@tearleads/client-sdk 0.1.88 → 0.1.89

package/data/persistence/organizations/organizationReadModelPersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationReadModelPersistence.js","sourceRoot":"","sources":["organizationReadModelPersistence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EACL,mCAAmC,EACnC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,gDAAgD,EAAE,MAAM,6CAA6C,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,yCAAyC,CAAC;AAC/F,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,gDAAgD,GAEjD,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,2CAA2C,EAC3C,gDAAgD,EAChD,iDAAiD,GAClD,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAIhG,MAAM,2BAA2B,GAAG,qBAAqB,CACvD,mCAAmC,CACpC,CAAC;AACF,MAAM,uBAAuB,GAAG,qBAAqB,CACnD,2BAA2B,CAC5B,CAAC;AAeF,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,mCAAmC,CAAC;SAC3C,KAAK,CACJ,EAAE,CACA,mCAAmC,CAAC,cAAc,EAClD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IAET,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS;QACT,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CAAC,CAAC;IACJ,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,IAAI,CAAC,MAAM,EACnB,KAAK,IAAI,2BAA2B,EACpC,CAAC;QACD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,mCAAmC,CAAC;aAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,2BAA2B,CAAC,CAAC;aAC9D,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAM9B;IACC,MAAM,YAAY,GAAG;QACnB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,GAAG;KACrB,CAAC;IACF,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,+BAA+B,CAAC;SACvC,MAAM,CAAC,YAAY,CAAC;SACpB,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,+BAA+B,CAAC,cAAc;YAC9C,+BAA+B,CAAC,MAAM;SACvC;QACD,GAAG,EAAE;YACH,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC;KACF,CAAC;SACD,GAAG,EAAE,CAAC;IACT,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,gDAAgD,CAAC;QACrD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,WAAW;QACvB,eAAe,EAAE,KAAK,CAAC,aAAa;QACpC,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAIhC;IACC,kEAAkE;IAClE,wEAAwE;IACxE,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE;SAClC,MAAM,CAAC;QACN,OAAO,EAAE,2BAA2B,CAAC,OAAO;QAC5C,gBAAgB,EAAE,2BAA2B,CAAC,gBAAgB;QAC9D,IAAI,EAAE,2BAA2B,CAAC,IAAI;KACvC,CAAC;SACD,IAAI,CAAC,2BAA2B,CAAC;SACjC,KAAK,CACJ,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CACrE,CAAC;IACJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CACtD,CAAC;IACF,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,2BAA2B,CAAC;SACnC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC3E,GAAG,EAAE,CAAC;IAET,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;QACT,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE;QACjD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,IAAI,IAAI;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,IAAI,IAAI;QACjD,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI;QAC9C,cAAc,EAAE,KAAK,CAAC,YAAY,EAAE,cAAc,IAAI,IAAI;QAC1D,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,IAAI,IAAI;QACpD,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,gBAAgB,IAAI,IAAI;KAC5E,CAAC,CAAC,CAAC;IACJ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,uBAAuB,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,2BAA2B,CAAC;aACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAAC,CAAC;aAC1D,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,EAAgC,EAChC,cAAsB;IAEtB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC;QACN,MAAM,EAAE,0BAA0B,CAAC,MAAM;QACzC,QAAQ,EAAE,0BAA0B,CAAC,oBAAoB;QACzD,cAAc,EAAE,0BAA0B,CAAC,0BAA0B;QACrE,WAAW,EAAE,0BAA0B,CAAC,uBAAuB;QAC/D,aAAa,EAAE,0BAA0B,CAAC,aAAa;QACvD,oBAAoB,EAAE,0BAA0B,CAAC,oBAAoB;QACrE,iBAAiB,EAAE,0BAA0B,CAAC,iBAAiB;QAC/D,SAAS,EAAE,0BAA0B,CAAC,qBAAqB;QAC3D,OAAO,EAAE,0BAA0B,CAAC,wBAAwB;KAC7D,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACpE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAC1E,OAAO,CAAC;IACV,OAAO;QACL,GAAG,IAAI;QACP,gBAAgB,EAAE;YAChB,QAAQ;YACR,cAAc;YACd,WAAW;YACX,SAAS;YACT,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;IACpD,IAAI,aAAa,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QAC5C,OAAO,aAAa,KAAK,KAAK,CAAC,QAAQ,CAAC,UAAU;YAChD,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,OAAO,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,qEAAqE;AACrE,KAAK,UAAU,oBAAoB,CACjC,KAAyB;IAEzB,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;IACjD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC/D,MAAM,oBAAoB,GAAG,gBAAgB;QAC3C,CAAC,CAAC,MAAM,yBAAyB,CAAC;YAC9B,2BAA2B,EACzB,KAAK,CAAC,OAAO,EAAE,oBAAoB,IAAI,IAAI;YAC7C,IAAI,EAAE,gBAAgB;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc;YACd,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU;YAC9C,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC;QACJ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,IAAI,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,oCAAoC,CAAC;YACzC,IAAI,EAAE,MAAM;YACZ,cAAc;YACd,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAA8D;IAE9D,MAAM,oBAAoB,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/D,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,gDAAgD,CAAC;YACrD,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;YAC7C,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACzE,MAAM,mCAAmC,CAAC;YACxC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,oBAAoB;YACpB,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;YAC7C,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gCAAgC,CAAC,KAO/C;IACC,MAAM,gBAAgB,GACpB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,YAAY;QACrD,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAClC,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,iCAAiC,CACzC,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;IACrD,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACjC,iBAAiB,EACf,aAAa,KAAK,SAAS;YACzB,CAAC,CAAC,aAAa,CAAC,iBAAiB;YACjC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,IAAI,IAAI,CAAC;QAChD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,qBAAqB,EAAE,gBAAgB,CAAC,SAAS;QACjD,wBAAwB,EAAE,gBAAgB,CAAC,OAAO;QAClD,oBAAoB,EAAE,gBAAgB,CAAC,QAAQ;QAC/C,0BAA0B,EAAE,gBAAgB,CAAC,cAAc;QAC3D,uBAAuB,EAAE,gBAAgB,CAAC,WAAW;QACrD,SAAS,EAAE,KAAK,CAAC,GAAG;KACrB,CAAC;IACF,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,0BAA0B,CAAC;SAClC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;SACpE,kBAAkB,CAAC;QAClB,MAAM,EAAE,0BAA0B,CAAC,cAAc;QACjD,GAAG,EAAE,MAAM;KACZ,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,KAG7B;IACC,MAAM,aAAa,GACjB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC;IAC7E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,OAAgB,EAChB,cAAsB,EACtB,aAAqB;IAErB,OAAO,2CAA2C,CAAC;QACjD,OAAO;QACP,cAAc;QACd,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CACX,gDAAgD,CAAC;YAC/C,aAAa;YACb,cAAc;YACd,EAAE;SACH,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAKxD;IACC,mCAAmC,CAAC;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,0EAA0E;IAC1E,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,2BAA2B;QAC9B,GAAG,2BAA2B;KAC/B,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,MAAM,iCAAiC,CACzD,KAAK,CAAC,OAAO,CACd,CAAC,WAAW,CACX,KAAK,EAAE,EAAE,EAAqD,EAAE;QAC9D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC1E,MAAM,WAAW,GAAG,uBAAuB,CAAC;YAC1C,OAAO;YACP,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,eAAe,CAAC;YACpB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU;YACjD,GAAG;YACH,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;YAC7C,EAAE;SACH,CAAC,CAAC;QACH,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;YACtC,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,aAAa,GAAG,oBAAoB,CAAC;YACzC,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,MAAM,oBAAoB,GAAG,MAAM,kBAAkB,CAAC;YACpD,OAAO;YACP,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,EAAE;SACH,CAAC,CAAC;QACH,MAAM,gCAAgC,CAAC;YACrC,OAAO;YACP,aAAa;YACb,oBAAoB;YACpB,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,EAAE;SACH,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,WAAW,KAAK,SAAS;QAC3B,qCAAqC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,kBAAkB,CACrE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC9B,CAAC;IACJ,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,OAAgB,EAChB,cAAsB,EACtB,UAAqD,EAAE;IAEvD,MAAM,eAAe,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAC5D,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxE,MAAM,iDAAiD,CAAC;YACtD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,cAAc;YACd,EAAE;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ListOrganizationGroupsResponse,\n  OrganizationGroupCurrentStateResponse,\n  OrganizationReadModelDirectoryResponse,\n  OrganizationReadModelResponse,\n} from \"@tearleads/validators/response\";\nimport { eq } from \"drizzle-orm\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../principals/principalPolicyCoordinator\";\nimport { organizationReadModelTables } from \"../../sqlite/schema\";\nimport { organizationDataUsageTables } from \"../../sqlite/schema/organizationDataUsageSchema\";\nimport {\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../sqlite/schema/organizationReadModelSchema\";\nimport { sqliteInsertBatchSize } from \"../../sqlite/sqliteBindBudget\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { clearOrganizationPresentationDenialInTransaction } from \"./organizationPresentationDenialPersistence\";\nimport { applyOrganizationReadModelGrantsLane } from \"./organizationReadModelGrantPersistence\";\nimport {\n  applyGroupMembershipsLane,\n  assertStoredGroupMembershipBindings,\n  OrganizationReadModelBindingError,\n} from \"./organizationReadModelMembershipPersistence\";\nimport {\n  loadOrganizationReadModelProjectionInTransaction,\n  type OrganizationReadModelProjection,\n} from \"./organizationReadModelProjection\";\nimport {\n  loadWithOrganizationReadModelIntegrityPurge,\n  pruneInactiveOrganizationRequestersInTransaction,\n  purgeOrganizationReadModelProjectionInTransaction,\n} from \"./organizationReadModelPurge\";\nimport { assertOrganizationReadModelResponse } from \"./organizationReadModelResponseAssertions\";\n\nexport type { OrganizationReadModelProjection } from \"./organizationReadModelProjection\";\n\nconst DIRECTORY_INSERT_BATCH_SIZE = sqliteInsertBatchSize(\n  organizationReadModelDirectoryUsers,\n);\nconst GROUP_INSERT_BATCH_SIZE = sqliteInsertBatchSize(\n  organizationReadModelGroups,\n);\n\ntype ApplyOrganizationReadModelResponseResult =\n  | \"already-applied\"\n  | \"applied\"\n  | \"stale\";\n\ninterface CurrentOrganizationReadModelState {\n  readonly cursor: string;\n  readonly memberGroupId: string;\n  readonly memberGroupStateHash: string;\n  readonly organizationHead: OrganizationGroupCurrentStateResponse;\n  readonly profileDocumentId: string | null;\n}\n\nasync function replaceDirectoryLane(input: {\n  readonly directory: OrganizationReadModelDirectoryResponse;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  await input.tx\n    .delete(organizationReadModelDirectoryUsers)\n    .where(\n      eq(\n        organizationReadModelDirectoryUsers.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n\n  const rows = input.directory.users.map((user, sortOrder) => ({\n    organizationId: input.organizationId,\n    userId: user.userId,\n    sortOrder,\n    signingKeyFingerprint: user.signingKeyFingerprint,\n    signingPublicKey: user.signingPublicKey,\n    encapsulationPublicKey: user.encapsulationPublicKey,\n    encapsulationKeyFingerprint: user.encapsulationKeyFingerprint,\n    isPersonalOrganizationOwner: user.isPersonalOrganizationOwner,\n    createdAt: user.createdAt,\n    status: user.status,\n    profileDocumentId: user.profileDocumentId,\n    joinedAt: user.joinedAt,\n    updatedAt: user.updatedAt,\n    disabledAt: user.disabledAt,\n    disabledByUserId: user.disabledByUserId,\n  }));\n  for (\n    let index = 0;\n    index < rows.length;\n    index += DIRECTORY_INSERT_BATCH_SIZE\n  ) {\n    await input.tx\n      .insert(organizationReadModelDirectoryUsers)\n      .values(rows.slice(index, index + DIRECTORY_INSERT_BATCH_SIZE))\n      .run();\n  }\n}\n\nasync function upsertRequester(input: {\n  readonly currentUserId: string;\n  readonly isOrgAdmin: boolean;\n  readonly now: string;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const requesterRow = {\n    organizationId: input.organizationId,\n    userId: input.currentUserId,\n    isOrgAdmin: input.isOrgAdmin,\n    updatedAt: input.now,\n  };\n  await input.tx\n    .insert(organizationReadModelRequesters)\n    .values(requesterRow)\n    .onConflictDoUpdate({\n      target: [\n        organizationReadModelRequesters.organizationId,\n        organizationReadModelRequesters.userId,\n      ],\n      set: {\n        isOrgAdmin: requesterRow.isOrgAdmin,\n        updatedAt: requesterRow.updatedAt,\n      },\n    })\n    .run();\n  // Storing an authoritative response proves access: retire the durable\n  // denial marker for this scope in the same transaction.\n  await clearOrganizationPresentationDenialInTransaction({\n    organizationId: input.organizationId,\n    projection: \"readModel\",\n    requesterUserId: input.currentUserId,\n    tx: input.tx,\n  });\n}\n\nasync function replaceGroupsLane(input: {\n  readonly groups: ListOrganizationGroupsResponse;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  // Hydrated names and delivered membership heads outlive a catalog\n  // replacement; the groupMemberships lane rebinds any head that changed.\n  const previousGroups = await input.tx\n    .select({\n      groupId: organizationReadModelGroups.groupId,\n      membersStateHash: organizationReadModelGroups.membersStateHash,\n      name: organizationReadModelGroups.name,\n    })\n    .from(organizationReadModelGroups)\n    .where(\n      eq(organizationReadModelGroups.organizationId, input.organizationId),\n    );\n  const previousById = new Map(\n    previousGroups.map((group) => [group.groupId, group]),\n  );\n  await input.tx\n    .delete(organizationReadModelGroups)\n    .where(eq(organizationReadModelGroups.organizationId, input.organizationId))\n    .run();\n\n  const rows = input.groups.groups.map((group, sortOrder) => ({\n    organizationId: input.organizationId,\n    groupId: group.groupId,\n    sortOrder,\n    name: previousById.get(group.groupId)?.name ?? \"\",\n    createdAt: group.createdAt,\n    isBuiltin: group.isBuiltin,\n    stateHash: group.currentState?.stateHash ?? null,\n    stateVersion: group.currentState?.version ?? null,\n    keyEpoch: group.currentState?.keyEpoch ?? null,\n    keyFingerprint: group.currentState?.keyFingerprint ?? null,\n    memberCount: group.currentState?.memberCount ?? null,\n    membersStateHash: previousById.get(group.groupId)?.membersStateHash ?? null,\n  }));\n  for (let index = 0; index < rows.length; index += GROUP_INSERT_BATCH_SIZE) {\n    await input.tx\n      .insert(organizationReadModelGroups)\n      .values(rows.slice(index, index + GROUP_INSERT_BATCH_SIZE))\n      .run();\n  }\n}\n\nasync function loadCurrentState(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<CurrentOrganizationReadModelState | null> {\n  const [current] = await tx\n    .select({\n      cursor: organizationReadModelState.cursor,\n      keyEpoch: organizationReadModelState.organizationKeyEpoch,\n      keyFingerprint: organizationReadModelState.organizationKeyFingerprint,\n      memberCount: organizationReadModelState.organizationMemberCount,\n      memberGroupId: organizationReadModelState.memberGroupId,\n      memberGroupStateHash: organizationReadModelState.memberGroupStateHash,\n      profileDocumentId: organizationReadModelState.profileDocumentId,\n      stateHash: organizationReadModelState.organizationStateHash,\n      version: organizationReadModelState.organizationStateVersion,\n    })\n    .from(organizationReadModelState)\n    .where(eq(organizationReadModelState.organizationId, organizationId))\n    .limit(1);\n  if (!current) {\n    return null;\n  }\n  const { keyEpoch, keyFingerprint, memberCount, stateHash, version, ...rest } =\n    current;\n  return {\n    ...rest,\n    organizationHead: {\n      keyEpoch,\n      keyFingerprint,\n      memberCount,\n      stateHash,\n      version,\n    },\n  };\n}\n\nfunction resolveApplyDisposition(input: {\n  readonly current: CurrentOrganizationReadModelState | null;\n  readonly requestedCursor: string | null;\n  readonly response: OrganizationReadModelResponse;\n}): ApplyOrganizationReadModelResponseResult | null {\n  const currentCursor = input.current?.cursor ?? null;\n  if (currentCursor !== input.requestedCursor) {\n    return currentCursor === input.response.nextCursor\n      ? \"already-applied\"\n      : \"stale\";\n  }\n  if (!input.current && input.response.mode !