@7365admin1/core 3.64.5 → 3.65.0

package/dist/index.d.ts

@@ -3,6 +3,8 @@ import { ObjectId, ClientSession, Db, Collection, Document, AggregateOptions } f
 import Joi from 'joi';
 import { Request, Response, NextFunction } from 'express';
 import * as bson from 'bson';
+import * as qs from 'qs';
+import * as express_serve_static_core from 'express-serve-static-core';
 import { z } from 'zod';
 import * as urllib from 'urllib';
 import { Server } from 'socket.io';
@@ -490,10 +492,474 @@ declare function useMemberRepo(): {
     }) => Promise<string[]>;
 };
 
+/**
+ * THE SEVEN365 STAFF CONSOLE CATALOGUE, ON THE SERVER.
+ *
+ * `console-authz.util.ts` `requirePlatformStaff` answers ONE question — is this
+ * session a Seven365 staff membership — and twelve controllers ask it before
+ * every console write. It has never read which modules the staff role holds, so
+ * a staff account onboarded onto a role ticked for Promo Codes alone could still
+ * suspend a client, publish platform Terms, mint a subscription and read every
+ * user on the platform. The console's own guard
+ * (`web-app-org middleware/console-tier.global.ts` + `composables/useConsoleGate.ts`,
+ * shipped in org #186) hides those screens from that role, but hiding a screen
+ * is drawing, not securing: the endpoint behind it answered anybody with a staff
+ * session. This file is the server half.
+ *
+ * ## The catalogue is a MIRROR, and it is pinned as one
+ *
+ * The strings below are `web-app-org composables/useAdminPermission.ts` — the
+ * tick-boxes a `type: "admin"` role is actually built from — plus the two
+ * families that composable pulls out of layer-common's `useCommonPermissions`
+ * (`members`, `roles-and-permissions`). It is copied rather than imported
+ * because `core` is a backend package and cannot depend on a Nuxt layer; a
+ * server that invented its own vocabulary would be the
+ * `visitor:create`/`visitor-mgmt:add-visitor` split all over again — a string
+ * the server enforces that no role editor can grant.
+ *
+ * ## THE EMPTY-LIST RULE — why switching this on locks nobody out
+ *
+ * `user.service.ts createDefaultUser()` seeds the platform-staff role with
+ * `permissions: []`, NOT `["*"]`. A plain membership test over this catalogue
+ * would therefore refuse the Seven365 owner's own account on the day it shipped.
+ *
+ * So an EMPTY list means "everything", exactly as it does today, and `"*"` keeps
+ * the short-circuit it has everywhere else in the estate. Both spellings the
+ * staging owner role and the seeder can produce (`["*"]` and `[]`) allow all, so
+ * **no role, member or user document has to be written for this to ship** —
+ * which matters, because nothing in a repo may write one.
+ *
+ * The moment somebody ticks a module on a staff role, that role becomes
+ * governed at BOTH ends. That is the intended behaviour, and it is the one case
+ * to check before granting: a staff role that already holds a partial list is
+ * enforced immediately.
+ *
+ * ## WIDENING ONLY
+ *
+ * Every check here is layered ON TOP of the staff identity test, never in place
+ * of it — nobody who was refused before is admitted now. And the match accepts
+ * ANY shipped spelling of a grant, the rule
+ * `layer-common utils/permission-spellings.ts` already applies on the client:
+ * `-admin`'s role editor writes `roles-and-permissions:add-role` while eight
+ * apps write `roles:add-role`, and a role holding either must pass. Accepting
+ * both costs nothing and needs no role migration; picking one would silently
+ * un-grant every role holding the other.
+ */
+/** Console resource -> the actions a staff role can be granted on it. */
+declare const CONSOLE_PERMISSIONS: Readonly<Record<string, readonly string[]>>;
+/** Every shipped spelling of `resource:action`. */
+declare function consoleSpellings(resource: string, action: string): readonly string[];
+/** True when this staff role is ungoverned and reaches the whole console. */
+declare function consoleRoleAllowsAll(held?: readonly string[] | null): boolean;
+/**
+ * May a staff role holding `held` take `action` on `resource`?
+ *
+ * Omit `action` to ask the SCREEN question — "does this role reach the resource
+ * at all" — which is `consoleCanSee` on the client: any single action on the
+ * resource is enough. Used where the catalogue has no string for the operation
+ * (creating a client organisation, writing a platform role/member row), because
+ * inventing a `create-organization` string here would be a grant no role editor
+ * anywhere can tick.
+ *
+ * An unknown resource, or an action the catalogue does not carry, is REFUSED for
+ * a governed role — the same answer `hasPermission` gives on the client, and the
+ * control the tests assert.
+ */
+declare function consoleRoleAllows(held: readonly string[] | null | undefined, resource: string, action?: string): boolean;
+/**
+ * THE CROSS-CLIENT GRANT — the one string that lets Seven365 staff out of
+ * tenant scoping.
+ *
+ * Every tenant-scoping helper in this package (`requireSiteReach`,
+ * `siteReachOf`, `entitledSites`, `requireOwnUnit`, `requireOrgReach`) opened
+ * with `if (actor.isSuperAdmin) return`. That is an IDENTITY test: it asks who
+ * the caller is and never asks what their staff role is ticked for. So a staff
+ * account onboarded onto a role holding Promo Codes alone still read and wrote
+ * every client's sites, people, files, documents, forms and facilities — the
+ * console gate shipped at revision 35 governs the console's OWN endpoints, and
+ * these are the tenant ones behind it.
+ *
+ * `organizations` is the catalogue string that already means "this staff role
+ * reaches across clients" (`CONSOLE_PERMISSIONS.organizations` =
+ * `see-all-organizations` / `see-organization-details`), and it is a tick-box
+ * the admin role editor can actually grant. No new vocabulary is invented — a
+ * string the server enforces that no editor can grant is the
+ * `visitor:create` mistake, and this deliberately avoids it. The SCREEN
+ * question is asked (no `action`), so either tick is enough.
+ */
+declare const CROSS_CLIENT_GRANT: {
+    resource: string;
+    action?: string;
+};
+/**
+ * May this staff caller skip tenant scoping?
+ *
+ * **This never refuses anybody by itself.** It answers one question, and the
+ * caller falls through to the ORDINARY tenant scoping when the answer is no —
+ * so a staff member who is also a member of the target organisation, or who
+ * reaches the site through a live `customer.sites` engagement, is served
+ * exactly as they are today. The change is that platform identity alone stops
+ * being a skeleton key.
+ *
+ * ## ZERO LOCKOUT
+ *
+ * The rule is `consoleRoleAllows`, unchanged and already shipped: an EMPTY
+ * permission list means everything (that is what `createDefaultUser` seeds) and
+ * `"*"` means everything (that is what the live staff account holds). Both
+ * spellings a real staff role can carry today allow all, so no role, member or
+ * user document has to be written for this to ship and nobody loses access on
+ * deploy.
+ *
+ * The one population this governs is a staff role holding a NON-EMPTY PARTIAL
+ * list — which is the intended behaviour, and the same population revision 35
+ * already began governing on the console endpoints. Such a role keeps every
+ * client it holds a membership or engagement in; it loses only the reach it was
+ * never ticked for.
+ */
+declare function staffMayBypass(actor: {
+    isSuperAdmin: boolean;
+    staffPermissions?: string[];
+}, grant?: {
+    resource: string;
+    action?: string;
+}): boolean;
+
+/**
+ * ONE console module, optionally ONE action on it.
+ *
+ * `{ resource }` alone is the SCREEN question — "does this role reach the module
+ * at all" — which is `consoleCanSee` on the client. Used where the catalogue
+ * carries no string for the operation; see `console-permission.util.ts`.
+ */
+type ConsoleGrant = {
+    resource: string;
+    action?: string;
+};
+
+/**
+ * Seven365 staff only, and — when a grant is named — staff whose role holds it.
+ *
+ * Returns the caller's id so a handler can attribute the write to them rather
+ * than to whatever the request body claimed.
+ *
+ * The `grant` argument is the whole of the console-permission change. Omitting
+ * it is exactly the behaviour this function has always had, so every call site
+ * that has not been mapped to a module is untouched rather than guessed at. A
+ * role with an EMPTY permission list — which is what `createDefaultUser` seeds —
+ * passes every grant, so naming one locks nobody out. See
+ * `console-permission.util.ts` for why that rule is what makes this shippable
+ * with no write to any role document.
+ */
+declare function requirePlatformStaff(req: Request, grant?: ConsoleGrant): Promise<string>;
+/**
+ * Seven365 staff who hold this console module.
+ *
+ * The name the controllers use. `requirePlatformStaff` still decides staff
+ * identity, unchanged — this is a layer ON TOP of it, never a replacement, so
+ * nobody who was refused before is admitted now.
+ */
+declare function requireConsolePermission(req: Request, resource: string, action?: string): Promise<string>;
+/**
+ * The person themselves, or Seven365 staff.
+ *
+ * A user record belongs to one person, so the id in the URL must be the
+ * caller's own — unless the caller is Seven365 staff, who run the client
+ * console. Used by both `/api/users` and its twin `/api/users/v2`, whose
+ * handlers are separate files with the same routes.
+ *
+ * `PATCH /api/users/field/:id` is why this exists: its allow-list includes
+ * `email`, `nric`, `status` and `defaultOrg`, so pointing it at somebody else's
+ * id rewrote their sign-in address — and the forgot-password flow then delivers
+ * to the new one.
+ */
+declare function requireSelfOrPlatformStaff(req: Request, userId?: string | null, grant?: ConsoleGrant): Promise<string>;
+
+/**
+ * What the Seven365 staff console records, as pure functions.
+ *
+ * Everything here is decidable without a database, a network or an Express
+ * request, which is the point: the rules that decide **what is allowed into an
+ * audit row** must be testable on their own. The row is written by
+ * `console-audit.repo.ts`; this file decides its shape and its contents.
+ *
+ * The one rule that governs the whole file: an audit row holds **who, what,
+ * which object, when, and enough of the values to make sense of the change**.
+ * It is not a copy of the document. Fields are admitted by an **allow-list per
+ * action** — anything not named there is dropped, so a handler that later
+ * passes a whole record cannot leak an email address, a phone number, a
+ * password hash or a token into the audit collection by accident.
+ */
+/** The staff actions worth keeping a record of. */
+declare enum ConsoleAuditAction {
+    SUBSCRIPTION_CREATED = "subscription.created",
+    SUBSCRIPTION_UPDATED = "subscription.updated",
+    CLIENT_CREATED = "client.created",
+    CLIENT_SUSPENDED = "client.suspended",
+    CLIENT_REACTIVATED = "client.reactivated",
+    /**
+     * Seven365 staff changing which catalogue modules a client is offered.
+     *
+     * Recorded because it is a commercial decision about a paying client that
+     * somebody has to be able to answer for later, even though it grants and
+     * revokes nothing by itself (`org-modules.util.ts` - it narrows what a role
+     * editor OFFERS, and the server re-decides every request regardless).
+     */
+    CLIENT_MODULES_CHANGED = "client.modules-changed",
+    /**
+     * A site's own module list changed (`PATCH /api/sites/:id/modules`).
+     *
+     * Like the camera rows below, this is a TENANT action: the organisation sets
+     * its site's list, not Seven365. It is here because the row is also the
+     * module gate's acknowledged-save marker (`gateListHash`, see
+     * `module-gate.util.ts enforcedModuleList`): a site list is enforced only
+     * once a save through the preview-and-acknowledge path has recorded it.
+     */
+    SITE_MODULES_CHANGED = "site.modules-changed",
+    PROMO_CODE_CREATED = "promo-code.created",
+    PROMO_CODE_UPDATED = "promo-code.updated",
+    PROMO_CODE_STATUS_CHANGED = "promo-code.status-changed",
+    PROMO_CODE_REMOVED = "promo-code.removed",
+    PLAN_CREATED = "plan.created",
+    PLAN_UPDATED = "plan.updated",
+    PLAN_STATUS_CHANGED = "plan.status-changed",
+    TERMS_PUBLISHED = "terms.published",
+    /**
+     * Seven365 staff switching a client's camera on or off.
+     *
+     * The only tenant-owned object on this list, and it is here because it is the
+     * only one staff may touch: a faulty camera at a client's site has to be
+     * switchable off by us. See `updateById` in `site-camera.controller.ts` for
+     * the boundary that allows it and nothing else.
+     */
+    CAMERA_STATUS_CHANGED = "camera.status-changed",
+    /**
+     * A camera being added, edited or removed BY THE SITE'S OWN PEOPLE.
+     *
+     * The three below are the answer to "who changed this camera's address, and
+     * when" - a question that had no answer anywhere in the system. A camera
+     * record carries `createdAt`/`updatedAt` and no actor, and a write overwrites
+     * the previous `host` in place, so a wrong port number could only be traced by
+     * asking people what they remembered doing. At Seventh Condominium that turned
+     * a one-line correction into nine days.
+     *
+     * This is a widening of what the collection holds: `CAMERA_STATUS_CHANGED` is
+     * a Seven365 STAFF action, and these are tenant actions. That is deliberate.
+     * The console is where an operator goes to answer exactly this question, the
+     * row already carries `actor`, `target` and `createdAt`, and the alternative -
+     * a second audit collection with its own repository, model and indexes - is
+     * more moving parts for the same row. Nothing existing changes: the collection
+     * is append-only and every reader filters by `action`.
+     */
+    CAMERA_ADDED = "camera.added",
+    CAMERA_UPDATED = "camera.updated",
+    CAMERA_REMOVED = "camera.removed"
+}
+/**
+ * The three actions that live in `organization.controller.ts`.
+ *
+ * They are defined, labelled and tested here, but **nothing calls them yet**.
+ * `organization.controller.ts` is being edited by open PR #1884 (suspend), and
+ * editing the same handlers here would hand a reviewer a merge conflict for no
+ * gain. Each needs exactly one `recordConsoleAction(...)` call once #1884
+ * lands; the action names and labels are already in place for it.
+ */
+declare const CLIENT_ACTIONS: ConsoleAuditAction[];
+/** What a person reads on the screen. The row carries it so the screen need not map it. */
+declare const CONSOLE_AUDIT_LABELS: Record<ConsoleAuditAction, string>;
+/** What kind of thing the action was done to. */
+declare enum ConsoleAuditTarget {
+    ORGANIZATION = "organization",
+    SUBSCRIPTION = "subscription",
+    PROMO_CODE = "promo-code",
+    PLAN = "plan",
+    TERMS = "terms",
+    CAMERA = "camera",
+    SITE = "site"
+}
+/** A stored value is a primitive or it is not stored. */
+declare const AUDIT_VALUE_MAX_LENGTH = 120;
+/**
+ * The part of a change that may be stored, for this action.
+ *
+ * Returns `undefined` rather than `{}` when nothing survives, so an empty
+ * object never occupies a row and a reader can tell "nothing recorded" from
+ * "recorded as empty".
+ */
+declare function pickAuditFields(action: ConsoleAuditAction, value?: Record<string, unknown> | null): Record<string, string | number | boolean> | undefined;
+
+/**
+ * Every module key a list can deny: the keys the Seven365 console's module card
+ * can offer, minus `ALWAYS_ALLOWED`, plus the alias spellings in
+ * `SPELLING_GROUPS`.
+ *
+ * GENERATED 2026-09-11 from layer-common `origin/main` 5a96f95, not
+ * hand-written: bundled with esbuild, then
+ *   union(Object.keys(PERMISSIONS)                   constants/permissions.ts,
+ *         applicationModules().flatMap(a => a.modules) utils/module-applications.ts)
+ * which is `MODULE_KEYS` in web-app-org `pages/super-admin/client-details.vue`.
+ * Then added the alias resources of `LEGACY_PERMISSION_ALIASES` that are not
+ * already keys (`facility-booking`, `service-provider`, `work-orders`), and
+ * removed `ALWAYS_ALLOWED`.
+ *
+ * Deliberately NOT included: resource keys of catalogues the card cannot offer
+ * (`useAdminPermission`: `organizations`, `users`, `promo-codes`, …;
+ * `useRecapPermission`: `request`). A governed key the card cannot tick could
+ * never be allowed again once a client had a list.
+ *
+ * Regenerate when a composable gains a module; until then the new module is
+ * simply ungoverned, so it stays visible.
+ */
+declare const GOVERNED_MODULES: readonly string[];
+/** A list, cleaned and widened so every spelling of a listed module is in it. */
+declare function expandModules(list: readonly unknown[] | null | undefined): string[];
+/**
+ * The modules this caller's apps must hide, given the organisation's list and
+ * the site's list. `[]` means hide nothing.
+ *
+ * Both tiers are widened through the spelling groups BEFORE the existing
+ * `effectiveSiteModules` intersects them, so `workOrder` at one tier and
+ * `work_orders` at the other still meet.
