@tearleads/client-sdk 0.1.62 → 0.1.64

package/workflows/organizations/provisioning/organizationProvisioningAttempt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationProvisioningAttempt.js","sourceRoot":"","sources":["organizationProvisioningAttempt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAEL,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,sCAAsC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,6CAA6C,EAAE,MAAM,oFAAoF,CAAC;AAKnJ,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAG/D,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAQnD,SAAS,8BAA8B,CAAC,KAOvC;IACC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,SAAS,CAAC,wBAAwB;YACpC,CAAC,CAAC,EAAE,wBAAwB,EAAE,SAAS,CAAC,wBAAwB,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;QAClE,6BAA6B,EAC3B,SAAS,CAAC,sBAAsB,CAAC,gBAAgB;QACnD,4BAA4B,EAC1B,SAAS,CAAC,sBAAsB,CAAC,sBAAsB;QACzD,oCAAoC,EAClC,SAAS,CAAC,6BAA6B,CAAC,gBAAgB;QAC1D,kCAAkC,EAChC,SAAS,CAAC,6BAA6B;aACpC,kCAAkC;QACvC,uBAAuB,EAAE,SAAS,CAAC,yBAAyB,CAAC,GAAG,CAC9D,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,gBAAgB,CACtD;QACD,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,yBAAyB;YACjC,CAAC,CAAC,EAAE,yBAAyB,EAAE,IAAa,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,sBAAsB;YAC9B,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,EAAE;YAC1D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAAC,KAIpE;IACC,MAAM,MAAM,GAAG,MAAM,6CAA6C,CAAC,IAAI,CACrE,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC7C,SAAS;QACT,mBAAmB,EAAE,IAAI;QACzB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,IACE,SAAS,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAClD,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAChD,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe;QAClD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,SAA4C;IACtE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE;QACxD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,GAAW;IAC5D,OAAO,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,KAA8B,EAAE,GAAW;IAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,UAAU,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,CACL,aAAa,CAAC,KAAK,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;QAC7B,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,CACL,aAAa,CAAC,KAAK,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;QAC/B,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAA8B;IAC/D,OAAO,CACL,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,QAAQ;QACrD,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;QACvE,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC;QACjD,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,SAAS,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC,CAC1C,KAAc;IAEd,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IACzE,OAAO,CACL,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,0BAA0B,CAAC,KAAK,IAAI;QACtD,sCAAsC,CACpC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAC/C,CAAC;QACJ,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,QAAQ;QACxD,aAAa,CAAC,SAAS,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,CAAC,KAAK,QAAQ;QAChE,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACrC,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACtC,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC;QAC7C,SAAS,CAAC,KAAK,EAAE,sBAAsB,CAAC;QACxC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;QAClE,SAAS,CAAC,KAAK,EAAE,6BAA6B,CAAC;QAC/C,aAAa,CAAC,MAAM,CAAC;QACrB,yBAAyB,CAAC,MAAM,CAAC;QACjC,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAC9D,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;QAChD,SAAS,CAAC,MAAM,EAAE,wBAAwB,CAAC;QAC3C,aAAa,CAAC,QAAQ,CAAC;QACvB,yBAAyB,CAAC,QAAQ,CAAC;QACnC,sBAAsB,CACpB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CACrD;QACD,SAAS,CAAC,QAAQ,EAAE,oCAAoC,CAAC;QACzD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,6BAA6B,CAAC,KAAK,QAAQ;QACxE,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC/B,gBAAgB,CAAC,KAAK,CACpB,CAAC,SAAS,EAAE,EAAE,CACZ,aAAa,CAAC,SAAS,CAAC,IAAI,yBAAyB,CAAC,SAAS,CAAC,CACnE,CACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAa;IAEb,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAkB,EAAE,EAAE;QACrE,IACE,OAAO,SAAS,KAAK,QAAQ;YAC7B,SAAS,KAAK,IAAI;YAClB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;YACnC,WAAW,IAAI,SAAS,EACxB,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,mCAAmC,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,KAQhE;IACC,MAAM,UAAU,GACd,KAAK,CAAC,sBAAsB;QAC5B,CAAC,KAAK,CAAC,yBAAyB;YAC9B,CAAC,CAAC,+BAA+B,KAAK,CAAC,MAAM,EAAE;YAC/C,CAAC,CAAC,IAAI,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,8BAA8B,CAAC,KAAK,CAAC;YAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,6CAA6C,CAAC,UAAU,CAC3E,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B;QACE,sBAAsB,EAAE,UAAU;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,cAAc;QAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,mBAAmB,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC;KACzD,EACD,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC7C,SAAS;QACT,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,IACE,SAAS,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAClD,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAChD,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe;QAClD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kDAAkD,CAAC,KAKxE;IACC,MAAM,UAAU,GAAG,+BAA+B,KAAK,CAAC,MAAM,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,6CAA6C,CAAC,IAAI,CACrE,OAAO,EACP,UAAU,CACX,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IACE,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC9B,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,qCAAqC,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,UAAU;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAM3D;IACC,OAAO,6CAA6C,CAAC,MAAM,CACzD,KAAK,CAAC,OAAO,EACb,KAAK,EACL,KAAK,CAAC,SAAS,CAChB,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport {\n  type CreateOrganizationRequest,\n  isCreateOrganizationRequest,\n} from \"@tearleads/validators/request\";\nimport { isOrganizationReplacementAuthorization } from \"@tearleads/validators/util\";\nimport { sqlOrganizationProvisioningAttemptPersistence } from \"../../../data/persistence/organizations/organizationProvisioningAttemptPersistence\";\nimport type {\n  ExecSql,\n  ExecSqlClientLike,\n} from \"../../../data/sqlite/sqlSchema\";\nimport { createExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { OrganizationProvisioningArtifacts } from \"../../registration/registerIdentity\";\n\nconst BYTE_MARKER = \"__tearleadsProvisioningBytes\";\n\ninterface DurableOrganizationProvisioningAttempt {\n  readonly artifacts: OrganizationProvisioningArtifacts;\n  readonly request: CreateOrganizationRequest;\n  readonly rootContainerId: string;\n}\n\nfunction buildCreateOrganizationRequest(input: {\n  artifacts: OrganizationProvisioningArtifacts;\n  finalizeReplacement?: boolean | undefined;\n  nativeSubscriptionRestore?: boolean | undefined;\n  replacesOrganizationId?: string | undefined;\n  rootContainerId: string;\n  userId: string;\n}): CreateOrganizationRequest {\n  const { artifacts } = input;\n  return {\n    userId: input.userId,\n    ...(artifacts.replacementAuthorization\n      ? { replacementAuthorization: artifacts.replacementAuthorization }\n      : {}),\n    organizationId: artifacts.organizationId,\n    rootContainerId: input.rootContainerId,\n    initialAdminGroup: artifacts.initialAdminGroup,\n    initialMemberGroup: artifacts.initialMemberGroup,\n    initialOrganizationPolicy: artifacts.initialOrganizationPolicy,\n    initialRootContainer: artifacts.initialRootContainer,\n    initialRootMetadataDocument: artifacts.rootMetadataDocumentRequest,\n    initialRosterProfileContainer:\n      artifacts.rosterProfileBootstrap.containerRequest,\n    initialRosterProfileDocument:\n      artifacts.rosterProfileBootstrap.profileDocumentRequest,\n    initialOrganizationMetadataContainer:\n      artifacts.organizationMetadataBootstrap.containerRequest,\n    initialOrganizationProfileDocument:\n      artifacts.organizationMetadataBootstrap\n        .organizationProfileDocumentRequest,\n    initialSystemContainers: artifacts.systemContainerBootstraps.map(\n      (systemContainer) => systemContainer.containerRequest,\n    ),\n    ...(input.finalizeReplacement ? { finalizeReplacement: true } : {}),\n    ...(input.nativeSubscriptionRestore\n      ? { nativeSubscriptionRestore: true as const }\n      : {}),\n    ...