== \"snapshot\") {\n    throw new Error(\"Organization read-model delta requires a local snapshot\");\n  }\n  return null;\n}\n\ninterface ResponseLanesInput {\n  readonly current: CurrentOrganizationReadModelState | null;\n  readonly memberGroupId: string;\n  readonly response: OrganizationReadModelResponse;\n  readonly tx: ClientSQLiteTransactionScope;\n}\n\n/** Apply every carried lane and return the reserved Members head. */\nasync function replaceResponseLanes(\n  input: ResponseLanesInput,\n): Promise<string | null> {\n  const { organizationId } = input.response;\n  const directory = input.response.lanes.directory;\n  if (directory) {\n    await replaceDirectoryLane({ directory, organizationId, tx: input.tx });\n  }\n  const groups = input.response.lanes.groups;\n  if (groups) {\n    await replaceGroupsLane({ groups, organizationId, tx: input.tx });\n  }\n  const groupMemberships = input.response.lanes.groupMemberships;\n  const memberGroupStateHash = groupMemberships\n    ? await applyGroupMembershipsLane({\n        currentMemberGroupStateHash:\n          input.current?.memberGroupStateHash ?? null,\n        lane: groupMemberships,\n        memberGroupId: input.memberGroupId,\n        organizationId,\n        replaceAll: input.response.mode === \"snapshot\",\n        tx: input.tx,\n      })\n    : (input.current?.memberGroupStateHash ?? null);\n  const grants = input.response.lanes.grants;\n  if (grants) {\n    await applyOrganizationReadModelGrantsLane({\n      lane: grants,\n      organizationId,\n      tx: input.tx,\n    });\n  }\n  return memberGroupStateHash;\n}\n\nasync function applyResponseLanes(\n  input: ResponseLanesInput & { readonly currentUserId: string },\n): Promise<string | null> {\n  const memberGroupStateHash = await replaceResponseLanes(input);\n  // The directory lane is the authoritative roster, already persisted above:\n  // requester rows for users it no longer lists as active fall with it.\n  if (input.response.lanes.directory) {\n    await pruneInactiveOrganizationRequestersInTransaction({\n      organizationId: input.response.organizationId,\n      retainUserId: input.currentUserId,\n      tx: input.tx,\n    });\n  }\n  if (input.response.lanes.groups || input.response.lanes.groupMemberships) {\n    await assertStoredGroupMembershipBindings({\n      memberGroupId: input.memberGroupId,\n      memberGroupStateHash,\n      organizationId: input.response.organizationId,\n      tx: input.tx,\n    });\n  }\n  return memberGroupStateHash;\n}\n\n/**\n * Write the cursor with the organization policy head and the reserved Members\n * head in one row, so a failure anywhere in the page rolls them back together.\n */\nasync function upsertOrganizationReadModelState(input: {\n  readonly current: CurrentOrganizationReadModelState | null;\n  readonly memberGroupId: string;\n  readonly memberGroupStateHash: string | null;\n  readonly now: string;\n  readonly response: OrganizationReadModelResponse;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const organizationHead =\n    input.response.lanes.organizationPolicy?.currentState ??\n    input.current?.organizationHead;\n  if (!organizationHead || input.memberGroupStateHash === null) {\n    throw new OrganizationReadModelBindingError(\n      \"Organization read-model policy or Members head is missing\",\n    );\n  }\n  const directoryLane = input.response.lanes.directory;\n  const values = {\n    cursor: input.response.nextCursor,\n    profileDocumentId:\n      directoryLane !== undefined\n        ? directoryLane.profileDocumentId\n        : (input.current?.profileDocumentId ?? null),\n    memberGroupId: input.memberGroupId,\n    memberGroupStateHash: input.memberGroupStateHash,\n    organizationStateHash: organizationHead.stateHash,\n    organizationStateVersion: organizationHead.version,\n    organizationKeyEpoch: organizationHead.keyEpoch,\n    organizationKeyFingerprint: organizationHead.keyFingerprint,\n    organizationMemberCount: organizationHead.memberCount,\n    updatedAt: input.now,\n  };\n  await input.tx\n    .insert(organizationReadModelState)\n    .values({ ...values, organizationId: input.response.organizationId })\n    .onConflictDoUpdate({\n      target: organizationReadModelState.organizationId,\n      set: values,\n    })\n    .run();\n}\n\nfunction requireMemberGroupId(input: {\n  readonly current: CurrentOrganizationReadModelState | null;\n  readonly response: OrganizationReadModelResponse;\n}): string {\n  const memberGroupId =\n    input.response.lanes.groups?.memberGroupId ?? input.current?.memberGroupId;\n  if (!memberGroupId) {\n    throw new Error(\"Organization read-model member group is missing\");\n  }\n  return memberGroupId;\n}\n\nexport async function loadOrganizationReadModelProjection(\n  execSql: ExecSql,\n  organizationId: string,\n  currentUserId: string,\n): Promise<OrganizationReadModelProjection | null> {\n  return loadWithOrganizationReadModelIntegrityPurge({\n    execSql,\n    organizationId,\n    load: (tx) =>\n      loadOrganizationReadModelProjectionInTransaction({\n        currentUserId,\n        organizationId,\n        tx,\n      }),\n  });\n}\n\nexport async function applyOrganizationReadModelResponse(input: {\n  readonly currentUserId: string;\n  readonly execSql: ExecSql;\n  readonly requestedCursor: string | null;\n  readonly response: OrganizationReadModelResponse;\n}): Promise<ApplyOrganizationReadModelResponseResult> {\n  assertOrganizationReadModelResponse({\n    currentUserId: input.currentUserId,\n    response: input.response,\n  });\n  // The requester prune below also retires pruned users' usage projections.\n  await ensureSqlTables(input.execSql, [\n    ...organizationReadModelTables,\n    ...organizationDataUsageTables,\n  ]);\n\n  const disposition = await getClientSQLitePersistenceRuntime(\n    input.execSql,\n  ).transaction(\n    async (tx): Promise<ApplyOrganizationReadModelResponseResult> => {\n      const current = await loadCurrentState(tx, input.response.organizationId);\n      const disposition = resolveApplyDisposition({\n        current,\n        requestedCursor: input.requestedCursor,\n        response: input.response,\n      });\n      if (disposition === \"stale\") {\n        return disposition;\n      }\n      const now = new Date().toISOString();\n      await upsertRequester({\n        currentUserId: input.currentUserId,\n        isOrgAdmin: input.response.currentUser.isOrgAdmin,\n        now,\n        organizationId: input.response.organizationId,\n        tx,\n      });\n      if (disposition === \"already-applied\") {\n        return disposition;\n      }\n      const memberGroupId = requireMemberGroupId({\n        current,\n        response: input.response,\n      });\n      const memberGroupStateHash = await applyResponseLanes({\n        current,\n        currentUserId: input.currentUserId,\n        memberGroupId,\n        response: input.response,\n        tx,\n      });\n      await upsertOrganizationReadModelState({\n        current,\n        memberGroupId,\n        memberGroupStateHash,\n        now,\n        response: input.response,\n        tx,\n      });\n\n      return \"applied\";\n    },\n  );\n  // An applied change follows an organization hint or mutation; in-flight\n  // operations recover the directory again instead of reusing their memo.\n  if (disposition === \"applied\")\n    getOrCreatePrincipalPolicyCoordinator(input.execSql).invalidateRecovery(\n      input.response.organizationId,\n    );\n  return disposition;\n}\n\nexport async function purgeOrganizationReadModelProjection(\n  execSql: ExecSql,\n  organizationId: string,\n  options: { readonly onlyRequesterUserId?: string } = {},\n): Promise<void> {\n  await ensureSqlTables(execSql, organizationReadModelTables);\n  await getClientSQLitePersistenceRuntime(execSql).transaction(async (tx) => {\n    await purgeOrganizationReadModelProjectionInTransaction({\n      onlyRequesterUserId: options.onlyRequesterUserId,\n      organizationId,\n      tx,\n    });\n  });\n}\n"]}
+{"version":3,"file":"organizationReadModelPersistence.js","sourceRoot":"","sources":["organizationReadModelPersistence.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EACL,mCAAmC,EACnC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAEL,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAgB,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,gDAAgD,EAAE,MAAM,6CAA6C,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,yCAAyC,CAAC;AAC/F,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,gDAAgD,GAEjD,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,2CAA2C,EAC3C,gDAAgD,EAChD,iDAAiD,GAClD,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAIhG,MAAM,2BAA2B,GAAG,qBAAqB,CACvD,mCAAmC,CACpC,CAAC;AACF,MAAM,uBAAuB,GAAG,qBAAqB,CACnD,2BAA2B,CAC5B,CAAC;AAeF;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,cAAsB,EACtB,IAA6D;IAE7D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,OAAO,OAAO;QACZ,OAAO,CAAC,cAAc,KAAK,cAAc;QACzC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAInC;IACC,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,mCAAmC,CAAC;SAC3C,KAAK,CACJ,EAAE,CACA,mCAAmC,CAAC,cAAc,EAClD,KAAK,CAAC,cAAc,CACrB,CACF;SACA,GAAG,EAAE,CAAC;IAET,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS;QACT,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,YAAY,EAAE,sBAAsB,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC;KACjE,CAAC,CAAC,CAAC;IACJ,KACE,IAAI,KAAK,GAAG,CAAC,EACb,KAAK,GAAG,IAAI,CAAC,MAAM,EACnB,KAAK,IAAI,2BAA2B,EACpC,CAAC;QACD,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,mCAAmC,CAAC;aAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,2BAA2B,CAAC,CAAC;aAC9D,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAM9B;IACC,MAAM,YAAY,GAAG;QACnB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,GAAG;KACrB,CAAC;IACF,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,+BAA+B,CAAC;SACvC,MAAM,CAAC,YAAY,CAAC;SACpB,kBAAkB,CAAC;QAClB,MAAM,EAAE;YACN,+BAA+B,CAAC,cAAc;YAC9C,+BAA+B,CAAC,MAAM;SACvC;QACD,GAAG,EAAE;YACH,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC;KACF,CAAC;SACD,GAAG,EAAE,CAAC;IACT,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,gDAAgD,CAAC;QACrD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,WAAW;QACvB,eAAe,EAAE,KAAK,CAAC,aAAa;QACpC,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAIhC;IACC,kEAAkE;IAClE,wEAAwE;IACxE,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE;SAClC,MAAM,CAAC;QACN,OAAO,EAAE,2BAA2B,CAAC,OAAO;QAC5C,gBAAgB,EAAE,2BAA2B,CAAC,gBAAgB;QAC9D,IAAI,EAAE,2BAA2B,CAAC,IAAI;KACvC,CAAC;SACD,IAAI,CAAC,2BAA2B,CAAC;SACjC,KAAK,CACJ,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CACrE,CAAC;IACJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CACtD,CAAC;IACF,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,2BAA2B,CAAC;SACnC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC3E,GAAG,EAAE,CAAC;IAET,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;QACT,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE;QACjD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,IAAI,IAAI;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,IAAI,IAAI;QACjD,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI;QAC9C,cAAc,EAAE,KAAK,CAAC,YAAY,EAAE,cAAc,IAAI,IAAI;QAC1D,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,IAAI,IAAI;QACpD,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,gBAAgB,IAAI,IAAI;KAC5E,CAAC,CAAC,CAAC;IACJ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,uBAAuB,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,EAAE;aACX,MAAM,CAAC,2BAA2B,CAAC;aACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAAC,CAAC;aAC1D,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,EAAgC,EAChC,cAAsB;IAEtB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC;QACN,MAAM,EAAE,0BAA0B,CAAC,MAAM;QACzC,QAAQ,EAAE,0BAA0B,CAAC,oBAAoB;QACzD,cAAc,EAAE,0BAA0B,CAAC,0BAA0B;QACrE,WAAW,EAAE,0BAA0B,CAAC,uBAAuB;QAC/D,aAAa,EAAE,0BAA0B,CAAC,aAAa;QACvD,oBAAoB,EAAE,0BAA0B,CAAC,oBAAoB;QACrE,iBAAiB,EAAE,0BAA0B,CAAC,iBAAiB;QAC/D,SAAS,EAAE,0BAA0B,CAAC,qBAAqB;QAC3D,OAAO,EAAE,0BAA0B,CAAC,wBAAwB;KAC7D,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACpE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAC1E,OAAO,CAAC;IACV,OAAO;QACL,GAAG,IAAI;QACP,gBAAgB,EAAE;YAChB,QAAQ;YACR,cAAc;YACd,WAAW;YACX,SAAS;YACT,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAIhC;IACC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;IACpD,IAAI,aAAa,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QAC5C,OAAO,aAAa,KAAK,KAAK,CAAC,QAAQ,CAAC,UAAU;YAChD,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,OAAO,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,qEAAqE;AACrE,KAAK,UAAU,oBAAoB,CACjC,KAAyB;IAEzB,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;IACjD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC/D,MAAM,oBAAoB,GAAG,gBAAgB;QAC3C,CAAC,CAAC,MAAM,yBAAyB,CAAC;YAC9B,2BAA2B,EACzB,KAAK,CAAC,OAAO,EAAE,oBAAoB,IAAI,IAAI;YAC7C,IAAI,EAAE,gBAAgB;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc;YACd,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU;YAC9C,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC;QACJ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,IAAI,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,oCAAoC,CAAC;YACzC,IAAI,EAAE,MAAM;YACZ,cAAc;YACd,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAA8D;IAE9D,MAAM,oBAAoB,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/D,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,gDAAgD,CAAC;YACrD,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;YAC7C,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACzE,MAAM,mCAAmC,CAAC;YACxC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,oBAAoB;YACpB,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;YAC7C,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gCAAgC,CAAC,KAO/C;IACC,MAAM,gBAAgB,GACpB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,YAAY;QACrD,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAClC,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,iCAAiC,CACzC,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;IACrD,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACjC,iBAAiB,EACf,aAAa,KAAK,SAAS;YACzB,CAAC,CAAC,aAAa,CAAC,iBAAiB;YACjC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,IAAI,IAAI,CAAC;QAChD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,qBAAqB,EAAE,gBAAgB,CAAC,SAAS;QACjD,wBAAwB,EAAE,gBAAgB,CAAC,OAAO;QAClD,oBAAoB,EAAE,gBAAgB,CAAC,QAAQ;QAC/C,0BAA0B,EAAE,gBAAgB,CAAC,cAAc;QAC3D,uBAAuB,EAAE,gBAAgB,CAAC,WAAW;QACrD,SAAS,EAAE,KAAK,CAAC,GAAG;KACrB,CAAC;IACF,MAAM,KAAK,CAAC,EAAE;SACX,MAAM,CAAC,0BAA0B,CAAC;SAClC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;SACpE,kBAAkB,CAAC;QAClB,MAAM,EAAE,0BAA0B,CAAC,cAAc;QACjD,GAAG,EAAE,MAAM;KACZ,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,KAG7B;IACC,MAAM,aAAa,GACjB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC;IAC7E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,OAAgB,EAChB,cAAsB,EACtB,aAAqB;IAErB,OAAO,2CAA2C,CAAC;QACjD,OAAO;QACP,cAAc;QACd,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CACX,gDAAgD,CAAC;YAC/C,aAAa;YACb,cAAc;YACd,EAAE;SACH,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAKxD;IACC,mCAAmC,CAAC;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,0EAA0E;IAC1E,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;QACnC,GAAG,2BAA2B;QAC9B,GAAG,2BAA2B;KAC/B,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,MAAM,iCAAiC,CACzD,KAAK,CAAC,OAAO,CACd,CAAC,WAAW,CACX,KAAK,EAAE,EAAE,EAAqD,EAAE;QAC9D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC1E,MAAM,WAAW,GAAG,uBAAuB,CAAC;YAC1C,OAAO;YACP,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,eAAe,CAAC;YACpB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU;YACjD,GAAG;YACH,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;YAC7C,EAAE;SACH,CAAC,CAAC;QACH,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;YACtC,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,aAAa,GAAG,oBAAoB,CAAC;YACzC,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,MAAM,oBAAoB,GAAG,MAAM,kBAAkB,CAAC;YACpD,OAAO;YACP,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,EAAE;SACH,CAAC,CAAC;QACH,MAAM,gCAAgC,CAAC;YACrC,OAAO;YACP,aAAa;YACb,oBAAoB;YACpB,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,EAAE;SACH,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,WAAW,KAAK,SAAS;QAC3B,qCAAqC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,kBAAkB,CACrE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAC9B,CAAC;IACJ,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,OAAgB,EAChB,cAAsB,EACtB,UAAqD,EAAE;IAEvD,MAAM,eAAe,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAC5D,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxE,MAAM,iDAAiD,CAAC;YACtD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,cAAc;YACd,EAAE;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ListOrganizationGroupsResponse,\n  OrganizationGroupCurrentStateResponse,\n  OrganizationReadModelDirectoryResponse,\n  OrganizationReadModelResponse,\n} from \"@tearleads/validators/response\";\nimport { eq } from \"drizzle-orm\";\nimport { getOrCreatePrincipalPolicyCoordinator } from \"../../principals/principalPolicyCoordinator\";\nimport { organizationReadModelTables } from \"../../sqlite/schema\";\nimport { organizationDataUsageTables } from \"../../sqlite/schema/organizationDataUsageSchema\";\nimport {\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../sqlite/schema/organizationReadModelSchema\";\nimport { sqliteInsertBatchSize } from \"../../sqlite/sqliteBindBudget\";\nimport {\n  type ClientSQLiteTransactionScope,\n  getClientSQLitePersistenceRuntime,\n} from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { type ExecSql, ensureSqlTables } from \"../../sqlite/sqlSchema\";\nimport { clearOrganizationPresentationDenialInTransaction } from \"./organizationPresentationDenialPersistence\";\nimport { applyOrganizationReadModelGrantsLane } from \"./organizationReadModelGrantPersistence\";\nimport {\n  applyGroupMembershipsLane,\n  assertStoredGroupMembershipBindings,\n  OrganizationReadModelBindingError,\n} from \"./organizationReadModelMembershipPersistence\";\nimport {\n  loadOrganizationReadModelProjectionInTransaction,\n  type OrganizationReadModelProjection,\n} from \"./organizationReadModelProjection\";\nimport {\n  loadWithOrganizationReadModelIntegrityPurge,\n  pruneInactiveOrganizationRequestersInTransaction,\n  purgeOrganizationReadModelProjectionInTransaction,\n} from \"./organizationReadModelPurge\";\nimport { assertOrganizationReadModelResponse } from \"./organizationReadModelResponseAssertions\";\n\nexport type { OrganizationReadModelProjection } from \"./organizationReadModelProjection\";\n\nconst DIRECTORY_INSERT_BATCH_SIZE = sqliteInsertBatchSize(\n  organizationReadModelDirectoryUsers,\n);\nconst GROUP_INSERT_BATCH_SIZE = sqliteInsertBatchSize(\n  organizationReadModelGroups,\n);\n\ntype ApplyOrganizationReadModelResponseResult =\n  | \"already-applied\"\n  | \"applied\"\n  | \"stale\";\n\ninterface CurrentOrganizationReadModelState {\n  readonly cursor: string;\n  readonly memberGroupId: string;\n  readonly memberGroupStateHash: string;\n  readonly organizationHead: OrganizationGroupCurrentStateResponse;\n  readonly profileDocumentId: string | null;\n}\n\n/**\n * The member's leave request as stored JSON, kept only when it names this\n * organization and member. Its signature is checked when read, against the\n * member's trusted identity rather than the key served beside it.