) {\n // Reach the row wherever it landed: a device that only synced the document\n // keys it under the server documentId rather than any local alias.\n const syncedLocalId = await findLocalIdByDocumentId(\n execSql,\n DOCUMENTS_APP_KIND,\n profileDocumentId,\n );\n const syncedName = syncedLocalId\n ? await readOrganizationNameFromDocument(execSql, syncedLocalId)\n : null;\n if (syncedName !== null) {\n return syncedName;\n }\n }\n\n const metadataSystemSlot =\n await deriveOrganizationMetadataContainerSystemSlot({ organizationId });\n const metadataContainer = organizationContainers.find(\n (container) => container.systemSlot === metadataSystemSlot,\n );\n if (!metadataContainer) {\n return null;\n }\n\n const documentLocalIds =\n await sqlDocumentsPersistence.findDocumentLocalIdsByContainerId(\n execSql,\n metadataContainer.id,\n );\n for (const documentLocalId of documentLocalIds) {\n const name = await readOrganizationNameFromDocument(\n execSql,\n documentLocalId,\n );\n if (name !== null) {\n return name;\n }\n }\n return null;\n}\n\n/**\n * Enumerates the organizations the user can manage from local state: one per\n * persisted root container. This is intentionally offline — the Explorer already\n * resolves files across organizations by effective permission, so listing the\n * organizations to manage needs no server round-trip.\n */\nexport async function listLocalOrganizations(input: {\n execSql: ExecSql;\n}): Promise<LocalOrganizationSummary[]> {\n const containers = await sqlContainerContentsPersistence.loadContainers(\n input.execSql,\n );\n // A projected read model is not a precondition for listing organizations, so\n // an unreadable one degrades to the container-derived lookups below.\n const profileDocumentIdsByOrganizationId =\n await loadOrganizationProfileDocumentIds(input.execSql).catch(\n () => new Map<string, string>(),\n );\n\n // Group every persisted container by org so name resolution can locate an\n // org's independent metadata root without a second DB scan.\n const containersByOrganizationId = new Map<\n string,\n LocalContainerForNameLookup[]\n >();\n for (const { container } of containers) {\n const entry: LocalContainerForNameLookup = {\n id: container.id,\n systemSlot: container.systemSlot ?? null,\n };\n const group = containersByOrganizationId.get(container.organizationId);\n if (group) {\n group.push(entry);\n } else {\n containersByOrganizationId.set(container.organizationId, [entry]);\n }\n }\n\n const seen = new Set<string>();\n const rootContainers = containers.filter(({ container }) => {\n if (\n container.parentId !== null ||\n container.systemSlot ||\n seen.has(container.organizationId)\n ) {\n return false;\n }\n seen.add(container.organizationId);\n return true;\n });\n rootContainers.sort(\n (left, right) =>\n (left.container.localCreatedAt ?? \"\").localeCompare(\n right.container.localCreatedAt ?? \"\",\n ) ||\n left.container.organizationId.localeCompare(\n right.container.organizationId,\n ) ||\n left.container.id.localeCompare(right.container.id),\n );\n\n // Read each organization's profile name concurrently; readLocalOrganizationName\n // already falls back to null per organization, so a single corrupt profile\n // cannot reject the batch.\n return Promise.all(\n rootContainers.map(async ({ container }) => ({\n name: await readLocalOrganizationName(\n input.execSql,\n container.organizationId,\n containersByOrganizationId.get(container.organizationId) ?? [],\n profileDocumentIdsByOrganizationId.get(container.organizationId) ??\n null,\n ),\n organizationId: container.organizationId,\n rootContainerId: container.id,\n })),\n );\n}\n"]}

package/workflows/organizations/{localReadModelDetails.d.ts → readModel/localReadModelDetails.d.ts} RENAMED Viewed

@@ -1,6 +1,6 @@
-import type { ReferencedPrincipalStateResponse } from "../../internal/validators/response/index.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { OrganizationContainerGrants, OrganizationGroupContainers, OrganizationGroupPolicyHistory, OrganizationPolicyHistory, OrganizationUserDetail } from "./readModel.js";