(input.replacesOrganizationId\n      ? { replacesOrganizationId: input.replacesOrganizationId }\n      : {}),\n  };\n}\n\nexport async function loadOrganizationReplacementFinalizationRequest(input: {\n  execSql: ExecSql;\n  replacedOrganizationId: string;\n  userId: string;\n}): Promise<CreateOrganizationRequest> {\n  const stored = await sqlOrganizationProvisioningAttemptPersistence.load(\n    input.execSql,\n    input.replacedOrganizationId,\n  );\n  if (!stored) {\n    throw new Error(\"Organization replacement attempt is unavailable\");\n  }\n  if (stored.userId !== input.userId) {\n    throw new Error(\n      \"Stored organization provisioning attempt belongs to another user\",\n    );\n  }\n  const artifacts = deserializeArtifacts(stored.serializedArtifacts);\n  const request = buildCreateOrganizationRequest({\n    artifacts,\n    finalizeReplacement: true,\n    replacesOrganizationId: input.replacedOrganizationId,\n    rootContainerId: stored.rootContainerId,\n    userId: stored.userId,\n  });\n  if (\n    artifacts.organizationId !== stored.organizationId ||\n    request.organizationId !== stored.organizationId ||\n    request.rootContainerId !== stored.rootContainerId ||\n    !isCreateOrganizationRequest(request)\n  ) {\n    throw new Error(\"Stored organization provisioning attempt is inconsistent\");\n  }\n  return request;\n}\n\nfunction serializeArtifacts(artifacts: OrganizationProvisioningArtifacts) {\n  return JSON.stringify(artifacts, (_key, value: unknown) => {\n    if (value instanceof Uint8Array) {\n      return { [BYTE_MARKER]: bytesToBase64(value) };\n    }\n    return value;\n  });\n}\n\nfunction hasRecord(value: Record<string, unknown>, key: string): boolean {\n  return isPlainObject(Reflect.get(value, key));\n}\n\nfunction hasBytes(value: Record<string, unknown>, key: string): boolean {\n  return Reflect.get(value, key) instanceof Uint8Array;\n}\n\nfunction isMaterializedDocument(value: unknown): boolean {\n  return (\n    isPlainObject(value) &&\n    hasBytes(value, \"contentKey\") &&\n    hasRecord(value, \"plan\")\n  );\n}\n\nfunction isMaterializedContainer(value: unknown): boolean {\n  return (\n    isPlainObject(value) &&\n    hasBytes(value, \"containerKey\") &&\n    hasRecord(value, \"plan\")\n  );\n}\n\nfunction hasContainerBootstrapCore(value: Record<string, unknown>): boolean {\n  return (\n    typeof Reflect.get(value, \"containerId\") === \"string\" &&\n    isMaterializedDocument(Reflect.get(value, \"containerMetadataDocument\")) &&\n    hasBytes(value, \"containerMetadataInitialUpdate\") &&\n    isMaterializedContainer(Reflect.get(value, \"containerPlan\")) &&\n    hasRecord(value, \"containerRequest\") &&\n    Reflect.get(value, \"systemSlot\") !== undefined\n  );\n}\n\nfunction isOrganizationProvisioningArtifacts(\n  value: unknown,\n): value is OrganizationProvisioningArtifacts {\n  if (!isPlainObject(value)) return false;\n  const bootstrap = Reflect.get(value, \"bootstrap\");\n  const roster = Reflect.get(value, \"rosterProfileBootstrap\");\n  const metadata = Reflect.get(value, \"organizationMetadataBootstrap\");\n  const systemContainers = Reflect.get(value, \"systemContainerBootstraps\");\n  return (\n    (Reflect.get(value, \"replacementAuthorization\") === null ||\n      isOrganizationReplacementAuthorization(\n        Reflect.get(value, \"replacementAuthorization\"),\n      )) &&\n    typeof Reflect.get(value, \"organizationId\") === \"string\" &&\n    isPlainObject(bootstrap) &&\n    hasBytes(bootstrap, \"initialUpdate\") &&\n    typeof Reflect.get(bootstrap, \"metadataDocumentId\") === \"string\" &&\n    hasRecord(value, \"initialAdminGroup\") &&\n    hasRecord(value, \"initialMemberGroup\") &&\n    hasRecord(value, \"initialOrganizationPolicy\") &&\n    hasRecord(value, \"initialRootContainer\") &&\n    isMaterializedContainer(Reflect.get(value, \"rootContainer\")) &&\n    isMaterializedDocument(Reflect.get(value, \"rootMetadataDocument\")) &&\n    hasRecord(value, \"rootMetadataDocumentRequest\") &&\n    isPlainObject(roster) &&\n    hasContainerBootstrapCore(roster) &&\n    isMaterializedDocument(Reflect.get(roster, \"profileDocument\")) &&\n    hasBytes(roster, \"profileDocumentInitialUpdate\") &&\n    hasRecord(roster, \"profileDocumentRequest\") &&\n    isPlainObject(metadata) &&\n    hasContainerBootstrapCore(metadata) &&\n    isMaterializedDocument(\n      Reflect.get(metadata, \"organizationProfileDocument\"),\n    ) &&\n    hasRecord(metadata, \"organizationProfileDocumentRequest\") &&\n    typeof Reflect.get(metadata, \"organizationProfileSnapshot\") === \"string\" &&\n    Array.isArray(systemContainers) &&\n    systemContainers.every(\n      (container) =>\n        isPlainObject(container) && hasContainerBootstrapCore(container),\n    )\n  );\n}\n\nfunction deserializeArtifacts(\n  value: string,\n): OrganizationProvisioningArtifacts {\n  const parsed: unknown = JSON.parse(value, (_key, candidate: unknown) => {\n    if (\n      typeof candidate === \"object\" &&\n      candidate !== null &&\n      Object.keys(candidate).length === 1 &&\n      BYTE_MARKER in candidate\n    ) {\n      const encoded = Reflect.get(candidate, BYTE_MARKER);\n      if (typeof encoded === \"string\") {\n        return base64ToBytes(encoded);\n      }\n    }\n    return candidate;\n  });\n  if (!isOrganizationProvisioningArtifacts(parsed)) {\n    throw new Error(\"Stored organization provisioning attempt is invalid\");\n  }\n  return parsed;\n}\n\nexport async function makeOrganizationProvisioningAttemptDurable(input: {\n  artifacts: OrganizationProvisioningArtifacts;\n  canStartDurableMutation?: (() => boolean) | undefined;\n  dbClient: ExecSqlClientLike;\n  nativeSubscriptionRestore?: boolean | undefined;\n  replacesOrganizationId?: string | undefined;\n  rootContainerId: string;\n  userId: string;\n}): Promise<DurableOrganizationProvisioningAttempt | null> {\n  const attemptKey =\n    input.replacesOrganizationId ??\n    (input.nativeSubscriptionRestore\n      ? `native-subscription-restore:${input.userId}`\n      : null);\n  if (!attemptKey) {\n    return {\n      artifacts: input.artifacts,\n      request: buildCreateOrganizationRequest(input),\n      rootContainerId: input.rootContainerId,\n    };\n  }\n  const stored = await sqlOrganizationProvisioningAttemptPersistence.loadOrSave(\n    createExecSql(input.dbClient),\n    {\n      replacedOrganizationId: attemptKey,\n      userId: input.userId,\n      organizationId: input.artifacts.organizationId,\n      rootContainerId: input.rootContainerId,\n      serializedArtifacts: serializeArtifacts(input.artifacts),\n    },\n    input.canStartDurableMutation,\n  );\n  if (!stored) return null;\n  if (stored.userId !== input.userId) {\n    throw new Error(\n      \"Stored organization provisioning attempt belongs to another user\",\n    );\n  }\n  const artifacts = deserializeArtifacts(stored.serializedArtifacts);\n  const request = buildCreateOrganizationRequest({\n    artifacts,\n    nativeSubscriptionRestore: input.nativeSubscriptionRestore,\n    replacesOrganizationId: input.replacesOrganizationId,\n    rootContainerId: stored.rootContainerId,\n    userId: stored.userId,\n  });\n  if (\n    artifacts.organizationId !== stored.organizationId ||\n    request.organizationId !== stored.organizationId ||\n    request.rootContainerId !== stored.rootContainerId ||\n    !isCreateOrganizationRequest(request)\n  ) {\n    throw new Error(\"Stored organization provisioning attempt is inconsistent\");\n  }\n  return { artifacts, request, rootContainerId: stored.rootContainerId };\n}\n\nexport async function removeNativeSubscriptionRestoreProvisioningAttempt(input: {\n  canCommit?: (() => boolean) | undefined;\n  dbClient: ExecSqlClientLike;\n  organizationId: string;\n  userId: string;\n}): Promise<boolean> {\n  const attemptKey = `native-subscription-restore:${input.userId}`;\n  const execSql = createExecSql(input.dbClient);\n  const stored = await sqlOrganizationProvisioningAttemptPersistence.load(\n    execSql,\n    attemptKey,\n  );\n  if (!stored) return true;\n  if (\n    stored.userId !== input.userId ||\n    stored.organizationId !== input.organizationId\n  ) {\n    throw new Error(\n      \"Stored native restore organization provisioning attempt is inconsistent\",\n    );\n  }\n  return removeOrganizationProvisioningAttempt({\n    canCommit: input.canCommit,\n    execSql,\n    organizationId: input.organizationId,\n    replacedOrganizationId: attemptKey,\n    userId: input.userId,\n  });\n}\n\nexport async function removeOrganizationProvisioningAttempt(input: {\n  canCommit?: (() => boolean) | undefined;\n  execSql: ExecSql;\n  organizationId?: string | undefined;\n  replacedOrganizationId: string;\n  userId: string;\n}): Promise<boolean> {\n  return sqlOrganizationProvisioningAttemptPersistence.remove(\n    input.execSql,\n    input,\n    input.canCommit,\n  );\n}\n"]}

