@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/organizations/principalPolicyRequest.d.ts

@@ -1,68 +0,0 @@
-import { type EncapsulationKeyPair, type GroupMetadataKey, type PrincipalContainerGrant, type PrincipalPolicyExternalAuthority, type SigningKeyPair } from "../../internal/crypto/index.js";
-import type { CreateOrganizationGroupRequest, PrincipalMemberEnvelopeRequest, PrincipalProjectionMemberRequest, PutPrincipalPolicyRequest } from "../../internal/validators/request/index.js";
-import type { PrincipalPolicyBundleResponse } from "../../internal/validators/response/index.js";
-interface BuildInitialGroupPolicyInput {
-    readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;
-    readonly externalAuthority?: PrincipalPolicyExternalAuthority["currentHead"] | null;
-    readonly groupId: string;
-    readonly grants?: readonly PrincipalContainerGrant[] | undefined;
-    readonly includeSignerAsAdmin?: boolean;
-    readonly name: string;
-    readonly metadataKey?: GroupMetadataKey;
-    readonly builtinRole?: "admins" | "members";
-    readonly signerUserId: string;
-    readonly signingFingerprint: string;
-    readonly signingKeyPair: SigningKeyPair;
-}
-export declare function userProjectionMember(userId: string, role: "member" | "admin"): PrincipalProjectionMemberRequest;
-/**
- * The comparison key for a group display name: width- and compatibility-
- * normalized, stripped of control, format, and default-ignorable characters,
- * whitespace-collapsed, and case-folded. Two names that a user cannot tell
- * apart in a picker must compare equal, or a look-alike name would slip past
- * the share-time binding. Cross-script homoglyphs (Latin "A" against Greek
- * "Α") are not folded: that needs the UTS #39 confusables table, and both
- * names would still have to be signed groups the organization's own admins
- * created.
- */
-export declare function canonicalGroupNameKey(name: string): string;
-type GroupPolicyNameInput = Pick<PrincipalPolicyBundleResponse, "currentState" | "currentPayload">;
-export type GroupPolicyNameReader = (bundle: GroupPolicyNameInput) => Promise<string>;
-/** Read only after the policy and its organization-directory binding verify. */
-export declare function readGroupPolicyPayloadName(bundle: GroupPolicyNameInput, readEncryptedName?: GroupPolicyNameReader): Promise<string>;
-/** One binding predicate for every operation selected by a read-model label. */
-export declare function groupPolicyNameMismatch(bundle: GroupPolicyNameInput, expectedGroupName: string, readEncryptedName?: GroupPolicyNameReader): Promise<"forbidden_characters" | "name_mismatch" | null>;
-export declare function signedGroupPolicyRequest(input: {
-    readonly currentPolicy?: Pick<PrincipalPolicyBundleResponse, "currentState">;
-    readonly encapsulationPublicKey: string;
-    readonly externalAuthority: PrincipalPolicyExternalAuthority["currentHead"] | null;
-    readonly keyEpoch: number;
-    readonly keyFingerprint: string;
-    readonly grants: ReadonlyArray<PrincipalContainerGrant>;
-    readonly memberEnvelopes: ReadonlyArray<PrincipalMemberEnvelopeRequest>;
-    readonly payloadCiphertext: string;
-    readonly principalId: string;
-    readonly projection: ReadonlyArray<PrincipalProjectionMemberRequest>;
-    readonly signedAt: string;
-    readonly signerUserId: string;
-    readonly signingFingerprint: string;
-    readonly signingKeyPair: SigningKeyPair;
-}): Promise<PutPrincipalPolicyRequest>;
-export declare function buildInitialGroupPolicyRequest(input: BuildInitialGroupPolicyInput): Promise<CreateOrganizationGroupRequest>;
-/**
- * Members at bootstrap holds the registering user alone.
- *
- * It used to also contain the Admins group as a nested member, so that admins
- * were implicitly members. Principals contain only users now, so an admin is an
- * ordinary Members entry — and bootstrap has exactly one user, who is that
- * admin.
