@tearleads/client-sdk 0.1.81 → 0.1.82

package/client/organizations/organizationReadModels.js

@@ -1,6 +1,6 @@
+import { recoverOrganizationAccess } from "../../workflows/container-contents/recovery/accessRestoration.js";
 import { loadLocalOrganizationContainerGrants, loadLocalOrganizationDirectoryAndGroups, loadLocalOrganizationGroupContainers, loadLocalOrganizationGroupMembers, loadLocalOrganizationUserDetail, reconcileOrganizationDirectoryAndGroups, } from "../../workflows/organizations/index.js";
 import { organizationAccessScopeKey, wasOrganizationPresentationAccessDeniedByServer, } from "../../workflows/organizations/readModel/organizationPresentationAccessState.js";
-import { recoverOrganizationAccess } from "./organizationAccessRestoration.js";
 import { loadBoundedOrganizationGroupHistory } from "./organizationGroupHistory.js";
 import { hydrateOrganizationGroupNamesForRuntime } from "./organizationGroupNameHydration.js";
 import { loadBoundedOrganizationHistory } from "./organizationHistory.js";
@@ -145,9 +145,11 @@ class OrganizationReadModelCoordinatorImpl {
                 directoryAndGroups !== undefined;
             if (accessWasRestored)
                 await recoverOrganizationAccess({
-                    active,
                     domainScope,
+                    execSql: active.runtime.infra.execSql,
+                    organizationId: active.organizationId,
                     stillCurrent,
+                    userId: active.userId,
                 });
             if (!stillCurrent())
                 return null;

package/client/organizations/organizationReadModels.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,6EAA6E,CAAC;AAErF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,MAAM;oBACN,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport {\n  loadLocalOrganizationContainerGrants,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadLocalOrganizationGroupContainers,\n  loadLocalOrganizationGroupMembers,\n  loadLocalOrganizationUserDetail,\n  type OrganizationContainerGrants,\n  type OrganizationDirectoryAndGroups,\n  type OrganizationGroupContainers,\n  type OrganizationGroupMembers,\n  type OrganizationGroupPolicyHistory,\n  type OrganizationPolicyHistory,\n  type OrganizationUserDetail,\n  reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n  organizationAccessScopeKey,\n  wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/readModel/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { recoverOrganizationAccess } from \"./organizationAccessRestoration\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null>;\n  loadLocalGroupMembers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupMembers | null>;\n  loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationGroupPolicyHistory | null>;\n  loadOrganizationPolicyHistory(\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationPolicyHistory | null>;\n  loadLocalGrants(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationContainerGrants | null>;\n  loadLocalGroupContainers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupContainers | null>;\n  loadLocalUserDetail(\n    userId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationUserDetail | null>;\n  /**\n   * Resolves `undefined` when the runtime declines without I/O (offline,\n   * database not ready, organization mismatch) or when the feed failed with\n   * no locally retained projection — passes that must not count as caught\n   * up; `null` when the reconcile completed but produced nothing presentable\n   * — including an authoritative denial that purged the projection, which\n   * consumers must repaint.\n   */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n  reconcileAfterMutation(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n  implements OrganizationReadModelCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDirectoryAndGroups | null | undefined>>\n  >();\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationDirectoryAndGroups({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGrants(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationContainerGrants({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupContainers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupMembers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationGroupHistory({\n      active,\n      groupId,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadOrganizationPolicyHistory(\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) return