package/workflows/organizations/provisioning/organizationReplacementVerification.js

@@ -0,0 +1,26 @@
+import { KeyingVerificationError, verifyOrganizationReplacementAuthorization, } from "../../../internal/crypto/index.js";
+import { persistOrganizationReplacementCheckpoints } from "../../../data/persistence/organizationReplacementCheckpointPersistence.js";
+/** The API's user/organization echoes are not authority to rehome local data. */
+export function verifyOrganizationReplacementResponse(input) {
+    const { response } = input;
+    const authorization = verifyOrganizationReplacementAuthorization(response.replacementAuthorization, input.signingPublicKey);
+    if (authorization.replacesOrganizationId !== input.replacesOrganizationId ||
+        authorization.userId !== input.userId ||
+        response.userId !== input.userId ||
+        authorization.organizationId !== response.organizationId ||
+        authorization.rootContainerId !== response.rootContainerId ||
+        authorization.rootManifestHash !== response.rootMetadataAccessStateHash ||
+        authorization.rootMetadataDocumentId !== response.rootMetadataDocumentId ||
+        response.rootMetadataAccessEpoch !== 1) {
+        throw new KeyingVerificationError("object_mismatch", "Organization replacement response does not match its signed authorization");
+    }
+    return authorization;
+}
+export async function pinOrganizationReplacementResponse(input) {
+    return persistOrganizationReplacementCheckpoints({
+        authorization: verifyOrganizationReplacementResponse(input),
+        execSql: input.execSql,
+        stillCurrent: input.stillCurrent,
+    });
+}
+//# sourceMappingURL=organizationReplacementVerification.js.map

package/workflows/organizations/provisioning/organizationReplacementVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReplacementVerification.js","sourceRoot":"","sources":["organizationReplacementVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,0CAA0C,GAC3C,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yCAAyC,EAAE,MAAM,wEAAwE,CAAC;AAGnI,iFAAiF;AACjF,MAAM,UAAU,qCAAqC,CAAC,KAKrD;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,aAAa,GAAG,0CAA0C,CAC9D,QAAQ,CAAC,wBAAwB,EACjC,KAAK,CAAC,gBAAgB,CACvB,CAAC;IACF,IACE,aAAa,CAAC,sBAAsB,KAAK,KAAK,CAAC,sBAAsB;QACrE,aAAa,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QACrC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAChC,aAAa,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QACxD,aAAa,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QAC1D,aAAa,CAAC,gBAAgB,KAAK,QAAQ,CAAC,2BAA2B;QACvE,aAAa,CAAC,sBAAsB,KAAK,QAAQ,CAAC,sBAAsB;QACxE,QAAQ,CAAC,uBAAuB,KAAK,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAGC;IAED,OAAO,yCAAyC,CAAC;QAC/C,aAAa,EAAE,qCAAqC,CAAC,KAAK,CAAC;QAC3D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  KeyingVerificationError,\n  type VerifiedOrganizationReplacementAuthorization,\n  verifyOrganizationReplacementAuthorization,\n} from \"@tearleads/crypto\";\nimport type { CreateOrganizationResponse } from \"@tearleads/validators/response\";\nimport { persistOrganizationReplacementCheckpoints } from \"../../../data/persistence/organizationReplacementCheckpointPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\n\n/** The API's user/organization echoes are not authority to rehome local data. */\nexport function verifyOrganizationReplacementResponse(input: {\n  readonly replacesOrganizationId: string;\n  readonly response: CreateOrganizationResponse;\n  readonly signingPublicKey: Uint8Array;\n  readonly userId: string;\n}): VerifiedOrganizationReplacementAuthorization {\n  const { response } = input;\n  const authorization = verifyOrganizationReplacementAuthorization(\n    response.replacementAuthorization,\n    input.signingPublicKey,\n  );\n  if (\n    authorization.replacesOrganizationId !== input.replacesOrganizationId ||\n    authorization.userId !== input.userId ||\n    response.userId !== input.userId ||\n    authorization.organizationId !== response.organizationId ||\n    authorization.rootContainerId !== response.rootContainerId ||\n    authorization.rootManifestHash !== response.rootMetadataAccessStateHash ||\n    authorization.rootMetadataDocumentId !== response.rootMetadataDocumentId ||\n    response.rootMetadataAccessEpoch !== 1\n  ) {\n    throw new KeyingVerificationError(\n      \"object_mismatch\",\n      \"Organization replacement response does not match its signed authorization\",\n    );\n  }\n  return authorization;\n}\n\nexport async function pinOrganizationReplacementResponse(\n  input: Parameters<typeof verifyOrganizationReplacementResponse>[0] & {\n    readonly execSql: ExecSql;\n    readonly stillCurrent?: (() => boolean) | undefined;\n  },\n): Promise<boolean> {\n  return persistOrganizationReplacementCheckpoints({\n    authorization: verifyOrganizationReplacementResponse(input),\n    execSql: input.execSql,\n    stillCurrent: input.stillCurrent,\n  });\n}\n"]}

package/workflows/organizations/readModel/dataUsageReadModel.d.ts

@@ -0,0 +1,19 @@
+import type { RequestResult, RequestResultOptions } from "../../../internal/api-client/index.js";
+import type { OrganizationDataUsageResponse } from "../../../internal/validators/response/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+export type OrganizationDataUsage = OrganizationDataUsageResponse;
+interface OrganizationDataUsageApi {
+    getOrganizationDataUsageResult(organizationId: string, options?: RequestResultOptions): Promise<RequestResult<OrganizationDataUsageResponse>>;
+}
+interface OrganizationDataUsageProjectionInput {
+    readonly execSql: ExecSql;
+    readonly organizationId: string;
+    readonly requesterUserId: string;
+}
+export interface ReconcileOrganizationDataUsageInput extends OrganizationDataUsageProjectionInput {
+    readonly apiClient: OrganizationDataUsageApi;
+    readonly logError?: ((message: string | Error, cause?: unknown) => void) | undefined;
+}
+export declare function loadLocalOrganizationDataUsage(input: OrganizationDataUsageProjectionInput): Promise<OrganizationDataUsage | null>;
+export declare function reconcileOrganizationDataUsage(input: ReconcileOrganizationDataUsageInput): Promise<OrganizationDataUsage | null>;
+export {};

