@bash-app/bash-common 30.360.0 → 30.361.0

package/dist/utils/__tests__/organizationEntitlements.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "@jest/globals";
-import { organizationHasVanitySubdomain } from "../organizationEntitlements.js";
+import { organizationHasApiAccess, organizationHasAuditLogAccess, organizationHasComplianceAccess, organizationHasEnterprisePlatformAccess, organizationHasProcurementAccess, organizationHasSsoAccess, organizationHasVanitySubdomain, } from "../organizationEntitlements.js";
 describe("organizationHasVanitySubdomain", () => {
     test("null / undefined return false", () => {
         expect(organizationHasVanitySubdomain(null)).toBe(false);
@@ -39,4 +39,37 @@ describe("organizationHasVanitySubdomain", () => {
         }
     });
 });
+describe("enterprise platform gates (audit logs, SSO, procurement, API access)", () => {
+    const enterpriseActive = {
+        subscriptionTier: "Enterprise",
+        subscriptionStatus: "Active",
+    };
+    const growthActive = { subscriptionTier: "Growth", subscriptionStatus: "Active" };
+    test("organizationHasEnterprisePlatformAccess mirrors organizationHasVanitySubdomain", () => {
+        expect(organizationHasEnterprisePlatformAccess(enterpriseActive)).toBe(true);
+        expect(organizationHasEnterprisePlatformAccess(growthActive)).toBe(false);
+        expect(organizationHasEnterprisePlatformAccess(null)).toBe(false);
+        expect(organizationHasEnterprisePlatformAccess(undefined)).toBe(false);
+    });
+    test("organizationHasAuditLogAccess follows the shared enterprise gate", () => {
+        expect(organizationHasAuditLogAccess(enterpriseActive)).toBe(true);
+        expect(organizationHasAuditLogAccess(growthActive)).toBe(false);
+    });
+    test("organizationHasSsoAccess follows the shared enterprise gate", () => {
+        expect(organizationHasSsoAccess(enterpriseActive)).toBe(true);
+        expect(organizationHasSsoAccess(growthActive)).toBe(false);
+    });
+    test("organizationHasProcurementAccess follows the shared enterprise gate", () => {
+        expect(organizationHasProcurementAccess(enterpriseActive)).toBe(true);
+        expect(organizationHasProcurementAccess(growthActive)).toBe(false);
+    });
+    test("organizationHasApiAccess follows the shared enterprise gate", () => {
+        expect(organizationHasApiAccess(enterpriseActive)).toBe(true);
+        expect(organizationHasApiAccess(growthActive)).toBe(false);
+    });
+    test("organizationHasComplianceAccess follows the shared enterprise gate", () => {
+        expect(organizationHasComplianceAccess(enterpriseActive)).toBe(true);
+        expect(organizationHasComplianceAccess(growthActive)).toBe(false);
+    });
+});
 //# sourceMappingURL=organizationEntitlements.test.js.map