null;\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationHistory({\n      active,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadLocalUserDetail(userId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || userId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationUserDetail({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      userId,\n    });\n  }\n\n  reconcile(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return Promise.resolve(undefined);\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    // Snapshot the server-denied flag before reconciling. A reconcile that\n    // flips it back to readable means org access was just restored (e.g. the\n    // user was re-added to a group), and any write lanes idled by\n    // permission-denied submissions have no self re-arm — regaining access is\n    // their retry signal, mirroring how billing recovery re-requests all\n    // lanes. Only a genuine server denial counts: a local session reset also\n    // marks scopes denied, and re-arming on its first reconcile would race the\n    // startup sync passes (e.g. pending-create adoption between panes).\n    const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n      {\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      },\n      \"readModel\",\n    );\n    const domainScope = active.runtime.state.domainScope;\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(\n        this.runtimeService,\n        active,\n        domainScope,\n      );\n\n    const reconciliation = reconcileOrganizationDirectoryAndGroups({\n      apiClient: active.runtime.apiClient,\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n    })\n      .then(async (directoryAndGroups) => {\n        if (!stillCurrent()) return null;\n        // Feed success restores retry eligibility even if name decryption fails.\n        const accessWasRestored =\n          accessWasDenied &&\n          directoryAndGroups !== null &&\n          directoryAndGroups !== undefined;\n        if (accessWasRestored)\n          await recoverOrganizationAccess({\n            active,\n            domainScope,\n            stillCurrent,\n          });\n        if (!stillCurrent()) return null;\n        return hydrateOrganizationGroupNamesForRuntime(\n          this.runtimeService,\n          active,\n          domainScope,\n          directoryAndGroups,\n        );\n      })\n      .finally(() => {\n        if (byKey.get(key) === reconciliation) {\n          byKey.delete(key);\n        }\n      });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n\n  async reconcileAfterMutation(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return undefined;\n    }\n    const existing = this.reconciliationMap(active).get(\n      organizationAccessScopeKey(active.organizationId, active.userId),\n    );\n    if (existing) {\n      await existing.catch(() => null);\n    }\n    return this.reconcile(active.organizationId);\n  }\n}\n\nexport function createOrganizationReadModelCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}
+{"version":3,"file":"organizationReadModels.js","sourceRoot":"","sources":["organizationReadModels.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAC1G,OAAO,EACL,oCAAoC,EACpC,uCAAuC,EACvC,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,EAQ/B,uCAAuC,GACxC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,+CAA+C,GAChD,MAAM,6EAA6E,CAAC;AAErF,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAEL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAGtC,CAAC;AA8CJ,MAAM,oCAAoC;IAOX;IAJZ,sBAAsB,GAAG,IAAI,OAAO,EAGlD,CAAC;IACJ,YAA6B,cAA+B;QAA/B,mBAAc,GAAd,cAAc,CAAiB;IAAG,CAAC;IAExD,iBAAiB,CAAC,MAAqC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAuB;QACrC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uCAAuC,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAuB;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,cAAuB;QACrE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,oCAAoC,CAAC;YAC1C,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,cAAuB;QAClE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,iCAAiC,CAAC;YACvC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,mCAAmC,CAAC;YACzC,MAAM;YACN,OAAO;YACP,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,cAAuB,EACvB,aAAsB;QAEtB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,OAAO,8BAA8B,CAAC;YACpC,MAAM;YACN,aAAa;YACb,YAAY,EAAE,GAAG,EAAE,CACjB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ;SACJ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,cAAuB;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,0BAA0B,CACpC,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,+CAA+C,CACrE;YACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,EACD,WAAW,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,gCAAgC,CAC9B,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,CACZ,CAAC;QAEJ,MAAM,cAAc,GAAG,uCAAuC,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;YACtC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE;YACjC,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,yEAAyE;YACzE,MAAM,iBAAiB,GACrB,eAAe;gBACf,kBAAkB,KAAK,IAAI;gBAC3B,kBAAkB,KAAK,SAAS,CAAC;YACnC,IAAI,iBAAiB;gBACnB,MAAM,yBAAyB,CAAC;oBAC9B,WAAW;oBACX,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;oBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,YAAY;oBACZ,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,uCAAuC,CAC5C,IAAI,CAAC,cAAc,EACnB,MAAM,EACN,WAAW,EACX,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,cAAuB;QAEvB,MAAM,MAAM,GAAG,6BAA6B,CAC1C,IAAI,CAAC,cAAc,EACnB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,CACjD,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CACjE,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,cAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,oCAAoC,CAAC,cAAc,CAAC,CAAC;IAC7E,qBAAqB,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { DomainScope } from \"../../data/shared/domainScope\";\nimport { recoverOrganizationAccess } from \"../../workflows/container-contents/recovery/accessRestoration\";\nimport {\n  loadLocalOrganizationContainerGrants,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadLocalOrganizationGroupContainers,\n  loadLocalOrganizationGroupMembers,\n  loadLocalOrganizationUserDetail,\n  type OrganizationContainerGrants,\n  type OrganizationDirectoryAndGroups,\n  type OrganizationGroupContainers,\n  type OrganizationGroupMembers,\n  type OrganizationGroupPolicyHistory,\n  type OrganizationPolicyHistory,\n  type OrganizationUserDetail,\n  reconcileOrganizationDirectoryAndGroups,\n} from \"../../workflows/organizations\";\nimport {\n  organizationAccessScopeKey,\n  wasOrganizationPresentationAccessDeniedByServer,\n} from \"../../workflows/organizations/readModel/organizationPresentationAccessState\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport { loadBoundedOrganizationGroupHistory } from \"./organizationGroupHistory\";\nimport { hydrateOrganizationGroupNamesForRuntime } from \"./organizationGroupNameHydration\";\nimport { loadBoundedOrganizationHistory } from \"./organizationHistory\";\nimport {\n  type ActiveOrganizationDataRuntime,\n  activeOrganizationDataRuntime,\n  isOrganizationDataRuntimeCurrent,\n} from \"./organizationWorkflowRuntime\";\n\nconst coordinatorsByRuntime = new WeakMap<\n  InternalRuntime,\n  OrganizationReadModelCoordinator\n>();\n\nexport interface OrganizationReadModelCoordinator {\n  loadLocal(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null>;\n  loadLocalGroupMembers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupMembers | null>;\n  loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationGroupPolicyHistory | null>;\n  loadOrganizationPolicyHistory(\n    organizationId?: string | undefined,\n    beforeVersion?: number | undefined,\n  ): Promise<OrganizationPolicyHistory | null>;\n  loadLocalGrants(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationContainerGrants | null>;\n  loadLocalGroupContainers(\n    groupId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationGroupContainers | null>;\n  loadLocalUserDetail(\n    userId: string,\n    organizationId?: string | undefined,\n  ): Promise<OrganizationUserDetail | null>;\n  /**\n   * Resolves `undefined` when the runtime declines without I/O (offline,\n   * database not ready, organization mismatch) or when the feed failed with\n   * no locally retained projection — passes that must not count as caught\n   * up; `null` when the reconcile completed but produced nothing presentable\n   * — including an authoritative denial that purged the projection, which\n   * consumers must repaint.