@bash-app/bash-common 30.367.0 → 30.370.0

package/dist/utils/organizationEntitlements.d.ts

@@ -10,20 +10,29 @@ export declare const ACTIVE_ORG_SUBSCRIPTION_STATUSES: readonly ["Active", "Tria
 export interface OrganizationEntitlementInput {
     subscriptionTier?: string | null;
     subscriptionStatus?: string | null;
+    /**
+     * True only when ops provisioned Enterprise via a signed deal (admin
+     * enterprise-provisioning endpoint). Self-serve Stripe checkout can also set
+     * subscriptionTier="Enterprise" but never sets this. Optional/undefined is
+     * treated as false so legacy call sites that don't select this field fail
+     * closed on the sales-gated surface rather than open.
+     */
+    enterpriseSalesProvisioned?: boolean | null;
 }
 /**
- * Vanity subdomains ({slug}.bash.community) are an Enterprise-only perk. All other
- * orgs use the canonical path URL (bash.community/org/{slug}). Requires an active
- * (or trialing) subscription so a lapsed Enterprise org falls back to the path.
+ * Vanity subdomains ({slug}.bash.community) and custom domains (white-label)
+ * are self-serve-eligible Enterprise perks — available whether Enterprise was
+ * bought via self-serve Stripe checkout or a sales-negotiated deal.
  */
 export declare function organizationHasVanitySubdomain(org: OrganizationEntitlementInput | null | undefined): boolean;
 /**
  * Shared gate for the enterprise platform surface: org-scoped audit logs,
  * SSO/identity setup, procurement approval policy, API keys, webhooks, and
- * third-party integrations (Mailchimp/Salesforce). All are Enterprise-tier
- * perks today — same predicate as {@link organizationHasVanitySubdomain}, kept
- * as a distinct name so the two can diverge later (e.g. Growth gets audit
- * logs before SSO) without touching every call site.
+ * third-party integrations (Mailchimp/Salesforce). Unlike the white-label
+ * perks above, this surface requires a sales-negotiated deal
+ * (`enterpriseSalesProvisioned`) — self-serve $495/mo checkout alone does not
+ * unlock SSO, compliance, procurement, or API access, since those typically
+ * involve a security review or contract terms sales owns.
  */
 export declare function organizationHasEnterprisePlatformAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
 /** Org-admin audit log viewer + CSV export. */
@@ -36,4 +45,15 @@ export declare function organizationHasProcurementAccess(org: OrganizationEntitl
 export declare function organizationHasApiAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
 /** Compliance docs (W-9 tax collection, certificate-of-insurance tracking). */
 export declare function organizationHasComplianceAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
+/**
+ * Custom domains (white-label tier): real DNS (e.g. members.acme.com) provisioned
+ * via AWS CloudFront SaaS Manager Distribution Tenants, plus the "Powered by Bash"
+ * removal toggle. Same Enterprise + active/trialing gate as
+ * {@link organizationHasVanitySubdomain} for MVP — reuse the existing tier rather
+ * than invent a new pricing tier now. A dedicated "White-label" tier is a
+ * fast-follow if sales needs separate pricing. Self-serve-eligible: does NOT
+ * require {@link organizationHasEnterprisePlatformAccess}'s
+ * `enterpriseSalesProvisioned` flag.
+ */
+export declare function organizationHasCustomDomainAccess(org: OrganizationEntitlementInput | null | undefined): boolean;
 //# sourceMappingURL=organizationEntitlements.d.ts.map

package/dist/utils/organizationEntitlements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizationEntitlements.d.ts","sourceRoot":"","sources":["../../src/utils/organizationEntitlements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,iCAGnC,CAAC;AAEX,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAUT;AAED;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CACrD,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,+CAA+C;AAC/C,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,0BAA0B;AAC1B,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,+DAA+D;AAC/D,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,+EAA+E;AAC/E,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET"}
+{"version":3,"file":"organizationEntitlements.d.ts","sourceRoot":"","sources":["../../src/utils/organizationEntitlements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,iCAGnC,CAAC;AAEX,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC7C;AAgBD;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,+CAA+C;AAC/C,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,0BAA0B;AAC1B,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,+DAA+D;AAC/D,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED,+EAA+E;AAC/E,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,4BAA4B,GAAG,IAAI,GAAG,SAAS,GACnD,OAAO,CAET"}