- */
-export declare function buildInitialMemberGroupPolicyRequest(input: {
-    readonly creatorEncapsulationKeyPair: EncapsulationKeyPair;
-    readonly groupId: string;
-    readonly grants?: readonly PrincipalContainerGrant[] | undefined;
-    readonly signerUserId: string;
-    readonly signingFingerprint: string;
-    readonly signingKeyPair: SigningKeyPair;
-}): Promise<CreateOrganizationGroupRequest>;
-export {};

package/workflows/organizations/principalPolicyRequest.js

@@ -1,176 +0,0 @@
-import { buildPrincipalStateSigningInput, encodeBuiltinGroupMetadata, encryptGroupMetadata, generateKemSeedAndKeyPair, normalizePrincipalContainerGrants, normalizePrincipalProjectionMembers, readGroupMetadata, signPrincipalState, toFingerprint, wrapDekForRecipients, } from "../../internal/crypto/index.js";
-import { bytesToBase64 } from "../../internal/encoding/index.js";
-export function userProjectionMember(userId, role) {
-    return { userId: userId, role };
-}
-function projectionToStateMembers(projection) {
-    return projection.map((member) => ({ userId: member.userId }));
-}
-/**
- * Code points that must never appear in a group name: control and format
- * characters (bidi overrides, zero-width joiners, newlines), lone surrogates
- * (re-encoded as U+FFFD when signed, so the signed name would no longer match
- * the one sent to the server), and every other default-ignorable code point
- * (Hangul fillers, variation selectors), which render as nothing and would
- * let one name pass for another. A group name is an identifier here, so this
- * deliberately refuses ZWJ emoji sequences as well. One predicate serves the
- * signing-time and the share-time refusal so the two cannot drift.
- */
-function hasForbiddenGroupNameCharacter(name) {
-    return /[\p{Cc}\p{Cf}\p{Cs}\p{Default_Ignorable_Code_Point}]/u.test(name);
-}
-/**
- * The comparison key for a group display name: width- and compatibility-
- * normalized, stripped of control, format, and default-ignorable characters,
- * whitespace-collapsed, and case-folded. Two names that a user cannot tell
- * apart in a picker must compare equal, or a look-alike name would slip past
- * the share-time binding. Cross-script homoglyphs (Latin "A" against Greek
- * "Α") are not folded: that needs the UTS #39 confusables table, and both
- * names would still have to be signed groups the organization's own admins
- * created.
- */
-export function canonicalGroupNameKey(name) {
-    return (name
-        .normalize("NFKC")
-        .replace(/[\p{Cc}\p{Cf}\p{Default_Ignorable_Code_Point}]/gu, "")
-        .replace(/\s+/gu, " ")
-        .trim()
-        .toLocaleLowerCase("en-US")
-        // Case folding can leave the string un-normalized (U+0130 lowercases to
-        // "i" plus a combining dot), so normalize once more after it.
-        .normalize("NFKC"));
-}
-/** Read only after the policy and its organization-directory binding verify. */
-export async function readGroupPolicyPayloadName(bundle, readEncryptedName) {
-    const metadata = readGroupMetadata(bundle.currentPayload.ciphertext);
-    if ("role" in metadata)
-        return metadata.role === "admins" ? "Admins" : "Members";
-    if (!readEncryptedName)
-        throw new Error("Group metadata decryption context is unavailable");
-    return readEncryptedName(bundle);
-}
-/** One binding predicate for every operation selected by a read-model label. */
-export async function groupPolicyNameMismatch(bundle, expectedGroupName, readEncryptedName) {
-    if (hasForbiddenGroupNameCharacter(expectedGroupName)) {
-        return "forbidden_characters";
-    }
-    const signedName = await readGroupPolicyPayloadName(bundle, readEncryptedName);
-    if (hasForbiddenGroupNameCharacter(signedName))
-        return "forbidden_characters";
-    return canonicalGroupNameKey(signedName) ===
-        canonicalGroupNameKey(expectedGroupName)
-        ? null
-        : "name_mismatch";
-}
-export async function signedGroupPolicyRequest(input) {
-    const projection = normalizePrincipalProjectionMembers(input.projection);
-    const grants = normalizePrincipalContainerGrants(input.grants);