\n   */\n  reconcile(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n  reconcileAfterMutation(\n    organizationId?: string | undefined,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined>;\n}\n\nclass OrganizationReadModelCoordinatorImpl\n  implements OrganizationReadModelCoordinator\n{\n  private readonly reconciliationsByScope = new WeakMap<\n    DomainScope,\n    Map<string, Promise<OrganizationDirectoryAndGroups | null | undefined>>\n  >();\n  constructor(private readonly runtimeService: InternalRuntime) {}\n\n  private reconciliationMap(active: ActiveOrganizationDataRuntime) {\n    const scope = active.runtime.state.domainScope;\n    let byKey = this.reconciliationsByScope.get(scope);\n    if (!byKey) {\n      byKey = new Map();\n      this.reconciliationsByScope.set(scope, byKey);\n    }\n    return byKey;\n  }\n\n  async loadLocal(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationDirectoryAndGroups({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGrants(organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) {\n      return null;\n    }\n    return loadLocalOrganizationContainerGrants({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupContainers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupContainers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadLocalGroupMembers(groupId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationGroupMembers({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      groupId,\n      organizationId: active.organizationId,\n    });\n  }\n\n  async loadGroupPolicyHistory(\n    groupId: string,\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || groupId.length === 0) {\n      return null;\n    }\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationGroupHistory({\n      active,\n      groupId,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadOrganizationPolicyHistory(\n    organizationId?: string,\n    beforeVersion?: number,\n  ) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active) return null;\n    const domainScope = active.runtime.state.domainScope;\n    return loadBoundedOrganizationHistory({\n      active,\n      beforeVersion,\n      stillCurrent: () =>\n        isOrganizationDataRuntimeCurrent(\n          this.runtimeService,\n          active,\n          domainScope,\n        ),\n    });\n  }\n\n  async loadLocalUserDetail(userId: string, organizationId?: string) {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active || userId.length === 0) {\n      return null;\n    }\n    return loadLocalOrganizationUserDetail({\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      organizationId: active.organizationId,\n      userId,\n    });\n  }\n\n  reconcile(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return Promise.resolve(undefined);\n    }\n\n    const byKey = this.reconciliationMap(active);\n    const key = organizationAccessScopeKey(\n      active.organizationId,\n      active.userId,\n    );\n    const existing = byKey.get(key);\n    if (existing) {\n      return existing;\n    }\n\n    // Snapshot the server-denied flag before reconciling. A reconcile that\n    // flips it back to readable means org access was just restored (e.g. the\n    // user was re-added to a group), and any write lanes idled by\n    // permission-denied submissions have no self re-arm — regaining access is\n    // their retry signal, mirroring how billing recovery re-requests all\n    // lanes. Only a genuine server denial counts: a local session reset also\n    // marks scopes denied, and re-arming on its first reconcile would race the\n    // startup sync passes (e.g. pending-create adoption between panes).\n    const accessWasDenied = wasOrganizationPresentationAccessDeniedByServer(\n      {\n        execSql: active.runtime.infra.execSql,\n        organizationId: active.organizationId,\n        requesterUserId: active.userId,\n      },\n      \"readModel\",\n    );\n    const domainScope = active.runtime.state.domainScope;\n    const stillCurrent = () =>\n      isOrganizationDataRuntimeCurrent(\n        this.runtimeService,\n        active,\n        domainScope,\n      );\n\n    const reconciliation = reconcileOrganizationDirectoryAndGroups({\n      apiClient: active.runtime.apiClient,\n      currentUserId: active.userId,\n      execSql: active.runtime.infra.execSql,\n      logError: active.runtime.util.logError,\n      organizationId: active.organizationId,\n    })\n      .then(async (directoryAndGroups) => {\n        if (!stillCurrent()) return null;\n        // Feed success restores retry eligibility even if name decryption fails.\n        const accessWasRestored =\n          accessWasDenied &&\n          directoryAndGroups !== null &&\n          directoryAndGroups !