@7365admin1/core 3.134.0 → 3.136.0

package/dist/index.js

@@ -120,6 +120,8 @@ __export(src_exports, {
   HID_PERMISSION_CATEGORIES: () => HID_PERMISSION_CATEGORIES,
   HID_UINT32_MAX: () => HID_UINT32_MAX,
   HID_UINT64_MAX: () => HID_UINT64_MAX,
+  INVITE_EMAIL_EVENTS: () => INVITE_EMAIL_EVENTS,
+  INVITE_RESEND_MIN_MINUTES: () => INVITE_RESEND_MIN_MINUTES,
   LIFT_DOOR: () => LIFT_DOOR,
   LIFT_LEASE_MS: () => LIFT_LEASE_MS,
   LIFT_MODE: () => LIFT_MODE,
@@ -528,6 +530,9 @@ __export(src_exports, {
   incidentReportLog: () => incidentReportLog,
   incidents_namespace_collection: () => incidents_namespace_collection,
   invitationOffersRole: () => invitationOffersRole,
+  inviteEmailFailureReason: () => inviteEmailFailureReason,
+  inviteEmailStatus: () => inviteEmailStatus,
+  inviteResendWaitMinutes: () => inviteResendWaitMinutes,
   isAvailableForWork: () => isAvailableForWork,
   isCameraEntitled: () => isCameraEntitled,
   isCrossSiteRole: () => isCrossSiteRole,
@@ -916,6 +921,7 @@ __export(src_exports, {
   serviceProviderInviteScope: () => serviceProviderInviteScope,
   serviceProviderInviteViewStatus: () => serviceProviderInviteViewStatus,
   serviceProviderInviterKind: () => serviceProviderInviterKind,
+  serviceProviderNatureFor: () => serviceProviderNatureFor,
   serviceTypeLabel: () => serviceTypeLabel,
   sessionSchema: () => sessionSchema,
   setIO: () => setIO,
@@ -5440,7 +5446,7 @@ function useMemberRepo() {
       throw error;
     }
   }
-  async function updateRoleById(_id, role) {
+  async function updateRoleById(_id, role, createdBy) {
     try {
       _id = new import_mongodb14.ObjectId(_id);
     } catch (error) {
@@ -5456,6 +5462,9 @@ function useMemberRepo() {
         role,
         updatedAt: /* @__PURE__ */ new Date()
       };
+      if (createdBy && import_mongodb14.ObjectId.isValid(String(createdBy))) {
+        updateValue.createdBy = new import_mongodb14.ObjectId(String(createdBy));
+      }
       const res = await collection.updateOne({ _id }, { $set: updateValue });
       if (res.modifiedCount === 0) {
         throw new import_node_server_utils15.InternalServerError("Unable to update feedback status.");
@@ -6088,10 +6097,10 @@ function useAuthService() {
 
 // src/controllers/auth.controller.ts
 var import_joi26 = __toESM(require("joi"));
-var import_node_server_utils63 = require("@7365admin1/node-server-utils");
+var import_node_server_utils64 = require("@7365admin1/node-server-utils");
 
 // src/services/verification.service.ts
-var import_node_server_utils60 = require("@7365admin1/node-server-utils");
+var import_node_server_utils62 = require("@7365admin1/node-server-utils");
 
 // src/models/verification.model.ts
 var import_node_server_utils19 = require("@7365admin1/node-server-utils");
@@ -9757,6 +9766,64 @@ function filterSiteProviderMembers(items, { type = "", company = "", search = ""
     (m) => (!type || m.type === type) && (!company || m.companyId === company) && (!needle || [m.name, m.email, m.company, m.role, m.invitedVia].map((v) => String(v ?? "").toLowerCase()).some((v) => v.includes(needle)))
   );
 }
+var INVITE_EMAIL_EVENTS = ["email-sent", "email-failed"];
+var INVITE_RESEND_MIN_MINUTES = 2;
+function inviteEmailStatus(history) {
+  const last = [...history ?? []].reverse().find((h) => INVITE_EMAIL_EVENTS.includes(h?.action));
+  if (!last)
+    return null;
+  return last.action === "email-sent" ? { state: "sent", at: String(last.at ?? "") } : { state: "failed", at: String(last.at ?? ""), reason: String(last.reason ?? "unknown error") };
+}
+function inviteEmailFailureReason(error) {
+  const code = String(error?.code ?? "").toUpperCase();
+  const smtp = Number(error?.responseCode ?? 0);
+  if (code === "EAUTH")
+    return "the mail server refused Seven365's login";
+  if (code === "ETIMEOUT" || code === "ETIMEDOUT")
+    return "the mail server did not answer in time";
+  if (code === "ECONNECTION" || code === "ESOCKET" || code === "EDNS" || code === "ECONNREFUSED") {
+    return "could not reach the mail server";
+  }
+  if (code === "EENVELOPE" || smtp >= 550 && smtp < 560) {
+    return "the email address was refused - check it is spelled correctly";
+  }
+  if (code === "ETEMPLATE")
+    return "the email could not be prepared";
+  if (smtp >= 400 && smtp < 500)
+    return "the mail server is busy - try Resend in a few minutes";
+  return "the email could not be sent";
+}
+function inviteResendWaitMinutes(history, now = /* @__PURE__ */ new Date()) {
+  const last = inviteEmailStatus(history);
+  if (!last?.at)
+    return 0;
+  const at2 = new Date(last.at).getTime();
+  if (!Number.isFinite(at2))
+    return 0;
+  const left = at2 + INVITE_RESEND_MIN_MINUTES * 6e4 - now.getTime();
+  return left > 0 ? Math.ceil(left / 6e4) : 0;
+}
+var PROVIDER_NATURE_ALIASES = {
+  security: "security_agency",
+  cleaning: "cleaning_services",
+  hygiene: "cleaning_services",
+  "mechanical-electrical": "mechanical_electrical_services",
+  mechanical_electrical: "mechanical_electrical_services",
+  landscape: "landscaping_services",
+  landscaping: "landscaping_services",
+  "pest-control": "pest_control_services",
+  pest_control: "pest_control_services",
+  pool: "pool_maintenance_services",
+  "pool-mgmt": "pool_maintenance_services",
+  pool_maintenance: "pool_maintenance_services"
+};
+function serviceProviderNatureFor(app) {
+  const key = String(app ?? "").trim().toLowerCase();
+  if (!key)
+    return "";
+  const nature = PROVIDER_NATURE_ALIASES[key] ?? key;
+  return nature !== "property_management_agency" && SERVICE_TYPE_LABELS[nature] ? nature : "";
+}
 
 // src/utils/invite-actor.util.ts
 var import_node_server_utils28 = require("@7365admin1/node-server-utils");
@@ -9844,9 +9911,12 @@ async function hasOrgInvitation(userId, orgId) {
   const invite = await db2.collection("verifications").findOne(
     {
       email,
-      type: {
-        $in: ["user-invite", "member-invite", "service-provider-invite"]
-      },
+      // NOT a service-provider invitation: its `metadata.org` is the company
+      // that SENT it, and the invited company joins as its OWN organisation
+      // (accept / accept-new-company). Counting it let an invited provider
+      // enrol into the client's organisation - on production an invitee became
+      // an owner of the property manager that invited them (2026-09-30).
+      type: { $in: ["user-invite", "member-invite"] },
       "metadata.org": { $in: orgCandidates }
     },
     // addresses are stored as typed, so the comparison is case-insensitive.
@@ -9872,7 +9942,8 @@ async function invitationOffersRole(userId, orgId, roleId) {
   const invites = await db2.collection("verifications").find(
     {
       email,
-      type: { $in: ["user-invite", "member-invite", "service-provider-invite"] },
+      // not a service-provider invitation - see `hasOrgInvitation`
+      type: { $in: ["user-invite", "member-invite"] },
       "metadata.org": { $in: [org, new import_mongodb26.ObjectId(org)] },
       status: { $ne: "cancelled" }
     },
@@ -9928,11 +9999,27 @@ async function siteInvitedPins(db2, userId, memberships) {
   const keys = /* @__PURE__ */ new Set();
   if (!pinned.length || !import_mongodb26.ObjectId.isValid(userId))
     return keys;
+  const both3 = (ids2) => [...new Set(ids2.map(String))].flatMap((v) => [v, new import_mongodb26.ObjectId(v)]);
+  const wanted = new Set(pinned.map((m) => pinKey(m.org, m.siteId)));
+  const placed = await db2.collection("members").find(
+    {
+      user: new import_mongodb26.ObjectId(userId),
+      status: { $ne: "deleted" },
+      org: { $in: both3(pinned.map((m) => m.org)) },
+      siteId: { $in: both3(pinned.map((m) => m.siteId)) },
+      createdBy: { $type: "objectId", $ne: new import_mongodb26.ObjectId(userId) }
+    },
+    { projection: { org: 1, siteId: 1 } }
+  ).toArray();
+  for (const row of placed) {
+    const key = pinKey(row.org, row.siteId);
+    if (wanted.has(key))
+      keys.add(key);
+  }
   const user = await db2.collection("users").findOne({ _id: new import_mongodb26.ObjectId(userId) }, { projection: { email: 1 } });
   const email = String(user?.email ?? "").trim();
   if (!email)
     return keys;
-  const both3 = (ids2) => [...new Set(ids2.map(String))].flatMap((v) => [v, new import_mongodb26.ObjectId(v)]);
   const invites = await db2.collection("verifications").find(
     {
       email,
@@ -9948,7 +10035,6 @@ async function siteInvitedPins(db2, userId, memberships) {
       collation: { locale: "en", strength: 2 }
     }
   ).toArray();
-  const wanted = new Set(pinned.map((m) => pinKey(m.org, m.siteId)));
   for (const invite of invites) {
     const key = pinKey(invite.metadata?.org, invite.metadata?.siteId);
     if (wanted.has(key))
@@ -10072,8 +10158,8 @@ async function holdsRole(userId, roleId, orgId) {
 }
 
 // src/services/service-provider-invite.service.ts
-var import_node_server_utils59 = require("@7365admin1/node-server-utils");
-var import_mongodb55 = require("mongodb");
+var import_node_server_utils61 = require("@7365admin1/node-server-utils");
+var import_mongodb56 = require("mongodb");
 
 // src/services/notification.service.ts
 var import_iservice365_expo_notifications = require("iservice365-expo-notifications");
@@ -10967,14 +11053,14 @@ function button(href, label2) {
 }
 function notificationEmail(p) {
   const pause = p.lastThisHour ? `You have had ${EMAIL_PER_MODULE_PER_HOUR} ${p.moduleLabel} emails in the last hour, so we will not email you about ${p.moduleLabel} again for up to an hour. Everything still arrives in the app.` : "";
-  const why = `You are getting this because you turned on email for ${p.moduleLabel} in your iService365 notification settings.`;
+  const why = p.why || `You are getting this because you turned on email for ${p.moduleLabel} in your iService365 notification settings.`;
   const html = frame(`<h2 style="font-size:26px;font-weight:400;margin:0 0 20px">${escapeHtml(p.title)}</h2>
 <p style="font-size:16px;line-height:1.5">${escapeHtml(p.body)}</p>
 ${button(p.openUrl, "Open in iService365")}
 ${pause ? `<p style="font-size:14px;color:#ddd">${escapeHtml(pause)}</p>` : ""}
 <hr style="border:none;border-top:1px solid #333;margin:30px 0 20px" />
 <p style="font-size:13px;color:#bbb"><strong>Why am I getting this?</strong> ${escapeHtml(why)}</p>
-<p style="font-size:13px"><a href="${escapeHtml(p.offUrl)}" style="color:#6cb4ff">Turn off email for ${escapeHtml(p.moduleLabel)}</a> &nbsp;\xB7&nbsp; <a href="${escapeHtml(p.settingsUrl)}" style="color:#6cb4ff">Notification settings</a></p>`);
+<p style="font-size:13px">${p.offUrl ? `<a href="${escapeHtml(p.offUrl)}" style="color:#6cb4ff">Turn off email for ${escapeHtml(p.moduleLabel)}</a> &nbsp;\xB7&nbsp; ` : ""}<a href="${escapeHtml(p.settingsUrl)}" style="color:#6cb4ff">Notification settings</a></p>`);
   const text2 = [
     p.title,
     "",
@@ -10984,7 +11070,7 @@ ${pause ? `<p style="font-size:14px;color:#ddd">${escapeHtml(pause)}</p>` : ""}
     ...pause ? ["", pause] : [],
     "",
     `Why am I getting this? ${why}`,
-    `Turn off email for ${p.moduleLabel}: ${p.offUrl}`,
+    ...p.offUrl ? [`Turn off email for ${p.moduleLabel}: ${p.offUrl}`] : [],
     `Notification settings: ${p.settingsUrl}`
   ].join("\n");
   return { subject: p.title, html, text: text2 };
@@ -12518,6 +12604,8 @@ async function sendNotificationEmails(job) {
     return 0;
   const { emailRecipients, takeEmailSlot } = useNotificationPreferenceRepo();
   const all = await emailRecipients(job.userIds, category.key);
+  if (job.required)
+    return sendRequiredEmails(job, category, all.map((r) => r.userId));
   if (!all.length)
     return 0;
   if (all.length > MAX_RECIPIENTS_PER_NOTIFICATION) {
@@ -12560,6 +12648,36 @@ async function sendNotificationEmails(job) {
   }
   return sent;
 }
+async function sendRequiredEmails(job, category, optedIn) {
+  const skip = new Set(optedIn);
+  const ids2 = job.userIds.filter((id) => !skip.has(String(id)) && import_mongodb34.ObjectId.isValid(String(id))).slice(0, MAX_RECIPIENTS_PER_NOTIFICATION).map((id) => new import_mongodb34.ObjectId(String(id)));
+  if (!ids2.length)
+    return 0;
+  const users = await import_node_server_utils39.useAtlas.getDb()?.collection("users").find({ _id: { $in: ids2 }, deletedAt: { $in: [null, ""] } }, { projection: { email: 1 } }).toArray();
+  const base = webBase();
+  const openUrl = openLink(base, {
+    kind: String(job.data?.params?.kind || notificationKind(job.data, category.key) || ""),
+    id: String(job.data?.params?.id ?? "")
+  });
+  const message = notificationEmail({
+    title: job.title,
+    body: job.body,
+    moduleLabel: category.label,
+    openUrl,
+    settingsUrl: `${base}/notification-settings`,
+    why: job.required?.why
+  });
+  let sent = 0;
+  for (const u of users ?? []) {
+    const to = String(u.email ?? "").trim();
+    if (!to)
+      continue;
+    const tag2 = `user=${u._id} category=${category.key} required`;
+    if (await deliverEmail(to, message, tag2) === "sent")
+      sent++;
+  }
+  return sent;
+}
 var queue = [];
 var draining = null;
 async function drain() {
@@ -12719,20 +12837,25 @@ var NotificationService = class {
     const staff = await staffRecipients();
     if (!staff.length)
       return;
-    await send(
-      staff,
-      "Service provider invitation to approve",
-      payload.subcontract ? `${payload.inviterOrgName} (a service provider) wants to bring in another service provider at ${payload.siteName}.` : `${payload.inviterOrgName} invited a service provider to ${payload.siteName}.`,
-      {
-        module: "platform",
-        kind: "spApproval",
-        screen: "",
-        params: { id: payload.invitationId.toString() }
-      },
-      false,
-      void 0,
-      "platform"
-    );
+    const title = "Service provider invitation to approve";
+    const body = `${payload.subcontract ? `${payload.inviterOrgName} (a service provider) wants to bring in another service provider at ${payload.siteName}.` : `${payload.inviterOrgName} invited a service provider to ${payload.siteName}.`} The invitation email is sent only after a Seven365 administrator approves it in SP Approvals.`;
+    const data = {
+      module: "platform",
+      kind: "spApproval",
+      screen: "",
+      params: { id: payload.invitationId.toString() }
+    };
+    await send(staff, title, body, data, false, void 0, "platform");
+    queueNotificationEmails({
+      userIds: staff,
+      category: "platform",
+      title,
+      body,
+      data: withNotificationKind(data, "platform"),
+      required: {
+        why: "You are getting this because you are a Seven365 administrator and this invitation waits for your approval."
+      }
+    });
   }
   static async clientInvitationAccepted(payload) {
     const staff = await staffRecipients();
@@ -24220,8 +24343,570 @@ async function requireRoleAssigner(req, orgId) {
   throw new import_node_server_utils58.UnauthorizedError("You do not have permission to assign roles.");
 }
 