package/workflows/organizations/readModel/dataUsageReadModel.js

@@ -0,0 +1,64 @@
+import { loadOrganizationDataUsageProjection, purgeOrganizationDataUsageProjection, saveOrganizationDataUsageProjection, } from "../../../data/persistence/organizations/organizationDataUsagePersistence.js";
+import { recordOrganizationPresentationDenials } from "../../../data/persistence/organizations/organizationPresentationDenialPersistence.js";
+import { captureOrganizationPresentationAccessAttempt, denyOrganizationPresentationAccess, isOrganizationPresentationAccessAttemptCurrent, isOrganizationPresentationAccessReadable, restoreOrganizationPresentationAccess, runOrganizationPresentationMutation, runOrganizationPresentationRead, } from "./organizationPresentationAccessState.js";
+import { isOrganizationPresentationAccessDeniedFailure } from "./organizationPresentationFailures.js";
+export async function loadLocalOrganizationDataUsage(input) {
+    return runOrganizationPresentationRead(input, "usage", () => loadOrganizationDataUsageProjection(input.execSql, input.organizationId, input.requesterUserId));
+}
+function retainedIfUsageReadable(input, attempt, value) {
+    return isOrganizationPresentationAccessAttemptCurrent(input, attempt) &&
+        isOrganizationPresentationAccessReadable(input, "usage")
+        ? value
+        : null;
+}
+export async function reconcileOrganizationDataUsage(input) {
+    const attempt = captureOrganizationPresentationAccessAttempt(input, "usage");
+    const local = await loadLocalOrganizationDataUsage(input);
+    const result = await input.apiClient.getOrganizationDataUsageResult(input.organizationId, { reportErrors: false });
+    if (!result.ok) {
+        if (isOrganizationPresentationAccessDeniedFailure(result)) {
+            denyOrganizationPresentationAccess(input, ["usage"]);
+            // Durable marker first: a failed purge plus a restart must not serve
+            // the revoked usage projection.
+            try {
+                await runOrganizationPresentationMutation(input.execSql, () => recordOrganizationPresentationDenials(input, ["usage"]));
+            }
+            catch (error) {
+                input.logError?.("Failed to record denied organization data usage", error);
+            }
+            try {
+                await runOrganizationPresentationMutation(input.execSql, () => purgeOrganizationDataUsageProjection(input.execSql, input.organizationId, input.requesterUserId));
+            }
+            catch (error) {
+                input.logError?.("Failed to purge denied organization data usage", error);
+            }
+            return null;
+        }
+        result.report();
+        return retainedIfUsageReadable(input, attempt, local);
+    }
+    if (result.data.organizationId !== input.organizationId) {
+        input.logError?.(`Organization data-usage response scope does not match ${input.organizationId}`);
+        return retainedIfUsageReadable(input, attempt, local);
+    }
+    return runOrganizationPresentationMutation(input.execSql, async () => {
+        if (!isOrganizationPresentationAccessAttemptCurrent(input, attempt)) {
+            return null;
+        }
+        try {
+            await saveOrganizationDataUsageProjection({
+                execSql: input.execSql,
+                requesterUserId: input.requesterUserId,
+                response: result.data,
+            });
+        }
+        catch (error) {
+            input.logError?.("Failed to persist organization data usage", error);
+            return retainedIfUsageReadable(input, attempt, local);
+        }
+        return restoreOrganizationPresentationAccess(input, attempt)
+            ? result.data
+            : null;
+    });
+}
+//# sourceMappingURL=dataUsageReadModel.js.map

package/workflows/organizations/readModel/dataUsageReadModel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataUsageReadModel.js","sourceRoot":"","sources":["dataUsageReadModel.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mCAAmC,EACnC,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mFAAmF,CAAC;AAE1I,OAAO,EACL,4CAA4C,EAC5C,kCAAkC,EAClC,8CAA8C,EAC9C,wCAAwC,EAExC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,6CAA6C,EAAE,MAAM,oCAAoC,CAAC;AAyBnG,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAA2C;IAE3C,OAAO,+BAA+B,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAC1D,mCAAmC,CACjC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA2C,EAC3C,OAA8C,EAC9C,KAAQ;IAER,OAAO,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC;QACnE,wCAAwC,CAAC,KAAK,EAAE,OAAO,CAAC;QACxD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAA0C;IAE1C,MAAM,OAAO,GAAG,4CAA4C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,8BAA8B,CACjE,KAAK,CAAC,cAAc,EACpB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,6CAA6C,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,kCAAkC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,qEAAqE;YACrE,gCAAgC;YAChC,IAAI,CAAC;gBACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,qCAAqC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CACxD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,CAAC,QAAQ,EAAE,CACd,iDAAiD,EACjD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,oCAAoC,CAClC,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,CAAC,QAAQ,EAAE,CACd,gDAAgD,EAChD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QACxD,KAAK,CAAC,QAAQ,EAAE,CACd,yDAAyD,KAAK,CAAC,cAAc,EAAE,CAChF,CAAC;QACF,OAAO,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACnE,IAAI,CAAC,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,mCAAmC,CAAC;gBACxC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,QAAQ,EAAE,MAAM,CAAC,IAAI;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,QAAQ,EAAE,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;YACrE,OAAO,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,qCAAqC,CAAC,KAAK,EAAE,OAAO,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  RequestResult,\n  RequestResultOptions,\n} from \"@tearleads/api-client\";\nimport type { OrganizationDataUsageResponse } from \"@tearleads/validators/response\";\nimport {\n  loadOrganizationDataUsageProjection,\n  purgeOrganizationDataUsageProjection,\n  saveOrganizationDataUsageProjection,\n} from \"../../../data/persistence/organizations/organizationDataUsagePersistence\";\nimport { recordOrganizationPresentationDenials } from \"../../../data/persistence/organizations/organizationPresentationDenialPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  captureOrganizationPresentationAccessAttempt,\n  denyOrganizationPresentationAccess,\n  isOrganizationPresentationAccessAttemptCurrent,\n  isOrganizationPresentationAccessReadable,\n  type OrganizationPresentationAccessAttempt,\n  restoreOrganizationPresentationAccess,\n  runOrganizationPresentationMutation,\n  runOrganizationPresentationRead,\n} from \"./organizationPresentationAccessState\";\nimport { isOrganizationPresentationAccessDeniedFailure } from \"./organizationPresentationFailures\";\n\nexport type OrganizationDataUsage = OrganizationDataUsageResponse;\n\ninterface OrganizationDataUsageApi {\n  getOrganizationDataUsageResult(\n    organizationId: string,\n    options?: RequestResultOptions,\n  ): Promise<RequestResult<OrganizationDataUsageResponse>>;\n}\n\ninterface OrganizationDataUsageProjectionInput {\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly requesterUserId: string;\n}\n\nexport interface ReconcileOrganizationDataUsageInput\n  extends OrganizationDataUsageProjectionInput {\n  readonly apiClient: OrganizationDataUsageApi;\n  readonly logError?:\n    | ((message: string | Error, cause?: unknown) => void)\n    | undefined;\n}\n\nexport async function loadLocalOrganizationDataUsage(\n  input: OrganizationDataUsageProjectionInput,\n): Promise<OrganizationDataUsage | null> {\n  return runOrganizationPresentationRead(input, \"usage\", () =>\n    loadOrganizationDataUsageProjection(\n      input.execSql,\n      input.organizationId,\n      input.requesterUserId,\n    ),\n  );\n}\n\nfunction retainedIfUsageReadable<T>(\n  input: OrganizationDataUsageProjectionInput,\n  attempt: OrganizationPresentationAccessAttempt,\n  value: T,\n): T | null {\n  return isOrganizationPresentationAccessAttemptCurrent(input, attempt) &&\n    isOrganizationPresentationAccessReadable(input, \"usage\")\n    ? value\n    : null;\n}\n\nexport async function reconcileOrganizationDataUsage(\n  input: ReconcileOrganizationDataUsageInput,\n): Promise<OrganizationDataUsage | null> {\n  const attempt = captureOrganizationPresentationAccessAttempt(input, \"usage\");\n  const local = await loadLocalOrganizationDataUsage(input);\n  const result = await input.apiClient.getOrganizationDataUsageResult(\n    input.organizationId,\n    { reportErrors: false },\n  );\n  if (!result.ok) {\n    if (isOrganizationPresentationAccessDeniedFailure(result)) {\n      denyOrganizationPresentationAccess(input, [\"usage\"]);\n      // Durable marker first: a failed purge plus a restart must not serve\n      // the revoked usage projection.\n      try {\n        await runOrganizationPresentationMutation(input.execSql, () =>\n          recordOrganizationPresentationDenials(input, [\"usage\"]),\n        );\n      } catch (error) {\n        input.logError?.(\n          \"Failed to record denied organization data usage\",\n          error,\n        );\n      }\n      try {\n        await runOrganizationPresentationMutation(input.execSql, () =>\n          purgeOrganizationDataUsageProjection(\n            input.execSql,\n            input.organizationId,\n            input.requesterUserId,\n          ),\n        );\n      } catch (error) {\n        input.logError?.(\n          \"Failed to purge denied organization data usage\",\n          error,\n        );\n      }\n      return null;\n    }\n\n    result.report();\n    return retainedIfUsageReadable(input, attempt, local);\n  }\n\n  if (result.data.organizationId !== input.organizationId) {\n    input.logError?.(\n      `Organization data-usage response scope does not match ${input.organizationId}`,\n    );\n    return retainedIfUsageReadable(input, attempt, local);\n  }\n\n  return runOrganizationPresentationMutation(input.execSql, async () => {\n    if (!isOrganizationPresentationAccessAttemptCurrent(input, attempt)) {\n      return null;\n    }\n    try {\n      await saveOrganizationDataUsageProjection({\n        execSql: input.execSql,\n        requesterUserId: input.requesterUserId,\n        response: result.data,\n      });\n    } catch (error) {\n      input.logError?.(\"Failed to persist organization data usage\", error);\n      return retainedIfUsageReadable(input, attempt, local);\n    }\n    return restoreOrganizationPresentationAccess(input, attempt)\n      ? result.data\n      : null;\n  });\n}\n"]}