-    const payloadCiphertext = input.payloadCiphertext;
-    const state = await signPrincipalState(await buildPrincipalStateSigningInput({
-        principalType: "group",
-        principalId: input.principalId,
-        version: input.currentPolicy
-            ? input.currentPolicy.currentState.version + 1
-            : 1,
-        prevStateHash: input.currentPolicy?.currentState.stateHash ?? null,
-        keyEpoch: input.keyEpoch,
-        encapsulationPublicKey: input.encapsulationPublicKey,
-        keyFingerprint: input.keyFingerprint,
-        members: projectionToStateMembers(projection),
-        memberEnvelopes: [...input.memberEnvelopes],
-        projection,
-        grants,
-        payloadCiphertext,
-        externalAuthority: input.externalAuthority,
-        signedAt: input.signedAt,
-        signerUserId: input.signerUserId,
-        signerUserKeyFingerprint: input.signingFingerprint,
-    }), input.signingKeyPair.signingPrivateKey);
-    return {
-        state,
-        encryptedPayload: {
-            cipherSuite: "aes-256-gcm",
-            ciphertext: payloadCiphertext,
-            ciphertextHash: state.payloadCiphertextHash,
-        },
-        projection,
-        grants,
-        memberEnvelopes: [...input.memberEnvelopes],
-    };
-}
-export async function buildInitialGroupPolicyRequest(input) {
-    const groupKem = generateKemSeedAndKeyPair();
-    const withSigner = input.includeSignerAsAdmin ?? true;
-    const projection = withSigner
-        ? [userProjectionMember(input.signerUserId, "admin")]
-        : [];
-    const memberEnvelopes = [];
-    if (withSigner) {
-        const creatorFingerprint = await toFingerprint(input.creatorEncapsulationKeyPair.publicKey);
-        const [creatorEnvelope] = await wrapDekForRecipients(groupKem.secretKey, [
-            input.creatorEncapsulationKeyPair.publicKey,
-        ]);
-        if (!creatorEnvelope) {
-            throw new Error("Failed to wrap group key for creator");
-        }
-        memberEnvelopes.push({
-            userId: input.signerUserId,
-            memberKeyFingerprint: creatorFingerprint,
-            kemCipherText: bytesToBase64(creatorEnvelope.kemCipherText),
-            wrappedKey: bytesToBase64(creatorEnvelope.wrappedKey),
-        });
-    }
-    const name = input.name.trim();
-    // A name is compared by canonical key but displayed raw, so an invisible
-    // code point would let one signed name render as another. Refuse them
-    // where the name is signed.
-    if (name.length === 0 || hasForbiddenGroupNameCharacter(name)) {
-        throw new Error("Group names must be non-empty and contain no control, format, or surrogate characters");
-    }
-    const payloadCiphertext = input.builtinRole
-        ? encodeBuiltinGroupMetadata(input.builtinRole)
-        : input.metadataKey
-            ? await encryptGroupMetadata({
-                key: input.metadataKey,
-                groupId: input.groupId,
-                name,
-            })
-            : (() => {
-                throw new Error("Group metadata encryption context is unavailable");
-            })();
-    const policyRequest = await signedGroupPolicyRequest({
-        encapsulationPublicKey: bytesToBase64(groupKem.publicKey),
-        externalAuthority: input.externalAuthority ?? null,
-        keyEpoch: 1,
-        keyFingerprint: await toFingerprint(groupKem.publicKey),
-        grants: input.grants ?? [],
-        memberEnvelopes,
-        payloadCiphertext,
-        principalId: input.groupId,
-        projection,
-        signedAt: new Date().toISOString(),
-        signerUserId: input.signerUserId,
-        signingFingerprint: input.signingFingerprint,
-        signingKeyPair: input.signingKeyPair,
-    });
-    return {
-        groupId: input.groupId,
-        initialGroupPolicy: policyRequest,
-    };
-}
-/**
- * Members at bootstrap holds the registering user alone.
- *
- * It used to also contain the Admins group as a nested member, so that admins
- * were implicitly members. Principals contain only users now, so an admin is an
- * ordinary Members entry — and bootstrap has exactly one user, who is that
- * admin.
