@tearleads/client-sdk 0.1.93 → 0.1.95

package/client/root/index.d.ts

@@ -1,5 +1,5 @@
 import type { OrganizationDataUsageResponse } from "../../internal/validators/response/index.js";
-import { type RootAuditApi, type RootAuditEventsPage, type RootAuditEventsQueryInput, type RootDataUsageApi, type RootDataUsageReportPage, type RootIdentitiesApi, type RootIdentitiesPage, type RootIdentitiesQueryInput, type RootIdentityDetail, type RootIdentityOrganization, type RootOrganizationDetail, type RootOrganizationIdentitiesPage, type RootOrganizationPageQueryInput, type RootOrganizationsApi, type RootOrganizationsPage, type RootOrganizationsQueryInput, type RootRequestOutcome } from "../../workflows/root/index.js";
+import { type RootAuditApi, type RootAuditEventsPage, type RootAuditEventsQueryInput, type RootDataUsageApi, type RootDataUsageReportPage, type RootIdentitiesApi, type RootIdentitiesPage, type RootIdentitiesQueryInput, type RootIdentity, type RootIdentityDetail, type RootIdentityOrganization, type RootOpsHealthApi, type RootOpsHealthReport, type RootOrganizationDetail, type RootOrganizationIdentitiesPage, type RootOrganizationPageQueryInput, type RootOrganizationsApi, type RootOrganizationsPage, type RootOrganizationsQueryInput, type RootRequestOutcome, type RootSuspensionApi } from "../../workflows/root/index.js";
 import type { WorkflowRuntimeAuthInput, WorkflowRuntimeCryptoInput } from "../../workflows/shared/runtimeInput.js";
 import type { InternalRuntime } from "../runtime/workflowRuntime.js";
 import type { Session } from "../session/sessionTypes.js";
@@ -8,12 +8,14 @@ import type { Session } from "../session/sessionTypes.js";
  * is authenticated and the server reported it as root at login; the API still
  * enforces root access on its own, so this gate only avoids doomed requests.
  */
-type RootApi = RootIdentitiesApi & RootOrganizationsApi & RootDataUsageApi & RootAuditApi;
+type RootApi = RootIdentitiesApi & RootOrganizationsApi & RootDataUsageApi & RootOpsHealthApi & RootAuditApi & RootSuspensionApi;
 export interface Root {
     /** Recorded operator actions, newest first; each listing is recorded too. */
     listAuditEvents(query?: RootAuditEventsQueryInput): Promise<RootRequestOutcome<RootAuditEventsPage>>;
     loadOrganizationDataUsage(organizationId: string): Promise<RootRequestOutcome<OrganizationDataUsageResponse>>;
     listDataUsageReport(query?: RootOrganizationsQueryInput): Promise<RootRequestOutcome<RootDataUsageReportPage>>;
+    /** Seat-sync, trial-expiry and purge trouble across every organization. */
+    loadOpsHealthReport(): Promise<RootRequestOutcome<RootOpsHealthReport>>;
     listOrganizations(query?: RootOrganizationsQueryInput): Promise<RootRequestOutcome<RootOrganizationsPage>>;
     loadOrganization(organizationId: string): Promise<RootRequestOutcome<RootOrganizationDetail>>;
     listOrganizationIdentities(organizationId: string, query?: RootOrganizationPageQueryInput): Promise<RootRequestOutcome<RootOrganizationIdentitiesPage>>;
@@ -22,6 +24,14 @@ export interface Root {
     listIdentities(query?: RootIdentitiesQueryInput): Promise<RootRequestOutcome<RootIdentitiesPage>>;
     listIdentityOrganizations(userId: string): Promise<RootRequestOutcome<RootIdentityOrganization[]>>;
     loadIdentity(userId: string): Promise<RootRequestOutcome<RootIdentityDetail>>;
+    /** Lets a suspended identity's devices sign in again. */
+    liftIdentitySuspension(userId: string): Promise<RootRequestOutcome<RootIdentity>>;
+    /**
+     * Signs the identity out of every device and refuses its sign-in until the
+     * suspension is lifted. The server refuses root identities. A session change
+     * mid-flight leaves the outcome unknown; reload the identity to see it.
+     */
+    suspendIdentity(userId: string): Promise<RootRequestOutcome<RootIdentity>>;
 }
 /**
  * What the facade needs from the runtime: change notifications, the current

package/client/root/index.js

@@ -1,4 +1,4 @@
-import { listRootAuditEvents, listRootDataUsageReport, listRootIdentities, listRootIdentityOrganizations, listRootOrganizationIdentities, listRootOrganizations, loadRootIdentity, loadRootOrganization, loadRootOrganizationDataUsage, } from "../../workflows/root/index.js";
+import { liftRootIdentitySuspension, listRootAuditEvents, listRootDataUsageReport, listRootIdentities, listRootIdentityOrganizations, listRootOrganizationIdentities, listRootOrganizations, loadRootIdentity, loadRootOpsHealthReport, loadRootOrganization, loadRootOrganizationDataUsage, suspendRootIdentity, } from "../../workflows/root/index.js";
 /** The SDK's internal runtime, narrowed to what the root facade observes. */
 export function rootRuntimeOf(runtime, session) {
     return {
@@ -91,15 +91,24 @@ export function createRoot(runtimeService) {
         get isAvailable() {
             return activeApi() !== null;
         },
+        ...guardedRootCalls(guarded),
+    };
+}
+/** Every facade call, each run through the session's root gate. */
+function guardedRootCalls(guarded) {
+    return {
         listAuditEvents: (query) => guarded((api) => listRootAuditEvents(api, query)),
         loadOrganizationDataUsage: (organizationId) => guarded((api) => loadRootOrganizationDataUsage(api, organizationId)),
         listDataUsageReport: (query) => guarded((api) => listRootDataUsageReport(api, query)),
+        loadOpsHealthReport: () => guarded((api) => loadRootOpsHealthReport(api)),
         listOrganizations: (query) => guarded((api) => listRootOrganizations(api, query)),
         loadOrganization: (organizationId) => guarded((api) => loadRootOrganization(api, organizationId)),
         listOrganizationIdentities: (organizationId, query) => guarded((api) => listRootOrganizationIdentities(api, organizationId, query)),
         listIdentities: (query) => guarded((api) => listRootIdentities(api, query)),
         listIdentityOrganizations: (userId) => guarded((api) => listRootIdentityOrganizations(api, userId)),
         loadIdentity: (userId) => guarded((api) => loadRootIdentity(api, userId)),
+        liftIdentitySuspension: (userId) => guarded((api) => liftRootIdentitySuspension(api, userId)),
+        suspendIdentity: (userId) => guarded((api) => suspendRootIdentity(api, userId)),
     };
 }
 //# sourceMappingURL=index.js.map