package/dist/utils/organizationEntitlements.js

@@ -10,12 +10,7 @@ export const ACTIVE_ORG_SUBSCRIPTION_STATUSES = [
     "Active",
     "Trialing",
 ];
-/**
- * Vanity subdomains ({slug}.bash.community) are an Enterprise-only perk. All other
- * orgs use the canonical path URL (bash.community/org/{slug}). Requires an active
- * (or trialing) subscription so a lapsed Enterprise org falls back to the path.
- */
-export function organizationHasVanitySubdomain(org) {
+function hasActiveEnterpriseTier(org) {
     if (!org)
         return false;
     if (org.subscriptionTier !== "Enterprise")
@@ -27,16 +22,25 @@ export function organizationHasVanitySubdomain(org) {
         return true;
     return ACTIVE_ORG_SUBSCRIPTION_STATUSES.includes(org.subscriptionStatus);
 }
+/**
+ * Vanity subdomains ({slug}.bash.community) and custom domains (white-label)
+ * are self-serve-eligible Enterprise perks — available whether Enterprise was
+ * bought via self-serve Stripe checkout or a sales-negotiated deal.
+ */
+export function organizationHasVanitySubdomain(org) {
+    return hasActiveEnterpriseTier(org);
+}
 /**
  * Shared gate for the enterprise platform surface: org-scoped audit logs,
  * SSO/identity setup, procurement approval policy, API keys, webhooks, and
- * third-party integrations (Mailchimp/Salesforce). All are Enterprise-tier
- * perks today — same predicate as {@link organizationHasVanitySubdomain}, kept
- * as a distinct name so the two can diverge later (e.g. Growth gets audit
- * logs before SSO) without touching every call site.
+ * third-party integrations (Mailchimp/Salesforce). Unlike the white-label
+ * perks above, this surface requires a sales-negotiated deal
+ * (`enterpriseSalesProvisioned`) — self-serve $495/mo checkout alone does not
+ * unlock SSO, compliance, procurement, or API access, since those typically
+ * involve a security review or contract terms sales owns.
  */
 export function organizationHasEnterprisePlatformAccess(org) {
-    return organizationHasVanitySubdomain(org);
+    return hasActiveEnterpriseTier(org) && org?.enterpriseSalesProvisioned === true;
 }
 /** Org-admin audit log viewer + CSV export. */
 export function organizationHasAuditLogAccess(org) {
@@ -58,4 +62,17 @@ export function organizationHasApiAccess(org) {
 export function organizationHasComplianceAccess(org) {
     return organizationHasEnterprisePlatformAccess(org);
 }
+/**
+ * Custom domains (white-label tier): real DNS (e.g. members.acme.com) provisioned
+ * via AWS CloudFront SaaS Manager Distribution Tenants, plus the "Powered by Bash"
+ * removal toggle. Same Enterprise + active/trialing gate as
+ * {@link organizationHasVanitySubdomain} for MVP — reuse the existing tier rather
+ * than invent a new pricing tier now. A dedicated "White-label" tier is a
+ * fast-follow if sales needs separate pricing. Self-serve-eligible: does NOT
+ * require {@link organizationHasEnterprisePlatformAccess}'s
+ * `enterpriseSalesProvisioned` flag.
+ */
+export function organizationHasCustomDomainAccess(org) {
+    return organizationHasVanitySubdomain(org);
+}
 //# sourceMappingURL=organizationEntitlements.js.map