package/dist/utils/__tests__/organizationEntitlements.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationEntitlements.test.js","sourceRoot":"","sources":["../../../src/utils/__tests__/organizationEntitlements.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,CACJ,8BAA8B,CAAC;gBAC7B,gBAAgB,EAAE,IAAI;gBACtB,kBAAkB,EAAE,QAAQ;aAC7B,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;QACjE,MAAM,CACJ,8BAA8B,CAAC;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,kBAAkB,EAAE,QAAQ;SAC7B,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,8BAA8B,CAAC;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,kBAAkB,EAAE,UAAU;SAC/B,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACnF,MAAM,CACJ,8BAA8B,CAAC,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CACnE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,8BAA8B,CAAC;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,KAAK,MAAM,MAAM,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1D,MAAM,CACJ,8BAA8B,CAAC;gBAC7B,gBAAgB,EAAE,YAAY;gBAC9B,kBAAkB,EAAE,MAAM;aAC3B,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"organizationEntitlements.test.js","sourceRoot":"","sources":["../../../src/utils/__tests__/organizationEntitlements.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,uCAAuC,EACvC,gCAAgC,EAChC,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AAExC,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,CACJ,8BAA8B,CAAC;gBAC7B,gBAAgB,EAAE,IAAI;gBACtB,kBAAkB,EAAE,QAAQ;aAC7B,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;QACjE,MAAM,CACJ,8BAA8B,CAAC;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,kBAAkB,EAAE,QAAQ;SAC7B,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,8BAA8B,CAAC;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,kBAAkB,EAAE,UAAU;SAC/B,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACnF,MAAM,CACJ,8BAA8B,CAAC,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CACnE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,8BAA8B,CAAC;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,KAAK,MAAM,MAAM,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1D,MAAM,CACJ,8BAA8B,CAAC;gBAC7B,gBAAgB,EAAE,YAAY;gBAC9B,kBAAkB,EAAE,MAAM;aAC3B,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sEAAsE,EAAE,GAAG,EAAE;IACpF,MAAM,gBAAgB,GAAG;QACvB,gBAAgB,EAAE,YAAY;QAC9B,kBAAkB,EAAE,QAAQ;KAC7B,CAAC;IACF,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;IAElF,IAAI,CAAC,gFAAgF,EAAE,GAAG,EAAE;QAC1F,MAAM,CAAC,uCAAuC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,uCAAuC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,CAAC,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,uCAAuC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,gCAAgC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,CAAC,gCAAgC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,+BAA+B,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/utils/organizationEntitlements.d.ts

@@ -17,4 +17,23 @@ export interface OrganizationEntitlementInput {
  * (or trialing) subscription so a lapsed Enterprise org falls back to the path.
  */
 export declare function organizationHasVanitySubdomain(org: OrganizationEntitlementInput | null | undefined): boolean;
+/**
+ * Shared gate for the enterprise platform surface: org-scoped audit logs,
+ * SSO/identity setup, procurement approval policy, API keys, webhooks, and
+ * third-party integrations (Mailchimp/Salesforce). All are Enterprise-tier
+ * perks today — same predicate as {@link organizationHasVanitySubdomain}, kept
+ * as a distinct name so the two can diverge later (e.g. Growth gets audit
+ * logs before SSO) without touching every call site.
+ */
+export declare function organizationHasEnterprisePlatformAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
+/** Org-admin audit log viewer + CSV export. */
+export declare function organizationHasAuditLogAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
+/** SSO/identity setup. */
+export declare function organizationHasSsoAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
+/** Procurement approval workflows (PO-gated billing/spend). */
+export declare function organizationHasProcurementAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
+/** API keys, outbound webhooks, and third-party integrations. */
+export declare function organizationHasApiAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
+/** Compliance docs (W-9 tax collection, certificate-of-insurance tracking). */
+export declare function organizationHasComplianceAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
 //# sourceMappingURL=organizationEntitlements.d.ts.map

package/dist/utils/organizationEntitlements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizationEntitlements.d.ts","sourceRoot":"","sources":["../../src/utils/organizationEntitlements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,iCAGnC,CAAC;AAEX,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAUT"}
+{"version":3,"file":"organizationEntitlements.d.ts","sourceRoot":"","sources":["../../src/utils/organizationEntitlements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,iCAGnC,CAAC;AAEX,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAUT;AAED;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CACrD,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,+CAA+C;AAC/C,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,0BAA0B;AAC1B,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,+DAA+D;AAC/D,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,+EAA+E;AAC/E,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET"}