+// src/repositories/role.repo.ts
+var import_node_server_utils59 = require("@7365admin1/node-server-utils");
+var import_mongodb55 = require("mongodb");
+var HISTORY_LIMIT = 10;
+function useRoleRepo() {
+  const db2 = import_node_server_utils59.useAtlas.getDb();
+  if (!db2) {
+    throw new import_node_server_utils59.InternalServerError("Unable to connect to server.");
+  }
+  const namespace_collection3 = "roles";
+  const collection = db2.collection(namespace_collection3);
+  async function createIndex() {
+    try {
+      await collection.createIndexes([
+        { key: { name: 1 } },
+        { key: { type: 1 } },
+        { key: { status: 1 } }
+      ]);
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to create index on role.");
+    }
+  }
+  async function createTextIndex() {
+    try {
+      await collection.createIndex({ name: "text" });
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to create text index on role.");
+    }
+  }
+  async function createUniqueIndex() {
+    try {
+      await collection.createIndex(
+        { name: 1, type: 1, org: 1, deletedAt: 1 },
+        { unique: true }
+      );
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to create unique index on role.");
+    }
+  }
+  const { delNamespace, setCache, getCache } = (0, import_node_server_utils59.useCache)(namespace_collection3);
+  const { delNamespace: _delDashboardNameSpace } = (0, import_node_server_utils59.useCache)("dashboard");
+  async function nameTakenMessage(value) {
+    const name = String(value?.name ?? "");
+    const fallback = `A role named "${name}" already exists in this organisation. Please choose a different name.`;
+    try {
+      const clash = await collection.findOne(
+        {
+          name,
+          type: value.type,
+          org: value.org,
+          deletedAt: value.deletedAt ?? ""
+        },
+        { projection: { site: 1 } }
+      );
+      if (!clash)
+        return fallback;
+      if (!clash.site) {
+        return `A role named "${name}" already exists for the whole organisation. Role names must be different across the organisation and all its sites - please choose a different name.`;
+      }
+      const siteName = async (id) => {
+        if (!id)
+          return "";
+        const doc = await db2?.collection("sites").findOne(
+          { _id: new import_mongodb55.ObjectId(String(id)) },
+          { projection: { name: 1 } }
+        ).catch(() => null);
+        return doc?.name ?? "";
+      };
+      if (value.site && String(value.site) === String(clash.site)) {
+        return `A role named "${name}" already exists at this site. Please choose a different name.`;
+      }
+      const [there, here] = await Promise.all([siteName(clash.site), siteName(value.site)]);
+      const suggestion = here ? `, for example "${name} - ${here}"` : "";
+      return `A role named "${name}" already exists in this organisation${there ? ` at ${there}` : " at another site"}. Role names must be different across all your sites - please choose a different name${suggestion}.`;
+    } catch {
+      return fallback;
+    }
+  }
+  async function addRole(value, session) {
+    value = new MRole({ ...value, type: serviceAppType(value.type) });
+    try {
+      const res = await collection.insertOne(value, { session });
+      delNamespace().then(() => {
+        import_node_server_utils59.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
+      }).catch((err) => {
+        import_node_server_utils59.logger.error(
+          `Failed to clear cache for namespace: ${namespace_collection3}`,
+          err
+        );
+      });
+      return res.insertedId;
+    } catch (error) {
+      import_node_server_utils59.logger.log({ level: "error", message: `${error}` });
+      const isDuplicated = error.message.includes("duplicate");
+      if (isDuplicated) {
+        throw new import_node_server_utils59.BadRequestError(await nameTakenMessage(value));
+      }
+      throw new import_node_server_utils59.InternalServerError("Failed to create role.");
+    }
+  }
+  async function getRoleByUserId(value) {
+    try {
+      value = new import_mongodb55.ObjectId(value);
+    } catch (error) {
+      throw new import_node_server_utils59.BadRequestError("Invalid user ID format.");
+    }
+    try {
+      const cacheKey = (0, import_node_server_utils59.makeCacheKey)(namespace_collection3, { user: value });
+      const cachedData = await getCache(cacheKey);
+      if (cachedData) {
+        import_node_server_utils59.logger.info(`Cache hit for key: ${cacheKey}`);
+        return cachedData;
+      }
+      const data = await collection.findOne({ user: value });
+      setCache(cacheKey, data, 15 * 60).then(() => {
+        import_node_server_utils59.logger.info(`Cache set for key: ${cacheKey}`);
+      }).catch((err) => {
+        import_node_server_utils59.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+      });
+      return data;
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to retrieve role by user ID.");
+    }
+  }
+  async function getOwnerRolesByTypeOrg(type, org) {
+    try {
+      org = new import_mongodb55.ObjectId(org);
+    } catch (error) {
+      throw new import_node_server_utils59.BadRequestError("Invalid organization ID format.");
+    }
+    const cacheOptions = {
+      org: org.toString(),
+      permissions: "*",
+      type,
+      status: "active"
+    };
+    const cacheKey = (0, import_node_server_utils59.makeCacheKey)(namespace_collection3, cacheOptions);
+    const cachedData = await getCache(cacheKey);
+    if (cachedData) {
+      import_node_server_utils59.logger.info(`Cache hit for key: ${cacheKey}`);
+      return cachedData;
+    }
+    try {
+      const data = await collection.find({ org, permissions: "*", type: appTypeQuery(type), status: "active" }).toArray();
+      setCache(cacheKey, data, 15 * 60).then(() => {
+        import_node_server_utils59.logger.info(`Cache set for key: ${cacheKey}`);
+      }).catch((err) => {
+        import_node_server_utils59.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+      });
+      return data;
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to retrieve role by user ID.");
+    }
+  }
+  async function getRoleById(_id) {
+    try {
+      _id = new import_mongodb55.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils59.BadRequestError("Invalid role ID format.");
+    }
+    try {
+      const cacheKey = (0, import_node_server_utils59.makeCacheKey)(namespace_collection3, { _id });
+      const cachedData = await getCache(cacheKey);
+      if (cachedData) {
+        import_node_server_utils59.logger.info(`Cache hit for key: ${cacheKey}`);
+        return cachedData;
+      }
+      const data = await collection.findOne({ _id });
+      setCache(cacheKey, data, 15 * 60).then(() => {
+        import_node_server_utils59.logger.info(`Cache set for key: ${cacheKey}`);
+      }).catch((err) => {
+        import_node_server_utils59.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+      });
+      return data;
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to retrieve role by ID.");
+    }
+  }
+  async function getRoleByName(name, type) {
+    if (!name) {
+      throw new import_node_server_utils59.BadRequestError("Role name is required.");
+    }
+    type = serviceAppType(type);
+    const query2 = type ? { name, type: appTypeQuery(type) } : { name };
+    try {
+      const cacheKey = (0, import_node_server_utils59.makeCacheKey)(namespace_collection3, query2);
+      const cachedData = await getCache(cacheKey);
+      if (cachedData) {
+        import_node_server_utils59.logger.info(`Cache hit for key: ${cacheKey}`);
+        return cachedData;
+      }
+      const data = await collection.findOne(query2);
+      setCache(cacheKey, data, 15 * 60).then(() => {
+        import_node_server_utils59.logger.info(`Cache set for key: ${cacheKey}`);
+      }).catch((err) => {
+        import_node_server_utils59.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+      });
+      return data;
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to retrieve role by name.");
+    }
+  }
+  async function getRoles({
+    search = "",
+    page: page2 = 1,
+    limit = 10,
+    sort = {},
+    type = "",
+    org = "",
+    site = "",
+    scope = ""
+  }) {
+    page2 = page2 > 0 ? page2 - 1 : 0;
+    if (org && typeof org === "string" && org.length === 24) {
+      try {
+        org = new import_mongodb55.ObjectId(org);
+      } catch (error) {
+        throw new import_node_server_utils59.BadRequestError("Invalid organization ID format.");
+      }
+    }
+    if (site && typeof site === "string" && site.length === 24) {
+      try {
+        site = new import_mongodb55.ObjectId(site);
+      } catch (error) {
+        throw new import_node_server_utils59.BadRequestError("Invalid site ID format.");
+      }
+    }
+    const query2 = { status: "active", org };
+    const cacheOptions = { status: "active", org };
+    if (site) {
+      query2.$or = [{ site }, { site: "" }, { site: null }];
+      cacheOptions.site = site.toString();
+    } else if (scope === "organisation") {
+      query2.site = { $in: ["", null] };
+      cacheOptions.scope = scope;
+    }
+    sort = Object.keys(sort).length > 0 ? sort : { _id: -1 };
+    cacheOptions.sort = JSON.stringify(sort);
+    if (search) {
+      query2.$text = { $search: search };
+      cacheOptions.search = search;
+    }
+    if (type) {
+      query2.type = appTypeQuery(type);
+      cacheOptions.type = serviceAppType(type);
+    }
+    const cacheKey = (0, import_node_server_utils59.makeCacheKey)(namespace_collection3, cacheOptions);
+    const cachedData = await getCache(cacheKey);
+    if (cachedData) {
+      import_node_server_utils59.logger.info(`Cache hit for key: ${cacheKey}`);
+      return cachedData;
+    }
+    try {
+      const items = await collection.aggregate([
+        { $match: query2 },
+        { $sort: sort },
+        { $skip: page2 * limit },
+        { $limit: limit }
+      ]).toArray();
+      const length = await collection.countDocuments(query2);
+      const data = (0, import_node_server_utils59.paginate)(items, page2, limit, length);
+      setCache(cacheKey, data, 15 * 60).then(() => {
+        import_node_server_utils59.logger.info(`Cache set for key: ${cacheKey}`);
+      }).catch((err) => {
+        import_node_server_utils59.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+      });
+      return data;
+    } catch (error) {
+      import_node_server_utils59.logger.log({ level: "error", message: `${error}` });
+      throw error;
+    }
+  }
+  async function getActiveByTypeOrg(type, org) {
+    try {
+      if (typeof org === "string" && org) {
+        org = new import_mongodb55.ObjectId(org);
+      }
+    } catch (error) {
+      throw new import_node_server_utils59.BadRequestError("Invalid organization ID format.");
+    }
+    try {
+      return await collection.find({ status: "active", type, org }).sort({ name: 1 }).toArray();
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to retrieve replacement roles.");
+    }
+  }
+  async function assertNotSeededOwnerRole(_id) {
+    const role = await collection.findOne(
+      { _id },
+      { projection: { type: 1, default: 1 } }
+    );
+    if (role?.type === PLATFORM_STAFF_ROLE_TYPE && role?.default === true) {
+      throw new import_node_server_utils59.BadRequestError(
+        "The Seven365 platform owner role cannot be edited or deleted."
+      );
+    }
+  }
+  async function updateRole(_id, value, session) {
+    if (!_id) {
+      throw new import_node_server_utils59.BadRequestError("Role ID is required.");
+    }
+    try {
+      _id = new import_mongodb55.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils59.BadRequestError("Invalid role ID format.");
+    }
+    await assertNotSeededOwnerRole(_id);
+    if (!value.name) {
+      delete value.name;
+    }
+    if (!value.permissions) {
+      delete value.permissions;
+    }
+    if (value.name || value.permissions) {
+      try {
+        await collection.updateOne({ _id }, { $set: value }, { session });
+        delNamespace().then(() => {
+          import_node_server_utils59.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
+        }).catch((err) => {
+          import_node_server_utils59.logger.error(
+            `Failed to clear cache for namespace: ${namespace_collection3}`,
+            err
+          );
+        });
+        return _id;
+      } catch (error) {
+        const isDuplicated = error.message.includes("duplicate");
+        if (isDuplicated) {
+          const current = await collection.findOne({ _id }, { projection: { type: 1, org: 1, site: 1, deletedAt: 1 } }).catch(() => null);
+          throw new import_node_server_utils59.BadRequestError(
+            await nameTakenMessage({ ...current ?? {}, name: value.name })
+          );
+        }
+        throw new import_node_server_utils59.InternalServerError("Failed to update role.");
+      }
+    } else {
+      throw new import_node_server_utils59.BadRequestError("No fields to update.");
+    }
+  }
+  async function updatePermissionsById(_id, permissions, session) {
+    if (!_id) {
+      throw new import_node_server_utils59.BadRequestError("Role ID is required.");
+    }
+    try {
+      _id = new import_mongodb55.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils59.BadRequestError("Invalid role ID format.");
+    }
+    await assertNotSeededOwnerRole(_id);
+    if (!permissions) {
+      throw new import_node_server_utils59.BadRequestError("Permissions are required.");
+    }
+    if (permissions.length === 0) {
+      throw new import_node_server_utils59.BadRequestError("Permissions cannot be empty.");
+    }
+    try {
+      await collection.updateOne(
+        { _id },
+        { $set: { permissions } },
+        { session }
+      );
+      delNamespace().then(() => {
+        import_node_server_utils59.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
+      }).catch((err) => {
+        import_node_server_utils59.logger.error(
+          `Failed to clear cache for namespace: ${namespace_collection3}`,
+          err
+        );
+      });
+      return "Successfully updated role permissions.";
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to update role permissions.");
+    }
+  }
+  async function appendPermissionHistory(_id, entry, session) {
+    try {
+      _id = new import_mongodb55.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils59.BadRequestError("Invalid role ID format.");
+    }
+    await collection.updateOne(
+      { _id },
+      // cast: the collection's generic has no `permissionHistory` in its
+      // `PushOperator`, because the field is new and optional. The operator
+      // itself is ordinary `$push`/`$slice`.
+      { $push: { permissionHistory: { $each: [entry], $slice: -HISTORY_LIMIT } } },
+      { session }
+    );
+    delNamespace().then(() => {
+      import_node_server_utils59.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
+    }).catch((err) => {
+      import_node_server_utils59.logger.error(
+        `Failed to clear cache for namespace: ${namespace_collection3}`,
+        err
+      );
+    });
+  }
+  async function deleteRole(_id, session) {
+    try {
+      _id = new import_mongodb55.ObjectId(_id);
+    } catch (error) {
+      throw new import_node_server_utils59.BadRequestError("Invalid role ID format.");
+    }
+    await assertNotSeededOwnerRole(_id);
+    try {
+      const updateValue = {
+        status: "deleted",
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        deletedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const res = await collection.updateOne(
+        { _id },
+        { $set: updateValue },
+        { session }
+      );
+      if (res.modifiedCount === 0) {
+        throw new import_node_server_utils59.InternalServerError("Unable to update role status.");
+      }
+      delNamespace().then(() => {
+        import_node_server_utils59.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
+      }).catch((err) => {
+        import_node_server_utils59.logger.error(
+          `Failed to clear cache for namespace: ${namespace_collection3}`,
+          err
+        );
+      });
+      _delDashboardNameSpace().then(() => {
+        import_node_server_utils59.logger.info(`Cache cleared for namespace: dashboard`);
+      }).catch((err) => {
+        import_node_server_utils59.logger.error(`Failed to clear cache for namespace: dashboard`, err);
+      });
+      return "Successfully deleted role permission.";
+    } catch (error) {
+      throw new import_node_server_utils59.InternalServerError("Failed to delete role.");
+    }
+  }
+  return {
+    createIndex,
+    createTextIndex,
+    createUniqueIndex,
+    addRole,
+    getRoleByUserId,
+    getRoleById,
+    getRoleByName,
+    getRoles,
+    getActiveByTypeOrg,
+    updateRole,
+    updatePermissionsById,
+    appendPermissionHistory,
+    deleteRole,
+    getOwnerRolesByTypeOrg
+  };
+}
+
+// src/utils/org-default-roles.util.ts
+var import_node_server_utils60 = require("@7365admin1/node-server-utils");
+var APP_SERVICE_TYPES = new Set(
+  Object.values(AppServiceType)
+);
+var ADMINISTRATOR_PERMISSIONS = Object.freeze([
+  "members:view-members",
+  "members:assign-member-role",
+  "members:suspend-member",
+  "members:activate-member",
+  "members:delete-member",
+  "invitations:create-invitation",
+  "invitations:view-invitations",
+  "invitations:cancel-invitation",
+  "roles:see-all-roles",
+  "roles:see-role-details",
+  "roles:add-role",
+  "roles:update-role",
+  "roles:delete-role"
+]);
+function defaultOwnerRoles(org, nature, appOwnerPermissions) {
+  if (!org?.toString())
+    return [];
+  const owner = {
+    org,
+    name: "owner",
+    permissions: ["*"],
+    default: true
+  };
+  const administrator = {
+    org,
+    name: "Administrator",
+    permissions: [...ADMINISTRATOR_PERMISSIONS],
+    default: true
+  };
+  const roles = [
+    { ...owner, type: "organization" },
+    { ...administrator, type: "organization" }
+  ];
+  const appType = serviceAppType(nature);
+  if (appType && APP_SERVICE_TYPES.has(appType)) {
+    roles.push({
+      ...owner,
+      type: appType,
+      ...appOwnerPermissions?.length && { permissions: [...appOwnerPermissions] }
+    });
+    roles.push({ ...administrator, type: appType });
+  }
+  return roles;
+}
+async function seedDefaultOrgRoles(addRole, org, nature, appOwnerPermissions) {
+  const seeded = [];
+  try {
+    for (const role of defaultOwnerRoles(org, nature, appOwnerPermissions)) {
+      const id = await addRole(role);
+      if (id)
+        seeded.push({ type: String(role.type), id: String(id), name: role.name });
+    }
+  } catch (error) {
+    import_node_server_utils60.logger.log({
+      level: "error",
+      message: `Failed to seed default roles for organization ${org}: ${error?.message}`
+    });
+  }
+  return seeded;
+}
+async function healOrgDefaultRoles(deps, org) {
+  if (!org?.toString())
+    return 0;
+  let claimed = false;
+  try {
+    claimed = await deps.claim(org);
+    if (!claimed)
+      return 0;
+    const existing = await deps.countRoles(org);
+    if (existing > 0) {
+      import_node_server_utils60.logger.log({
+        level: "info",
+        message: `Default role self-heal skipped for organization ${org}: ${existing} role(s) already present`
+      });
+      return 0;
+    }
+    const roles = defaultOwnerRoles(org, await deps.getNature(org));
+    for (const role of roles) {
+      await deps.addRole(role);
+    }
+    import_node_server_utils60.logger.log({
+      level: "info",
+      message: `Seeded ${roles.length} default role(s) for existing organization ${org} on read`
+    });
+    return roles.length;
+  } catch (error) {
+    if (claimed) {
+      await deps.release(org).catch(() => void 0);
+    }
+    import_node_server_utils60.logger.log({
+      level: "error",
+      message: `Failed to self-heal default roles for organization ${org}: ${error?.message}`
+    });
+    return 0;
+  }
+}
+function clientInviteOwnerPermissionsOn(env2 = process.env) {
+  const value = String(env2.CLIENT_INVITE_OWNER_PERMISSIONS ?? "on").trim().toLowerCase();
+  return !["off", "false", "0", "no"].includes(value);
+}
+
 // src/services/service-provider-invite.service.ts
 var INVITE_VALID_HOURS = 72;
+var INVITE_EMAIL_TIMEOUT_MS = 3e4;
 async function siteClientOrgs(siteId, pmMemberOrgIds = []) {
   const site = await useSiteRepo().getSiteById(siteId).catch(() => null);
   const owner = String(site?.orgId ?? site?.org ?? "");
@@ -24259,11 +24944,11 @@ async function assertServiceProviderInviteScope(actor, orgId, siteId) {
     )
   });
   if (!scope.ok)
-    throw new import_node_server_utils59.UnauthorizedError(scope.reason);
+    throw new import_node_server_utils61.UnauthorizedError(scope.reason);
   return { sender: scope.sender, siteOwnerOrg };
 }
 function useServiceProviderInviteService() {
-  const mailer2 = new import_node_server_utils59.useMailer({
+  const mailer2 = new import_node_server_utils61.useMailer({
     host: MAILER_TRANSPORT_HOST,
     port: MAILER_TRANSPORT_PORT,
     secure: MAILER_TRANSPORT_SECURE,
@@ -24277,13 +24962,18 @@ function useServiceProviderInviteService() {
     getServiceProviderInvites: _list,
     countServiceProviderInvitesAwaitingApproval: _countAwaiting
   } = useVerificationRepoV2();
-  const { getById: getOrgById, getByEmail: getOrgByEmail } = useOrgRepo();
+  const {
+    getById: getOrgById,
+    getByEmail: getOrgByEmail,
+    add: addOrg,
+    getByCreatorAndNature
+  } = useOrgRepo();
   const { getUserByEmail, getUserById } = useUserRepo();
   function event(action, actor, reason) {
     return {
       action,
       at: (/* @__PURE__ */ new Date()).toISOString(),
-      by: actor.id ? new import_mongodb55.ObjectId(actor.id) : null,
+      by: actor.id ? new import_mongodb56.ObjectId(actor.id) : null,
       byName: actor.name,
       ...reason ? { reason } : {}
     };
@@ -24319,36 +25009,81 @@ function useServiceProviderInviteService() {
         });
       }
     } catch (error) {
-      import_node_server_utils59.logger.log({
+      import_node_server_utils61.logger.log({
         level: "error",
         message: `Invitation in-app notification failed: ${error?.message}`
       });
     }
-    const filePath = (0, import_node_server_utils59.getDirectory)(
-      __dirname,
-      `./public/handlebars/${invite.type}`
+    let result;
+    let timer;
+    try {
+      let emailContent;
+      try {
+        const filePath = (0, import_node_server_utils61.getDirectory)(
+          __dirname,
+          `./public/handlebars/${invite.type}`
+        );
+        emailContent = (0, import_node_server_utils61.compileHandlebar)({
+          context: {
+            email,
+            orgName,
+            siteName,
+            validity: VERIFICATION_USER_INVITE_DURATION,
+            link: `${APP_MAIN}/verify/service-provider-invite/${inviteId}`
+          },
+          filePath
+        });
+      } catch (error) {
+        throw Object.assign(new Error("template"), { code: "ETEMPLATE" });
+      }
+      await Promise.race([
+        mailer2.sendMail({
+          to: email,