package/client/root/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAkB9B,MAAM,sBAAsB,CAAC;AAmE9B,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAC3B,OAAiE,EACjE,OAAmC;IAEnC,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS;QAClC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;QAClE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAA8B;IAC/C,OAAO,EAAE,iDAAiD;IAC1D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,eAAe,GAA8B;IACjD,OAAO,EAAE,sDAAsD;IAC/D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,cAA2B;IACpD,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YACpC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;IAC/C,IAAI,gBAAgB,GAClB,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE;QAC5B,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,aAAa,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC;QACtD,MAAM,OAAO,GACX,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACzC,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAC/B,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,IAAI,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC;QACtC,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,GAAmB,EAAE;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe;YACjC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YAC5B,gBAAgB,KAAK,IAAI;YACzB,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB;YACtD,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EACnB,OAA4D,EACzB,EAAE;QACrC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,EAAE,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,WAAW;YACb,OAAO,SAAS,EAAE,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CACzB,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,yBAAyB,EAAE,CAAC,cAAc,EAAE,EAAE,CAC5C,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,gBAAgB,EAAE,CAAC,cAAc,EAAE,EAAE,CACnC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7D,0BAA0B,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CACpD,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,8BAA8B,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAC3D;QACH,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3E,yBAAyB,EAAE,CAAC,MAAM,EAAE,EAAE,CACpC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC","sourcesContent":["import type { OrganizationDataUsageResponse } from \"@tearleads/validators/response\";\nimport {\n  listRootAuditEvents,\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootAuditApi,\n  type RootAuditEventsPage,\n  type RootAuditEventsQueryInput,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootIdentitiesApi,\n  type RootIdentitiesPage,\n  type RootIdentitiesQueryInput,\n  type RootIdentityDetail,\n  type RootIdentityOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n  type RootRequestOutcome,\n} from \"../../workflows/root\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n} from \"../../workflows/shared/runtimeInput\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport type { Session } from \"../session/sessionTypes\";\n\n/**\n * Platform-operator lookups. Every call is refused locally unless the session\n * is authenticated and the server reported it as root at login; the API still\n * enforces root access on its own, so this gate only avoids doomed requests.\n */\ntype RootApi = RootIdentitiesApi &\n  RootOrganizationsApi &\n  RootDataUsageApi &\n  RootAuditApi;\n\nexport interface Root {\n  /** Recorded operator actions, newest first; each listing is recorded too. */\n  listAuditEvents(\n    query?: RootAuditEventsQueryInput,\n  ): Promise<RootRequestOutcome<RootAuditEventsPage>>;\n  loadOrganizationDataUsage(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<OrganizationDataUsageResponse>>;\n  listDataUsageReport(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootDataUsageReportPage>>;\n  listOrganizations(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationsPage>>;\n  loadOrganization(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<RootOrganizationDetail>>;\n  listOrganizationIdentities(\n    organizationId: string,\n    query?: RootOrganizationPageQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationIdentitiesPage>>;\n  /** Whether the current session may use the root surface at all. */\n  readonly isAvailable: boolean;\n  listIdentities(\n    query?: RootIdentitiesQueryInput,\n  ): Promise<RootRequestOutcome<RootIdentitiesPage>>;\n  listIdentityOrganizations(\n    userId: string,\n  ): Promise<RootRequestOutcome<RootIdentityOrganization[]>>;\n  loadIdentity(userId: string): Promise<RootRequestOutcome<RootIdentityDetail>>;\n}\n\n/**\n * What the facade needs from the runtime: change notifications, the current\n * auth snapshot, the signing identity (which can change or vanish without\n * touching the session), and the api client. Narrower than the full runtime\n * so tests can drive it with a fake.\n */\nexport interface RootRuntime {\n  /** The session's current auth token; a new one marks a fresh login. */\n  authToken(): string | null;\n  subscribe(listener: () => void): () => void;\n  workflowInput(): {\n    readonly apiClient: RootApi;\n    readonly auth: WorkflowRuntimeAuthInput;\n    readonly crypto: Pick<WorkflowRuntimeCryptoInput, \"signingFingerprint\">;\n  };\n}\n\n/** The SDK's internal runtime, narrowed to what the root facade observes. */\nexport function rootRuntimeOf(\n  runtime: Pick<InternalRuntime, \"publicRuntime\" | \"workflowInput\">,\n  session: Pick<Session, \"authToken\">,\n): RootRuntime {\n  return {\n    authToken: () => session.authToken,\n    subscribe: (listener) => runtime.publicRuntime.subscribe(listener),\n    workflowInput: () => runtime.workflowInput(),\n  };\n}\n\nconst NOT_AVAILABLE: RootRequestOutcome<never> = {\n  message: \"The current session is not a platform operator.\",\n  ok: false,\n  status: null,\n};\n\nconst SESSION_CHANGED: RootRequestOutcome<never> = {\n  message: \"The session changed while the request was in flight.\",\n  ok: false,\n  status: null,\n};\n\nexport function createRoot(runtimeService: RootRuntime): Root {\n  const principal = () => {\n    const runtime = runtimeService.workflowInput();\n    return {\n      fingerprint: runtime.crypto.signingFingerprint,\n      isAuthenticated: runtime.auth.isAuthenticated,\n      isRoot: runtime.auth.isRoot === true,\n      userId: runtime.auth.userId,\n    };\n  };\n\n  // Root standing belongs to the signing identity that authenticated, not to\n  // whichever key pair is loaded now. The fingerprint is bound whenever a\n  // login completes, which is observable as a new auth token carrying the\n  // server's verdict, or when the session first becomes root. A principal\n  // change without a new token (a key swap while the old token lingers)\n  // unbinds root until the next login. Every principal change is also\n  // counted as it happens, so a round trip such as logout then login, or a\n  // switch to another identity and back, is still two changes even though\n  // the endpoints match; a token renewal alone changes no principal, so a\n  // retried lookup is still returned.\n  let observed = principal();\n  let observedToken = runtimeService.authToken();\n  let boundFingerprint: string | null =\n    observed.isAuthenticated && observed.isRoot ? observed.fingerprint : null;\n  let lifecycle = 0;\n  runtimeService.subscribe(() => {\n    const next = principal();\n    const token = runtimeService.authToken();\n    const freshToken = token !== null && token !== observedToken;\n    const wasRoot = observed.isAuthenticated && observed.isRoot;\n    const isRootNow = next.isAuthenticated && next.isRoot;\n    const changed =\n      next.fingerprint !== observed.fingerprint ||\n      next.isAuthenticated !== observed.isAuthenticated ||\n      next.isRoot !== observed.isRoot ||\n      next.userId !== observed.userId;\n    if (changed) {\n      lifecycle += 1;\n    }\n    if (!isRootNow) {\n      boundFingerprint = null;\n    } else if (freshToken || !wasRoot) {\n      boundFingerprint = next.fingerprint;\n    } else if (changed) {\n      boundFingerprint = null;\n    }\n    observed = next;\n    observedToken = token;\n  });\n\n  const activeApi = (): RootApi | null => {\n    const runtime = runtimeService.workflowInput();\n    return runtime.auth.isAuthenticated &&\n      runtime.auth.isRoot === true &&\n      boundFingerprint !== null &&\n      runtime.crypto.signingFingerprint === boundFingerprint\n      ? runtime.apiClient\n      : null;\n  };\n\n  const guarded = async <Data>(\n    request: (api: RootApi) => Promise<RootRequestOutcome<Data>>,\n  ): Promise<RootRequestOutcome<Data>> => {\n    const api = activeApi();\n    if (!api) {\n      return NOT_AVAILABLE;\n    }\n    const startedIn = lifecycle;\n    const outcome = await request(api);\n    if (activeApi() === null || lifecycle !== startedIn) {\n      return SESSION_CHANGED;\n    }\n    return outcome;\n  };\n\n  return {\n    get isAvailable() {\n      return activeApi() !== null;\n    },\n    listAuditEvents: (query) =>\n      guarded((api) => listRootAuditEvents(api, query)),\n    loadOrganizationDataUsage: (organizationId) =>\n      guarded((api) => loadRootOrganizationDataUsage(api, organizationId)),\n    listDataUsageReport: (query) =>\n      guarded((api) => listRootDataUsageReport(api, query)),\n    listOrganizations: (query) =>\n      guarded((api) => listRootOrganizations(api, query)),\n    loadOrganization: (organizationId) =>\n      guarded((api) => loadRootOrganization(api, organizationId)),\n    listOrganizationIdentities: (organizationId, query) =>\n      guarded((api) =>\n        listRootOrganizationIdentities(api, organizationId, query),\n      ),\n    listIdentities: (query) => guarded((api) => listRootIdentities(api, query)),\n    listIdentityOrganizations: (userId) =>\n      guarded((api) => listRootIdentityOrganizations(api, userId)),\n    loadIdentity: (userId) => guarded((api) => loadRootIdentity(api, userId)),\n  };\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAsB7B,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAiF9B,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAC3B,OAAiE,EACjE,OAAmC;IAEnC,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS;QAClC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;QAClE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAA8B;IAC/C,OAAO,EAAE,iDAAiD;IAC1D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,eAAe,GAA8B;IACjD,OAAO,EAAE,sDAAsD;IAC/D,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,cAA2B;IACpD,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YACpC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;IAC/C,IAAI,gBAAgB,GAClB,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE;QAC5B,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,aAAa,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC;QACtD,MAAM,OAAO,GACX,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YACzC,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YACjD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAC/B,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,IAAI,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC;QACtC,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,GAAmB,EAAE;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe;YACjC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YAC5B,gBAAgB,KAAK,IAAI;YACzB,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB;YACtD,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EACnB,OAA4D,EACzB,EAAE;QACrC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,EAAE,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,WAAW;YACb,OAAO,SAAS,EAAE,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,GAAG,gBAAgB,CAAC,OAAO,CAAC;KAC7B,CAAC;AACJ,CAAC;AAMD,mEAAmE;AACnE,SAAS,gBAAgB,CACvB,OAA2B;IAE3B,OAAO;QACL,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CACzB,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,yBAAyB,EAAE,CAAC,cAAc,EAAE,EAAE,CAC5C,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,mBAAmB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACzE,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,gBAAgB,EAAE,CAAC,cAAc,EAAE,EAAE,CACnC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7D,0BAA0B,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CACpD,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,8BAA8B,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAC3D;QACH,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3E,yBAAyB,EAAE,CAAC,MAAM,EAAE,EAAE,CACpC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzE,sBAAsB,EAAE,CAAC,MAAM,EAAE,EAAE,CACjC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3D,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAC1B,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;KACrD,CAAC;AACJ,CAAC","sourcesContent":["import type { OrganizationDataUsageResponse } from \"@tearleads/validators/response\";\nimport {\n  liftRootIdentitySuspension,\n  listRootAuditEvents,\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOpsHealthReport,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootAuditApi,\n  type RootAuditEventsPage,\n  type RootAuditEventsQueryInput,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootIdentitiesApi,\n  type RootIdentitiesPage,\n  type RootIdentitiesQueryInput,\n  type RootIdentity,\n  type RootIdentityDetail,\n  type RootIdentityOrganization,\n  type RootOpsHealthApi,\n  type RootOpsHealthReport,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n  type RootRequestOutcome,\n  type RootSuspensionApi,\n  suspendRootIdentity,\n} from \"../../workflows/root\";\nimport type {\n  WorkflowRuntimeAuthInput,\n  WorkflowRuntimeCryptoInput,\n} from \"../../workflows/shared/runtimeInput\";\nimport type { InternalRuntime } from \"../runtime/workflowRuntime\";\nimport type { Session } from \"../session/sessionTypes\";\n\n/**\n * Platform-operator lookups. Every call is refused locally unless the session\n * is authenticated and the server reported it as root at login; the API still\n * enforces root access on its own, so this gate only avoids doomed requests.\n */\ntype RootApi = RootIdentitiesApi &\n  RootOrganizationsApi &\n  RootDataUsageApi &\n  RootOpsHealthApi &\n  RootAuditApi &\n  RootSuspensionApi;\n\nexport interface Root {\n  /** Recorded operator actions, newest first; each listing is recorded too. */\n  listAuditEvents(\n    query?: RootAuditEventsQueryInput,\n  ): Promise<RootRequestOutcome<RootAuditEventsPage>>;\n  loadOrganizationDataUsage(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<OrganizationDataUsageResponse>>;\n  listDataUsageReport(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootDataUsageReportPage>>;\n  /** Seat-sync, trial-expiry and purge trouble across every organization. */\n  loadOpsHealthReport(): Promise<RootRequestOutcome<RootOpsHealthReport>>;\n  listOrganizations(\n    query?: RootOrganizationsQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationsPage>>;\n  loadOrganization(\n    organizationId: string,\n  ): Promise<RootRequestOutcome<RootOrganizationDetail>>;\n  listOrganizationIdentities(\n    organizationId: string,\n    query?: RootOrganizationPageQueryInput,\n  ): Promise<RootRequestOutcome<RootOrganizationIdentitiesPage>>;\n  /** Whether the current session may use the root surface at all. */\n  readonly isAvailable: boolean;\n  listIdentities(\n    query?: RootIdentitiesQueryInput,\n  ): Promise<RootRequestOutcome<RootIdentitiesPage>>;\n  listIdentityOrganizations(\n    userId: string,\n  ): Promise<RootRequestOutcome<RootIdentityOrganization[]>>;\n  loadIdentity(userId: string): Promise<RootRequestOutcome<RootIdentityDetail>>;\n  /** Lets a suspended identity's devices sign in again. */\n  liftIdentitySuspension(\n    userId: string,\n  ): Promise<RootRequestOutcome<RootIdentity>>;\n  /**\n   * Signs the identity out of every device and refuses its sign-in until the\n   * suspension is lifted. The server refuses root identities. A session change\n   * mid-flight leaves the outcome unknown; reload the identity to see it.\n   */\n  suspendIdentity(userId: string): Promise<RootRequestOutcome<RootIdentity>>;\n}\n\n/**\n * What the facade needs from the runtime: change notifications, the current\n * auth snapshot, the signing identity (which can change or vanish without\n * touching the session), and the api client. Narrower than the full runtime\n * so tests can drive it with a fake.\n */\nexport interface RootRuntime {\n  /** The session's current auth token; a new one marks a fresh login. */\n  authToken(): string | null;\n  subscribe(listener: () => void): () => void;\n  workflowInput(): {\n    readonly apiClient: RootApi;\n    readonly auth: WorkflowRuntimeAuthInput;\n    readonly crypto: Pick<WorkflowRuntimeCryptoInput, \"signingFingerprint\">;\n  };\n}\n\n/** The SDK's internal runtime, narrowed to what the root facade observes. */\nexport function rootRuntimeOf(\n  runtime: Pick<InternalRuntime, \"publicRuntime\" | \"workflowInput\">,\n  session: Pick<Session, \"authToken\">,\n): RootRuntime {\n  return {\n    authToken: () => session.authToken,\n    subscribe: (listener) => runtime.publicRuntime.subscribe(listener),\n    workflowInput: () => runtime.workflowInput(),\n  };\n}\n\nconst NOT_AVAILABLE: RootRequestOutcome<never> = {\n  message: \"The current session is not a platform operator.\",\n  ok: false,\n  status: null,\n};\n\nconst SESSION_CHANGED: RootRequestOutcome<never> = {\n  message: \"The session changed while the request was in flight.\",\n  ok: false,\n  status: null,\n};\n\nexport function createRoot(runtimeService: RootRuntime): Root {\n  const principal = () => {\n    const runtime = runtimeService.workflowInput();\n    return {\n      fingerprint: runtime.crypto.signingFingerprint,\n      isAuthenticated: runtime.auth.isAuthenticated,\n      isRoot: runtime.auth.isRoot === true,\n      userId: runtime.auth.userId,\n    };\n  };\n\n  // Root standing belongs to the signing identity that authenticated, not to\n  // whichever key pair is loaded now. The fingerprint is bound whenever a\n  // login completes, which is observable as a new auth token carrying the\n  // server's verdict, or when the session first becomes root. A principal\n  // change without a new token (a key swap while the old token lingers)\n  // unbinds root until the next login. Every principal change is also\n  // counted as it happens, so a round trip such as logout then login, or a\n  // switch to another identity and back, is still two changes even though\n  // the endpoints match; a token renewal alone changes no principal, so a\n  // retried lookup is still returned.\n  let observed = principal();\n  let observedToken = runtimeService.authToken();\n  let boundFingerprint: string | null =\n    observed.isAuthenticated && observed.isRoot ? observed.fingerprint : null;\n  let lifecycle = 0;\n  runtimeService.subscribe(() => {\n    const next = principal();\n    const token = runtimeService.authToken();\n    const freshToken = token !== null && token !== observedToken;\n    const wasRoot = observed.isAuthenticated && observed.isRoot;\n    const isRootNow = next.isAuthenticated && next.isRoot;\n    const changed =\n      next.fingerprint !== observed.fingerprint ||\n      next.isAuthenticated !== observed.isAuthenticated ||\n      next.isRoot !== observed.isRoot ||\n      next.userId !== observed.userId;\n    if (changed) {\n      lifecycle += 1;\n    }\n    if (!isRootNow) {\n      boundFingerprint = null;\n    } else if (freshToken || !wasRoot) {\n      boundFingerprint = next.fingerprint;\n    } else if (changed) {\n      boundFingerprint = null;\n    }\n    observed = next;\n    observedToken = token;\n  });\n\n  const activeApi = (): RootApi | null => {\n    const runtime = runtimeService.workflowInput();\n    return runtime.auth.isAuthenticated &&\n      runtime.auth.isRoot === true &&\n      boundFingerprint !== null &&\n      runtime.crypto.signingFingerprint === boundFingerprint\n      ? runtime.apiClient\n      : null;\n  };\n\n  const guarded = async <Data>(\n    request: (api: RootApi) => Promise<RootRequestOutcome<Data>>,\n  ): Promise<RootRequestOutcome<Data>> => {\n    const api = activeApi();\n    if (!api) {\n      return NOT_AVAILABLE;\n    }\n    const startedIn = lifecycle;\n    const outcome = await request(api);\n    if (activeApi() === null || lifecycle !== startedIn) {\n      return SESSION_CHANGED;\n    }\n    return outcome;\n  };\n\n  return {\n    get isAvailable() {\n      return activeApi() !== null;\n    },\n    ...guardedRootCalls(guarded),\n  };\n}\n\ntype GuardedRootRequest = <Data>(\n  request: (api: RootApi) => Promise<RootRequestOutcome<Data>>,\n) => Promise<RootRequestOutcome<Data>>;\n\n/** Every facade call, each run through the session's root gate. */\nfunction guardedRootCalls(\n  guarded: GuardedRootRequest,\n): Omit<Root, \"isAvailable\"> {\n  return {\n    listAuditEvents: (query) =>\n      guarded((api) => listRootAuditEvents(api, query)),\n    loadOrganizationDataUsage: (organizationId) =>\n      guarded((api) => loadRootOrganizationDataUsage(api, organizationId)),\n    listDataUsageReport: (query) =>\n      guarded((api) => listRootDataUsageReport(api, query)),\n    loadOpsHealthReport: () => guarded((api) => loadRootOpsHealthReport(api)),\n    listOrganizations: (query) =>\n      guarded((api) => listRootOrganizations(api, query)),\n    loadOrganization: (organizationId) =>\n      guarded((api) => loadRootOrganization(api, organizationId)),\n    listOrganizationIdentities: (organizationId, query) =>\n      guarded((api) =>\n        listRootOrganizationIdentities(api, organizationId, query),\n      ),\n    listIdentities: (query) => guarded((api) => listRootIdentities(api, query)),\n    listIdentityOrganizations: (userId) =>\n      guarded((api) => listRootIdentityOrganizations(api, userId)),\n    loadIdentity: (userId) => guarded((api) => loadRootIdentity(api, userId)),\n    liftIdentitySuspension: (userId) =>\n      guarded((api) => liftRootIdentitySuspension(api, userId)),\n    suspendIdentity: (userId) =>\n      guarded((api) => suspendRootIdentity(api, userId)),\n  };\n}\n"]}

package/client/session/index.js

@@ -4,7 +4,7 @@ import { createListenerSet } from "../runtime/listenerSet.js";
 import { emptySessionSnapshot, mergeSessionContext, sessionSnapshotsEqual, } from "./sessionContext.js";
 import { registrationKeyAlreadyBound, requireRegistrationIdentityPinner, requireUserIdentityAvailable, SessionIdentityAcknowledgments, } from "./sessionIdentityTrust.js";
 import { userSessionsFromResponse } from "./sessionListing.js";
-import { refuseSessionLogin } from "./sessionLoginRefusal.js";
+import { authenticateUnlessSuspended, refuseSessionLogin, } from "./sessionLoginRefusal.js";
 import { createSessionOrganization } from "./sessionOrganizationCreation.js";
 import { clearSessionRemoteSyncState, recoverPurgedSessionOrganization, } from "./sessionPurgeRecovery.js";
 import { acknowledgedSessionRoot, commitSessionRootAcknowledgment, } from "./sessionRootAuthority.js";
@@ -93,9 +93,12 @@ class SessionService {
         }
         const pinLocalUserIdentity = requireUserIdentityAvailable(this.dependencies.onUserIdentityAvailable, "Login");
         this.dependencies.log(challengeHex ? "Authenticating with challenge..." : "Authenticating...");
-        const authentication = challengeHex
-            ? await this.dependencies.api.authenticateWithChallenge(fingerprint, signingKeyPair.signingPrivateKey, challengeHex)
-            : await this.dependencies.api.authenticate(fingerprint, signingKeyPair.signingPrivateKey);
+        const authentication = await authenticateUnlessSuspended(() => challengeHex
+            ? this.dependencies.api.authenticateWithChallenge(fingerprint, signingKeyPair.signingPrivateKey, challengeHex)
+            : this.dependencies.api.authenticate(fingerprint, signingKeyPair.signingPrivateKey), () => {
+            if (this.authToken === snapshotAtStart.authToken)
+                this.logout();
+        });
         if (this.dependencies.identity.snapshot !== identitySnapshot) {
             return false;
         }