+ */
+declare function deniedModules(orgList: readonly unknown[] | null | undefined, siteList: readonly unknown[] | null | undefined): string[];
+type TImpactMember = {
+    _id?: unknown;
+    name?: string;
+    type?: string;
+    role?: unknown;
+};
+type TImpactRole = {
+    _id?: unknown;
+    name?: string;
+    permissions?: unknown;
+};
+type TModuleImpactEntry = {
+    /** The module's first spelling in `SPELLING_GROUPS`, or the key itself. */
+    module: string;
+    /** Every newly denied spelling of it. */
+    spellings: string[];
+    memberCount: number;
+    members: Array<{
+        _id: string;
+        name: string;
+    }>;
+    roleCount: number;
+    roles: Array<{
+        _id: string;
+        name: string;
+    }>;
+};
+type TModuleImpact = {
+    /** Distinct members who lose at least one module. */
+    memberCount: number;
+    modules: TModuleImpactEntry[];
+};
+/**
+ * Who would lose what if the denied list went from `currentDenied` to
+ * `proposedDenied`: the preview that must come before any narrowing save.
+ *
+ * - A role holding `"*"` holds every module. So does an EMPTY role, which is the
+ *   estate rule (`createDefaultUser` seeds `permissions: []`), so a preview
+ *   over-counts rather than under-counts.
+ * - An enumerated role holds the resource half of each string, under any
+ *   spelling. A string for an ungoverned resource never loses anything.
+ * - Residents are excluded: they hold no staff role. A member whose role is not
+ *   in `rolesById` is skipped. Filter out inactive members before calling.
+ */
+declare function moduleImpact({ currentDenied, proposedDenied, members, rolesById, }: {
+    currentDenied: readonly unknown[] | null | undefined;
+    proposedDenied: readonly unknown[] | null | undefined;
+    members: readonly TImpactMember[] | null | undefined;
+    rolesById: Record<string, TImpactRole | null | undefined> | null | undefined;
+}): TModuleImpact;
+/**
+ * THE ONE SWITCH (master plan rule 2). `MODULE_LIST_GATE=off` turns the whole
+ * gate off everywhere at once, with no app build: the `/modules` deny list that
+ * every web and mobile app ANDs, the Q7 notification filter and the Q3 server
+ * refusal all check this before computing anything, and answer "nothing
+ * denied".
+ *
+ * Read on every call rather than once at load, so a lead's emergency env
+ * override takes effect on restart. OUR flips change the code default below,
+ * by PR, staging first: setting an env on DigitalOcean is the leads' job.
+ */
+declare const MODULE_LIST_GATE_DEFAULT = "on";
+declare function moduleListGateOn(env?: Record<string, string | undefined>): boolean;
+/** The latest console-audit row that saved a list: its `after` and `createdAt`. */
+type TModuleListSave = {
+    after?: Record<string, unknown> | null;
+    createdAt?: string | null;
+} | null | undefined;
+
+/**
+ * THE MODULE GATE, READ FROM THE DATABASE.
+ *
+ * The pure rules live in `utils/module-gate.util.ts`. This file only fetches
+ * what they need: memberships, the organisation and the site, the latest
+ * console-audit save row (the acknowledged-save marker) and roles. Every read
+ * is a plain `find`/`findOne` or a cached repository getter. Nothing here
+ * writes, and roles are never read through `GET /api/roles`, whose heal path
+ * writes.
+ *
+ * Every lookup is injectable (`TModuleGateData`), so the rules are tested
+ * against the shipped code with no database.
+ */
+type TRow = {
+    _id?: unknown;
+    user?: unknown;
+    org?: unknown;
+    siteId?: unknown;
+    type?: string;
+    status?: string;
+    deletedAt?: unknown;
+    role?: unknown;
+    name?: string;
+};
+type TOrgDoc = {
+    _id?: unknown;
+    modules?: unknown;
+} | null;
+type TSiteDoc = {
+    _id?: unknown;
+    orgId?: unknown;
+    metadata?: {
+        modules?: unknown;
+    } | null;
+} | null;
+type TRoleDoc = {
+    _id?: unknown;
+    name?: string;
+    permissions?: unknown;
+};
+type TModuleGateData = {
+    /** Every membership row of these users, any status. */
+    membershipsOf(userIds: string[]): Promise<TRow[]>;
+    org(id: string): Promise<TOrgDoc>;
+    site(id: string): Promise<TSiteDoc>;
+    /** The latest console-audit row saving this list. */
+    latestSave(action: ConsoleAuditAction, org: string, target: string): Promise<TModuleListSave>;
+    /** Seven365 staff whose console role may skip tenant scoping. */
+    isPlatformStaff(userId: string): Promise<boolean>;
+    /** Non-resident memberships in `org`; with `site`, those pinned there or org-wide. */
+    staffMembers(query: {
+        org: string;
+        site?: string;
+    }): Promise<TRow[]>;
+    roles(ids: string[]): Promise<Record<string, TRoleDoc>>;
+};
+
+/** Injected so a unit test runs the handler with no database. */
+type TMemberModulesDeps = {
+    requireSelfOrPlatformStaff: typeof requireSelfOrPlatformStaff;
+    gateData?: TModuleGateData;
+};
+declare function memberModulesHandlers({ requireSelfOrPlatformStaff, gateData, }: TMemberModulesDeps): {
+    getModulesByUserIdType: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+};
 declare function useMemberController(): {
     createMember: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getByUserId: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getByUserIdType: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    getModulesByUserIdType: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
     getAll: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAllByUser: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getOrgsByMembership: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -949,6 +1415,94 @@ declare function useOrgRepo(): {
     completeOnboardingById: (_id: string | ObjectId, session?: ClientSession) => Promise<string>;
 };
 
+/**
+ * One staff action in the Seven365 console.
+ *
+ * A new collection. Nothing existing is changed, no field is added to any live
+ * document, and there is no migration — a client, a subscription, a promo code
+ * and a plan are all exactly as they were.
+ *
+ * `actor` is a `users._id` and it comes from the SESSION, never from the
+ * request body. The body-attribution defect fixed on `POST /api/terms` earlier
+ * today is the reason that is written down rather than assumed.
+ */
+type TConsoleAudit = {
+    _id?: ObjectId;
+    action: ConsoleAuditAction;
+    /** Who. A `users._id`, resolved from the session. */
+    actor: string | ObjectId;
+    /** Which client it affected, when the action is about one. */
+    org?: string | ObjectId | null;
+    /** Which object changed, and of what kind. */
+    target?: string | ObjectId | null;
+    targetType?: ConsoleAuditTarget | null;
+    /** Enough of the change to make sense of it — never a whole document. */
+    before?: Record<string, unknown> | null;
+    after?: Record<string, unknown> | null;
+    /** ISO-8601 UTC, so a lexicographic range filter is also a date range filter. */
+    createdAt?: string;
+};
+declare const schemaConsoleAudit: Joi.ObjectSchema<any>;
+declare function MConsoleAudit(value: TConsoleAudit): TConsoleAudit;
+
+declare const console_audit_namespace_collection = "console-audit";
+type TConsoleAuditQuery = {
+    org?: string;
+    action?: string;
+    /** ISO-8601. Inclusive at both ends of the day the caller names. */
+    from?: string;
+    to?: string;
+    page?: number;
+    limit?: number;
+};
+declare function useConsoleAuditRepo(): {
+    createIndexes: () => Promise<void>;
+    add: (value: TConsoleAudit) => Promise<{
+        _id: ObjectId;
+        action: ConsoleAuditAction;
+        actor: string | ObjectId;
+        org?: string | ObjectId | null | undefined;
+        target?: string | ObjectId | null | undefined;
+        targetType?: ConsoleAuditTarget | null | undefined;
+        before?: Record<string, unknown> | null | undefined;
+        after?: Record<string, unknown> | null | undefined;
+        createdAt?: string | undefined;
+    }>;
+    list: (query: TConsoleAuditQuery) => Promise<{
+        items: any[];
+        pages: number;
+        pageRange: string;
+    }>;
+};
+/**
+ * Record a staff action — and never, under any circumstance, break the action
+ * it describes.
+ *
+ * Everything is inside the catch: resolving the database, validating the row
+ * and the insert itself. The returned promise **cannot reject**, so a caller
+ * that `await`s it cannot be thrown out of its own success path, and a caller
+ * that forgets to `await` it cannot crash the process with an unhandled
+ * rejection either. A failure is logged and the operation stands.
+ *
+ * Called only AFTER the operation it records has succeeded, so a row can never
+ * describe something that did not happen. The other direction is possible and
+ * accepted: an action can happen and its row fail to be written, in which case
+ * the log carries it.
+ */
+declare function recordConsoleAction(entry: TConsoleAudit): Promise<void>;
+
+/** What the client module-list handlers read and write; injected so a unit test runs them with no database. */
+type TOrgModulesDeps = {
+    requireConsolePermission: (req: Request, resource: string) => Promise<string>;
+    _getById: (id: string) => Promise<any>;
+    _update: (id: string, value: any) => Promise<unknown>;
+    recordConsoleAction: (entry: Parameters<typeof recordConsoleAction>[0]) => Promise<unknown>;
+    gateData?: TModuleGateData;
+};
+declare function orgModulesHandlers({ requireConsolePermission, _getById, _update, recordConsoleAction, gateData, }: TOrgModulesDeps): {
+    updateModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    previewOrgModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+};
 declare function useOrgController(): {
     add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     addOnboardingOrg: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -961,7 +1515,8 @@ declare function useOrgController(): {
     getOrgsByEmail: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAdminOrgForResident: (_req: Request, res: Response, next: NextFunction) => Promise<void>;
     updateStatus: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    updateModules: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
+    previewOrgModules: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
 };
 
 /**
@@ -2241,85 +2796,315 @@ declare function useCustomerController(): {
     deleteCustomer: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 };
 
-declare function useSiteRepo(): {
-    createIndexes: () => Promise<void>;
-    createSite: (value: TSite, session?: ClientSession) => Promise<ObjectId>;
-    getSites: ({ page, limit, search, sort, org, }: {
-        page?: number | undefined;
-        limit?: number | undefined;
-        search?: string | undefined;
-        sort?: Record<string, any> | undefined;
-        org: string | ObjectId;
-    }) => Promise<{}>;
-    getAllSites: ({ page, limit, }: {
-        page: number;
-        limit: number;
-    }) => Promise<{
-        items: {
-            _id: ObjectId;
-            name: string;
-        }[];
-        pages: number;
-        pageRange: string;
-    }>;
-    getSiteById: (_id: string | ObjectId) => Promise<TSite>;
-    updateSiteBlock: (_id: string | ObjectId, block: TSiteUpdateBlock) => Promise<number>;
-    deleteSite: (_id: string | ObjectId, session?: ClientSession) => Promise<number>;
-    updateById: ({ _id, field, value, type }?: {
-        _id: string | ObjectId;
-        field: string;
-        value: string | number | ObjectId;
-        type?: string | undefined;
-    }, session?: ClientSession) => Promise<string>;
-    getByName: (name?: string) => Promise<TSite[]>;
-    getByExactName: (name: string, orgId: string | ObjectId) => Promise<TSite[]>;
-    updateSiteIncidentCounter: (_id: string | ObjectId, incidentCounter: number, session?: ClientSession) => Promise<number>;
-    updateSiteById: (id: string | ObjectId, payload: TSite, session?: ClientSession) => Promise<number>;
-    getAllSitesUnpaginated: () => Promise<bson.Document[]>;
-    siteInformation: ({ id, payload, }: {
-        id: string;
-        payload: TSiteInformation;
-    }) => Promise<number>;
-    getAllSitesForResidentCreation: ({ search, page, limit, }: {
-        search: string;
-        page: number;
-        limit: number;
-    }) => Promise<{
-        items: {
-            _id: ObjectId;
-            name: string;
-        }[];
-        pages: number;
-        pageRange: string;
-    }>;
+declare function useSiteRepo(): {
+    createIndexes: () => Promise<void>;
+    createSite: (value: TSite, session?: ClientSession) => Promise<ObjectId>;
+    getSites: ({ page, limit, search, sort, org, }: {
+        page?: number | undefined;
+        limit?: number | undefined;
+        search?: string | undefined;
+        sort?: Record<string, any> | undefined;
+        org: string | ObjectId;
+    }) => Promise<{}>;
+    getAllSites: ({ page, limit, }: {
+        page: number;
+        limit: number;
+    }) => Promise<{
+        items: {
+            _id: ObjectId;
+            name: string;
+        }[];
+        pages: number;
+        pageRange: string;
+    }>;
+    getSiteById: (_id: string | ObjectId) => Promise<TSite>;
+    updateSiteBlock: (_id: string | ObjectId, block: TSiteUpdateBlock) => Promise<number>;
+    deleteSite: (_id: string | ObjectId, session?: ClientSession) => Promise<number>;
+    updateById: ({ _id, field, value, type }?: {
+        _id: string | ObjectId;
+        field: string;
+        value: string | number | ObjectId;
+        type?: string | undefined;
+    }, session?: ClientSession) => Promise<string>;
+    getByName: (name?: string) => Promise<TSite[]>;
+    getByExactName: (name: string, orgId: string | ObjectId) => Promise<TSite[]>;
+    updateSiteIncidentCounter: (_id: string | ObjectId, incidentCounter: number, session?: ClientSession) => Promise<number>;
+    updateSiteById: (id: string | ObjectId, payload: TSite, session?: ClientSession) => Promise<number>;
+    getAllSitesUnpaginated: () => Promise<bson.Document[]>;
+    siteInformation: ({ id, payload, }: {
+        id: string;
+        payload: TSiteInformation;
+    }) => Promise<number>;
+    getAllSitesForResidentCreation: ({ search, page, limit, }: {
+        search: string;
+        page: number;
+        limit: number;
+    }) => Promise<{
+        items: {
+            _id: ObjectId;
+            name: string;
+        }[];
+        pages: number;
+        pageRange: string;
+    }>;
+};
+
+declare function useSiteService(): {
+    createSite: (value: {
+        orgId: string;
+        name: string;
+        description?: string | undefined;
+        customerId: string;
+        category: SiteCategories;
+        address: {
+            line1: string;
+            line2?: string;
+            city: string;
+            state?: string;
+            postalCode: string;
+            country: string;
+        };
+    }) => Promise<{
+        site: bson.ObjectId;
+    }>;
+    updateGuardPostById: (site: string, guardPost: number) => Promise<void>;
+    updateById: (_id: string, payload: TSite) => Promise<void>;
+    siteInformation: ({ id, payload }: {
+        id: string;
+        payload: TSiteInformation;
+    }) => Promise<number>;
+};
+
+/**
+ * Who is asking, resolved from the session id alone.
+ *
+ * Every invitation action re-derives this — the caller never states who they
+ * are in a body or a query field.
+ *
+ * **Super admin is a membership, not an email address.** `createDefaultUser()`
+ * seeds a role named "Super Admin" with `type: "admin"` and a `members` row with
+ * `type: "admin"` and NO organisation; the user behind it is whatever
+ * `DEFAULT_USER_EMAIL` is set to in that environment (`admin@gmail.com` on
+ * staging, something else in production). Gating on the email address would
+ * therefore work on staging and fail in production, and would break the day the
+ * account is rotated. Both halves are required — a `members` row of type
+ * "admin" whose role is also of type "admin" — because staging carries a second
+ * role merely NAMED "Super Admin" that is an ordinary organisation role.
+ */
+type InviteActor = {
+    id: string;
+    name: string;
+    isSuperAdmin: boolean;
+    /** every organisation this user is a live member of */
+    orgIds: string[];
+    /** organisations this user represents as a property management company */
+    propertyManagementOrgIds: string[];
+    /**
+     * Every live membership as an `(org, siteId)` pair, `siteId` empty when the
+     * membership carries no site — i.e. when it is an org-wide role.
+     *
+     * `orgIds` above flattens this and throws the site away, which is right for
+     * the organisation-level gates that read it. The LISTING paths need the site
+     * back: `GET /api/customer-sites?org=` authorises at organisation level and
+     * then returned the organisation's whole estate, so a user invited to one
+     * site was offered every site in the client. See `orgSiteScope`.
+     *
+     * `orgLevelRole` is true when the membership's ROLE is organisation-level —
+     * the `roles` document carries no `site` of its own. Owner decision of
+     * 2026-09-02: an org-level role sees every site EVEN IF its membership row
+     * also names one, so the stray `siteId` on an Org Owner row must not narrow
+     * them. It fails closed: a missing, soft-deleted or unreadable role is not
+     * org-level.
+     */
+    memberships: Array<{
+        org: string;
+        siteId: string;
+        orgLevelRole: boolean;
+        /** The membership's `type` (`resident`, `security_agency`, …); `""` when absent. */
+        type?: string;
+    }>;
+    /**
+     * The `permissions` array of the LIVE staff role behind `isSuperAdmin`, or
+     * undefined when the caller is not Seven365 staff.
+     *
+     * The role document is already read two lines below to decide
+     * `isSuperAdmin`; only its `permissions` field was being thrown away. Carrying
+     * it costs no extra query and is what lets `staffMayBypass` ask the console
+     * catalogue's question instead of identity alone. Undefined and `[]` are NOT
+     * the same thing: `[]` is a staff role that holds everything (the empty-list
+     * rule), undefined is somebody who is not staff at all.
+     */
+    staffPermissions?: string[];
+};
+declare function resolveInviteActor(userId?: string | ObjectId | null): Promise<InviteActor>;
+/**
+ * Does this person hold an invitation naming this organisation?