+          subject: invite.type === SERVICE_PROVIDER_SIGN_IN_TYPE ? SERVICE_PROVIDER_SIGN_IN_SUBJECT : SERVICE_PROVIDER_SIGN_UP_SUBJECT,
+          html: emailContent,
+          sender: "iService365" /* ISERVICE365 */
+        }),
+        new Promise((_, reject2) => {
+          timer = setTimeout(
+            () => reject2(Object.assign(new Error("timeout"), { code: "ETIMEOUT" })),
+            INVITE_EMAIL_TIMEOUT_MS
+          );
+        })
+      ]);
+      result = { sent: true };
+      import_node_server_utils61.logger.log({ level: "info", message: `[sp-invite-email] sent invite=${inviteId}` });
+    } catch (error) {
+      result = { sent: false, reason: inviteEmailFailureReason(error) };
+      import_node_server_utils61.logger.log({
+        level: "error",
+        message: `[sp-invite-email] failed invite=${inviteId} code=${error?.code || error?.responseCode || error?.name || "error"}`
+      });
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+    }
+    await _transition({
+      id: inviteId,
+      from: [],
+      event: {
+        action: result.sent ? "email-sent" : "email-failed",
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        by: null,
+        byName: "system",
+        ...result.reason ? { reason: result.reason } : {}
+      }
+    }).catch(
+      (error) => import_node_server_utils61.logger.log({
+        level: "error",
+        message: `[sp-invite-email] could not record the result invite=${inviteId}: ${error?.name || "error"}`
+      })
     );
-    const emailContent = (0, import_node_server_utils59.compileHandlebar)({
-      context: {
-        email,
-        orgName,
-        siteName,
-        validity: VERIFICATION_USER_INVITE_DURATION,
-        link: `${APP_MAIN}/verify/service-provider-invite/${inviteId}`
-      },
-      filePath
-    });
-    await mailer2.sendMail({
-      to: email,
-      subject: invite.type === SERVICE_PROVIDER_SIGN_IN_TYPE ? SERVICE_PROVIDER_SIGN_IN_SUBJECT : SERVICE_PROVIDER_SIGN_UP_SUBJECT,
-      html: emailContent,
-      sender: "iService365" /* ISERVICE365 */
-    });
+    return result;
   }
   async function load(id) {
     const invite = await _getById(id);
     if (!invite)
-      throw new import_node_server_utils59.NotFoundError("Invitation not found.");
+      throw new import_node_server_utils61.NotFoundError("Invitation not found.");
     return invite;
   }
   function assertOwnerOrSuperAdmin(actor, invite) {
@@ -24357,13 +25092,13 @@ function useServiceProviderInviteService() {
     const org = inviteOrgId(invite);
     if (org && actor.orgIds.includes(org))
       return;
-    throw new import_node_server_utils59.UnauthorizedError(
+    throw new import_node_server_utils61.UnauthorizedError(
       "This invitation belongs to another organisation."
     );
   }
   function assertSuperAdmin(actor) {
     if (!staffMayBypass(actor)) {
-      throw new import_node_server_utils59.UnauthorizedError(
+      throw new import_node_server_utils61.UnauthorizedError(
         "Only a Seven365 administrator can approve or reject invitations."
       );
     }
@@ -24371,12 +25106,12 @@ function useServiceProviderInviteService() {
   function assertAllowed(action, invite) {
     const refusal = refuseServiceProviderInviteAction(action, invite.status);
     if (refusal)
-      throw new import_node_server_utils59.BadRequestError(refusal);
+      throw new import_node_server_utils61.BadRequestError(refusal);
   }
   async function actorFor(userId) {
     const actor = await resolveInviteActor(userId);
     if (!actor.id)
-      throw new import_node_server_utils59.UnauthorizedError("Sign in to continue.");
+      throw new import_node_server_utils61.UnauthorizedError("Sign in to continue.");
     return actor;
   }
   async function listApprovals({
@@ -24439,7 +25174,8 @@ function useServiceProviderInviteService() {
           inviterOrgName,
           inviterKind: fromClient ? "property-management" : serviceProviderInviterKind(inviterOrg, siteOwnerOrg),
           siteOwnerName,
-          service: String(invite.metadata?.app ?? "")
+          service: String(invite.metadata?.app ?? ""),
+          emailStatus: inviteEmailStatus(invite.history)
         };
       })
     );
@@ -24457,7 +25193,7 @@ function useServiceProviderInviteService() {
     let scope = actor.orgIds;
     if (orgId) {
       if (!staffMayBypass(actor) && !actor.orgIds.includes(orgId)) {
-        throw new import_node_server_utils59.UnauthorizedError(
+        throw new import_node_server_utils61.UnauthorizedError(
           "You are not a member of that organisation."
         );
       }
@@ -24546,7 +25282,9 @@ function useServiceProviderInviteService() {
       answeredAt: status === "expired" ? invite.expireAt ?? null : status === "pending" || status === "awaiting-approval" /* AWAITING_APPROVAL */ ? null : answer?.at ?? invite.updatedAt ?? null,
       contactEmail,
       contactPhone,
-      onSite
+      onSite,
+      // Did the invitation email go out, and if not, why (latest attempt).
+      emailStatus: inviteEmailStatus(history)
     };
   }
   async function approvalCount({ userId }) {
@@ -24578,13 +25316,23 @@ function useServiceProviderInviteService() {
     if (!updated) {
       return { message: "This invitation has already been approved." };
     }
-    await notifyProvider(updated);
+    const email = await notifyProvider(updated);
+    if (!email.sent) {
+      return {
+        message: `Invitation approved, but the email could not be sent: ${email.reason}. Use Resend on the invitation to try again.`,
+        emailSent: false,
+        emailError: email.reason
+      };
+    }
     await _transition({
       id,
       from: [],
       event: event("provider-notified", actor)
     });
-    return { message: "Invitation approved. The service provider has been notified." };
+    return {
+      message: "Invitation approved. The invitation email has been sent to the service provider.",
+      emailSent: true
+    };
   }
   async function reject({
     id,
@@ -24595,7 +25343,7 @@ function useServiceProviderInviteService() {
     assertSuperAdmin(actor);
     const trimmed = String(reason ?? "").trim();
     if (!trimmed) {
-      throw new import_node_server_utils59.BadRequestError(
+      throw new import_node_server_utils61.BadRequestError(
         "Give a reason for not approving this invitation. Whoever sent it will see it."
       );
     }
@@ -24639,6 +25387,12 @@ function useServiceProviderInviteService() {
     const invite = await load(id);
     assertOwnerOrSuperAdmin(actor, invite);
     assertAllowed("resend", invite);
+    const wait = inviteResendWaitMinutes(invite.history);
+    if (wait > 0) {
+      throw new import_node_server_utils61.BadRequestError(
+        `The invitation email was sent moments ago. You can resend it in ${wait} minute${wait === 1 ? "" : "s"}.`
+      );
+    }
     const expireAt = new Date(
       Date.now() + INVITE_VALID_HOURS * 60 * 60 * 1e3
     ).toISOString();
@@ -24649,12 +25403,17 @@ function useServiceProviderInviteService() {
       set: { expireAt }
     });
     if (!updated) {
-      throw new import_node_server_utils59.BadRequestError(
+      throw new import_node_server_utils61.BadRequestError(
         refuseServiceProviderInviteAction("resend", invite.status) ?? "This invitation cannot be sent again."
       );
     }
-    await notifyProvider(updated);
-    return { message: "Invitation sent again." };
+    const email = await notifyProvider(updated);
+    if (!email.sent) {
+      throw new import_node_server_utils61.BadRequestError(
+        `The invitation email could not be sent: ${email.reason}.`
+      );
+    }
+    return { message: "Invitation email sent again.", emailSent: true };
   }
   async function softDelete({ id, userId }) {
     const actor = await actorFor(userId);
@@ -24669,7 +25428,7 @@ function useServiceProviderInviteService() {
       event: event("deleted", actor),
       set: {
         deletedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        deletedBy: actor.id ? new import_mongodb55.ObjectId(actor.id) : null
+        deletedBy: actor.id ? new import_mongodb56.ObjectId(actor.id) : null
       }
     });
     if (!updated) {
@@ -24685,7 +25444,7 @@ function useServiceProviderInviteService() {
     );
     const invitedUserId = user?._id?.toString();
     if (!invitedUserId || invitedUserId !== userId) {
-      throw new import_node_server_utils59.UnauthorizedError("This invitation was sent to someone else.");
+      throw new import_node_server_utils61.UnauthorizedError("This invitation was sent to someone else.");
     }
   }
   async function decline({ id, userId }) {
@@ -24696,11 +25455,11 @@ function useServiceProviderInviteService() {
       return { message: "You have already declined this invitation." };
     }
     if (invite.deletedAt) {
-      throw new import_node_server_utils59.BadRequestError("This invitation is no longer valid.");
+      throw new import_node_server_utils61.BadRequestError("This invitation is no longer valid.");
     }
     assertAllowed("decline", invite);
     if (isServiceProviderInviteExpired(invite)) {
-      throw new import_node_server_utils59.BadRequestError(SERVICE_PROVIDER_INVITE_EXPIRED_MESSAGE);
+      throw new import_node_server_utils61.BadRequestError(SERVICE_PROVIDER_INVITE_EXPIRED_MESSAGE);
     }
     const updated = await _transition({
       id,
@@ -24729,16 +25488,16 @@ function useServiceProviderInviteService() {
     if (![SERVICE_PROVIDER_SIGN_IN_TYPE, SERVICE_PROVIDER_SIGN_UP_TYPE].includes(
       String(invite.type ?? "")
     )) {
-      throw new import_node_server_utils59.NotFoundError("Invitation not found.");
+      throw new import_node_server_utils61.NotFoundError("Invitation not found.");
     }
     if (invite.status === "awaiting-approval" /* AWAITING_APPROVAL */) {
-      throw new import_node_server_utils59.NotFoundError("Invitation not found.");
+      throw new import_node_server_utils61.NotFoundError("Invitation not found.");
     }
     if (invite.deletedAt) {
-      throw new import_node_server_utils59.BadRequestError("This invitation is no longer valid. Ask for a new one.");
+      throw new import_node_server_utils61.BadRequestError("This invitation is no longer valid. Ask for a new one.");
     }
     if (isServiceProviderInviteExpired(invite)) {
-      throw new import_node_server_utils59.BadRequestError(SERVICE_PROVIDER_INVITE_EXPIRED_MESSAGE);
+      throw new import_node_server_utils61.BadRequestError(SERVICE_PROVIDER_INVITE_EXPIRED_MESSAGE);
     }
     let result;
     try {
@@ -24758,6 +25517,207 @@ function useServiceProviderInviteService() {
       await notifyInviter(invite, true, result.providerOrgName);
     return { message: result.message };
   }
+  async function acceptAsNewCompany({
+    id,
+    userId,
+    companyName,
+    country
+  }) {
+    const actor = await actorFor(userId);
+    const invite = await load(id);
+    await assertInvitedParty(actor.id, invite);
+    if (![SERVICE_PROVIDER_SIGN_IN_TYPE, SERVICE_PROVIDER_SIGN_UP_TYPE].includes(
+      String(invite.type ?? "")
+    ) || invite.status === "awaiting-approval" /* AWAITING_APPROVAL */) {
+      throw new import_node_server_utils61.NotFoundError("Invitation not found.");
+    }
+    if (invite.deletedAt) {
+      throw new import_node_server_utils61.BadRequestError("This invitation is no longer valid. Ask for a new one.");
+    }
+    if (isServiceProviderInviteExpired(invite)) {
+      throw new import_node_server_utils61.BadRequestError(SERVICE_PROVIDER_INVITE_EXPIRED_MESSAGE);
+    }
+    if (invite.status !== "pending" /* PENDING */) {
+      throw new import_node_server_utils61.BadRequestError(
+        refuseServiceProviderInviteAction("accept", invite.status) ?? "This invitation cannot be accepted."
+      );
+    }
+    const nature = serviceProviderNatureFor(invite.metadata?.app);
+    if (!nature) {
+      throw new import_node_server_utils61.BadRequestError(
+        "This invitation does not say which service your company provides. Ask the sender for a new one."
+      );
+    }
+    const existing = await getByCreatorAndNature(actor.id, nature).catch(() => null);
+    if (existing) {
+      throw new import_node_server_utils61.BadRequestError(
+        `You already have a ${serviceTypeLabel(nature)} company on iService365 (${existing.name}). Accept the invitation from that company instead.`
+      );
+    }
+    const user = await getUserById(actor.id).catch(() => null);
+    const name = String(companyName ?? "").trim() || String(invite.metadata?.name ?? "").trim() || String(user?.name ?? "").trim();
+    if (!name)
+      throw new import_node_server_utils61.BadRequestError("Enter your company's name.");
+    const email = String(invite.email ?? "").trim().toLowerCase();
+    const orgId = String(
+      await addOrg({
+        name,
+        type: nature,
+        nature,
+        email,
+        contact: "",
+        country: String(country ?? "").trim(),
+        createdBy: actor.id,
+        invitedFrom: String(invite._id)
+      })
+    );
+    const roles = await seedDefaultOrgRoles(useRoleRepo().addRole, orgId, nature);
+    const appType = serviceAppType(nature);
+    const orgOwner = roles.find((r) => r.type === "organization" && r.name === "owner");
+    const appOwner = roles.find((r) => r.type === appType && r.name === "owner");
+    if (!orgOwner || !appOwner) {
+      import_node_server_utils61.logger.log({
+        level: "error",
+        message: `[sp-invite] new company ${orgId}: owner roles missing after seeding`
+      });
+      throw new import_node_server_utils61.BadRequestError("Your company was created but could not be set up. Contact Seven365.");
+    }
+    const { add: addMember } = useMemberRepo();
+    const base = {
+      org: orgId,
+      orgName: name,
+      user: actor.id,
+      name: String(user?.name || email),
+      email,
+      createdBy: actor.id,
+      // The owner runs the whole company, not one site.
+      siteId: "",
+      siteName: "",
+      onboardingRequired: false
+    };
+    await addMember({ ...base, role: orgOwner.id, type: "organization" });
+    await addMember({ ...base, role: appOwner.id, type: appType });
+    await useUserRepo().updateUserFieldById({ _id: actor.id, field: "defaultOrg", value: orgId }).catch(() => void 0);
+    import_node_server_utils61.logger.log({
+      level: "info",
+      message: `[sp-invite] invite=${id} new company org=${orgId} nature=${nature}`
+    });
+    const result = await accept({ id, userId: actor.id, org: orgId });
+    return {
+      ...result,
+      orgId,
+      nature,
+      siteId: invite.metadata?.siteId?.toString?.() ?? ""
+    };
+  }
+  async function wrongJoinContext(id, userId) {
+    const actor = await actorFor(userId);
+    assertSuperAdmin(actor);
+    const invite = await load(id);
+    if (![SERVICE_PROVIDER_SIGN_IN_TYPE, SERVICE_PROVIDER_SIGN_UP_TYPE].includes(
+      String(invite.type ?? "")
+    )) {
+      throw new import_node_server_utils61.NotFoundError("Invitation not found.");
+    }
+    const senderOrg = inviteOrgId(invite);
+    const user = await getUserByEmail(
+      String(invite.email ?? "").trim().toLowerCase()
+    ).catch(() => null);
+    return { actor, invite, senderOrg, user };
+  }
+  async function wrongJoinRows(invite, senderOrg, user) {
+    const db2 = import_node_server_utils61.useAtlas.getDb();
+    if (!db2 || !user?._id || !import_mongodb56.ObjectId.isValid(senderOrg))
+      return [];
+    const since = new Date(String(invite.createdAt ?? 0)).getTime();
+    const rows = await db2.collection("members").find({
+      user: { $in: [user._id, String(user._id)] },
+      org: { $in: [new import_mongodb56.ObjectId(senderOrg), senderOrg] },
+      status: "active"
+    }).toArray();
+    const recent = rows.filter(
+      (m) => !Number.isFinite(since) || new Date(m.createdAt ?? 0).getTime() >= since
+    );
+    const roleIds = recent.map((m) => m.role?.toString?.() ?? "").filter((r) => import_mongodb56.ObjectId.isValid(r)).map((r) => new import_mongodb56.ObjectId(r));
+    const roles = roleIds.length ? await db2.collection("roles").find({ _id: { $in: roleIds } }, { projection: { name: 1, permissions: 1 } }).toArray() : [];
+    const roleOf = new Map(roles.map((r) => [r._id.toString(), r]));
+    return recent.map((m) => {
+      const role = roleOf.get(m.role?.toString?.() ?? "");
+      return {
+        _id: m._id.toString(),
+        type: String(m.type ?? ""),
+        roleName: String(role?.name ?? ""),
+        fullAccess: Array.isArray(role?.permissions) && role.permissions.includes("*"),
+        siteName: String(m.siteName ?? ""),
+        createdAt: m.createdAt ?? null
+      };
+    });
+  }
+  function lastRepair(invite) {
+    const history = invite.history ?? [];
+    const last = [...history].reverse().find((e) => ["wrong-join-repaired", "wrong-join-undone"].includes(e?.action));
+    return last?.action === "wrong-join-repaired" ? last : null;
+  }
+  async function wrongJoinPreview({ id, userId }) {
+    const { invite, senderOrg, user } = await wrongJoinContext(id, userId);
+    const org = await getOrgById(senderOrg).catch(() => null);
+    const memberships = await wrongJoinRows(invite, senderOrg, user);
+    const repaired = lastRepair(invite);
+    return {
+      invitationId: id,
+      email: String(invite.email ?? ""),
+      account: user?._id ? String(user.name || user.email || "") : "",
+      senderOrgId: senderOrg,
+      senderOrgName: String(org?.name ?? ""),
+      memberships,
+      defaultOrgIsSender: String(user?.defaultOrg ?? "") === senderOrg,
+      repaired: repaired ? { at: repaired.at, by: repaired.byName, memberIds: repaired.memberIds ?? [] } : null
+    };
+  }
+  async function repairWrongJoin({ id, userId }) {
+    const { actor, invite, senderOrg, user } = await wrongJoinContext(id, userId);
+    const rows = await wrongJoinRows(invite, senderOrg, user);
+    if (!rows.length) {
+      return {
+        message: "Nothing to repair: this account is not in the sender's organisation.",
+        changed: 0
+      };
+    }
+    const { updateMemberStatus } = useMemberRepo();
+    for (const row of rows)
+      await updateMemberStatus(row._id, { status: "inactive" });
+    await _transition({
+      id,
+      from: [],
+      event: {
+        ...event("wrong-join-repaired", actor),
+        memberIds: rows.map((row) => row._id)
+      }
+    });
+    import_node_server_utils61.logger.log({
+      level: "info",
+      message: `[sp-invite] wrong-join repaired invite=${id} memberships=${rows.length} by=${actor.id}`
+    });
+    return {
+      message: `Repaired: ${rows.length} membership${rows.length === 1 ? "" : "s"} in the sender's organisation set inactive. Undo is available.`,
+      changed: rows.length
+    };
+  }
+  async function undoWrongJoin({ id, userId }) {
+    const { actor, invite } = await wrongJoinContext(id, userId);
+    const repaired = lastRepair(invite);
+    if (!repaired)
+      throw new import_node_server_utils61.BadRequestError("There is no repair to undo on this invitation.");
+    const { updateMemberStatus } = useMemberRepo();
+    const ids2 = (repaired.memberIds ?? []).filter((m) => import_mongodb56.ObjectId.isValid(m));
+    for (const m of ids2)
+      await updateMemberStatus(m, { status: "active" }).catch(() => 0);
+    await _transition({ id, from: [], event: event("wrong-join-undone", actor) });
+    return {
+      message: `Undone: ${ids2.length} membership${ids2.length === 1 ? "" : "s"} active again.`,
+      changed: ids2.length
+    };
+  }
   async function notifyInviter(invite, accepted, providerName) {
     try {
       const to = invite.metadata?.invitedBy?.toString?.() ?? "";
@@ -24775,7 +25735,7 @@ function useServiceProviderInviteService() {
         siteId: invite.metadata?.siteId?.toString?.()
       });
     } catch (error) {
-      import_node_server_utils59.logger.log({
+      import_node_server_utils61.logger.log({
         level: "error",
         message: `Invitation answer notification failed: ${error?.message}`
       });
@@ -24785,11 +25745,11 @@ function useServiceProviderInviteService() {
     const id = String(org ?? "").trim();
     if (!id)
       return "";
-    const runs = import_mongodb55.ObjectId.isValid(id) && actor.memberships.some(
+    const runs = import_mongodb56.ObjectId.isValid(id) && actor.memberships.some(
       (m) => m.org === id && (m.companyWideRole === true || !m.siteId && m.orgLevelRole === true)
     );
     if (!runs) {
-      throw new import_node_server_utils59.UnauthorizedError(
+      throw new import_node_server_utils61.UnauthorizedError(
         "Only an administrator of that company can answer this invitation for it."
       );
     }
@@ -24906,15 +25866,15 @@ function useServiceProviderInviteService() {
     await assertInvitedParty(actor.id, invite);
     const forOrg = memberOrg(actor, org);
     if (!forOrg) {
-      throw new import_node_server_utils59.BadRequestError("Choose the company to add the site to.");
+      throw new import_node_server_utils61.BadRequestError("Choose the company to add the site to.");
     }
     if (![SERVICE_PROVIDER_SIGN_IN_TYPE, SERVICE_PROVIDER_SIGN_UP_TYPE].includes(
       String(invite.type ?? "")
     ) || invite.status === "awaiting-approval" /* AWAITING_APPROVAL */) {
-      throw new import_node_server_utils59.NotFoundError("Invitation not found.");
+      throw new import_node_server_utils61.NotFoundError("Invitation not found.");
     }
     if (invite.status !== "complete" /* COMPLETE */ || invite.deletedAt) {
-      throw new import_node_server_utils59.BadRequestError(
+      throw new import_node_server_utils61.BadRequestError(
         "Only an accepted invitation can be added to your Sites."
       );
     }
@@ -24923,7 +25883,7 @@ function useServiceProviderInviteService() {
       return { message: "This site is already on your Sites list." };
     }
     if (!state.needsSiteLink) {
-      throw new import_node_server_utils59.BadRequestError(
+      throw new import_node_server_utils61.BadRequestError(
         state.providerOrgId && state.providerOrgId !== forOrg ? `This invitation was accepted for ${state.providerOrgName || "another company"}. The site is on that company's Sites list.` : "This site was removed from your Sites list. Ask the client to invite you again."
       );
     }
@@ -24951,7 +25911,7 @@ function useServiceProviderInviteService() {
     const invite = await load(id);
     await assertInvitedParty(actor.id, invite);
     if (invite.status === "awaiting-approval" /* AWAITING_APPROVAL */ || invite.status === "rejected" /* REJECTED */) {
-      throw new import_node_server_utils59.NotFoundError("Invitation not found.");
+      throw new import_node_server_utils61.NotFoundError("Invitation not found.");
     }
     const row = await receivedRow(invite, memberOrg(actor, org));
     return { ...row, tab: receivedInviteTab(invite) };
@@ -24967,6 +25927,10 @@ function useServiceProviderInviteService() {
     softDelete,
     decline,
     accept,
+    acceptAsNewCompany,
+    wrongJoinPreview,
+    repairWrongJoin,
+    undoWrongJoin,
     linkSite,
     listReceived,
     getForProvider,
@@ -24975,7 +25939,7 @@ function useServiceProviderInviteService() {
 }
 