- */
-export async function buildInitialMemberGroupPolicyRequest(input) {
-    return buildInitialGroupPolicyRequest({
-        ...input,
-        name: "Members",
-        builtinRole: "members",
-    });
-}
-//# sourceMappingURL=principalPolicyRequest.js.map

package/workflows/organizations/readModel.d.ts

@@ -1,70 +0,0 @@
-import type { UpdateOrganizationProfileRequest, UpdateOrganizationRosterEntryRequest } from "../../internal/validators/request/index.js";
-import type { OrganizationContainerGrantResponse, OrganizationContainerGrantsResponse, OrganizationDirectoryResponse, OrganizationDirectoryUserResponse, OrganizationGroupContainerResponse, OrganizationGroupContainersResponse, OrganizationGroupSummaryResponse, OrganizationProfileResponse, OrganizationReadModelGroupMemberResponse, OrganizationUserDetailResponse } from "../../internal/validators/response/index.js";
-import type { OrganizationGroupPolicyHistory } from "./policyHistoryReadModel.js";
-export type { OrganizationGroupPolicyHistory, OrganizationGroupPolicyHistoryEntry, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationPrincipalMemberChange, OrganizationPrincipalMemberChangeType, OrganizationPrincipalPolicyHistory, OrganizationPrincipalPolicyHistoryEntry, } from "./policyHistoryReadModel.js";
-export { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "./policyHistoryReadModel.js";
-export type OrganizationDirectory = OrganizationDirectoryResponse;
-export type OrganizationDirectoryUser = OrganizationDirectoryUserResponse;
-export type OrganizationProfile = OrganizationProfileResponse;
-export type OrganizationGroupContainer = OrganizationGroupContainerResponse & {
-    readonly containerDisplayName: string | null;
-};
-export type OrganizationContainerGrant = OrganizationContainerGrantResponse & {
-    readonly groupName: string | null;
-    readonly containerDisplayName: string | null;
-};
-export interface OrganizationGroupContainers extends Omit<OrganizationGroupContainersResponse, "containers"> {
-    readonly containers: OrganizationGroupContainer[];
-}
-export interface OrganizationContainerGrants extends Omit<OrganizationContainerGrantsResponse, "grants"> {
-    readonly grants: OrganizationContainerGrant[];
-}
-export interface OrganizationUserDetail extends Omit<OrganizationUserDetailResponse, "grants" | "groups"> {
-    readonly groups: OrganizationGroupSummary[];
-    readonly grants: {
-        readonly directGrants: OrganizationContainerGrant[];
-        readonly groupGrants: OrganizationContainerGrant[];
-    };
-}
-/** A projected group member: public keys live in the directory lane only. */
-export type OrganizationGroupMember = OrganizationReadModelGroupMemberResponse;
-export interface OrganizationGroupMembers {
-    readonly groupId: string;
-    readonly members: OrganizationGroupMember[];
-    readonly organizationId: string;
-}
-export type OrganizationGroupSummary = OrganizationGroupSummaryResponse & {
-    readonly name: string;
-    /**
-     * The group's signed name does not open under the metadata key this member
-     * holds; only a dishonest admin signs such a name. `name` is then empty, and
-     * the group must not be offered for selection by name.
-     */
-    readonly nameUnreadable: boolean;
-};
-export interface OrganizationDirectoryAndGroups {
-    readonly directory: OrganizationDirectory;
-    readonly groups: ReadonlyArray<OrganizationGroupSummary>;
-    readonly memberGroupId: string;
-    readonly readModelCursor: string;
-}
-export interface OrganizationGroupDetails {
-    readonly members: OrganizationGroupMembers | null;
-    readonly containers: OrganizationGroupContainers | null;
-    readonly policyHistory: OrganizationGroupPolicyHistory | null;
-}
-interface OrganizationReadApi {
-    readonly updateOrganizationRosterEntry: (organizationId: string, userId: string, input: UpdateOrganizationRosterEntryRequest) => Promise<OrganizationDirectoryUserResponse | null>;
-    readonly updateOrganizationProfile: (organizationId: string, input: UpdateOrganizationProfileRequest) => Promise<OrganizationProfileResponse | null>;
-}
-export declare function updateOrganizationRosterEntry(input: {
-    readonly apiClient: Pick<OrganizationReadApi, "updateOrganizationRosterEntry">;
-    readonly organizationId: string;
-    readonly profileDocumentId: string | null;
-    readonly userId: string;
-}): Promise<OrganizationDirectoryUser | null>;
-export declare function updateOrganizationProfile(input: {
-    readonly apiClient: Pick<OrganizationReadApi, "updateOrganizationProfile">;
-    readonly organizationId: string;
-    readonly profileDocumentId: string | null;
-}): Promise<OrganizationProfileResponse | null>;