\n */\nfunction storedLeaveRequestJson(\n  organizationId: string,\n  user: OrganizationReadModelDirectoryResponse[\"users\"][number],\n): string | null {\n  const request = user.leaveRequest;\n  return request &&\n    request.organizationId === organizationId &&\n    request.userId === user.userId\n    ? JSON.stringify(request)\n    : null;\n}\n\nasync function replaceDirectoryLane(input: {\n  readonly directory: OrganizationReadModelDirectoryResponse;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  await input.tx\n    .delete(organizationReadModelDirectoryUsers)\n    .where(\n      eq(\n        organizationReadModelDirectoryUsers.organizationId,\n        input.organizationId,\n      ),\n    )\n    .run();\n\n  const rows = input.directory.users.map((user, sortOrder) => ({\n    organizationId: input.organizationId,\n    userId: user.userId,\n    sortOrder,\n    signingKeyFingerprint: user.signingKeyFingerprint,\n    signingPublicKey: user.signingPublicKey,\n    encapsulationPublicKey: user.encapsulationPublicKey,\n    encapsulationKeyFingerprint: user.encapsulationKeyFingerprint,\n    isPersonalOrganizationOwner: user.isPersonalOrganizationOwner,\n    createdAt: user.createdAt,\n    status: user.status,\n    profileDocumentId: user.profileDocumentId,\n    joinedAt: user.joinedAt,\n    updatedAt: user.updatedAt,\n    disabledAt: user.disabledAt,\n    disabledByUserId: user.disabledByUserId,\n    leaveRequest: storedLeaveRequestJson(input.organizationId, user),\n  }));\n  for (\n    let index = 0;\n    index < rows.length;\n    index += DIRECTORY_INSERT_BATCH_SIZE\n  ) {\n    await input.tx\n      .insert(organizationReadModelDirectoryUsers)\n      .values(rows.slice(index, index + DIRECTORY_INSERT_BATCH_SIZE))\n      .run();\n  }\n}\n\nasync function upsertRequester(input: {\n  readonly currentUserId: string;\n  readonly isOrgAdmin: boolean;\n  readonly now: string;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const requesterRow = {\n    organizationId: input.organizationId,\n    userId: input.currentUserId,\n    isOrgAdmin: input.isOrgAdmin,\n    updatedAt: input.now,\n  };\n  await input.tx\n    .insert(organizationReadModelRequesters)\n    .values(requesterRow)\n    .onConflictDoUpdate({\n      target: [\n        organizationReadModelRequesters.organizationId,\n        organizationReadModelRequesters.userId,\n      ],\n      set: {\n        isOrgAdmin: requesterRow.isOrgAdmin,\n        updatedAt: requesterRow.updatedAt,\n      },\n    })\n    .run();\n  // Storing an authoritative response proves access: retire the durable\n  // denial marker for this scope in the same transaction.\n  await clearOrganizationPresentationDenialInTransaction({\n    organizationId: input.organizationId,\n    projection: \"readModel\",\n    requesterUserId: input.currentUserId,\n    tx: input.tx,\n  });\n}\n\nasync function replaceGroupsLane(input: {\n  readonly groups: ListOrganizationGroupsResponse;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  // Hydrated names and delivered membership heads outlive a catalog\n  // replacement; the groupMemberships lane rebinds any head that changed.\n  const previousGroups = await input.tx\n    .select({\n      groupId: organizationReadModelGroups.groupId,\n      membersStateHash: organizationReadModelGroups.membersStateHash,\n      name: organizationReadModelGroups.name,\n    })\n    .from(organizationReadModelGroups)\n    .where(\n      eq(organizationReadModelGroups.organizationId, input.organizationId),\n    );\n  const previousById = new Map(\n    previousGroups.map((group) => [group.groupId, group]),\n  );\n  await input.tx\n    .delete(organizationReadModelGroups)\n    .where(eq(organizationReadModelGroups.organizationId, input.organizationId))\n    .run();\n\n  const rows = input.groups.groups.map((group, sortOrder) => ({\n    organizationId: input.organizationId,\n    groupId: group.groupId,\n    sortOrder,\n    name: previousById.get(group.groupId)?.name ?? \"\",\n    createdAt: group.createdAt,\n    isBuiltin: group.isBuiltin,\n    stateHash: group.currentState?.stateHash ?? null,\n    stateVersion: group.currentState?.version ?? null,\n    keyEpoch: group.currentState?.keyEpoch ?? null,\n    keyFingerprint: group.currentState?.keyFingerprint ?? null,\n    memberCount: group.currentState?.memberCount ?? null,\n    membersStateHash: previousById.get(group.groupId)?.membersStateHash ?? null,\n  }));\n  for (let index = 0; index < rows.length; index += GROUP_INSERT_BATCH_SIZE) {\n    await input.tx\n      .insert(organizationReadModelGroups)\n      .values(rows.slice(index, index + GROUP_INSERT_BATCH_SIZE))\n      .run();\n  }\n}\n\nasync function loadCurrentState(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<CurrentOrganizationReadModelState | null> {\n  const [current] = await tx\n    .select({\n      cursor: organizationReadModelState.cursor,\n      keyEpoch: organizationReadModelState.organizationKeyEpoch,\n      keyFingerprint: organizationReadModelState.organizationKeyFingerprint,\n      memberCount: organizationReadModelState.organizationMemberCount,\n      memberGroupId: organizationReadModelState.memberGroupId,\n      memberGroupStateHash: organizationReadModelState.memberGroupStateHash,\n      profileDocumentId: organizationReadModelState.profileDocumentId,\n      stateHash: organizationReadModelState.organizationStateHash,\n      version: organizationReadModelState.organizationStateVersion,\n    })\n    .from(organizationReadModelState)\n    .where(eq(organizationReadModelState.organizationId, organizationId))\n    .limit(1);\n  if (!current) {\n    return null;\n  }\n  const { keyEpoch, keyFingerprint, memberCount, stateHash, version, ...rest } =\n    current;\n  return {\n    ...rest,\n    organizationHead: {\n      keyEpoch,\n      keyFingerprint,\n      memberCount,\n      stateHash,\n      version,\n    },\n  };\n}\n\nfunction resolveApplyDisposition(input: {\n  readonly current: CurrentOrganizationReadModelState | null;\n  readonly requestedCursor: string | null;\n  readonly response: OrganizationReadModelResponse;\n}): ApplyOrganizationReadModelResponseResult | null {\n  const currentCursor = input.current?.cursor ?? null;\n  if (currentCursor !== input.requestedCursor) {\n    return currentCursor === input.response.nextCursor\n      ? \"already-applied\"\n      : \"stale\";\n  }\n  if (!input.current && input.response.mode !== \"snapshot\") {\n    throw new Error(\"Organization read-model delta requires a local snapshot\");\n  }\n  return null;\n}\n\ninterface ResponseLanesInput {\n  readonly current: CurrentOrganizationReadModelState | null;\n  readonly memberGroupId: string;\n  readonly response: OrganizationReadModelResponse;\n  readonly tx: ClientSQLiteTransactionScope;\n}\n\n/** Apply every carried lane and return the reserved Members head. */\nasync function replaceResponseLanes(\n  input: ResponseLanesInput,\n): Promise<string | null> {\n  const { organizationId } = input.response;\n  const directory = input.response.lanes.directory;\n  if (directory) {\n    await replaceDirectoryLane({ directory, organizationId, tx: input.tx });\n  }\n  const groups = input.response.lanes.groups;\n  if (groups) {\n    await replaceGroupsLane({ groups, organizationId, tx: input.tx });\n  }\n  const groupMemberships = input.response.lanes.groupMemberships;\n  const memberGroupStateHash = groupMemberships\n    ? await applyGroupMembershipsLane({\n        currentMemberGroupStateHash:\n          input.current?.memberGroupStateHash ?? null,\n        lane: groupMemberships,\n        memberGroupId: input.memberGroupId,\n        organizationId,\n        replaceAll: input.response.mode === \"snapshot\",\n        tx: input.tx,\n      })\n    : (input.current?.memberGroupStateHash ?? null);\n  const grants = input.response.lanes.grants;\n  if (grants) {\n    await applyOrganizationReadModelGrantsLane({\n      lane: grants,\n      organizationId,\n      tx: input.tx,\n    });\n  }\n  return memberGroupStateHash;\n}\n\nasync function applyResponseLanes(\n  input: ResponseLanesInput & { readonly currentUserId: string },\n): Promise<string | null> {\n  const memberGroupStateHash = await replaceResponseLanes(input);\n  // The directory lane is the authoritative roster, already persisted above:\n  // requester rows for users it no longer lists as active fall with it.\n  if (input.response.lanes.directory) {\n    await pruneInactiveOrganizationRequestersInTransaction({\n      organizationId: input.response.organizationId,\n      retainUserId: input.currentUserId,\n      tx: input.tx,\n    });\n  }\n  if (input.response.lanes.groups || input.response.lanes.groupMemberships) {\n    await assertStoredGroupMembershipBindings({\n      memberGroupId: input.memberGroupId,\n      memberGroupStateHash,\n      organizationId: input.response.organizationId,\n      tx: input.tx,\n    });\n  }\n  return memberGroupStateHash;\n}\n\n/**\n * Write the cursor with the organization policy head and the reserved Members\n * head in one row, so a failure anywhere in the page rolls them back together.\n */\nasync function upsertOrganizationReadModelState(input: {\n  readonly current: CurrentOrganizationReadModelState | null;\n  readonly memberGroupId: string;\n  readonly memberGroupStateHash: string | null;\n  readonly now: string;\n  readonly response: OrganizationReadModelResponse;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<void> {\n  const organizationHead =\n    input.response.lanes.organizationPolicy?.currentState ??\n    input.current?.organizationHead;\n  if (!organizationHead || input.memberGroupStateHash === null) {\n    throw new OrganizationReadModelBindingError(\n      \"Organization read-model policy or Members head is missing\",\n    );\n  }\n  const directoryLane = input.response.lanes.directory;\n  const values = {\n    cursor: input.response.nextCursor,\n    profileDocumentId:\n      directoryLane !== undefined\n        ? directoryLane.profileDocumentId\n        : (input.current?.profileDocumentId ?? null),\n    memberGroupId: input.memberGroupId,\n    memberGroupStateHash: input.memberGroupStateHash,\n    organizationStateHash: organizationHead.stateHash,\n    organizationStateVersion: organizationHead.version,\n    organizationKeyEpoch: organizationHead.keyEpoch,\n    organizationKeyFingerprint: organizationHead.keyFingerprint,\n    organizationMemberCount: organizationHead.memberCount,\n    updatedAt: input.now,\n  };\n  await input.tx\n    .insert(organizationReadModelState)\n    .values({ ...values, organizationId: input.response.organizationId })\n    .onConflictDoUpdate({\n      target: organizationReadModelState.organizationId,\n      set: values,\n    })\n    .run();\n}\n\nfunction requireMemberGroupId(input: {\n  readonly current: CurrentOrganizationReadModelState | null;\n  readonly response: OrganizationReadModelResponse;\n}): string {\n  const memberGroupId =\n    input.response.lanes.groups?.memberGroupId ?? input.current?.memberGroupId;\n  if (!memberGroupId) {\n    throw new Error(\"Organization read-model member group is missing\");\n  }\n  return memberGroupId;\n}\n\nexport async function loadOrganizationReadModelProjection(\n  execSql: ExecSql,\n  organizationId: string,\n  currentUserId: string,\n): Promise<OrganizationReadModelProjection | null> {\n  return loadWithOrganizationReadModelIntegrityPurge({\n    execSql,\n    organizationId,\n    load: (tx) =>\n      loadOrganizationReadModelProjectionInTransaction({\n        currentUserId,\n        organizationId,\n        tx,\n      }),\n  });\n}\n\nexport async function applyOrganizationReadModelResponse(input: {\n  readonly currentUserId: string;\n  readonly execSql: ExecSql;\n  readonly requestedCursor: string | null;\n  readonly response: OrganizationReadModelResponse;\n}): Promise<ApplyOrganizationReadModelResponseResult> {\n  assertOrganizationReadModelResponse({\n    currentUserId: input.currentUserId,\n    response: input.response,\n  });\n  // The requester prune below also retires pruned users' usage projections.\n  await ensureSqlTables(input.execSql, [\n    ...organizationReadModelTables,\n    ...organizationDataUsageTables,\n  ]);\n\n  const disposition = await getClientSQLitePersistenceRuntime(\n    input.execSql,\n  ).transaction(\n    async (tx): Promise<ApplyOrganizationReadModelResponseResult> => {\n      const current = await loadCurrentState(tx, input.response.organizationId);\n      const disposition = resolveApplyDisposition({\n        current,\n        requestedCursor: input.requestedCursor,\n        response: input.response,\n      });\n      if (disposition === \"stale\") {\n        return disposition;\n      }\n      const now = new Date().toISOString();\n      await upsertRequester({\n        currentUserId: input.currentUserId,\n        isOrgAdmin: input.response.currentUser.isOrgAdmin,\n        now,\n        organizationId: input.response.organizationId,\n        tx,\n      });\n      if (disposition === \"already-applied\") {\n        return disposition;\n      }\n      const memberGroupId = requireMemberGroupId({\n        current,\n        response: input.response,\n      });\n      const memberGroupStateHash = await applyResponseLanes({\n        current,\n        currentUserId: input.currentUserId,\n        memberGroupId,\n        response: input.response,\n        tx,\n      });\n      await upsertOrganizationReadModelState({\n        current,\n        memberGroupId,\n        memberGroupStateHash,\n        now,\n        response: input.response,\n        tx,\n      });\n\n      return \"applied\";\n    },\n  );\n  // An applied change follows an organization hint or mutation; in-flight\n  // operations recover the directory again instead of reusing their memo.\n  if (disposition === \"applied\")\n    getOrCreatePrincipalPolicyCoordinator(input.execSql).invalidateRecovery(\n      input.response.organizationId,\n    );\n  return disposition;\n}\n\nexport async function purgeOrganizationReadModelProjection(\n  execSql: ExecSql,\n  organizationId: string,\n  options: { readonly onlyRequesterUserId?: string } = {},\n): Promise<void> {\n  await ensureSqlTables(execSql, organizationReadModelTables);\n  await getClientSQLitePersistenceRuntime(execSql).transaction(async (tx) => {\n    await purgeOrganizationReadModelProjectionInTransaction({\n      onlyRequesterUserId: options.onlyRequesterUserId,\n      organizationId,\n      tx,\n    });\n  });\n}\n"]}