 // src/services/verification.service.ts
-var import_mongodb56 = require("mongodb");
+var import_mongodb57 = require("mongodb");
 function useVerificationService() {
   const MailerConfig = {
     host: MAILER_TRANSPORT_HOST,
@@ -24985,7 +25949,7 @@ function useVerificationService() {
     from: MAILER_FROM_EMAIL,
     password: MAILER_PASSWORD
   };
-  const mailer2 = new import_node_server_utils60.useMailer(MailerConfig);
+  const mailer2 = new import_node_server_utils62.useMailer(MailerConfig);
   const {
     add,
     getById: _getById,
@@ -25024,11 +25988,11 @@ function useVerificationService() {
       value.type = type;
       const res = await add(value);
       const dir = __dirname;
-      const filePath = (0, import_node_server_utils60.getDirectory)(dir, `./public/handlebars/${type}`);
+      const filePath = (0, import_node_server_utils62.getDirectory)(dir, `./public/handlebars/${type}`);
       const isMember = type === "member-invite";
       const subject = isMember ? "Member Invite" : "User Invite";
       const link = `${APP_MAIN}/verify/${isMember ? "membership" : "invitation"}/${res}`;
-      const emailContent = (0, import_node_server_utils60.compileHandlebar)({
+      const emailContent = (0, import_node_server_utils62.compileHandlebar)({
         context: {
           email: userName,
           validity: VERIFICATION_USER_INVITE_DURATION,
@@ -25042,7 +26006,7 @@ function useVerificationService() {
         html: emailContent,
         sender: "iService365"
       }).catch((error) => {
-        import_node_server_utils60.logger.log({
+        import_node_server_utils62.logger.log({
           level: "error",
           message: `Error sending user ${type} email: ${error}`
         });
@@ -25096,7 +26060,7 @@ function useVerificationService() {
       const createdId = reissued ? pending._id : await add(value);
       verificationIds.push(createdId.toString());
       const link = `${APP_MAIN}/verify/invitation/${createdId}`;
-      const emailContent = (0, import_node_server_utils60.compileHandlebar)({
+      const emailContent = (0, import_node_server_utils62.compileHandlebar)({
         context: {
           email,
           validity: VERIFICATION_USER_INVITE_DURATION,
@@ -25109,7 +26073,7 @@ function useVerificationService() {
           hasPestControl: app === "pest_control_services",
           hasPoolMaintenance: app === "pool_maintenance_services"
         },
-        filePath: (0, import_node_server_utils60.getDirectory)(__dirname, "./public/handlebars/user-invite")
+        filePath: (0, import_node_server_utils62.getDirectory)(__dirname, "./public/handlebars/user-invite")
       });
       await mailer2.sendMail({
         to: email,
@@ -25138,7 +26102,7 @@ function useVerificationService() {
     });
     if (existing) {
       if (existing.status === "complete") {
-        throw new import_node_server_utils60.BadRequestError(
+        throw new import_node_server_utils62.BadRequestError(
           `User already completed member invite for app: ${metadata.app}`
         );
       }
@@ -25153,13 +26117,13 @@ function useVerificationService() {
     };
     const res = await add(value);
     const link = `${APP_MAIN}/verify/membership/${res}`;
-    const emailContent = (0, import_node_server_utils60.compileHandlebar)({
+    const emailContent = (0, import_node_server_utils62.compileHandlebar)({
       context: {
         email,
         validity: VERIFICATION_USER_INVITE_DURATION,
         link
       },
-      filePath: (0, import_node_server_utils60.getDirectory)(__dirname, "./public/handlebars/member-invite")
+      filePath: (0, import_node_server_utils62.getDirectory)(__dirname, "./public/handlebars/member-invite")
     });
     await mailer2.sendMail({
       to: email,
@@ -25205,8 +26169,8 @@ function useVerificationService() {
     });
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
-      import_node_server_utils60.logger.log({ level: "error", message: messages });
-      throw new import_node_server_utils60.BadRequestError(`Invalid input: ${error.message}`);
+      import_node_server_utils62.logger.log({ level: "error", message: messages });
+      throw new import_node_server_utils62.BadRequestError(`Invalid input: ${error.message}`);
     }
     let subject = "Service Provider Invite" /* _SERVICE_PROVIDER_INVITE */;
     let type = "service-provider-invite" /* SERVICE_PROVIDER_INVITE */;
@@ -25229,7 +26193,7 @@ function useVerificationService() {
       const org = await getOrgById(orgId);
       const actor = await resolveInviteActor(invitedBy);
       if (!actor.id) {
-        throw new import_node_server_utils60.UnauthorizedError("Sign in to continue.");
+        throw new import_node_server_utils62.UnauthorizedError("Sign in to continue.");
       }
       const { sender } = await assertServiceProviderInviteScope(
         actor,
@@ -25254,7 +26218,7 @@ function useVerificationService() {
         inviterIsServiceProvider: sender === "subcontract"
       });
       if (!decision.ok) {
-        throw new import_node_server_utils60.BadRequestError(decision.reason);
+        throw new import_node_server_utils62.BadRequestError(decision.reason);
       }
       value.type = decision.type;
       subject = decision.subject;
@@ -25285,7 +26249,7 @@ function useVerificationService() {
       }
       await useServiceProviderInviteService().notifyProvider({
         ...value,
-        _id: new import_mongodb56.ObjectId(String(res))
+        _id: new import_mongodb57.ObjectId(String(res))
       });
       return res;
     } catch (error2) {
@@ -25321,8 +26285,8 @@ function useVerificationService() {
     });
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
-      import_node_server_utils60.logger.log({ level: "error", message: messages });
-      throw new import_node_server_utils60.BadRequestError(`Invalid input: ${error.message}`);
+      import_node_server_utils62.logger.log({ level: "error", message: messages });
+      throw new import_node_server_utils62.BadRequestError(`Invalid input: ${error.message}`);
     }
     const subject = "Service Provider Invite" /* _SERVICE_PROVIDER_INVITE */;
     const type = "service-provider-invite" /* SERVICE_PROVIDER_INVITE */;
@@ -25342,12 +26306,12 @@ function useVerificationService() {
     };
     try {
       const id = await _add(value);
-      const filePath = (0, import_node_server_utils60.getDirectory)(
+      const filePath = (0, import_node_server_utils62.getDirectory)(
         __dirname,
         `./public/handlebars/${value.type}`
       );
       const link = `${APP_MAIN}/verify/${value.type}/${id}`;
-      const emailContent = (0, import_node_server_utils60.compileHandlebar)({
+      const emailContent = (0, import_node_server_utils62.compileHandlebar)({
         context: {
           email,
           app,
@@ -25380,12 +26344,12 @@ function useVerificationService() {
     try {
       const user = await getUserByEmail(email);
       if (!user) {
-        throw new import_node_server_utils60.NotFoundError("Email not found");
+        throw new import_node_server_utils62.NotFoundError("Email not found");
       }
       const res = await add(value);
       const dir = __dirname;
-      const filePath = (0, import_node_server_utils60.getDirectory)(dir, "./public/handlebars/forget-password");
-      const emailContent = (0, import_node_server_utils60.compileHandlebar)({
+      const filePath = (0, import_node_server_utils62.getDirectory)(dir, "./public/handlebars/forget-password");
+      const emailContent = (0, import_node_server_utils62.compileHandlebar)({
         context: {
           userName: user?.name,
           validity: VERIFICATION_FORGET_PASSWORD_DURATION,
@@ -25399,21 +26363,21 @@ function useVerificationService() {
         sender: "iService365",
         html: emailContent
       }).catch((error) => {
-        import_node_server_utils60.logger.log({
+        import_node_server_utils62.logger.log({
           level: "error",
           message: `Error sending forget password email: ${error}`
         });
       });
       return "Successfully created a link to reset password. Please check your email.";
     } catch (error) {
-      throw new import_node_server_utils60.InternalServerError("Failed to create forget password link.");
+      throw new import_node_server_utils62.InternalServerError("Failed to create forget password link.");
     }
   }
   async function getById(id) {
     try {
       const _id = await _getById(id);
       if (!_id) {
-        throw new import_node_server_utils60.NotFoundError("Verification not found.");
+        throw new import_node_server_utils62.NotFoundError("Verification not found.");
       }
       return _id;
     } catch (error) {
@@ -25422,48 +26386,48 @@ function useVerificationService() {
   }
   function errorByType(type, status) {
     if ((type === "user-invite" || type === "member-invite" || type === "service-provider-invite" || type === "service-provider-create-org") && status === "expired") {
-      throw new import_node_server_utils60.BadRequestError(
+      throw new import_node_server_utils62.BadRequestError(
         "Invitation has already expired, please contact admin to resend the invitation."
       );
     }
     if (type === "user-sign-up" && status === "expired") {
-      throw new import_node_server_utils60.BadRequestError(
+      throw new import_node_server_utils62.BadRequestError(
         "Sign up verification has expired, please sign up again to get a new verification link."
       );
     }
     if ((type === "user-invite" || type === "member-invite" || type === "service-provider-invite" || type === "service-provider-create-org") && status === "complete") {
-      throw new import_node_server_utils60.BadRequestError(
+      throw new import_node_server_utils62.BadRequestError(
         "User already registered, please login to continue."
       );
     }
     if (type === "forget-password" && status === "complete") {
-      throw new import_node_server_utils60.BadRequestError(
+      throw new import_node_server_utils62.BadRequestError(
         "Forget password verification has already been used, please request a new one."
       );
     }
     if (type === "forget-password" && status === "expired") {
-      throw new import_node_server_utils60.BadRequestError(
+      throw new import_node_server_utils62.BadRequestError(
         "Forget password verification has expired, please request a new one."
       );
     }
-    throw new import_node_server_utils60.BadRequestError("Invalid verification.");
+    throw new import_node_server_utils62.BadRequestError("Invalid verification.");
   }
   async function verify(id) {
-    const session = import_node_server_utils60.useAtlas.getClient()?.startSession();
+    const session = import_node_server_utils62.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     try {
       const _id = await _getById(id);
       if (!_id) {
-        throw new import_node_server_utils60.NotFoundError("Verification not found.");
+        throw new import_node_server_utils62.NotFoundError("Verification not found.");
       }
       if (_id.status === "expired") {
         errorByType(_id.type, "expired");
       }
       if (_id.status === "cancelled") {
-        throw new import_node_server_utils60.BadRequestError("Verification already cancelled.");
+        throw new import_node_server_utils62.BadRequestError("Verification already cancelled.");
       }
       if (_id.status === "complete") {
-        throw new import_node_server_utils60.BadRequestError("Verification already completed.");
+        throw new import_node_server_utils62.BadRequestError("Verification already completed.");
       }
       const expiration = new Date(_id.expireAt).getTime();
       const now = (/* @__PURE__ */ new Date()).getTime();
@@ -25474,7 +26438,7 @@ function useVerificationService() {
       return _id;
     } catch (error) {
       await session?.abortTransaction();
-      import_node_server_utils60.logger.log({
+      import_node_server_utils62.logger.log({
         level: "info",
         message: `Error verifying user invitation: ${error}`
       });
@@ -25487,7 +26451,7 @@ function useVerificationService() {
     try {
       await updateStatusById(id, "cancelled");
     } catch (error) {
-      throw new import_node_server_utils60.InternalServerError(
+      throw new import_node_server_utils62.InternalServerError(
         `Error cancelling user invitation: ${error}`
       );
     }
@@ -25507,7 +26471,7 @@ function useVerificationService() {
     try {
       const user = await getUserByEmail(email);
       if (user) {
-        throw new import_node_server_utils60.BadRequestError(
+        throw new import_node_server_utils62.BadRequestError(
           `Email ${email} is already registered, please login to continue.`
         );
       }
@@ -25521,8 +26485,8 @@ function useVerificationService() {
       };
       const res = await add(value);
       const dir = __dirname;
-      const filePath = (0, import_node_server_utils60.getDirectory)(dir, "./public/handlebars/sign-up");
-      const emailContent = (0, import_node_server_utils60.compileHandlebar)({
+      const filePath = (0, import_node_server_utils62.getDirectory)(dir, "./public/handlebars/sign-up");
+      const emailContent = (0, import_node_server_utils62.compileHandlebar)({
         context: {
           email,
           validity: "5 minutes",
@@ -25536,7 +26500,7 @@ function useVerificationService() {
         html: emailContent,
         sender: "iService365"
       }).catch((error) => {
-        import_node_server_utils60.logger.log({
+        import_node_server_utils62.logger.log({
           level: "error",
           message: `Error sending user invite email: ${error}`
         });
@@ -25557,7 +26521,7 @@ function useVerificationService() {
       }
       return "Successfully checked for expired invitations.";
     } catch (error) {
-      import_node_server_utils60.logger.log({
+      import_node_server_utils62.logger.log({
         level: "info",
         message: `Error checking expired user invitation: ${error}`
       });
@@ -25581,459 +26545,7 @@ function useVerificationService() {
 }
 