package/dist/utils/organizationEntitlements.js

@@ -27,3 +27,35 @@ export function organizationHasVanitySubdomain(org) {
         return true;
     return ACTIVE_ORG_SUBSCRIPTION_STATUSES.includes(org.subscriptionStatus);
 }
+/**
+ * Shared gate for the enterprise platform surface: org-scoped audit logs,
+ * SSO/identity setup, procurement approval policy, API keys, webhooks, and
+ * third-party integrations (Mailchimp/Salesforce). All are Enterprise-tier
+ * perks today — same predicate as {@link organizationHasVanitySubdomain}, kept
+ * as a distinct name so the two can diverge later (e.g. Growth gets audit
+ * logs before SSO) without touching every call site.
+ */
+export function organizationHasEnterprisePlatformAccess(org) {
+    return organizationHasVanitySubdomain(org);
+}
+/** Org-admin audit log viewer + CSV export. */
+export function organizationHasAuditLogAccess(org) {
+    return organizationHasEnterprisePlatformAccess(org);
+}
+/** SSO/identity setup. */
+export function organizationHasSsoAccess(org) {
+    return organizationHasEnterprisePlatformAccess(org);
+}
+/** Procurement approval workflows (PO-gated billing/spend). */
+export function organizationHasProcurementAccess(org) {
+    return organizationHasEnterprisePlatformAccess(org);
+}
+/** API keys, outbound webhooks, and third-party integrations. */
+export function organizationHasApiAccess(org) {
+    return organizationHasEnterprisePlatformAccess(org);
+}
+/** Compliance docs (W-9 tax collection, certificate-of-insurance tracking). */
+export function organizationHasComplianceAccess(org) {
+    return organizationHasEnterprisePlatformAccess(org);
+}
+//# sourceMappingURL=organizationEntitlements.js.map

package/dist/utils/organizationEntitlements.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationEntitlements.js","sourceRoot":"","sources":["../../src/utils/organizationEntitlements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,QAAQ;IACR,UAAU;CACF,CAAC;AAOX;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,GAAoD;IAEpD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,GAAG,CAAC,gBAAgB,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACxD,+EAA+E;IAC/E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,OAAQ,gCAAsD,CAAC,QAAQ,CACrE,GAAG,CAAC,kBAAkB,CACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"organizationEntitlements.js","sourceRoot":"","sources":["../../src/utils/organizationEntitlements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,QAAQ;IACR,UAAU;CACF,CAAC;AAOX;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,GAAoD;IAEpD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,GAAG,CAAC,gBAAgB,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACxD,+EAA+E;IAC/E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,OAAQ,gCAAsD,CAAC,QAAQ,CACrE,GAAG,CAAC,kBAAkB,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CACrD,GAAoD;IAEpD,OAAO,8BAA8B,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,6BAA6B,CAC3C,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,wBAAwB,CACtC,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gCAAgC,CAC9C,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CACtC,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,+BAA+B,CAC7C,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bash-app/bash-common",
-  "version": "30.360.0",
+  "version": "30.361.0",
   "description": "Common data and scripts to use on the frontend and backend",
   "type": "module",
   "main": "dist/index.js",

package/prisma/schema.prisma

@@ -4457,6 +4457,20 @@ model User {
   submittedBudgets               Budget[]             @relation("BudgetSubmitter")
   ownedBudgets                   Budget[]             @relation("UserBudgets")
   departmentsHeaded              Department[]         @relation("DepartmentHead")
+  /// Enterprise platform (Phase 0-4): internal team members assigned as a named
+  /// account manager, and org members who submit/approve procurement requests
+  /// or create API keys.
+  accountManagerForOrganizations Organization[]        @relation("OrganizationAccountManager")
+  procurementRequestsSubmitted   ProcurementRequest[]  @relation("ProcurementRequestSubmitter")
+  procurementRequestsApproved    ProcurementRequest[]  @relation("ProcurementRequestApprover")
+  organizationApiKeysCreated     OrganizationApiKey[]  @relation("OrganizationApiKeyCreator")
+  /// SSO (Phase 2) + compliance (Phase 5): who configured a connection, and
+  /// who submitted/reviewed a W-9 or certificate of insurance.
+  organizationSsoConnectionsConfigured OrganizationSsoConnection[]         @relation("OrganizationSsoConfiguredBy")
+  organizationTaxDocumentsSubmitted    OrganizationTaxDocument[]          @relation("OrgTaxDocumentSubmittedBy")
+  organizationTaxDocumentsReviewed     OrganizationTaxDocument[]          @relation("OrgTaxDocumentReviewedBy")
+  organizationInsuranceCertsSubmitted  OrganizationInsuranceCertificate[] @relation("OrgInsuranceCertSubmittedBy")
+  organizationInsuranceCertsReviewed   OrganizationInsuranceCertificate[] @relation("OrgInsuranceCertReviewedBy")
   favoriteOrganizations          Organization[]       @relation("FavoriteOrganizations")
   organizationEmailSubscriptions OrganizationSubscriber[]
   eventSeriesCreated             EventSeries[]        @relation("EventSeriesCreator")
@@ -5909,10 +5923,55 @@ model Organization {
   agencyBookingSettlements AgencyBookingSettlement[]
   representedBookings      ServiceBooking[]
 