package/dist/utils/organizationEntitlements.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationEntitlements.js","sourceRoot":"","sources":["../../src/utils/organizationEntitlements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,QAAQ;IACR,UAAU;CACF,CAAC;AAOX;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,GAAoD;IAEpD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,GAAG,CAAC,gBAAgB,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACxD,+EAA+E;IAC/E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,OAAQ,gCAAsD,CAAC,QAAQ,CACrE,GAAG,CAAC,kBAAkB,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CACrD,GAAoD;IAEpD,OAAO,8BAA8B,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,6BAA6B,CAC3C,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,wBAAwB,CACtC,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gCAAgC,CAC9C,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CACtC,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,+BAA+B,CAC7C,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"organizationEntitlements.js","sourceRoot":"","sources":["../../src/utils/organizationEntitlements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,QAAQ;IACR,UAAU;CACF,CAAC;AAeX,SAAS,uBAAuB,CAC9B,GAAoD;IAEpD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,GAAG,CAAC,gBAAgB,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACxD,+EAA+E;IAC/E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,OAAQ,gCAAsD,CAAC,QAAQ,CACrE,GAAG,CAAC,kBAAkB,CACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,GAAoD;IAEpD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uCAAuC,CACrD,GAAoD;IAEpD,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,0BAA0B,KAAK,IAAI,CAAC;AAClF,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,6BAA6B,CAC3C,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,wBAAwB,CACtC,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gCAAgC,CAC9C,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CACtC,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,+BAA+B,CAC7C,GAAoD;IAEpD,OAAO,uCAAuC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,GAAoD;IAEpD,OAAO,8BAA8B,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bash-app/bash-common",
-  "version": "30.367.0",
+  "version": "30.370.0",
   "description": "Common data and scripts to use on the frontend and backend",
   "type": "module",
   "main": "dist/index.js",

package/prisma/schema.prisma

@@ -929,6 +929,9 @@ model BashEvent {
   attendeeListPublic          Boolean                @default(false)
   /// Preview = count + curated faces; Public = full list for everyone; TicketHolders = full list for ticket buyers only.
   attendeeListAccess          String                 @default("Preview")
+  /// When true, only accounts with a published service profile (Vendor/Venue/Entertainment/Exhibitor/Sponsor/Event
+  /// Service) can view budget lines revealed via `Budget.showOnBashDetailPage`. Default off = anyone can click to view.
+  budgetRestrictedToServiceProviders Boolean          @default(false)
   /// When true on Rsvp-mode events, affirmative RSVPs land in a host approval queue first.
   rsvpRequiresApproval        Boolean                @default(false)
   /// Hide when guests RSVP'd on host-facing attendee views.
@@ -1036,6 +1039,12 @@ model BashEvent {
   allowMemberGuests        Boolean  @default(false) // Members can bring +1s
   maxGuestsPerMember       Int? // Guest limit per member (null = unlimited)
   restrictToOrgDepartments String[] @default([]) // Empty = all departments can see/join
+  /// Discovery opt-out for portal-created events. DB default `true` preserves current
+  /// behavior for every existing/consumer-created event. The Organization Workspace's
+  /// event wizard sets this to `false` at creation (app-level default, not this DB
+  /// default) so private-portal events don't leak into public Bash discovery unless
+  /// the host flips "Publish to Bash" on. See publicDiscoveryPredicate.ts.
+  publishToBashDiscovery Boolean @default(true)
 
   /// When true, new event expenses default to Pending until host/org approves (see Expense.status).
   requireExpenseApproval Boolean @default(false)
@@ -3377,6 +3386,14 @@ model Ticket {
   lastReminded24hAt         DateTime?
   lastReminded1weekAt       DateTime?
   lastReminded3hAt          DateTime?
+  /// Per-activity ActivityKit update/end push token, reported by the client once its
+  /// Live Activity actually starts (distinct from the user-level push-to-start token
+  /// in LiveActivityPushToken, which can only start new activities, not update/end them).
+  liveActivityPushToken      String?
+  /// Set once the liveActivityLifecycle cron has sent the start push for this ticket; avoids duplicate sends.
+  liveActivityStartPushedAt  DateTime?
+  /// Set once the liveActivityLifecycle cron has sent the end push for this ticket; avoids duplicate sends.
+  liveActivityEndPushedAt    DateTime?
   refundRequestedAt          DateTime? // Set when RefundPending; cleared once refund processes
   /// Set when the guest keeps or declines after a postponement; cleared on each new Postpone.
   postponeRespondedAt        DateTime?
@@ -3761,6 +3778,8 @@ model Media {
   sponsoredEventsReferencingMe           SponsoredEvent[]         @relation("MediaToSponsoredEvent")
   organizationsNonprofitDeterminationDoc Organization[]           @relation("OrganizationNonprofitDeterminationDoc")
   memoryCaptures                         BashMemoryCapture[]
+  courseLessonsReferencingMe              CourseLesson[]
+  organizationResourcesReferencingMe      OrganizationResource[]
 }
 