package/client/session/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kDAAkD,EAAE,MAAM,+DAA+D,CAAC;AACnI,OAAO,EACL,sBAAsB,EACtB,gBAAgB,IAAI,wBAAwB,GAC7C,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAgBhC,MAAM,UAAU,aAAa,CAAC,YAAiC;IAC7D,OAAO,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,cAAc;IAOW;IANZ,uBAAuB,GACtC,IAAI,8BAA8B,EAAE,CAAC;IACtB,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACzC,gBAAgB,GAAG,IAAI,CAAC;IACxB,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE/C,YAA6B,YAAiC;QAAjC,iBAAY,GAAZ,YAAY,CAAqB;IAAG,CAAC;IAElE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACtC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;IACxC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC;IAClD,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;IAC5C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,IAAI,CAAC,aAAa,CAAC,MAAM,EACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,2BAA2B;QAI/B,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,EACJ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;QACF,IAAI,IAAI,CAAC,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,6BAA6B,CAAC,CACzE,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,wBAAwB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,cAAsB;QAEtB,OAAO,2BAA2B,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACvE,OAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAiC;QAC3C,MAAM,cAAc,GAClB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,WAAW,GACf,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,IAAI,CAAC;QAEzE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;QAC3C,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,gBAAgB,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,oBAAoB,GAAG,4BAA4B,CACvD,IAAI,CAAC,YAAY,CAAC,uBAAuB,EACzC,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,YAAY,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,mBAAmB,CACxE,CAAC;QACF,MAAM,cAAc,GAAG,YAAY;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,yBAAyB,CACnD,WAAW,EACX,cAAc,CAAC,iBAAiB,EAChC,YAAY,CACb;YACH,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CACtC,WAAW,EACX,cAAc,CAAC,iBAAiB,CACjC,CAAC;QAEN,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,uBAAuB,CAAC,aAAa,CACxC,cAAc,CAAC,MAAM,EACrB,WAAW,CACZ,CAAC;YACF,MAAM,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE;gBAChD,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;gBACtD,qBAAqB,EAAE,WAAW;gBAClC,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;aAClD,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;gBAC1D,OAAO,KAAK,CAAC;YACf,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;aACjD,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE;gBACP,SAAS,EAAE,cAAc,CAAC,KAAK;gBAC/B,qBAAqB,EAAE,cAAc,CAAC,cAAc;gBACpD,eAAe,EAAE,IAAI;gBACrB,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,MAAM,EAAE,cAAc,CAAC,MAAM;aAC9B;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,IAAI,IAAI,CAAC,aAAa,KAAK,eAAe;oBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC;YACD,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,WAAW;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACtD,OAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,OAAiC;QAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,mDAAmD,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACvD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,wDAAwD,CACzD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,sDAAsD,CACvD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;YAC7D,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;YACpC,gBAAgB;YAChB,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB;SACnE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,YAAY,EACjB,gBAAgB,CAAC,kBAAkB,CACpC,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,IAAI,QAA8D,CAAC;QACnE,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,wBAAwB,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;gBAChC,WAAW;gBACX,QAAQ;gBACR,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,kBAAkB;gBACxD,oBAAoB;gBACpB,iBAAiB,EAAE,GAAG,EAAE,CACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;gBAC1D,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;gBAC1B,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;gBACpC,uBAAuB,EAAE,OAAO,EAAE,uBAAuB;gBACzD,oBAAoB;gBACpB,qBAAqB,EACnB,IAAI,CAAC,YAAY,CAAC,gCAAgC;gBACpD,2BAA2B,EACzB,IAAI,CAAC,YAAY,CAAC,2BAA2B;gBAC/C,qBAAqB,EAAE,OAAO,EAAE,qBAAqB;gBACrD,qBAAqB,EAAE,gBAAgB,CAAC,kBAAkB;gBAC1D,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE;gBACP,WAAW,EAAE,QAAQ,CAAC,eAAe;gBACrC,qBAAqB,EAAE,QAAQ,CAAC,cAAc;gBAC9C,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB;YACD,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;SACxD,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW,EAAE,QAAQ,CAAC,eAAe;YACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAmC,EACnC,sBAA+B,EAC/B,yBAAmC;QAEnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,YAAY,EAAE;YAClE,yBAAyB;YACzB,OAAO;YACP,sBAAsB;YACtB,MAAM;SACP,CAAC,CAAC;QACH,IACE,CAAC,QAAQ;YACT,CAAC,MAAM;YACP,IAAI,CAAC,MAAM,KAAK,MAAM;YACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAExD,OAAO,IAAI,CAAC;QACd,MAAM,+BAA+B,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE;gBACJ,MAAM;gBACN,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,eAAe,EAAE,QAAQ,CAAC,WAAW;aACtC;YACD,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;SACxD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4CAA4C,CAC1C,OAAmC;QAEnC,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,6CAA6C,CACjD,cAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,kDAAkD,CAAC;YACxD,SAAS,EAAE,GAAG,EAAE,CACd,IAAI,CAAC,MAAM,KAAK,MAAM;gBACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAC1D,QAAQ;YACR,cAAc;YACd,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,cAAsB,EACtB,OAAmC;QAEnC,OAAO,gCAAgC,CACrC,IAAI,CAAC,YAAY,EACjB,IAAI,EACJ,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,SAAwB;QACnC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,cAAc,CAAC,WAA0B;QACvC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,UAAU,CAAC,OAAuB;QAChC,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAChD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CACnC,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,WAAW,CACd,mBAAmB,CACjB,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CACF,CAAC;QACF,4EAA4E;QAC5E,wEAAwE;QACxE,IACE,IAAI,CAAC,aAAa,KAAK,QAAQ;YAC/B,eAAe,KAAK,IAAI,CAAC,kBAAkB,EAC3C,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,cAA6B;QAC7C,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc,CAAC,OAAgB;QAC7B,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,MAAqB;QAC7B,IAAI,CAAC,WAAW,CACd,mBAAmB,CACjB,IAAI,CAAC,aAAa,EAClB,EAAE,MAAM,EAAE,EACV,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CACF,CAAC;IACJ,CAAC;IAED,SAAS,GAAG,CAAC,QAAyB,EAAgB,EAAE,CACtD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE7B,WAAW,CAAC,IAAqB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF","sourcesContent":["import { removeNativeSubscriptionRestoreProvisioningAttempt } from \"../../workflows/organizations/provisioning/createOrganization\";\nimport {\n  bootstrapRootContainer,\n  registerIdentity as registerIdentityWorkflow,\n} from \"../../workflows/registration\";\nimport type { ClearRemoteSyncStateResult } from \"../../workflows/sync\";\nimport { createListenerSet } from \"../runtime/listenerSet\";\nimport {\n  emptySessionSnapshot,\n  mergeSessionContext,\n  sessionSnapshotsEqual,\n} from \"./sessionContext\";\nimport {\n  registrationKeyAlreadyBound,\n  requireRegistrationIdentityPinner,\n  requireUserIdentityAvailable,\n  SessionIdentityAcknowledgments,\n} from \"./sessionIdentityTrust\";\nimport { userSessionsFromResponse } from \"./sessionListing\";\nimport { refuseSessionLogin } from \"./sessionLoginRefusal\";\nimport { createSessionOrganization } from \"./sessionOrganizationCreation\";\nimport {\n  clearSessionRemoteSyncState,\n  recoverPurgedSessionOrganization,\n} from \"./sessionPurgeRecovery\";\nimport {\n  acknowledgedSessionRoot,\n  commitSessionRootAcknowledgment,\n} from \"./sessionRootAuthority\";\nimport type {\n  CreateOrganizationOptions,\n  RegisterIdentityOptions,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionDependencies,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  UserSession,\n} from \"./sessionTypes\";\n\nexport function createSession(dependencies: SessionDependencies): Session {\n  return new SessionService(dependencies);\n}\n\nclass SessionService implements Session {\n  private readonly identityAcknowledgments =\n    new SessionIdentityAcknowledgments();\n  private readonly listeners = createListenerSet();\n  private syncEnabledValue = true;\n  private snapshotValue = emptySessionSnapshot();\n\n  constructor(private readonly dependencies: SessionDependencies) {}\n\n  get authToken(): string | null {\n    return this.snapshotValue.authToken;\n  }\n\n  get containerId(): string | null {\n    return this.snapshotValue.containerId;\n  }\n\n  get defaultOrganizationId(): string | null {\n    return this.snapshotValue.defaultOrganizationId;\n  }\n\n  get isAuthenticated(): boolean {\n    return this.snapshotValue.isAuthenticated;\n  }\n\n  get isRoot(): boolean {\n    return this.snapshotValue.isRoot;\n  }\n\n  get organizationId(): string | null {\n    return this.snapshotValue.organizationId;\n  }\n\n  get snapshot(): SessionSnapshot {\n    return this.snapshotValue;\n  }\n\n  get syncEnabled(): boolean {\n    return this.syncEnabledValue;\n  }\n\n  get userId(): string | null {\n    return this.snapshotValue.userId;\n  }\n\n  get userIdAcknowledged(): boolean {\n    return this.identityAcknowledgments.isAcknowledged(\n      this.snapshotValue.userId,\n      this.dependencies.identity.snapshot.signingFingerprint,\n    );\n  }\n\n  async bootstrapLocalRootContainer(): Promise<{\n    containerId: string;\n    created: boolean;\n  }> {\n    // Recovery can request local bootstrap after login. Preserve the root\n    // acknowledged by that session instead of replacing it with a local id.\n    const acknowledgedRoot = acknowledgedSessionRoot(\n      this,\n      this.dependencies.identity.snapshot.signingFingerprint,\n    );\n    if (this.isAuthenticated && acknowledgedRoot) {\n      return { containerId: acknowledgedRoot, created: false };\n    }\n    const result = await bootstrapRootContainer(\n      this.dependencies.database.requireExecSql(\"bootstrapLocalRootContainer\"),\n    );\n    this.setContainerId(result.containerId);\n    if (result.created) {\n      this.dependencies.log(\"Root container created\");\n    }\n    return result;\n  }\n\n  async listSessions(): Promise<UserSession[]> {\n    return userSessionsFromResponse(await this.dependencies.api.listSessions());\n  }\n\n  async clearRemoteSyncState(\n    organizationId: string,\n  ): Promise<ClearRemoteSyncStateResult> {\n    return clearSessionRemoteSyncState(this.dependencies, this, organizationId);\n  }\n\n  async destroySession(sessionId: string): Promise<boolean> {\n    const response = await this.dependencies.api.destroySession(sessionId);\n    return response?.message === \"ok\";\n  }\n\n  async login(challengeHex?: string | undefined): Promise<boolean> {\n    const signingKeyPair =\n      this.dependencies.identity.requireSigningKeyPair(\"login\");\n    const fingerprint =\n      (await this.dependencies.identity.refreshSigningFingerprint()) ?? null;\n\n    if (!fingerprint) {\n      return false;\n    }\n    // A refusal below clears the session it is evidence against; a session\n    // another login committed meanwhile is not that session and stays.\n    const snapshotAtStart = this.snapshotValue;\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;\n    if (!encapsulationKeyPair) {\n      return false;\n    }\n    if (identitySnapshot.signingKeyPair !== signingKeyPair) {\n      return false;\n    }\n    const pinLocalUserIdentity = requireUserIdentityAvailable(\n      this.dependencies.onUserIdentityAvailable,\n      \"Login\",\n    );\n\n    this.dependencies.log(\n      challengeHex ? \"Authenticating with challenge...\" : \"Authenticating...\",\n    );\n    const authentication = challengeHex\n      ? await this.dependencies.api.authenticateWithChallenge(\n          fingerprint,\n          signingKeyPair.signingPrivateKey,\n          challengeHex,\n        )\n      : await this.dependencies.api.authenticate(\n          fingerprint,\n          signingKeyPair.signingPrivateKey,\n        );\n\n    if (this.dependencies.identity.snapshot !== identitySnapshot) {\n      return false;\n    }\n\n    if (!authentication) {\n      this.logout();\n      this.dependencies.log(\"Authentication failed\");\n      return false;\n    }\n\n    try {\n      this.identityAcknowledgments.assertMatches(\n        authentication.userId,\n        fingerprint,\n      );\n      await pinLocalUserIdentity(authentication.userId, {\n        encapsulationPublicKey: encapsulationKeyPair.publicKey,\n        signingKeyFingerprint: fingerprint,\n        signingPublicKey: signingKeyPair.signingPublicKey,\n      });\n      if (this.dependencies.identity.snapshot !== identitySnapshot)\n        return false;\n      this.identityAcknowledgments.remember(authentication.userId, fingerprint);\n    } catch (error) {\n      return refuseSessionLogin(error, authentication.userId, {\n        clear: () => this.logout(),\n        report: this.dependencies.reportSecurityIncident,\n      });\n    }\n    // A changed root for this identity+org is refused before the token is\n    // usable. Decision and commit are one synchronous step against the live\n    // snapshot (no await in between); the refusal clears the prior session in\n    // that same step and then reports its own incident.\n    await commitSessionRootAcknowledgment({\n      context: {\n        authToken: authentication.token,\n        defaultOrganizationId: authentication.organizationId,\n        isAuthenticated: true,\n        isRoot: authentication.isRoot,\n        organizationId: authentication.organizationId,\n        userId: authentication.userId,\n      },\n      onRefused: () => {\n        if (this.snapshotValue === snapshotAtStart) this.logout();\n      },\n      reporter: this.dependencies.reportSecurityIncident,\n      root: authentication,\n      session: this,\n      signingFingerprint: fingerprint,\n    });\n    this.dependencies.log(\"Authentication successful\");\n    return true;\n  }\n\n  logout(): void {\n    this.setContext({ authToken: null, isAuthenticated: false, isRoot: false });\n  }\n\n  async logoutRemote(): Promise<boolean> {\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    try {\n      if (!this.authToken) {\n        return true;\n      }\n\n      const response = await this.dependencies.api.logout();\n      return response?.message === \"ok\";\n    } finally {\n      if (this.dependencies.identity.snapshot === identitySnapshot) {\n        this.logout();\n      }\n    }\n  }\n\n  async registerIdentity(\n    options?: RegisterIdentityOptions,\n  ): Promise<SessionRegistrationResult | SessionRegistrationRefusal | null> {\n    const containerId = this.containerId;\n    if (!containerId) {\n      this.dependencies.log(\n        \"Registration skipped: container id is unavailable\",\n      );\n      return null;\n    }\n\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    const signingKeyPair = identitySnapshot.signingKeyPair;\n    if (!signingKeyPair) {\n      this.dependencies.log(\"Registration skipped: signing key is unavailable\");\n      return null;\n    }\n\n    const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;\n    if (!encapsulationKeyPair) {\n      this.dependencies.log(\n        \"Registration skipped: encapsulation key is unavailable\",\n      );\n      return null;\n    }\n\n    const dbClient = this.dependencies.database.client;\n    if (!dbClient) {\n      this.dependencies.log(\n        \"Registration skipped: database client is unavailable\",\n      );\n      return null;\n    }\n    const pinLocalUserIdentity = requireRegistrationIdentityPinner({\n      identity: this.dependencies.identity,\n      identitySnapshot,\n      onUserIdentityAvailable: this.dependencies.onUserIdentityAvailable,\n    });\n    const keyBound = await registrationKeyAlreadyBound(\n      this.dependencies,\n      identitySnapshot.signingFingerprint,\n    );\n    if (this.dependencies.identity.snapshot !