+  /// Enterprise billing + support (ops-provisioned after a signed pilot/annual
+  /// deal — not self-serve). See docs/ENTERPRISE-B2B-SALES-PLAYBOOK.md.
+  billingPoNumber           String? // Purchase order number for invoiced billing
+  billingContactEmail       String? // AP / finance contact, distinct from pocEmail
+  invoiceNetDays            Int? // e.g. 30 for Net 30 terms; null = card/Stripe billing only
+  enterpriseContractStartAt DateTime?
+  enterpriseContractEndAt   DateTime?
+  accountManagerUserId      String?
+  accountManager            User?     @relation("OrganizationAccountManager", fields: [accountManagerUserId], references: [id], onDelete: SetNull)
+  /// "Standard" | "Priority" | "Dedicated" — drives named-AM banner + support routing copy.
+  supportTier               String    @default("Standard")
+
+  /// SSO / identity (Organization Enterprise only). `ssoEnforced` blocks password
+  /// login for members whose email matches `ssoDomain` once `ssoConnection.status`
+  /// is Active. Denormalized here (rather than requiring a join) so the
+  /// pre-login domain check on every sign-in attempt stays a single indexed
+  /// lookup; `ssoConnection` holds the protocol-specific IdP configuration.
+  ssoProvider     String? // "saml" | "oidc" — mirrors ssoConnection.protocol; drives login routing
+  ssoDomain       String? // Verified email domain that triggers SSO redirect
+  ssoEnforced     Boolean   @default(false)
+  ssoConfiguredAt DateTime?
+  ssoConnection   OrganizationSsoConnection?
+
+  /// Procurement approval policy (nullable JSON). Null = no gate, billing/spend
+  /// proceeds without a PO. Shape when set:
+  /// { requirePoForSubscription: boolean, approverUserIds: string[], minAmountCentsForApproval: number }
+  procurementApprovalPolicy Json?
+  procurementRequests       ProcurementRequest[]
+
+  /// Enterprise integrations + developer platform (API keys, outbound webhooks,
+  /// third-party connectors like Mailchimp/Salesforce).
+  integrations OrganizationIntegration[]
+  apiKeys      OrganizationApiKey[]
+  webhooks     OrganizationWebhook[]
+
+  /// Compliance (deal-driven, Phase 5): W-9 collection for institutional
+  /// finance + certificate-of-insurance tracking. Ops reviews both manually.
+  taxDocuments          OrganizationTaxDocument[]
+  insuranceCertificates OrganizationInsuranceCertificate[]
+
+  /// Org-scoped slice of the platform audit trail (member approvals, budget
+  /// approvals, settings changes, SSO logins, API key/webhook/integration events).
+  auditLogs AuditLog[] @relation("OrganizationAuditLogs")
+
   @@index([ownerId])
   @@index([slug])
   @@index([parentOrganizationId])
   @@index([nonprofitVerifiedAt])
+  @@index([accountManagerUserId])
 }
 
 /// Email-first followers of a public organizer (org landing). Authenticated users who
@@ -10840,6 +10899,12 @@ model AuditLog {
   userId String?
   user   User?   @relation("UserAuditLogs", fields: [userId], references: [id], onDelete: SetNull)
 