 model Prize {
@@ -4385,6 +4404,7 @@ model User {
   feedbackTeamApplications      FeedbackTeamApplication[]
   newsletterSubscriptions       NewsletterSubscriber[]
   pushNotificationTokens        PushNotificationToken[]
+  liveActivityPushTokens        LiveActivityPushToken[]
   redeemedVouchers              Voucher[]
   bashEventPromoCodesIUsed      BashEventPromoCode[]    @relation("BashEventPromoCodeToUser")
   ticketTiersWaitListsIveJoined TicketTier[]            @relation("TicketTierToUser")
@@ -4484,6 +4504,16 @@ model User {
   organizationEmailSubscriptions OrganizationSubscriber[]
   eventSeriesCreated             EventSeries[]        @relation("EventSeriesCreator")
 
+  /// Organization Workspace: courses, quizzes/certificates, and community.
+  coursesInstructed        Course[]                        @relation("CourseInstructor")
+  courseEnrollments        CourseEnrollment[]
+  courseQuizAttempts       CourseQuizAttempt[]
+  courseCertificates       CourseCertificate[]
+  communityPostsAuthored   OrganizationCommunityPost[]      @relation("OrganizationCommunityPostAuthor")
+  communityCommentsAuthored OrganizationCommunityComment[]  @relation("OrganizationCommunityCommentAuthor")
+  communityPostLikes       OrganizationCommunityPostLike[]
+  communityPostReports     OrganizationCommunityPostReport[]
+
   // Service Includes & Add-On Requests
   suggestedIncludes ServiceInclude[]      @relation("SuggestedIncludes")
   includeVotes      ServiceIncludeVote[]
@@ -5572,6 +5602,14 @@ model Exhibitor {
   paymentTerms       String? // Payment terms and conditions
   setupRequirements  String? // Setup and breakdown requirements
 
+  /// Phase 1 host bid/RFP matching opt-in — shared shape with VendorPreferences and Sponsor
+  /// (see docs/product/VENDOR_HIRE_BID_SIGNUP_SPEC.md).
+  openToHostBids Boolean  @default(false)
+  bidCategories  String[] @default([])
+  bidMinLeadDays Int?
+  /// small | medium | large — typical event size the exhibitor is comfortable with.
+  bidProjectSize String?
+
   crowdSize    AmountOfGuests? @relation(fields: [crowdSizeId], references: [id], onDelete: Cascade)
   serviceRange ServiceRange?   @relation(fields: [serviceRangeId], references: [id])
   service      Service?
@@ -5600,6 +5638,14 @@ model Sponsor {
   contractTerms      String? // Contract terms and conditions
   paymentTerms       String? // Payment terms and requirements
 