== identitySnapshot) return null;\n    if (keyBound) return keyBound;\n\n    let response: Awaited<ReturnType<typeof registerIdentityWorkflow>>;\n    try {\n      response = await registerIdentityWorkflow({\n        apiClient: this.dependencies.api,\n        containerId,\n        dbClient,\n        documentProjectors: this.dependencies.documentProjectors,\n        encapsulationKeyPair,\n        isIdentityCurrent: () =>\n          this.dependencies.identity.snapshot === identitySnapshot,\n        log: this.dependencies.log,\n        logError: this.dependencies.logError,\n        organizationProfileName: options?.organizationProfileName,\n        pinLocalUserIdentity,\n        primePrincipalHistory:\n          this.dependencies.primeProvisionedPrincipalHistory,\n        provisionedSystemContainers:\n          this.dependencies.provisionedSystemContainers,\n        rosterProfileNickname: options?.rosterProfileNickname,\n        signingKeyFingerprint: identitySnapshot.signingFingerprint,\n        signingKeyPair,\n      });\n    } catch (error: unknown) {\n      this.dependencies.logError(\"Identity registration failed\", error);\n      throw error;\n    }\n\n    if (this.dependencies.identity.snapshot !== identitySnapshot) return null;\n    if (!response) {\n      this.dependencies.log(\"Registration failed\");\n      return null;\n    }\n\n    // The workflow pinned `response.userId` once the server confirmed it,\n    // under the same currency check as above.\n    await commitSessionRootAcknowledgment({\n      context: {\n        containerId: response.rootContainerId,\n        defaultOrganizationId: response.organizationId,\n        organizationId: response.organizationId,\n        userId: response.userId,\n      },\n      reporter: this.dependencies.reportSecurityIncident,\n      root: response,\n      session: this,\n      signingFingerprint: identitySnapshot.signingFingerprint,\n    });\n\n    return {\n      challenge: response.challenge,\n      containerId: response.rootContainerId,\n      organizationId: response.organizationId,\n      userId: response.userId,\n    };\n  }\n\n  async createOrganization(\n    options?: CreateOrganizationOptions,\n    replacesOrganizationId?: string,\n    nativeSubscriptionRestore?: boolean,\n  ): Promise<SessionCreateOrganizationResult | null> {\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    const userId = this.userId;\n    const response = await createSessionOrganization(this.dependencies, {\n      nativeSubscriptionRestore,\n      options,\n      replacesOrganizationId,\n      userId,\n    });\n    if (\n      !response ||\n      !userId ||\n      this.userId !== userId ||\n      this.dependencies.identity.snapshot !== identitySnapshot\n    )\n      return null;\n    await commitSessionRootAcknowledgment({\n      reporter: this.dependencies.reportSecurityIncident,\n      root: {\n        userId,\n        organizationId: response.organizationId,\n        rootContainerId: response.containerId,\n      },\n      session: this,\n      signingFingerprint: identitySnapshot.signingFingerprint,\n    });\n    return response;\n  }\n\n  prepareNativeSubscriptionRestoreOrganization(\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionCreateOrganizationResult | null> {\n    return this.createOrganization(options, undefined, true);\n  }\n\n  async completeNativeSubscriptionRestoreOrganization(\n    organizationId: string,\n  ): Promise<boolean> {\n    const userId = this.userId;\n    const dbClient = this.dependencies.database.client;\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    if (!userId || !dbClient) return false;\n    return removeNativeSubscriptionRestoreProvisioningAttempt({\n      canCommit: () =>\n        this.userId === userId &&\n        this.dependencies.identity.snapshot === identitySnapshot,\n      dbClient,\n      organizationId,\n      userId,\n    });\n  }\n\n  async recoverPurgedOrganization(\n    organizationId: string,\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionRecoverOrganizationResult | null> {\n    return recoverPurgedSessionOrganization(\n      this.dependencies,\n      this,\n      organizationId,\n      options,\n    );\n  }\n\n  setAuthToken(authToken: string | null): void {\n    this.setSnapshot({ ...this.snapshotValue, authToken });\n  }\n\n  setContainerId(containerId: string | null): void {\n    this.setSnapshot({ ...this.snapshotValue, containerId });\n  }\n\n  setContext(context: SessionContext): void {\n    const wasAcknowledged = this.userIdAcknowledged;\n    this.identityAcknowledgments.remember(\n      context.userId,\n      this.dependencies.identity.snapshot.signingFingerprint,\n    );\n    const previous = this.snapshotValue;\n    this.setSnapshot(\n      mergeSessionContext(\n        previous,\n        context,\n        this.dependencies.identity.snapshot.signingFingerprint,\n      ),\n    );\n    // Acknowledging an already-held userId changes `userIdAcknowledged` without\n    // changing the snapshot; persistence subscribers must still observe it.\n    if (\n      this.snapshotValue === previous &&\n      wasAcknowledged !== this.userIdAcknowledged\n    ) {\n      this.listeners.notify();\n    }\n  }\n\n  setOrganizationId(organizationId: string | null): void {\n    this.setSnapshot({ ...this.snapshotValue, organizationId });\n  }\n\n  setSyncEnabled(enabled: boolean): void {\n    if (this.syncEnabledValue === enabled) {\n      return;\n    }\n    this.syncEnabledValue = enabled;\n    this.listeners.notify();\n  }\n\n  setUserId(userId: string | null): void {\n    this.setSnapshot(\n      mergeSessionContext(\n        this.snapshotValue,\n        { userId },\n        this.dependencies.identity.snapshot.signingFingerprint,\n      ),\n    );\n  }\n\n  subscribe = (listener: SessionListener): (() => void) =>\n    this.listeners.subscribe(listener);\n\n  private setSnapshot(next: SessionSnapshot): void {\n    const previous = this.snapshotValue;\n    if (previous.authToken !== next.authToken) {\n      this.dependencies.api.setAuthToken(next.authToken);\n    }\n\n    if (sessionSnapshotsEqual(previous, next)) {\n      return;\n    }\n\n    this.snapshotValue = next;\n    this.listeners.notify();\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kDAAkD,EAAE,MAAM,+DAA+D,CAAC;AACnI,OAAO,EACL,sBAAsB,EACtB,gBAAgB,IAAI,wBAAwB,GAC7C,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAgBhC,MAAM,UAAU,aAAa,CAAC,YAAiC;IAC7D,OAAO,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,cAAc;IAOW;IANZ,uBAAuB,GACtC,IAAI,8BAA8B,EAAE,CAAC;IACtB,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACzC,gBAAgB,GAAG,IAAI,CAAC;IACxB,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE/C,YAA6B,YAAiC;QAAjC,iBAAY,GAAZ,YAAY,CAAqB;IAAG,CAAC;IAElE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACtC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;IACxC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC;IAClD,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;IAC5C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,IAAI,CAAC,aAAa,CAAC,MAAM,EACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,2BAA2B;QAI/B,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,EACJ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;QACF,IAAI,IAAI,CAAC,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,6BAA6B,CAAC,CACzE,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,wBAAwB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,cAAsB;QAEtB,OAAO,2BAA2B,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACvE,OAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAiC;QAC3C,MAAM,cAAc,GAClB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,WAAW,GACf,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,IAAI,CAAC;QAEzE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;QAC3C,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,gBAAgB,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,oBAAoB,GAAG,4BAA4B,CACvD,IAAI,CAAC,YAAY,CAAC,uBAAuB,EACzC,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,YAAY,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,mBAAmB,CACxE,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,2BAA2B,CACtD,GAAG,EAAE,CACH,YAAY;YACV,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,yBAAyB,CAC7C,WAAW,EACX,cAAc,CAAC,iBAAiB,EAChC,YAAY,CACb;YACH,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAChC,WAAW,EACX,cAAc,CAAC,iBAAiB,CACjC,EACP,GAAG,EAAE;YACH,IAAI,IAAI,CAAC,SAAS,KAAK,eAAe,CAAC,SAAS;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAClE,CAAC,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,uBAAuB,CAAC,aAAa,CACxC,cAAc,CAAC,MAAM,EACrB,WAAW,CACZ,CAAC;YACF,MAAM,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE;gBAChD,sBAAsB,EAAE,oBAAoB,CAAC,SAAS;gBACtD,qBAAqB,EAAE,WAAW;gBAClC,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;aAClD,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;gBAC1D,OAAO,KAAK,CAAC;YACf,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;aACjD,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE;gBACP,SAAS,EAAE,cAAc,CAAC,KAAK;gBAC/B,qBAAqB,EAAE,cAAc,CAAC,cAAc;gBACpD,eAAe,EAAE,IAAI;gBACrB,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,MAAM,EAAE,cAAc,CAAC,MAAM;aAC9B;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,IAAI,IAAI,CAAC,aAAa,KAAK,eAAe;oBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC;YACD,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,WAAW;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACtD,OAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,OAAiC;QAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,mDAAmD,CACpD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACvD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,wDAAwD,CACzD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,sDAAsD,CACvD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;YAC7D,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;YACpC,gBAAgB;YAChB,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB;SACnE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,YAAY,EACjB,gBAAgB,CAAC,kBAAkB,CACpC,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,IAAI,QAA8D,CAAC;QACnE,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,wBAAwB,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;gBAChC,WAAW;gBACX,QAAQ;gBACR,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,kBAAkB;gBACxD,oBAAoB;gBACpB,iBAAiB,EAAE,GAAG,EAAE,CACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;gBAC1D,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;gBAC1B,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;gBACpC,uBAAuB,EAAE,OAAO,EAAE,uBAAuB;gBACzD,oBAAoB;gBACpB,qBAAqB,EACnB,IAAI,CAAC,YAAY,CAAC,gCAAgC;gBACpD,2BAA2B,EACzB,IAAI,CAAC,YAAY,CAAC,2BAA2B;gBAC/C,qBAAqB,EAAE,OAAO,EAAE,qBAAqB;gBACrD,qBAAqB,EAAE,gBAAgB,CAAC,kBAAkB;gBAC1D,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE;gBACP,WAAW,EAAE,QAAQ,CAAC,eAAe;gBACrC,qBAAqB,EAAE,QAAQ,CAAC,cAAc;gBAC9C,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB;YACD,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;SACxD,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW,EAAE,QAAQ,CAAC,eAAe;YACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAmC,EACnC,sBAA+B,EAC/B,yBAAmC;QAEnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,YAAY,EAAE;YAClE,yBAAyB;YACzB,OAAO;YACP,sBAAsB;YACtB,MAAM;SACP,CAAC,CAAC;QACH,IACE,CAAC,QAAQ;YACT,CAAC,MAAM;YACP,IAAI,CAAC,MAAM,KAAK,MAAM;YACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAExD,OAAO,IAAI,CAAC;QACd,MAAM,+BAA+B,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,sBAAsB;YAClD,IAAI,EAAE;gBACJ,MAAM;gBACN,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,eAAe,EAAE,QAAQ,CAAC,WAAW;aACtC;YACD,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;SACxD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4CAA4C,CAC1C,OAAmC;QAEnC,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,6CAA6C,CACjD,cAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,kDAAkD,CAAC;YACxD,SAAS,EAAE,GAAG,EAAE,CACd,IAAI,CAAC,MAAM,KAAK,MAAM;gBACtB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAK,gBAAgB;YAC1D,QAAQ;YACR,cAAc;YACd,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,cAAsB,EACtB,OAAmC;QAEnC,OAAO,gCAAgC,CACrC,IAAI,CAAC,YAAY,EACjB,IAAI,EACJ,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,SAAwB;QACnC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,cAAc,CAAC,WAA0B;QACvC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,UAAU,CAAC,OAAuB;QAChC,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAChD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CACnC,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,WAAW,CACd,mBAAmB,CACjB,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CACF,CAAC;QACF,4EAA4E;QAC5E,wEAAwE;QACxE,IACE,IAAI,CAAC,aAAa,KAAK,QAAQ;YAC/B,eAAe,KAAK,IAAI,CAAC,kBAAkB,EAC3C,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,cAA6B;QAC7C,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc,CAAC,OAAgB;QAC7B,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,MAAqB;QAC7B,IAAI,CAAC,WAAW,CACd,mBAAmB,CACjB,IAAI,CAAC,aAAa,EAClB,EAAE,MAAM,EAAE,EACV,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CACvD,CACF,CAAC;IACJ,CAAC;IAED,SAAS,GAAG,CAAC,QAAyB,EAAgB,EAAE,CACtD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE7B,WAAW,CAAC,IAAqB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF","sourcesContent":["import { removeNativeSubscriptionRestoreProvisioningAttempt } from \"../../workflows/organizations/provisioning/createOrganization\";\nimport {\n  bootstrapRootContainer,\n  registerIdentity as registerIdentityWorkflow,\n} from \"../../workflows/registration\";\nimport type { ClearRemoteSyncStateResult } from \"../../workflows/sync\";\nimport { createListenerSet } from \"../runtime/listenerSet\";\nimport {\n  emptySessionSnapshot,\n  mergeSessionContext,\n  sessionSnapshotsEqual,\n} from \"./sessionContext\";\nimport {\n  registrationKeyAlreadyBound,\n  requireRegistrationIdentityPinner,\n  requireUserIdentityAvailable,\n  SessionIdentityAcknowledgments,\n} from \"./sessionIdentityTrust\";\nimport { userSessionsFromResponse } from \"./sessionListing\";\nimport {\n  authenticateUnlessSuspended,\n  refuseSessionLogin,\n} from \"./sessionLoginRefusal\";\nimport { createSessionOrganization } from \"./sessionOrganizationCreation\";\nimport {\n  clearSessionRemoteSyncState,\n  recoverPurgedSessionOrganization,\n} from \"./sessionPurgeRecovery\";\nimport {\n  acknowledgedSessionRoot,\n  commitSessionRootAcknowledgment,\n} from \"./sessionRootAuthority\";\nimport type {\n  CreateOrganizationOptions,\n  RegisterIdentityOptions,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionDependencies,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  UserSession,\n} from \"./sessionTypes\";\n\nexport function createSession(dependencies: SessionDependencies): Session {\n  return new SessionService(dependencies);\n}\n\nclass SessionService implements Session {\n  private readonly identityAcknowledgments =\n    new SessionIdentityAcknowledgments();\n  private readonly listeners = createListenerSet();\n  private syncEnabledValue = true;\n  private snapshotValue = emptySessionSnapshot();\n\n  constructor(private readonly dependencies: SessionDependencies) {}\n\n  get authToken(): string | null {\n    return this.snapshotValue.authToken;\n  }\n\n  get containerId(): string | null {\n    return this.snapshotValue.containerId;\n  }\n\n  get defaultOrganizationId(): string | null {\n    return this.snapshotValue.defaultOrganizationId;\n  }\n\n  get isAuthenticated(): boolean {\n    return this.snapshotValue.isAuthenticated;\n  }\n\n  get isRoot(): boolean {\n    return this.snapshotValue.isRoot;\n  }\n\n  get organizationId(): string | null {\n    return this.snapshotValue.organizationId;\n  }\n\n  get snapshot(): SessionSnapshot {\n    return this.snapshotValue;\n  }\n\n  get syncEnabled(): boolean {\n    return this.syncEnabledValue;\n  }\n\n  get userId(): string | null {\n    return this.snapshotValue.userId;\n  }\n\n  get userIdAcknowledged(): boolean {\n    return this.identityAcknowledgments.isAcknowledged(\n      this.snapshotValue.userId,\n      this.dependencies.identity.snapshot.signingFingerprint,\n    );\n  }\n\n  async bootstrapLocalRootContainer(): Promise<{\n    containerId: string;\n    created: boolean;\n  }> {\n    // Recovery can request local bootstrap after login. Preserve the root\n    // acknowledged by that session instead of replacing it with a local id.\n    const acknowledgedRoot = acknowledgedSessionRoot(\n      this,\n      this.dependencies.identity.snapshot.signingFingerprint,\n    );\n    if (this.isAuthenticated && acknowledgedRoot) {\n      return { containerId: acknowledgedRoot, created: false };\n    }\n    const result = await bootstrapRootContainer(\n      this.dependencies.database.requireExecSql(\"bootstrapLocalRootContainer\"),\n    );\n    this.setContainerId(result.containerId);\n    if (result.created) {\n      this.dependencies.log(\"Root container created\");\n    }\n    return result;\n  }\n\n  async listSessions(): Promise<UserSession[]> {\n    return userSessionsFromResponse(await this.dependencies.api.listSessions());\n  }\n\n  async clearRemoteSyncState(\n    organizationId: string,\n  ): Promise<ClearRemoteSyncStateResult> {\n    return clearSessionRemoteSyncState(this.dependencies, this, organizationId);\n  }\n\n  async destroySession(sessionId: string): Promise<boolean> {\n    const response = await this.dependencies.api.destroySession(sessionId);\n    return response?.message === \"ok\";\n  }\n\n  async login(challengeHex?: string | undefined): Promise<boolean> {\n    const signingKeyPair =\n      this.dependencies.identity.requireSigningKeyPair(\"login\");\n    const fingerprint =\n      (await this.dependencies.identity.refreshSigningFingerprint()) ?? null;\n\n    if (!fingerprint) {\n      return false;\n    }\n    // A refusal below clears the session it is evidence against; a session\n    // another login committed meanwhile is not that session and stays.\n    const snapshotAtStart = this.snapshotValue;\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;\n    if (!encapsulationKeyPair) {\n      return false;\n    }\n    if (identitySnapshot.signingKeyPair !== signingKeyPair) {\n      return false;\n    }\n    const pinLocalUserIdentity = requireUserIdentityAvailable(\n      this.dependencies.onUserIdentityAvailable,\n      \"Login\",\n    );\n\n    this.dependencies.log(\n      challengeHex ? \"Authenticating with challenge...\" : \"Authenticating...\",\n    );\n    const authentication = await authenticateUnlessSuspended(\n      () =>\n        challengeHex\n          ? this.dependencies.api.authenticateWithChallenge(\n              fingerprint,\n              signingKeyPair.signingPrivateKey,\n              challengeHex,\n            )\n          : this.dependencies.api.authenticate(\n              fingerprint,\n              signingKeyPair.signingPrivateKey,\n            ),\n      () => {\n        if (this.authToken === snapshotAtStart.authToken) this.logout();\n      },\n    );\n\n    if (this.dependencies.identity.snapshot !== identitySnapshot) {\n      return false;\n    }\n\n    if (!authentication) {\n      this.logout();\n      this.dependencies.log(\"Authentication failed\");\n      return false;\n    }\n\n    try {\n      this.identityAcknowledgments.assertMatches(\n        authentication.userId,\n        fingerprint,\n      );\n      await pinLocalUserIdentity(authentication.userId, {\n        encapsulationPublicKey: encapsulationKeyPair.publicKey,\n        signingKeyFingerprint: fingerprint,\n        signingPublicKey: signingKeyPair.signingPublicKey,\n      });\n      if (this.dependencies.identity.snapshot !== identitySnapshot)\n        return false;\n      this.identityAcknowledgments.remember(authentication.userId, fingerprint);\n    } catch (error) {\n      return refuseSessionLogin(error, authentication.userId, {\n        clear: () => this.logout(),\n        report: this.dependencies.reportSecurityIncident,\n      });\n    }\n    // A changed root for this identity+org is refused before the token is\n    // usable. Decision and commit are one synchronous step against the live\n    // snapshot (no await in between); the refusal clears the prior session in\n    // that same step and then reports its own incident.\n    await commitSessionRootAcknowledgment({\n      context: {\n        authToken: authentication.token,\n        defaultOrganizationId: authentication.organizationId,\n        isAuthenticated: true,\n        isRoot: authentication.isRoot,\n        organizationId: authentication.organizationId,\n        userId: authentication.userId,\n      },\n      onRefused: () => {\n        if (this.snapshotValue === snapshotAtStart) this.logout();\n      },\n      reporter: this.dependencies.reportSecurityIncident,\n      root: authentication,\n      session: this,\n      signingFingerprint: fingerprint,\n    });\n    this.dependencies.log(\"Authentication successful\");\n    return true;\n  }\n\n  logout(): void {\n    this.setContext({ authToken: null, isAuthenticated: false, isRoot: false });\n  }\n\n  async logoutRemote(): Promise<boolean> {\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    try {\n      if (!this.authToken) {\n        return true;\n      }\n\n      const response = await this.dependencies.api.logout();\n      return response?.message === \"ok\";\n    } finally {\n      if (this.dependencies.identity.snapshot === identitySnapshot) {\n        this.logout();\n      }\n    }\n  }\n\n  async registerIdentity(\n    options?: RegisterIdentityOptions,\n  ): Promise<SessionRegistrationResult | SessionRegistrationRefusal | null> {\n    const containerId = this.containerId;\n    if (!containerId) {\n      this.dependencies.log(\n        \"Registration skipped: container id is unavailable\",\n      );\n      return null;\n    }\n\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    const signingKeyPair = identitySnapshot.signingKeyPair;\n    if (!signingKeyPair) {\n      this.dependencies.log(\"Registration skipped: signing key is unavailable\");\n      return null;\n    }\n\n    const encapsulationKeyPair = identitySnapshot.encapsulationKeyPair;\n    if (!encapsulationKeyPair) {\n      this.dependencies.log(\n        \"Registration skipped: encapsulation key is unavailable\",\n      );\n      return null;\n    }\n\n    const dbClient = this.dependencies.database.client;\n    if (!dbClient) {\n      this.dependencies.log(\n        \"Registration skipped: database client is unavailable\",\n      );\n      return null;\n    }\n    const pinLocalUserIdentity = requireRegistrationIdentityPinner({\n      identity: this.dependencies.identity,\n      identitySnapshot,\n      onUserIdentityAvailable: this.dependencies.onUserIdentityAvailable,\n    });\n    const keyBound = await registrationKeyAlreadyBound(\n      this.dependencies,\n      identitySnapshot.signingFingerprint,\n    );\n    if (this.dependencies.identity.snapshot !== identitySnapshot) return null;\n    if (keyBound) return keyBound;\n\n    let response: Awaited<ReturnType<typeof registerIdentityWorkflow>>;\n    try {\n      response = await registerIdentityWorkflow({\n        apiClient: this.dependencies.api,\n        containerId,\n        dbClient,\n        documentProjectors: this.dependencies.documentProjectors,\n        encapsulationKeyPair,\n        isIdentityCurrent: () =>\n          this.dependencies.identity.snapshot === identitySnapshot,\n        log: this.dependencies.log,\n        logError: this.dependencies.logError,\n        organizationProfileName: options?.organizationProfileName,\n        pinLocalUserIdentity,\n        primePrincipalHistory:\n          this.dependencies.primeProvisionedPrincipalHistory,\n        provisionedSystemContainers:\n          this.dependencies.provisionedSystemContainers,\n        rosterProfileNickname: options?.rosterProfileNickname,\n        signingKeyFingerprint: identitySnapshot.signingFingerprint,\n        signingKeyPair,\n      });\n    } catch (error: unknown) {\n      this.dependencies.logError(\"Identity registration failed\", error);\n      throw error;\n    }\n\n    if (this.dependencies.identity.snapshot !== identitySnapshot) return null;\n    if (!response) {\n      this.dependencies.log(\"Registration failed\");\n      return null;\n    }\n\n    // The workflow pinned `response.userId` once the server confirmed it,\n    // under the same currency check as above.\n    await commitSessionRootAcknowledgment({\n      context: {\n        containerId: response.rootContainerId,\n        defaultOrganizationId: response.organizationId,\n        organizationId: response.organizationId,\n        userId: response.userId,\n      },\n      reporter: this.dependencies.reportSecurityIncident,\n      root: response,\n      session: this,\n      signingFingerprint: identitySnapshot.signingFingerprint,\n    });\n\n    return {\n      challenge: response.challenge,\n      containerId: response.rootContainerId,\n      organizationId: response.organizationId,\n      userId: response.userId,\n    };\n  }\n\n  async createOrganization(\n    options?: CreateOrganizationOptions,\n    replacesOrganizationId?: string,\n    nativeSubscriptionRestore?: boolean,\n  ): Promise<SessionCreateOrganizationResult | null> {\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    const userId = this.userId;\n    const response = await createSessionOrganization(this.dependencies, {\n      nativeSubscriptionRestore,\n      options,\n      replacesOrganizationId,\n      userId,\n    });\n    if (\n      !response ||\n      !userId ||\n      this.userId !== userId ||\n      this.dependencies.identity.snapshot !== identitySnapshot\n    )\n      return null;\n    await commitSessionRootAcknowledgment({\n      reporter: this.dependencies.reportSecurityIncident,\n      root: {\n        userId,\n        organizationId: response.organizationId,\n        rootContainerId: response.containerId,\n      },\n      session: this,\n      signingFingerprint: identitySnapshot.signingFingerprint,\n    });\n    return response;\n  }\n\n  prepareNativeSubscriptionRestoreOrganization(\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionCreateOrganizationResult | null> {\n    return this.createOrganization(options, undefined, true);\n  }\n\n  async completeNativeSubscriptionRestoreOrganization(\n    organizationId: string,\n  ): Promise<boolean> {\n    const userId = this.userId;\n    const dbClient = this.dependencies.database.client;\n    const identitySnapshot = this.dependencies.identity.snapshot;\n    if (!userId || !dbClient) return false;\n    return removeNativeSubscriptionRestoreProvisioningAttempt({\n      canCommit: () =>\n        this.userId === userId &&\n        this.dependencies.identity.snapshot === identitySnapshot,\n      dbClient,\n      organizationId,\n      userId,\n    });\n  }\n\n  async recoverPurgedOrganization(\n    organizationId: string,\n    options?: CreateOrganizationOptions,\n  ): Promise<SessionRecoverOrganizationResult | null> {\n    return recoverPurgedSessionOrganization(\n      this.dependencies,\n      this,\n      organizationId,\n      options,\n    );\n  }\n\n  setAuthToken(authToken: string | null): void {\n    this.setSnapshot({ ...this.snapshotValue, authToken });\n  }\n\n  setContainerId(containerId: string | null): void {\n    this.setSnapshot({ ...this.snapshotValue, containerId });\n  }\n\n  setContext(context: SessionContext): void {\n    const wasAcknowledged = this.userIdAcknowledged;\n    this.identityAcknowledgments.remember(\n      context.userId,\n      this.dependencies.identity.snapshot.signingFingerprint,\n    );\n    const previous = this.snapshotValue;\n    this.setSnapshot(\n      mergeSessionContext(\n        previous,\n        context,\n        this.dependencies.identity.snapshot.signingFingerprint,\n      ),\n    );\n    // Acknowledging an already-held userId changes `userIdAcknowledged` without\n    // changing the snapshot; persistence subscribers must still observe it.\n    if (\n      this.snapshotValue === previous &&\n      wasAcknowledged !== this.userIdAcknowledged\n    ) {\n      this.listeners.notify();\n    }\n  }\n\n  setOrganizationId(organizationId: string | null): void {\n    this.setSnapshot({ ...this.snapshotValue, organizationId });\n  }\n\n  setSyncEnabled(enabled: boolean): void {\n    if (this.syncEnabledValue === enabled) {\n      return;\n    }\n    this.syncEnabledValue = enabled;\n    this.listeners.notify();\n  }\n\n  setUserId(userId: string | null): void {\n    this.setSnapshot(\n      mergeSessionContext(\n        this.snapshotValue,\n        { userId },\n        this.dependencies.identity.snapshot.signingFingerprint,\n      ),\n    );\n  }\n\n  subscribe = (listener: SessionListener): (() => void) =>\n    this.listeners.subscribe(listener);\n\n  private setSnapshot(next: SessionSnapshot): void {\n    const previous = this.snapshotValue;\n    if (previous.authToken !== next.authToken) {\n      this.dependencies.api.setAuthToken(next.authToken);\n    }\n\n    if (sessionSnapshotsEqual(previous, next)) {\n      return;\n    }\n\n    this.snapshotValue = next;\n    this.listeners.notify();\n  }\n}\n"]}