+  /// Set when the action happened in the context of an Organization (member
+  /// approvals, budget approvals, settings changes, SSO logins, API keys,
+  /// webhooks, integrations, procurement). Null for platform-wide/user actions.
+  organizationId String?
+  organization   Organization? @relation("OrganizationAuditLogs", fields: [organizationId], references: [id], onDelete: SetNull)
+
   // Action details
   action   AuditAction // LOGIN_SUCCESS, LOGIN_FAILED, PAYMENT_PROCESSED, etc.
   category AuditCategory // Authentication, Payment, Admin, DataAccess, etc.
@@ -10864,6 +10929,7 @@ model AuditLog {
   @@index([category, severity, createdAt])
   @@index([resourceType, resourceId])
   @@index([ipAddress])
+  @@index([organizationId, createdAt])
 }
 
 /// Token Revocation System
@@ -10959,6 +11025,30 @@ enum AuditAction {
   RATE_LIMIT_EXCEEDED
   IP_BLOCKED
   TOKEN_REVOKED
+
+  // Organization (enterprise platform — member/budget approvals, settings,
+  // SSO, procurement, API keys, webhooks, integrations)
+  ORG_MEMBER_APPROVED
+  ORG_MEMBER_REJECTED
+  ORG_BUDGET_APPROVED
+  ORG_SETTINGS_CHANGED
+  ORG_BILLING_UPDATED
+  ORG_SSO_CONFIGURED
+  ORG_SSO_LOGIN
+  ORG_PROCUREMENT_SUBMITTED
+  ORG_PROCUREMENT_APPROVED
+  ORG_PROCUREMENT_REJECTED
+  ORG_API_KEY_CREATED
+  ORG_API_KEY_REVOKED
+  ORG_WEBHOOK_CREATED
+  ORG_WEBHOOK_DELETED
+  ORG_INTEGRATION_CONNECTED
+  ORG_INTEGRATION_DISCONNECTED
+  ORG_AUDIT_LOG_EXPORTED
+  ORG_TAX_DOCUMENT_SUBMITTED
+  ORG_TAX_DOCUMENT_REVIEWED
+  ORG_INSURANCE_CERTIFICATE_SUBMITTED
+  ORG_INSURANCE_CERTIFICATE_REVIEWED
 }
 
 enum AuditCategory {
@@ -10973,6 +11063,7 @@ enum AuditCategory {
   DataAccess
   Compliance
   Security
+  Organization
 }
 
 enum AuditSeverity {
@@ -10981,6 +11072,260 @@ enum AuditSeverity {
   Critical // Security incidents
 }
 