+ *
+ * The org-scoping rule on roles and memberships is "Seven365 staff, or a live
+ * member of this organisation" — but three live flows legitimately reach an
+ * organisation the caller is **not yet** a member of, because joining it is the
+ * whole point:
+ *
+ * - the service-provider signing in against a `service-provider-invite`
+ *   (`web-app-main pages/sign-in.vue:298,428`), who looks up that customer's
+ *   "Admin Service Provider" role and then enrols;
+ * - the admin member finishing sign-up from a `member-invite`
+ *   (`web-app-main pages/verify/email/index.vue:462`);
+ * - the client owner walking the onboarding wizard
+ *   (`web-app-org pages/onboarding/getting-started/index.vue`).
+ *
+ * All three are holding an invitation addressed to their OWN email whose
+ * `metadata.org` is the organisation being reached, so that invitation is the
+ * relationship the rule tests. Both string and ObjectId shapes are matched,
+ * because `MVerification` casts `metadata.org` to an ObjectId while older rows
+ * carry a string — the same pair `completePendingInvites` matches on.
+ *
+ * Any status counts: `completeOrgAdminAccount` marks the verification complete
+ * before the member row is written, so a pending-only test would refuse the
+ * flow it exists to protect.
+ */
+declare function hasOrgInvitation(userId?: string | ObjectId | null, orgId?: string | ObjectId | null): Promise<boolean>;
+/**
+ * Does one of this person's own invitations into this organisation OFFER this
+ * role?
+ *
+ * `hasOrgInvitation` answers "may you reach the organisation"; this answers
+ * "may you wear THIS role there". An invitation that names a role offers that
+ * role and nothing else. An invitation that names NO role — the
+ * service-provider invite, whose sign-in then finds or creates the org's
+ * "Admin Service Provider" role (`web-app-main pages/sign-in.vue`) — offers a
+ * role of this organisation whose `type` is the invitation's own `app`, which
+ * is exactly what that flow can pick.
+ *
+ * A `cancelled` invitation offers nothing: the organisation took it back. Any
+ * other status counts, for the reason `hasOrgInvitation` gives (the member row
+ * is written after the invitation is marked complete).
+ */
+declare function invitationOffersRole(userId?: string | ObjectId | null, orgId?: string | ObjectId | null, roleId?: string | ObjectId | null): Promise<boolean>;
+/**
+ * Which of these role ids are ORGANISATION-level, i.e. the `roles` document
+ * carries no `site` of its own. One batched lookup, `site` the only field it
+ * needs.
+ *
+ * Fails closed: a role that is missing, soft-deleted or unreadable is absent
+ * from the set and therefore reads as SITE-level — the narrowing side, which is
+ * the safe way to be wrong about a rule that widens access.
+ *
+ * Shared by `resolveInviteActor` (the site LIST half, `orgSiteScope`) and by
+ * `resolveSiteAccess` in the camera service (the ACCESS half, `cameraGrant`),
+ * because the two must answer "is this an org-level role?" identically or the
+ * switcher offers sites the camera view refuses.
+ */
+declare function orgLevelRoles(db: Db, roles: Array<unknown>): Promise<Set<string>>;
+/**
+ * Does this person OWN this organisation — did they create it, or is it
+ * registered under their own account e-mail?
+ *
+ * DV-0248. The client owner who signs themselves up creates the organisation
+ * (`POST /api/organizations/onboarding`) and only gets their `members` row at
+ * the LAST onboarding step, from `ensureCurrentUserMemberExists`. Every step in
+ * between — save the org details, create the first site, create the roles,
+ * invite the admins — asked for a membership or an invitation, and the owner
+ * has neither. So the wizard refused its own owner at step 1, and the
+ * organisation never appeared in their list either. On staging, 64 of 195
+ * organisations have no member and no invitation at all.
+ *
+ * Two roads, because the second repairs the ones already stuck:
+ *
+ * - `createdBy` — stamped from the session when the organisation is created,
+ *   never from the request body. Fixes every NEW signup, and is the road that
+ *   would have been enough on its own if the field had always existed.
+ * - `email` — the organisation is registered under the caller's own account
+ *   address. This is the SAME comparison `organization.repo getAll` already
+ *   makes to scope the client list, against the same session-resolved address,
+ *   and it is what lets the 64 existing organisations repair themselves with no
+ *   data backfill.
+ *
+ * The e-mail road is only sound because `PATCH /api/users/field/:id` no longer
+ * lets a user set their own address (`requireUserFieldWrite`). While it did,
+ * anyone could have typed a victim organisation's address and walked in; that
+ * hole is closed in the same change, and re-opening it re-opens this.
+ *
+ * Case-insensitive by collation rather than `$regex`, for the reason
+ * `hasOrgInvitation` gives: an address may contain `+` or `.` and building a
+ * pattern out of one invites an escaping bug.
+ */
+declare function hasOrgOwnership(userId?: string | ObjectId | null, orgId?: string | ObjectId | null): Promise<boolean>;
+/**
+ * Has this account been APPROVED? `isAccountLive` (blank = an older live
+ * account) minus `resubmit`: a resident applicant asked to resubmit can sign
+ * in, and self-signup already gave them an active resident `members` row and
+ * the site they applied for, but the client has not accepted them.
+ */
+declare function readsAsApprovedAccount(status?: string | null): boolean;
+/** `readsAsApprovedAccount` for a user id. Fails closed: unreadable is "no". */
+declare function callerAccountApproved(userId?: string | ObjectId | null): Promise<boolean>;
+/**
+ * Does this person LIVE at, or WORK on, one of this organisation's sites?
+ *
+ * The two relationships `requireOrgReach` does not see, because neither is a
+ * membership OF this organisation:
+ *
+ * - **a resident** (`residents-are-not-members`): the Service365 app reads its
+ *   own client's record (`residentAppModules`, `defaultSite`) and a resident's
+ *   tie to the estate lives on the `users` document (`site`, `unitId`) or a
+ *   `site.people` row, not in `members`. Every one of those is server-written,
+ *   but a self-signup stores the site and unit it APPLIED for, and a rejected
+ *   or resubmit applicant can still sign in. So these roads count only for an
+ *   approved account (`readsAsApprovedAccount`), and only an
+ *   `active`/`approved` `site.people` row. `PATCH
+ *   /api/users/field` does not accept `site` or `unitId`. The organisation's
+ *   `defaultSite` being the resident's own site counts too — it is exactly the
+ *   fallback the app itself uses.
+ * - **a service provider** engaged by this client: an active `customer.sites`
+ *   row between one of the caller's organisations and this one
+ *   (`customer-sites-row-is-the-engagement`).
+ *
+ * `memberOrgIds` is the caller's own organisations, already resolved by the
+ * caller of this function. Fails closed: anything unreadable is "no".
+ */
+declare function hasOrgSiteReach(userId?: string | ObjectId | null, orgId?: string | ObjectId | null, memberOrgIds?: string[]): Promise<boolean>;
+/**
+ * Does this person themselves HOLD this role?
+ *
+ * `GET /api/roles/id/:id` is read on the hot path by every signed-in session —
+ * `layer-common plugins/secure-member.client.ts` resolves the caller's own app
+ * role, and the guard app's `permission.store.ts` does the same — so the only
+ * scoping rule that can go on it has to keep "my own role" working. Scoping it
+ * by the role's organisation alone does not: staging carries 12 roles with NO
+ * `org` at all, one of which ("Org Owner") is held by 119 ordinary tenant
+ * members across eight membership types. An org-less role routes to the staff
+ * gate, so those 119 accounts would 401 on their own role and both callers fail
+ * closed — permissions silently emptying, with nothing in the product to say
+ * why.
+ *
+ * The relationship is a live `members` row joining the caller's user id to this
+ * exact role id. **Both halves are resolved server-side**: the user id comes
+ * from the session (`callerId`), never from a body or a query field, and the
+ * role id is the resource being asked for. There is nothing a caller can send
+ * that makes this answer yes for a role they do not hold — naming somebody
+ * else's role id simply finds no row.
+ *
+ * `status: { $ne: "deleted" }` is the same liveness test every other membership
+ * read in this package uses, so a revoked membership stops conferring the read.
+ */
+declare function holdsRole(userId?: string | ObjectId | null, roleId?: string | ObjectId | null, 
+/** when given, the live membership must also be in THIS organisation */
+orgId?: string | ObjectId | null): Promise<boolean>;
+
+/** What the site module-list handlers read and write; injected so a unit test runs them with no database. */
+type TSiteModulesDeps = {
+    requireSiteWrite: (req: Request, siteId: string) => Promise<InviteActor>;
+    _getSiteById: (id: string) => Promise<any>;
+    _getOrgById: (id: string) => Promise<any>;
+    _updateById: (id: string, value: any) => Promise<unknown>;
+    recordConsoleAction: (entry: Parameters<typeof recordConsoleAction>[0]) => Promise<unknown>;
+    gateData?: TModuleGateData;
 };
-
-declare function useSiteService(): {
-    createSite: (value: {
-        orgId: string;
-        name: string;
-        description?: string | undefined;
-        customerId: string;
-        category: SiteCategories;
-        address: {
-            line1: string;
-            line2?: string;
-            city: string;
-            state?: string;
-            postalCode: string;
-            country: string;
-        };
-    }) => Promise<{
-        site: bson.ObjectId;
-    }>;
-    updateGuardPostById: (site: string, guardPost: number) => Promise<void>;
-    updateById: (_id: string, payload: TSite) => Promise<void>;
-    siteInformation: ({ id, payload }: {
-        id: string;
-        payload: TSiteInformation;
-    }) => Promise<number>;
+declare function siteModulesHandlers({ requireSiteWrite, _getSiteById, _getOrgById, _updateById, recordConsoleAction, gateData, }: TSiteModulesDeps): {
+    updateSiteModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    previewSiteModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 };
-
 declare function useSiteController(): {
     createSite: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getSites: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -2327,7 +3112,8 @@ declare function useSiteController(): {
     updateSiteBlock: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     deleteSite: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     updateById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    updateSiteModules: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    updateSiteModules: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
+    previewSiteModules: (req: Request<express_serve_static_core.ParamsDictionary, any, any, qs.ParsedQs, Record<string, any>>, res: Response<any, Record<string, any>>, next: NextFunction) => Promise<void>;
     updateGuardPostsById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     siteInformation: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     getAllSitesForResidentCreation: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -6756,7 +7542,7 @@ declare function useBulletinBoardRepo(): {
         site: string | ObjectId;
         status: string;
         recipients: Array<string>;
-        expiration?: "yes" | "no" | undefined;
+        expiration?: "no" | "yes" | undefined;
     }, session?: ClientSession) => Promise<{
         items: any[];
         pages: number;
@@ -10822,187 +11608,25 @@ type TSelfServiceResendFacts = {
     now: number;
 };
 type TSelfServiceResendDecision = {
-    ok: true;
-    email: string;
-    persistEmail: boolean;
-} | {
-    ok: false;
-    httpStatus: 400 | 404 | 429;
-    reason: string;
-};
-/**
- * What the public resend route may do with an id.
- *
- * The rule that matters: an address ALREADY on the record wins, always. A
- * caller can fill in a blank one - that is what the card's inline field is for,
- * and it grants no more than the id already did, since the id alone opens the
- * pass page - but it can never redirect a pass that is already addressed to
- * someone. Without that, a harvested id would be a way to have another
- * person's check-in QR mailed anywhere.
- */
-declare function decideSelfServiceResend(facts: TSelfServiceResendFacts): TSelfServiceResendDecision;
-
-/**
- * Who is asking, resolved from the session id alone.
- *
- * Every invitation action re-derives this — the caller never states who they
- * are in a body or a query field.
- *
- * **Super admin is a membership, not an email address.** `createDefaultUser()`
- * seeds a role named "Super Admin" with `type: "admin"` and a `members` row with
- * `type: "admin"` and NO organisation; the user behind it is whatever
- * `DEFAULT_USER_EMAIL` is set to in that environment (`admin@gmail.com` on
- * staging, something else in production). Gating on the email address would
- * therefore work on staging and fail in production, and would break the day the
- * account is rotated. Both halves are required — a `members` row of type
- * "admin" whose role is also of type "admin" — because staging carries a second
- * role merely NAMED "Super Admin" that is an ordinary organisation role.
- */
-type InviteActor = {
-    id: string;
-    name: string;
-    isSuperAdmin: boolean;
-    /** every organisation this user is a live member of */
-    orgIds: string[];
-    /** organisations this user represents as a property management company */
-    propertyManagementOrgIds: string[];
-    /**
-     * Every live membership as an `(org, siteId)` pair, `siteId` empty when the
-     * membership carries no site — i.e. when it is an org-wide role.
-     *
-     * `orgIds` above flattens this and throws the site away, which is right for
-     * the organisation-level gates that read it. The LISTING paths need the site
-     * back: `GET /api/customer-sites?org=` authorises at organisation level and
-     * then returned the organisation's whole estate, so a user invited to one
-     * site was offered every site in the client. See `orgSiteScope`.
-     *
-     * `orgLevelRole` is true when the membership's ROLE is organisation-level —
-     * the `roles` document carries no `site` of its own. Owner decision of
-     * 2026-09-02: an org-level role sees every site EVEN IF its membership row
-     * also names one, so the stray `siteId` on an Org Owner row must not narrow
-     * them. It fails closed: a missing, soft-deleted or unreadable role is not
-     * org-level.
-     */
-    memberships: Array<{
-        org: string;
-        siteId: string;
-        orgLevelRole: boolean;
-    }>;
-    /**
-     * The `permissions` array of the LIVE staff role behind `isSuperAdmin`, or
-     * undefined when the caller is not Seven365 staff.
-     *
-     * The role document is already read two lines below to decide
-     * `isSuperAdmin`; only its `permissions` field was being thrown away. Carrying
-     * it costs no extra query and is what lets `staffMayBypass` ask the console
-     * catalogue's question instead of identity alone. Undefined and `[]` are NOT
-     * the same thing: `[]` is a staff role that holds everything (the empty-list
-     * rule), undefined is somebody who is not staff at all.
-     */
-    staffPermissions?: string[];
-};
-declare function resolveInviteActor(userId?: string | ObjectId | null): Promise<InviteActor>;
-/**
- * Does this person hold an invitation naming this organisation?
- *
- * The org-scoping rule on roles and memberships is "Seven365 staff, or a live
- * member of this organisation" — but three live flows legitimately reach an
- * organisation the caller is **not yet** a member of, because joining it is the
- * whole point:
- *
- * - the service-provider signing in against a `service-provider-invite`
- *   (`web-app-main pages/sign-in.vue:298,428`), who looks up that customer's
- *   "Admin Service Provider" role and then enrols;
- * - the admin member finishing sign-up from a `member-invite`
- *   (`web-app-main pages/verify/email/index.vue:462`);
- * - the client owner walking the onboarding wizard
- *   (`web-app-org pages/onboarding/getting-started/index.vue`).
- *
- * All three are holding an invitation addressed to their OWN email whose
- * `metadata.org` is the organisation being reached, so that invitation is the
- * relationship the rule tests. Both string and ObjectId shapes are matched,
- * because `MVerification` casts `metadata.org` to an ObjectId while older rows
- * carry a string — the same pair `completePendingInvites` matches on.
- *
- * Any status counts: `completeOrgAdminAccount` marks the verification complete
- * before the member row is written, so a pending-only test would refuse the
- * flow it exists to protect.
- */
-declare function hasOrgInvitation(userId?: string | ObjectId | null, orgId?: string | ObjectId | null): Promise<boolean>;
-/**
- * Which of these role ids are ORGANISATION-level, i.e. the `roles` document
- * carries no `site` of its own. One batched lookup, `site` the only field it
- * needs.
- *
- * Fails closed: a role that is missing, soft-deleted or unreadable is absent
- * from the set and therefore reads as SITE-level — the narrowing side, which is
- * the safe way to be wrong about a rule that widens access.
- *
- * Shared by `resolveInviteActor` (the site LIST half, `orgSiteScope`) and by
- * `resolveSiteAccess` in the camera service (the ACCESS half, `cameraGrant`),
- * because the two must answer "is this an org-level role?" identically or the
- * switcher offers sites the camera view refuses.
- */
-declare function orgLevelRoles(db: Db, roles: Array<unknown>): Promise<Set<string>>;
-/**
- * Does this person OWN this organisation — did they create it, or is it
- * registered under their own account e-mail?
- *
- * DV-0248. The client owner who signs themselves up creates the organisation
- * (`POST /api/organizations/onboarding`) and only gets their `members` row at
- * the LAST onboarding step, from `ensureCurrentUserMemberExists`. Every step in
- * between — save the org details, create the first site, create the roles,
- * invite the admins — asked for a membership or an invitation, and the owner
- * has neither. So the wizard refused its own owner at step 1, and the
- * organisation never appeared in their list either. On staging, 64 of 195
- * organisations have no member and no invitation at all.
- *
- * Two roads, because the second repairs the ones already stuck:
- *
- * - `createdBy` — stamped from the session when the organisation is created,
- *   never from the request body. Fixes every NEW signup, and is the road that
- *   would have been enough on its own if the field had always existed.
- * - `email` — the organisation is registered under the caller's own account
- *   address. This is the SAME comparison `organization.repo getAll` already
- *   makes to scope the client list, against the same session-resolved address,
- *   and it is what lets the 64 existing organisations repair themselves with no
- *   data backfill.