package/data/persistence/organizations/organizationReadModelProjection.js

@@ -1,4 +1,5 @@
 import { compareCanonicalStrings } from "../../../internal/crypto/index.js";
+import { isOrganizationLeaveRequest, } from "../../../internal/validators/util/index.js";
 import { and, asc, eq } from "drizzle-orm";
 import { organizationReadModelDirectoryUsers, organizationReadModelGroupMembers, organizationReadModelGroups, organizationReadModelRequesters, organizationReadModelState, } from "../../sqlite/schema/organizationReadModelSchema.js";
 import { loadOrganizationReadModelGrantsInTransaction } from "./organizationReadModelGrantPersistence.js";
@@ -22,11 +23,21 @@ function toDirectoryUser(row, currentUserId) {
         status: row.status,
         profileDocumentId: row.profileDocumentId,
         joinedAt: row.joinedAt,
+        leaveRequest: readStoredLeaveRequest(row.leaveRequest),
         updatedAt: row.updatedAt,
         disabledAt: row.disabledAt,
         disabledByUserId: row.disabledByUserId,
     };
 }
+function readStoredLeaveRequest(stored) {
+    if (stored === null)
+        return null;
+    const parsed = JSON.parse(stored);
+    if (!isOrganizationLeaveRequest(parsed)) {
+        throw new OrganizationReadModelIntegrityError("Stored organization leave request is invalid");
+    }
+    return parsed;
+}
 function isValidPolicyHead(head) {
     return (head.stateHash.length > 0 &&
         Number.isInteger(head.version) &&
@@ -107,6 +118,7 @@ async function loadDirectoryRows(tx, organizationId) {
         encapsulationKeyFingerprint: organizationReadModelDirectoryUsers.encapsulationKeyFingerprint,
         encapsulationPublicKey: organizationReadModelDirectoryUsers.encapsulationPublicKey,
         joinedAt: organizationReadModelDirectoryUsers.joinedAt,
+        leaveRequest: organizationReadModelDirectoryUsers.leaveRequest,
         isPersonalOrganizationOwner: organizationReadModelDirectoryUsers.isPersonalOrganizationOwner,
         profileDocumentId: organizationReadModelDirectoryUsers.profileDocumentId,
         signingKeyFingerprint: organizationReadModelDirectoryUsers.signingKeyFingerprint,