package/workflows/organizations/readModel/index.d.ts

@@ -0,0 +1,70 @@
+import type { UpdateOrganizationProfileRequest, UpdateOrganizationRosterEntryRequest } from "../../../internal/validators/request/index.js";
+import type { OrganizationContainerGrantResponse, OrganizationContainerGrantsResponse, OrganizationDirectoryResponse, OrganizationDirectoryUserResponse, OrganizationGroupContainerResponse, OrganizationGroupContainersResponse, OrganizationGroupSummaryResponse, OrganizationProfileResponse, OrganizationReadModelGroupMemberResponse, OrganizationUserDetailResponse } from "../../../internal/validators/response/index.js";
+import type { OrganizationGroupPolicyHistory } from "../policyHistory/policyHistoryReadModel.js";
+export type { OrganizationGroupPolicyHistory, OrganizationGroupPolicyHistoryEntry, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationPrincipalMemberChange, OrganizationPrincipalMemberChangeType, OrganizationPrincipalPolicyHistory, OrganizationPrincipalPolicyHistoryEntry, } from "../policyHistory/policyHistoryReadModel.js";
+export { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "../policyHistory/policyHistoryReadModel.js";
+export type OrganizationDirectory = OrganizationDirectoryResponse;
+export type OrganizationDirectoryUser = OrganizationDirectoryUserResponse;
+export type OrganizationProfile = OrganizationProfileResponse;
+export type OrganizationGroupContainer = OrganizationGroupContainerResponse & {
+    readonly containerDisplayName: string | null;
+};
+export type OrganizationContainerGrant = OrganizationContainerGrantResponse & {
+    readonly groupName: string | null;
+    readonly containerDisplayName: string | null;
+};
+export interface OrganizationGroupContainers extends Omit<OrganizationGroupContainersResponse, "containers"> {
+    readonly containers: OrganizationGroupContainer[];
+}
+export interface OrganizationContainerGrants extends Omit<OrganizationContainerGrantsResponse, "grants"> {
+    readonly grants: OrganizationContainerGrant[];
+}
+export interface OrganizationUserDetail extends Omit<OrganizationUserDetailResponse, "grants" | "groups"> {
+    readonly groups: OrganizationGroupSummary[];
+    readonly grants: {
+        readonly directGrants: OrganizationContainerGrant[];
+        readonly groupGrants: OrganizationContainerGrant[];
+    };
+}
+/** A projected group member: public keys live in the directory lane only. */
+export type OrganizationGroupMember = OrganizationReadModelGroupMemberResponse;
+export interface OrganizationGroupMembers {
+    readonly groupId: string;
+    readonly members: OrganizationGroupMember[];
+    readonly organizationId: string;
+}
+export type OrganizationGroupSummary = OrganizationGroupSummaryResponse & {
+    readonly name: string;
+    /**
+     * The group's signed name does not open under the metadata key this member
+     * holds; only a dishonest admin signs such a name. `name` is then empty, and
+     * the group must not be offered for selection by name.
+     */
+    readonly nameUnreadable: boolean;
+};
+export interface OrganizationDirectoryAndGroups {
+    readonly directory: OrganizationDirectory;
+    readonly groups: ReadonlyArray<OrganizationGroupSummary>;
+    readonly memberGroupId: string;
+    readonly readModelCursor: string;
+}
+export interface OrganizationGroupDetails {
+    readonly members: OrganizationGroupMembers | null;
+    readonly containers: OrganizationGroupContainers | null;
+    readonly policyHistory: OrganizationGroupPolicyHistory | null;
+}
+interface OrganizationReadApi {
+    readonly updateOrganizationRosterEntry: (organizationId: string, userId: string, input: UpdateOrganizationRosterEntryRequest) => Promise<OrganizationDirectoryUserResponse | null>;
+    readonly updateOrganizationProfile: (organizationId: string, input: UpdateOrganizationProfileRequest) => Promise<OrganizationProfileResponse | null>;
+}
+export declare function updateOrganizationRosterEntry(input: {
+    readonly apiClient: Pick<OrganizationReadApi, "updateOrganizationRosterEntry">;
+    readonly organizationId: string;
+    readonly profileDocumentId: string | null;
+    readonly userId: string;
+}): Promise<OrganizationDirectoryUser | null>;
+export declare function updateOrganizationProfile(input: {
+    readonly apiClient: Pick<OrganizationReadApi, "updateOrganizationProfile">;
+    readonly organizationId: string;
+    readonly profileDocumentId: string | null;
+}): Promise<OrganizationProfileResponse | null>;

package/workflows/organizations/readModel/index.js

@@ -0,0 +1,10 @@
+export { buildOrganizationGroupPolicyHistory, buildOrganizationPolicyHistory, } from "../policyHistory/policyHistoryReadModel.js";
+export async function updateOrganizationRosterEntry(input) {
+    return input.apiClient.updateOrganizationRosterEntry(input.organizationId, input.userId, { profileDocumentId: input.profileDocumentId });
+}
+export async function updateOrganizationProfile(input) {
+    return input.apiClient.updateOrganizationProfile(input.organizationId, {
+        profileDocumentId: input.profileDocumentId,
+    });
+}
+//# sourceMappingURL=index.js.map