- *
- * The e-mail road is only sound because `PATCH /api/users/field/:id` no longer
- * lets a user set their own address (`requireUserFieldWrite`). While it did,
- * anyone could have typed a victim organisation's address and walked in; that
- * hole is closed in the same change, and re-opening it re-opens this.
- *
- * Case-insensitive by collation rather than `$regex`, for the reason
- * `hasOrgInvitation` gives: an address may contain `+` or `.` and building a
- * pattern out of one invites an escaping bug.
- */
-declare function hasOrgOwnership(userId?: string | ObjectId | null, orgId?: string | ObjectId | null): Promise<boolean>;
-/**
- * Does this person themselves HOLD this role?
- *
- * `GET /api/roles/id/:id` is read on the hot path by every signed-in session —
- * `layer-common plugins/secure-member.client.ts` resolves the caller's own app
- * role, and the guard app's `permission.store.ts` does the same — so the only
- * scoping rule that can go on it has to keep "my own role" working. Scoping it
- * by the role's organisation alone does not: staging carries 12 roles with NO
- * `org` at all, one of which ("Org Owner") is held by 119 ordinary tenant
- * members across eight membership types. An org-less role routes to the staff
- * gate, so those 119 accounts would 401 on their own role and both callers fail
- * closed — permissions silently emptying, with nothing in the product to say
- * why.
- *
- * The relationship is a live `members` row joining the caller's user id to this
- * exact role id. **Both halves are resolved server-side**: the user id comes
- * from the session (`callerId`), never from a body or a query field, and the
- * role id is the resource being asked for. There is nothing a caller can send
- * that makes this answer yes for a role they do not hold — naming somebody
- * else's role id simply finds no row.
+    ok: true;
+    email: string;
+    persistEmail: boolean;
+} | {
+    ok: false;
+    httpStatus: 400 | 404 | 429;
+    reason: string;
+};
+/**
+ * What the public resend route may do with an id.
  *
- * `status: { $ne: "deleted" }` is the same liveness test every other membership
- * read in this package uses, so a revoked membership stops conferring the read.
+ * The rule that matters: an address ALREADY on the record wins, always. A
+ * caller can fill in a blank one - that is what the card's inline field is for,
+ * and it grants no more than the id already did, since the id alone opens the
+ * pass page - but it can never redirect a pass that is already addressed to
+ * someone. Without that, a harvested id would be a way to have another
+ * person's check-in QR mailed anywhere.
  */
-declare function holdsRole(userId?: string | ObjectId | null, roleId?: string | ObjectId | null): Promise<boolean>;
+declare function decideSelfServiceResend(facts: TSelfServiceResendFacts): TSelfServiceResendDecision;
 
 declare function useAuthControllerV2(): {
     signUp: (req: Request, res: Response, next: NextFunction) => Promise<void>;
@@ -12006,7 +12630,7 @@ declare function MHidAmicoIdentity(value: THidAmicoIdentity): {
     member: ObjectId | undefined;
     serviceProvider: ObjectId | undefined;
     visitor: ObjectId | undefined;
-    type: "admin" | "resident" | "contractor" | "unknown" | "visitor" | "staff";
+    type: "admin" | "resident" | "staff" | "contractor" | "unknown" | "visitor";
     status: "deleted" | "active" | "inactive";
     metadata: Record<string, unknown>;
     createdAt: string | Date;
@@ -12118,7 +12742,7 @@ declare function useHidAmicoRepo(): {
         member: ObjectId | undefined;
         serviceProvider: ObjectId | undefined;
         visitor: ObjectId | undefined;
-        type: "admin" | "resident" | "contractor" | "unknown" | "visitor" | "staff";
+        type: "admin" | "resident" | "staff" | "contractor" | "unknown" | "visitor";
         status: "deleted" | "active" | "inactive";
         metadata: Record<string, unknown>;
         createdAt: string | Date;
@@ -12522,7 +13146,7 @@ declare function useHidAmicoService(): {
         member: bson.ObjectId | undefined;
         serviceProvider: bson.ObjectId | undefined;
         visitor: bson.ObjectId | undefined;
-        type: "admin" | "resident" | "contractor" | "unknown" | "visitor" | "staff";
+        type: "admin" | "resident" | "staff" | "contractor" | "unknown" | "visitor";
         status: "deleted" | "active" | "inactive";
         metadata: Record<string, unknown>;
         createdAt: string | Date;
@@ -12912,267 +13536,89 @@ declare function usePlatformTermsRepo(): {
     }>;
     getById: (id: string | ObjectId) => Promise<TPlatformTerms>;
     getByVersion: (version: number) => Promise<mongodb.WithId<TPlatformTerms> | null>;
-    getLatest: () => Promise<TPlatformTerms>;
-    getNextVersion: () => Promise<number>;
-};
-
-declare function usePlatformTermsService(): {
-    getLatest: () => Promise<{
-        _id: ObjectId | undefined;
-        version: number;
-        terms: string;
-        policies: string;
-        createdAt: string | undefined;
-    }>;
-    getById: (id: string | ObjectId) => Promise<{
-        _id: ObjectId | undefined;
-        version: number;
-        terms: string;
-        policies: string;
-        createdAt: string | undefined;
-    }>;
-    assertLatestTerms: (termsId: string | ObjectId) => Promise<TPlatformTerms>;
-    getStatusByUserId: (userId: string | ObjectId) => Promise<{
-        latestVersion: {
-            _id: ObjectId | undefined;
-            version: number;
-        };
-        acceptedTerms: string | null;
-        acceptedTermsAt: string | null;
-        isCurrent: boolean;
-    }>;
-    acceptByUserId: (userId: string | ObjectId, termsId: string | ObjectId, session?: ClientSession) => Promise<{
-        acceptedTerms: ObjectId | undefined;
-        version: number;
-    }>;
-    getStatusByPersonId: (personId: string | ObjectId) => Promise<{
-        latestVersion: {
-            _id: ObjectId | undefined;
-            version: number;
-        };
-        acceptedTerms: string | null;
-        acceptedTermsAt: string | null;
-        isCurrent: boolean;
-    }>;
-    acceptByPersonId: (personId: string | ObjectId, termsId: string | ObjectId) => Promise<{
-        acceptedTerms: ObjectId | undefined;
-        version: number;
-    }>;
-    listAcceptance: ({ version, accepted, page, limit, }: {
-        version?: number | null | undefined;
-        accepted?: boolean | undefined;
-        page?: number | undefined;
-        limit?: number | undefined;
-    }) => Promise<{
-        items: any[];
-        pages: number;
-        pageRange: string;
-    }>;
-    add: ({ terms, policies, createdBy, }: {
-        terms: string;
-        policies: string;
-        createdBy: string | ObjectId;
-    }) => Promise<{
-        _id: ObjectId;
-        version: number;
-        terms: string;
-        policies: string;
-        createdBy: string | ObjectId;
-        status?: string | undefined;
-        createdAt?: string | undefined;
-        updatedAt?: string | undefined;
-    }>;
-};
-
-declare function usePlatformTermsController(): {
-    getLatest: (_req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getStatus: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    getAcceptance: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    accept: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-    add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
-};
-
-declare function isTermsCurrent(accepted: string | null | undefined, latestVersionId: string): boolean;
-declare function normalizeAcceptedTerms(acceptedTerms: ObjectId | string | null | undefined): string | null;
-
-/**
- * What the Seven365 staff console records, as pure functions.
- *
- * Everything here is decidable without a database, a network or an Express
- * request, which is the point: the rules that decide **what is allowed into an
- * audit row** must be testable on their own. The row is written by
- * `console-audit.repo.ts`; this file decides its shape and its contents.
- *
- * The one rule that governs the whole file: an audit row holds **who, what,
- * which object, when, and enough of the values to make sense of the change**.
- * It is not a copy of the document. Fields are admitted by an **allow-list per
- * action** — anything not named there is dropped, so a handler that later
- * passes a whole record cannot leak an email address, a phone number, a
- * password hash or a token into the audit collection by accident.
- */
-/** The staff actions worth keeping a record of. */
-declare enum ConsoleAuditAction {
-    SUBSCRIPTION_CREATED = "subscription.created",
-    SUBSCRIPTION_UPDATED = "subscription.updated",
-    CLIENT_CREATED = "client.created",
-    CLIENT_SUSPENDED = "client.suspended",
-    CLIENT_REACTIVATED = "client.reactivated",
-    /**
-     * Seven365 staff changing which catalogue modules a client is offered.
-     *
-     * Recorded because it is a commercial decision about a paying client that
-     * somebody has to be able to answer for later, even though it grants and
-     * revokes nothing by itself (`org-modules.util.ts` - it narrows what a role
-     * editor OFFERS, and the server re-decides every request regardless).
-     */
-    CLIENT_MODULES_CHANGED = "client.modules-changed",
-    PROMO_CODE_CREATED = "promo-code.created",
-    PROMO_CODE_UPDATED = "promo-code.updated",
-    PROMO_CODE_STATUS_CHANGED = "promo-code.status-changed",
-    PROMO_CODE_REMOVED = "promo-code.removed",
-    PLAN_CREATED = "plan.created",
-    PLAN_UPDATED = "plan.updated",
-    PLAN_STATUS_CHANGED = "plan.status-changed",
-    TERMS_PUBLISHED = "terms.published",
-    /**
-     * Seven365 staff switching a client's camera on or off.
-     *
-     * The only tenant-owned object on this list, and it is here because it is the
-     * only one staff may touch: a faulty camera at a client's site has to be
-     * switchable off by us. See `updateById` in `site-camera.controller.ts` for
-     * the boundary that allows it and nothing else.
-     */
-    CAMERA_STATUS_CHANGED = "camera.status-changed",
-    /**
-     * A camera being added, edited or removed BY THE SITE'S OWN PEOPLE.
-     *
-     * The three below are the answer to "who changed this camera's address, and
-     * when" - a question that had no answer anywhere in the system. A camera
-     * record carries `createdAt`/`updatedAt` and no actor, and a write overwrites
-     * the previous `host` in place, so a wrong port number could only be traced by
-     * asking people what they remembered doing. At Seventh Condominium that turned
-     * a one-line correction into nine days.
-     *
-     * This is a widening of what the collection holds: `CAMERA_STATUS_CHANGED` is
-     * a Seven365 STAFF action, and these are tenant actions. That is deliberate.
-     * The console is where an operator goes to answer exactly this question, the
-     * row already carries `actor`, `target` and `createdAt`, and the alternative -
-     * a second audit collection with its own repository, model and indexes - is
-     * more moving parts for the same row. Nothing existing changes: the collection
-     * is append-only and every reader filters by `action`.
-     */
-    CAMERA_ADDED = "camera.added",
-    CAMERA_UPDATED = "camera.updated",
-    CAMERA_REMOVED = "camera.removed"
-}
-/**
- * The three actions that live in `organization.controller.ts`.
- *
- * They are defined, labelled and tested here, but **nothing calls them yet**.
- * `organization.controller.ts` is being edited by open PR #1884 (suspend), and
- * editing the same handlers here would hand a reviewer a merge conflict for no
- * gain. Each needs exactly one `recordConsoleAction(...)` call once #1884
- * lands; the action names and labels are already in place for it.
- */
-declare const CLIENT_ACTIONS: ConsoleAuditAction[];
-/** What a person reads on the screen. The row carries it so the screen need not map it. */
-declare const CONSOLE_AUDIT_LABELS: Record<ConsoleAuditAction, string>;
-/** What kind of thing the action was done to. */
-declare enum ConsoleAuditTarget {
-    ORGANIZATION = "organization",
-    SUBSCRIPTION = "subscription",
-    PROMO_CODE = "promo-code",
-    PLAN = "plan",
-    TERMS = "terms",
-    CAMERA = "camera"
-}
-/** A stored value is a primitive or it is not stored. */
-declare const AUDIT_VALUE_MAX_LENGTH = 120;
-/**
- * The part of a change that may be stored, for this action.
- *
- * Returns `undefined` rather than `{}` when nothing survives, so an empty
- * object never occupies a row and a reader can tell "nothing recorded" from
- * "recorded as empty".
- */
-declare function pickAuditFields(action: ConsoleAuditAction, value?: Record<string, unknown> | null): Record<string, string | number | boolean> | undefined;
-
-/**
- * One staff action in the Seven365 console.
- *
- * A new collection. Nothing existing is changed, no field is added to any live
- * document, and there is no migration — a client, a subscription, a promo code
- * and a plan are all exactly as they were.
- *
- * `actor` is a `users._id` and it comes from the SESSION, never from the
- * request body. The body-attribution defect fixed on `POST /api/terms` earlier
- * today is the reason that is written down rather than assumed.
- */
-type TConsoleAudit = {
-    _id?: ObjectId;
-    action: ConsoleAuditAction;
-    /** Who. A `users._id`, resolved from the session. */
-    actor: string | ObjectId;
-    /** Which client it affected, when the action is about one. */
-    org?: string | ObjectId | null;
-    /** Which object changed, and of what kind. */
-    target?: string | ObjectId | null;
-    targetType?: ConsoleAuditTarget | null;
-    /** Enough of the change to make sense of it — never a whole document. */
-    before?: Record<string, unknown> | null;
-    after?: Record<string, unknown> | null;
-    /** ISO-8601 UTC, so a lexicographic range filter is also a date range filter. */
-    createdAt?: string;
-};
-declare const schemaConsoleAudit: Joi.ObjectSchema<any>;
-declare function MConsoleAudit(value: TConsoleAudit): TConsoleAudit;
-
-declare const console_audit_namespace_collection = "console-audit";
-type TConsoleAuditQuery = {
-    org?: string;
-    action?: string;
-    /** ISO-8601. Inclusive at both ends of the day the caller names. */
-    from?: string;
-    to?: string;
-    page?: number;
-    limit?: number;
-};
-declare function useConsoleAuditRepo(): {
-    createIndexes: () => Promise<void>;
-    add: (value: TConsoleAudit) => Promise<{
-        _id: ObjectId;
-        action: ConsoleAuditAction;
-        actor: string | ObjectId;
-        org?: string | ObjectId | null | undefined;
-        target?: string | ObjectId | null | undefined;
-        targetType?: ConsoleAuditTarget | null | undefined;
-        before?: Record<string, unknown> | null | undefined;
-        after?: Record<string, unknown> | null | undefined;
-        createdAt?: string | undefined;
+    getLatest: () => Promise<TPlatformTerms>;
+    getNextVersion: () => Promise<number>;
+};
+
+declare function usePlatformTermsService(): {
+    getLatest: () => Promise<{
+        _id: ObjectId | undefined;
+        version: number;
+        terms: string;
+        policies: string;
+        createdAt: string | undefined;
     }>;
-    list: (query: TConsoleAuditQuery) => Promise<{
+    getById: (id: string | ObjectId) => Promise<{
+        _id: ObjectId | undefined;
+        version: number;
+        terms: string;
+        policies: string;
+        createdAt: string | undefined;
+    }>;
+    assertLatestTerms: (termsId: string | ObjectId) => Promise<TPlatformTerms>;
+    getStatusByUserId: (userId: string | ObjectId) => Promise<{
+        latestVersion: {
+            _id: ObjectId | undefined;
+            version: number;
+        };
+        acceptedTerms: string | null;
+        acceptedTermsAt: string | null;
+        isCurrent: boolean;
+    }>;
+    acceptByUserId: (userId: string | ObjectId, termsId: string | ObjectId, session?: ClientSession) => Promise<{
+        acceptedTerms: ObjectId | undefined;
+        version: number;
+    }>;
+    getStatusByPersonId: (personId: string | ObjectId) => Promise<{
+        latestVersion: {
+            _id: ObjectId | undefined;
+            version: number;
+        };
+        acceptedTerms: string | null;
+        acceptedTermsAt: string | null;
+        isCurrent: boolean;
+    }>;
+    acceptByPersonId: (personId: string | ObjectId, termsId: string | ObjectId) => Promise<{
+        acceptedTerms: ObjectId | undefined;
+        version: number;
+    }>;
+    listAcceptance: ({ version, accepted, page, limit, }: {
+        version?: number | null | undefined;
+        accepted?: boolean | undefined;
+        page?: number | undefined;
+        limit?: number | undefined;
+    }) => Promise<{
         items: any[];
         pages: number;
         pageRange: string;
     }>;
+    add: ({ terms, policies, createdBy, }: {
+        terms: string;
+        policies: string;
+        createdBy: string | ObjectId;
+    }) => Promise<{
+        _id: ObjectId;
+        version: number;
+        terms: string;
+        policies: string;
+        createdBy: string | ObjectId;
+        status?: string | undefined;
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+    }>;
 };
-/**
- * Record a staff action — and never, under any circumstance, break the action
- * it describes.
- *
- * Everything is inside the catch: resolving the database, validating the row
- * and the insert itself. The returned promise **cannot reject**, so a caller
- * that `await`s it cannot be thrown out of its own success path, and a caller
- * that forgets to `await` it cannot crash the process with an unhandled
- * rejection either. A failure is logged and the operation stands.
- *
- * Called only AFTER the operation it records has succeeded, so a row can never
- * describe something that did not happen. The other direction is possible and
- * accepted: an action can happen and its row fail to be written, in which case
- * the log carries it.