package/data/persistence/organizations/organizationReadModelProjection.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationReadModelProjection.js","sourceRoot":"","sources":["organizationReadModelProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAS5D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,4CAA4C,EAAE,MAAM,yCAAyC,CAAC;AACvG,OAAO,EACL,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,iCAAiC,CAAC;AA6EzC,SAAS,0BAA0B,CACjC,KAAa;IAEb,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,UAAU,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CACtB,GAA0B,EAC1B,aAAqB;IAErB,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,mCAAmC,CAC3C,iDAAiD,CAClD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;QAClD,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,aAAa;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAsB;IAC/C,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,CAAC;QAChB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,CAAC;QACjB,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC9B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,CAAC,CACtB,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,mBAAmB,CAC1B,GAAkB;IAElB,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,WAAW;KAChB,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GACR,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,GAAG,CAAC,YAAY,KAAK,IAAI;QACzB,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,GAAG,CAAC,cAAc,KAAK,IAAI;QAC3B,GAAG,CAAC,WAAW,KAAK,IAAI;QACtB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,YAAY;YACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC;IACR,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,cAAsB,EACtB,IAAsB;IAEtB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,cAAc;QACd,WAAW,EAAE,cAAc;QAC3B,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,uBAAuB,CAAC,KAOhC;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM;SAC5B,OAAO,CAAC,CAAC,KAAK,EAAqC,EAAE,CACpD,KAAK,CAAC,YAAY;QAChB,CAAC,CAAC;YACE;gBACE,GAAG,KAAK,CAAC,YAAY;gBACrB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,OAAO;gBAC1B,aAAa,EAAE,OAAO;aACvB;SACF;QACH,CAAC,CAAC,EAAE,CACP;SACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAC7D,CAAC;IACJ,sEAAsE;IACtE,OAAO;QACL,GAAG,UAAU;QACb,wBAAwB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,SAAS,EAAE,mCAAmC,CAAC,SAAS;QACxD,UAAU,EAAE,mCAAmC,CAAC,UAAU;QAC1D,gBAAgB,EAAE,mCAAmC,CAAC,gBAAgB;QACtE,2BAA2B,EACzB,mCAAmC,CAAC,2BAA2B;QACjE,sBAAsB,EACpB,mCAAmC,CAAC,sBAAsB;QAC5D,QAAQ,EAAE,mCAAmC,CAAC,QAAQ;QACtD,2BAA2B,EACzB,mCAAmC,CAAC,2BAA2B;QACjE,iBAAiB,EAAE,mCAAmC,CAAC,iBAAiB;QACxE,qBAAqB,EACnB,mCAAmC,CAAC,qBAAqB;QAC3D,gBAAgB,EAAE,mCAAmC,CAAC,gBAAgB;QACtE,MAAM,EAAE,mCAAmC,CAAC,MAAM;QAClD,SAAS,EAAE,mCAAmC,CAAC,SAAS;QACxD,MAAM,EAAE,mCAAmC,CAAC,MAAM;KACnD,CAAC;SACD,IAAI,CAAC,mCAAmC,CAAC;SACzC,KAAK,CACJ,EAAE,CAAC,mCAAmC,CAAC,cAAc,EAAE,cAAc,CAAC,CACvE;SACA,OAAO,CACN,GAAG,CAAC,mCAAmC,CAAC,SAAS,CAAC,EAClD,GAAG,CAAC,mCAAmC,CAAC,MAAM,CAAC,CAChD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,OAAO,EAAE,2BAA2B,CAAC,OAAO;QAC5C,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;QAC9C,cAAc,EAAE,2BAA2B,CAAC,cAAc;QAC1D,WAAW,EAAE,2BAA2B,CAAC,WAAW;QACpD,IAAI,EAAE,2BAA2B,CAAC,IAAI;QACtC,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,YAAY,EAAE,2BAA2B,CAAC,YAAY;KACvD,CAAC;SACD,IAAI,CAAC,2BAA2B,CAAC;SACjC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACrE,OAAO,CACN,GAAG,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAC1C,GAAG,CAAC,2BAA2B,CAAC,OAAO,CAAC,CACzC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,OAAO,EAAE,iCAAiC,CAAC,OAAO;QAClD,MAAM,EAAE,iCAAiC,CAAC,MAAM;KACjD,CAAC;SACD,IAAI,CAAC,iCAAiC,CAAC;SACvC,KAAK,CAAC,EAAE,CAAC,iCAAiC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SAC3E,OAAO,CACN,GAAG,CAAC,iCAAiC,CAAC,OAAO,CAAC,EAC9C,GAAG,CAAC,iCAAiC,CAAC,SAAS,CAAC,EAChD,GAAG,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAC9C,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAItE;IACC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE;SAC3B,MAAM,CAAC;QACN,MAAM,EAAE,0BAA0B,CAAC,MAAM;QACzC,aAAa,EAAE,0BAA0B,CAAC,aAAa;QACvD,oBAAoB,EAAE,0BAA0B,CAAC,oBAAoB;QACrE,0BAA0B,EACxB,0BAA0B,CAAC,0BAA0B;QACvD,uBAAuB,EACrB,0BAA0B,CAAC,uBAAuB;QACpD,qBAAqB,EAAE,0BAA0B,CAAC,qBAAqB;QACvE,wBAAwB,EACtB,0BAA0B,CAAC,wBAAwB;QACrD,iBAAiB,EAAE,0BAA0B,CAAC,iBAAiB;QAC/D,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE;SAC/B,MAAM,CAAC,EAAE,UAAU,EAAE,+BAA+B,CAAC,UAAU,EAAE,CAAC;SAClE,IAAI,CAAC,+BAA+B,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,KAAK,CAAC,cAAc,CACrB,EACD,EAAE,CAAC,+BAA+B,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAChE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,4CAA4C,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAC/C,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,mBAAmB,CAAC,GAAG,CAAC;KACvC,CAAC,CAAC,CAAC;IACJ,MAAM,WAAW,GAAG,uBAAuB,CAAC;QAC1C,MAAM;QACN,gBAAgB,EAAE;YAChB,QAAQ,EAAE,KAAK,CAAC,oBAAoB;YACpC,cAAc,EAAE,KAAK,CAAC,0BAA0B;YAChD,WAAW,EAAE,KAAK,CAAC,uBAAuB;YAC1C,SAAS,EAAE,KAAK,CAAC,qBAAqB;YACtC,OAAO,EAAE,KAAK,CAAC,wBAAwB;SACxC;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/B,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAC1C;SACF;QACD,MAAM;QACN,MAAM,EAAE;YACN,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM;SACP;QACD,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW;QACX,eAAe,EAAE,wCAAwC;QACzD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;QAClE,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import { compareCanonicalStrings } from \"@tearleads/crypto\";\nimport type {\n  ListOrganizationGroupsResponse,\n  OrganizationContainerGrantsResponse,\n  OrganizationDirectoryResponse,\n  OrganizationDirectoryUserResponse,\n  OrganizationGroupCurrentStateResponse,\n  OrganizationRosterStatus,\n} from \"@tearleads/validators/response\";\nimport { and, asc, eq } from \"drizzle-orm\";\nimport {\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../sqlite/schema/organizationReadModelSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { loadOrganizationReadModelGrantsInTransaction } from \"./organizationReadModelGrantPersistence\";\nimport {\n  ORGANIZATION_READ_MODEL_PROTOCOL_VERSION,\n  OrganizationReadModelIntegrityError,\n} from \"./organizationReadModelProtocol\";\n\nexport type OrganizationDirectoryProjection = Omit<\n  OrganizationDirectoryResponse,\n  \"currentUser\"\n>;\n\nexport interface OrganizationReadModelProjection {\n  readonly cursor: string;\n  readonly directory: OrganizationDirectoryProjection;\n  readonly grants: OrganizationContainerGrantsResponse;\n  readonly groups: Omit<ListOrganizationGroupsResponse, \"groups\"> & {\n    groups: Array<\n      ListOrganizationGroupsResponse[\"groups\"][number] & { name: string }\n    >;\n  };\n  readonly membershipEdges: OrganizationReadModelMembershipEdge[];\n  readonly organizationId: string;\n  readonly policyHeads: readonly OrganizationReadModelPolicyHead[];\n  readonly protocolVersion: typeof ORGANIZATION_READ_MODEL_PROTOCOL_VERSION;\n  readonly requester: OrganizationDirectoryResponse[\"currentUser\"] | null;\n  readonly updatedAt: string;\n}\n\nexport interface OrganizationReadModelPolicyHead {\n  readonly keyEpoch: number;\n  readonly keyFingerprint: string;\n  readonly memberCount: number;\n  readonly organizationId: string;\n  readonly principalId: string;\n  readonly principalType: \"group\" | \"organization\";\n  readonly stateHash: string;\n  readonly version: number;\n}\n\nexport interface OrganizationReadModelMembershipEdge {\n  readonly groupId: string;\n  readonly userId: string;\n}\n\ninterface SelectedDirectoryUser {\n  readonly createdAt: string;\n  readonly disabledAt: string | null;\n  readonly disabledByUserId: string | null;\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: string;\n  readonly isPersonalOrganizationOwner: boolean;\n  readonly joinedAt: string;\n  readonly profileDocumentId: string | null;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: string;\n  readonly status: string;\n  readonly updatedAt: string;\n  readonly userId: string;\n}\n\ninterface SelectedGroup {\n  readonly createdAt: string;\n  readonly groupId: string;\n  readonly isBuiltin: boolean;\n  readonly keyEpoch: number | null;\n  readonly keyFingerprint: string | null;\n  readonly memberCount: number | null;\n  readonly name: string;\n  readonly stateHash: string | null;\n  readonly stateVersion: number | null;\n}\n\n/** A stored policy head before validation; `version` is the state version. */\ninterface StoredPolicyHead {\n  readonly keyEpoch: number;\n  readonly keyFingerprint: string;\n  readonly memberCount: number;\n  readonly stateHash: string;\n  readonly version: number;\n}\n\nfunction isOrganizationRosterStatus(\n  value: string,\n): value is OrganizationRosterStatus {\n  return value === \"active\" || value === \"disabled\";\n}\n\nfunction toDirectoryUser(\n  row: SelectedDirectoryUser,\n  currentUserId: string,\n): OrganizationDirectoryUserResponse {\n  if (!isOrganizationRosterStatus(row.status)) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization directory status is invalid\",\n    );\n  }\n\n  return {\n    userId: row.userId,\n    signingKeyFingerprint: row.signingKeyFingerprint,\n    signingPublicKey: row.signingPublicKey,\n    encapsulationPublicKey: row.encapsulationPublicKey,\n    encapsulationKeyFingerprint: row.encapsulationKeyFingerprint,\n    createdAt: row.createdAt,\n    isPersonalOrganizationOwner: row.isPersonalOrganizationOwner,\n    isSelf: row.userId === currentUserId,\n    status: row.status,\n    profileDocumentId: row.profileDocumentId,\n    joinedAt: row.joinedAt,\n    updatedAt: row.updatedAt,\n    disabledAt: row.disabledAt,\n    disabledByUserId: row.disabledByUserId,\n  };\n}\n\nfunction isValidPolicyHead(head: StoredPolicyHead): boolean {\n  return (\n    head.stateHash.length > 0 &&\n    Number.isInteger(head.version) &&\n    head.version > 0 &&\n    Number.isSafeInteger(head.keyEpoch) &&\n    head.keyEpoch > 0 &&\n    head.keyFingerprint.length > 0 &&\n    Number.isInteger(head.memberCount) &&\n    head.memberCount >= 0\n  );\n}\n\n/** A group's state columns are all null (stateless) or one valid head. */\nfunction toGroupCurrentState(\n  row: SelectedGroup,\n): OrganizationGroupCurrentStateResponse | null {\n  const values = [\n    row.stateHash,\n    row.stateVersion,\n    row.keyEpoch,\n    row.keyFingerprint,\n    row.memberCount,\n  ];\n  if (values.every((value) => value === null)) {\n    return null;\n  }\n  const head =\n    row.stateHash === null ||\n    row.stateVersion === null ||\n    row.keyEpoch === null ||\n    row.keyFingerprint === null ||\n    row.memberCount === null\n      ? null\n      : {\n          stateHash: row.stateHash,\n          version: row.stateVersion,\n          keyEpoch: row.keyEpoch,\n          keyFingerprint: row.keyFingerprint,\n          memberCount: row.memberCount,\n        };\n  if (!head || !isValidPolicyHead(head)) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization group state is invalid\",\n    );\n  }\n  return head;\n}\n\nfunction toOrganizationPolicyHead(\n  organizationId: string,\n  head: StoredPolicyHead,\n): OrganizationReadModelPolicyHead {\n  if (!isValidPolicyHead(head)) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization policy head is invalid\",\n    );\n  }\n  return {\n    ...head,\n    organizationId,\n    principalId: organizationId,\n    principalType: \"organization\",\n  };\n}\n\n/** The organization head from the state row plus every stateful group head. */\nfunction toProjectionPolicyHeads(input: {\n  readonly groups: ReadonlyArray<{\n    readonly currentState: OrganizationGroupCurrentStateResponse | null;\n    readonly groupId: string;\n  }>;\n  readonly organizationHead: StoredPolicyHead;\n  readonly organizationId: string;\n}): OrganizationReadModelPolicyHead[] {\n  const groupHeads = input.groups\n    .flatMap((group): OrganizationReadModelPolicyHead[] =>\n      group.currentState\n        ? [\n            {\n              ...group.currentState,\n              organizationId: input.organizationId,\n              principalId: group.groupId,\n              principalType: \"group\",\n            },\n          ]\n        : [],\n    )\n    .sort((left, right) =>\n      compareCanonicalStrings(left.principalId, right.principalId),\n    );\n  // Group heads precede the organization head, ordered by principal ID.\n  return [\n    ...groupHeads,\n    toOrganizationPolicyHead(input.organizationId, input.organizationHead),\n  ];\n}\n\nasync function loadDirectoryRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedDirectoryUser[]> {\n  return tx\n    .select({\n      createdAt: organizationReadModelDirectoryUsers.createdAt,\n      disabledAt: organizationReadModelDirectoryUsers.disabledAt,\n      disabledByUserId: organizationReadModelDirectoryUsers.disabledByUserId,\n      encapsulationKeyFingerprint:\n        organizationReadModelDirectoryUsers.encapsulationKeyFingerprint,\n      encapsulationPublicKey:\n        organizationReadModelDirectoryUsers.encapsulationPublicKey,\n      joinedAt: organizationReadModelDirectoryUsers.joinedAt,\n      isPersonalOrganizationOwner:\n        organizationReadModelDirectoryUsers.isPersonalOrganizationOwner,\n      profileDocumentId: organizationReadModelDirectoryUsers.profileDocumentId,\n      signingKeyFingerprint:\n        organizationReadModelDirectoryUsers.signingKeyFingerprint,\n      signingPublicKey: organizationReadModelDirectoryUsers.signingPublicKey,\n      status: organizationReadModelDirectoryUsers.status,\n      updatedAt: organizationReadModelDirectoryUsers.updatedAt,\n      userId: organizationReadModelDirectoryUsers.userId,\n    })\n    .from(organizationReadModelDirectoryUsers)\n    .where(\n      eq(organizationReadModelDirectoryUsers.organizationId, organizationId),\n    )\n    .orderBy(\n      asc(organizationReadModelDirectoryUsers.sortOrder),\n      asc(organizationReadModelDirectoryUsers.userId),\n    );\n}\n\nasync function loadGroupRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedGroup[]> {\n  return tx\n    .select({\n      createdAt: organizationReadModelGroups.createdAt,\n      groupId: organizationReadModelGroups.groupId,\n      isBuiltin: organizationReadModelGroups.isBuiltin,\n      keyEpoch: organizationReadModelGroups.keyEpoch,\n      keyFingerprint: organizationReadModelGroups.keyFingerprint,\n      memberCount: organizationReadModelGroups.memberCount,\n      name: organizationReadModelGroups.name,\n      stateHash: organizationReadModelGroups.stateHash,\n      stateVersion: organizationReadModelGroups.stateVersion,\n    })\n    .from(organizationReadModelGroups)\n    .where(eq(organizationReadModelGroups.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelGroups.sortOrder),\n      asc(organizationReadModelGroups.groupId),\n    );\n}\n\nasync function loadMembershipEdges(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<OrganizationReadModelMembershipEdge[]> {\n  return tx\n    .select({\n      groupId: organizationReadModelGroupMembers.groupId,\n      userId: organizationReadModelGroupMembers.userId,\n    })\n    .from(organizationReadModelGroupMembers)\n    .where(eq(organizationReadModelGroupMembers.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelGroupMembers.groupId),\n      asc(organizationReadModelGroupMembers.sortOrder),\n      asc(organizationReadModelGroupMembers.userId),\n    );\n}\n\nexport async function loadOrganizationReadModelProjectionInTransaction(input: {\n  readonly currentUserId: string;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<OrganizationReadModelProjection | null> {\n  const [state] = await input.tx\n    .select({\n      cursor: organizationReadModelState.cursor,\n      memberGroupId: organizationReadModelState.memberGroupId,\n      organizationKeyEpoch: organizationReadModelState.organizationKeyEpoch,\n      organizationKeyFingerprint:\n        organizationReadModelState.organizationKeyFingerprint,\n      organizationMemberCount:\n        organizationReadModelState.organizationMemberCount,\n      organizationStateHash: organizationReadModelState.organizationStateHash,\n      organizationStateVersion:\n        organizationReadModelState.organizationStateVersion,\n      profileDocumentId: organizationReadModelState.profileDocumentId,\n      updatedAt: organizationReadModelState.updatedAt,\n    })\n    .from(organizationReadModelState)\n    .where(eq(organizationReadModelState.organizationId, input.organizationId))\n    .limit(1);\n  if (!state) {\n    return null;\n  }\n  const [requester] = await input.tx\n    .select({ isOrgAdmin: organizationReadModelRequesters.isOrgAdmin })\n    .from(organizationReadModelRequesters)\n    .where(\n      and(\n        eq(\n          organizationReadModelRequesters.organizationId,\n          input.organizationId,\n        ),\n        eq(organizationReadModelRequesters.userId, input.currentUserId),\n      ),\n    )\n    .limit(1);\n  const directoryRows = await loadDirectoryRows(input.tx, input.organizationId);\n  const groupRows = await loadGroupRows(input.tx, input.organizationId);\n  const grants = await loadOrganizationReadModelGrantsInTransaction(input);\n  const membershipEdges = await loadMembershipEdges(\n    input.tx,\n    input.organizationId,\n  );\n  const groups = groupRows.map((row) => ({\n    groupId: row.groupId,\n    organizationId: input.organizationId,\n    name: row.name,\n    createdAt: row.createdAt,\n    isBuiltin: row.isBuiltin,\n    currentState: toGroupCurrentState(row),\n  }));\n  const policyHeads = toProjectionPolicyHeads({\n    groups,\n    organizationHead: {\n      keyEpoch: state.organizationKeyEpoch,\n      keyFingerprint: state.organizationKeyFingerprint,\n      memberCount: state.organizationMemberCount,\n      stateHash: state.organizationStateHash,\n      version: state.organizationStateVersion,\n    },\n    organizationId: input.organizationId,\n  });\n\n  return {\n    cursor: state.cursor,\n    directory: {\n      organizationId: input.organizationId,\n      profileDocumentId: state.profileDocumentId,\n      users: directoryRows.map((row) =>\n        toDirectoryUser(row, input.currentUserId),\n      ),\n    },\n    grants,\n    groups: {\n      organizationId: input.organizationId,\n      memberGroupId: state.memberGroupId,\n      groups,\n    },\n    membershipEdges,\n    organizationId: input.organizationId,\n    policyHeads,\n    protocolVersion: ORGANIZATION_READ_MODEL_PROTOCOL_VERSION,\n    requester: requester ? { isOrgAdmin: requester.isOrgAdmin } : null,\n    updatedAt: state.updatedAt,\n  };\n}\n"]}