== undefined;\n        if (accessWasRestored)\n          await recoverOrganizationAccess({\n            domainScope,\n            execSql: active.runtime.infra.execSql,\n            organizationId: active.organizationId,\n            stillCurrent,\n            userId: active.userId,\n          });\n        if (!stillCurrent()) return null;\n        return hydrateOrganizationGroupNamesForRuntime(\n          this.runtimeService,\n          active,\n          domainScope,\n          directoryAndGroups,\n        );\n      })\n      .finally(() => {\n        if (byKey.get(key) === reconciliation) {\n          byKey.delete(key);\n        }\n      });\n    byKey.set(key, reconciliation);\n    return reconciliation;\n  }\n\n  async reconcileAfterMutation(\n    organizationId?: string,\n  ): Promise<OrganizationDirectoryAndGroups | null | undefined> {\n    const active = activeOrganizationDataRuntime(\n      this.runtimeService,\n      organizationId,\n    );\n    if (!active?.runtime.state.online) {\n      return undefined;\n    }\n    const existing = this.reconciliationMap(active).get(\n      organizationAccessScopeKey(active.organizationId, active.userId),\n    );\n    if (existing) {\n      await existing.catch(() => null);\n    }\n    return this.reconcile(active.organizationId);\n  }\n}\n\nexport function createOrganizationReadModelCoordinator(\n  runtimeService: InternalRuntime,\n): OrganizationReadModelCoordinator {\n  const existing = coordinatorsByRuntime.get(runtimeService);\n  if (existing) {\n    return existing;\n  }\n\n  const coordinator = new OrganizationReadModelCoordinatorImpl(runtimeService);\n  coordinatorsByRuntime.set(runtimeService, coordinator);\n  return coordinator;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.81",
+  "version": "0.1.82",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/{client/organizations/organizationAccessRestoration.js → workflows/container-contents/recovery/accessRestoration.js}

@@ -1,11 +1,11 @@
-import { sqlDocumentMoveIntentPersistence } from "../../data/persistence/container-contents/documentMoveIntentPersistence.js";
-import { requestDormantMetadataRestorationSweeps } from "../../data/persistence/container-contents/dormantMetadataSweep.js";
-import { hasRecordedTerminalSyncFailures } from "../../data/sqlite/documentPersistence/index.js";
-import { requestAllDomainSyncLanes, requestDomainSyncLane, } from "../../data/sync/syncCoordinator.js";
-import { CONTAINER_CONTENTS_SYNC_LANE_KEY } from "../../workflows/container-contents/syncLane.js";
+import { sqlDocumentMoveIntentPersistence } from "../../../data/persistence/container-contents/documentMoveIntentPersistence.js";
+import { requestDormantMetadataRestorationSweeps } from "../../../data/persistence/container-contents/dormantMetadataSweep.js";
+import { hasRecordedTerminalSyncFailures } from "../../../data/sqlite/documentPersistence/index.js";
+import { requestAllDomainSyncLanes, requestDomainSyncLane, } from "../../../data/sync/syncCoordinator.js";
+import { CONTAINER_CONTENTS_SYNC_LANE_KEY } from "../syncLane.js";
 /** Recover parked work before optional presentation hydration can fail. */
 export async function recoverOrganizationAccess(input) {
-    const { active, domainScope, stillCurrent } = input;
+    const { domainScope, execSql, organizationId, stillCurrent, userId } = input;
     if (!stillCurrent())
         return;
     // The evidence gate: re-arm only when some queued write actually
@@ -14,12 +14,16 @@ export async function recoverOrganizationAccess(input) {
     // denied flag, and re-arming then would race the startup sync passes.
     // A failed pass (`undefined`) proves nothing about restored access,
     // so it must not re-arm either.
-    if (((await hasRecordedTerminalSyncFailures(active.runtime.infra.execSql)) ||
-        (await sqlDocumentMoveIntentPersistence.hasDeniedMoveIntents(active.runtime.infra.execSql, { organizationId: active.organizationId }))) &&
+    if (((await hasRecordedTerminalSyncFailures(execSql)) ||
+        (await sqlDocumentMoveIntentPersistence.hasDeniedMoveIntents(execSql, {
+            organizationId,
+        }))) &&
         stillCurrent()) {
         // Parked permission-denied moves (row 7) only replay once flipped
         // back to pending; restore them before re-arming the lanes.
-        await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(active.runtime.infra.execSql, { organizationId: active.organizationId });
+        await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(execSql, {
+            organizationId,
+        });
         if (stillCurrent())
             requestAllDomainSyncLanes(domainScope);
     }
@@ -27,12 +31,12 @@ export async function recoverOrganizationAccess(input) {
     // but run it afterward so a SQLite failure cannot suppress the
     // pre-existing denied-write and move-intent recovery signal.