- */
-declare function recordConsoleAction(entry: TConsoleAudit): Promise<void>;
+
+declare function usePlatformTermsController(): {
+    getLatest: (_req: Request, res: Response, next: NextFunction) => Promise<void>;
+    getById: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    getStatus: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    getAcceptance: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    accept: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    add: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+};
+
+declare function isTermsCurrent(accepted: string | null | undefined, latestVersionId: string): boolean;
+declare function normalizeAcceptedTerms(acceptedTerms: ObjectId | string | null | undefined): string | null;
 
 /**
  * The staff console's own history: who did what, to which client, and when.
@@ -13447,172 +13893,104 @@ declare function isSuperAdmin(userId?: string | ObjectId | null): Promise<boolea
 declare function isPlatformOwner(userId?: string | ObjectId | null): Promise<boolean>;
 
 /**
- * THE SEVEN365 STAFF CONSOLE CATALOGUE, ON THE SERVER.
- *
- * `console-authz.util.ts` `requirePlatformStaff` answers ONE question — is this
- * session a Seven365 staff membership — and twelve controllers ask it before
- * every console write. It has never read which modules the staff role holds, so
- * a staff account onboarded onto a role ticked for Promo Codes alone could still
- * suspend a client, publish platform Terms, mint a subscription and read every
- * user on the platform. The console's own guard
- * (`web-app-org middleware/console-tier.global.ts` + `composables/useConsoleGate.ts`,
- * shipped in org #186) hides those screens from that role, but hiding a screen
- * is drawing, not securing: the endpoint behind it answered anybody with a staff
- * session. This file is the server half.
- *
- * ## The catalogue is a MIRROR, and it is pinned as one
- *
- * The strings below are `web-app-org composables/useAdminPermission.ts` — the
- * tick-boxes a `type: "admin"` role is actually built from — plus the two
- * families that composable pulls out of layer-common's `useCommonPermissions`
- * (`members`, `roles-and-permissions`). It is copied rather than imported
- * because `core` is a backend package and cannot depend on a Nuxt layer; a
- * server that invented its own vocabulary would be the
- * `visitor:create`/`visitor-mgmt:add-visitor` split all over again — a string
- * the server enforces that no role editor can grant.
- *
- * ## THE EMPTY-LIST RULE — why switching this on locks nobody out
- *
- * `user.service.ts createDefaultUser()` seeds the platform-staff role with
- * `permissions: []`, NOT `["*"]`. A plain membership test over this catalogue
- * would therefore refuse the Seven365 owner's own account on the day it shipped.
- *
- * So an EMPTY list means "everything", exactly as it does today, and `"*"` keeps
- * the short-circuit it has everywhere else in the estate. Both spellings the
- * staging owner role and the seeder can produce (`["*"]` and `[]`) allow all, so
- * **no role, member or user document has to be written for this to ship** —
- * which matters, because nothing in a repo may write one.
- *
- * The moment somebody ticks a module on a staff role, that role becomes
- * governed at BOTH ends. That is the intended behaviour, and it is the one case
- * to check before granting: a staff role that already holds a partial list is
- * enforced immediately.
- *
- * ## WIDENING ONLY
- *
- * Every check here is layered ON TOP of the staff identity test, never in place
- * of it — nobody who was refused before is admitted now. And the match accepts
- * ANY shipped spelling of a grant, the rule
- * `layer-common utils/permission-spellings.ts` already applies on the client:
- * `-admin`'s role editor writes `roles-and-permissions:add-role` while eight
- * apps write `roles:add-role`, and a role holding either must pass. Accepting
- * both costs nothing and needs no role migration; picking one would silently
- * un-grant every role holding the other.
- */
-/** Console resource -> the actions a staff role can be granted on it. */
-declare const CONSOLE_PERMISSIONS: Readonly<Record<string, readonly string[]>>;
-/** Every shipped spelling of `resource:action`. */
-declare function consoleSpellings(resource: string, action: string): readonly string[];
-/** True when this staff role is ungoverned and reaches the whole console. */
-declare function consoleRoleAllowsAll(held?: readonly string[] | null): boolean;
-/**
- * May a staff role holding `held` take `action` on `resource`?
- *
- * Omit `action` to ask the SCREEN question — "does this role reach the resource
- * at all" — which is `consoleCanSee` on the client: any single action on the
- * resource is enough. Used where the catalogue has no string for the operation
- * (creating a client organisation, writing a platform role/member row), because
- * inventing a `create-organization` string here would be a grant no role editor
- * anywhere can tick.
- *
- * An unknown resource, or an action the catalogue does not carry, is REFUSED for
- * a governed role — the same answer `hasPermission` gives on the client, and the
- * control the tests assert.
- */
-declare function consoleRoleAllows(held: readonly string[] | null | undefined, resource: string, action?: string): boolean;
-/**
- * THE CROSS-CLIENT GRANT — the one string that lets Seven365 staff out of
- * tenant scoping.
- *
- * Every tenant-scoping helper in this package (`requireSiteReach`,
- * `siteReachOf`, `entitledSites`, `requireOwnUnit`, `requireOrgReach`) opened
- * with `if (actor.isSuperAdmin) return`. That is an IDENTITY test: it asks who
- * the caller is and never asks what their staff role is ticked for. So a staff
- * account onboarded onto a role holding Promo Codes alone still read and wrote
- * every client's sites, people, files, documents, forms and facilities — the
- * console gate shipped at revision 35 governs the console's OWN endpoints, and
- * these are the tenant ones behind it.
- *
- * `organizations` is the catalogue string that already means "this staff role
- * reaches across clients" (`CONSOLE_PERMISSIONS.organizations` =
- * `see-all-organizations` / `see-organization-details`), and it is a tick-box
- * the admin role editor can actually grant. No new vocabulary is invented — a
- * string the server enforces that no editor can grant is the
- * `visitor:create` mistake, and this deliberately avoids it. The SCREEN
- * question is asked (no `action`), so either tick is enough.
- */
-declare const CROSS_CLIENT_GRANT: {
-    resource: string;
-    action?: string;
-};
-/**
- * May this staff caller skip tenant scoping?
+ * Q7 (owner, 2026-09-11): staff get NO notifications for modules they cannot
+ * open.
  *
- * **This never refuses anybody by itself.** It answers one question, and the
- * caller falls through to the ORDINARY tenant scoping when the answer is no —
- * so a staff member who is also a member of the target organisation, or who
- * reaches the site through a live `customer.sites` engagement, is served
- * exactly as they are today. The change is that platform identity alone stops
- * being a skeleton key.
+ * Only the Super Admin module list drops anybody: a recipient is dropped when
+ * EVERY membership they hold at the site denies EVERY module the category is
+ * about. A resource the list does not govern (`site-settings` for camera
+ * faults) is never denied, so it always keeps the notification.
  *
- * ## ZERO LOCKOUT
+ * The role check is computed and LOGGED only (master plan rule 3). The apps do
+ * not enforce most role gates today, so a role-based drop would hide alerts for
+ * screens people can open, and RP-5 forbids that loss.
  *
- * The rule is `consoleRoleAllows`, unchanged and already shipped: an EMPTY
- * permission list means everything (that is what `createDefaultUser` seeds) and
- * `"*"` means everything (that is what the live staff account holds). Both
- * spellings a real staff role can carry today allow all, so no role, member or
- * user document has to be written for this to ship and nobody loses access on
- * deploy.
+ * Exempt, never dropped: residents; anyone with no membership at the site
+ * (invitees, a push-token user with no member row); Seven365 staff; a send
+ * with no site (marketplace, broadcasts); a category not in the catalogue or
+ * with no permission resources (resident-only and marketplace ones).
  *
- * The one population this governs is a staff role holding a NON-EMPTY PARTIAL
- * list — which is the intended behaviour, and the same population revision 35
- * already began governing on the console endpoints. Such a role keeps every
- * client it holds a membership or engagement in; it loses only the reach it was
- * never ticked for.
- */
-declare function staffMayBypass(actor: {
-    isSuperAdmin: boolean;
-    staffPermissions?: string[];
-}, grant?: {
-    resource: string;
-    action?: string;
-}): boolean;
-
-/**
- * ONE console module, optionally ONE action on it.
+ * `NOTIFY_ACCESS_FILTER`: `log` (code default) counts, logs and SENDS TO
+ * EVERYONE; `on` drops; `off` reads nothing. `MODULE_LIST_GATE=off` is the
+ * same as `off`. Any error sends to everyone.
  *
- * `{ resource }` alone is the SCREEN question — "does this role reach the module
- * at all" — which is `consoleCanSee` on the client. Used where the catalogue
- * carries no string for the operation; see `console-permission.util.ts`.
+ * Both senders call this: core's `notification.service.ts send()` here, and
+ * API-core's own `send()` (a separate class; memory
+ * `two-notification-senders-not-one`), which must call it the same way.
  */
-type ConsoleGrant = {
-    resource: string;
-    action?: string;
+type TNotifyAccessMode = "log" | "on" | "off";
+declare const NOTIFY_ACCESS_FILTER_DEFAULT: TNotifyAccessMode;
+declare function notifyAccessMode(env?: Record<string, string | undefined>): TNotifyAccessMode;
+type TNotifyAccessContext = {
+    category?: string | null;
+    siteId?: unknown;
 };
-
-/**
- * Seven365 staff only, and — when a grant is named — staff whose role holds it.
- *
- * Returns the caller's id so a handler can attribute the write to them rather
- * than to whatever the request body claimed.
- *
- * The `grant` argument is the whole of the console-permission change. Omitting
- * it is exactly the behaviour this function has always had, so every call site
- * that has not been mapped to a module is untouched rather than guessed at. A
- * role with an EMPTY permission list — which is what `createDefaultUser` seeds —
- * passes every grant, so naming one locks nobody out. See
- * `console-permission.util.ts` for why that rule is what makes this shippable
- * with no write to any role document.
- */
-declare function requirePlatformStaff(req: Request, grant?: ConsoleGrant): Promise<string>;
-/**
- * Seven365 staff who hold this console module.
- *
- * The name the controllers use. `requirePlatformStaff` still decides staff
- * identity, unchanged — this is a layer ON TOP of it, never a replacement, so
- * nobody who was refused before is admitted now.
- */
-declare function requireConsolePermission(req: Request, resource: string, action?: string): Promise<string>;
+type TNotifyAccessReport = {
+    dropByModule: string[];
+    /** Logged only, never dropped. */
+    dropByRole: string[];
+    /** No membership at the site: counted, never dropped. */
+    noMember: string[];
+};
+/** Who this send would drop, and why. `null` when the send is exempt as a whole. */
+declare function notificationAccessReport(userIds: readonly unknown[], context: TNotifyAccessContext, data?: TModuleGateData): Promise<TNotifyAccessReport | null>;
+/**
+ * The recipients this send may reach. In `log` mode (the default) that is
+ * always all of them. Never throws.
+ */
+declare function filterByAccess<T extends string | {
+    toString(): string;
+}>(userIds: T[], context: TNotifyAccessContext, data?: TModuleGateData): Promise<T[]>;
+
+/**
+ * Q3 (owner, 2026-09-11): the server must ALSO refuse modules a client has not
+ * been given. This is the primitive. API-core's `requireSiteAccess` maps a
+ * route to its module and asks here once the site is resolved.
+ *
+ * `MODULE_GATE_MODE`: `log` (code default) never refuses anything, it logs a
+ * `would-refuse` line; `enforce` refuses only the modules listed in
+ * `MODULE_GATE_ENFORCE_KEYS`; `off` reads nothing. `MODULE_LIST_GATE=off` is
+ * the same as `off`.
+ *
+ * Allowed, always: Seven365 staff, residents, anyone with no membership at the
+ * site, an ungoverned or unmapped module, a module only SOME of the person's
+ * memberships at the site deny, and every error.
+ *
+ * OFFLINE WORK (owner, 2026-09-11): work done while the person still had
+ * access is accepted. A queued offline item carries its original, frozen
+ * timestamp (memory `isecure365-offline-mode`); pass it as `at`. It is refused
+ * only if it was stamped at or after the acknowledged save that denied the
+ * module. With no `at`, the request is treated as happening now.
+ *
+ * ponytail: `at` is the client's own clock, so a forged old timestamp slips
+ * through. That fails open, which is the rule everywhere here; bound it by a
+ * maximum queue age when enforcement starts.