+{"version":3,"file":"organizationReadModelProjection.js","sourceRoot":"","sources":["organizationReadModelProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAS5D,OAAO,EACL,0BAA0B,GAE3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,4CAA4C,EAAE,MAAM,yCAAyC,CAAC;AACvG,OAAO,EACL,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,iCAAiC,CAAC;AA8EzC,SAAS,0BAA0B,CACjC,KAAa;IAEb,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,UAAU,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CACtB,GAA0B,EAC1B,aAAqB;IAErB,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,mCAAmC,CAC3C,iDAAiD,CAClD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;QAClD,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,aAAa;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC;QACtD,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAqB;IAErB,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mCAAmC,CAC3C,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAsB;IAC/C,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,CAAC;QAChB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,CAAC;QACjB,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC9B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,CAAC,CACtB,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,mBAAmB,CAC1B,GAAkB;IAElB,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,WAAW;KAChB,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GACR,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,GAAG,CAAC,YAAY,KAAK,IAAI;QACzB,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,GAAG,CAAC,cAAc,KAAK,IAAI;QAC3B,GAAG,CAAC,WAAW,KAAK,IAAI;QACtB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,YAAY;YACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC;IACR,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,cAAsB,EACtB,IAAsB;IAEtB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,cAAc;QACd,WAAW,EAAE,cAAc;QAC3B,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,uBAAuB,CAAC,KAOhC;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM;SAC5B,OAAO,CAAC,CAAC,KAAK,EAAqC,EAAE,CACpD,KAAK,CAAC,YAAY;QAChB,CAAC,CAAC;YACE;gBACE,GAAG,KAAK,CAAC,YAAY;gBACrB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,OAAO;gBAC1B,aAAa,EAAE,OAAO;aACvB;SACF;QACH,CAAC,CAAC,EAAE,CACP;SACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAC7D,CAAC;IACJ,sEAAsE;IACtE,OAAO;QACL,GAAG,UAAU;QACb,wBAAwB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,SAAS,EAAE,mCAAmC,CAAC,SAAS;QACxD,UAAU,EAAE,mCAAmC,CAAC,UAAU;QAC1D,gBAAgB,EAAE,mCAAmC,CAAC,gBAAgB;QACtE,2BAA2B,EACzB,mCAAmC,CAAC,2BAA2B;QACjE,sBAAsB,EACpB,mCAAmC,CAAC,sBAAsB;QAC5D,QAAQ,EAAE,mCAAmC,CAAC,QAAQ;QACtD,YAAY,EAAE,mCAAmC,CAAC,YAAY;QAC9D,2BAA2B,EACzB,mCAAmC,CAAC,2BAA2B;QACjE,iBAAiB,EAAE,mCAAmC,CAAC,iBAAiB;QACxE,qBAAqB,EACnB,mCAAmC,CAAC,qBAAqB;QAC3D,gBAAgB,EAAE,mCAAmC,CAAC,gBAAgB;QACtE,MAAM,EAAE,mCAAmC,CAAC,MAAM;QAClD,SAAS,EAAE,mCAAmC,CAAC,SAAS;QACxD,MAAM,EAAE,mCAAmC,CAAC,MAAM;KACnD,CAAC;SACD,IAAI,CAAC,mCAAmC,CAAC;SACzC,KAAK,CACJ,EAAE,CAAC,mCAAmC,CAAC,cAAc,EAAE,cAAc,CAAC,CACvE;SACA,OAAO,CACN,GAAG,CAAC,mCAAmC,CAAC,SAAS,CAAC,EAClD,GAAG,CAAC,mCAAmC,CAAC,MAAM,CAAC,CAChD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,OAAO,EAAE,2BAA2B,CAAC,OAAO;QAC5C,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;QAC9C,cAAc,EAAE,2BAA2B,CAAC,cAAc;QAC1D,WAAW,EAAE,2BAA2B,CAAC,WAAW;QACpD,IAAI,EAAE,2BAA2B,CAAC,IAAI;QACtC,SAAS,EAAE,2BAA2B,CAAC,SAAS;QAChD,YAAY,EAAE,2BAA2B,CAAC,YAAY;KACvD,CAAC;SACD,IAAI,CAAC,2BAA2B,CAAC;SACjC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACrE,OAAO,CACN,GAAG,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAC1C,GAAG,CAAC,2BAA2B,CAAC,OAAO,CAAC,CACzC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAgC,EAChC,cAAsB;IAEtB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,OAAO,EAAE,iCAAiC,CAAC,OAAO;QAClD,MAAM,EAAE,iCAAiC,CAAC,MAAM;KACjD,CAAC;SACD,IAAI,CAAC,iCAAiC,CAAC;SACvC,KAAK,CAAC,EAAE,CAAC,iCAAiC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SAC3E,OAAO,CACN,GAAG,CAAC,iCAAiC,CAAC,OAAO,CAAC,EAC9C,GAAG,CAAC,iCAAiC,CAAC,SAAS,CAAC,EAChD,GAAG,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAC9C,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gDAAgD,CAAC,KAItE;IACC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE;SAC3B,MAAM,CAAC;QACN,MAAM,EAAE,0BAA0B,CAAC,MAAM;QACzC,aAAa,EAAE,0BAA0B,CAAC,aAAa;QACvD,oBAAoB,EAAE,0BAA0B,CAAC,oBAAoB;QACrE,0BAA0B,EACxB,0BAA0B,CAAC,0BAA0B;QACvD,uBAAuB,EACrB,0BAA0B,CAAC,uBAAuB;QACpD,qBAAqB,EAAE,0BAA0B,CAAC,qBAAqB;QACvE,wBAAwB,EACtB,0BAA0B,CAAC,wBAAwB;QACrD,iBAAiB,EAAE,0BAA0B,CAAC,iBAAiB;QAC/D,SAAS,EAAE,0BAA0B,CAAC,SAAS;KAChD,CAAC;SACD,IAAI,CAAC,0BAA0B,CAAC;SAChC,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;SAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE;SAC/B,MAAM,CAAC,EAAE,UAAU,EAAE,+BAA+B,CAAC,UAAU,EAAE,CAAC;SAClE,IAAI,CAAC,+BAA+B,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CACA,+BAA+B,CAAC,cAAc,EAC9C,KAAK,CAAC,cAAc,CACrB,EACD,EAAE,CAAC,+BAA+B,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAChE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,4CAA4C,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAC/C,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,mBAAmB,CAAC,GAAG,CAAC;KACvC,CAAC,CAAC,CAAC;IACJ,MAAM,WAAW,GAAG,uBAAuB,CAAC;QAC1C,MAAM;QACN,gBAAgB,EAAE;YAChB,QAAQ,EAAE,KAAK,CAAC,oBAAoB;YACpC,cAAc,EAAE,KAAK,CAAC,0BAA0B;YAChD,WAAW,EAAE,KAAK,CAAC,uBAAuB;YAC1C,SAAS,EAAE,KAAK,CAAC,qBAAqB;YACtC,OAAO,EAAE,KAAK,CAAC,wBAAwB;SACxC;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/B,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAC1C;SACF;QACD,MAAM;QACN,MAAM,EAAE;YACN,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM;SACP;QACD,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW;QACX,eAAe,EAAE,wCAAwC;QACzD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;QAClE,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import { compareCanonicalStrings } from \"@tearleads/crypto\";\nimport type {\n  ListOrganizationGroupsResponse,\n  OrganizationContainerGrantsResponse,\n  OrganizationDirectoryResponse,\n  OrganizationDirectoryUserResponse,\n  OrganizationGroupCurrentStateResponse,\n  OrganizationRosterStatus,\n} from \"@tearleads/validators/response\";\nimport {\n  isOrganizationLeaveRequest,\n  type OrganizationLeaveRequest,\n} from \"@tearleads/validators/util\";\nimport { and, asc, eq } from \"drizzle-orm\";\nimport {\n  organizationReadModelDirectoryUsers,\n  organizationReadModelGroupMembers,\n  organizationReadModelGroups,\n  organizationReadModelRequesters,\n  organizationReadModelState,\n} from \"../../sqlite/schema/organizationReadModelSchema\";\nimport type { ClientSQLiteTransactionScope } from \"../../sqlite/sqlitePersistenceRuntime\";\nimport { loadOrganizationReadModelGrantsInTransaction } from \"./organizationReadModelGrantPersistence\";\nimport {\n  ORGANIZATION_READ_MODEL_PROTOCOL_VERSION,\n  OrganizationReadModelIntegrityError,\n} from \"./organizationReadModelProtocol\";\n\nexport type OrganizationDirectoryProjection = Omit<\n  OrganizationDirectoryResponse,\n  \"currentUser\"\n>;\n\nexport interface OrganizationReadModelProjection {\n  readonly cursor: string;\n  readonly directory: OrganizationDirectoryProjection;\n  readonly grants: OrganizationContainerGrantsResponse;\n  readonly groups: Omit<ListOrganizationGroupsResponse, \"groups\"> & {\n    groups: Array<\n      ListOrganizationGroupsResponse[\"groups\"][number] & { name: string }\n    >;\n  };\n  readonly membershipEdges: OrganizationReadModelMembershipEdge[];\n  readonly organizationId: string;\n  readonly policyHeads: readonly OrganizationReadModelPolicyHead[];\n  readonly protocolVersion: typeof ORGANIZATION_READ_MODEL_PROTOCOL_VERSION;\n  readonly requester: OrganizationDirectoryResponse[\"currentUser\"] | null;\n  readonly updatedAt: string;\n}\n\nexport interface OrganizationReadModelPolicyHead {\n  readonly keyEpoch: number;\n  readonly keyFingerprint: string;\n  readonly memberCount: number;\n  readonly organizationId: string;\n  readonly principalId: string;\n  readonly principalType: \"group\" | \"organization\";\n  readonly stateHash: string;\n  readonly version: number;\n}\n\nexport interface OrganizationReadModelMembershipEdge {\n  readonly groupId: string;\n  readonly userId: string;\n}\n\ninterface SelectedDirectoryUser {\n  readonly createdAt: string;\n  readonly disabledAt: string | null;\n  readonly disabledByUserId: string | null;\n  readonly encapsulationKeyFingerprint: string;\n  readonly encapsulationPublicKey: string;\n  readonly isPersonalOrganizationOwner: boolean;\n  readonly joinedAt: string;\n  readonly leaveRequest: string | null;\n  readonly profileDocumentId: string | null;\n  readonly signingKeyFingerprint: string;\n  readonly signingPublicKey: string;\n  readonly status: string;\n  readonly updatedAt: string;\n  readonly userId: string;\n}\n\ninterface SelectedGroup {\n  readonly createdAt: string;\n  readonly groupId: string;\n  readonly isBuiltin: boolean;\n  readonly keyEpoch: number | null;\n  readonly keyFingerprint: string | null;\n  readonly memberCount: number | null;\n  readonly name: string;\n  readonly stateHash: string | null;\n  readonly stateVersion: number | null;\n}\n\n/** A stored policy head before validation; `version` is the state version. */\ninterface StoredPolicyHead {\n  readonly keyEpoch: number;\n  readonly keyFingerprint: string;\n  readonly memberCount: number;\n  readonly stateHash: string;\n  readonly version: number;\n}\n\nfunction isOrganizationRosterStatus(\n  value: string,\n): value is OrganizationRosterStatus {\n  return value === \"active\" || value === \"disabled\";\n}\n\nfunction toDirectoryUser(\n  row: SelectedDirectoryUser,\n  currentUserId: string,\n): OrganizationDirectoryUserResponse {\n  if (!isOrganizationRosterStatus(row.status)) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization directory status is invalid\",\n    );\n  }\n\n  return {\n    userId: row.userId,\n    signingKeyFingerprint: row.signingKeyFingerprint,\n    signingPublicKey: row.signingPublicKey,\n    encapsulationPublicKey: row.encapsulationPublicKey,\n    encapsulationKeyFingerprint: row.encapsulationKeyFingerprint,\n    createdAt: row.createdAt,\n    isPersonalOrganizationOwner: row.isPersonalOrganizationOwner,\n    isSelf: row.userId === currentUserId,\n    status: row.status,\n    profileDocumentId: row.profileDocumentId,\n    joinedAt: row.joinedAt,\n    leaveRequest: readStoredLeaveRequest(row.leaveRequest),\n    updatedAt: row.updatedAt,\n    disabledAt: row.disabledAt,\n    disabledByUserId: row.disabledByUserId,\n  };\n}\n\nfunction readStoredLeaveRequest(\n  stored: string | null,\n): OrganizationLeaveRequest | null {\n  if (stored === null) return null;\n  const parsed: unknown = JSON.parse(stored);\n  if (!isOrganizationLeaveRequest(parsed)) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization leave request is invalid\",\n    );\n  }\n  return parsed;\n}\n\nfunction isValidPolicyHead(head: StoredPolicyHead): boolean {\n  return (\n    head.stateHash.length > 0 &&\n    Number.isInteger(head.version) &&\n    head.version > 0 &&\n    Number.isSafeInteger(head.keyEpoch) &&\n    head.keyEpoch > 0 &&\n    head.keyFingerprint.length > 0 &&\n    Number.isInteger(head.memberCount) &&\n    head.memberCount >= 0\n  );\n}\n\n/** A group's state columns are all null (stateless) or one valid head. */\nfunction toGroupCurrentState(\n  row: SelectedGroup,\n): OrganizationGroupCurrentStateResponse | null {\n  const values = [\n    row.stateHash,\n    row.stateVersion,\n    row.keyEpoch,\n    row.keyFingerprint,\n    row.memberCount,\n  ];\n  if (values.every((value) => value === null)) {\n    return null;\n  }\n  const head =\n    row.stateHash === null ||\n    row.stateVersion === null ||\n    row.keyEpoch === null ||\n    row.keyFingerprint === null ||\n    row.memberCount === null\n      ? null\n      : {\n          stateHash: row.stateHash,\n          version: row.stateVersion,\n          keyEpoch: row.keyEpoch,\n          keyFingerprint: row.keyFingerprint,\n          memberCount: row.memberCount,\n        };\n  if (!head || !isValidPolicyHead(head)) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization group state is invalid\",\n    );\n  }\n  return head;\n}\n\nfunction toOrganizationPolicyHead(\n  organizationId: string,\n  head: StoredPolicyHead,\n): OrganizationReadModelPolicyHead {\n  if (!isValidPolicyHead(head)) {\n    throw new OrganizationReadModelIntegrityError(\n      \"Stored organization policy head is invalid\",\n    );\n  }\n  return {\n    ...head,\n    organizationId,\n    principalId: organizationId,\n    principalType: \"organization\",\n  };\n}\n\n/** The organization head from the state row plus every stateful group head. */\nfunction toProjectionPolicyHeads(input: {\n  readonly groups: ReadonlyArray<{\n    readonly currentState: OrganizationGroupCurrentStateResponse | null;\n    readonly groupId: string;\n  }>;\n  readonly organizationHead: StoredPolicyHead;\n  readonly organizationId: string;\n}): OrganizationReadModelPolicyHead[] {\n  const groupHeads = input.groups\n    .flatMap((group): OrganizationReadModelPolicyHead[] =>\n      group.currentState\n        ? [\n            {\n              ...group.currentState,\n              organizationId: input.organizationId,\n              principalId: group.groupId,\n              principalType: \"group\",\n            },\n          ]\n        : [],\n    )\n    .sort((left, right) =>\n      compareCanonicalStrings(left.principalId, right.principalId),\n    );\n  // Group heads precede the organization head, ordered by principal ID.\n  return [\n    ...groupHeads,\n    toOrganizationPolicyHead(input.organizationId, input.organizationHead),\n  ];\n}\n\nasync function loadDirectoryRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedDirectoryUser[]> {\n  return tx\n    .select({\n      createdAt: organizationReadModelDirectoryUsers.createdAt,\n      disabledAt: organizationReadModelDirectoryUsers.disabledAt,\n      disabledByUserId: organizationReadModelDirectoryUsers.disabledByUserId,\n      encapsulationKeyFingerprint:\n        organizationReadModelDirectoryUsers.encapsulationKeyFingerprint,\n      encapsulationPublicKey:\n        organizationReadModelDirectoryUsers.encapsulationPublicKey,\n      joinedAt: organizationReadModelDirectoryUsers.joinedAt,\n      leaveRequest: organizationReadModelDirectoryUsers.leaveRequest,\n      isPersonalOrganizationOwner:\n        organizationReadModelDirectoryUsers.isPersonalOrganizationOwner,\n      profileDocumentId: organizationReadModelDirectoryUsers.profileDocumentId,\n      signingKeyFingerprint:\n        organizationReadModelDirectoryUsers.signingKeyFingerprint,\n      signingPublicKey: organizationReadModelDirectoryUsers.signingPublicKey,\n      status: organizationReadModelDirectoryUsers.status,\n      updatedAt: organizationReadModelDirectoryUsers.updatedAt,\n      userId: organizationReadModelDirectoryUsers.userId,\n    })\n    .from(organizationReadModelDirectoryUsers)\n    .where(\n      eq(organizationReadModelDirectoryUsers.organizationId, organizationId),\n    )\n    .orderBy(\n      asc(organizationReadModelDirectoryUsers.sortOrder),\n      asc(organizationReadModelDirectoryUsers.userId),\n    );\n}\n\nasync function loadGroupRows(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<SelectedGroup[]> {\n  return tx\n    .select({\n      createdAt: organizationReadModelGroups.createdAt,\n      groupId: organizationReadModelGroups.groupId,\n      isBuiltin: organizationReadModelGroups.isBuiltin,\n      keyEpoch: organizationReadModelGroups.keyEpoch,\n      keyFingerprint: organizationReadModelGroups.keyFingerprint,\n      memberCount: organizationReadModelGroups.memberCount,\n      name: organizationReadModelGroups.name,\n      stateHash: organizationReadModelGroups.stateHash,\n      stateVersion: organizationReadModelGroups.stateVersion,\n    })\n    .from(organizationReadModelGroups)\n    .where(eq(organizationReadModelGroups.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelGroups.sortOrder),\n      asc(organizationReadModelGroups.groupId),\n    );\n}\n\nasync function loadMembershipEdges(\n  tx: ClientSQLiteTransactionScope,\n  organizationId: string,\n): Promise<OrganizationReadModelMembershipEdge[]> {\n  return tx\n    .select({\n      groupId: organizationReadModelGroupMembers.groupId,\n      userId: organizationReadModelGroupMembers.userId,\n    })\n    .from(organizationReadModelGroupMembers)\n    .where(eq(organizationReadModelGroupMembers.organizationId, organizationId))\n    .orderBy(\n      asc(organizationReadModelGroupMembers.groupId),\n      asc(organizationReadModelGroupMembers.sortOrder),\n      asc(organizationReadModelGroupMembers.userId),\n    );\n}\n\nexport async function loadOrganizationReadModelProjectionInTransaction(input: {\n  readonly currentUserId: string;\n  readonly organizationId: string;\n  readonly tx: ClientSQLiteTransactionScope;\n}): Promise<OrganizationReadModelProjection | null> {\n  const [state] = await input.tx\n    .select({\n      cursor: organizationReadModelState.cursor,\n      memberGroupId: organizationReadModelState.memberGroupId,\n      organizationKeyEpoch: organizationReadModelState.organizationKeyEpoch,\n      organizationKeyFingerprint:\n        organizationReadModelState.organizationKeyFingerprint,\n      organizationMemberCount:\n        organizationReadModelState.organizationMemberCount,\n      organizationStateHash: organizationReadModelState.organizationStateHash,\n      organizationStateVersion:\n        organizationReadModelState.organizationStateVersion,\n      profileDocumentId: organizationReadModelState.profileDocumentId,\n      updatedAt: organizationReadModelState.updatedAt,\n    })\n    .from(organizationReadModelState)\n    .where(eq(organizationReadModelState.organizationId, input.organizationId))\n    .limit(1);\n  if (!state) {\n    return null;\n  }\n  const [requester] = await input.tx\n    .select({ isOrgAdmin: organizationReadModelRequesters.isOrgAdmin })\n    .from(organizationReadModelRequesters)\n    .where(\n      and(\n        eq(\n          organizationReadModelRequesters.organizationId,\n          input.organizationId,\n        ),\n        eq(organizationReadModelRequesters.userId, input.currentUserId),\n      ),\n    )\n    .limit(1);\n  const directoryRows = await loadDirectoryRows(input.tx, input.organizationId);\n  const groupRows = await loadGroupRows(input.tx, input.organizationId);\n  const grants = await loadOrganizationReadModelGrantsInTransaction(input);\n  const membershipEdges = await loadMembershipEdges(\n    input.tx,\n    input.organizationId,\n  );\n  const groups = groupRows.map((row) => ({\n    groupId: row.groupId,\n    organizationId: input.organizationId,\n    name: row.name,\n    createdAt: row.createdAt,\n    isBuiltin: row.isBuiltin,\n    currentState: toGroupCurrentState(row),\n  }));\n  const policyHeads = toProjectionPolicyHeads({\n    groups,\n    organizationHead: {\n      keyEpoch: state.organizationKeyEpoch,\n      keyFingerprint: state.organizationKeyFingerprint,\n      memberCount: state.organizationMemberCount,\n      stateHash: state.organizationStateHash,\n      version: state.organizationStateVersion,\n    },\n    organizationId: input.organizationId,\n  });\n\n  return {\n    cursor: state.cursor,\n    directory: {\n      organizationId: input.organizationId,\n      profileDocumentId: state.profileDocumentId,\n      users: directoryRows.map((row) =>\n        toDirectoryUser(row, input.currentUserId),\n      ),\n    },\n    grants,\n    groups: {\n      organizationId: input.organizationId,\n      memberGroupId: state.memberGroupId,\n      groups,\n    },\n    membershipEdges,\n    organizationId: input.organizationId,\n    policyHeads,\n    protocolVersion: ORGANIZATION_READ_MODEL_PROTOCOL_VERSION,\n    requester: requester ? { isOrgAdmin: requester.isOrgAdmin } : null,\n    updatedAt: state.updatedAt,\n  };\n}\n"]}