+import type { ReferencedPrincipalStateResponse } from "../../../internal/validators/response/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { OrganizationContainerGrants, OrganizationGroupContainers, OrganizationGroupPolicyHistory, OrganizationPolicyHistory, OrganizationUserDetail } from "./index.js";
 interface LocalReadModelInput {
     readonly currentUserId: string;
     readonly execSql: ExecSql;

package/workflows/organizations/{localReadModelDetails.js → readModel/localReadModelDetails.js} RENAMED Viewed

@@ -1,10 +1,10 @@
-import { loadContainerDisplayNamesByIds } from "../../data/persistence/containers/containerPersistence.js";
-import { loadOrganizationGroupDisplayNames } from "../../data/persistence/organizations/organizationGroupNamePersistence.js";
-import { loadOrganizationReadModelProjection } from "../../data/persistence/organizations/organizationReadModelPersistence.js";
-import { loadPrincipalPolicyBundle } from "../../data/persistence/principalPolicyPersistence.js";
-import { loadVerifiedOrganizationGroupRoles } from "../../data/principals/organizationGroupRoles.js";
+import { loadContainerDisplayNamesByIds } from "../../../data/persistence/containers/containerPersistence.js";
+import { loadOrganizationGroupDisplayNames } from "../../../data/persistence/organizations/organizationGroupNamePersistence.js";
+import { loadOrganizationReadModelProjection } from "../../../data/persistence/organizations/organizationReadModelPersistence.js";
+import { loadPrincipalPolicyBundle } from "../../../data/persistence/principalPolicyPersistence.js";
+import { loadVerifiedOrganizationGroupRoles } from "../../../data/principals/organizationGroupRoles.js";
+import { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "../policyHistory/policyHistoryReadModel.js";
 import { runOrganizationPresentationRead } from "./organizationPresentationAccessState.js";
-import { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "./policyHistoryReadModel.js";
 const DISPLAY_NAME_BATCH_SIZE = 400;
 function uniqueContainerIds(grants) {
     return [...new Set(grants.map((grant) => grant.containerId))];

package/workflows/organizations/readModel/localReadModelDetails.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"localReadModelDetails.js","sourceRoot":"","sources":["localReadModelDetails.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,2DAA2D,CAAC;AAC3G,OAAO,EAAE,iCAAiC,EAAE,MAAM,0EAA0E,CAAC;AAC7H,OAAO,EAAE,mCAAmC,EAAE,MAAM,0EAA0E,CAAC;AAC/H,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AAErG,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AAUjD,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAUxF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,SAAS,kBAAkB,CACzB,MAAqD;IAErD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,MAAqD,EACrD,cAAsB;IAEtB,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,iCAAiC,CACxD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,kCAAkC,CACzD,OAAO,EACP,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,YAAY,CAAC,MAAM,EAC3B,KAAK,IAAI,uBAAuB,EAChC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAChD,OAAO,EACP,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAAC,CAC3D,CAAC;QACF,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,KAAK;QACR,oBAAoB,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI;QACjE,SAAS,EACP,KAAK,CAAC,WAAW,KAAK,OAAO;YAC3B,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAChC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC/B,IAAI,CAAC;YACP,CAAC,CAAC,IAAI;KACX,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAiC;IAEjC,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAM1B;IACC,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,KAAK;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,MAAM,YAAY,CACxB,KAAK,CAAC,OAAO,EACb,UAAU,CAAC,MAAM,CAAC,MAAM,EACxB,KAAK,CAAC,cAAc,CACrB;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,qBAAqB,GACzB,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,aAAa;YACjD,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAC3C,CAAC;QACJ,