package/workflows/organizations/readModel/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AAqEjD,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAQnD;IACC,OAAO,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAClD,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,MAAM,EACZ,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,OAAO,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,KAAK,CAAC,cAAc,EAAE;QACrE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  UpdateOrganizationProfileRequest,\n  UpdateOrganizationRosterEntryRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n  OrganizationContainerGrantResponse,\n  OrganizationContainerGrantsResponse,\n  OrganizationDirectoryResponse,\n  OrganizationDirectoryUserResponse,\n  OrganizationGroupContainerResponse,\n  OrganizationGroupContainersResponse,\n  OrganizationGroupSummaryResponse,\n  OrganizationProfileResponse,\n  OrganizationReadModelGroupMemberResponse,\n  OrganizationUserDetailResponse,\n} from \"@tearleads/validators/response\";\nimport type { OrganizationGroupPolicyHistory } from \"../policyHistory/policyHistoryReadModel\";\n\nexport type {\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n} from \"../policyHistory/policyHistoryReadModel\";\nexport {\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationPolicyHistory,\n} from \"../policyHistory/policyHistoryReadModel\";\n\nexport type OrganizationDirectory = OrganizationDirectoryResponse;\nexport type OrganizationDirectoryUser = OrganizationDirectoryUserResponse;\nexport type OrganizationProfile = OrganizationProfileResponse;\nexport type OrganizationGroupContainer = OrganizationGroupContainerResponse & {\n  readonly containerDisplayName: string | null;\n};\nexport type OrganizationContainerGrant = OrganizationContainerGrantResponse & {\n  readonly groupName: string | null;\n  readonly containerDisplayName: string | null;\n};\nexport interface OrganizationGroupContainers\n  extends Omit<OrganizationGroupContainersResponse, \"containers\"> {\n  readonly containers: OrganizationGroupContainer[];\n}\nexport interface OrganizationContainerGrants\n  extends Omit<OrganizationContainerGrantsResponse, \"grants\"> {\n  readonly grants: OrganizationContainerGrant[];\n}\nexport interface OrganizationUserDetail\n  extends Omit<OrganizationUserDetailResponse, \"grants\" | \"groups\"> {\n  readonly groups: OrganizationGroupSummary[];\n  readonly grants: {\n    readonly directGrants: OrganizationContainerGrant[];\n    readonly groupGrants: OrganizationContainerGrant[];\n  };\n}\n/** A projected group member: public keys live in the directory lane only. */\nexport type OrganizationGroupMember = OrganizationReadModelGroupMemberResponse;\nexport interface OrganizationGroupMembers {\n  readonly groupId: string;\n  readonly members: OrganizationGroupMember[];\n  readonly organizationId: string;\n}\nexport type OrganizationGroupSummary = OrganizationGroupSummaryResponse & {\n  readonly name: string;\n  /**\n   * The group's signed name does not open under the metadata key this member\n   * holds; only a dishonest admin signs such a name. `name` is then empty, and\n   * the group must not be offered for selection by name.\n   */\n  readonly nameUnreadable: boolean;\n};\nexport interface OrganizationDirectoryAndGroups {\n  readonly directory: OrganizationDirectory;\n  readonly groups: ReadonlyArray<OrganizationGroupSummary>;\n  readonly memberGroupId: string;\n  readonly readModelCursor: string;\n}\n\nexport interface OrganizationGroupDetails {\n  readonly members: OrganizationGroupMembers | null;\n  readonly containers: OrganizationGroupContainers | null;\n  readonly policyHistory: OrganizationGroupPolicyHistory | null;\n}\n\ninterface OrganizationReadApi {\n  readonly updateOrganizationRosterEntry: (\n    organizationId: string,\n    userId: string,\n    input: UpdateOrganizationRosterEntryRequest,\n  ) => Promise<OrganizationDirectoryUserResponse | null>;\n  readonly updateOrganizationProfile: (\n    organizationId: string,\n    input: UpdateOrganizationProfileRequest,\n  ) => Promise<OrganizationProfileResponse | null>;\n}\n\nexport async function updateOrganizationRosterEntry(input: {\n  readonly apiClient: Pick<\n    OrganizationReadApi,\n    \"updateOrganizationRosterEntry\"\n  >;\n  readonly organizationId: string;\n  readonly profileDocumentId: string | null;\n  readonly userId: string;\n}): Promise<OrganizationDirectoryUser | null> {\n  return input.apiClient.updateOrganizationRosterEntry(\n    input.organizationId,\n    input.userId,\n    { profileDocumentId: input.profileDocumentId },\n  );\n}\n\nexport async function updateOrganizationProfile(input: {\n  readonly apiClient: Pick<OrganizationReadApi, \"updateOrganizationProfile\">;\n  readonly organizationId: string;\n  readonly profileDocumentId: string | null;\n}): Promise<OrganizationProfileResponse | null> {\n  return input.apiClient.updateOrganizationProfile(input.organizationId, {\n    profileDocumentId: input.profileDocumentId,\n  });\n}\n"]}

package/workflows/organizations/readModel/listLocalOrganizations.d.ts

@@ -0,0 +1,20 @@
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+/**
+ * A locally-known organization the user belongs to, derived from its persisted
+ * root container. `name` is the decrypted organization-profile display name when
+ * one is stored locally, or null when it has not synced yet.
+ */
+export interface LocalOrganizationSummary {
+    name: string | null;
+    organizationId: string;
+    rootContainerId: string;
+}
+/**
+ * Enumerates the organizations the user can manage from local state: one per
+ * persisted root container. This is intentionally offline — the Explorer already
+ * resolves files across organizations by effective permission, so listing the
+ * organizations to manage needs no server round-trip.
+ */
+export declare function listLocalOrganizations(input: {
+    execSql: ExecSql;
+}): Promise<LocalOrganizationSummary[]>;