     if (stillCurrent()) {
-        const requestedDormantSweepCount = await requestDormantMetadataRestorationSweeps(active.runtime.infra.execSql, {
-            requesterUserId: active.userId,
+        const requestedDormantSweepCount = await requestDormantMetadataRestorationSweeps(execSql, {
+            requesterUserId: userId,
         });
         if (requestedDormantSweepCount > 0 && stillCurrent()) {
             requestDomainSyncLane(domainScope, CONTAINER_CONTENTS_SYNC_LANE_KEY);
         }
     }
 }
-//# sourceMappingURL=organizationAccessRestoration.js.map
+//# sourceMappingURL=accessRestoration.js.map

package/workflows/container-contents/recovery/accessRestoration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessRestoration.js","sourceRoot":"","sources":["accessRestoration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,4EAA4E,CAAC;AAC9H,OAAO,EAAE,uCAAuC,EAAE,MAAM,mEAAmE,CAAC;AAE5H,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAE3F,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAM/C;IACC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC7E,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,iEAAiE;IACjE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,gCAAgC;IAChC,IACE,CAAC,CAAC,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC,MAAM,gCAAgC,CAAC,oBAAoB,CAAC,OAAO,EAAE;YACpE,cAAc;SACf,CAAC,CAAC,CAAC;QACN,YAAY,EAAE,EACd,CAAC;QACD,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,gCAAgC,CAAC,sBAAsB,CAAC,OAAO,EAAE;YACrE,cAAc;SACf,CAAC,CAAC;QACH,IAAI,YAAY,EAAE;YAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,sEAAsE;IACtE,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,0BAA0B,GAC9B,MAAM,uCAAuC,CAAC,OAAO,EAAE;YACrD,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QACL,IAAI,0BAA0B,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;YACrD,qBAAqB,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { sqlDocumentMoveIntentPersistence } from \"../../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { requestDormantMetadataRestorationSweeps } from \"../../../data/persistence/container-contents/dormantMetadataSweep\";\nimport type { DomainScope } from \"../../../data/shared/domainScope\";\nimport { hasRecordedTerminalSyncFailures } from \"../../../data/sqlite/documentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n  requestAllDomainSyncLanes,\n  requestDomainSyncLane,\n} from \"../../../data/sync/syncCoordinator\";\nimport { CONTAINER_CONTENTS_SYNC_LANE_KEY } from \"../syncLane\";\n\n/** Recover parked work before optional presentation hydration can fail. */\nexport async function recoverOrganizationAccess(input: {\n  readonly domainScope: DomainScope;\n  readonly execSql: ExecSql;\n  readonly organizationId: string;\n  readonly stillCurrent: () => boolean;\n  readonly userId: string;\n}): Promise<void> {\n  const { domainScope, execSql, organizationId, stillCurrent, userId } = input;\n  if (!stillCurrent()) return;\n  // The evidence gate: re-arm only when some queued write actually\n  // recorded a terminal failure. A transient denial during bootstrap\n  // (e.g. a read-model 403 before grants propagate) also flips the\n  // denied flag, and re-arming then would race the startup sync passes.\n  // A failed pass (`undefined`) proves nothing about restored access,\n  // so it must not re-arm either.\n  if (\n    ((await hasRecordedTerminalSyncFailures(execSql)) ||\n      (await sqlDocumentMoveIntentPersistence.hasDeniedMoveIntents(execSql, {\n        organizationId,\n      }))) &&\n    stillCurrent()\n  ) {\n    // Parked permission-denied moves (row 7) only replay once flipped\n    // back to pending; restore them before re-arming the lanes.\n    await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(execSql, {\n      organizationId,\n    });\n    if (stillCurrent()) requestAllDomainSyncLanes(domainScope);\n  }\n  // Keep dormant cleanup independent from the write-lane evidence gate,\n  // but run it afterward so a SQLite failure cannot suppress the\n  // pre-existing denied-write and move-intent recovery signal.\n  if (stillCurrent()) {\n    const requestedDormantSweepCount =\n      await requestDormantMetadataRestorationSweeps(execSql, {\n        requesterUserId: userId,\n      });\n    if (requestedDormantSweepCount > 0 && stillCurrent()) {\n      requestDomainSyncLane(domainScope, CONTAINER_CONTENTS_SYNC_LANE_KEY);\n    }\n  }\n}\n"]}