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CACrE,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,CACV,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAChE,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,KAAyD;IAEzD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CACvE,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,OAAO,EACP,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,mCAAmC,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,MAA4C,EAC5C,aAQC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,YAAY,CAAC;IACxC,OAAO,OAAO,CACZ,UAAU;QACR,UAAU,CAAC,aAAa,KAAK,aAAa,CAAC,aAAa;QACxD,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW;QACpD,UAAU,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS;QAChD,UAAU,CAAC,OAAO,KAAK,aAAa,CAAC,OAAO;QAC5C,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ;QAC9C,UAAU,CAAC,cAAc,KAAK,aAAa,CAAC,cAAc;QAC1D,UAAU,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW,CACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA0B;IAE1B,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAC/C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,cAAc;YACrC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAC5C,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO,gCAAgC,CAAC,MAAM,EAAE,aAAa,CAAC;YAC5D,CAAC,CAAC,8BAA8B,CAAC,MAAM,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAGC;IAED,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CACtC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC/C,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC9C,CAAC;QACF,OAAO,IAAI;YACT,CAAC,CAAC;gBACE,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAwD;IAExD,OAAO,+BAA+B,CACpC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,EAClD,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC1D,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CACjD,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,eAAe;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC;YAClE,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACpE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;QACF,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI;YACJ,MAAM;YACN,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CACnE;gBACD,WAAW,EAAE,MAAM,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAClE;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n OrganizationContainerGrantResponse,\n PrincipalPolicyBundleResponse,\n ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport { loadContainerDisplayNamesByIds } from \"../../../data/persistence/containers/containerPersistence\";\nimport { loadOrganizationGroupDisplayNames } from \"../../../data/persistence/organizations/organizationGroupNamePersistence\";\nimport { loadOrganizationReadModelProjection } from \"../../../data/persistence/organizations/organizationReadModelPersistence\";\nimport { loadPrincipalPolicyBundle } from \"../../../data/persistence/principalPolicyPersistence\";\nimport { loadVerifiedOrganizationGroupRoles } from \"../../../data/principals/organizationGroupRoles\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n buildOrganizationGroupPolicyHistory,\n buildOrganizationPolicyHistory,\n} from \"../policyHistory/policyHistoryReadModel\";\nimport type {\n OrganizationContainerGrant,\n OrganizationContainerGrants,\n OrganizationGroupContainer,\n OrganizationGroupContainers,\n OrganizationGroupPolicyHistory,\n OrganizationPolicyHistory,\n OrganizationUserDetail,\n} from \"./index\";\nimport { runOrganizationPresentationRead } from \"./organizationPresentationAccessState\";\n\ninterface LocalReadModelInput {\n readonly currentUserId: string;\n readonly execSql: ExecSql;\n readonly organizationId: string;\n}\n\ntype PolicyPrincipalType = ReferencedPrincipalStateResponse[\"principalType\"];\n\nconst DISPLAY_NAME_BATCH_SIZE = 400;\n\nfunction uniqueContainerIds(\n grants: readonly OrganizationContainerGrantResponse[],\n): string[] {\n return [...new Set(grants.map((grant) => grant.containerId))];\n}\n\nasync function enrichGrants(\n execSql: ExecSql,\n grants: readonly OrganizationContainerGrantResponse[],\n