+  /// Phase 1 host bid/RFP matching opt-in — shared shape with VendorPreferences and Exhibitor
+  /// (see docs/product/VENDOR_HIRE_BID_SIGNUP_SPEC.md).
+  openToHostBids Boolean  @default(false)
+  bidCategories  String[] @default([])
+  bidMinLeadDays Int?
+  /// small | medium | large — typical event size the sponsor is comfortable with.
+  bidProjectSize String?
+
   service      Service?
   crowdSize    AmountOfGuests? @relation(fields: [crowdSizeId], references: [id])
   serviceRange ServiceRange?   @relation(fields: [serviceRangeId], references: [id])
@@ -5874,6 +5920,31 @@ model Organization {
   stripeConnectedAccountId    String? // Org-level Stripe account for wallet display
   accentColor                 String? // Hex color for org page branding (e.g. "#6366f1")
   inheritBrandingFromParent   Boolean              @default(true)
+
+  /// White-label branding + Organization Workspace modules. All additive with safe
+  /// defaults — existing orgs are unaffected until a module is explicitly enabled.
+  faviconUrl          String?
+  secondaryBrandColor String?
+  fontPreset          String?  @default("default")
+  coursesEnabled      Boolean  @default(false)
+  communityEnabled    Boolean  @default(false)
+  resourcesEnabled    Boolean  @default(false)
+  removeBashBranding  Boolean  @default(false)
+  /// Marks the single first-party "Bash Academy" org that hosts Bash's own courses/
+  /// certificates (e.g. the event-planning certification program). Drives a
+  /// "Certified by Bash" trust badge; no other special-casing anywhere else in the stack.
+  isBashOfficial      Boolean  @default(false)
+
+  /// Custom domain (white-label tier), provisioned via AWS CloudFront SaaS Manager
+  /// Distribution Tenants + CloudFront-managed ACM certs. See organizationDomainApi.ts.
+  customDomain              String?            @unique
+  customDomainStatus        CustomDomainStatus @default(Unverified)
+  customDomainCname         String?
+  cloudfrontTenantId        String?
+  cloudfrontTenantArn       String?
+  customDomainVerifiedAt    DateTime?
+  customDomainLastCheckedAt DateTime?
+
   latitude                    Float?
   longitude                   Float?
   createdAt                   DateTime             @default(now())
@@ -5895,6 +5966,11 @@ model Organization {
   awayTeamGames               Game[]               @relation("AwayTeamGames")
   products                    OrgProduct[]
 
+  /// Organization Workspace modules (additive, gated by the *Enabled flags above).
+  courses       Course[]
+  communityPosts OrganizationCommunityPost[]
+  resources     OrganizationResource[]
+
   /// Verified-nonprofit fields. Verification is a Bash-side admin action driven by
   /// the host's uploaded determination letter (nonprofitDeterminationDocId). These
   /// are the ONLY signals fee-math is allowed to read — `BashEvent.nonProfit` is
@@ -5949,6 +6025,15 @@ model Organization {
   accountManager            User?     @relation("OrganizationAccountManager", fields: [accountManagerUserId], references: [id], onDelete: SetNull)
   /// "Standard" | "Priority" | "Dedicated" — drives named-AM banner + support routing copy.
   supportTier               String    @default("Standard")
+  /// True only when ops set subscriptionTier="Enterprise" via the admin
+  /// enterprise-provisioning endpoint (a signed deal). Self-serve Stripe checkout
+  /// (organizationSubscriptionUtils.ts) can also set subscriptionTier="Enterprise"
+  /// but never sets this flag. organizationHasEnterprisePlatformAccess() and the
+  /// SSO/audit-log/procurement/compliance/API entitlements below require this flag
+  /// in addition to the Enterprise tier — self-serve Enterprise unlocks white-label
+  /// (organizationHasCustomDomainAccess/organizationHasVanitySubdomain do NOT
+  /// require this flag) but not the sales-negotiated platform surface.
+  enterpriseSalesProvisioned Boolean  @default(false)
 
   /// SSO / identity (Organization Enterprise only). `ssoEnforced` blocks password
   /// login for members whose email matches `ssoDomain` once `ssoConnection.status`
@@ -5989,6 +6074,301 @@ model Organization {
   @@index([accountManagerUserId])
 }
 