package/workflows/organizations/readModel.js

@@ -1,10 +0,0 @@
-export { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "./policyHistoryReadModel.js";
-export async function updateOrganizationRosterEntry(input) {
-    return input.apiClient.updateOrganizationRosterEntry(input.organizationId, input.userId, { profileDocumentId: input.profileDocumentId });
-}
-export async function updateOrganizationProfile(input) {
-    return input.apiClient.updateOrganizationProfile(input.organizationId, {
-        profileDocumentId: input.profileDocumentId,
-    });
-}
-//# sourceMappingURL=readModel.js.map

package/workflows/organizations/readModel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"readModel.js","sourceRoot":"","sources":["readModel.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAqElC,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAQnD;IACC,OAAO,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAClD,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,MAAM,EACZ,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,OAAO,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,KAAK,CAAC,cAAc,EAAE;QACrE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  UpdateOrganizationProfileRequest,\n  UpdateOrganizationRosterEntryRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  OrganizationContainerGrantResponse,\n  OrganizationContainerGrantsResponse,\n  OrganizationDirectoryResponse,\n  OrganizationDirectoryUserResponse,\n  OrganizationGroupContainerResponse,\n  OrganizationGroupContainersResponse,\n  OrganizationGroupSummaryResponse,\n  OrganizationProfileResponse,\n  OrganizationReadModelGroupMemberResponse,\n  OrganizationUserDetailResponse,\n} from \"@tearleads/validators/response\";\nimport type { OrganizationGroupPolicyHistory } from \"./policyHistoryReadModel\";\n\nexport type {\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n} from \"./policyHistoryReadModel\";\nexport {\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationPolicyHistory,\n} from \"./policyHistoryReadModel\";\n\nexport type OrganizationDirectory = OrganizationDirectoryResponse;\nexport type OrganizationDirectoryUser = OrganizationDirectoryUserResponse;\nexport type OrganizationProfile = OrganizationProfileResponse;\nexport type OrganizationGroupContainer = OrganizationGroupContainerResponse & {\n  readonly containerDisplayName: string | null;\n};\nexport type OrganizationContainerGrant = OrganizationContainerGrantResponse & {\n  readonly groupName: string | null;\n  readonly containerDisplayName: string | null;\n};\nexport interface OrganizationGroupContainers\n  extends Omit<OrganizationGroupContainersResponse, \"containers\"> {\n  readonly containers: OrganizationGroupContainer[];\n}\nexport interface OrganizationContainerGrants\n  extends Omit<OrganizationContainerGrantsResponse, \"grants\"> {\n  readonly grants: OrganizationContainerGrant[];\n}\nexport interface OrganizationUserDetail\n  extends Omit<OrganizationUserDetailResponse, \"grants\" | \"groups\"> {\n  readonly groups: OrganizationGroupSummary[];\n  readonly grants: {\n    readonly directGrants: OrganizationContainerGrant[];\n    readonly groupGrants: OrganizationContainerGrant[];\n  };\n}\n/** A projected group member: public keys live in the directory lane only. */\nexport type OrganizationGroupMember = OrganizationReadModelGroupMemberResponse;\nexport interface OrganizationGroupMembers {\n  readonly groupId: string;\n  readonly members: OrganizationGroupMember[];\n  readonly organizationId: string;\n}\nexport type OrganizationGroupSummary = OrganizationGroupSummaryResponse & {\n  readonly name: string;\n  /**\n   * The group's signed name does not open under the metadata key this member\n   * holds; only a dishonest admin signs such a name. `name` is then empty, and\n   * the group must not be offered for selection by name.\n   */\n  readonly nameUnreadable: boolean;\n};\nexport interface OrganizationDirectoryAndGroups {\n  readonly directory: OrganizationDirectory;\n  readonly groups: ReadonlyArray<OrganizationGroupSummary>;\n  readonly memberGroupId: string;\n  readonly readModelCursor: string;\n}\n\nexport interface OrganizationGroupDetails {\n  readonly members: OrganizationGroupMembers | null;\n  readonly containers: OrganizationGroupContainers | null;\n  readonly policyHistory: OrganizationGroupPolicyHistory | null;\n}\n\ninterface OrganizationReadApi {\n  readonly updateOrganizationRosterEntry: (\n    organizationId: string,\n    userId: string,\n    input: UpdateOrganizationRosterEntryRequest,\n  ) => Promise<OrganizationDirectoryUserResponse | null>;\n  readonly updateOrganizationProfile: (\n    organizationId: string,\n    input: UpdateOrganizationProfileRequest,\n  ) => Promise<OrganizationProfileResponse | null>;\n}\n\nexport async function updateOrganizationRosterEntry(input: {\n  readonly apiClient: Pick<\n    OrganizationReadApi,\n    \"updateOrganizationRosterEntry\"\n  >;\n  readonly organizationId: string;\n  readonly profileDocumentId: string | null;\n  readonly userId: string;\n}): Promise<OrganizationDirectoryUser | null> {\n  return input.apiClient.updateOrganizationRosterEntry(\n    input.organizationId,\n    input.userId,\n    { profileDocumentId: input.profileDocumentId },\n  );\n}\n\nexport async function updateOrganizationProfile(input: {\n  readonly apiClient: Pick<OrganizationReadApi, \"updateOrganizationProfile\">;\n  readonly organizationId: string;\n  readonly profileDocumentId: string | null;\n}): Promise<OrganizationProfileResponse | null> {\n  return input.apiClient.updateOrganizationProfile(input.organizationId, {\n    profileDocumentId: input.profileDocumentId,\n  });\n}\n"]}

package/workflows/organizations/readModelProjection.d.ts

@@ -1,29 +0,0 @@
-import type { RequestResult, RequestResultOptions } from "../../internal/api-client/index.js";
-import { type OrganizationReadModelResponse } from "../../internal/validators/response/index.js";
-import { type OrganizationReadModelGroupMembers } from "../../data/persistence/organizations/organizationReadModelMemberLoad.js";
-import type { ExecSql } from "../../data/sqlite/sqlSchema.js";
-import type { OrganizationDirectoryAndGroups } from "./readModel.js";
-interface OrganizationReadModelApi {
-    getOrganizationReadModelResult(organizationId: string, cursor?: string, options?: RequestResultOptions): Promise<RequestResult<OrganizationReadModelResponse>>;
-}
-interface OrganizationReadModelProjectionInput {
-    readonly currentUserId: string;
-    readonly execSql: ExecSql;
-    readonly organizationId: string;
-}
-export interface ReconcileOrganizationDirectoryAndGroupsInput extends OrganizationReadModelProjectionInput {
-    readonly apiClient: OrganizationReadModelApi;
-    readonly logError?: ((message: string | Error, cause?: unknown) => void) | undefined;
-}
-export declare function loadLocalOrganizationDirectoryAndGroups(input: OrganizationReadModelProjectionInput): Promise<OrganizationDirectoryAndGroups | null>;
-export declare function loadLocalOrganizationGroupMembers(input: OrganizationReadModelProjectionInput & {
-    readonly groupId: string;
-}): Promise<OrganizationReadModelGroupMembers | null>;
-/**
- * Resolves the reconciled projection, `null` when the pass completed
- * authoritatively with nothing presentable (including a denial that purged
- * the projection), or `undefined` when the feed failed and no local
- * projection was retained — a pass that must not count as caught up.
- */
-export declare function reconcileOrganizationDirectoryAndGroups(input: ReconcileOrganizationDirectoryAndGroupsInput): Promise<OrganizationDirectoryAndGroups | null | undefined>;
-export {};

package/workflows/organizations/readModelProjection.js

@@ -1,255 +0,0 @@
-import { ORGANIZATION_READ_MODEL_ERROR_CODES, } from "../../internal/validators/response/index.js";
-import { purgeOrganizationAccessProjection } from "../../data/persistence/organizations/organizationAccessRevocationPersistence.js";
-import { recordOrganizationPresentationDenials } from "../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
-import { loadOrganizationReadModelGroupMembers, } from "../../data/persistence/organizations/organizationReadModelMemberLoad.js";
-import { OrganizationReadModelBindingError } from "../../data/persistence/organizations/organizationReadModelMembershipPersistence.js";
-import { applyOrganizationReadModelResponse, loadOrganizationReadModelProjection, purgeOrganizationReadModelProjection, } from "../../data/persistence/organizations/organizationReadModelPersistence.js";
-import { captureOrganizationPresentationAccessAttempt, denyOrganizationPresentationAccess, isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, restoreOrganizationPresentationAccess, runOrganizationPresentationMutation, runOrganizationPresentationRead, } from "./organizationPresentationAccessState.js";
-import { isOrganizationPresentationAccessDeniedFailure } from "./organizationPresentationFailures.js";
-const MAX_READ_MODEL_PAGES = 100;
-const MAX_STALE_RETRIES = 1;
-function toDirectoryAndGroups(projection) {
-    if (!projection?.requester) {
-        return null;
-    }
-    return {
-        directory: {
-            ...projection.directory,
-            currentUser: projection.requester,
-        },
-        // Hydration decides whether a name is unreadable; a stored blank name may
-        // only mean the group has not been hydrated yet.