+ */
+type TModuleGateMode = "log" | "enforce" | "off";
+declare const MODULE_GATE_MODE_DEFAULT: TModuleGateMode;
+declare function moduleGateMode(env?: Record<string, string | undefined>): TModuleGateMode;
+/** The modules `enforce` refuses: comma-separated, any spelling. Empty = none. */
+declare function moduleGateEnforceKeys(env?: Record<string, string | undefined>): string[];
+type TModuleAccess = {
+    /** Answer 403: only in `enforce` mode, and only for an enforced key. */
+    refuse: boolean;
+    /** The client's list denies this module for this person, at the time of the work. */
+    denied: boolean;
+};
+declare function moduleDeniedForCaller({ userId, site, module, at, }: {
+    userId?: unknown;
+    /** The site id, or the site document when the caller already has it. */
+    site?: {
+        _id?: unknown;
+        orgId?: unknown;
+        metadata?: {
+            modules?: unknown;
+        } | null;
+    } | string | null;
+    module?: string | null;
+    /** When the work was done: an offline item's original timestamp. */
+    at?: Date | string | number | null;
+}, data?: TModuleGateData): Promise<TModuleAccess>;
 
 type Recipient = string | ObjectId | Array<string | ObjectId>;
 declare class NotificationService {
@@ -14234,4 +14612,4 @@ declare function usePersonalEmergencyChainController(): {
     update: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 };
 
-export { ANPRMode, APP_BASE_URLS, AUDIT_VALUE_MAX_LENGTH, AccessTypeProps, AppKey, AppServiceType, AssignCardConfig, BULK_CAMERA_COLUMNS, BidStatus, BidType, BuildingLevelStatus, BuildingStatus, BulkCameraAccepted, BulkCameraOutcome, BulkCameraPlan, BulkCameraResult, BulkCardUpdate, BulletinOrder, BulletinRecipient, BulletinSort, BulletinStatus, BulletinVideoOrder, BulletinVideoSort, CAMERA_ANPR_PERMISSIONS, CAMERA_CAPABILITIES, CAMERA_CAPABILITY_REASONS, CAMERA_MANAGE_ANY_PERMISSIONS, CAMERA_NOT_PATROL_OR_CCTV, CAMERA_NO_SUB_STREAM_TTL_SECONDS, CAMERA_PTZ_PERMISSIONS, CAMERA_REQUEST_TIMEOUT_MS, CAMERA_RTSP_TIMEOUT_MS, CAMERA_SETUP_PERMISSIONS, CAMERA_SNAPSHOT_CACHE_SECONDS, CAMERA_SNAPSHOT_MAX_BYTES, CAMERA_TEST_MIN_INTERVAL_SECONDS, CAMERA_TEST_ROUND_LIMIT, CAMERA_TEST_ROUND_SECONDS, CAMERA_TYPE_ANPR, CAMERA_TYPE_IP, CAMERA_VIEW_PERMISSIONS, CLIENT_ACTIONS, CLOCK_DRIFT_WARN_SECONDS, CONSOLE_AUDIT_LABELS, CONSOLE_PERMISSIONS, CONTRACTOR_TYPE_LABELS, CROSS_CLIENT_GRANT, CURRENT_TIME_ENDPOINT, Camera, CameraAddressInput, CameraCapability, CameraCapabilityContext, CameraCapabilityDescriptor, CameraCapabilityEntry, CameraCapabilityReason, CameraCapabilityState, CameraCapabilityTrace, CameraDevice, CameraFrame, CameraMembership, CameraStream, CameraTestStatus, CameraTransport, CameraType, ConsoleAuditAction, ConsoleAuditTarget, ConsoleGrant, DEFAULT_RING_SECONDS, DEFAULT_SITE_TIMEZONE, DEVICE_STATUS, DOBStatus, DUPLICATE_TERMS_VERSION_MESSAGE, DayOfWeek, DeviceHttpTarget, DeviceProbeResult, DynamicFormFields, E164, EAccessCardTypes, EAccessCardUserTypes, EmailSender, EntryOrder, EntrySort, EventOrder, EventSort, EventStatus, EventType, FacilitySort, FacilityStatus, FormEntryStatus, GuestSort, GuestStatus, HID_CARD_VALUE_FACTOR, HID_PERMISSION_CATEGORIES, HID_UINT32_MAX, HID_UINT64_MAX, HidRawUint64, IAccessCard, IAccessCardTransaction, InviteActor, LIVE_ROLE, MAX_BULK_CAMERA_ROWS, MAX_CAMERA_CHANNEL, MAX_CAMERA_NAME_LENGTH, MAX_PERSONAL_EMERGENCY_CONTACTS, MAX_RING_SECONDS, MAccessCard, MAccessCardTransaction, MAddress, MAttendance, MAttendanceSettings, MBidPreloved, MBillingConfiguration, MBillingItem, MBuilding, MBuildingLevel, MBuildingUnit, MBulletinBoard, MBulletinVideo, MCategoryPreloved, MChannelPreloved, MChat, MChatPreloved, MConsoleAudit, MCustomer, MCustomerSite, MDocumentManagement, MEMBER_TYPES, MEntryPassSettings, MEventManagement, MFeedback, MFile, MFormEntry, MGuestManagement, MHidAmicoEvent, MHidAmicoIdentity, MHidAmicoReader, MHidSipAccount, MHidSitePermissions, MIN_RING_SECONDS, MIncidentReport, MManpowerDesignations, MManpowerMonitoring, MManpowerRemarks, MManpowerSites, MMember, MNfcPatrolLog, MNfcPatrolRoute, MNfcPatrolSettings, MNfcPatrolSettingsUpdate, MNfcPatrolTag, MNotification, MNotificationPreference, MOccurrenceBook, MOccurrenceEntry, MOccurrenceSubject, MOnlineForm, MOrg, MOvernightParkingApprovalHours, MOvernightParkingRequest, MPatrolEmail, MPatrolLog, MPatrolQuestion, MPatrolRoute, MPerson, MPersonalEmergencyChain, MPlatformTerms, MPost, MPostFavorite, MPromoCode, MRobot, MRole, MRoleV2, MServiceProvider, MServiceProviderBilling, MSession, MSite, MSiteCamera, MSiteFacility, MSiteFacilityBooking, MStatementOfAccount, MSubcategoryPreloved, MSubscription, MSubscriptionPlan, MUnitBilling, MUser, MVehicle, MVehicleTransaction, MVerification, MVerificationV2, MVisitorTransaction, MWorkOrder, NOTIFICATION_CATEGORIES, NOTIFICATION_CHANNELS, NOTIFICATION_CHANNEL_LABELS, NOTIFICATION_NAMESPACE, NotificationAppSlug, NotificationCategory, NotificationChannel, NotificationModule, NotificationPreferenceView, NotificationService, ORG_MARKETPLACE_VENDOR_FIELD, OrgNature, OvernightParkingRequestSort, OvernightParkingRequestStatus, PATROL_CCTV_CAMERA_FILTER, PATROL_EMAIL_MAX_LOGS, PATROL_EMAIL_MAX_PER_HOUR, PATROL_EMAIL_MAX_RECIPIENTS, PERSON_TYPES, PLATFORM_STAFF_MEMBER_TYPE, PLATFORM_STAFF_ROLE_TYPE, PROPERTY_MANAGEMENT_MEMBER_TYPES, PStatus, PTZ_ALLOWED_ACTIONS, PTZ_ALLOWED_CODES, Period, PersonStatus, PersonType, PersonTypes, PlatformTermsStatus, PostOrder, PostSort, PostStatus, QrTagProps, REALTIME_MAX_FANOUT, ResidentAppModuleKey, SELF_SERVICE_RESEND_COOLDOWN_MS, SELF_SIGNUP_PLATFORM, SELF_SIGNUP_STATUS, SELF_SIGNUP_TYPES, SERVICE_PROVIDER_INVITE_LABELS, SERVICE_PROVIDER_INVITE_TRANSITIONS, SERVICE_PROVIDER_SIGN_IN_SUBJECT, SERVICE_PROVIDER_SIGN_IN_TYPE, SERVICE_PROVIDER_SIGN_UP_SUBJECT, SERVICE_PROVIDER_SIGN_UP_TYPE, SOFTWARE_VERSION_ENDPOINT, ServiceProviderInviteAction, ServiceProviderInviteDecision, ServiceProviderInviteFacts, SiteAddress, SiteCategories, SiteStatus, SortFields, SortOrder, Status, SubjectOrder, SubjectSort, SubscriptionBillingMode, SubscriptionType, TAccessMngmntSettings, TActionStatus, TAddress, TAffectedEntities, TAffectedInjured, TAppServiceType, TApprovedBy, TApprover, TAttendance, TAttendanceCheckIn, TAttendanceCheckOut, TAttendanceCheckTime, TAttendanceLocation, TAttendanceSettings, TAttendanceSettingsGetBySite, TAuthorities, TAuthoritiesCalled, TBidPreloved, TBilling, TBillingConfiguration, TBillingItem, TBuilding, TBuildingLevel, TBuildingUnit, TBulletinBoard, TBulletinVideo, TCamera, TCameraHealthClaim, TCategoryPreloved, TChannelPreloved, TChat, TChatPreloved, TCheckPoint$1 as TCheckPoint, TComplaintInfo, TComplaintReceivedTo, TConsoleAudit, TConsoleAuditQuery, TCounter, TCreateNfcPatrolLog, TCustomer, TCustomerSite, TCustomerSitePropertyField, TDayNumber, TDaySchedule, TDefaultAccessCard, TDesignations, TDocs, TDocumentCreate, TDocumentManagement, TEntryPassSettings, TEventManagement, TFeedback, TFeedbackMetadata, TFeedbackUpdate, TFeedbackUpdateCategory, TFeedbackUpdateServiceProvider, TFeedbackUpdateStatus, TFeedbackUpdateToCompleted, TFile, TFiles, TFolderUpdate, TFormEntry, TGetAttendancesByUserQuery, TGetAttendancesQuery, TGuestManagement, THidAmicoEvent, THidAmicoGatewayJob, THidAmicoIdentity, THidAmicoPhysicalCard, THidAmicoReader, THidPermissionAssignment, THidPermissionCategory, THidPermissionUserBinding, THidPhysicalCardInput, THidPhysicalCardType$1 as THidPhysicalCardType, THidSipAccount, THidSitePermissions, TIncidentInformation, TIncidentReport, TIncidentTypeAndTime, TInvoice, TKeyRef, TManpowerDesignations, TManpowerDesignationsUpdate, TManpowerMonitoring, TManpowerMonitoringUpdate, TManpowerRemarks, TManpowerRemarksStatusUpdate, TManpowerRemarksUpdate, TManpowerSearchFilter, TManpowerSites, TMember, TMemberUpdateStatus, TMessagePreloved, TMiniRole, TNfcPatrolLog, TNfcPatrolRoute, TNfcPatrolRouteEdit, TNfcPatrolSettings, TNfcPatrolSettingsGetBySite, TNfcPatrolSettingsUpdate, TNfcPatrolTag, TNfcPatrolTagConfigureReset, TNfcPatrolTagEdit, TNfcPatrolTagUpdateData, TNotification, TNotificationPreference, TNotificationPreferenceOff, TOccurrenceBook, TOccurrenceEntry, TOccurrenceSubject, TOnlineForm, TOrg, TOvernightParkingApprovalHours, TOvernightParkingRequest, TPatrolEmail, TPatrolEmailCreatedBy, TPatrolEmailLogRef, TPatrolLog, TPatrolQuestion, TPatrolRoute, TPerson, TPersonalEmergencyChain, TPersonalEmergencyContact, TPlaceOfIncident, TPlates, TPlatformTerms, TPost, TPostFavorite, TPrice, TPriceType, TPromoCode, TPromoCurrencyInput, TPromoTier, TRANSPORT_DEVICE_HTTP, TRANSPORT_RELAY_PLAYER, TRANSPORT_RTSP_FRAME, TRecipientOfComplaint, TRemarks, TResident, TResidentAppModules, TRobot, TRobotMetadata, TRole, TRolePermissionHistoryEntry, TRoleV2, TRoute, TSOABillingItem, TSOAStatus, TSelfServiceEmailOccasion, TSelfServiceEmailRecord, TSelfServiceResendDecision, TSelfServiceResendFacts, TServiceProvider, TServiceProviderBilling, TSession, TSessionCreate, TShifts, TSignNfcPatrolLog, TSite, TSiteCamera, TSiteDayBounds, TSiteFacility, TSiteFacilityBooking, TSiteInfo, TSiteInformation, TSiteMetadata, TSiteUpdateBlock, TStatementOfAccount, TSubcategoryPreloved, TSubmissionForm, TSubscription, TSubscriptionPlan, TSubscriptionPlanApplication, TUnitBilling, TUnits, TUpdateFormEntry, TUpdateName, TUser, TUserCreate, TVehicle, TVehicleTransaction, TVehicleUpdate, TVerification, TVerificationCode, TVerificationEvent, TVerificationMetadata, TVerificationMetadataV2, TVerificationOnboarding, TVerificationV2, TVisitorTransaction, TWorkOrder, TWorkOrderMetadata, TWorkOrderUpdate, TWorkOrderUpdateStatus, TWorkOrderUpdateToCompleted, TanyoneDamageToProperty, UNSTORED_COLUMNS, UseAccessManagementRepo, UserStatus, VERIFICATION_OPEN_STATUSES, VehicleCategory, VehicleOrder, VehicleSort, VehicleStatus, VehicleType, VerificationLinkType, VerificationStatus, VerificationSubjectType, VerificationType, VisitorSort, VisitorStatus, addressSchema, allowedFieldsSite, allowedNatures, allowedPlanApplications, attendanceSchema, attendanceSettingsSchema, buildSelfServiceEmailContext, building_level_namespace_collection, building_units_namespace_collection, buildings_namespace_collection, bulletin_boards_namespace_collection, callerId, cameraBaseUrl, cameraCapabilitiesFor, cameraDevices, cameraGrant, cameraHealthClaim, cameraHealthSummary, cameraManagePermissions, cameraProbeCacheKey, cameraTransports, canRevokeRefreshTokenFamily, categoriesForPermissions, categorySupportsChannel, chatPrelovedEvents, chatSchema, clampPtzSpeed, clockDriftSeconds, consoleRoleAllows, consoleRoleAllowsAll, consoleSpellings, console_audit_namespace_collection, createManpowerRemarksDaily, customerSchema, customerSitePropertyFields, decideSelfServiceResend, decideServiceProviderInvite, decodeHidPacsCard, deriveBulletinStatus, deriveCameraHost, describeCameraCapabilities, designationsSchema, deviceControlEnabled, deviceHttpEnabled, deviceHttpTargets, deviceHttpTimeoutMs, deviceProbeTtlSeconds, emitNotificationCreated, emptyPersonalEmergencyChain, encodeHidPacsCard, entitledSiteScope, events_namespace_collection, expiredBulletinSweepFilter, expiredVehicleSweepFilter, facility_bookings_namespace_collection, feedbackSchema, feedbacks2_namespace_collection, feedbacks_namespace_collection, ffmpegFrameArgs, ffmpegPath, formatCapabilityTrace, formatDahuaDate, getIO, getSessionIdFromRequest, grabWithSubStreamFallback, guests_namespace_collection, hasAnyCapability, hasAnyPermission, hasOrgInvitation, hasOrgOwnership, hidRawUint64, holdsRole, incidentReport, incidentReportLog, incidents_namespace_collection, isCameraEntitled, isDuplicateVersionError, isLikelySelfServiceEmail, isPatrolCctvCamera, isPlatformOwner, isPromoCodeExpired, isRelayPlayerUrl, isSafeRelativePath, isSuperAdmin, isTermsCurrent, isValidTimezone, logCamera, manpowerDesignationsSchema, manpowerEvents, manpowerMonitoringSchema, manpowerRemarksSchema, manpowerSitesSchema, mapWithLimit, maskNric, nfcPatrolSettingsSchema, nfcPatrolSettingsSchemaUpdate, normalizeAcceptedTerms, normalizeHidCardValue, notificationCategory, notificationCategoryLabel, notificationEvents, notificationRoom, occasionForStatus, occurrence_book_namespace_collection, online_forms_namespace_collection, orgLevelRoles, orgSchema, overnight_parking_requests_namespace_collection, parseCameraChannel, parseCameraHost, parseDahuaFind, parseDeviceTime, parseHidJsonLossless, parsePromoExpiry, parseSoftwareVersion, pickAuditFields, pickCustomerSiteProperties, planBulkCameraImport, platform_terms_namespace_collection, promoCodeRefusal, promoCodeSchema, promoCodeStatusSchema, promoCodeUpdate, promoCodeUpdateSchema, ptzEndpoint, publicCameraFields, recordConsoleAction, refuseServiceProviderInviteAction, registerCameraTransport, relayForRecorder, remarksSchema, renderPagePdf, requireConsolePermission, requirePlatformStaff, resetCameraTransports, residentAppModuleKeys, residentAppModulesSchema, residentFormEntry, resolutionRefusalReason, resolveCamera, resolveDeviceHttp, resolveHidPhysicalCardValue, resolveInviteActor, resolveSiteTimezone, resolveStaffRole, robotSchema, rtspUrl, schema, schemaAppSlugNotification, schemaApprovedBy, schemaApprover, schemaBidPreloved, schemaBilling, schemaBillingConfiguration, schemaBillingItem, schemaBuilding, schemaBuildingLevel, schemaBuildingUnit, schemaBuildingUpdateOptions, schemaBulletinBoard, schemaBulletinVideo, schemaCategoryPreloved, schemaChannelPreloved, schemaChatPreloved, schemaConsoleAudit, schemaCreateHidAmicoIdentity, schemaCreateNfcPatrolLog, schemaCreateNotification, schemaCustomerSite, schemaDiscoverHidAmicoReader, schemaDocumentManagement, schemaEntryPassSettings, schemaEventManagement, schemaFiles, schemaFormEntry, schemaGuestManagement, schemaHidAmicoAccessLogQuery, schemaHidAmicoAssignUserCard, schemaHidAmicoConfiguration, schemaHidAmicoEnrollUserCard, schemaHidAmicoEvent, schemaHidAmicoExecuteActions, schemaHidAmicoIdentity, schemaHidAmicoIdentityIdParams, schemaHidAmicoIdentityQuery, schemaHidAmicoIntercomCall, schemaHidAmicoLogQuery, schemaHidAmicoMonitor, schemaHidAmicoNotificationParams, schemaHidAmicoObjectOperation, schemaHidAmicoOperatingMode, schemaHidAmicoReader, schemaHidAmicoReaderIdParams, schemaHidAmicoReaderListQuery, schemaHidAmicoReaderUserQuery, schemaHidAmicoSetConfiguration, schemaHidAmicoSiteIdParams, schemaHidAmicoSync, schemaHidAmicoUserCardIdParams, schemaHidAmicoUserCardParams, schemaHidAmicoUserImageParams, schemaHidAmicoUserImageUploadQuery, schemaHidAmicoUserPin, schemaHidAmicoUserPinParams, schemaHidAmicoVisitorImageParams, schemaHidAmicoVisitorImageUploadQuery, schemaHidAmicoVisitorQr, schemaHidPermissionCandidateQuery, schemaHidPermissionScopeQuery, schemaHidSipAccountRequest, schemaIncidentReport, schemaListNotification, schemaMultipleDocumentManagement, schemaNfcPatrolLog, schemaNfcPatrolRoute, schemaNfcPatrolTag, schemaNfcPatrolTagUpdateData, schemaNotification, schemaNotificationPreference, schemaNotificationPreferenceOff, schemaOccurrenceBook, schemaOccurrenceEntry, schemaOccurrenceSubject, schemaOnlineForm, schemaOvernightParkingApprovalHours, schemaOvernightParkingRequest, schemaPatrolEmail, schemaPatrolEmailCreatedBy, schemaPatrolEmailLogRef, schemaPatrolEmailQuery, schemaPatrolLog, schemaPatrolQuestion, schemaPatrolRoute, schemaPerson, schemaPersonalEmergencyContact, schemaPlate, schemaPlatformTerms, schemaPost, schemaPostFavorite, schemaResendPatrolEmail, schemaResidentSelfSignUp, schemaSelfServiceVisitor, schemaSendPatrolEmail, schemaServiceProvider, schemaServiceProviderBilling, schemaSignNfcPatrolLog, schemaSiteCamera, schemaSiteFacility, schemaSiteFacilityBooking, schemaStatementOfAccount, schemaSubcategoryPreloved, schemaUnitBilling, schemaUpdateBidPreloved, schemaUpdateBuildingLevel, schemaUpdateBulletinBoard, schemaUpdateBulletinVideo, schemaUpdateCategoryPreloved, schemaUpdateChatPreloved, schemaUpdateDocumentManagement, schemaUpdateEntryPassSettings, schemaUpdateEventManagement, schemaUpdateFolderManagement, schemaUpdateFormEntry, schemaUpdateGuestManagement, schemaUpdateHidAmicoIdentity, schemaUpdateHidAmicoReader, schemaUpdateHidSitePermissions, schemaUpdateIncidentReport, schemaUpdateNotification, schemaUpdateNotificationPreference, schemaUpdateOccurrenceBook, schemaUpdateOccurrenceEntry, schemaUpdateOccurrenceSubject, schemaUpdateOnlineForm, schemaUpdateOptions, schemaUpdateOvernightParkingRequest, schemaUpdatePatrolLog, schemaUpdatePatrolQuestion, schemaUpdatePatrolRoute, schemaUpdatePerson, schemaUpdatePersonalEmergencyChain, schemaUpdatePost, schemaUpdatePostFavorite, schemaUpdateServiceProviderBilling, schemaUpdateSiteBillingConfiguration, schemaUpdateSiteBillingItem, schemaUpdateSiteCamera, schemaUpdateSiteFacility, schemaUpdateSiteFacilityBooking, schemaUpdateSiteUnitBilling, schemaUpdateStatementOfAccount, schemaUpdateSubcategoryPreloved, schemaUpdateVisTrans, schemaVehicleTransaction, schemaVisitorTransaction, schemeCamera, schemeLogCamera, selectHealthTargets, selfServiceEmailSubject, serviceProviderInviteLabel, sessionSchema, setIO, shiftSchema, siteDayBounds, siteSchema, site_people_namespace_collection, snapshotEndpoint, snapshotRefusalReason, staffMayBypass, stringifyHidJson, stripFacialImageMetadata, subscriptionPlanSchema, summariseBulkCameraPlan, updateRemarksStatusEod, updateRemarksisAcknowledged, updateSiteSchema, useAccessManagementController, useAddressRepo, useAttendanceController, useAttendanceRepository, useAttendanceSettingsController, useAttendanceSettingsRepository, useAttendanceSettingsService, useAuthController, useAuthControllerV2, useAuthService, useAuthServiceV2, useBidPrelovedController, useBidPrelovedRepo, useBidPrelovedService, useBuildingController, useBuildingLevelController, useBuildingLevelRepo, useBuildingLevelService, useBuildingRepo, useBuildingService, useBuildingUnitController, useBuildingUnitRepo, useBuildingUnitService, useBulletinBoardController, useBulletinBoardRepo, useBulletinBoardService, useBulletinVideoController, useBulletinVideoRepo, useBulletinVideoService, useCameraViewController, useCameraViewService, useCategoryPrelovedController, useCategoryPrelovedRepo, useChannelPrelovedController, useChannelPrelovedRepo, useChatController, useChatPrelovedController, useChatPrelovedRepo, useChatPrelovedService, useChatRepo, useConsoleAuditController, useConsoleAuditRepo, useCounterModel, useCounterRepo, useCustomerController, useCustomerRepo, useCustomerSiteController, useCustomerSiteRepo, useCustomerSiteService, useDahuaService, useDashboardController, useDashboardRepo, useDocumentManagementController, useDocumentManagementRepo, useDocumentManagementService, useEntryPassSettingsController, useEntryPassSettingsRepo, useEventManagementController, useEventManagementRepo, useEventManagementService, useFeedbackController, useFeedbackRepo, useFeedbackService, useFileController, useFileRepo, useFileService, useFormEntryController, useFormEntryRepo, useGuestManagementController, useGuestManagementRepo, useGuestManagementService, useHidAmicoController, useHidAmicoRepo, useHidAmicoService, useHrmLabsAttendanceCtrl, useHrmLabsAttendanceSrvc, useIncidentReportController, useIncidentReportRepo, useIncidentReportService, useInvoiceController, useInvoiceModel, useInvoiceRepo, useManpowerDesignationCtrl, useManpowerDesignationRepo, useManpowerMonitoringCtrl, useManpowerMonitoringRepo, useManpowerMonitoringSrvc, useManpowerRemarkCtrl, useManpowerRemarksRepo, useManpowerSitesCtrl, useManpowerSitesRepo, useManpowerSitesSrvc, useMemberController, useMemberRepo, useMemberService, useNewDashboardController, useNewDashboardRepo, useNfcPatrolLogController, useNfcPatrolLogRepo, useNfcPatrolLogService, useNfcPatrolRouteController, useNfcPatrolRouteRepo, useNfcPatrolRouteService, useNfcPatrolSettingsController, useNfcPatrolSettingsRepository, useNfcPatrolSettingsService, useNfcPatrolTagController, useNfcPatrolTagRepo, useNfcPatrolTagService, useNotificationController, useNotificationPreferenceController, useNotificationPreferenceRepo, useNotificationPreferenceService, useNotificationRepo, useOccurrenceBookController, useOccurrenceBookRepo, useOccurrenceBookService, useOccurrenceEntryController, useOccurrenceEntryRepo, useOccurrenceEntryService, useOccurrenceSubjectController, useOccurrenceSubjectRepo, useOccurrenceSubjectService, useOnlineFormController, useOnlineFormRepo, useOrgController, useOrgControllerV2, useOrgRepo, useOvernightParkingController, useOvernightParkingRepo, useOvernightParkingRequestController, useOvernightParkingRequestRepo, useOvernightParkingRequestService, usePatrolEmailController, usePatrolEmailRepo, usePatrolEmailService, usePatrolLogController, usePatrolLogRepo, usePatrolLogService, usePatrolQuestionController, usePatrolQuestionRepo, usePatrolRouteController, usePatrolRouteRepo, usePersonController, usePersonRepo, usePersonalEmergencyChainController, usePersonalEmergencyChainRepo, usePersonalEmergencyChainService, usePlatformTermsController, usePlatformTermsRepo, usePlatformTermsService, usePostFavoriteController, usePostFavoriteRepo, usePostFavoriteService, usePostPrelovedController, usePostPrelovedRepo, usePriceController, usePriceModel, usePriceRepo, usePromoCodeController, usePromoCodeRepo, useRedDotPaymentController, useRedDotPaymentRepo, useRedDotPaymentSvc, useRobotController, useRobotRepo, useRobotService, useRoleController, useRoleControllerV2, useRoleRepo, useRoleRepoV2, useRoleServiceV2, useServiceProviderBillingController, useServiceProviderBillingRepo, useServiceProviderBillingService, useServiceProviderController, useServiceProviderInviteController, useServiceProviderInviteService, useServiceProviderRepo, useSessionRepo, useSiteBillingConfigurationController, useSiteBillingConfigurationRepo, useSiteBillingItemController, useSiteBillingItemRepo, useSiteCameraController, useSiteCameraRepo, useSiteCameraService, useSiteController, useSiteFacilityBookingController, useSiteFacilityBookingRepo, useSiteFacilityBookingService, useSiteFacilityController, useSiteFacilityRepo, useSiteFacilityService, useSiteRepo, useSiteService, useSiteUnitBillingController, useSiteUnitBillingRepo, useSiteUnitBillingService, useStatementOfAccountController, useStatementOfAccountRepo, useSubcategoryPrelovedController, useSubcategoryPrelovedRepo, useSubscriptionController, useSubscriptionPlanController, useSubscriptionPlanRepo, useSubscriptionRepo, useSubscriptionService, useUserController, useUserControllerV2, useUserRepo, useUserRepoV2, useUserService, useUserServiceV2, useVehicleController, useVehicleRepo, useVehicleService, useVerificationController, useVerificationControllerV2, useVerificationRepo, useVerificationRepoV2, useVerificationService, useVerificationServiceV2, useVisitorTransactionController, useVisitorTransactionRepo, useVisitorTransactionService, useWorkOrderController, useWorkOrderRepo, useWorkOrderService, userSchema, vehicleSchema, vehicles_namespace_collection, visitorPersonRepo, visitorPersonService, visitorType, visitors_namespace_collection, wallConfig, workOrderSchema, work_orders2_namespace_collection, work_orders_namespace_collection };
+export { ANPRMode, APP_BASE_URLS, AUDIT_VALUE_MAX_LENGTH, AccessTypeProps, AppKey, AppServiceType, AssignCardConfig, BULK_CAMERA_COLUMNS, BidStatus, BidType, BuildingLevelStatus, BuildingStatus, BulkCameraAccepted, BulkCameraOutcome, BulkCameraPlan, BulkCameraResult, BulkCardUpdate, BulletinOrder, BulletinRecipient, BulletinSort, BulletinStatus, BulletinVideoOrder, BulletinVideoSort, CAMERA_ANPR_PERMISSIONS, CAMERA_CAPABILITIES, CAMERA_CAPABILITY_REASONS, CAMERA_MANAGE_ANY_PERMISSIONS, CAMERA_NOT_PATROL_OR_CCTV, CAMERA_NO_SUB_STREAM_TTL_SECONDS, CAMERA_PTZ_PERMISSIONS, CAMERA_REQUEST_TIMEOUT_MS, CAMERA_RTSP_TIMEOUT_MS, CAMERA_SETUP_PERMISSIONS, CAMERA_SNAPSHOT_CACHE_SECONDS, CAMERA_SNAPSHOT_MAX_BYTES, CAMERA_TEST_MIN_INTERVAL_SECONDS, CAMERA_TEST_ROUND_LIMIT, CAMERA_TEST_ROUND_SECONDS, CAMERA_TYPE_ANPR, CAMERA_TYPE_IP, CAMERA_VIEW_PERMISSIONS, CLIENT_ACTIONS, CLOCK_DRIFT_WARN_SECONDS, CONSOLE_AUDIT_LABELS, CONSOLE_PERMISSIONS, CONTRACTOR_TYPE_LABELS, CROSS_CLIENT_GRANT, CURRENT_TIME_ENDPOINT, Camera, CameraAddressInput, CameraCapability, CameraCapabilityContext, CameraCapabilityDescriptor, CameraCapabilityEntry, CameraCapabilityReason, CameraCapabilityState, CameraCapabilityTrace, CameraDevice, CameraFrame, CameraMembership, CameraStream, CameraTestStatus, CameraTransport, CameraType, ConsoleAuditAction, ConsoleAuditTarget, ConsoleGrant, DEFAULT_RING_SECONDS, DEFAULT_SITE_TIMEZONE, DEVICE_STATUS, DOBStatus, DUPLICATE_TERMS_VERSION_MESSAGE, DayOfWeek, DeviceHttpTarget, DeviceProbeResult, DynamicFormFields, E164, EAccessCardTypes, EAccessCardUserTypes, EmailSender, EntryOrder, EntrySort, EventOrder, EventSort, EventStatus, EventType, FacilitySort, FacilityStatus, FormEntryStatus, GOVERNED_MODULES, GuestSort, GuestStatus, HID_CARD_VALUE_FACTOR, HID_PERMISSION_CATEGORIES, HID_UINT32_MAX, HID_UINT64_MAX, HidRawUint64, IAccessCard, IAccessCardTransaction, InviteActor, LIVE_ROLE, MAX_BULK_CAMERA_ROWS, MAX_CAMERA_CHANNEL, MAX_CAMERA_NAME_LENGTH, MAX_PERSONAL_EMERGENCY_CONTACTS, MAX_RING_SECONDS, MAccessCard, MAccessCardTransaction, MAddress, MAttendance, MAttendanceSettings, MBidPreloved, MBillingConfiguration, MBillingItem, MBuilding, MBuildingLevel, MBuildingUnit, MBulletinBoard, MBulletinVideo, MCategoryPreloved, MChannelPreloved, MChat, MChatPreloved, MConsoleAudit, MCustomer, MCustomerSite, MDocumentManagement, MEMBER_TYPES, MEntryPassSettings, MEventManagement, MFeedback, MFile, MFormEntry, MGuestManagement, MHidAmicoEvent, MHidAmicoIdentity, MHidAmicoReader, MHidSipAccount, MHidSitePermissions, MIN_RING_SECONDS, MIncidentReport, MManpowerDesignations, MManpowerMonitoring, MManpowerRemarks, MManpowerSites, MMember, MNfcPatrolLog, MNfcPatrolRoute, MNfcPatrolSettings, MNfcPatrolSettingsUpdate, MNfcPatrolTag, MNotification, MNotificationPreference, MODULE_GATE_MODE_DEFAULT, MODULE_LIST_GATE_DEFAULT, MOccurrenceBook, MOccurrenceEntry, MOccurrenceSubject, MOnlineForm, MOrg, MOvernightParkingApprovalHours, MOvernightParkingRequest, MPatrolEmail, MPatrolLog, MPatrolQuestion, MPatrolRoute, MPerson, MPersonalEmergencyChain, MPlatformTerms, MPost, MPostFavorite, MPromoCode, MRobot, MRole, MRoleV2, MServiceProvider, MServiceProviderBilling, MSession, MSite, MSiteCamera, MSiteFacility, MSiteFacilityBooking, MStatementOfAccount, MSubcategoryPreloved, MSubscription, MSubscriptionPlan, MUnitBilling, MUser, MVehicle, MVehicleTransaction, MVerification, MVerificationV2, MVisitorTransaction, MWorkOrder, NOTIFICATION_CATEGORIES, NOTIFICATION_CHANNELS, NOTIFICATION_CHANNEL_LABELS, NOTIFICATION_NAMESPACE, NOTIFY_ACCESS_FILTER_DEFAULT, NotificationAppSlug, NotificationCategory, NotificationChannel, NotificationModule, NotificationPreferenceView, NotificationService, ORG_MARKETPLACE_VENDOR_FIELD, OrgNature, OvernightParkingRequestSort, OvernightParkingRequestStatus, PATROL_CCTV_CAMERA_FILTER, PATROL_EMAIL_MAX_LOGS, PATROL_EMAIL_MAX_PER_HOUR, PATROL_EMAIL_MAX_RECIPIENTS, PERSON_TYPES, PLATFORM_STAFF_MEMBER_TYPE, PLATFORM_STAFF_ROLE_TYPE, PROPERTY_MANAGEMENT_MEMBER_TYPES, PStatus, PTZ_ALLOWED_ACTIONS, PTZ_ALLOWED_CODES, Period, PersonStatus, PersonType, PersonTypes, PlatformTermsStatus, PostOrder, PostSort, PostStatus, QrTagProps, REALTIME_MAX_FANOUT, ResidentAppModuleKey, SELF_SERVICE_RESEND_COOLDOWN_MS, SELF_SIGNUP_PLATFORM, SELF_SIGNUP_STATUS, SELF_SIGNUP_TYPES, SERVICE_PROVIDER_INVITE_LABELS, SERVICE_PROVIDER_INVITE_TRANSITIONS, SERVICE_PROVIDER_SIGN_IN_SUBJECT, SERVICE_PROVIDER_SIGN_IN_TYPE, SERVICE_PROVIDER_SIGN_UP_SUBJECT, SERVICE_PROVIDER_SIGN_UP_TYPE, SOFTWARE_VERSION_ENDPOINT, ServiceProviderInviteAction, ServiceProviderInviteDecision, ServiceProviderInviteFacts, SiteAddress, SiteCategories, SiteStatus, SortFields, SortOrder, Status, SubjectOrder, SubjectSort, SubscriptionBillingMode, SubscriptionType, TAccessMngmntSettings, TActionStatus, TAddress, TAffectedEntities, TAffectedInjured, TAppServiceType, TApprovedBy, TApprover, TAttendance, TAttendanceCheckIn, TAttendanceCheckOut, TAttendanceCheckTime, TAttendanceLocation, TAttendanceSettings, TAttendanceSettingsGetBySite, TAuthorities, TAuthoritiesCalled, TBidPreloved, TBilling, TBillingConfiguration, TBillingItem, TBuilding, TBuildingLevel, TBuildingUnit, TBulletinBoard, TBulletinVideo, TCamera, TCameraHealthClaim, TCategoryPreloved, TChannelPreloved, TChat, TChatPreloved, TCheckPoint$1 as TCheckPoint, TComplaintInfo, TComplaintReceivedTo, TConsoleAudit, TConsoleAuditQuery, TCounter, TCreateNfcPatrolLog, TCustomer, TCustomerSite, TCustomerSitePropertyField, TDayNumber, TDaySchedule, TDefaultAccessCard, TDesignations, TDocs, TDocumentCreate, TDocumentManagement, TEntryPassSettings, TEventManagement, TFeedback, TFeedbackMetadata, TFeedbackUpdate, TFeedbackUpdateCategory, TFeedbackUpdateServiceProvider, TFeedbackUpdateStatus, TFeedbackUpdateToCompleted, TFile, TFiles, TFolderUpdate, TFormEntry, TGetAttendancesByUserQuery, TGetAttendancesQuery, TGuestManagement, THidAmicoEvent, THidAmicoGatewayJob, THidAmicoIdentity, THidAmicoPhysicalCard, THidAmicoReader, THidPermissionAssignment, THidPermissionCategory, THidPermissionUserBinding, THidPhysicalCardInput, THidPhysicalCardType$1 as