+/// ─── Enterprise platform: procurement, API keys, webhooks, integrations ────
+/// Shared by universities/nonprofits/venues/brands buying Organization
+/// Enterprise. See docs/ENTERPRISE-B2B-SALES-PLAYBOOK.md for sales framing.
+
+model ProcurementRequest {
+  id             String @id @default(cuid())
+  organizationId String
+
+  /// "OrgSubscription" | "EventSpend" | "VendorContract" | "Other"
+  type String
+
+  amountCents Int
+  poNumber    String?
+  description String?
+
+  /// "Draft" | "Submitted" | "Approved" | "Rejected" | "Cancelled"
+  status String @default("Draft")
+
+  submittedById String?
+  /// Snapshot of who is entitled to approve at submit time (org's
+  /// `procurementApprovalPolicy.approverUserIds`, or Owner/Admin if unset).
+  approverIds   String[] @default([])
+  approvedById  String?
+  approvedAt    DateTime?
+  rejectedById  String?
+  rejectedAt    DateTime?
+  rejectionReason String?
+
+  /// Free-form context: linked subscription tier, budget id, vendor name, etc.
+  metadata Json?
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  submittedBy  User?        @relation("ProcurementRequestSubmitter", fields: [submittedById], references: [id], onDelete: SetNull)
+  approvedBy   User?        @relation("ProcurementRequestApprover", fields: [approvedById], references: [id], onDelete: SetNull)
+
+  @@index([organizationId, status])
+  @@index([submittedById])
+}
+
+model OrganizationApiKey {
+  id             String @id @default(cuid())
+  organizationId String
+  name           String // Host-chosen label, e.g. "Zapier sync"
+
+  /// SHA-256 hash of the secret; the plaintext key is shown once at creation
+  /// and never persisted. Prefix is safe to display for identification.
+  keyHash   String @unique
+  keyPrefix String // e.g. "bsh_live_ab12" — shown in the UI list
+
+  scopes      String[] @default([]) // e.g. ["read:members", "read:events"]
+  createdById String?
+  lastUsedAt  DateTime?
+  revokedAt   DateTime?
+  expiresAt   DateTime?
+
+  createdAt DateTime @default(now())
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  createdBy    User?        @relation("OrganizationApiKeyCreator", fields: [createdById], references: [id], onDelete: SetNull)
+
+  @@index([organizationId])
+}
+
+model OrganizationWebhook {
+  id             String @id @default(cuid())
+  organizationId String
+
+  url          String
+  /// Event types this subscription receives, e.g. "ticket.checked_in",
+  /// "member.approved", "procurement.approved".
+  eventTypes   String[] @default([])
+  /// HMAC-SHA256 signing secret (shown once at creation) — verify the
+  /// `X-Bash-Signature` header before trusting the payload.
+  signingSecret String
+
+  isActive      Boolean   @default(true)
+  lastDeliveryAt      DateTime?
+  lastDeliveryStatus  String? // "success" | "failed"
+  failureCount        Int       @default(0)
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId])
+}
+
+model OrganizationIntegration {
+  id             String @id @default(cuid())
+  organizationId String
+
+  /// "Mailchimp" | "Salesforce" — extend as connectors ship.
+  provider String
+
+  /// "Connected" | "Error" | "Disconnected"
+  status String @default("Connected")
+
+  /// Provider credentials, AES-256-CBC encrypted at rest (see
+  /// api/src/utils/organization/organizationIntegrationCrypto.ts). Never
+  /// return this field to the client.
+  encryptedCredentials String?
+
+  /// Non-secret provider config, e.g. { audienceId: "abc123" } for Mailchimp.
+  settings Json?
+
+  lastSyncAt      DateTime?
+  lastSyncStatus  String? // "success" | "failed"
+  lastSyncError   String?
+  connectedById   String?
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@unique([organizationId, provider])
+  @@index([organizationId])
+}
+
+enum SsoProtocol {
+  Saml
+  Oidc
+}
+
+enum SsoConnectionStatus {
+  Draft    // Admin has started filling in IdP details; not yet validated.
+  Testing  // "Test connection" is in flight or failed; ssoEnforced cannot be true.
+  Active   // Test succeeded; org can enforce SSO for its verified domain.
+  Disabled // Was Active; admin turned it off without deleting the config.
+}
+
+/// Generic SAML 2.0 (as Service Provider) or OIDC (as Relying Party) connection
+/// for one Organization. No third-party IdP broker (e.g. WorkOS) — Bash acts as