package/client/session/sessionLoginRefusal.js

@@ -1,3 +1,4 @@
+import { AccountSuspendedError } from "../../internal/api-client/index.js";
 import { reportAndRethrowKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
 /**
  * A server answering this identity with another account, or an identity
@@ -13,4 +14,20 @@ export async function refuseSessionLogin(error, userId, session) {
     });
     throw error;
 }
+/**
+ * Runs the sign-in request. A suspended account is terminal: the session it
+ * would have renewed is cleared, so that session's requests stop renewing,
+ * and the error propagates for the host to name.
+ */
+export async function authenticateUnlessSuspended(authenticate, clear) {
+    try {
+        return await authenticate();
+    }
+    catch (error) {
+        if (error instanceof AccountSuspendedError) {
+            clear();
+        }
+        throw error;
+    }
+}
 //# sourceMappingURL=sessionLoginRefusal.js.map

package/client/session/sessionLoginRefusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionLoginRefusal.js","sourceRoot":"","sources":["sessionLoginRefusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AAGxG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,MAAc,EACd,OAGC;IAED,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,MAAM,uCAAuC,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE;QACnE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,CAAC;AACd,CAAC","sourcesContent":["import { reportAndRethrowKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\n\n/**\n * A server answering this identity with another account, or an identity\n * whose durable pin no longer matches, is evidence, not a login failure: the\n * session is cleared, the keying error is recorded, and the error propagates.\n */\nexport async function refuseSessionLogin(\n  error: unknown,\n  userId: string,\n  session: {\n    readonly clear: () => void;\n    readonly report: SecurityIncidentReporter | undefined;\n  },\n): Promise<never> {\n  session.clear();\n  await reportAndRethrowKeyingVerificationError(error, session.report, {\n    objectId: userId,\n    objectKind: \"user\",\n    operation: \"session.login\",\n  });\n  throw error;\n}\n"]}
+{"version":3,"file":"sessionLoginRefusal.js","sourceRoot":"","sources":["sessionLoginRefusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AAGxG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,MAAc,EACd,OAGC;IAED,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,MAAM,uCAAuC,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE;QACnE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAA2C,EAC3C,KAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,KAAK,EAAE,CAAC;QACV,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { AccountSuspendedError } from \"@tearleads/api-client\";\nimport { reportAndRethrowKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport type { SecurityIncidentReporter } from \"../../data/shared/securityIncidents\";\n\n/**\n * A server answering this identity with another account, or an identity\n * whose durable pin no longer matches, is evidence, not a login failure: the\n * session is cleared, the keying error is recorded, and the error propagates.\n */\nexport async function refuseSessionLogin(\n  error: unknown,\n  userId: string,\n  session: {\n    readonly clear: () => void;\n    readonly report: SecurityIncidentReporter | undefined;\n  },\n): Promise<never> {\n  session.clear();\n  await reportAndRethrowKeyingVerificationError(error, session.report, {\n    objectId: userId,\n    objectKind: \"user\",\n    operation: \"session.login\",\n  });\n  throw error;\n}\n\n/**\n * Runs the sign-in request. A suspended account is terminal: the session it\n * would have renewed is cleared, so that session's requests stop renewing,\n * and the error propagates for the host to name.\n */\nexport async function authenticateUnlessSuspended<Authentication>(\n  authenticate: () => Promise<Authentication>,\n  clear: () => void,\n): Promise<Authentication> {\n  try {\n    return await authenticate();\n  } catch (error) {\n    if (error instanceof AccountSuspendedError) {\n      clear();\n    }\n    throw error;\n  }\n}\n"]}

package/index.d.ts

@@ -26,6 +26,6 @@ export { cacheReferencedPrincipalPolicies, captureAcknowledgedPrincipalPredecess
 export type { InitialRootMetadataBootstrap, ProvisionedSystemContainerSpec, RegisterIdentityInput, RegistrationApi, } from "./workflows/registration/index.js";
 export { bootstrapRootContainer, buildInitialOrganizationPolicyRequest, createInitialRootMetadataBootstrap, persistRegistrationBootstrap, registerIdentity, } from "./workflows/registration/index.js";
 export type { RootIdentitiesApi, RootIdentitiesPage, RootIdentitiesQueryInput, RootIdentity, RootIdentityDetail, RootIdentityOrganization, RootIdentitySession, RootRequestOutcome, } from "./workflows/root/index.js";
-export { listRootAuditEvents, listRootDataUsageReport, listRootIdentities, listRootIdentityOrganizations, listRootOrganizationIdentities, listRootOrganizations, loadRootIdentity, loadRootOrganization, loadRootOrganizationDataUsage, type RootAuditApi, type RootAuditEvent, type RootAuditEventsPage, type RootAuditEventsQueryInput, type RootDataUsageApi, type RootDataUsageReportPage, type RootOrganization, type RootOrganizationDetail, type RootOrganizationIdentitiesPage, type RootOrganizationIdentity, type RootOrganizationPageQueryInput, type RootOrganizationsApi, type RootOrganizationsPage, type RootOrganizationsQueryInput, } from "./workflows/root/index.js";
+export { liftRootIdentitySuspension, listRootAuditEvents, listRootDataUsageReport, listRootIdentities, listRootIdentityOrganizations, listRootOrganizationIdentities, listRootOrganizations, loadRootIdentity, loadRootOpsHealthReport, loadRootOrganization, loadRootOrganizationDataUsage, type RootAuditApi, type RootAuditEvent, type RootAuditEventsPage, type RootAuditEventsQueryInput, type RootDataUsageApi, type RootDataUsageReportPage, type RootOpsHealthApi, type RootOpsHealthReport, type RootOrganization, type RootOrganizationDetail, type RootOrganizationIdentitiesPage, type RootOrganizationIdentity, type RootOrganizationPageQueryInput, type RootOrganizationsApi, type RootOrganizationsPage, type RootOrganizationsQueryInput, type RootSuspensionApi, suspendRootIdentity, } from "./workflows/root/index.js";
 export type { ClearRemoteSyncStateResult, DomainSyncCoordinator, DomainSyncSnapshot, RemoteResetInput, RemoteResetReplacement, SyncIdleOptions, SyncLane, SyncLaneConfig, SyncLaneLastAction, SyncLanePhase, SyncLaneSnapshot, SyncLaneStatus, } from "./workflows/sync/index.js";
 export { clearRemoteSyncState, getDomainSyncCoordinatorSnapshot, getOrCreateDomainSyncCoordinator, hasDomainSyncCoordinatorPendingWork, requestAllDomainSyncLanes, subscribeToDomainSyncCoordinator, waitForDomainSyncCoordinatorToSettle, } from "./workflows/sync/index.js";

package/index.js

@@ -14,6 +14,6 @@ export { buildMaterializedDocumentCreatePlan, createDocumentProjectionUserKeyRes
 export { abandonJournaledPrincipalMutation, addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, buildOrganizationGroupPolicyHistory, buildOrganizationProfileDocumentPatch, buildRosterProfileDocumentPatch, checkNativePurchaseEligibility, createInitializedRosterProfileDocument, createOrganizationGroup, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, discardUnreadableJournaledPrincipalMutation, GroupMembershipNameMismatchError, GroupShareNameMismatchError, getOrganizationProfileDocumentLocalId, getRosterProfileDocumentLocalId, importOrganizationUser, loadLocalOrganizationDataUsage, loadLocalOrganizationDirectoryAndGroups, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_PROFILE_DOCUMENT_KIND, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, PendingPrincipalMutationError, PrincipalMutationOutcomeUnknownError, ROSTER_PROFILE_DOCUMENT_KIND, readJournaledPrincipalMutation, readOrganizationProfileName, reconcileOrganizationDataUsage, reconcileOrganizationDirectoryAndGroups, recoverJournaledPrincipalMutation, removeOrganizationGroupUser, resolveOrganizationBillingView, retainAcknowledgedPrincipalCurrents, revokeOrganizationContainerGrant, shareRemoteContainerWithGroup, startOrganizationTrial, submitJournaledPrincipalMutation, subscribeOrganizationReadModelInvalidation, UnreadablePrincipalMutationError, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./workflows/organizations/index.js";
 export { cacheReferencedPrincipalPolicies, captureAcknowledgedPrincipalPredecessor, PrincipalPolicyHistoryReadError, recoverPrincipalPolicyHistory, recoverProjectionPolicyHistory, recoverScopedPrincipalPolicyHistory, } from "./workflows/principals/index.js";
 export { bootstrapRootContainer, buildInitialOrganizationPolicyRequest, createInitialRootMetadataBootstrap, persistRegistrationBootstrap, registerIdentity, } from "./workflows/registration/index.js";
-export { listRootAuditEvents, listRootDataUsageReport, listRootIdentities, listRootIdentityOrganizations, listRootOrganizationIdentities, listRootOrganizations, loadRootIdentity, loadRootOrganization, loadRootOrganizationDataUsage, } from "./workflows/root/index.js";
+export { liftRootIdentitySuspension, listRootAuditEvents, listRootDataUsageReport, listRootIdentities, listRootIdentityOrganizations, listRootOrganizationIdentities, listRootOrganizations, loadRootIdentity, loadRootOpsHealthReport, loadRootOrganization, loadRootOrganizationDataUsage, suspendRootIdentity, } from "./workflows/root/index.js";
 export { clearRemoteSyncState, getDomainSyncCoordinatorSnapshot, getOrCreateDomainSyncCoordinator, hasDomainSyncCoordinatorPendingWork, requestAllDomainSyncLanes, subscribeToDomainSyncCoordinator, waitForDomainSyncCoordinatorToSettle, } from "./workflows/sync/index.js";
 //# sourceMappingURL=index.js.map