package/workflows/organizations/readModel/listLocalOrganizations.js

@@ -0,0 +1,137 @@
+import { readStoredDocumentState } from "../../../data/documents/documentKinds.js";
+import { sqlContainerContentsPersistence } from "../../../data/persistence/container-contents/containerContentsPersistence.js";
+import { DOCUMENTS_APP_KIND, sqlDocumentsPersistence, } from "../../../data/persistence/documents/documentsPersistence.js";
+import { loadOrganizationProfileDocumentIds } from "../../../data/persistence/organizations/organizationProfileDocumentPointers.js";
+import { findLocalIdByDocumentId } from "../../../data/sqlite/documentPersistence.js";
+import { loadPersistedDocumentContent } from "../../documents/historyContent.js";
+import { getOrganizationProfileDocumentLocalId, readOrganizationProfileName, } from "../organizationProfile.js";
+import { deriveOrganizationMetadataContainerSystemSlot } from "../rosterProfileContainer.js";
+// Reads and decrypts the `name` field of the organization_profile document
+// persisted under `documentLocalId`, or null if it is absent, empty, or
+// unparseable. A single corrupt profile must not break the whole list, so every
+// failure collapses to a null (unnamed) organization.
+async function readOrganizationNameFromDocument(execSql, documentLocalId) {
+    try {
+        const doc = await loadPersistedDocumentContent({
+            execSql,
+            localId: documentLocalId,
+            persistence: sqlDocumentsPersistence,
+        });
+        if (!doc) {
+            return null;
+        }
+        return readOrganizationProfileName(readStoredDocumentState(doc).structuredFields);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolves an organization's decrypted display name from local state.
+ *
+ * The same organization_profile document is addressed by several different
+ * local-id conventions depending on how it arrived, so one lookup by id is not
+ * enough:
+ *
+ *  - The org's own **provisioner** (and any admin who later edits the name)
+ *    writes the document under the deterministic alias
+ *    `org-profile:<organizationId>` — resolved by the fast path below.
+ *  - A **device that only synced it** — a member of another org, or this same
+ *    user's freshly re-hydrated device after an identity restore — never runs
+ *    that write. The sync ingest keys the document under the server documentId
+ *    (there is no local alias to reuse — see `upsertDiscoveredDocumentWithExec`),
+ *    so the alias lookup misses.
+ *
+ * Two fallbacks cover the synced case, in order of authority:
+ *
+ *  1. The **organization read model** records the org's `profileDocumentId`.
+ *     That pointer is container-independent, so it resolves the name wherever
+ *     the document happens to be linked — including a profile document created
+ *     by an admin through the org-manager editor rather than by provisioning.
+ *  2. Failing that, locate the org's metadata container by its deterministic
+ *     system slot and read whichever profile document is linked there. Keying on
+ *     the system slot (rather than the document kind) keeps it correct even
+ *     before the projected document kind has been rebuilt from a freshly-synced
+ *     snapshot, and it still works before the read model has been projected.
+ */
+async function readLocalOrganizationName(execSql, organizationId, organizationContainers, profileDocumentId) {
+    const aliasName = await readOrganizationNameFromDocument(execSql, getOrganizationProfileDocumentLocalId({ organizationId }));
+    if (aliasName !== null) {
+        return aliasName;
+    }
+    if (profileDocumentId) {
+        // Reach the row wherever it landed: a device that only synced the document
+        // keys it under the server documentId rather than any local alias.
+        const syncedLocalId = await findLocalIdByDocumentId(execSql, DOCUMENTS_APP_KIND, profileDocumentId);
+        const syncedName = syncedLocalId
+            ? await readOrganizationNameFromDocument(execSql, syncedLocalId)
+            : null;
+        if (syncedName !== null) {
+            return syncedName;
+        }
+    }
+    const metadataSystemSlot = await deriveOrganizationMetadataContainerSystemSlot({ organizationId });
+    const metadataContainer = organizationContainers.find((container) => container.systemSlot === metadataSystemSlot);
+    if (!metadataContainer) {
+        return null;
+    }
+    const documentLocalIds = await sqlDocumentsPersistence.findDocumentLocalIdsByContainerId(execSql, metadataContainer.id);
+    for (const documentLocalId of documentLocalIds) {
+        const name = await readOrganizationNameFromDocument(execSql, documentLocalId);
+        if (name !== null) {
+            return name;
+        }
+    }
+    return null;
+}
+/**
+ * Enumerates the organizations the user can manage from local state: one per
+ * persisted root container. This is intentionally offline — the Explorer already
+ * resolves files across organizations by effective permission, so listing the
+ * organizations to manage needs no server round-trip.
+ */
+export async function listLocalOrganizations(input) {
+    const containers = await sqlContainerContentsPersistence.loadContainers(input.execSql);
+    // A projected read model is not a precondition for listing organizations, so
+    // an unreadable one degrades to the container-derived lookups below.
+    const profileDocumentIdsByOrganizationId = await loadOrganizationProfileDocumentIds(input.execSql).catch(() => new Map());
+    // Group every persisted container by org so name resolution can locate an
+    // org's independent metadata root without a second DB scan.
+    const containersByOrganizationId = new Map();
+    for (const { container } of containers) {
+        const entry = {
+            id: container.id,
+            systemSlot: container.systemSlot ?? null,
+        };
+        const group = containersByOrganizationId.get(container.organizationId);
+        if (group) {
+            group.push(entry);
+        }
+        else {
+            containersByOrganizationId.set(container.organizationId, [entry]);
+        }
+    }
+    const seen = new Set();
+    const rootContainers = containers.filter(({ container }) => {
+        if (container.parentId !== null ||
+            container.systemSlot ||
+            seen.has(container.organizationId)) {
+            return false;
+        }
+        seen.add(container.organizationId);
+        return true;
+    });
+    rootContainers.sort((left, right) => (left.container.localCreatedAt ?? "").localeCompare(right.container.localCreatedAt ?? "") ||
+        left.container.organizationId.localeCompare(right.container.organizationId) ||
+        left.container.id.localeCompare(right.container.id));
+    // Read each organization's profile name concurrently; readLocalOrganizationName
+    // already falls back to null per organization, so a single corrupt profile
+    // cannot reject the batch.
+    return Promise.all(rootContainers.map(async ({ container }) => ({
+        name: await readLocalOrganizationName(input.execSql, container.organizationId, containersByOrganizationId.get(container.organizationId) ?? [], profileDocumentIdsByOrganizationId.get(container.organizationId) ??
+            null),
+        organizationId: container.organizationId,
+        rootContainerId: container.id,
+    })));
+}
+//# sourceMappingURL=listLocalOrganizations.js.map