+/// its own SP/RP against whatever IdP the customer supplies (Okta, Entra ID,
+/// Google Workspace, generic OIDC). One connection per org for v1.
+model OrganizationSsoConnection {
+  id             String      @id @default(cuid())
+  organizationId String      @unique
+  protocol       SsoProtocol
+  status         SsoConnectionStatus @default(Draft)
+
+  /// SAML 2.0 — values copied from the customer's IdP app configuration.
+  samlIdpEntityId    String?
+  samlIdpSsoUrl      String? // IdP's Single Sign-On (AuthnRequest destination) URL
+  samlIdpCertificate String? // IdP's public signing cert (PEM), used to verify the SAMLResponse signature
+
+  /// OIDC — values copied from the customer's IdP app configuration. The
+  /// authorization/token/jwks endpoints are filled in by discovery against
+  /// `oidcIssuer` when the connection is tested, not entered by the admin.
+  oidcIssuer                String?
+  oidcClientId              String?
+  /// AES-256-CBC encrypted (see organizationIntegrationCrypto.ts). Never
+  /// returned to the client.
+  oidcClientSecretEncrypted String?
+  oidcAuthorizationEndpoint String?
+  oidcTokenEndpoint         String?
+  oidcJwksUri               String?
+
+  lastTestedAt  DateTime?
+  lastTestStatus String? // "Success" | "Failed"
+  lastTestError  String?
+
+  configuredByUserId String?
+  configuredBy        User?    @relation("OrganizationSsoConfiguredBy", fields: [configuredByUserId], references: [id], onDelete: SetNull)
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId])
+}
+
+enum OrgComplianceDocStatus {
+  Pending
+  Approved
+  Rejected
+}
+
+enum OrgTaxDocumentType {
+  W9
+  W8BEN
+}
+
+/// Institutional tax documentation (deal-driven, Phase 5). Ops reviews the
+/// uploaded PDF manually — same "admin approves after out-of-band review"
+/// shape as nonprofit verification, just with a real self-serve upload
+/// (presigned S3, see AwsS3Utils.createUrlFromAssetKey) instead of an
+/// ops-entered doc id.
+model OrganizationTaxDocument {
+  id             String             @id @default(cuid())
+  organizationId String
+  type           OrgTaxDocumentType @default(W9)
+
+  legalBusinessName String
+  taxClassification String? // e.g. "C Corporation", "LLC", "Nonprofit" — free text, mirrors the W-9 form
+  taxIdLast4        String? // Last 4 of EIN/SSN only; never store the full TIN
+  docUrl            String // Uploaded W-9 PDF
+
+  status          OrgComplianceDocStatus @default(Pending)
+  rejectionReason String?
+
+  submittedByUserId String?
+  reviewedByUserId  String?
+  reviewedAt        DateTime?
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  submittedBy  User?        @relation("OrgTaxDocumentSubmittedBy", fields: [submittedByUserId], references: [id], onDelete: SetNull)
+  reviewedBy   User?        @relation("OrgTaxDocumentReviewedBy", fields: [reviewedByUserId], references: [id], onDelete: SetNull)
+
+  @@index([organizationId])
+  @@index([status])
+}
+
+/// Certificate of insurance tracking at the Organization level (deal-driven,
+/// Phase 5) — e.g. a university requiring proof of general liability coverage
+/// before an annual agreement. Distinct from the per-`Vendor` insurance flags
+/// on `VendorInsurance`, which cover marketplace vendors, not the org itself.
+model OrganizationInsuranceCertificate {
+  id             String @id @default(cuid())
+  organizationId String
+
+  insurerName         String
+  policyNumber        String?
+  coverageAmountCents Int?
+  docUrl              String // Uploaded certificate-of-insurance PDF
+  expiresAt           DateTime
+
+  status          OrgComplianceDocStatus @default(Pending)
+  rejectionReason String?
+
+  submittedByUserId String?
+  reviewedByUserId  String?
+  reviewedAt        DateTime?
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  submittedBy  User?        @relation("OrgInsuranceCertSubmittedBy", fields: [submittedByUserId], references: [id], onDelete: SetNull)
+  reviewedBy   User?        @relation("OrgInsuranceCertReviewedBy", fields: [reviewedByUserId], references: [id], onDelete: SetNull)
+
+  @@index([organizationId])
+  @@index([status])
+  @@index([expiresAt])
+}
+
 // Service Analytics Tracking
 model ServiceAnalytics {
   id           String                @id @default(cuid())