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAsK/B,OAAO,EAEL,KAAK,EACL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAuBlB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAexC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,2BAA2B,EAC3B,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EACL,gCAAgC,EAChC,uCAAuC,EACvC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAe9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// SDK: verified identity links, read-only pins and device-first handles.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationLeaveRequestResult,\n  OrganizationMembership,\n  OrganizationMemberships,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./data/documents\";\nexport {\n  addDocumentAttachments,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./data/documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeMoveSettlement,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport { Tearleads } from \"./Tearleads\";\nexport type {\n  TearleadsDatabaseOptions,\n  TearleadsOptions,\n} from \"./TearleadsOptions\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  readBlobByteSource,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  GroupShareNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  shareRemoteContainerWithGroup,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  AcknowledgedPrincipalPredecessor,\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  captureAcknowledgedPrincipalPredecessor,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  listRootAuditEvents,\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootAuditApi,\n  type RootAuditEvent,\n  type RootAuditEventsPage,\n  type RootAuditEventsQueryInput,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,4FAA4F;AAC5F,OAAO,EAGL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAsK/B,OAAO,EAEL,KAAK,EACL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAuBlB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAexC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,2BAA2B,EAC3B,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EACL,gCAAgC,EAChC,uCAAuC,EACvC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAkB7B,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// SDK: verified identity links, read-only pins and device-first handles.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport {\n  type ApiRequestCounts,\n  type ApiRequestEndpointCounts,\n  ApiRequestMetrics,\n  type ApiRequestMetricsSnapshot,\n} from \"@tearleads/api-client\";\nexport type {\n  AbandonOrganizationPolicyMutationInput,\n  AddOrganizationGroupUserInput,\n  BlobInfo,\n  BlobInfoAttachmentKind,\n  BlobInfoDocumentReference,\n  BlobInfoInput,\n  BlobInfoList,\n  BlobInfoSort,\n  BlobInfoSortDirection,\n  BlobInfoSortKey,\n  BrowserLocalKeyringOptions,\n  ContainerContents,\n  ContainerContentsContextValue,\n  ContainerContentsStore,\n  ContainerContentsStoreOptions,\n  ContainerDocumentLinkInput,\n  ContainerDocumentLinks,\n  ContainerDocumentObjectSyncState,\n  ContainerDocumentObjectSyncStatus,\n  ContainerDocumentQueries,\n  ContainerDocumentSidebarRow,\n  ContainerInfo,\n  ContainerInfoInput,\n  ContainerItemRow,\n  ContainerItemSort,\n  ContainerItemSortDirection,\n  ContainerItemSortKey,\n  ContainerNode,\n  ContainerShareAccessLevel,\n  CreateOrganizationOptions,\n  DatabaseListener,\n  DatabaseOptions,\n  DatabaseSnapshot,\n  DatabaseStatus,\n  DeviceFirst,\n  DeviceFirstContainerContents,\n  DiscardUnreadableOrganizationPolicyMutationInput,\n  DocumentAttachmentStatus,\n  DocumentAttachmentUpload,\n  DocumentAttributionRangesInput,\n  DocumentAttributionRangesPage,\n  DocumentContextValue,\n  DocumentInfo,\n  DocumentInfoInput,\n  DocumentList,\n  DocumentSort,\n  DocumentSortDirection,\n  DocumentSortKey,\n  DocumentStore,\n  DocumentSubscriptionOptions,\n  Documents,\n  DocumentsRuntime,\n  DomainScope,\n  FileSaver,\n  Identity,\n  IdentityGenerationResult,\n  IdentityKeyPackage,\n  IdentityListener,\n  IdentityOptions,\n  IdentitySnapshot,\n  ImportedOrganizationUser,\n  IndexedDbLocalKeyringManifestStoreOptions,\n  IndexedDbWrappingKeyKeystoreOptions,\n  LinkDocumentToContainerInput,\n  ListDocumentsInput,\n  LocalKeyPurpose,\n  LocalKeyring,\n  LocalKeyringManifest,\n  LocalKeyringManifestFormat,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringOptions,\n  LocalKeyringPinCode,\n  LocalKeyringScope,\n  LocalKeyringSession,\n  LocalOrganizationSummary,\n  LocalProjectionReconciledDelta,\n  LocalProjectionSnapshot,\n  LocalProjectionView,\n  LocalSecretContext,\n  LocalStorageLocalKeyringManifestStoreOptions,\n  Logger,\n  MergeDocumentSummary,\n  MoveDocumentToContainerInput,\n  NetworkListener,\n  NetworkMode,\n  NetworkStatusSource,\n  NormalizedLocalKeyringScope,\n  OpenContainerDocumentInput,\n  OpenDocumentInput,\n  OpenDocumentOptions,\n  OrganizationBilling,\n  OrganizationBillingHistory,\n  OrganizationBillingHistoryEntry,\n  OrganizationBillingManagementUrl,\n  OrganizationBillingView,\n  OrganizationContainerGrant,\n  OrganizationContainerGrants,\n  OrganizationDataUsage,\n  OrganizationDirectory,\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationGrantRef,\n  OrganizationGroupContainer,\n  OrganizationGroupContainers,\n  OrganizationGroupDetails,\n  OrganizationGroupMember,\n  OrganizationGroupMembers,\n  OrganizationGroupMutationReceipt,\n  OrganizationGroupPolicyHistory,\n  OrganizationGroupSummary,\n  OrganizationLeaveRequestResult,\n  OrganizationMembership,\n  OrganizationMemberships,\n  OrganizationPolicyGrantChange,\n  OrganizationPolicyGroupChange,\n  /** Verified organization display page with an optional older-page cursor. */\n  OrganizationPolicyHistory,\n  OrganizationPolicyHistoryEntry,\n  OrganizationProfile,\n  OrganizationSyncPauseResult,\n  Organizations,\n  OrganizationUserDetail,\n  PendingWriteQueueItem,\n  PendingWriteQueueItemStatus,\n  PendingWriteQueueObjectKind,\n  PendingWriteQueueOperation,\n  PendingWriteQueueOperationKind,\n  PendingWriteQueueOperationStatus,\n  // Persistence notifications distinguish placement changes from content saves.\n  PersistedDocumentListener,\n  PinCodeBrowserLocalKeyringOptions,\n  PinCodeWrappingKeyKeystoreOptions,\n  PurgeDocumentInput,\n  PurgeDocumentResult,\n  ReconciliationService,\n  RemoveOrganizationGroupUserInput,\n  ResolvedUserIdentity,\n  SaveFileRequest,\n  SecurityIncident,\n  SecurityIncidentListener,\n  SecurityIncidentObjectKind,\n  SecurityIncidents,\n  Session,\n  SessionContext,\n  SessionCreateOrganizationResult,\n  SessionListener,\n  SessionRecoverOrganizationResult,\n  SessionRegistrationRefusal,\n  SessionRegistrationResult,\n  SessionSnapshot,\n  SetActiveDocumentContainerInput,\n  SetLinkedContainerIdsForDocument,\n  UnlinkDocumentFromContainerInput,\n  UnwrapLocalSecretInput,\n  UserIdentities,\n  UserSession,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappedLocalSecretFormat,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n  WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n  type BlobStoreFactory,\n  Blobs,\n  createBrowserLocalKeyring,\n  createBrowserLocalKeyringManifestStore,\n  createBrowserNetworkStatusSource,\n  createContainerDocumentObjectSyncState,\n  createDomainScope,\n  createIndexedDbLocalKeyringManifestStore,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  createLocalStorageLocalKeyringManifestStore,\n  createMemoryLocalKeyringManifestStore,\n  createMemoryWrappingKeyKeystore,\n  createPinCodeBrowserLocalKeyring,\n  createPinCodeWrappingKeyKeystore,\n  createRevenueCatPurchases,\n  createUnavailableDirectCheckout,\n  createUnavailablePurchases,\n  createWebViewLocalKeyring,\n  Database,\n  DEFAULT_DOCUMENT_ID,\n  type DirectCheckoutAppearance,\n  type DirectCheckoutCapability,\n  type DirectCheckoutConfirmation,\n  type DirectCheckoutSession,\n  DirectCheckoutUnavailableError,\n  decodeLocalKeyringSqliteKey,\n  Events,\n  type EventsListener,\n  type EventsSnapshot,\n  encodeLocalKeyringSqliteKey,\n  enqueueReconciliationForEvents,\n  IDENTITY_KEY_PACKAGE_FORMAT,\n  isPinCodeWrappedLocalSecretEnvelope,\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  localKeyringScopeKey,\n  Network,\n  normalizeLocalKeyringScope,\n  type PrincipalHistoryKeyProvider,\n  type PrincipalHistoryKeyScope,\n  PurchaseAbortedError,\n  PurchaseAlreadyOwnedError,\n  PurchaseCancelledError,\n  PurchaseIdentityPendingError,\n  PurchaseProviderStalledError,\n  type PurchasesCapability,\n  PurchasesUnavailableError,\n  PurgedOrganizationRecoveryBillingRequiredError,\n  parseLocalKeyringManifest,\n  type RevenueCatBackend,\n  type RevenueCatCustomerInfo,\n  type RevenueCatPackage,\n  type RevenueCatPurchasesConfig,\n  SyncBillingGate,\n  type SyncBillingGateListener,\n  type SyncPurchaseResult,\n  type SyncSubscriptionOption,\n  serializeLocalKeyringManifest,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n  DiscoveredDocumentInput,\n  DocumentAttachment,\n  DocumentClientProjectionDefinition,\n  DocumentClientProjectionDeleteInput,\n  DocumentClientProjectionSaveInput,\n  DocumentFieldValidationIssue,\n  DocumentProjection,\n  DocumentProjectorDefinition,\n  DocumentProjectorInput,\n  DocumentProjectorRegistry,\n  DocumentProjectorRegistryInput,\n  DocumentRow,\n  DocumentRowSummary,\n  DocumentSummary,\n  StoredDocumentKind,\n  StoredDocumentState,\n  StructuredDocumentMap,\n  StructuredDocumentShape,\n  StructuredDocumentText,\n  ValidatedDocumentFields,\n} from \"./data/documents\";\nexport {\n  addDocumentAttachments,\n  createDocumentProjectorRegistry,\n  createDocumentSignerDeviceId,\n  DEFAULT_DOCUMENT_ACCESS_EPOCH,\n  DEFAULT_DOCUMENT_KIND,\n  defaultDocumentProjectorRegistry,\n  deriveStoredDocumentTitle,\n  ensureDocumentAttachmentStructure,\n  getDocumentAttachments,\n  getDocumentClientProjectionTables,\n  getStoredDocumentTypeLabel,\n  getUntitledDocumentTitle,\n  initializeStoredDocumentKind,\n  projectStoredDocumentState,\n  readStoredDocumentState,\n  readStringDocumentField,\n  resolveOpIdAttribution,\n  sameDocumentAttachments,\n  summarizeDocumentContributors,\n  writerByPeerId,\n  writeStoredDocumentFields,\n} from \"./data/documents\";\nexport type {\n  ContainerContentsSnapshot,\n  ContainerContentsStoreRuntime,\n  ContainerContentsStoreState,\n  ContainerContentsStoreSyncAgent,\n  ContainerContentsStoreSyncState,\n  ContainerState,\n  PurgeMoveSettlement,\n  PurgeOptions,\n  PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n  createContainerContentsStore,\n  createContainerContentsStoreState,\n  createContainerContentsStoreSyncAgent,\n  getOrCreateContainerContentsStore,\n  isSystemContainerNode,\n  requestContainerContentsDocumentPriming,\n  subscribeToContainerContentsStore,\n  updateContainerContentsSnapshot,\n  updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n  DocumentSnapshot,\n  DocumentStoreFacade,\n  DocumentStoreOpenOptions,\n  DocumentStoreRelinkInput,\n  DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n  createDocumentStore,\n  discardRegisteredDocumentLocalState,\n  getOrCreateDocumentStore,\n  openDocumentStore,\n  requestDomainDocumentSync,\n  subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport { Tearleads } from \"./Tearleads\";\nexport type {\n  TearleadsDatabaseOptions,\n  TearleadsOptions,\n} from \"./TearleadsOptions\";\nexport type {\n  BlobByteSource,\n  BlobByteSourceInput,\n  BlobBytes,\n  BlobStore,\n  EncryptedBlobStoreCipher,\n  EncryptedBlobStoreKey,\n  EncryptedBlobStoreOptions,\n  WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n  blobByteSourceInputLength,\n  createBlobByteSource,\n  createBlobStore,\n  createEncryptedBlobStore,\n  createLazyEncryptedBlobStore,\n  createMemoryBlobStore,\n  decryptDocumentAttachmentBlob,\n  hydrateDocumentAttachmentBlobs,\n  purgeOpfsBlobStore,\n  readBlobByteSource,\n  uploadDocumentAttachment,\n  wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n  ContainerContentsRootAdopter,\n  ContainerContentsRootAdoptionInput,\n  ContainerContentsStoreWorkflowRuntime,\n  ContainerContentsWorkflowRuntime,\n  // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n  // documentQueries variant has a different shape, so it keeps a disambiguating\n  // alias on the public surface.\n  ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n  ContainerSystemSlotDefinition,\n  PendingDownloadQueueItem,\n  RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n  createContainerContentsDocumentsRuntime,\n  createContainerContentsProjectionUserKeyResolver,\n  createContainerContentsStoreWorkflowRuntime,\n  createContainerContentsSyncLane,\n  createContainerContentsWorkflowRuntime,\n  createContainerParentSyncLane,\n  createInitializedContainerMetadataDocument,\n  defaultContainerContentsPersistence,\n  deriveContainerSystemSlot,\n  initializeDocumentLinksSchema,\n  listBlobInfo,\n  listDocumentLinkedContainerIds,\n  loadContainerInfo,\n  loadContainerSyncWatermark,\n  loadDocumentAttributionRanges,\n  loadDocumentInfo,\n  replaceDocumentLinks,\n  saveContainerSyncWatermark,\n  syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n  AggregatedContainerKekLog,\n  ContainerMutationAuthor,\n  ContainerReciteApi,\n  ContainerWriteRefusal,\n  KeyringRebuildResult,\n  MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n  buildMaterializedContainerRekeyPlan,\n  buildRootContainerCreatePlan,\n  ContainerAuthorAccessError,\n  ContainerKekRepairInaccessibleError,\n  ContainerKekRepairRequiredError,\n  ContainerKeyringOverrideStaleError,\n  ContainerPathTooDeepError,\n  classifyContainerWriteRefusal,\n  containerWriterProjectionFromRekeyPlan,\n  createRemoteContainer,\n  fetchContainerKekLog,\n  HistoricalWrapUnavailableError,\n  type HistoricalWrapUnavailableReason,\n  isProjectionVerificationCancelledError,\n  moveRemoteContainer,\n  rebuildKeyringEntriesFromLog,\n  recoverKeyringEntryFromWraps,\n  rekeyRemoteContainer,\n  revokeRemoteContainer,\n  rootContainerWriterProjectionFromCreatePlan,\n  shareRemoteContainer,\n} from \"./workflows/containers\";\nexport type {\n  DocumentRecord,\n  DocumentSyncContainerRekeyBuilder,\n  DocumentSyncPullContinuation,\n  DocumentSyncUpdateIsolationError,\n  DocumentsPersistence,\n  DocumentsWorkflowRuntime,\n  DocumentsWorkflowRuntimeInput,\n  IncomingDocumentSyncUpdateValidator,\n  LocalAttachmentRecord,\n  PendingAttachmentRecord,\n  PendingUpdateInsert,\n  PendingUpdateRecord,\n  SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n  buildMaterializedDocumentCreatePlan,\n  createDocumentProjectionUserKeyResolver,\n  createDocumentsWorkflowRuntime,\n  createRemoteDocument,\n  DOCUMENT_SYNC_TRACE_FRAGMENT,\n  DOCUMENT_SYNC_TRACE_PATTERN,\n  DOCUMENTS_APP_KIND,\n  DocumentRawHistoryUnavailableError,\n  defaultDocumentsPersistence,\n  deletePersistedDocument,\n  isDatabaseUnavailableError,\n  isDocumentSyncUpdateIsolationError,\n  persistedDocumentCreateStateFromResponse,\n  readPullContinuation,\n  syncRemoteDocument,\n  unwrapContainerKekPath,\n  unwrapDocumentContentKeyTarget,\n  validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are available only through the testing subpath\n// for low-level runtime tests.\nexport type {\n  AcknowledgedPrincipalCurrentInput,\n  AcknowledgedPrincipalCurrentRetirement,\n  AuthoredPrincipalMutation,\n  OrganizationGroupPolicyHistoryEntry,\n  OrganizationNativePurchaseEligibility,\n  OrganizationPrincipalMemberChange,\n  OrganizationPrincipalMemberChangeType,\n  OrganizationPrincipalPolicyHistory,\n  OrganizationPrincipalPolicyHistoryEntry,\n  PrincipalMutationJournalContext,\n  PrincipalMutationJournalScope,\n  PrincipalMutationResponse,\n  ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n  abandonJournaledPrincipalMutation,\n  addOrganizationGroupUser,\n  buildInitialGroupPolicyRequest,\n  buildInitialMemberGroupPolicyRequest,\n  buildOrganizationGroupPolicyHistory,\n  buildOrganizationProfileDocumentPatch,\n  buildRosterProfileDocumentPatch,\n  checkNativePurchaseEligibility,\n  createInitializedRosterProfileDocument,\n  createOrganizationGroup,\n  DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n  deriveOrganizationMetadataContainerSystemSlot,\n  deriveOrganizationRosterProfileContainerSystemSlot,\n  discardUnreadableJournaledPrincipalMutation,\n  GroupMembershipNameMismatchError,\n  GroupShareNameMismatchError,\n  getOrganizationProfileDocumentLocalId,\n  getRosterProfileDocumentLocalId,\n  importOrganizationUser,\n  loadLocalOrganizationDataUsage,\n  loadLocalOrganizationDirectoryAndGroups,\n  loadOrganizationBilling,\n  loadOrganizationBillingHistory,\n  loadOrganizationBillingManagementUrl,\n  ORGANIZATION_METADATA_CONTAINER_NAME,\n  ORGANIZATION_PROFILE_DOCUMENT_KIND,\n  ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n  PendingPrincipalMutationError,\n  PrincipalMutationOutcomeUnknownError,\n  ROSTER_PROFILE_DOCUMENT_KIND,\n  readJournaledPrincipalMutation,\n  readOrganizationProfileName,\n  reconcileOrganizationDataUsage,\n  reconcileOrganizationDirectoryAndGroups,\n  recoverJournaledPrincipalMutation,\n  removeOrganizationGroupUser,\n  resolveOrganizationBillingView,\n  retainAcknowledgedPrincipalCurrents,\n  revokeOrganizationContainerGrant,\n  shareRemoteContainerWithGroup,\n  startOrganizationTrial,\n  submitJournaledPrincipalMutation,\n  subscribeOrganizationReadModelInvalidation,\n  UnreadablePrincipalMutationError,\n  updateOrganizationProfile,\n  updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n  AcknowledgedPrincipalPredecessor,\n  CacheReferencedPrincipalPoliciesOptions,\n  PrincipalHistoryProtectionLease,\n  ProjectionPolicyHistoryRecoveryOptions,\n  RecoveredPrincipalPolicyHistory,\n  RecoveredScopedPrincipalPolicyHistory,\n  RecoverPrincipalPolicyHistoryOptions,\n  RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n  cacheReferencedPrincipalPolicies,\n  captureAcknowledgedPrincipalPredecessor,\n  PrincipalPolicyHistoryReadError,\n  recoverPrincipalPolicyHistory,\n  recoverProjectionPolicyHistory,\n  recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n  InitialRootMetadataBootstrap,\n  ProvisionedSystemContainerSpec,\n  RegisterIdentityInput,\n  RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n  bootstrapRootContainer,\n  buildInitialOrganizationPolicyRequest,\n  createInitialRootMetadataBootstrap,\n  persistRegistrationBootstrap,\n  registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n  RootIdentitiesApi,\n  RootIdentitiesPage,\n  RootIdentitiesQueryInput,\n  RootIdentity,\n  RootIdentityDetail,\n  RootIdentityOrganization,\n  RootIdentitySession,\n  RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n  liftRootIdentitySuspension,\n  listRootAuditEvents,\n  listRootDataUsageReport,\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootIdentity,\n  loadRootOpsHealthReport,\n  loadRootOrganization,\n  loadRootOrganizationDataUsage,\n  type RootAuditApi,\n  type RootAuditEvent,\n  type RootAuditEventsPage,\n  type RootAuditEventsQueryInput,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n  type RootOpsHealthApi,\n  type RootOpsHealthReport,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n  type RootSuspensionApi,\n  suspendRootIdentity,\n} from \"./workflows/root\";\nexport type {\n  ClearRemoteSyncStateResult,\n  DomainSyncCoordinator,\n  DomainSyncSnapshot,\n  RemoteResetInput,\n  RemoteResetReplacement,\n  SyncIdleOptions,\n  SyncLane,\n  SyncLaneConfig,\n  SyncLaneLastAction,\n  SyncLanePhase,\n  SyncLaneSnapshot,\n  SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n  clearRemoteSyncState,\n  getDomainSyncCoordinatorSnapshot,\n  getOrCreateDomainSyncCoordinator,\n  hasDomainSyncCoordinatorPendingWork,\n  requestAllDomainSyncLanes,\n  subscribeToDomainSyncCoordinator,\n  waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}