 // src/services/user.service.ts
-var import_node_server_utils62 = require("@7365admin1/node-server-utils");
-
-// src/repositories/role.repo.ts
-var import_node_server_utils61 = require("@7365admin1/node-server-utils");
-var import_mongodb57 = require("mongodb");
-var HISTORY_LIMIT = 10;
-function useRoleRepo() {
-  const db2 = import_node_server_utils61.useAtlas.getDb();
-  if (!db2) {
-    throw new import_node_server_utils61.InternalServerError("Unable to connect to server.");
-  }
-  const namespace_collection3 = "roles";
-  const collection = db2.collection(namespace_collection3);
-  async function createIndex() {
-    try {
-      await collection.createIndexes([
-        { key: { name: 1 } },
-        { key: { type: 1 } },
-        { key: { status: 1 } }
-      ]);
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to create index on role.");
-    }
-  }
-  async function createTextIndex() {
-    try {
-      await collection.createIndex({ name: "text" });
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to create text index on role.");
-    }
-  }
-  async function createUniqueIndex() {
-    try {
-      await collection.createIndex(
-        { name: 1, type: 1, org: 1, deletedAt: 1 },
-        { unique: true }
-      );
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to create unique index on role.");
-    }
-  }
-  const { delNamespace, setCache, getCache } = (0, import_node_server_utils61.useCache)(namespace_collection3);
-  const { delNamespace: _delDashboardNameSpace } = (0, import_node_server_utils61.useCache)("dashboard");
-  async function nameTakenMessage(value) {
-    const name = String(value?.name ?? "");
-    const fallback = `A role named "${name}" already exists in this organisation. Please choose a different name.`;
-    try {
-      const clash = await collection.findOne(
-        {
-          name,
-          type: value.type,
-          org: value.org,
-          deletedAt: value.deletedAt ?? ""
-        },
-        { projection: { site: 1 } }
-      );
-      if (!clash)
-        return fallback;
-      if (!clash.site) {
-        return `A role named "${name}" already exists for the whole organisation. Role names must be different across the organisation and all its sites - please choose a different name.`;
-      }
-      const siteName = async (id) => {
-        if (!id)
-          return "";
-        const doc = await db2?.collection("sites").findOne(
-          { _id: new import_mongodb57.ObjectId(String(id)) },
-          { projection: { name: 1 } }
-        ).catch(() => null);
-        return doc?.name ?? "";
-      };
-      if (value.site && String(value.site) === String(clash.site)) {
-        return `A role named "${name}" already exists at this site. Please choose a different name.`;
-      }
-      const [there, here] = await Promise.all([siteName(clash.site), siteName(value.site)]);
-      const suggestion = here ? `, for example "${name} - ${here}"` : "";
-      return `A role named "${name}" already exists in this organisation${there ? ` at ${there}` : " at another site"}. Role names must be different across all your sites - please choose a different name${suggestion}.`;
-    } catch {
-      return fallback;
-    }
-  }
-  async function addRole(value, session) {
-    value = new MRole({ ...value, type: serviceAppType(value.type) });
-    try {
-      const res = await collection.insertOne(value, { session });
-      delNamespace().then(() => {
-        import_node_server_utils61.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
-      }).catch((err) => {
-        import_node_server_utils61.logger.error(
-          `Failed to clear cache for namespace: ${namespace_collection3}`,
-          err
-        );
-      });
-      return res.insertedId;
-    } catch (error) {
-      import_node_server_utils61.logger.log({ level: "error", message: `${error}` });
-      const isDuplicated = error.message.includes("duplicate");
-      if (isDuplicated) {
-        throw new import_node_server_utils61.BadRequestError(await nameTakenMessage(value));
-      }
-      throw new import_node_server_utils61.InternalServerError("Failed to create role.");
-    }
-  }
-  async function getRoleByUserId(value) {
-    try {
-      value = new import_mongodb57.ObjectId(value);
-    } catch (error) {
-      throw new import_node_server_utils61.BadRequestError("Invalid user ID format.");
-    }
-    try {
-      const cacheKey = (0, import_node_server_utils61.makeCacheKey)(namespace_collection3, { user: value });
-      const cachedData = await getCache(cacheKey);
-      if (cachedData) {
-        import_node_server_utils61.logger.info(`Cache hit for key: ${cacheKey}`);
-        return cachedData;
-      }
-      const data = await collection.findOne({ user: value });
-      setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils61.logger.info(`Cache set for key: ${cacheKey}`);
-      }).catch((err) => {
-        import_node_server_utils61.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
-      });
-      return data;
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to retrieve role by user ID.");
-    }
-  }
-  async function getOwnerRolesByTypeOrg(type, org) {
-    try {
-      org = new import_mongodb57.ObjectId(org);
-    } catch (error) {
-      throw new import_node_server_utils61.BadRequestError("Invalid organization ID format.");
-    }
-    const cacheOptions = {
-      org: org.toString(),
-      permissions: "*",
-      type,
-      status: "active"
-    };
-    const cacheKey = (0, import_node_server_utils61.makeCacheKey)(namespace_collection3, cacheOptions);
-    const cachedData = await getCache(cacheKey);
-    if (cachedData) {
-      import_node_server_utils61.logger.info(`Cache hit for key: ${cacheKey}`);
-      return cachedData;
-    }
-    try {
-      const data = await collection.find({ org, permissions: "*", type: appTypeQuery(type), status: "active" }).toArray();
-      setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils61.logger.info(`Cache set for key: ${cacheKey}`);
-      }).catch((err) => {
-        import_node_server_utils61.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
-      });
-      return data;
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to retrieve role by user ID.");
-    }
-  }
-  async function getRoleById(_id) {
-    try {
-      _id = new import_mongodb57.ObjectId(_id);
-    } catch (error) {
-      throw new import_node_server_utils61.BadRequestError("Invalid role ID format.");
-    }
-    try {
-      const cacheKey = (0, import_node_server_utils61.makeCacheKey)(namespace_collection3, { _id });
-      const cachedData = await getCache(cacheKey);
-      if (cachedData) {
-        import_node_server_utils61.logger.info(`Cache hit for key: ${cacheKey}`);
-        return cachedData;
-      }
-      const data = await collection.findOne({ _id });
-      setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils61.logger.info(`Cache set for key: ${cacheKey}`);
-      }).catch((err) => {
-        import_node_server_utils61.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
-      });
-      return data;
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to retrieve role by ID.");
-    }
-  }
-  async function getRoleByName(name, type) {
-    if (!name) {
-      throw new import_node_server_utils61.BadRequestError("Role name is required.");
-    }
-    type = serviceAppType(type);
-    const query2 = type ? { name, type: appTypeQuery(type) } : { name };
-    try {
-      const cacheKey = (0, import_node_server_utils61.makeCacheKey)(namespace_collection3, query2);
-      const cachedData = await getCache(cacheKey);
-      if (cachedData) {
-        import_node_server_utils61.logger.info(`Cache hit for key: ${cacheKey}`);
-        return cachedData;
-      }
-      const data = await collection.findOne(query2);
-      setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils61.logger.info(`Cache set for key: ${cacheKey}`);
-      }).catch((err) => {
-        import_node_server_utils61.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
-      });
-      return data;
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to retrieve role by name.");
-    }
-  }
-  async function getRoles({
-    search = "",
-    page: page2 = 1,
-    limit = 10,
-    sort = {},
-    type = "",
-    org = "",
-    site = ""
-  }) {
-    page2 = page2 > 0 ? page2 - 1 : 0;
-    if (org && typeof org === "string" && org.length === 24) {
-      try {
-        org = new import_mongodb57.ObjectId(org);
-      } catch (error) {
-        throw new import_node_server_utils61.BadRequestError("Invalid organization ID format.");
-      }
-    }
-    if (site && typeof site === "string" && site.length === 24) {
-      try {
-        site = new import_mongodb57.ObjectId(site);
-      } catch (error) {
-        throw new import_node_server_utils61.BadRequestError("Invalid site ID format.");
-      }
-    }
-    const query2 = { status: "active", org };
-    const cacheOptions = { status: "active", org };
-    if (site) {
-      query2.$or = [{ site }, { site: "" }, { site: null }];
-      cacheOptions.site = site.toString();
-    }
-    sort = Object.keys(sort).length > 0 ? sort : { _id: -1 };
-    cacheOptions.sort = JSON.stringify(sort);
-    if (search) {
-      query2.$text = { $search: search };
-      cacheOptions.search = search;
-    }
-    if (type) {
-      query2.type = appTypeQuery(type);
-      cacheOptions.type = serviceAppType(type);
-    }
-    const cacheKey = (0, import_node_server_utils61.makeCacheKey)(namespace_collection3, cacheOptions);
-    const cachedData = await getCache(cacheKey);
-    if (cachedData) {
-      import_node_server_utils61.logger.info(`Cache hit for key: ${cacheKey}`);
-      return cachedData;
-    }
-    try {
-      const items = await collection.aggregate([
-        { $match: query2 },
-        { $sort: sort },
-        { $skip: page2 * limit },
-        { $limit: limit }
-      ]).toArray();
-      const length = await collection.countDocuments(query2);
-      const data = (0, import_node_server_utils61.paginate)(items, page2, limit, length);
-      setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils61.logger.info(`Cache set for key: ${cacheKey}`);
-      }).catch((err) => {
-        import_node_server_utils61.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
-      });
-      return data;
-    } catch (error) {
-      import_node_server_utils61.logger.log({ level: "error", message: `${error}` });
-      throw error;
-    }
-  }
-  async function getActiveByTypeOrg(type, org) {
-    try {
-      if (typeof org === "string" && org) {
-        org = new import_mongodb57.ObjectId(org);
-      }
-    } catch (error) {
-      throw new import_node_server_utils61.BadRequestError("Invalid organization ID format.");
-    }
-    try {
-      return await collection.find({ status: "active", type, org }).sort({ name: 1 }).toArray();
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to retrieve replacement roles.");
-    }
-  }
-  async function assertNotSeededOwnerRole(_id) {
-    const role = await collection.findOne(
-      { _id },
-      { projection: { type: 1, default: 1 } }
-    );
-    if (role?.type === PLATFORM_STAFF_ROLE_TYPE && role?.default === true) {
-      throw new import_node_server_utils61.BadRequestError(
-        "The Seven365 platform owner role cannot be edited or deleted."
-      );
-    }
-  }
-  async function updateRole(_id, value, session) {
-    if (!_id) {
-      throw new import_node_server_utils61.BadRequestError("Role ID is required.");
-    }
-    try {
-      _id = new import_mongodb57.ObjectId(_id);
-    } catch (error) {
-      throw new import_node_server_utils61.BadRequestError("Invalid role ID format.");
-    }
-    await assertNotSeededOwnerRole(_id);
-    if (!value.name) {
-      delete value.name;
-    }
-    if (!value.permissions) {
-      delete value.permissions;
-    }
-    if (value.name || value.permissions) {
-      try {
-        await collection.updateOne({ _id }, { $set: value }, { session });
-        delNamespace().then(() => {
-          import_node_server_utils61.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
-        }).catch((err) => {
-          import_node_server_utils61.logger.error(
-            `Failed to clear cache for namespace: ${namespace_collection3}`,
-            err
-          );
-        });
-        return _id;
-      } catch (error) {
-        const isDuplicated = error.message.includes("duplicate");
-        if (isDuplicated) {
-          const current = await collection.findOne({ _id }, { projection: { type: 1, org: 1, site: 1, deletedAt: 1 } }).catch(() => null);
-          throw new import_node_server_utils61.BadRequestError(
-            await nameTakenMessage({ ...current ?? {}, name: value.name })
-          );
-        }
-        throw new import_node_server_utils61.InternalServerError("Failed to update role.");
-      }
-    } else {
-      throw new import_node_server_utils61.BadRequestError("No fields to update.");
-    }
-  }
-  async function updatePermissionsById(_id, permissions, session) {
-    if (!_id) {
-      throw new import_node_server_utils61.BadRequestError("Role ID is required.");
-    }
-    try {
-      _id = new import_mongodb57.ObjectId(_id);
-    } catch (error) {
-      throw new import_node_server_utils61.BadRequestError("Invalid role ID format.");
-    }
-    await assertNotSeededOwnerRole(_id);
-    if (!permissions) {
-      throw new import_node_server_utils61.BadRequestError("Permissions are required.");
-    }
-    if (permissions.length === 0) {
-      throw new import_node_server_utils61.BadRequestError("Permissions cannot be empty.");
-    }
-    try {
-      await collection.updateOne(
-        { _id },
-        { $set: { permissions } },
-        { session }
-      );
-      delNamespace().then(() => {
-        import_node_server_utils61.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
-      }).catch((err) => {
-        import_node_server_utils61.logger.error(
-          `Failed to clear cache for namespace: ${namespace_collection3}`,
-          err
-        );
-      });
-      return "Successfully updated role permissions.";
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to update role permissions.");
-    }
-  }
-  async function appendPermissionHistory(_id, entry, session) {
-    try {
-      _id = new import_mongodb57.ObjectId(_id);
-    } catch (error) {
-      throw new import_node_server_utils61.BadRequestError("Invalid role ID format.");
-    }
-    await collection.updateOne(
-      { _id },
-      // cast: the collection's generic has no `permissionHistory` in its
-      // `PushOperator`, because the field is new and optional. The operator
-      // itself is ordinary `$push`/`$slice`.
-      { $push: { permissionHistory: { $each: [entry], $slice: -HISTORY_LIMIT } } },
-      { session }
-    );
-    delNamespace().then(() => {
-      import_node_server_utils61.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
-    }).catch((err) => {
-      import_node_server_utils61.logger.error(
-        `Failed to clear cache for namespace: ${namespace_collection3}`,
-        err
-      );
-    });
-  }
-  async function deleteRole(_id, session) {
-    try {
-      _id = new import_mongodb57.ObjectId(_id);
-    } catch (error) {
-      throw new import_node_server_utils61.BadRequestError("Invalid role ID format.");
-    }
-    await assertNotSeededOwnerRole(_id);
-    try {
-      const updateValue = {
-        status: "deleted",