package/data/sqlite/schema/index.d.ts

@@ -2703,6 +2703,25 @@ export declare const clientSQLiteSchema: {
             }, {}, {
                 length: number | undefined;
             }>;
+            leaveRequest: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "leave_request";
+                tableName: "organization_read_model_directory_users";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
         };
         dialect: "sqlite";
     }>;

package/data/sqlite/schema/organizationReadModelSchema.js

@@ -43,6 +43,8 @@ export const organizationReadModelDirectoryUsers = sqliteTable("organization_rea
     updatedAt: text("updated_at").notNull(),
     disabledAt: text("disabled_at"),
     disabledByUserId: text("disabled_by_user_id"),
+    /** A pending leave request, as JSON, kept only once its signature verified. */
+    leaveRequest: text("leave_request"),
 }, (table) => [primaryKey({ columns: [table.organizationId, table.userId] })]);
 /**
  * Normalized visible organization group summaries. The state columns are the

package/data/sqlite/schema/organizationReadModelSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationReadModelSchema.js","sourceRoot":"","sources":["organizationReadModelSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,+BAA+B,EAC/B;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC9C,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IAChD,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAC/D,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAChE,wBAAwB,EAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE;IACzE,oBAAoB,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE;IACjE,0BAA0B,EAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,EAAE;IAC1E,uBAAuB,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC,OAAO,EAAE;IACvE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAC7D,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,oCAAoC,EACpC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,UAAU,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAClE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAC3E,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,mCAAmC,GAAG,WAAW,CAC5D,yCAAyC,EACzC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAChE,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE;IAClE,2BAA2B,EAAE,IAAI,CAC/B,+BAA+B,CAChC,CAAC,OAAO,EAAE;IACX,2BAA2B,EAAE,OAAO,CAAC,gCAAgC,EAAE;QACrE,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC,OAAO,EAAE;IACZ,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC9C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC;CAC9C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAC3E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CACpD,gCAAgC,EAChC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;IAC9B,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACvC,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;IACpC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC;CAC7C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,WAAW,CAC1D,uCAAuC,EACvC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;CAC7B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;KAC7D,CAAC;CACH,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,mCAAmC,EACnC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;CACtC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC;KACzE,CAAC;CACH,CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,oCAAoC,GAAG,WAAW,CAC7D,0CAA0C,EAC1C;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/D,mBAAmB,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE;IAC/D,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE;IACrE,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IACvB,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;CAC1B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE;YACP,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,SAAS;SAChB;KACF,CAAC;CACH,CACF,CAAC","sourcesContent":["import {\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\n\n/**\n * Cursor and lane-level fields for one locally projected organization: the\n * exact organization policy head, and the state hash of the reserved Members\n * group's membership head, which the group catalog does not list.\n */\nexport const organizationReadModelState = sqliteTable(\n  \"organization_read_model_state\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    cursor: text(\"cursor\").notNull(),\n    profileDocumentId: text(\"profile_document_id\"),\n    memberGroupId: text(\"member_group_id\").notNull(),\n    memberGroupStateHash: text(\"member_group_state_hash\").notNull(),\n    organizationStateHash: text(\"organization_state_hash\").notNull(),\n    organizationStateVersion: integer(\"organization_state_version\").notNull(),\n    organizationKeyEpoch: integer(\"organization_key_epoch\").notNull(),\n    organizationKeyFingerprint: text(\"organization_key_fingerprint\").notNull(),\n    organizationMemberCount: integer(\"organization_member_count\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId] })],\n);\n\n/** Requester-scoped fields that must not become organization-global state. */\nexport const organizationReadModelRequesters = sqliteTable(\n  \"organization_read_model_requesters\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    userId: text(\"user_id\").notNull(),\n    isOrgAdmin: integer(\"is_org_admin\", { mode: \"boolean\" }).notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.userId] })],\n);\n\n/** Normalized organization directory rows. `isSelf` is derived at read time. */\nexport const organizationReadModelDirectoryUsers = sqliteTable(\n  \"organization_read_model_directory_users\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    userId: text(\"user_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    signingKeyFingerprint: text(\"signing_key_fingerprint\").notNull(),\n    signingPublicKey: text(\"signing_public_key\").notNull(),\n    encapsulationPublicKey: text(\"encapsulation_public_key\").notNull(),\n    encapsulationKeyFingerprint: text(\n      \"encapsulation_key_fingerprint\",\n    ).notNull(),\n    isPersonalOrganizationOwner: integer(\"is_personal_organization_owner\", {\n      mode: \"boolean\",\n    }).notNull(),\n    createdAt: text(\"created_at\").notNull(),\n    status: text(\"status\").notNull(),\n    profileDocumentId: text(\"profile_document_id\"),\n    joinedAt: text(\"joined_at\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n    disabledAt: text(\"disabled_at\"),\n    disabledByUserId: text(\"disabled_by_user_id\"),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.userId] })],\n);\n\n/**\n * Normalized visible organization group summaries. The state columns are the\n * group's exact policy head, all null for a stateless group.\n * `members_state_hash` is the state hash of the membership head delivered for\n * the group, null until the groupMemberships lane covers it.\n */\nexport const organizationReadModelGroups = sqliteTable(\n  \"organization_read_model_groups\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    groupId: text(\"group_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    name: text(\"name\").notNull(),\n    createdAt: text(\"created_at\").notNull(),\n    isBuiltin: integer(\"is_builtin\", { mode: \"boolean\" }).notNull(),\n    stateHash: text(\"state_hash\"),\n    stateVersion: integer(\"state_version\"),\n    keyEpoch: integer(\"key_epoch\"),\n    keyFingerprint: text(\"key_fingerprint\"),\n    memberCount: integer(\"member_count\"),\n    membersStateHash: text(\"members_state_hash\"),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.groupId] })],\n);\n\n/**\n * Direct users bound to the exact state of their group's membership head.\n * Public keys are not repeated here; the directory lane holds them per user.\n */\nexport const organizationReadModelGroupMembers = sqliteTable(\n  \"organization_read_model_group_members\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    groupId: text(\"group_id\").notNull(),\n    userId: text(\"user_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    role: text(\"role\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [table.organizationId, table.groupId, table.userId],\n    }),\n  ],\n);\n\n/**\n * Durable record of a server 403/404 for one requester's presentation\n * projection. Written before the revoked rows are purged so a purge failure\n * followed by an offline restart cannot serve the revoked projection; cleared\n * only by a successful authoritative reconcile for the same scope.\n */\nexport const organizationPresentationDenials = sqliteTable(\n  \"organization_presentation_denials\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    requesterUserId: text(\"requester_user_id\").notNull(),\n    projection: text(\"projection\").notNull(),\n    deniedAt: text(\"denied_at\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [table.organizationId, table.requesterUserId, table.projection],\n    }),\n  ],\n);\n\n/** Whole-lane container grants used only by organization presentation reads. */\nexport const organizationReadModelContainerGrants = sqliteTable(\n  \"organization_read_model_container_grants\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    containerId: text(\"container_id\").notNull(),\n    subjectType: text(\"subject_type\").notNull(),\n    subjectId: text(\"subject_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    accessLevel: text(\"access_level\").notNull(),\n    createdAt: text(\"created_at\").notNull(),\n    depth: integer(\"depth\").notNull(),\n    isBuiltin: integer(\"is_builtin\", { mode: \"boolean\" }).notNull(),\n    metadataAccessEpoch: integer(\"metadata_access_epoch\").notNull(),\n    metadataAccessStateHash: text(\"metadata_access_state_hash\").notNull(),\n    metadataDocumentId: text(\"metadata_document_id\"),\n    parentId: text(\"parent_id\"),\n    updatedAt: text(\"updated_at\").notNull(),\n    userId: text(\"user_id\"),\n    signingKeyFingerprint: text(\"signing_key_fingerprint\"),\n    groupId: text(\"group_id\"),\n  },\n  (table) => [\n    primaryKey({\n      columns: [\n        table.organizationId,\n        table.containerId,\n        table.subjectType,\n        table.subjectId,\n      ],\n    }),\n  ],\n);\n"]}
+{"version":3,"file":"organizationReadModelSchema.js","sourceRoot":"","sources":["organizationReadModelSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CACnD,+BAA+B,EAC/B;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC9C,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IAChD,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAC/D,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAChE,wBAAwB,EAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE;IACzE,oBAAoB,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE;IACjE,0BAA0B,EAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,EAAE;IAC1E,uBAAuB,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC,OAAO,EAAE;IACvE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAC7D,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,oCAAoC,EACpC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,UAAU,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAClE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAC3E,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,mCAAmC,GAAG,WAAW,CAC5D,yCAAyC,EACzC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAChE,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE;IAClE,2BAA2B,EAAE,IAAI,CAC/B,+BAA+B,CAChC,CAAC,OAAO,EAAE;IACX,2BAA2B,EAAE,OAAO,CAAC,gCAAgC,EAAE;QACrE,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC,OAAO,EAAE;IACZ,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC9C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC7C,+EAA+E;IAC/E,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;CACpC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAC3E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CACpD,gCAAgC,EAChC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;IAC9B,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACvC,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;IACpC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC;CAC7C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,WAAW,CAC1D,uCAAuC,EACvC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;CAC7B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;KAC7D,CAAC;CACH,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,mCAAmC,EACnC;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;CACtC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC;KACzE,CAAC;CACH,CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,oCAAoC,GAAG,WAAW,CAC7D,0CAA0C,EAC1C;IACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IACjC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/D,mBAAmB,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE;IAC/D,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE;IACrE,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IACvB,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;CAC1B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC;QACT,OAAO,EAAE;YACP,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,SAAS;SAChB;KACF,CAAC;CACH,CACF,CAAC","sourcesContent":["import {\n  integer,\n  primaryKey,\n  sqliteTable,\n  text,\n} from \"drizzle-orm/sqlite-core\";\n\n/**\n * Cursor and lane-level fields for one locally projected organization: the\n * exact organization policy head, and the state hash of the reserved Members\n * group's membership head, which the group catalog does not list.\n */\nexport const organizationReadModelState = sqliteTable(\n  \"organization_read_model_state\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    cursor: text(\"cursor\").notNull(),\n    profileDocumentId: text(\"profile_document_id\"),\n    memberGroupId: text(\"member_group_id\").notNull(),\n    memberGroupStateHash: text(\"member_group_state_hash\").notNull(),\n    organizationStateHash: text(\"organization_state_hash\").notNull(),\n    organizationStateVersion: integer(\"organization_state_version\").notNull(),\n    organizationKeyEpoch: integer(\"organization_key_epoch\").notNull(),\n    organizationKeyFingerprint: text(\"organization_key_fingerprint\").notNull(),\n    organizationMemberCount: integer(\"organization_member_count\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId] })],\n);\n\n/** Requester-scoped fields that must not become organization-global state. */\nexport const organizationReadModelRequesters = sqliteTable(\n  \"organization_read_model_requesters\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    userId: text(\"user_id\").notNull(),\n    isOrgAdmin: integer(\"is_org_admin\", { mode: \"boolean\" }).notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.userId] })],\n);\n\n/** Normalized organization directory rows. `isSelf` is derived at read time. */\nexport const organizationReadModelDirectoryUsers = sqliteTable(\n  \"organization_read_model_directory_users\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    userId: text(\"user_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    signingKeyFingerprint: text(\"signing_key_fingerprint\").notNull(),\n    signingPublicKey: text(\"signing_public_key\").notNull(),\n    encapsulationPublicKey: text(\"encapsulation_public_key\").notNull(),\n    encapsulationKeyFingerprint: text(\n      \"encapsulation_key_fingerprint\",\n    ).notNull(),\n    isPersonalOrganizationOwner: integer(\"is_personal_organization_owner\", {\n      mode: \"boolean\",\n    }).notNull(),\n    createdAt: text(\"created_at\").notNull(),\n    status: text(\"status\").notNull(),\n    profileDocumentId: text(\"profile_document_id\"),\n    joinedAt: text(\"joined_at\").notNull(),\n    updatedAt: text(\"updated_at\").notNull(),\n    disabledAt: text(\"disabled_at\"),\n    disabledByUserId: text(\"disabled_by_user_id\"),\n    /** A pending leave request, as JSON, kept only once its signature verified. */\n    leaveRequest: text(\"leave_request\"),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.userId] })],\n);\n\n/**\n * Normalized visible organization group summaries. The state columns are the\n * group's exact policy head, all null for a stateless group.\n * `members_state_hash` is the state hash of the membership head delivered for\n * the group, null until the groupMemberships lane covers it.\n */\nexport const organizationReadModelGroups = sqliteTable(\n  \"organization_read_model_groups\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    groupId: text(\"group_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    name: text(\"name\").notNull(),\n    createdAt: text(\"created_at\").notNull(),\n    isBuiltin: integer(\"is_builtin\", { mode: \"boolean\" }).notNull(),\n    stateHash: text(\"state_hash\"),\n    stateVersion: integer(\"state_version\"),\n    keyEpoch: integer(\"key_epoch\"),\n    keyFingerprint: text(\"key_fingerprint\"),\n    memberCount: integer(\"member_count\"),\n    membersStateHash: text(\"members_state_hash\"),\n  },\n  (table) => [primaryKey({ columns: [table.organizationId, table.groupId] })],\n);\n\n/**\n * Direct users bound to the exact state of their group's membership head.\n * Public keys are not repeated here; the directory lane holds them per user.\n */\nexport const organizationReadModelGroupMembers = sqliteTable(\n  \"organization_read_model_group_members\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    groupId: text(\"group_id\").notNull(),\n    userId: text(\"user_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    stateHash: text(\"state_hash\").notNull(),\n    role: text(\"role\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [table.organizationId, table.groupId, table.userId],\n    }),\n  ],\n);\n\n/**\n * Durable record of a server 403/404 for one requester's presentation\n * projection. Written before the revoked rows are purged so a purge failure\n * followed by an offline restart cannot serve the revoked projection; cleared\n * only by a successful authoritative reconcile for the same scope.\n */\nexport const organizationPresentationDenials = sqliteTable(\n  \"organization_presentation_denials\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    requesterUserId: text(\"requester_user_id\").notNull(),\n    projection: text(\"projection\").notNull(),\n    deniedAt: text(\"denied_at\").notNull(),\n  },\n  (table) => [\n    primaryKey({\n      columns: [table.organizationId, table.requesterUserId, table.projection],\n    }),\n  ],\n);\n\n/** Whole-lane container grants used only by organization presentation reads. */\nexport const organizationReadModelContainerGrants = sqliteTable(\n  \"organization_read_model_container_grants\",\n  {\n    organizationId: text(\"organization_id\").notNull(),\n    containerId: text(\"container_id\").notNull(),\n    subjectType: text(\"subject_type\").notNull(),\n    subjectId: text(\"subject_id\").notNull(),\n    sortOrder: integer(\"sort_order\").notNull(),\n    accessLevel: text(\"access_level\").notNull(),\n    createdAt: text(\"created_at\").notNull(),\n    depth: integer(\"depth\").notNull(),\n    isBuiltin: integer(\"is_builtin\", { mode: \"boolean\" }).notNull(),\n    metadataAccessEpoch: integer(\"metadata_access_epoch\").notNull(),\n    metadataAccessStateHash: text(\"metadata_access_state_hash\").notNull(),\n    metadataDocumentId: text(\"metadata_document_id\"),\n    parentId: text(\"parent_id\"),\n    updatedAt: text(\"updated_at\").notNull(),\n    userId: text(\"user_id\"),\n    signingKeyFingerprint: text(\"signing_key_fingerprint\"),\n    groupId: text(\"group_id\"),\n  },\n  (table) => [\n    primaryKey({\n      columns: [\n        table.organizationId,\n        table.containerId,\n        table.subjectType,\n        table.subjectId,\n      ],\n    }),\n  ],\n);\n"]}