package/workflows/organizations/readModel/listLocalOrganizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listLocalOrganizations.js","sourceRoot":"","sources":["listLocalOrganizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,6EAA6E,CAAC;AACjI,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EACL,qCAAqC,EACrC,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6CAA6C,EAAE,MAAM,2BAA2B,CAAC;AAoB1F,2EAA2E;AAC3E,wEAAwE;AACxE,gFAAgF;AAChF,sDAAsD;AACtD,KAAK,UAAU,gCAAgC,CAC7C,OAAgB,EAChB,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAAC;YAC7C,OAAO;YACP,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,uBAAuB;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,2BAA2B,CAChC,uBAAuB,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,yBAAyB,CACtC,OAAgB,EAChB,cAAsB,EACtB,sBAAkE,EAClE,iBAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,gCAAgC,CACtD,OAAO,EACP,qCAAqC,CAAC,EAAE,cAAc,EAAE,CAAC,CAC1D,CAAC;IACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,EACP,kBAAkB,EAClB,iBAAiB,CAClB,CAAC;QACF,MAAM,UAAU,GAAG,aAAa;YAC9B,CAAC,CAAC,MAAM,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GACtB,MAAM,6CAA6C,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CACnD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,kBAAkB,CAC3D,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GACpB,MAAM,uBAAuB,CAAC,iCAAiC,CAC7D,OAAO,EACP,iBAAiB,CAAC,EAAE,CACrB,CAAC;IACJ,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,gCAAgC,CACjD,OAAO,EACP,eAAe,CAChB,CAAC;QACF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,cAAc,CACrE,KAAK,CAAC,OAAO,CACd,CAAC;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,kCAAkC,GACtC,MAAM,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAC3D,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAChC,CAAC;IAEJ,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAGvC,CAAC;IACJ,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAgC;YACzC,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI;SACzC,CAAC;QACF,MAAM,KAAK,GAAG,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACzD,IACE,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC3B,SAAS,CAAC,UAAU;YACpB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,EAClC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,aAAa,CACjD,KAAK,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CACrC;QACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CACzC,KAAK,CAAC,SAAS,CAAC,cAAc,CAC/B;QACD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CACtD,CAAC;IAEF,gFAAgF;IAChF,2EAA2E;IAC3E,2BAA2B;IAC3B,OAAO,OAAO,CAAC,GAAG,CAChB,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,MAAM,yBAAyB,CACnC,KAAK,CAAC,OAAO,EACb,SAAS,CAAC,cAAc,EACxB,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,EAC9D,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC;YAC9D,IAAI,CACP;QACD,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,eAAe,EAAE,SAAS,CAAC,EAAE;KAC9B,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import { readStoredDocumentState } from \"../../../data/documents/documentKinds\";\nimport { sqlContainerContentsPersistence } from \"../../../data/persistence/container-contents/containerContentsPersistence\";\nimport {\n  DOCUMENTS_APP_KIND,\n  sqlDocumentsPersistence,\n} from \"../../../data/persistence/documents/documentsPersistence\";\nimport { loadOrganizationProfileDocumentIds } from \"../../../data/persistence/organizations/organizationProfileDocumentPointers\";\nimport { findLocalIdByDocumentId } from \"../../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { loadPersistedDocumentContent } from \"../../documents/historyContent\";\nimport {\n  getOrganizationProfileDocumentLocalId,\n  readOrganizationProfileName,\n} from \"../organizationProfile\";\nimport { deriveOrganizationMetadataContainerSystemSlot } from \"../rosterProfileContainer\";\n\n// Just the container fields this module needs to locate an org's metadata\n// container among the locally-persisted containers.\ninterface LocalContainerForNameLookup {\n  id: string;\n  systemSlot: string | null;\n}\n\n/**\n * A locally-known organization the user belongs to, derived from its persisted\n * root container. `name` is the decrypted organization-profile display name when\n * one is stored locally, or null when it has not synced yet.\n */\nexport interface LocalOrganizationSummary {\n  name: string | null;\n  organizationId: string;\n  rootContainerId: string;\n}\n\n// Reads and decrypts the `name` field of the organization_profile document\n// persisted under `documentLocalId`, or null if it is absent, empty, or\n// unparseable. A single corrupt profile must not break the whole list, so every\n// failure collapses to a null (unnamed) organization.\nasync function readOrganizationNameFromDocument(\n  execSql: ExecSql,\n  documentLocalId: string,\n): Promise<string | null> {\n  try {\n    const doc = await loadPersistedDocumentContent({\n      execSql,\n      localId: documentLocalId,\n      persistence: sqlDocumentsPersistence,\n    });\n    if (!doc) {\n      return null;\n    }\n\n    return readOrganizationProfileName(\n      readStoredDocumentState(doc).structuredFields,\n    );\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolves an organization's decrypted display name from local state.\n *\n * The same organization_profile document is addressed by several different\n * local-id conventions depending on how it arrived, so one lookup by id is not\n * enough:\n *\n *  - The org's own **provisioner** (and any admin who later edits the name)\n *    writes the document under the deterministic alias\n *    `org-profile:<organizationId>` — resolved by the fast path below.\n *  - A **device that only synced it** — a member of another org, or this same\n *    user's freshly re-hydrated device after an identity restore — never runs\n *    that write. The sync ingest keys the document under the server documentId\n *    (there is no local alias to reuse — see `upsertDiscoveredDocumentWithExec`),\n *    so the alias lookup misses.\n *\n * Two fallbacks cover the synced case, in order of authority:\n *\n *  1. The **organization read model** records the org's `profileDocumentId`.\n *     That pointer is container-independent, so it resolves the name wherever\n *     the document happens to be linked — including a profile document created\n *     by an admin through the org-manager editor rather than by provisioning.\n *  2. Failing that, locate the org's metadata container by its deterministic\n *     system slot and read whichever profile document is linked there. Keying on\n *     the system slot (rather than the document kind) keeps it correct even\n *     before the projected document kind has been rebuilt from a freshly-synced\n *     snapshot, and it still works before the read model has been projected.\n */\nasync function readLocalOrganizationName(\n  execSql: ExecSql,\n  organizationId: string,\n  organizationContainers: ReadonlyArray<LocalContainerForNameLookup>,\n  profileDocumentId: string | null,\n): Promise<string | null> {\n  const aliasName = await readOrganizationNameFromDocument(\n    execSql,\n    getOrganizationProfileDocumentLocalId({ organizationId }),\n  );\n  if (aliasName !== null) {\n    return aliasName;\n  }\n\n  if (profileDocumentId) {\n    // Reach the row wherever it landed: a device that only synced the document\n    // keys it under the server documentId rather than any local alias.\n    const syncedLocalId = await findLocalIdByDocumentId(\n      execSql,\n      DOCUMENTS_APP_KIND,\n      profileDocumentId,\n    );\n    const syncedName = syncedLocalId\n      ? await readOrganizationNameFromDocument(execSql, syncedLocalId)\n      : null;\n    if (syncedName !== null) {\n      return syncedName;\n    }\n  }\n\n  const metadataSystemSlot =\n    await deriveOrganizationMetadataContainerSystemSlot({ organizationId });\n  const metadataContainer = organizationContainers.find(\n    (container) => container.systemSlot === metadataSystemSlot,\n  );\n  if (!metadataContainer) {\n    return null;\n  }\n\n  const documentLocalIds =\n    await sqlDocumentsPersistence.findDocumentLocalIdsByContainerId(\n      execSql,\n      metadataContainer.id,\n    );\n  for (const documentLocalId of documentLocalIds) {\n    const name = await readOrganizationNameFromDocument(\n      execSql,\n      documentLocalId,\n    );\n    if (name !== null) {\n      return name;\n    }\n  }\n  return null;\n}\n\n/**\n * Enumerates the organizations the user can manage from local state: one per\n * persisted root container. This is intentionally offline — the Explorer already\n * resolves files across organizations by effective permission, so listing the\n * organizations to manage needs no server round-trip.\n */\nexport async function listLocalOrganizations(input: {\n  execSql: ExecSql;\n}): Promise<LocalOrganizationSummary[]> {\n  const containers = await sqlContainerContentsPersistence.loadContainers(\n    input.execSql,\n  );\n  // A projected read model is not a precondition for listing organizations, so\n  // an unreadable one degrades to the container-derived lookups below.\n  const profileDocumentIdsByOrganizationId =\n    await loadOrganizationProfileDocumentIds(input.execSql).catch(\n      () => new Map<string, string>(),\n    );\n\n  // Group every persisted container by org so name resolution can locate an\n  // org's independent metadata root without a second DB scan.\n  const containersByOrganizationId = new Map<\n    string,\n    LocalContainerForNameLookup[]\n  >();\n  for (const { container } of containers) {\n    const entry: LocalContainerForNameLookup = {\n      id: container.id,\n      systemSlot: container.systemSlot ?? null,\n    };\n    const group = containersByOrganizationId.get(container.organizationId);\n    if (group) {\n      group.push(entry);\n    } else {\n      containersByOrganizationId.set(container.organizationId, [entry]);\n    }\n  }\n\n  const seen = new Set<string>();\n  const rootContainers = containers.filter(({ container }) => {\n    if (\n      container.parentId !== null ||\n      container.systemSlot ||\n      seen.has(container.organizationId)\n    ) {\n      return false;\n    }\n    seen.add(container.organizationId);\n    return true;\n  });\n  rootContainers.sort(\n    (left, right) =>\n      (left.container.localCreatedAt ?? \"\").localeCompare(\n        right.container.localCreatedAt ?? \"\",\n      ) ||\n      left.container.organizationId.localeCompare(\n        right.container.organizationId,\n      ) ||\n      left.container.id.localeCompare(right.container.id),\n  );\n\n  // Read each organization's profile name concurrently; readLocalOrganizationName\n  // already falls back to null per organization, so a single corrupt profile\n  // cannot reject the batch.\n  return Promise.all(\n    rootContainers.map(async ({ container }) => ({\n      name: await readLocalOrganizationName(\n        input.execSql,\n        container.organizationId,\n        containersByOrganizationId.get(container.organizationId) ?? [],\n        profileDocumentIdsByOrganizationId.get(container.organizationId) ??\n          null,\n      ),\n      organizationId: container.organizationId,\n      rootContainerId: container.id,\n    })),\n  );\n}\n"]}

package/workflows/organizations/readModel/localReadModelDetails.d.ts

@@ -0,0 +1,25 @@
+import type { ReferencedPrincipalStateResponse } from "../../../internal/validators/response/index.js";
+import type { ExecSql } from "../../../data/sqlite/sqlSchema.js";
+import type { OrganizationContainerGrants, OrganizationGroupContainers, OrganizationGroupPolicyHistory, OrganizationPolicyHistory, OrganizationUserDetail } from "./index.js";
+interface LocalReadModelInput {
+    readonly currentUserId: string;
+    readonly execSql: ExecSql;
+    readonly organizationId: string;
+}
+type PolicyPrincipalType = ReferencedPrincipalStateResponse["principalType"];
+export declare function loadLocalOrganizationContainerGrants(input: LocalReadModelInput): Promise<OrganizationContainerGrants | null>;
+export declare function loadLocalOrganizationGroupContainers(input: LocalReadModelInput & {
+    readonly groupId: string;
+}): Promise<OrganizationGroupContainers | null>;
+export declare function loadLocalOrganizationGroupPolicyHistory(input: LocalReadModelInput & {
+    readonly groupId: string;
+}): Promise<OrganizationGroupPolicyHistory | null>;
+export declare function loadLocalOrganizationPolicyHistory(input: LocalReadModelInput): Promise<OrganizationPolicyHistory | null>;
+export declare function loadLocalOrganizationPolicyReference(input: LocalReadModelInput & {
+    readonly principalId: string;
+    readonly principalType: PolicyPrincipalType;
+}): Promise<ReferencedPrincipalStateResponse | null>;
+export declare function loadLocalOrganizationUserDetail(input: LocalReadModelInput & {
+    readonly userId: string;
+}): Promise<OrganizationUserDetail | null>;
+export {};