THidPhysicalCardType, THidSipAccount, THidSitePermissions, TIncidentInformation, TIncidentReport, TIncidentTypeAndTime, TInvoice, TKeyRef, TManpowerDesignations, TManpowerDesignationsUpdate, TManpowerMonitoring, TManpowerMonitoringUpdate, TManpowerRemarks, TManpowerRemarksStatusUpdate, TManpowerRemarksUpdate, TManpowerSearchFilter, TManpowerSites, TMember, TMemberModulesDeps, TMemberUpdateStatus, TMessagePreloved, TMiniRole, TModuleAccess, TModuleGateMode, TModuleImpact, TNfcPatrolLog, TNfcPatrolRoute, TNfcPatrolRouteEdit, TNfcPatrolSettings, TNfcPatrolSettingsGetBySite, TNfcPatrolSettingsUpdate, TNfcPatrolTag, TNfcPatrolTagConfigureReset, TNfcPatrolTagEdit, TNfcPatrolTagUpdateData, TNotification, TNotificationPreference, TNotificationPreferenceOff, TNotifyAccessContext, TNotifyAccessMode, TNotifyAccessReport, TOccurrenceBook, TOccurrenceEntry, TOccurrenceSubject, TOnlineForm, TOrg, TOrgModulesDeps, TOvernightParkingApprovalHours, TOvernightParkingRequest, TPatrolEmail, TPatrolEmailCreatedBy, TPatrolEmailLogRef, TPatrolLog, TPatrolQuestion, TPatrolRoute, TPerson, TPersonalEmergencyChain, TPersonalEmergencyContact, TPlaceOfIncident, TPlates, TPlatformTerms, TPost, TPostFavorite, TPrice, TPriceType, TPromoCode, TPromoCurrencyInput, TPromoTier, TRANSPORT_DEVICE_HTTP, TRANSPORT_RELAY_PLAYER, TRANSPORT_RTSP_FRAME, TRecipientOfComplaint, TRemarks, TResident, TResidentAppModules, TRobot, TRobotMetadata, TRole, TRolePermissionHistoryEntry, TRoleV2, TRoute, TSOABillingItem, TSOAStatus, TSelfServiceEmailOccasion, TSelfServiceEmailRecord, TSelfServiceResendDecision, TSelfServiceResendFacts, TServiceProvider, TServiceProviderBilling, TSession, TSessionCreate, TShifts, TSignNfcPatrolLog, TSite, TSiteCamera, TSiteDayBounds, TSiteFacility, TSiteFacilityBooking, TSiteInfo, TSiteInformation, TSiteMetadata, TSiteModulesDeps, TSiteUpdateBlock, TStatementOfAccount, TSubcategoryPreloved, TSubmissionForm, TSubscription, TSubscriptionPlan, TSubscriptionPlanApplication, TUnitBilling, TUnits, TUpdateFormEntry, TUpdateName, TUser, TUserCreate, TVehicle, TVehicleTransaction, TVehicleUpdate, TVerification, TVerificationCode, TVerificationEvent, TVerificationMetadata, TVerificationMetadataV2, TVerificationOnboarding, TVerificationV2, TVisitorTransaction, TWorkOrder, TWorkOrderMetadata, TWorkOrderUpdate, TWorkOrderUpdateStatus, TWorkOrderUpdateToCompleted, TanyoneDamageToProperty, UNSTORED_COLUMNS, UseAccessManagementRepo, UserStatus, VERIFICATION_OPEN_STATUSES, VehicleCategory, VehicleOrder, VehicleSort, VehicleStatus, VehicleType, VerificationLinkType, VerificationStatus, VerificationSubjectType, VerificationType, VisitorSort, VisitorStatus, addressSchema, allowedFieldsSite, allowedNatures, allowedPlanApplications, attendanceSchema, attendanceSettingsSchema, buildSelfServiceEmailContext, building_level_namespace_collection, building_units_namespace_collection, buildings_namespace_collection, bulletin_boards_namespace_collection, callerAccountApproved, callerId, cameraBaseUrl, cameraCapabilitiesFor, cameraDevices, cameraGrant, cameraHealthClaim, cameraHealthSummary, cameraManagePermissions, cameraProbeCacheKey, cameraTransports, canRevokeRefreshTokenFamily, categoriesForPermissions, categorySupportsChannel, chatPrelovedEvents, chatSchema, clampPtzSpeed, clockDriftSeconds, consoleRoleAllows, consoleRoleAllowsAll, consoleSpellings, console_audit_namespace_collection, createManpowerRemarksDaily, customerSchema, customerSitePropertyFields, decideSelfServiceResend, decideServiceProviderInvite, decodeHidPacsCard, deniedModules, deriveBulletinStatus, deriveCameraHost, describeCameraCapabilities, designationsSchema, deviceControlEnabled, deviceHttpEnabled, deviceHttpTargets, deviceHttpTimeoutMs, deviceProbeTtlSeconds, emitNotificationCreated, emptyPersonalEmergencyChain, encodeHidPacsCard, entitledSiteScope, events_namespace_collection, expandModules, expiredBulletinSweepFilter, expiredVehicleSweepFilter, facility_bookings_namespace_collection, feedbackSchema, feedbacks2_namespace_collection, feedbacks_namespace_collection, ffmpegFrameArgs, ffmpegPath, filterByAccess, formatCapabilityTrace, formatDahuaDate, getIO, getSessionIdFromRequest, grabWithSubStreamFallback, guests_namespace_collection, hasAnyCapability, hasAnyPermission, hasOrgInvitation, hasOrgOwnership, hasOrgSiteReach, hidRawUint64, holdsRole, incidentReport, incidentReportLog, incidents_namespace_collection, invitationOffersRole, isCameraEntitled, isDuplicateVersionError, isLikelySelfServiceEmail, isPatrolCctvCamera, isPlatformOwner, isPromoCodeExpired, isRelayPlayerUrl, isSafeRelativePath, isSuperAdmin, isTermsCurrent, isValidTimezone, logCamera, manpowerDesignationsSchema, manpowerEvents, manpowerMonitoringSchema, manpowerRemarksSchema, manpowerSitesSchema, mapWithLimit, maskNric, memberModulesHandlers, moduleDeniedForCaller, moduleGateEnforceKeys, moduleGateMode, moduleImpact, moduleListGateOn, nfcPatrolSettingsSchema, nfcPatrolSettingsSchemaUpdate, normalizeAcceptedTerms, normalizeHidCardValue, notificationAccessReport, notificationCategory, notificationCategoryLabel, notificationEvents, notificationRoom, notifyAccessMode, occasionForStatus, occurrence_book_namespace_collection, online_forms_namespace_collection, orgLevelRoles, orgModulesHandlers, orgSchema, overnight_parking_requests_namespace_collection, parseCameraChannel, parseCameraHost, parseDahuaFind, parseDeviceTime, parseHidJsonLossless, parsePromoExpiry, parseSoftwareVersion, pickAuditFields, pickCustomerSiteProperties, planBulkCameraImport, platform_terms_namespace_collection, promoCodeRefusal, promoCodeSchema, promoCodeStatusSchema, promoCodeUpdate, promoCodeUpdateSchema, ptzEndpoint, publicCameraFields, readsAsApprovedAccount, recordConsoleAction, refuseServiceProviderInviteAction, registerCameraTransport, relayForRecorder, remarksSchema, renderPagePdf, requireConsolePermission, requirePlatformStaff, resetCameraTransports, residentAppModuleKeys, residentAppModulesSchema, residentFormEntry, resolutionRefusalReason, resolveCamera, resolveDeviceHttp, resolveHidPhysicalCardValue, resolveInviteActor, resolveSiteTimezone, resolveStaffRole, robotSchema, rtspUrl, schema, schemaAppSlugNotification, schemaApprovedBy, schemaApprover, schemaBidPreloved, schemaBilling, schemaBillingConfiguration, schemaBillingItem, schemaBuilding, schemaBuildingLevel, schemaBuildingUnit, schemaBuildingUpdateOptions, schemaBulletinBoard, schemaBulletinVideo, schemaCategoryPreloved, schemaChannelPreloved, schemaChatPreloved, schemaConsoleAudit, schemaCreateHidAmicoIdentity, schemaCreateNfcPatrolLog, schemaCreateNotification, schemaCustomerSite, schemaDiscoverHidAmicoReader, schemaDocumentManagement, schemaEntryPassSettings, schemaEventManagement, schemaFiles, schemaFormEntry, schemaGuestManagement, schemaHidAmicoAccessLogQuery, schemaHidAmicoAssignUserCard, schemaHidAmicoConfiguration, schemaHidAmicoEnrollUserCard, schemaHidAmicoEvent, schemaHidAmicoExecuteActions, schemaHidAmicoIdentity, schemaHidAmicoIdentityIdParams, schemaHidAmicoIdentityQuery, schemaHidAmicoIntercomCall, schemaHidAmicoLogQuery, schemaHidAmicoMonitor, schemaHidAmicoNotificationParams, schemaHidAmicoObjectOperation, schemaHidAmicoOperatingMode, schemaHidAmicoReader, schemaHidAmicoReaderIdParams, schemaHidAmicoReaderListQuery, schemaHidAmicoReaderUserQuery, schemaHidAmicoSetConfiguration, schemaHidAmicoSiteIdParams, schemaHidAmicoSync, schemaHidAmicoUserCardIdParams, schemaHidAmicoUserCardParams, schemaHidAmicoUserImageParams, schemaHidAmicoUserImageUploadQuery, schemaHidAmicoUserPin, schemaHidAmicoUserPinParams, schemaHidAmicoVisitorImageParams, schemaHidAmicoVisitorImageUploadQuery, schemaHidAmicoVisitorQr, schemaHidPermissionCandidateQuery, schemaHidPermissionScopeQuery, schemaHidSipAccountRequest, schemaIncidentReport, schemaListNotification, schemaMultipleDocumentManagement, schemaNfcPatrolLog, schemaNfcPatrolRoute, schemaNfcPatrolTag, schemaNfcPatrolTagUpdateData, schemaNotification, schemaNotificationPreference, schemaNotificationPreferenceOff, schemaOccurrenceBook, schemaOccurrenceEntry, schemaOccurrenceSubject, schemaOnlineForm, schemaOvernightParkingApprovalHours, schemaOvernightParkingRequest, schemaPatrolEmail, schemaPatrolEmailCreatedBy, schemaPatrolEmailLogRef, schemaPatrolEmailQuery, schemaPatrolLog, schemaPatrolQuestion, schemaPatrolRoute, schemaPerson, schemaPersonalEmergencyContact, schemaPlate, schemaPlatformTerms, schemaPost, schemaPostFavorite, schemaResendPatrolEmail, schemaResidentSelfSignUp, schemaSelfServiceVisitor, schemaSendPatrolEmail, schemaServiceProvider, schemaServiceProviderBilling, schemaSignNfcPatrolLog, schemaSiteCamera, schemaSiteFacility, schemaSiteFacilityBooking, schemaStatementOfAccount, schemaSubcategoryPreloved, schemaUnitBilling, schemaUpdateBidPreloved, schemaUpdateBuildingLevel, schemaUpdateBulletinBoard, schemaUpdateBulletinVideo, schemaUpdateCategoryPreloved, schemaUpdateChatPreloved, schemaUpdateDocumentManagement, schemaUpdateEntryPassSettings, schemaUpdateEventManagement, schemaUpdateFolderManagement, schemaUpdateFormEntry, schemaUpdateGuestManagement, schemaUpdateHidAmicoIdentity, schemaUpdateHidAmicoReader, schemaUpdateHidSitePermissions, schemaUpdateIncidentReport, schemaUpdateNotification, schemaUpdateNotificationPreference, schemaUpdateOccurrenceBook, schemaUpdateOccurrenceEntry, schemaUpdateOccurrenceSubject, schemaUpdateOnlineForm, schemaUpdateOptions, schemaUpdateOvernightParkingRequest, schemaUpdatePatrolLog, schemaUpdatePatrolQuestion, schemaUpdatePatrolRoute, schemaUpdatePerson, schemaUpdatePersonalEmergencyChain, schemaUpdatePost, schemaUpdatePostFavorite, schemaUpdateServiceProviderBilling, schemaUpdateSiteBillingConfiguration, schemaUpdateSiteBillingItem, schemaUpdateSiteCamera, schemaUpdateSiteFacility, schemaUpdateSiteFacilityBooking, schemaUpdateSiteUnitBilling, schemaUpdateStatementOfAccount, schemaUpdateSubcategoryPreloved, schemaUpdateVisTrans, schemaVehicleTransaction, schemaVisitorTransaction, schemeCamera, schemeLogCamera, selectHealthTargets, selfServiceEmailSubject, serviceProviderInviteLabel, sessionSchema, setIO, shiftSchema, siteDayBounds, siteModulesHandlers, siteSchema, site_people_namespace_collection, snapshotEndpoint, snapshotRefusalReason, staffMayBypass, stringifyHidJson, stripFacialImageMetadata, subscriptionPlanSchema, summariseBulkCameraPlan, updateRemarksStatusEod, updateRemarksisAcknowledged, updateSiteSchema, useAccessManagementController, useAddressRepo, useAttendanceController, useAttendanceRepository, useAttendanceSettingsController, useAttendanceSettingsRepository, useAttendanceSettingsService, useAuthController, useAuthControllerV2, useAuthService, useAuthServiceV2, useBidPrelovedController, useBidPrelovedRepo, useBidPrelovedService, useBuildingController, useBuildingLevelController, useBuildingLevelRepo, useBuildingLevelService, useBuildingRepo, useBuildingService, useBuildingUnitController, useBuildingUnitRepo, useBuildingUnitService, useBulletinBoardController, useBulletinBoardRepo, useBulletinBoardService, useBulletinVideoController, useBulletinVideoRepo, useBulletinVideoService, useCameraViewController, useCameraViewService, useCategoryPrelovedController, useCategoryPrelovedRepo, useChannelPrelovedController, useChannelPrelovedRepo, useChatController, useChatPrelovedController, useChatPrelovedRepo, useChatPrelovedService, useChatRepo, useConsoleAuditController, useConsoleAuditRepo, useCounterModel, useCounterRepo, useCustomerController, useCustomerRepo, useCustomerSiteController, useCustomerSiteRepo, useCustomerSiteService, useDahuaService, useDashboardController, useDashboardRepo, useDocumentManagementController, useDocumentManagementRepo, useDocumentManagementService, useEntryPassSettingsController, useEntryPassSettingsRepo, useEventManagementController, useEventManagementRepo, useEventManagementService, useFeedbackController, useFeedbackRepo, useFeedbackService, useFileController, useFileRepo, useFileService, useFormEntryController, useFormEntryRepo, useGuestManagementController, useGuestManagementRepo, useGuestManagementService, useHidAmicoController, useHidAmicoRepo, useHidAmicoService, useHrmLabsAttendanceCtrl, useHrmLabsAttendanceSrvc, useIncidentReportController, useIncidentReportRepo, useIncidentReportService, useInvoiceController, useInvoiceModel, useInvoiceRepo, useManpowerDesignationCtrl, useManpowerDesignationRepo, useManpowerMonitoringCtrl, useManpowerMonitoringRepo, useManpowerMonitoringSrvc, useManpowerRemarkCtrl, useManpowerRemarksRepo, useManpowerSitesCtrl, useManpowerSitesRepo, useManpowerSitesSrvc, useMemberController, useMemberRepo, useMemberService, useNewDashboardController, useNewDashboardRepo, useNfcPatrolLogController, useNfcPatrolLogRepo, useNfcPatrolLogService, useNfcPatrolRouteController, useNfcPatrolRouteRepo, useNfcPatrolRouteService, useNfcPatrolSettingsController, useNfcPatrolSettingsRepository, useNfcPatrolSettingsService, useNfcPatrolTagController, useNfcPatrolTagRepo, useNfcPatrolTagService, useNotificationController, useNotificationPreferenceController, useNotificationPreferenceRepo, useNotificationPreferenceService, useNotificationRepo, useOccurrenceBookController, useOccurrenceBookRepo, useOccurrenceBookService, useOccurrenceEntryController, useOccurrenceEntryRepo, useOccurrenceEntryService, useOccurrenceSubjectController, useOccurrenceSubjectRepo, useOccurrenceSubjectService, useOnlineFormController, useOnlineFormRepo, useOrgController, useOrgControllerV2, useOrgRepo, useOvernightParkingController, useOvernightParkingRepo, useOvernightParkingRequestController, useOvernightParkingRequestRepo, useOvernightParkingRequestService, usePatrolEmailController, usePatrolEmailRepo, usePatrolEmailService, usePatrolLogController, usePatrolLogRepo, usePatrolLogService, usePatrolQuestionController, usePatrolQuestionRepo, usePatrolRouteController, usePatrolRouteRepo, usePersonController, usePersonRepo, usePersonalEmergencyChainController, usePersonalEmergencyChainRepo, usePersonalEmergencyChainService, usePlatformTermsController, usePlatformTermsRepo, usePlatformTermsService, usePostFavoriteController, usePostFavoriteRepo, usePostFavoriteService, usePostPrelovedController, usePostPrelovedRepo, usePriceController, usePriceModel, usePriceRepo, usePromoCodeController, usePromoCodeRepo, useRedDotPaymentController, useRedDotPaymentRepo, useRedDotPaymentSvc, useRobotController, useRobotRepo, useRobotService, useRoleController, useRoleControllerV2, useRoleRepo, useRoleRepoV2, useRoleServiceV2, useServiceProviderBillingController, useServiceProviderBillingRepo, useServiceProviderBillingService, useServiceProviderController, useServiceProviderInviteController, useServiceProviderInviteService, useServiceProviderRepo, useSessionRepo, useSiteBillingConfigurationController, useSiteBillingConfigurationRepo, useSiteBillingItemController, useSiteBillingItemRepo, useSiteCameraController, useSiteCameraRepo, useSiteCameraService, useSiteController, useSiteFacilityBookingController, useSiteFacilityBookingRepo, useSiteFacilityBookingService, useSiteFacilityController, useSiteFacilityRepo, useSiteFacilityService, useSiteRepo, useSiteService, useSiteUnitBillingController, useSiteUnitBillingRepo, useSiteUnitBillingService, useStatementOfAccountController, useStatementOfAccountRepo, useSubcategoryPrelovedController, useSubcategoryPrelovedRepo, useSubscriptionController, useSubscriptionPlanController, useSubscriptionPlanRepo, useSubscriptionRepo, useSubscriptionService, useUserController, useUserControllerV2, useUserRepo, useUserRepoV2, useUserService, useUserServiceV2, useVehicleController, useVehicleRepo, useVehicleService, useVerificationController, useVerificationControllerV2, useVerificationRepo, useVerificationRepoV2, useVerificationService, useVerificationServiceV2, useVisitorTransactionController, useVisitorTransactionRepo, useVisitorTransactionService, useWorkOrderController, useWorkOrderRepo, useWorkOrderService, userSchema, vehicleSchema, vehicles_namespace_collection, visitorPersonRepo, visitorPersonService, visitorType, visitors_namespace_collection, wallConfig, workOrderSchema, work_orders2_namespace_collection, work_orders_namespace_collection };