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        deletedAt: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      const res = await collection.updateOne(
-        { _id },
-        { $set: updateValue },
-        { session }
-      );
-      if (res.modifiedCount === 0) {
-        throw new import_node_server_utils61.InternalServerError("Unable to update role status.");
-      }
-      delNamespace().then(() => {
-        import_node_server_utils61.logger.info(`Cache cleared for namespace: ${namespace_collection3}`);
-      }).catch((err) => {
-        import_node_server_utils61.logger.error(
-          `Failed to clear cache for namespace: ${namespace_collection3}`,
-          err
-        );
-      });
-      _delDashboardNameSpace().then(() => {
-        import_node_server_utils61.logger.info(`Cache cleared for namespace: dashboard`);
-      }).catch((err) => {
-        import_node_server_utils61.logger.error(`Failed to clear cache for namespace: dashboard`, err);
-      });
-      return "Successfully deleted role permission.";
-    } catch (error) {
-      throw new import_node_server_utils61.InternalServerError("Failed to delete role.");
-    }
-  }
-  return {
-    createIndex,
-    createTextIndex,
-    createUniqueIndex,
-    addRole,
-    getRoleByUserId,
-    getRoleById,
-    getRoleByName,
-    getRoles,
-    getActiveByTypeOrg,
-    updateRole,
-    updatePermissionsById,
-    appendPermissionHistory,
-    deleteRole,
-    getOwnerRolesByTypeOrg
-  };
-}
-
-// src/services/user.service.ts
+var import_node_server_utils63 = require("@7365admin1/node-server-utils");
 var import_multer = require("multer");
 function useUserService() {
   const {
@@ -26060,7 +26572,7 @@ function useUserService() {
         role = result._id?.toString();
       }
     } catch (error) {
-      import_node_server_utils62.logger.error(error.message);
+      import_node_server_utils63.logger.error(error.message);
     }
     if (!role) {
       try {
@@ -26072,15 +26584,15 @@ function useUserService() {
         });
         role = result.toString();
       } catch (error) {
-        import_node_server_utils62.logger.error(error.message);
+        import_node_server_utils63.logger.error(error.message);
       }
       if (!role) {
-        import_node_server_utils62.logger.error("Failed to create default role.");
+        import_node_server_utils63.logger.error("Failed to create default role.");
       }
     }
     let user = "";
     if (!DEFAULT_USER_EMAIL) {
-      import_node_server_utils62.logger.error("Default user email is not set.");
+      import_node_server_utils63.logger.error("Default user email is not set.");
     }
     try {
       const result = await getUserByEmail(DEFAULT_USER_EMAIL);
@@ -26088,11 +26600,11 @@ function useUserService() {
         user = result._id?.toString();
       }
     } catch (error) {
-      import_node_server_utils62.logger.error(error.message);
+      import_node_server_utils63.logger.error(error.message);
     }
     if (!user) {
       try {
-        const password = await (0, import_node_server_utils62.hashPassword)(DEFAULT_USER_PASSWORD);
+        const password = await (0, import_node_server_utils63.hashPassword)(DEFAULT_USER_PASSWORD);
         const userId = await addUser({
           email: DEFAULT_USER_EMAIL,
           password,
@@ -26100,10 +26612,10 @@ function useUserService() {
         });
         user = userId.toString();
       } catch (error) {
-        import_node_server_utils62.logger.error(error.message);
+        import_node_server_utils63.logger.error(error.message);
       }
       if (!user) {
-        import_node_server_utils62.logger.error("Failed to create default user.");
+        import_node_server_utils63.logger.error("Failed to create default user.");
       }
     }
     try {
@@ -26114,7 +26626,7 @@ function useUserService() {
         type: "admin"
       });
     } catch (error) {
-      import_node_server_utils62.logger.error(error.message);
+      import_node_server_utils63.logger.error(error.message);
     }
   }
   async function createUserBySignUp({
@@ -26122,31 +26634,31 @@ function useUserService() {
     name = "",
     password = ""
   } = {}) {
-    const session = import_node_server_utils62.useAtlas.getClient()?.startSession();
+    const session = import_node_server_utils63.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     try {
       const signUp = await getVerificationById(id);
       if (!signUp) {
-        throw new import_node_server_utils62.BadRequestError("Invalid sign up link.");
+        throw new import_node_server_utils63.BadRequestError("Invalid sign up link.");
       }
       if (signUp.status === "complete") {
-        throw new import_node_server_utils62.BadRequestError(
+        throw new import_node_server_utils63.BadRequestError(
           "You have already an account created using this link."
         );
       }
       if (signUp.status === "cancelled") {
-        throw new import_node_server_utils62.BadRequestError("This invitation was cancelled.");
+        throw new import_node_server_utils63.BadRequestError("This invitation was cancelled.");
       }
       const expired = new Date(signUp.expireAt) < /* @__PURE__ */ new Date();
       if (signUp.status === "expired" || expired) {
-        throw new import_node_server_utils62.BadRequestError("Sign up link expired.");
+        throw new import_node_server_utils63.BadRequestError("Sign up link expired.");
       }
       const email = signUp.email;
       const _user = await getUserByEmail(signUp.email);
       if (_user) {
-        throw new import_node_server_utils62.BadRequestError(`User already exists: ${email}.`);
+        throw new import_node_server_utils63.BadRequestError(`User already exists: ${email}.`);
       }
-      const hashedPassword = await (0, import_node_server_utils62.hashPassword)(password);
+      const hashedPassword = await (0, import_node_server_utils63.hashPassword)(password);
       let org = null;
       if (signUp.metadata?.org) {
         org = await getOrgById(signUp.metadata.org);
@@ -26195,30 +26707,30 @@ function useUserService() {
       throw error;
     }
     if (newPassword !== passwordConfirmation) {
-      throw new import_node_server_utils62.BadRequestError("Passwords do not match.");
+      throw new import_node_server_utils63.BadRequestError("Passwords do not match.");
     }
     let hashedPassword;
-    const session = import_node_server_utils62.useAtlas.getClient()?.startSession();
+    const session = import_node_server_utils63.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     try {
-      hashedPassword = await (0, import_node_server_utils62.hashPassword)(newPassword);
+      hashedPassword = await (0, import_node_server_utils63.hashPassword)(newPassword);
     } catch (error) {
-      throw new import_node_server_utils62.InternalServerError(`Error hashing password: ${error}`);
+      throw new import_node_server_utils63.InternalServerError(`Error hashing password: ${error}`);
     }
     try {
       const otpDoc = await getVerificationById(id);
       if (!otpDoc) {
-        throw new import_node_server_utils62.NotFoundError("You are using an invalid reset link.");
+        throw new import_node_server_utils63.NotFoundError("You are using an invalid reset link.");
       }
       if (otpDoc.status === "complete") {
-        throw new import_node_server_utils62.BadRequestError("This link has already been invalidated.");
+        throw new import_node_server_utils63.BadRequestError("This link has already been invalidated.");
       }
       const user = await getUserByEmail(otpDoc.email);
       if (!user) {
-        throw new import_node_server_utils62.NotFoundError("User not found.");
+        throw new import_node_server_utils63.NotFoundError("User not found.");
       }
       if (!user._id) {
-        throw new import_node_server_utils62.InternalServerError("Invalid user ID.");
+        throw new import_node_server_utils63.InternalServerError("Invalid user ID.");
       }
       await updateStatusById(id, "complete", session);
       await _resetPassword(
@@ -26238,7 +26750,7 @@ function useUserService() {
       session?.endSession();
     }
   }
-  const s3 = new import_node_server_utils62.useS3({
+  const s3 = new import_node_server_utils63.useS3({
     accessKeyId: SPACES_ACCESS_KEY,
     secretAccessKey: SPACES_SECRET_KEY,
     endpoint: SPACES_ENDPOINT,
@@ -26251,7 +26763,7 @@ function useUserService() {
     user,
     previousProfile
   }) {
-    const session = import_node_server_utils62.useAtlas.getClient()?.startSession();
+    const session = import_node_server_utils63.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     const _file = {
       name: file.originalname,
@@ -26284,18 +26796,18 @@ function useUserService() {
   async function updatePasswordById(id, currentPassword, newPassword, passwordConfirmation) {
     let hashedPassword;
     const user = await getUserById(id);
-    const isPasswordValid = await (0, import_node_server_utils62.comparePassword)(
+    const isPasswordValid = await (0, import_node_server_utils63.comparePassword)(
       currentPassword,
       user.password
     );
     if (!isPasswordValid)
-      throw new import_node_server_utils62.BadRequestError("Invalid current password.");
+      throw new import_node_server_utils63.BadRequestError("Invalid current password.");
     if (newPassword !== passwordConfirmation)
-      throw new import_node_server_utils62.BadRequestError("Passwords do not match.");
+      throw new import_node_server_utils63.BadRequestError("Passwords do not match.");
     try {
-      hashedPassword = await (0, import_node_server_utils62.hashPassword)(newPassword);
+      hashedPassword = await (0, import_node_server_utils63.hashPassword)(newPassword);
       if (!hashedPassword)
-        throw new import_node_server_utils62.InternalServerError("Error hashing password.");
+        throw new import_node_server_utils63.InternalServerError("Error hashing password.");
       return await updatePassword({ _id: id, password: hashedPassword });
     } catch (error) {
       throw error;
@@ -26333,8 +26845,8 @@ function useAuthController() {
       });
       if (error) {
         const messages = error.details.map((d) => d.message);
-        import_node_server_utils63.logger.log({ level: "error", message: messages.join(", ") });
-        next(new import_node_server_utils63.BadRequestError(messages.join(", ")));
+        import_node_server_utils64.logger.log({ level: "error", message: messages.join(", ") });
+        next(new import_node_server_utils64.BadRequestError(messages.join(", ")));
         return;
       }
       const session = await _login(value);
@@ -26346,7 +26858,7 @@ function useAuthController() {
       res.cookie("sid", session.sid, cookieOptions).cookie("user", session.user, cookieOptions).json(session);
       return;
     } catch (error) {
-      import_node_server_utils63.logger.log({ level: "error", message: error.message });
+      import_node_server_utils64.logger.log({ level: "error", message: error.message });
       next(error);
       return;
     }
@@ -26357,8 +26869,8 @@ function useAuthController() {
     });
     const { error, value } = validation.validate(req.body);
     if (error) {
-      import_node_server_utils63.logger.log({ level: "error", message: error.message });
-      next(new import_node_server_utils63.BadRequestError(error.message));
+      import_node_server_utils64.logger.log({ level: "error", message: error.message });
+      next(new import_node_server_utils64.BadRequestError(error.message));
       return;
     }
     try {
@@ -26366,7 +26878,7 @@ function useAuthController() {
       res.json(session);
       return;
     } catch (error2) {
-      import_node_server_utils63.logger.log({ level: "error", message: error2.message });
+      import_node_server_utils64.logger.log({ level: "error", message: error2.message });
       next(error2);
       return;
     }
@@ -26374,7 +26886,7 @@ function useAuthController() {
   async function logout(req, res, next) {
     const sid = getSessionIdFromRequest(req);
     if (!sid) {
-      next(new import_node_server_utils63.BadRequestError("Session ID is required"));
+      next(new import_node_server_utils64.BadRequestError("Session ID is required"));
       return;
     }
     const refreshToken2 = typeof req.body?.refreshToken === "string" ? req.body.refreshToken : void 0;
@@ -26383,7 +26895,7 @@ function useAuthController() {
       res.json({ message: "Logged out successfully" });
       return;
     } catch (error) {
-      import_node_server_utils63.logger.log({ level: "error", message: error.message });
+      import_node_server_utils64.logger.log({ level: "error", message: error.message });
       next(error);
       return;
     }
@@ -26398,8 +26910,8 @@ function useAuthController() {
     });
     if (error) {
       const messages = error.details.map((d) => d.message);
-      import_node_server_utils63.logger.log({ level: "error", message: messages.join(", ") });
-      next(new import_node_server_utils63.BadRequestError(messages.join(", ")));
+      import_node_server_utils64.logger.log({ level: "error", message: messages.join(", ") });
+      next(new import_node_server_utils64.BadRequestError(messages.join(", ")));
       return;
     }
     const email = value.email;
@@ -26414,7 +26926,7 @@ function useAuthController() {
       res.json({ message });
       return;
     } catch (error2) {
-      import_node_server_utils63.logger.log({ level: "error", message: error2.message });
+      import_node_server_utils64.logger.log({ level: "error", message: error2.message });
       next(error2);
       return;
     }
@@ -26428,8 +26940,8 @@ function useAuthController() {
     const payload = { ...req.body };
     const { error } = validation.validate(payload);
     if (error) {
-      import_node_server_utils63.logger.log({ level: "error", message: error.message });
-      next(new import_node_server_utils63.BadRequestError(error.message));
+      import_node_server_utils64.logger.log({ level: "error", message: error.message });
+      next(new import_node_server_utils64.BadRequestError(error.message));
       return;
     }
     const otp = req.body.otp;
@@ -26444,7 +26956,7 @@ function useAuthController() {
       res.json({ message });
       return;
     } catch (error2) {
-      import_node_server_utils63.logger.log({ level: "error", message: error2.message });
+      import_node_server_utils64.logger.log({ level: "error", message: error2.message });
       next(error2);
       return;
     }
@@ -26459,8 +26971,8 @@ function useAuthController() {
     const { error } = validation.validate(payload);
     if (error) {
       const messages = error.details.map((d) => d.message).join(", ");
-      import_node_server_utils63.logger.log({ level: "error", message: messages });
-      next(new import_node_server_utils63.BadRequestError(messages));
+      import_node_server_utils64.logger.log({ level: "error", message: messages });
+      next(new import_node_server_utils64.BadRequestError(messages));
       return;
     }
     const password = req.body.password;
@@ -26469,7 +26981,7 @@ function useAuthController() {
       res.json({ message });
       return;
     } catch (error2) {
-      import_node_server_utils63.logger.log({ level: "error", message: error2.message });
+      import_node_server_utils64.logger.log({ level: "error", message: error2.message });
       next(error2);
       return;
     }
@@ -26486,10 +26998,10 @@ function useAuthController() {
 