-        groups: projection.groups.groups.map((group) => ({
-            ...group,
-            nameUnreadable: false,
-        })),
-        memberGroupId: projection.groups.memberGroupId,
-        readModelCursor: projection.cursor,
-    };
-}
-async function loadProjection(input) {
-    return runOrganizationPresentationRead(organizationPresentationAccessInput(input), "readModel", () => loadRawProjection(input));
-}
-function loadRawProjection(input) {
-    return loadOrganizationReadModelProjection(input.execSql, input.organizationId, input.currentUserId);
-}
-function organizationPresentationAccessInput(input) {
-    return {
-        execSql: input.execSql,
-        organizationId: input.organizationId,
-        requesterUserId: input.currentUserId,
-    };
-}
-function localResult(input, state, outcome) {
-    const accessInput = organizationPresentationAccessInput(input);
-    const readable = isOrganizationPresentationAccessAttemptCurrent(accessInput, state.accessAttempt) && isOrganizationPresentationAccessReadable(accessInput, "readModel");
-    if (!readable) {
-        return { kind: "done", value: null };
-    }
-    const value = toDirectoryAndGroups(state.projection);
-    // A failed pass that retained nothing must not read as a completed (null)
-    // pass: consumers mark a scope caught up only on completed passes, and this
-    // scope still needs a fresh catch-up.
-    if (value === null && outcome.failed) {
-        return { kind: "done", value: undefined };
-    }
-    return { kind: "done", value };
-}
-function resetRequestCursor(state) {
-    state.expectedLocalCursor = state.projection?.cursor ?? null;
-    state.requestCursor = state.projection?.cursor ?? undefined;
-}
-function isInvalidReadModelCursorFailure(result) {
-    return (!result.ok &&
-        result.kind === "http" &&
-        result.status === 400 &&
-        result.code === ORGANIZATION_READ_MODEL_ERROR_CODES.cursorInvalid);
-}
-async function requestReadModelPage(input, state) {
-    const result = await input.apiClient.getOrganizationReadModelResult(input.organizationId, state.requestCursor, { reportErrors: false });
-    if (result.ok) {
-        return { kind: "response", response: result.data };
-    }
-    if (isOrganizationPresentationAccessDeniedFailure(result)) {
-        const accessInput = organizationPresentationAccessInput(input);
-        denyOrganizationPresentationAccess(accessInput, ["readModel", "usage"]);
-        // The durable marker lands before the purge attempt: if the purge fails,
-        // an offline restart must still refuse to serve the revoked projection.
-        try {
-            await runOrganizationPresentationMutation(input.execSql, () => recordOrganizationPresentationDenials(accessInput, [
-                "readModel",
-                "usage",
-            ]));
-        }
-        catch (error) {
-            input.logError?.("Failed to record denied organization access", error);
-        }
-        try {
-            await runOrganizationPresentationMutation(input.execSql, () => purgeOrganizationAccessProjection({
-                execSql: input.execSql,
-                organizationId: input.organizationId,
-                requesterUserId: input.currentUserId,
-            }));
-        }
-        catch (error) {
-            input.logError?.("Failed to purge denied organization access", error);
-        }
-        return { kind: "done", value: null };
-    }
-    if (isInvalidReadModelCursorFailure(result) &&
-        state.requestCursor !== undefined &&
-        !state.retriedInvalidCursor) {
-        state.requestCursor = undefined;
-        state.retriedInvalidCursor = true;
-        return { kind: "continue" };
-    }
-    result.report();
-    return localResult(input, state, { failed: true });
-}
-function responseMatchesRequest(input, state, response) {
-    if (response.organizationId !== input.organizationId) {
-        input.logError?.(`Organization read-model response scope does not match ${input.organizationId}`);
-        return false;
-    }
-    if (response.hasMore && response.nextCursor === state.expectedLocalCursor) {
-        input.logError?.("Organization read-model page did not advance its cursor");
-        return false;
-    }
-    return true;
-}
-function reconciliationIsCurrent(input, state) {
-    return isOrganizationPresentationAccessAttemptCurrent(organizationPresentationAccessInput(input), state.accessAttempt);
-}
-async function applyResponse(input, state, response) {
-    try {
-        return {
-            kind: "applied",
-            result: await applyOrganizationReadModelResponse({
-                currentUserId: input.currentUserId,
-                execSql: input.execSql,
-                requestedCursor: state.expectedLocalCursor,
-                response,
-            }),
-        };
-    }
-    catch (error) {
-        input.logError?.("Failed to apply organization read-model response", error);
-        if (!(error instanceof OrganizationReadModelBindingError) ||
-            state.retriedBindingFailure) {
-            return localResult(input, state, { failed: true });
-        }
-        state.retriedBindingFailure = true;
-        await purgeOrganizationReadModelProjection(input.execSql, input.organizationId);
-        if (!reconciliationIsCurrent(input, state)) {
-            return { kind: "done", value: null };
-        }
-        state.projection = null;
-        resetRequestCursor(state);
-        return { kind: "continue" };
-    }
-}
-async function prepareDeniedProjectionForApply(input, state) {
-    if (state.preparedDeniedProjection) {
-        return null;
-    }
-    try {
-        // The apply that follows replaces the shared rows authoritatively, so
-        // only this requester's row is dropped: another local identity sharing
-        // the database keeps its access and reads the replacement.