package/src/utils/__tests__/organizationEntitlements.test.ts

@@ -1,6 +1,14 @@
 import { describe, expect, test } from "@jest/globals";
 
-import { organizationHasVanitySubdomain } from "../organizationEntitlements.js";
+import {
+  organizationHasApiAccess,
+  organizationHasAuditLogAccess,
+  organizationHasComplianceAccess,
+  organizationHasEnterprisePlatformAccess,
+  organizationHasProcurementAccess,
+  organizationHasSsoAccess,
+  organizationHasVanitySubdomain,
+} from "../organizationEntitlements.js";
 
 describe("organizationHasVanitySubdomain", () => {
   test("null / undefined return false", () => {
@@ -57,3 +65,43 @@ describe("organizationHasVanitySubdomain", () => {
     }
   });
 });
+
+describe("enterprise platform gates (audit logs, SSO, procurement, API access)", () => {
+  const enterpriseActive = {
+    subscriptionTier: "Enterprise",
+    subscriptionStatus: "Active",
+  };
+  const growthActive = { subscriptionTier: "Growth", subscriptionStatus: "Active" };
+
+  test("organizationHasEnterprisePlatformAccess mirrors organizationHasVanitySubdomain", () => {
+    expect(organizationHasEnterprisePlatformAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasEnterprisePlatformAccess(growthActive)).toBe(false);
+    expect(organizationHasEnterprisePlatformAccess(null)).toBe(false);
+    expect(organizationHasEnterprisePlatformAccess(undefined)).toBe(false);
+  });
+
+  test("organizationHasAuditLogAccess follows the shared enterprise gate", () => {
+    expect(organizationHasAuditLogAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasAuditLogAccess(growthActive)).toBe(false);
+  });
+
+  test("organizationHasSsoAccess follows the shared enterprise gate", () => {
+    expect(organizationHasSsoAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasSsoAccess(growthActive)).toBe(false);
+  });
+
+  test("organizationHasProcurementAccess follows the shared enterprise gate", () => {
+    expect(organizationHasProcurementAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasProcurementAccess(growthActive)).toBe(false);
+  });
+
+  test("organizationHasApiAccess follows the shared enterprise gate", () => {
+    expect(organizationHasApiAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasApiAccess(growthActive)).toBe(false);
+  });
+
+  test("organizationHasComplianceAccess follows the shared enterprise gate", () => {
+    expect(organizationHasComplianceAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasComplianceAccess(growthActive)).toBe(false);
+  });
+});

package/src/utils/organizationEntitlements.ts

@@ -35,3 +35,52 @@ export function organizationHasVanitySubdomain(
     org.subscriptionStatus
   );
 }
+
+/**
+ * Shared gate for the enterprise platform surface: org-scoped audit logs,
+ * SSO/identity setup, procurement approval policy, API keys, webhooks, and
+ * third-party integrations (Mailchimp/Salesforce). All are Enterprise-tier
+ * perks today — same predicate as {@link organizationHasVanitySubdomain}, kept
+ * as a distinct name so the two can diverge later (e.g. Growth gets audit
+ * logs before SSO) without touching every call site.
+ */
+export function organizationHasEnterprisePlatformAccess(
+  org: OrganizationEntitlementInput | null | undefined
+): boolean {
+  return organizationHasVanitySubdomain(org);
+}
+
+/** Org-admin audit log viewer + CSV export. */
+export function organizationHasAuditLogAccess(
+  org: OrganizationEntitlementInput | null | undefined
+): boolean {
+  return organizationHasEnterprisePlatformAccess(org);
+}
+
+/** SSO/identity setup. */
+export function organizationHasSsoAccess(
+  org: OrganizationEntitlementInput | null | undefined
+): boolean {
+  return organizationHasEnterprisePlatformAccess(org);
+}
+
+/** Procurement approval workflows (PO-gated billing/spend). */
+export function organizationHasProcurementAccess(
+  org: OrganizationEntitlementInput | null | undefined
+): boolean {
+  return organizationHasEnterprisePlatformAccess(org);
+}
+
+/** API keys, outbound webhooks, and third-party integrations. */
+export function organizationHasApiAccess(
+  org: OrganizationEntitlementInput | null | undefined
+): boolean {
+  return organizationHasEnterprisePlatformAccess(org);
+}
+
+/** Compliance docs (W-9 tax collection, certificate-of-insurance tracking). */
+export function organizationHasComplianceAccess(
+  org: OrganizationEntitlementInput | null | undefined
+): boolean {
+  return organizationHasEnterprisePlatformAccess(org);
+}