 // src/controllers/user.controller.ts
 var import_joi27 = __toESM(require("joi"));
-var import_node_server_utils65 = require("@7365admin1/node-server-utils");
+var import_node_server_utils66 = require("@7365admin1/node-server-utils");
 
 // src/repositories/person.repo.ts
-var import_node_server_utils64 = require("@7365admin1/node-server-utils");
+var import_node_server_utils65 = require("@7365admin1/node-server-utils");
 var import_mongodb58 = require("mongodb");
 
 // src/utils/sanitizer.ts
@@ -26503,13 +27015,13 @@ var makeContainsRegex = (input) => {
 // src/repositories/person.repo.ts
 var site_people_namespace_collection = "site.people";
 function usePersonRepo() {
-  const db2 = import_node_server_utils64.useAtlas.getDb();
+  const db2 = import_node_server_utils65.useAtlas.getDb();
   if (!db2) {
-    throw new import_node_server_utils64.InternalServerError("Unable to connect to server.");
+    throw new import_node_server_utils65.InternalServerError("Unable to connect to server.");
   }
   const collection = db2.collection(site_people_namespace_collection);
   const vehiclesCollection = db2.collection("vehicles");
-  const { delNamespace, getCache, setCache } = (0, import_node_server_utils64.useCache)(
+  const { delNamespace, getCache, setCache } = (0, import_node_server_utils65.useCache)(
     site_people_namespace_collection
   );
   async function withoutDeletedPlates(people) {
@@ -26558,7 +27070,7 @@ function usePersonRepo() {
         { key: { unit: 1, status: 1 } }
       ]);
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError("Failed to create index on site people.");
+      throw new import_node_server_utils65.InternalServerError("Failed to create index on site people.");
     }
   }
   async function createTextIndex() {
@@ -26571,7 +27083,7 @@ function usePersonRepo() {
         contact: "text"
       });
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError(
+      throw new import_node_server_utils65.InternalServerError(
         "Failed to create text index on site people."
       );
     }
@@ -26581,11 +27093,11 @@ function usePersonRepo() {
       value = MPerson(value);
       const res = await collection.insertOne(value, { session });
       delNamespace().then(() => {
-        import_node_server_utils64.logger.info(
+        import_node_server_utils65.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       }).catch((err) => {
-        import_node_server_utils64.logger.error(
+        import_node_server_utils65.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
@@ -26594,7 +27106,7 @@ function usePersonRepo() {
     } catch (error) {
       const isDuplicated = error.message.includes("duplicate");
       if (isDuplicated) {
-        throw new import_node_server_utils64.BadRequestError("Person already exists.");
+        throw new import_node_server_utils65.BadRequestError("Person already exists.");
       }
       throw error;
     }
@@ -26722,7 +27234,7 @@ function usePersonRepo() {
         collection.aggregate([{ $match: query2 }, { $count: "total" }], { session }).toArray()
       ]);
       const totalCount = countResult[0]?.total || 0;
-      const data = (0, import_node_server_utils64.paginate)(
+      const data = (0, import_node_server_utils65.paginate)(
         await withoutDeletedPlates(items),
         page2,
         limit,
@@ -26737,7 +27249,7 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb58.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils64.BadRequestError("Invalid person transaction ID format.");
+      throw new import_node_server_utils65.BadRequestError("Invalid person transaction ID format.");
     }
     value.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     if (value.updatedBy) {
@@ -26753,11 +27265,11 @@ function usePersonRepo() {
         { session }
       );
       delNamespace().then(() => {
-        import_node_server_utils64.logger.info(
+        import_node_server_utils65.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       }).catch((err) => {
-        import_node_server_utils64.logger.error(
+        import_node_server_utils65.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
@@ -26771,7 +27283,7 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb58.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils64.BadRequestError("Invalid customer ID format.");
+      throw new import_node_server_utils65.BadRequestError("Invalid customer ID format.");
     }
     try {
       const updateValue = {
@@ -26781,14 +27293,14 @@ function usePersonRepo() {
       };
       const res = await collection.updateOne({ _id }, { $set: updateValue });
       if (res.modifiedCount === 0) {
-        throw new import_node_server_utils64.InternalServerError("Unable to delete visitor transaction.");
+        throw new import_node_server_utils65.InternalServerError("Unable to delete visitor transaction.");
       }
       delNamespace().then(() => {
-        import_node_server_utils64.logger.info(
+        import_node_server_utils65.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       }).catch((err) => {
-        import_node_server_utils64.logger.error(
+        import_node_server_utils65.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
@@ -26802,15 +27314,15 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb58.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils64.BadRequestError("Invalid person ID.");
+      throw new import_node_server_utils65.BadRequestError("Invalid person ID.");
     }
-    const cacheKey = (0, import_node_server_utils64.makeCacheKey)(site_people_namespace_collection, {
+    const cacheKey = (0, import_node_server_utils65.makeCacheKey)(site_people_namespace_collection, {
       _id: String(_id)
     });
     try {
       const cached4 = await getCache(cacheKey);
       if (cached4) {
-        import_node_server_utils64.logger.log({
+        import_node_server_utils65.logger.log({
           level: "info",
           message: `Cache hit for getById person: ${cacheKey}`
         });
@@ -26820,34 +27332,34 @@ function usePersonRepo() {
         _id
       });
       setCache(cacheKey, result, 300).then(() => {
-        import_node_server_utils64.logger.log({
+        import_node_server_utils65.logger.log({
           level: "info",
           message: `Cache set for person by id: ${cacheKey}`
         });
       }).catch((err) => {
-        import_node_server_utils64.logger.log({
+        import_node_server_utils65.logger.log({
           level: "error",
           message: `Failed to set cache for person by id: ${err.message}`
         });
       });
       return result;
     } catch (error) {
-      if (error instanceof import_node_server_utils64.AppError) {
+      if (error instanceof import_node_server_utils65.AppError) {
         throw error;
       } else {
-        throw new import_node_server_utils64.InternalServerError("Failed to get person by id.");
+        throw new import_node_server_utils65.InternalServerError("Failed to get person by id.");
       }
     }
   }
   async function getPersonByPlateNumber(plateNumber) {
-    const cacheKey = (0, import_node_server_utils64.makeCacheKey)(site_people_namespace_collection, {
+    const cacheKey = (0, import_node_server_utils65.makeCacheKey)(site_people_namespace_collection, {
       plateNumber,
       key: "get-person-plate-number"
     });
     try {
       const cacheData = await getCache(cacheKey);
       if (cacheData) {
-        import_node_server_utils64.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache hit for key: ${cacheKey}`);
         return await withoutDeletedPlatesOne(cacheData);
       }
       const data = await collection.findOne(
@@ -26855,13 +27367,13 @@ function usePersonRepo() {
         { sort: { _id: -1 } }
       );
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils64.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils64.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils65.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return await withoutDeletedPlatesOne(data);
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError(
+      throw new import_node_server_utils65.InternalServerError(
         "Failed to fetch individual by plate number."
       );
     }
@@ -26873,11 +27385,11 @@ function usePersonRepo() {
         status: "approved"
       };
       if (excludePersonId) {
-        query2._id = { $ne: (0, import_node_server_utils64.toObjectId)(excludePersonId) };
+        query2._id = { $ne: (0, import_node_server_utils65.toObjectId)(excludePersonId) };
       }
       return await collection.findOne(query2);
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError(
+      throw new import_node_server_utils65.InternalServerError(
         "Failed to fetch approved person by plate number."
       );
     }
@@ -26885,47 +27397,47 @@ function usePersonRepo() {
   async function getByNRIC(value) {
     try {
       if (!value || value.trim() === "") {
-        import_node_server_utils64.logger.warn("getByNRIC called with an empty or invalid NRIC value.");
+        import_node_server_utils65.logger.warn("getByNRIC called with an empty or invalid NRIC value.");
         return null;
       }
-      const cacheKey = (0, import_node_server_utils64.makeCacheKey)(site_people_namespace_collection, {
+      const cacheKey = (0, import_node_server_utils65.makeCacheKey)(site_people_namespace_collection, {
         nric: value
       });
       const cachedData = await getCache(cacheKey);
       if (cachedData) {
-        import_node_server_utils64.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache hit for key: ${cacheKey}`);
         return await withoutDeletedPlatesOne(cachedData);
       }
       const data = await collection.findOne({ nric: value });
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils64.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils64.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils65.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return await withoutDeletedPlatesOne(data);
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError("Failed to retrieve person by NRIC.");
+      throw new import_node_server_utils65.InternalServerError("Failed to retrieve person by NRIC.");
     }
   }
   async function getPersonByPhoneNumber(value) {
     try {
-      const cacheKey = (0, import_node_server_utils64.makeCacheKey)(site_people_namespace_collection, {
+      const cacheKey = (0, import_node_server_utils65.makeCacheKey)(site_people_namespace_collection, {
         contact: value
       });
       const cachedData = await getCache(cacheKey);
       if (cachedData) {
-        import_node_server_utils64.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache hit for key: ${cacheKey}`);
         return await withoutDeletedPlatesOne(cachedData);
       }
       const data = await collection.findOne({ contact: value });
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils64.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils64.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils65.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return await withoutDeletedPlatesOne(data);
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError(
+      throw new import_node_server_utils65.InternalServerError(
         "Failed to retrieve person by Phone Number."
       );
     }
@@ -26937,7 +27449,7 @@ function usePersonRepo() {
   }, session) {
     try {
       if (!unit || !import_mongodb58.ObjectId.isValid(unit)) {
-        throw new import_node_server_utils64.BadRequestError("Invalid unit ID.");
+        throw new import_node_server_utils65.BadRequestError("Invalid unit ID.");
       }
       const query2 = {
         unit: new import_mongodb58.ObjectId(unit),
@@ -26982,14 +27494,14 @@ function usePersonRepo() {
       ]).toArray();
       return await withoutDeletedPlates(data);
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError(
+      throw new import_node_server_utils65.InternalServerError(
         "Failed to fetch people type residents by unit."
       );
     }
   }
   async function getCompany(search, orgs) {
     try {
-      const cacheKey = (0, import_node_server_utils64.makeCacheKey)(site_people_namespace_collection, {
+      const cacheKey = (0, import_node_server_utils65.makeCacheKey)(site_people_namespace_collection, {
         company: search
       });
       const baseQuery = {
@@ -27059,18 +27571,18 @@ function usePersonRepo() {
       ]).toArray();
       return data;
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError("Failed to fetch visitor by company.");
+      throw new import_node_server_utils65.InternalServerError("Failed to fetch visitor by company.");
     }
   }
   async function getPeopleByPlateNumber(plateNumber) {
-    const cacheKey = (0, import_node_server_utils64.makeCacheKey)(site_people_namespace_collection, {
+    const cacheKey = (0, import_node_server_utils65.makeCacheKey)(site_people_namespace_collection, {
       plateNumber,
       key: "get-people-plate-number"
     });
     try {
       const cacheData = await getCache(cacheKey);
       if (cacheData) {
-        import_node_server_utils64.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache hit for key: ${cacheKey}`);
         return await withoutDeletedPlates(cacheData);
       }
       const data = await collection.find(
@@ -27078,13 +27590,13 @@ function usePersonRepo() {
         { sort: { _id: -1 } }
       ).toArray();
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils64.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils64.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils65.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return await withoutDeletedPlates(data);
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError("Failed to fetch people by plate number.");
+      throw new import_node_server_utils65.InternalServerError("Failed to fetch people by plate number.");
     }
   }
   async function getPeopleByNRIC({
@@ -27109,13 +27621,13 @@ function usePersonRepo() {
       sort: JSON.stringify(sort)
     };
     try {
-      const cacheKey = (0, import_node_server_utils64.makeCacheKey)(
+      const cacheKey = (0, import_node_server_utils65.makeCacheKey)(
         site_people_namespace_collection,
         cacheOptions
       );
       const cachedData = await getCache(cacheKey);
       if (cachedData) {
-        import_node_server_utils64.logger.info(`Cache hit for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache hit for key: ${cacheKey}`);
         const cachedPage = cachedData;
         return {
           ...cachedPage,
@@ -27124,26 +27636,26 @@ function usePersonRepo() {
       }
       const items = await collection.find(query2).sort(sort).skip(page2 * limit).limit(limit).toArray();
       const length = await collection.countDocuments(query2);
-      const data = (0, import_node_server_utils64.paginate)(
+      const data = (0, import_node_server_utils65.paginate)(
         await withoutDeletedPlates(items),
         page2,
         limit,
         length
       );
       setCache(cacheKey, data, 15 * 60).then(() => {
-        import_node_server_utils64.logger.info(`Cache set for key: ${cacheKey}`);
+        import_node_server_utils65.logger.info(`Cache set for key: ${cacheKey}`);
       }).catch((err) => {
-        import_node_server_utils64.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
+        import_node_server_utils65.logger.error(`Failed to set cache for key: ${cacheKey}`, err);
       });
       return data;
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError("Failed to retrieve person by NRIC.");
+      throw new import_node_server_utils65.InternalServerError("Failed to retrieve person by NRIC.");
     }
   }
   async function pushVehicleById(id, plate, session) {
     const { plateNumber, recNo } = plate;
     const updatedAt2 = (/* @__PURE__ */ new Date()).toISOString();
-    const _id = (0, import_node_server_utils64.toObjectId)(id);
+    const _id = (0, import_node_server_utils65.toObjectId)(id);
     try {
       const updateExisting = await collection.updateOne(
         {
@@ -27176,15 +27688,15 @@ function usePersonRepo() {
         );
       }
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError("Failed to push vehicle plates by nric.");
+      throw new import_node_server_utils65.InternalServerError("Failed to push vehicle plates by nric.");
     }
   }
   async function pullVehicleByRecNo(recNo, scope, session) {
     const updatedAt2 = (/* @__PURE__ */ new Date()).toISOString();
-    const owner = scope?.peopleId ? (0, import_node_server_utils64.toObjectId)(scope.peopleId) : null;
-    const site = scope?.site ? (0, import_node_server_utils64.toObjectId)(scope.site) : null;
+    const owner = scope?.peopleId ? (0, import_node_server_utils65.toObjectId)(scope.peopleId) : null;
+    const site = scope?.site ? (0, import_node_server_utils65.toObjectId)(scope.site) : null;
     if (!owner && !site) {
-      throw new import_node_server_utils64.BadRequestError(
+      throw new import_node_server_utils65.BadRequestError(
         "Cannot remove a vehicle plate without a person or a site."
       );
     }
@@ -27225,24 +27737,24 @@ function usePersonRepo() {
         { session }
       );
     } catch (error) {
-      import_node_server_utils64.logger.log({
+      import_node_server_utils65.logger.log({
         level: "error",
         message: `pullVehicleByRecNo failed on ${matchKey} for ${owner ? "person" : "site"} ${String(owner ?? site)}: ${error?.message ?? error}`
       });
-      throw new import_node_server_utils64.InternalServerError(
+      throw new import_node_server_utils65.InternalServerError(
         "Could not take the plate off the resident's record."
       );
     }
   }
   async function getByUserId(userId) {
-    const user = (0, import_node_server_utils64.toObjectId)(userId);
-    const cacheKey = (0, import_node_server_utils64.makeCacheKey)(site_people_namespace_collection, {
+    const user = (0, import_node_server_utils65.toObjectId)(userId);
+    const cacheKey = (0, import_node_server_utils65.makeCacheKey)(site_people_namespace_collection, {
       user: userId
     });
     try {
       const cached4 = await getCache(cacheKey);
       if (cached4) {
-        import_node_server_utils64.logger.log({
+        import_node_server_utils65.logger.log({
           level: "info",
           message: `Cache hit for getByUserId person: ${cacheKey}`
         });
@@ -27252,22 +27764,22 @@ function usePersonRepo() {
         user
       });
       setCache(cacheKey, result, 15 * 60).then(() => {
-        import_node_server_utils64.logger.log({
+        import_node_server_utils65.logger.log({
           level: "info",
           message: `Cache set for person by user: ${cacheKey}`
         });
       }).catch((err) => {
-        import_node_server_utils64.logger.log({
+        import_node_server_utils65.logger.log({
           level: "error",
           message: `Failed to set cache for person by user: ${err.message}`
         });
       });
       return result;
     } catch (error) {
-      if (error instanceof import_node_server_utils64.AppError) {
+      if (error instanceof import_node_server_utils65.AppError) {
         throw error;
       } else {
-        throw new import_node_server_utils64.InternalServerError("Failed to get person by user.");
+        throw new import_node_server_utils65.InternalServerError("Failed to get person by user.");
       }
     }
   }
@@ -27276,7 +27788,7 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb58.ObjectId(_id);
     } catch (error) {
-      throw new import_node_server_utils64.BadRequestError("Invalid ID format.");
+      throw new import_node_server_utils65.BadRequestError("Invalid ID format.");
     }
     try {
       const res = await collection.updateOne(
@@ -27285,14 +27797,14 @@ function usePersonRepo() {
         { session }
       );
       if (res.modifiedCount === 0) {
-        throw new import_node_server_utils64.InternalServerError(`Unable to ${value.status}   person.`);
+        throw new import_node_server_utils65.InternalServerError(`Unable to ${value.status}   person.`);
       }
       delNamespace().then(() => {
-        import_node_server_utils64.logger.info(
+        import_node_server_utils65.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       }).catch((err) => {
-        import_node_server_utils64.logger.error(
+        import_node_server_utils65.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
@@ -27308,7 +27820,7 @@ function usePersonRepo() {
       const data = await collection.find(query2, { session }).limit(10).toArray();
       return data;
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError("Failed to find persons" + error);
+      throw new import_node_server_utils65.InternalServerError("Failed to find persons" + error);
     }
   }
   async function addFromVisitor(value, session) {
@@ -27343,7 +27855,7 @@ function usePersonRepo() {
       _id = new import_mongodb58.ObjectId(personId);
       acceptedTerms = new import_mongodb58.ObjectId(termsId);
     } catch {
-      throw new import_node_server_utils64.BadRequestError("Invalid ID format.");
+      throw new import_node_server_utils65.BadRequestError("Invalid ID format.");
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     try {
@@ -27352,7 +27864,7 @@ function usePersonRepo() {
         { $set: { acceptedTerms, acceptedTermsAt: now, updatedAt: now } }
       );
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError("Failed to record terms acceptance.");
+      throw new import_node_server_utils65.InternalServerError("Failed to record terms acceptance.");
     }
   }
   async function getAcceptedTerms(personId) {
@@ -27360,7 +27872,7 @@ function usePersonRepo() {
     try {
       _id = new import_mongodb58.ObjectId(personId);
     } catch {
-      throw new import_node_server_utils64.BadRequestError("Invalid person ID format.");
+      throw new import_node_server_utils65.BadRequestError("Invalid person ID format.");
     }
     try {
       return await collection.findOne(
@@ -27368,11 +27880,11 @@ function usePersonRepo() {
         { projection: { acceptedTerms: 1, acceptedTermsAt: 1, _id: 0 } }
       );
     } catch (error) {
-      throw new import_node_server_utils64.InternalServerError("Failed to read terms acceptance.");
+      throw new import_node_server_utils65.InternalServerError("Failed to read terms acceptance.");
     }
   }
   async function updatePlateNumberByUserId(userId, plateNumber, session) {
-    const user = (0, import_node_server_utils64.toObjectId)(userId);
+    const user = (0, import_node_server_utils65.toObjectId)(userId);
     try {
       const result = await collection.updateOne(
         { user },
@@ -27386,25 +27898,25 @@ function usePersonRepo() {
         { session }
       );
       if (result.matchedCount === 0) {
-        throw new import_node_server_utils64.BadRequestError("Person not found for this user.");
+        throw new import_node_server_utils65.BadRequestError("Person not found for this user.");
       }
       try {
         await delNamespace();
-        import_node_server_utils64.logger.info(
+        import_node_server_utils65.logger.info(
           `Cache cleared for namespace: ${site_people_namespace_collection}`
         );
       } catch (err) {
-        import_node_server_utils64.logger.error(
+        import_node_server_utils65.logger.error(
           `Failed to clear cache for namespace: ${site_people_namespace_collection}`,
           err
         );
       }
       return "Successfully updated plate number.";
     } catch (error) {
-      if (error instanceof import_node_server_utils64.BadRequestError) {
+      if (error instanceof import_node_server_utils65.BadRequestError) {
         throw error;
       }
-      throw new import_node_server_utils64.InternalServerError("Failed to update plate number.");
+      throw new import_node_server_utils65.InternalServerError("Failed to update plate number.");
     }
   }
   return {
@@ -27467,8 +27979,8 @@ function useUserController() {
     const _id = req.params.id;
     const { error } = validation.validate(_id);
     if (error) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error.message}` });
-      next(new import_node_server_utils65.BadRequestError(error.message));
+      import_node_server_utils66.logger.log({ level: "error", message: `${error.message}` });
+      next(new import_node_server_utils66.BadRequestError(error.message));
       return;
     }
     try {
@@ -27477,7 +27989,7 @@ function useUserController() {
       res.json(user);
       return;
     } catch (error2) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error2.message}` });
+      import_node_server_utils66.logger.log({ level: "error", message: `${error2.message}` });
       next(error2);
       return;
     }
@@ -27492,8 +28004,8 @@ function useUserController() {
     const query2 = { ...req.query };
     const { error } = validation.validate(query2);
     if (error) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error.message}` });
-      next(new import_node_server_utils65.BadRequestError(error.message));
+      import_node_server_utils66.logger.log({ level: "error", message: `${error.message}` });
+      next(new import_node_server_utils66.BadRequestError(error.message));
       return;
     }
     const search = req.query.search ?? "";
@@ -27511,7 +28023,7 @@ function useUserController() {
       res.json(data);
       return;
     } catch (error2) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error2.message}` });
+      import_node_server_utils66.logger.log({ level: "error", message: `${error2.message}` });
       next(error2);
       return;
     }
@@ -27521,8 +28033,8 @@ function useUserController() {
     const email = req.params.email;
     const { error } = validation.validate(email);
     if (error) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error.message}` });
-      next(new import_node_server_utils65.BadRequestError(error.message));
+      import_node_server_utils66.logger.log({ level: "error", message: `${error.message}` });
+      next(new import_node_server_utils66.BadRequestError(error.message));
       return;
     }
     try {
@@ -27535,7 +28047,7 @@ function useUserController() {
       res.json(publicIdentity(user));
       return;
     } catch (error2) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error2.message}` });
+      import_node_server_utils66.logger.log({ level: "error", message: `${error2.message}` });
       next(error2);
       return;
     }
@@ -27549,8 +28061,8 @@ function useUserController() {
     const query2 = { ...req.query };
     const { error } = validation.validate(query2);
     if (error) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error.message}` });
-      next(new import_node_server_utils65.BadRequestError(error.message));
+      import_node_server_utils66.logger.log({ level: "error", message: `${error.message}` });
+      next(new import_node_server_utils66.BadRequestError(error.message));
       return;
     }
     const search = req.query.search ?? "";
@@ -27562,7 +28074,7 @@ function useUserController() {
       res.json(data);
       return;
     } catch (error2) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error2.message}` });
+      import_node_server_utils66.logger.log({ level: "error", message: `${error2.message}` });
       next(error2);
       return;
     }
@@ -27579,8 +28091,8 @@ function useUserController() {
     const payload = { ...req.body };
     const { error } = validation.validate({ id, ...payload });
     if (error) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error.message}` });
-      next(new import_node_server_utils65.BadRequestError(error.message));
+      import_node_server_utils66.logger.log({ level: "error", message: `${error.message}` });
+      next(new import_node_server_utils66.BadRequestError(error.message));
       return;
     }
     try {
@@ -27588,14 +28100,14 @@ function useUserController() {
       res.status(201).json({ message: "Successfully created account." });
       return;
     } catch (error2) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error2.message}` });
+      import_node_server_utils66.logger.log({ level: "error", message: `${error2.message}` });
       next(error2);
       return;
     }
   }
   async function updateUserProfile(req, res, next) {
     if (!req.file) {
-      next(new import_node_server_utils65.BadRequestError("File is required!"));
+      next(new import_node_server_utils66.BadRequestError("File is required!"));
       return;
     }
     const validation = import_joi27.default.object({
@@ -27604,8 +28116,8 @@ function useUserController() {
     const payload = { ...req.body };
     const { error } = validation.validate(payload);
     if (error) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error.message}` });
-      next(new import_node_server_utils65.BadRequestError(error.message));
+      import_node_server_utils66.logger.log({ level: "error", message: `${error.message}` });
+      next(new import_node_server_utils66.BadRequestError(error.message));
       return;
     }
     const user = req.headers.user ?? "";
@@ -27618,7 +28130,7 @@ function useUserController() {
       res.json({ message: "Successfully updated profile picture." });
       return;
     } catch (error2) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error2.message}` });
+      import_node_server_utils66.logger.log({ level: "error", message: `${error2.message}` });
       next(error2);
       return;
     }
@@ -27647,8 +28159,8 @@ function useUserController() {
     const payload = { ...req.body };
     const { error } = validation.validate({ _id, ...payload });
     if (error) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error.message}` });
-      next(new import_node_server_utils65.BadRequestError(error.message));
+      import_node_server_utils66.logger.log({ level: "error", message: `${error.message}` });
+      next(new import_node_server_utils66.BadRequestError(error.message));
       return;
     }
     try {
@@ -27657,7 +28169,7 @@ function useUserController() {
       res.json({ message });
       return;
     } catch (error2) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error2.message}` });
+      import_node_server_utils66.logger.log({ level: "error", message: `${error2.message}` });
       next(error2);
       return;
     }
@@ -27689,8 +28201,8 @@ function useUserController() {
     const payload = { ...req.body };
     const { error } = validation.validate({ _id, ...payload });
     if (error) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error.message}` });
-      next(new import_node_server_utils65.BadRequestError(error.message));
+      import_node_server_utils66.logger.log({ level: "error", message: `${error.message}` });
+      next(new import_node_server_utils66.BadRequestError(error.message));
       return;
     }
     try {
@@ -27710,7 +28222,7 @@ function useUserController() {
       res.json({ message });
       return;
     } catch (error2) {
-      import_node_server_utils65.logger.log({ level: "error", message: `${error2.message}` });
+      import_node_server_utils66.logger.log({ level: "error", message: `${error2.message}` });
       next(error2);
       return;
     }
@@ -27729,7 +28241,7 @@ function useUserController() {
       ...payload
     });
     if (error) {
-      next(new import_node_server_utils65.BadRequestError(error.message));
+      next(new import_node_server_utils66.BadRequestError(error.message));
       return;
     }
     const currentPassword = req.body.currentPassword ?? "";
@@ -27766,16 +28278,16 @@ var import_joi28 = __toESM(require("joi"));
 var import_node_server_utils71 = require("@7365admin1/node-server-utils");
 