package/internal/api-client/ApiClient.d.ts

@@ -1,7 +1,7 @@
 import type { NativeSubscriptionStore } from "../validators/billing.js";
 import { type RootAuditEventsQuery, type RootIdentitiesQuery, type RootOrganizationPageQuery, type RootOrganizationsQuery } from "../validators/operation/index.js";
 import type { BlobAttachmentBindRequest, BlobAttachmentDetachRequest, CommitOrganizationGroupPolicyRequest, ContainerCreateWithMetadataDocumentRequest, ContainerMutationRequest, ContainerReciteRequest, ContainerRotationRequest, CreateOrganizationRequest, DocumentCreateRequest, DocumentLinkSetMutationRequest, DocumentPurgeRequest, DocumentSyncRequest, InitiateMultipartBlobStageRequest, ListContainerDocumentLanesRequest, ListContainerParentLanesRequest, RegistrationRequest, UpdateOrganizationMembershipRequest, UpdateOrganizationProfileRequest, UpdateOrganizationRosterEntryRequest } from "../validators/request/index.js";
-import type { CommitOrganizationGroupPolicyResponse, ContainerCreateWithMetadataDocumentResponse, ContainerDeleteResponse, ContainerMutationResponse, ContainerRotationResponse, ContainerWriterProjectionResponse, DocumentCreateResponse, DocumentSyncResponse, DocumentWriterProjectionResponse, ListContainerDocumentLanesResponse, OrganizationDataUsageResponse, OrganizationMembershipResponse, OrganizationPolicyHistoryResponse, OrganizationReadModelResponse, RootAuditEventsResponse, RootDataUsageReportResponse, RootIdentitiesResponse, RootIdentityDetailResponse, RootIdentityOrganizationsResponse, RootOrganizationDetailResponse, RootOrganizationIdentitiesResponse, RootOrganizationsResponse } from "../validators/response/index.js";
+import type { CommitOrganizationGroupPolicyResponse, ContainerCreateWithMetadataDocumentResponse, ContainerDeleteResponse, ContainerMutationResponse, ContainerRotationResponse, ContainerWriterProjectionResponse, DocumentCreateResponse, DocumentSyncResponse, DocumentWriterProjectionResponse, ListContainerDocumentLanesResponse, OrganizationDataUsageResponse, OrganizationMembershipResponse, OrganizationPolicyHistoryResponse, OrganizationReadModelResponse, RootAuditEventsResponse, RootDataUsageReportResponse, RootIdentitiesResponse, RootIdentityDetailResponse, RootIdentityOrganizationsResponse, RootIdentitySuspensionResponse, RootOpsHealthReportResponse, RootOrganizationDetailResponse, RootOrganizationIdentitiesResponse, RootOrganizationsResponse } from "../validators/response/index.js";
 import type { OrganizationLeaveRequest } from "../validators/util/index.js";
 import type { ApiRequestInstrumentation } from "./apiRequestMetrics.js";
 import { getOrganizationPolicyHistoryResult as organizationHistory } from "./organizationPolicyHistory.js";
@@ -988,6 +988,7 @@ export declare class ApiClient {
         token: string;
         userId: string;
         wsTicket: string;
+        code?: undefined;
         error?: undefined;
     } | null>;
     authenticateWithChallenge(fingerprint: string, secretKey: Uint8Array, challengeHex: string): Promise<{
@@ -998,6 +999,7 @@ export declare class ApiClient {
         token: string;
         userId: string;
         wsTicket: string;
+        code?: undefined;
         error?: undefined;
     } | null>;
     getUserIdentity(userId: string): Promise<{
@@ -1944,6 +1946,7 @@ export declare class ApiClient {
     getOrganizationReadModelResult(organizationId: string, cursor?: string, options?: RequestResultOptions): Promise<RequestResult<OrganizationReadModelResponse>>;
     getRootOrganizationDataUsageResult(organizationId: string, options?: RequestResultOptions): Promise<RequestResult<OrganizationDataUsageResponse>>;
     listRootAuditEventsResult(query?: RootAuditEventsQuery, options?: RequestResultOptions): Promise<RequestResult<RootAuditEventsResponse>>;
+    getRootOpsHealthReportResult(options?: RequestResultOptions): Promise<RequestResult<RootOpsHealthReportResponse>>;
     listRootDataUsageReportResult(query?: RootOrganizationsQuery, options?: RequestResultOptions): Promise<RequestResult<RootDataUsageReportResponse>>;
     listRootOrganizationsResult(query?: RootOrganizationsQuery, options?: RequestResultOptions): Promise<RequestResult<RootOrganizationsResponse>>;
     getRootOrganizationResult(organizationId: string, options?: RequestResultOptions): Promise<RequestResult<RootOrganizationDetailResponse>>;
@@ -1951,6 +1954,8 @@ export declare class ApiClient {
     listRootIdentitiesResult(query?: RootIdentitiesQuery, options?: RequestResultOptions): Promise<RequestResult<RootIdentitiesResponse>>;
     getRootIdentityResult(userId: string, options?: RequestResultOptions): Promise<RequestResult<RootIdentityDetailResponse>>;
     listRootIdentityOrganizationsResult(userId: string, options?: RequestResultOptions): Promise<RequestResult<RootIdentityOrganizationsResponse>>;
+    suspendRootIdentityResult(userId: string): Promise<RequestResult<RootIdentitySuspensionResponse>>;
+    liftRootIdentitySuspensionResult(userId: string): Promise<RequestResult<RootIdentitySuspensionResponse>>;
     getOrganizationDataUsageResult(organizationId: string, options?: RequestResultOptions): Promise<RequestResult<OrganizationDataUsageResponse>>;
     getOrganizationBilling(organizationId: string): Promise<{
         organizationId: string;

package/internal/api-client/ApiClient.js

@@ -1,6 +1,7 @@
 import { sign } from "../crypto/index.js";
-import { bindBlobAttachmentOperation, cancelStripeSubscriptionOperation, challengeOperation, claimNativeOrganizationSubscriptionOperation, createContainerOperation, createContainerWithMetadataDocumentOperation, createDocumentOperation, createOrganizationOperation, createStripeCheckoutOperation, createStripeCheckoutSessionOperation, createStripePortalOperation, deleteContainerOperation, destroySessionOperation, detachBlobAttachmentOperation, documentSyncOperation, getContainerKekLogOperation, getContainerReplacementAuthorizationsOperation, getContainerWriterProjectionOperation, getDocumentWriterProjectionOperation, getHealthOperation, getMultipartBlobStageOperation, getOrganizationBillingHistoryOperation, getOrganizationBillingManagementUrlOperation, getOrganizationBillingOperation, getOrganizationDataUsageOperation, getOrganizationNativePurchaseEligibilityOperation, getOrganizationReadModelOperation, getRootIdentityOperation, getRootOrganizationDataUsageOperation, getRootOrganizationOperation, getStripeCheckoutOptionsOperation, initiateMultipartBlobStageOperation, linkDocumentOperation, listContainerDocumentLanesOperation, listContainerParentLanesOperation, listDocumentAttachmentsOperation, listOrganizationGroupMembersOperation, listOrganizationMembershipsOperation, listRootAuditEventsOperation, listRootDataUsageReportOperation, listRootIdentitiesOperation, listRootIdentityOrganizationsOperation, listRootOrganizationIdentitiesOperation, listRootOrganizationsOperation, listSessionsOperation, logoutOperation, moveContainerOperation, reciteContainerOperation, registerOperation, rekeyContainerOperation, requestOrganizationLeaveOperation, revokeContainerOperation, shareContainerOperation, startOrganizationTrialOperation, unlinkDocumentOperation, updateOrganizationMembershipOperation, updateOrganizationProfileOperation, updateOrganizationRosterEntryOperation, userIdentityOperation, verifyOperation, withdrawOrganizationLeaveRequestOperation, } from "../validators/operation/index.js";
+import { bindBlobAttachmentOperation, cancelStripeSubscriptionOperation, challengeOperation, claimNativeOrganizationSubscriptionOperation, createContainerOperation, createContainerWithMetadataDocumentOperation, createDocumentOperation, createOrganizationOperation, createStripeCheckoutOperation, createStripeCheckoutSessionOperation, createStripePortalOperation, deleteContainerOperation, destroySessionOperation, detachBlobAttachmentOperation, documentSyncOperation, getContainerKekLogOperation, getContainerReplacementAuthorizationsOperation, getContainerWriterProjectionOperation, getDocumentWriterProjectionOperation, getHealthOperation, getMultipartBlobStageOperation, getOrganizationBillingHistoryOperation, getOrganizationBillingManagementUrlOperation, getOrganizationBillingOperation, getOrganizationDataUsageOperation, getOrganizationNativePurchaseEligibilityOperation, getOrganizationReadModelOperation, getRootIdentityOperation, getRootOpsHealthReportOperation, getRootOrganizationDataUsageOperation, getRootOrganizationOperation, getStripeCheckoutOptionsOperation, initiateMultipartBlobStageOperation, liftRootIdentitySuspensionOperation, linkDocumentOperation, listContainerDocumentLanesOperation, listContainerParentLanesOperation, listDocumentAttachmentsOperation, listOrganizationGroupMembersOperation, listOrganizationMembershipsOperation, listRootAuditEventsOperation, listRootDataUsageReportOperation, listRootIdentitiesOperation, listRootIdentityOrganizationsOperation, listRootOrganizationIdentitiesOperation, listRootOrganizationsOperation, listSessionsOperation, logoutOperation, moveContainerOperation, reciteContainerOperation, registerOperation, rekeyContainerOperation, requestOrganizationLeaveOperation, revokeContainerOperation, shareContainerOperation, startOrganizationTrialOperation, suspendRootIdentityOperation, unlinkDocumentOperation, updateOrganizationMembershipOperation, updateOrganizationProfileOperation, updateOrganizationRosterEntryOperation, userIdentityOperation, verifyOperation, withdrawOrganizationLeaveRequestOperation, } from "../validators/operation/index.js";
 import { BoundedCache } from "./ApiCache.js";
+import { verifiedLogin } from "./accountSuspension.js";
 import { ApiRequestRuntime } from "./apiRequestRuntime.js";
 import { getDocumentPurgeProof as readPurgeProof, purgeDocument as submitDocumentPurge, } from "./documentPurge.js";
 import { createOperationTransport, } from "./operationTransportFactory.js";
@@ -239,10 +240,10 @@ export class ApiClient {
     }
     async authenticateWithChallenge(fingerprint, secretKey, challengeHex) {
         const signed = sign(this.requestRuntime.authChallengeBytes(challengeHex, fingerprint), secretKey);
-        const response = await this.transport.request(verifyOperation, {
+        const response = verifiedLogin(await this.transport.requestResult(verifyOperation, {
             body: { fingerprint, signature: Array.from(signed) },
             params: {},
-        }, { retryOnSessionExpired: false });
+        }, { retryOnSessionExpired: false }));
         if (!response?.authenticated)
             return null;
         this.webSocketTickets.rememberLogin(response);
@@ -308,6 +309,9 @@ export class ApiClient {
     listRootAuditEventsResult(query = {}, options = {}) {
         return this.transport.requestResult(listRootAuditEventsOperation, { params: {}, query }, options);
     }
+    getRootOpsHealthReportResult(options = {}) {
+        return this.transport.requestResult(getRootOpsHealthReportOperation, { params: {} }, options);
+    }
     listRootDataUsageReportResult(query = {}, options = {}) {
         return this.transport.requestResult(listRootDataUsageReportOperation, { params: {}, query }, options);
     }
@@ -329,6 +333,16 @@ export class ApiClient {
     listRootIdentityOrganizationsResult(userId, options = {}) {
         return this.transport.requestResult(listRootIdentityOrganizationsOperation, { params: { userId } }, options);
     }
+    suspendRootIdentityResult(userId) {
+        return this.transport.requestResult(suspendRootIdentityOperation, {
+            params: { userId },
+        });
+    }
+    liftRootIdentitySuspensionResult(userId) {
+        return this.transport.requestResult(liftRootIdentitySuspensionOperation, {
+            params: { userId },
+        });
+    }
     getOrganizationDataUsageResult(organizationId, options = {}) {
         return this.requestResult(organizationDataUsage.path(organizationId), organizationDataUsage.isResponse, organizationDataUsage.method, undefined, options, getOrganizationDataUsageOperation);
     }