-        await purgeOrganizationReadModelProjection(input.execSql, input.organizationId, { onlyRequesterUserId: input.currentUserId });
-    }
-    catch (error) {
-        input.logError?.("Failed to replace denied organization read model", error);
-        return { kind: "done", value: null };
-    }
-    if (!reconciliationIsCurrent(input, state)) {
-        return { kind: "done", value: null };
-    }
-    state.expectedLocalCursor = null;
-    state.preparedDeniedProjection = true;
-    state.projection = null;
-    return null;
-}
-async function applyReadModelPage(input, state, response) {
-    if (!responseMatchesRequest(input, state, response)) {
-        return localResult(input, state, { failed: true });
-    }
-    const accessInput = organizationPresentationAccessInput(input);
-    return runOrganizationPresentationMutation(input.execSql, async () => {
-        if (!reconciliationIsCurrent(input, state)) {
-            return { kind: "done", value: null };
-        }
-        const preparation = await prepareDeniedProjectionForApply(input, state);
-        if (preparation) {
-            return preparation;
-        }
-        const applied = await applyResponse(input, state, response);
-        if (applied.kind !== "applied") {
-            return applied;
-        }
-        state.projection = await loadRawProjection(input);
-        if (!reconciliationIsCurrent(input, state)) {
-            return { kind: "done", value: null };
-        }
-        if (applied.result === "stale") {
-            if (state.staleRetries >= MAX_STALE_RETRIES) {
-                return localResult(input, state, { failed: true });
-            }
-            state.staleRetries += 1;
-            resetRequestCursor(state);
-            return { kind: "continue" };
-        }
-        state.expectedLocalCursor = state.projection?.cursor ?? response.nextCursor;
-        if (!response.hasMore) {
-            return restoreOrganizationPresentationAccess(accessInput, state.accessAttempt)
-                ? localResult(input, state, { failed: false })
-                : { kind: "done", value: null };
-        }
-        state.requestCursor = response.nextCursor;
-        return { kind: "continue" };
-    });
-}
-export async function loadLocalOrganizationDirectoryAndGroups(input) {
-    return toDirectoryAndGroups(await loadProjection(input));
-}
-export async function loadLocalOrganizationGroupMembers(input) {
-    return runOrganizationPresentationRead(organizationPresentationAccessInput(input), "readModel", () => loadOrganizationReadModelGroupMembers(input.execSql, input.organizationId, input.groupId, input.currentUserId));
-}
-/**
- * Resolves the reconciled projection, `null` when the pass completed
- * authoritatively with nothing presentable (including a denial that purged
- * the projection), or `undefined` when the feed failed and no local
- * projection was retained — a pass that must not count as caught up.
- */
-export async function reconcileOrganizationDirectoryAndGroups(input) {
-    const accessInput = organizationPresentationAccessInput(input);
-    const accessAttempt = captureOrganizationPresentationAccessAttempt(accessInput, "readModel");
-    const state = {
-        accessAttempt,
-        expectedLocalCursor: null,
-        preparedDeniedProjection: !accessAttempt.startedDenied,
-        projection: await loadProjection(input),
-        requestCursor: undefined,
-        retriedBindingFailure: false,
-        retriedInvalidCursor: false,
-        staleRetries: 0,
-    };
-    resetRequestCursor(state);
-    for (let page = 0; page < MAX_READ_MODEL_PAGES; page += 1) {
-        const request = await requestReadModelPage(input, state);
-        if (request.kind === "done") {
-            return request.value;
-        }
-        if (request.kind === "continue") {
-            continue;
-        }
-        const applied = await applyReadModelPage(input, state, request.response);
-        if (applied.kind === "done") {
-            return applied.value;
-        }
-    }
-    input.logError?.("Organization read-model reconciliation exceeded page limit");
-    const retained = localResult(input, state, { failed: true });
-    return retained.kind === "done" ? retained.value : null;
-}
-//# sourceMappingURL=readModelProjection.js.map