organizationId: string,\n): Promise<OrganizationContainerGrant[]> {\n const containerIds = uniqueContainerIds(grants);\n const groupNames = await loadOrganizationGroupDisplayNames(\n execSql,\n organizationId,\n );\n const groupRoles = await loadVerifiedOrganizationGroupRoles(\n execSql,\n organizationId,\n );\n const displayNames = new Map<string, string>();\n for (\n let index = 0;\n index < containerIds.length;\n index += DISPLAY_NAME_BATCH_SIZE\n ) {\n const batch = await loadContainerDisplayNamesByIds(\n execSql,\n containerIds.slice(index, index + DISPLAY_NAME_BATCH_SIZE),\n );\n for (const [containerId, displayName] of batch) {\n displayNames.set(containerId, displayName);\n }\n }\n return grants.map((grant) => ({\n ...grant,\n containerDisplayName: displayNames.get(grant.containerId) ?? null,\n groupName:\n grant.subjectType === \"group\"\n ? (groupRoles.get(grant.subjectId) ??\n groupNames.get(grant.subjectId) ??\n null)\n : null,\n }));\n}\n\nfunction toGroupContainer(\n grant: OrganizationContainerGrant,\n): OrganizationGroupContainer {\n return {\n accessLevel: grant.accessLevel,\n containerId: grant.containerId,\n containerDisplayName: grant.containerDisplayName,\n createdAt: grant.createdAt,\n depth: grant.depth,\n isBuiltin: grant.isBuiltin,\n metadataAccessEpoch: grant.metadataAccessEpoch,\n metadataAccessStateHash: grant.metadataAccessStateHash,\n metadataDocumentId: grant.metadataDocumentId,\n parentId: grant.parentId,\n updatedAt: grant.updatedAt,\n };\n}\n\n/**\n * The groups a user belongs to is exactly the set naming them as a member.\n *\n * This used to be a breadth-first walk over group-in-group edges. Groups\n * contain only users now, so the walk had no second level to visit.\n */\nfunction reachableGroupIds(input: {\n readonly edges: ReadonlyArray<{\n readonly groupId: string;\n readonly userId: string;\n }>;\n readonly userId: string;\n}): Set<string> {\n return new Set(\n input.edges\n .filter((edge) => edge.userId === input.userId)\n .map((edge) => edge.groupId),\n );\n}\n\nexport async function loadLocalOrganizationContainerGrants(\n input: LocalReadModelInput,\n): Promise<OrganizationContainerGrants | null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n return {\n organizationId: input.organizationId,\n grants: await enrichGrants(\n input.execSql,\n projection.grants.grants,\n input.organizationId,\n ),\n };\n },\n );\n}\n\nexport async function loadLocalOrganizationGroupContainers(\n input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupContainers | null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n const groupIsInOrganization =\n input.groupId === projection.groups.memberGroupId ||\n projection.groups.groups.some(\n (group) => group.groupId === input.groupId,\n );\n if (!groupIsInOrganization) {\n return null;\n }\n const grants = projection.grants.grants.filter(\n (grant) =>\n grant.subjectType === \"group\" && grant.subjectId === input.groupId,\n );\n return {\n organizationId: input.organizationId,\n groupId: input.groupId,\n containers: (\n await enrichGrants(input.execSql, grants, input.organizationId)\n ).map(toGroupContainer),\n };\n },\n );\n}\n\nexport async function loadLocalOrganizationGroupPolicyHistory(\n input: LocalReadModelInput & { readonly groupId: string },\n): Promise<OrganizationGroupPolicyHistory | null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n\n const projectedHead = projection.policyHeads.find(\n (head) =>\n head.principalType === \"group\" && head.principalId === input.groupId,\n );\n if (!projectedHead) {\n return null;\n }\n\n const bundle = await loadPrincipalPolicyBundle(\n input.execSql,\n \"group\",\n input.groupId,\n );\n return policyBundleMatchesProjectedHead(bundle, projectedHead)\n ? buildOrganizationGroupPolicyHistory(bundle, input.organizationId)\n : null;\n },\n );\n}\n\nfunction policyBundleMatchesProjectedHead(\n bundle: PrincipalPolicyBundleResponse | null,\n projectedHead: {\n readonly keyEpoch: number;\n readonly keyFingerprint: string;\n readonly memberCount: number;\n readonly principalId: string;\n readonly