 // src/repositories/org-role-seed.repo.ts
-var import_node_server_utils66 = require("@7365admin1/node-server-utils");
+var import_node_server_utils67 = require("@7365admin1/node-server-utils");
 var import_mongodb59 = require("mongodb");
 var namespace_collection = "org-default-role-seeds";
 function toOrgId(org) {
   return typeof org === "string" ? new import_mongodb59.ObjectId(org) : org;
 }
 function useOrgRoleSeedRepo() {
-  const db2 = import_node_server_utils66.useAtlas.getDb();
+  const db2 = import_node_server_utils67.useAtlas.getDb();
   if (!db2) {
-    throw new import_node_server_utils66.InternalServerError("Unable to connect to server.");
+    throw new import_node_server_utils67.InternalServerError("Unable to connect to server.");
   }
   const collection = db2.collection(namespace_collection);
   const roles = db2.collection("roles");
@@ -27799,7 +28311,7 @@ function useOrgRoleSeedRepo() {
 }
 
 // src/services/role.service.ts
-var import_node_server_utils67 = require("@7365admin1/node-server-utils");
+var import_node_server_utils68 = require("@7365admin1/node-server-utils");
 function useRoleService() {
   const {
     deleteRole: _deleteRole,
@@ -27811,7 +28323,7 @@ function useRoleService() {
     try {
       const count = await getByRoleId(_id);
       if (count > 0) {
-        throw new import_node_server_utils67.BadRequestError(
+        throw new import_node_server_utils68.BadRequestError(
           "Cannot delete role that is assigned to members."
         );
       }
@@ -27823,16 +28335,16 @@ function useRoleService() {
   async function getDeletionPreview(_id) {
     const role = await getRoleById(_id);
     if (!role) {
-      throw new import_node_server_utils67.NotFoundError("Role not found.");
+      throw new import_node_server_utils68.NotFoundError("Role not found.");
     }
     const members = await getAssignedByRoleId(_id);
     const replacementRoles = (await getActiveByTypeOrg(role.type ?? "", role.org ?? "")).filter((replacementRole) => replacementRole._id?.toString() !== _id);
     return { role, members, replacementRoles };
   }
   async function deleteWithReassignments(_id, reassignments) {
-    const session = import_node_server_utils67.useAtlas.getClient()?.startSession();
+    const session = import_node_server_utils68.useAtlas.getClient()?.startSession();
     if (!session) {
-      throw new import_node_server_utils67.InternalServerError("Unable to start role deletion transaction.");
+      throw new import_node_server_utils68.InternalServerError("Unable to start role deletion transaction.");
     }
     try {
       session.startTransaction();
@@ -27849,7 +28361,7 @@ function useRoleService() {
         ({ roleId }) => replacementRoleIds.has(roleId)
       );
       if (!hasExactMemberCoverage || !hasEligibleReplacementRoles) {
-        throw new import_node_server_utils67.BadRequestError("Invalid role reassignment request.");
+        throw new import_node_server_utils68.BadRequestError("Invalid role reassignment request.");
       }
       await reassignRoles(reassignments, session);
       await _deleteRole(_id, session);
@@ -27866,7 +28378,7 @@ function useRoleService() {
 }
 
 // src/utils/role-scope.util.ts
-var import_node_server_utils68 = require("@7365admin1/node-server-utils");
+var import_node_server_utils69 = require("@7365admin1/node-server-utils");
 function roleScope(role) {
   if ((role?.type ?? "") === PLATFORM_STAFF_ROLE_TYPE)
     return "platform";
@@ -27900,7 +28412,7 @@ function requireNoPlatformGrant(role, next) {
   const added = platformPermissionsAdded(next, role?.permissions);
   if (added.length === 0)
     return;
-  throw new import_node_server_utils68.AppError(
+  throw new import_node_server_utils69.AppError(
     "These are Seven365 console permissions and cannot be granted on a client role: " + added.join(", "),
     403
   );
@@ -27915,7 +28427,7 @@ function refuseSharedClientTemplate(role, next) {
     return true;
   if (Array.isArray(next) && restorableFromHistory(role, next))
     return true;
-  throw new import_node_server_utils68.AppError(
+  throw new import_node_server_utils69.AppError(
     "This role is shared by every client that was invited with it and cannot be changed here.",
     403
   );
@@ -27923,7 +28435,7 @@ function refuseSharedClientTemplate(role, next) {
 function refuseNewSharedClientTemplate(role) {
   if (roleScope(role) !== "client-template")
     return;
-  throw new import_node_server_utils68.AppError(
+  throw new import_node_server_utils69.AppError(
     "A role with no organisation would be shared by every client and cannot be created. Choose the organisation this role belongs to.",
     403
   );
@@ -27961,113 +28473,6 @@ function recordablePriorPermissions(role) {
   return [...held];
 }
 
-// src/utils/org-default-roles.util.ts
-var import_node_server_utils69 = require("@7365admin1/node-server-utils");
-var APP_SERVICE_TYPES = new Set(
-  Object.values(AppServiceType)
-);
-var ADMINISTRATOR_PERMISSIONS = Object.freeze([
-  "members:view-members",
-  "members:assign-member-role",
-  "members:suspend-member",
-  "members:activate-member",
-  "members:delete-member",
-  "invitations:create-invitation",
-  "invitations:view-invitations",
-  "invitations:cancel-invitation",
-  "roles:see-all-roles",
-  "roles:see-role-details",
-  "roles:add-role",
-  "roles:update-role",
-  "roles:delete-role"
-]);
-function defaultOwnerRoles(org, nature, appOwnerPermissions) {
-  if (!org?.toString())
-    return [];
-  const owner = {
-    org,
-    name: "owner",
-    permissions: ["*"],
-    default: true
-  };
-  const administrator = {
-    org,
-    name: "Administrator",
-    permissions: [...ADMINISTRATOR_PERMISSIONS],
-    default: true
-  };
-  const roles = [
-    { ...owner, type: "organization" },
-    { ...administrator, type: "organization" }
-  ];
-  const appType = serviceAppType(nature);
-  if (appType && APP_SERVICE_TYPES.has(appType)) {
-    roles.push({
-      ...owner,
-      type: appType,
-      ...appOwnerPermissions?.length && { permissions: [...appOwnerPermissions] }
-    });
-    roles.push({ ...administrator, type: appType });
-  }
-  return roles;
-}
-async function seedDefaultOrgRoles(addRole, org, nature, appOwnerPermissions) {
-  const seeded = [];
-  try {
-    for (const role of defaultOwnerRoles(org, nature, appOwnerPermissions)) {
-      const id = await addRole(role);
-      if (id)
-        seeded.push({ type: String(role.type), id: String(id), name: role.name });
-    }
-  } catch (error) {
-    import_node_server_utils69.logger.log({
-      level: "error",
-      message: `Failed to seed default roles for organization ${org}: ${error?.message}`
-    });
-  }
-  return seeded;
-}
-async function healOrgDefaultRoles(deps, org) {
-  if (!org?.toString())
-    return 0;
-  let claimed = false;
-  try {
-    claimed = await deps.claim(org);
-    if (!claimed)
-      return 0;
-    const existing = await deps.countRoles(org);
-    if (existing > 0) {
-      import_node_server_utils69.logger.log({
-        level: "info",
-        message: `Default role self-heal skipped for organization ${org}: ${existing} role(s) already present`
-      });
-      return 0;
-    }
-    const roles = defaultOwnerRoles(org, await deps.getNature(org));
-    for (const role of roles) {
-      await deps.addRole(role);
-    }
-    import_node_server_utils69.logger.log({
-      level: "info",
-      message: `Seeded ${roles.length} default role(s) for existing organization ${org} on read`
-    });
-    return roles.length;
-  } catch (error) {
-    if (claimed) {
-      await deps.release(org).catch(() => void 0);
-    }
-    import_node_server_utils69.logger.log({
-      level: "error",
-      message: `Failed to self-heal default roles for organization ${org}: ${error?.message}`
-    });
-    return 0;
-  }
-}
-function clientInviteOwnerPermissionsOn(env2 = process.env) {
-  const value = String(env2.CLIENT_INVITE_OWNER_PERMISSIONS ?? "on").trim().toLowerCase();
-  return !["off", "false", "0", "no"].includes(value);
-}
-
 // src/utils/module-ceiling.util.ts
 var import_node_server_utils70 = require("@7365admin1/node-server-utils");
 async function moduleCeiling(org, site) {
@@ -28250,7 +28655,9 @@ function useRoleController() {
       limit: import_joi28.default.number().integer().min(1).max(100).allow("", null).default(10),
       type: import_joi28.default.string().optional().allow("", null),
       org: import_joi28.default.string().hex().optional().allow("", null),
-      site: import_joi28.default.string().hex().optional().allow("", null)
+      site: import_joi28.default.string().hex().optional().allow("", null),
+      // "organisation": only the roles with no site (Organization app, service roles made once)
+      scope: import_joi28.default.string().valid("organisation").optional().allow("", null)
     });
     const query2 = { ...req.query };
     const { error } = validation.validate(query2);
@@ -28265,18 +28672,19 @@ function useRoleController() {
     const type = req.query.type ?? "";
     const org = req.query.org ?? "";
     const site = req.query.site ?? "";
+    const scope = req.query.scope ?? "";
     try {
       if (org) {
         await requireOrgReach(req, org);
       }
-      let data = await _getRoles({ search, page: page2, limit, type, org, site });
-      const listIsWholeOrg = org && !search && !site && page2 === 1;
+      let data = await _getRoles({ search, page: page2, limit, type, org, site, scope });
+      const listIsWholeOrg = org && !search && !site && !scope && page2 === 1;
       const listed = data?.items;
       if (listIsWholeOrg && listed?.length === 0) {
         const seeded = await healDefaultRoles(org).catch(() => 0);
         if (seeded > 0) {
           try {
-            data = await _getRoles({ search, page: page2, limit, type, org, site });
+            data = await _getRoles({ search, page: page2, limit, type, org, site, scope });
           } catch (error2) {
             import_node_server_utils71.logger.log({ level: "error", message: error2.message });
           }
@@ -28724,7 +29132,8 @@ function useMemberService() {
         }
       }
     }
-    await _updateRoleById(id, role);
+    const placedBy = member.siteId && !newRole?.site && callerId5 && import_mongodb60.ObjectId.isValid(callerId5) && String(member.user ?? "") !== callerId5 ? callerId5 : void 0;
+    await _updateRoleById(id, role, placedBy);
     return { message: "Member role updated successfully." };
   }
   async function updateSiteById(id, siteId, siteName) {
@@ -28772,6 +29181,7 @@ function useMemberService() {
 var import_node_server_utils73 = require("@7365admin1/node-server-utils");
 var import_mongodb61 = require("mongodb");
 var EXCLUDED_TYPES = ["resident", PLATFORM_STAFF_MEMBER_TYPE];
+var ORG_ROLE_EXCLUDED = [...EXCLUDED_TYPES, "organization"];
 var both = (id) => [id, new import_mongodb61.ObjectId(id)];
 function useMemberSiteAccessService() {
   const { add, updateMemberStatus, updateRoleById } = useMemberRepo();
@@ -28811,10 +29221,13 @@ function useMemberSiteAccessService() {
     const roles = await db2().collection("roles").find({
       $or: [
         { _id: { $in: roleIds.map((r) => new import_mongodb61.ObjectId(r)) } },
-        { org: { $in: both(org) }, site: { $in: [...sites.keys()].flatMap(both) }, status: "active" }
+        { org: { $in: both(org) }, site: { $in: [...sites.keys()].flatMap(both) }, status: "active" },
+        // organisation-level service roles (no site; never the org-console type)
+        { org: { $in: both(org) }, site: { $in: ["", null] }, status: "active", type: { $nin: ORG_ROLE_EXCLUDED } }
       ]
     }).project({ name: 1, type: 1, site: 1, org: 1, status: 1 }).toArray();
     const byId = new Map(roles.map((r) => [String(r._id), r]));
+    const orgRoles = roles.filter((r) => !String(r.site ?? "") && String(r.org ?? "") === org && r.status === "active" && !ORG_ROLE_EXCLUDED.includes(r.type)).map((r) => ({ _id: String(r._id), name: r.name ?? "", type: r.type ?? "", scope: "organisation" })).sort((a, b) => a.name.localeCompare(b.name));
     const view = (m) => ({
       _id: String(m._id),
       role: String(m.role ?? ""),
@@ -28828,7 +29241,7 @@ function useMemberSiteAccessService() {
         ...s,
         membership: here[0] ?? null,
         memberships: here,
-        roles: roles.filter((r) => String(r.site ?? "") === s.site && String(r.org ?? "") === org && r.status === "active" && !EXCLUDED_TYPES.includes(r.type)).map((r) => ({ _id: String(r._id), name: r.name ?? "", type: r.type ?? "" }))
+        roles: roles.filter((r) => String(r.site ?? "") === s.site && String(r.org ?? "") === org && r.status === "active" && !EXCLUDED_TYPES.includes(r.type)).map((r) => ({ _id: String(r._id), name: r.name ?? "", type: r.type ?? "", scope: "site" })).concat(orgRoles)
       };
     }).sort((a, b) => a.name.localeCompare(b.name));
     const orgWide = members.filter((m) => !String(m.siteId ?? "")).map(view);
@@ -28854,7 +29267,7 @@ function useMemberSiteAccessService() {
         throw new import_node_server_utils73.BadRequestError("A site is listed twice.");
       seen2.add(choice.site);
       if (!row.roles.some((r) => r._id === choice.role)) {
-        throw new import_node_server_utils73.BadRequestError(`Choose a role created for ${row.name || "that site"}.`);
+        throw new import_node_server_utils73.BadRequestError(`Choose a role created for ${row.name || "that site"}, or one of the organisation's service roles.`);
       }
     }
     const userDoc = await db2().collection("users").findOne({ _id: new import_mongodb61.ObjectId(user) }, { projection: { email: 1, name: 1 } });
@@ -28868,10 +29281,11 @@ function useMemberSiteAccessService() {
       const choice = sites.find((c) => c.site === row.site);
       const role = choice ? row.roles.find((r) => r._id === choice.role) : null;
       const keep = role ? row.memberships.find((m) => m.type === role.type) : void 0;
-      if (role && keep && keep.role !== role._id) {
+      if (role && keep && (keep.role !== role._id || role.scope === "organisation")) {
         reroles.push(async () => {
-          await updateRoleById(keep._id, role._id);
-          applied.changed.push(row.site);
+          await updateRoleById(keep._id, role._id, actor);
+          if (keep.role !== role._id)
+            applied.changed.push(row.site);
         });
       } else if (role && !keep) {
         adds.push(async () => {
@@ -28880,7 +29294,7 @@ function useMemberSiteAccessService() {
             { projection: { _id: 1 } }
           );
           if (old) {
-            await updateRoleById(old._id, role._id);
+            await updateRoleById(old._id, role._id, actor);
             await updateMemberStatus(old._id, { status: suspended ? "suspended" : "active" });
           } else {
             await add({
@@ -28894,6 +29308,8 @@ function useMemberSiteAccessService() {
               siteId: row.site,
               siteName: row.name,
               dateInvited: (/* @__PURE__ */ new Date()).toISOString(),
+              // "placed at this site by the editor": confines an organisation role to it (siteInvitedPins)
+              createdBy: actor,
               ...suspended ? { status: "suspended" } : {}
             });
           }
@@ -100838,6 +101254,10 @@ function useServiceProviderInviteController() {
     softDelete: _softDelete,
     decline: _decline,
     accept: _accept,
+    acceptAsNewCompany: _acceptAsNewCompany,
+    wrongJoinPreview: _wrongJoinPreview,
+    repairWrongJoin: _repairWrongJoin,
+    undoWrongJoin: _undoWrongJoin,
     linkSite: _linkSite,
     listReceived: _listReceived,
     getForProvider: _getForProvider
@@ -101009,6 +101429,42 @@ function useServiceProviderInviteController() {
       next(error);
     }
   }
+  async function acceptNewCompany(req, res, next) {
+    try {
+      const { error, value } = import_joi149.default.object({
+        companyName: import_joi149.default.string().trim().max(200).optional().allow("", null),
+        country: import_joi149.default.string().trim().max(100).optional().allow("", null)
+      }).validate(req.body ?? {}, { stripUnknown: true });
+      if (error)
+        throw new import_node_server_utils293.BadRequestError(`Invalid input: ${error.message}`);
+      res.json(
+        await _acceptAsNewCompany({
+          id: inviteId(req),
+          userId: callerId5(req),
+          companyName: value.companyName ?? "",
+          country: value.country ?? ""
+        })
+      );
+    } catch (error) {
+      next(error);
+    }
+  }
+  function wrongJoin(action) {
+    return async (req, res, next) => {
+      try {
+        await requireConsolePermission(req, "sp-approvals", "approve-sp");
+        const args = { id: inviteId(req), userId: callerId5(req) };
+        res.json(
+          action === "preview" ? await _wrongJoinPreview(args) : action === "repair" ? await _repairWrongJoin(args) : await _undoWrongJoin(args)
+        );
+      } catch (error) {
+        next(error);
+      }
+    };
+  }
+  const wrongJoinPreview = wrongJoin("preview");
+  const wrongJoinRepair = wrongJoin("repair");
+  const wrongJoinUndo = wrongJoin("undo");
   async function linkSite(req, res, next) {
     try {
       res.json(
@@ -101059,6 +101515,10 @@ function useServiceProviderInviteController() {
     remove,
     decline,
     accept,
+    acceptNewCompany,
+    wrongJoinPreview,
+    wrongJoinRepair,
+    wrongJoinUndo,
     linkSite,
     received,
     getOne
@@ -107632,6 +108092,8 @@ function usePersonalEmergencyChainController() {
   HID_PERMISSION_CATEGORIES,
   HID_UINT32_MAX,
   HID_UINT64_MAX,
+  INVITE_EMAIL_EVENTS,
+  INVITE_RESEND_MIN_MINUTES,
   LIFT_DOOR,
   LIFT_LEASE_MS,
   LIFT_MODE,
@@ -108040,6 +108502,9 @@ function usePersonalEmergencyChainController() {
   incidentReportLog,
   incidents_namespace_collection,
   invitationOffersRole,
+  inviteEmailFailureReason,
+  inviteEmailStatus,
+  inviteResendWaitMinutes,
   isAvailableForWork,
   isCameraEntitled,
   isCrossSiteRole,
@@ -108428,6 +108893,7 @@ function usePersonalEmergencyChainController() {
   serviceProviderInviteScope,
   serviceProviderInviteViewStatus,
   serviceProviderInviterKind,
+  serviceProviderNatureFor,
   serviceTypeLabel,
   sessionSchema,
   setIO,