package/data/sqlite/schema/organizationReadModelTableRegistry.d.ts

@@ -577,6 +577,25 @@ export declare const organizationReadModelSQLiteSchema: {
             }, {}, {
                 length: number | undefined;
             }>;
+            leaveRequest: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                name: "leave_request";
+                tableName: "organization_read_model_directory_users";
+                dataType: "string";
+                columnType: "SQLiteText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                length: number | undefined;
+            }>;
         };
         dialect: "sqlite";
     }>;

package/index.d.ts

@@ -1,5 +1,5 @@
 export { type ApiRequestCounts, type ApiRequestEndpointCounts, ApiRequestMetrics, type ApiRequestMetricsSnapshot, } from "./internal/api-client/index.js";
-export type { AbandonOrganizationPolicyMutationInput, AddOrganizationGroupUserInput, BlobInfo, BlobInfoAttachmentKind, BlobInfoDocumentReference, BlobInfoInput, BlobInfoList, BlobInfoSort, BlobInfoSortDirection, BlobInfoSortKey, BrowserLocalKeyringOptions, ContainerContents, ContainerContentsContextValue, ContainerContentsStore, ContainerContentsStoreOptions, ContainerDocumentLinkInput, ContainerDocumentLinks, ContainerDocumentObjectSyncState, ContainerDocumentObjectSyncStatus, ContainerDocumentQueries, ContainerDocumentSidebarRow, ContainerInfo, ContainerInfoInput, ContainerItemRow, ContainerItemSort, ContainerItemSortDirection, ContainerItemSortKey, ContainerNode, ContainerShareAccessLevel, CreateOrganizationOptions, DatabaseListener, DatabaseOptions, DatabaseSnapshot, DatabaseStatus, DeviceFirst, DeviceFirstContainerContents, DiscardUnreadableOrganizationPolicyMutationInput, DocumentAttachmentStatus, DocumentAttachmentUpload, DocumentAttributionRangesInput, DocumentAttributionRangesPage, DocumentContextValue, DocumentInfo, DocumentInfoInput, DocumentList, DocumentSort, DocumentSortDirection, DocumentSortKey, DocumentStore, DocumentSubscriptionOptions, Documents, DocumentsRuntime, DomainScope, FileSaver, Identity, IdentityGenerationResult, IdentityKeyPackage, IdentityListener, IdentityOptions, IdentitySnapshot, ImportedOrganizationUser, IndexedDbLocalKeyringManifestStoreOptions, IndexedDbWrappingKeyKeystoreOptions, LinkDocumentToContainerInput, ListDocumentsInput, LocalKeyPurpose, LocalKeyring, LocalKeyringManifest, LocalKeyringManifestFormat, LocalKeyringManifestStorage, LocalKeyringManifestStore, LocalKeyringOptions, LocalKeyringPinCode, LocalKeyringScope, LocalKeyringSession, LocalOrganizationSummary, LocalProjectionReconciledDelta, LocalProjectionSnapshot, LocalProjectionView, LocalSecretContext, LocalStorageLocalKeyringManifestStoreOptions, Logger, MergeDocumentSummary, MoveDocumentToContainerInput, NetworkListener, NetworkMode, NetworkStatusSource, NormalizedLocalKeyringScope, OpenContainerDocumentInput, OpenDocumentInput, OpenDocumentOptions, OrganizationBilling, OrganizationBillingHistory, OrganizationBillingHistoryEntry, OrganizationBillingManagementUrl, OrganizationBillingView, OrganizationContainerGrant, OrganizationContainerGrants, OrganizationDataUsage, OrganizationDirectory, OrganizationDirectoryAndGroups, OrganizationDirectoryUser, OrganizationGrantRef, OrganizationGroupContainer, OrganizationGroupContainers, OrganizationGroupDetails, OrganizationGroupMember, OrganizationGroupMembers, OrganizationGroupMutationReceipt, OrganizationGroupPolicyHistory, OrganizationGroupSummary, OrganizationMembership, OrganizationMemberships, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, 
+export type { AbandonOrganizationPolicyMutationInput, AddOrganizationGroupUserInput, BlobInfo, BlobInfoAttachmentKind, BlobInfoDocumentReference, BlobInfoInput, BlobInfoList, BlobInfoSort, BlobInfoSortDirection, BlobInfoSortKey, BrowserLocalKeyringOptions, ContainerContents, ContainerContentsContextValue, ContainerContentsStore, ContainerContentsStoreOptions, ContainerDocumentLinkInput, ContainerDocumentLinks, ContainerDocumentObjectSyncState, ContainerDocumentObjectSyncStatus, ContainerDocumentQueries, ContainerDocumentSidebarRow, ContainerInfo, ContainerInfoInput, ContainerItemRow, ContainerItemSort, ContainerItemSortDirection, ContainerItemSortKey, ContainerNode, ContainerShareAccessLevel, CreateOrganizationOptions, DatabaseListener, DatabaseOptions, DatabaseSnapshot, DatabaseStatus, DeviceFirst, DeviceFirstContainerContents, DiscardUnreadableOrganizationPolicyMutationInput, DocumentAttachmentStatus, DocumentAttachmentUpload, DocumentAttributionRangesInput, DocumentAttributionRangesPage, DocumentContextValue, DocumentInfo, DocumentInfoInput, DocumentList, DocumentSort, DocumentSortDirection, DocumentSortKey, DocumentStore, DocumentSubscriptionOptions, Documents, DocumentsRuntime, DomainScope, FileSaver, Identity, IdentityGenerationResult, IdentityKeyPackage, IdentityListener, IdentityOptions, IdentitySnapshot, ImportedOrganizationUser, IndexedDbLocalKeyringManifestStoreOptions, IndexedDbWrappingKeyKeystoreOptions, LinkDocumentToContainerInput, ListDocumentsInput, LocalKeyPurpose, LocalKeyring, LocalKeyringManifest, LocalKeyringManifestFormat, LocalKeyringManifestStorage, LocalKeyringManifestStore, LocalKeyringOptions, LocalKeyringPinCode, LocalKeyringScope, LocalKeyringSession, LocalOrganizationSummary, LocalProjectionReconciledDelta, LocalProjectionSnapshot, LocalProjectionView, LocalSecretContext, LocalStorageLocalKeyringManifestStoreOptions, Logger, MergeDocumentSummary, MoveDocumentToContainerInput, NetworkListener, NetworkMode, NetworkStatusSource, NormalizedLocalKeyringScope, OpenContainerDocumentInput, OpenDocumentInput, OpenDocumentOptions, OrganizationBilling, OrganizationBillingHistory, OrganizationBillingHistoryEntry, OrganizationBillingManagementUrl, OrganizationBillingView, OrganizationContainerGrant, OrganizationContainerGrants, OrganizationDataUsage, OrganizationDirectory, OrganizationDirectoryAndGroups, OrganizationDirectoryUser, OrganizationGrantRef, OrganizationGroupContainer, OrganizationGroupContainers, OrganizationGroupDetails, OrganizationGroupMember, OrganizationGroupMembers, OrganizationGroupMutationReceipt, OrganizationGroupPolicyHistory, OrganizationGroupSummary, OrganizationLeaveRequestResult, OrganizationMembership, OrganizationMemberships, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, 
 /** Verified organization display page with an optional older-page cursor. */
 OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationProfile, OrganizationSyncPauseResult, Organizations, OrganizationUserDetail, PendingWriteQueueItem, PendingWriteQueueItemStatus, PendingWriteQueueObjectKind, PendingWriteQueueOperation, PendingWriteQueueOperationKind, PendingWriteQueueOperationStatus, PersistedDocumentListener, PinCodeBrowserLocalKeyringOptions, PinCodeWrappingKeyKeystoreOptions, PurgeDocumentInput, PurgeDocumentResult, ReconciliationService, RemoveOrganizationGroupUserInput, ResolvedUserIdentity, SaveFileRequest, SecurityIncident, SecurityIncidentListener, SecurityIncidentObjectKind, SecurityIncidents, Session, SessionContext, SessionCreateOrganizationResult, SessionListener, SessionRecoverOrganizationResult, SessionRegistrationRefusal, SessionRegistrationResult, SessionSnapshot, SetActiveDocumentContainerInput, SetLinkedContainerIdsForDocument, UnlinkDocumentFromContainerInput, UnwrapLocalSecretInput, UserIdentities, UserSession, WrapLocalSecretInput, WrappedLocalSecretEnvelope, WrappedLocalSecretFormat, WrappingKeyHandle, WrappingKeyKeystore, WrappingKeyMaterialStorage, } from "./client/index.js";
 export { type BlobStoreFactory, Blobs, createBrowserLocalKeyring, createBrowserLocalKeyringManifestStore, createBrowserNetworkStatusSource, createContainerDocumentObjectSyncState, createDomainScope, createIndexedDbLocalKeyringManifestStore, createIndexedDbWrappingKeyKeystore, createLocalKeyring, createLocalStorageLocalKeyringManifestStore, createMemoryLocalKeyringManifestStore, createMemoryWrappingKeyKeystore, createPinCodeBrowserLocalKeyring, createPinCodeWrappingKeyKeystore, createRevenueCatPurchases, createUnavailableDirectCheckout, createUnavailablePurchases, createWebViewLocalKeyring, Database, DEFAULT_DOCUMENT_ID, type DirectCheckoutAppearance, type DirectCheckoutCapability, type DirectCheckoutConfirmation, type DirectCheckoutSession, DirectCheckoutUnavailableError, decodeLocalKeyringSqliteKey, Events, type EventsListener, type EventsSnapshot, encodeLocalKeyringSqliteKey, enqueueReconciliationForEvents, IDENTITY_KEY_PACKAGE_FORMAT, isPinCodeWrappedLocalSecretEnvelope, LOCAL_KEYRING_MANIFEST_FORMAT, localKeyringScopeKey, Network, normalizeLocalKeyringScope, type PrincipalHistoryKeyProvider, type PrincipalHistoryKeyScope, PurchaseAbortedError, PurchaseAlreadyOwnedError, PurchaseCancelledError, PurchaseIdentityPendingError, PurchaseProviderStalledError, type PurchasesCapability, PurchasesUnavailableError, PurgedOrganizationRecoveryBillingRequiredError, parseLocalKeyringManifest, type RevenueCatBackend, type RevenueCatCustomerInfo, type RevenueCatPackage, type RevenueCatPurchasesConfig, SyncBillingGate, type SyncBillingGateListener, type SyncPurchaseResult, type SyncSubscriptionOption, serializeLocalKeyringManifest, WRAPPED_LOCAL_SECRET_FORMAT, } from "./client/index.js";

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAqK/B,OAAO,EAEL,KAAK,EACL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAuBlB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAexC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,2BAA2B,EAC3B,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EACL,gCAAgC,EAChC,uCAAuC,EACvC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// SDK: verified identity links, read-only pins and device-first handles.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationMembership,\n  OrganizationMemberships,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./data/documents\";\nexport {\n  addDocumentAttachments,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./data/documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeMoveSettlement,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport { Tearleads } from \"./Tearleads\";\nexport type {\n  TearleadsDatabaseOptions,\n  TearleadsOptions,\n} from \"./TearleadsOptions\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  readBlobByteSource,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  GroupShareNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  shareRemoteContainerWithGroup,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  AcknowledgedPrincipalPredecessor,\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  captureAcknowledgedPrincipalPredecessor,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAsK/B,OAAO,EAEL,KAAK,EACL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAuBlB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAexC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,2BAA2B,EAC3B,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EACL,gCAAgC,EAChC,uCAAuC,EACvC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// SDK: verified identity links, read-only pins and device-first handles.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationLeaveRequestResult,\n  OrganizationMembership,\n  OrganizationMemberships,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./data/documents\";\nexport {\n  addDocumentAttachments,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./data/documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeMoveSettlement,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport { Tearleads } from \"./Tearleads\";\nexport type {\n  TearleadsDatabaseOptions,\n  TearleadsOptions,\n} from \"./TearleadsOptions\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  readBlobByteSource,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  GroupShareNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  shareRemoteContainerWithGroup,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  AcknowledgedPrincipalPredecessor,\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  captureAcknowledgedPrincipalPredecessor,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}

package/internal/api-client/ApiClient.d.ts

@@ -2,6 +2,7 @@ import type { NativeSubscriptionStore } from "../validators/billing.js";
 import { type RootIdentitiesQuery, type RootOrganizationPageQuery, type RootOrganizationsQuery } from "../validators/operation/index.js";
 import type { BlobAttachmentBindRequest, BlobAttachmentDetachRequest, CommitOrganizationGroupPolicyRequest, ContainerCreateWithMetadataDocumentRequest, ContainerMutationRequest, ContainerReciteRequest, ContainerRotationRequest, CreateOrganizationRequest, DocumentCreateRequest, DocumentLinkSetMutationRequest, DocumentPurgeRequest, DocumentSyncRequest, InitiateMultipartBlobStageRequest, ListContainerDocumentLanesRequest, ListContainerParentLanesRequest, RegistrationRequest, UpdateOrganizationMembershipRequest, UpdateOrganizationProfileRequest, UpdateOrganizationRosterEntryRequest } from "../validators/request/index.js";
 import type { CommitOrganizationGroupPolicyResponse, ContainerCreateWithMetadataDocumentResponse, ContainerDeleteResponse, ContainerMutationResponse, ContainerRotationResponse, ContainerWriterProjectionResponse, DocumentCreateResponse, DocumentSyncResponse, DocumentWriterProjectionResponse, ListContainerDocumentLanesResponse, OrganizationDataUsageResponse, OrganizationMembershipResponse, OrganizationPolicyHistoryResponse, OrganizationReadModelResponse, RootDataUsageReportResponse, RootIdentitiesResponse, RootIdentityDetailResponse, RootIdentityOrganizationsResponse, RootOrganizationDetailResponse, RootOrganizationIdentitiesResponse, RootOrganizationsResponse } from "../validators/response/index.js";
+import type { OrganizationLeaveRequest } from "../validators/util/index.js";
 import type { ApiRequestInstrumentation } from "./apiRequestMetrics.js";
 import { getOrganizationPolicyHistoryResult as organizationHistory } from "./organizationPolicyHistory.js";
 import type { PrincipalPolicyPageReadOptions } from "./principalPolicyPages.js";
@@ -2082,6 +2083,12 @@ export declare class ApiClient {
         isPersonalOrganizationOwner: boolean;
         isSelf: boolean;
         joinedAt: string;
+        leaveRequest: {
+            organizationId: string;
+            userId: string;
+            requestedAt: string;
+            signature: string;
+        } | null;
         profileDocumentId: string | null;
         signingKeyFingerprint: string;
         signingPublicKey: string;
@@ -2093,11 +2100,14 @@ export declare class ApiClient {
     listOrganizationMemberships(): Promise<{
         memberships: {
             isPersonalOrganizationOwner: boolean;
+            leaveRequestedAt: string | null;
             organizationId: string;
             syncPaused: boolean;
         }[];
     } | null>;
     updateOrganizationMembership(organizationId: string, input: UpdateOrganizationMembershipRequest): Promise<RequestResult<OrganizationMembershipResponse>>;
+    /** Files the user's signed request to leave, or withdraws it (null). */
+    setOrganizationLeaveRequest(organizationId: string, request: OrganizationLeaveRequest | null): Promise<RequestResult<OrganizationMembershipResponse>>;
     updateOrganizationProfile(organizationId: string, input: UpdateOrganizationProfileRequest): Promise<{
         organizationId: string;
         profileDocumentId: string | null;