principalType: PolicyPrincipalType;\n readonly stateHash: string;\n readonly version: number;\n },\n): bundle is PrincipalPolicyBundleResponse {\n const storedHead = bundle?.currentState;\n return Boolean(\n storedHead &&\n storedHead.principalType === projectedHead.principalType &&\n storedHead.principalId === projectedHead.principalId &&\n storedHead.stateHash === projectedHead.stateHash &&\n storedHead.version === projectedHead.version &&\n storedHead.keyEpoch === projectedHead.keyEpoch &&\n storedHead.keyFingerprint === projectedHead.keyFingerprint &&\n storedHead.memberCount === projectedHead.memberCount,\n );\n}\n\nexport async function loadLocalOrganizationPolicyHistory(\n input: LocalReadModelInput,\n): Promise<OrganizationPolicyHistory | null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n const projectedHead = projection.policyHeads.find(\n (head) =>\n head.principalType === \"organization\" &&\n head.principalId === input.organizationId,\n );\n if (!projectedHead) {\n return null;\n }\n const bundle = await loadPrincipalPolicyBundle(\n input.execSql,\n \"organization\",\n input.organizationId,\n );\n return policyBundleMatchesProjectedHead(bundle, projectedHead)\n ? buildOrganizationPolicyHistory(bundle)\n : null;\n },\n );\n}\n\nexport async function loadLocalOrganizationPolicyReference(\n input: LocalReadModelInput & {\n readonly principalId: string;\n readonly principalType: PolicyPrincipalType;\n },\n): Promise<ReferencedPrincipalStateResponse | null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n if (!projection?.requester) {\n return null;\n }\n const head = projection.policyHeads.find(\n (candidate) =>\n candidate.principalType === input.principalType &&\n candidate.principalId === input.principalId,\n );\n return head\n ? {\n principalType: head.principalType,\n principalId: head.principalId,\n stateHash: head.stateHash,\n version: head.version,\n keyEpoch: head.keyEpoch,\n keyFingerprint: head.keyFingerprint,\n }\n : null;\n },\n );\n}\n\nexport async function loadLocalOrganizationUserDetail(\n input: LocalReadModelInput & { readonly userId: string },\n): Promise<OrganizationUserDetail | null> {\n return runOrganizationPresentationRead(\n { ...input, requesterUserId: input.currentUserId },\n \"readModel\",\n async () => {\n const projection = await loadOrganizationReadModelProjection(\n input.execSql,\n input.organizationId,\n input.currentUserId,\n );\n const user = projection?.directory.users.find(\n (candidate) => candidate.userId === input.userId,\n );\n if (!projection?.requester || !user) {\n return null;\n }\n\n const reachable = reachableGroupIds({\n edges: projection.membershipEdges,\n userId: input.userId,\n });\n const groups = projection.groups.groups\n .filter((group) => reachable.has(group.groupId))\n .map((group) => ({ ...group, nameUnreadable: false }));\n const relevantGrants = projection.grants.grants.filter(\n (grant) =>\n (grant.subjectType === \"user\" && grant.subjectId === input.userId) ||\n (grant.subjectType === \"group\" && reachable.has(grant.subjectId)),\n );\n const grants = await enrichGrants(\n input.execSql,\n relevantGrants,\n input.organizationId,\n );\n return {\n organizationId: input.organizationId,\n user,\n groups,\n grants: {\n directGrants: grants.filter(\n (grant) =>\n grant.subjectType === \"user\" && grant.subjectId === input.userId,\n ),\n groupGrants: grants.filter(\n (grant) =>\n grant.subjectType === \"group\" && reachable.has(grant.subjectId),\n ),\n },\n };\n },\n );\n}\n"]}

package/workflows/organizations/{organizationPresentationAccessState.js → readModel/organizationPresentationAccessState.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { hasOrganizationPresentationDenial } from "../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
+import { hasOrganizationPresentationDenial } from "../../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
 const accessByExecutor = new WeakMap();
 export function organizationAccessScopeKey(organizationId, requesterUserId) {
     return JSON.stringify([organizationId, requesterUserId]);