package/client/organizations/organizationAccessRestoration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"organizationAccessRestoration.js","sourceRoot":"","sources":["organizationAccessRestoration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yEAAyE,CAAC;AAC3H,OAAO,EAAE,uCAAuC,EAAE,MAAM,gEAAgE,CAAC;AAEzH,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAG/F,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACpD,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,iEAAiE;IACjE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,gCAAgC;IAChC,IACE,CAAC,CAAC,MAAM,+BAA+B,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC,MAAM,gCAAgC,CAAC,oBAAoB,CAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC,CAAC;QACL,YAAY,EAAE,EACd,CAAC;QACD,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,gCAAgC,CAAC,sBAAsB,CAC3D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC;QACF,IAAI,YAAY,EAAE;YAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,sEAAsE;IACtE,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,0BAA0B,GAC9B,MAAM,uCAAuC,CAC3C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC5B;YACE,eAAe,EAAE,MAAM,CAAC,MAAM;SAC/B,CACF,CAAC;QACJ,IAAI,0BAA0B,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;YACrD,qBAAqB,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { sqlDocumentMoveIntentPersistence } from \"../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { requestDormantMetadataRestorationSweeps } from \"../../data/persistence/container-contents/dormantMetadataSweep\";\nimport type { DomainScope } from \"../../data/shared/domainScope\";\nimport { hasRecordedTerminalSyncFailures } from \"../../data/sqlite/documentPersistence\";\nimport {\n  requestAllDomainSyncLanes,\n  requestDomainSyncLane,\n} from \"../../data/sync/syncCoordinator\";\nimport { CONTAINER_CONTENTS_SYNC_LANE_KEY } from \"../../workflows/container-contents/syncLane\";\nimport type { ActiveOrganizationDataRuntime } from \"./organizationWorkflowRuntime\";\n\n/** Recover parked work before optional presentation hydration can fail. */\nexport async function recoverOrganizationAccess(input: {\n  readonly active: ActiveOrganizationDataRuntime;\n  readonly domainScope: DomainScope;\n  readonly stillCurrent: () => boolean;\n}): Promise<void> {\n  const { active, domainScope, stillCurrent } = input;\n  if (!stillCurrent()) return;\n  // The evidence gate: re-arm only when some queued write actually\n  // recorded a terminal failure. A transient denial during bootstrap\n  // (e.g. a read-model 403 before grants propagate) also flips the\n  // denied flag, and re-arming then would race the startup sync passes.\n  // A failed pass (`undefined`) proves nothing about restored access,\n  // so it must not re-arm either.\n  if (\n    ((await hasRecordedTerminalSyncFailures(active.runtime.infra.execSql)) ||\n      (await sqlDocumentMoveIntentPersistence.hasDeniedMoveIntents(\n        active.runtime.infra.execSql,\n        { organizationId: active.organizationId },\n      ))) &&\n    stillCurrent()\n  ) {\n    // Parked permission-denied moves (row 7) only replay once flipped\n    // back to pending; restore them before re-arming the lanes.\n    await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(\n      active.runtime.infra.execSql,\n      { organizationId: active.organizationId },\n    );\n    if (stillCurrent()) requestAllDomainSyncLanes(domainScope);\n  }\n  // Keep dormant cleanup independent from the write-lane evidence gate,\n  // but run it afterward so a SQLite failure cannot suppress the\n  // pre-existing denied-write and move-intent recovery signal.\n  if (stillCurrent()) {\n    const requestedDormantSweepCount =\n      await requestDormantMetadataRestorationSweeps(\n        active.runtime.infra.execSql,\n        {\n          requesterUserId: active.userId,\n        },\n      );\n    if (requestedDormantSweepCount > 0 && stillCurrent()) {\n      requestDomainSyncLane(domainScope, CONTAINER_CONTENTS_SYNC_LANE_KEY);\n    }\n  }\n}\n"]}