+/// Custom-domain provisioning status (white-label tier). See Organization.customDomain*
+/// fields and organizationDomainApi.ts (AWS CloudFront SaaS Manager Distribution Tenants).
+enum CustomDomainStatus {
+  Unverified
+  PendingValidation
+  Active
+  Failed
+}
+
+// ─── Organization Workspace: Courses, Quizzes & Certificates ─────────────────────
+// Generic, org-scoped course platform any Organization can enable via
+// `Organization.coursesEnabled`. Bash's own event-planning certification program
+// is not special-cased here — it is authored on a first-party "Bash Academy"
+// Organization (`Organization.isBashOfficial`) through this exact same model.
+
+enum CourseVisibility {
+  Public
+  MembersOnly
+  PremiumOnly
+  Paid
+}
+
+enum CourseStatus {
+  Draft
+  Published
+  Archived
+}
+
+model Course {
+  id               String           @id @default(cuid())
+  organizationId   String
+  title            String
+  slug             String
+  description      String?          @db.Text
+  coverImage       String?
+  instructorUserId String
+  visibility       CourseVisibility @default(MembersOnly)
+  priceCents       Int?
+  status           CourseStatus     @default(Draft)
+  /// Requires a published CourseQuiz with >=1 question before this can be turned on.
+  certificateEnabled Boolean        @default(false)
+  createdAt        DateTime         @default(now())
+  updatedAt        DateTime         @updatedAt
+
+  organization Organization       @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  instructor   User               @relation("CourseInstructor", fields: [instructorUserId], references: [id], onDelete: Restrict)
+  modules      CourseModule[]
+  lessons      CourseLesson[]
+  enrollments  CourseEnrollment[]
+  quiz         CourseQuiz?
+  certificates CourseCertificate[]
+
+  @@unique([organizationId, slug])
+  @@index([organizationId])
+  @@index([instructorUserId])
+}
+
+model CourseModule {
+  id        String @id @default(cuid())
+  courseId  String
+  title     String
+  sortOrder Int    @default(0)
+
+  course  Course         @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  lessons CourseLesson[]
+
+  @@index([courseId])
+}
+
+enum CourseLessonContentType {
+  Video
+  Text
+  Embed
+  File
+}
+
+model CourseLesson {
+  id              String                   @id @default(cuid())
+  courseId        String
+  moduleId        String?
+  title           String
+  contentType     CourseLessonContentType  @default(Text)
+  videoUrl        String?
+  richTextContent String?                  @db.Text
+  mediaId         String?
+  sortOrder       Int                      @default(0)
+  /// Viewable without enrolling — course "trailer" lesson(s).
+  isPreviewable   Boolean                  @default(false)
+
+  course           Course                  @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  module           CourseModule?           @relation(fields: [moduleId], references: [id], onDelete: SetNull)
+  media            Media?                  @relation(fields: [mediaId], references: [id], onDelete: SetNull)
+  progressEntries  CourseLessonProgress[]
+
+  @@index([courseId])
+  @@index([moduleId])
+}
+
+enum CourseEnrollmentSource {
+  Membership
+  Purchase
+  Manual
+}
+
+model CourseEnrollment {
+  id                    String                 @id @default(cuid())
+  courseId              String
+  userId                String
+  source                CourseEnrollmentSource @default(Membership)
+  stripePaymentIntentId String?
+  enrolledAt            DateTime               @default(now())
+
+  course          Course                 @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  user            User                   @relation(fields: [userId], references: [id], onDelete: Cascade)
+  lessonProgress  CourseLessonProgress[]
+  quizAttempts    CourseQuizAttempt[]
+  certificate     CourseCertificate?
+
+  @@unique([courseId, userId])
+  @@index([courseId])
+  @@index([userId])
+}
+
+model CourseLessonProgress {
+  id           String    @id @default(cuid())
+  enrollmentId String
+  lessonId     String
+  completedAt  DateTime?
+
+  enrollment CourseEnrollment @relation(fields: [enrollmentId], references: [id], onDelete: Cascade)
+  lesson     CourseLesson     @relation(fields: [lessonId], references: [id], onDelete: Cascade)
+
+  @@unique([enrollmentId, lessonId])
+  @@index([lessonId])
+}
+
+/// One final quiz gates the certificate (MVP). Per-module quizzes are a natural
+/// fast-follow with the same shape.
+model CourseQuiz {
+  id                   String @id @default(cuid())
+  courseId             String @unique
+  passThresholdPercent Int    @default(80)
+
+  course    Course               @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  questions CourseQuizQuestion[]
+  attempts  CourseQuizAttempt[]
+}
+
+model CourseQuizQuestion {
+  id              String @id @default(cuid())
+  quizId          String
+  prompt          String @db.Text
+  /// [{ id: string, text: string }, ...]
+  choices         Json
+  correctChoiceId String
+  sortOrder       Int    @default(0)
+
+  quiz CourseQuiz @relation(fields: [quizId], references: [id], onDelete: Cascade)
+
+  @@index([quizId])
+}
+
+model CourseQuizAttempt {
+  id           String   @id @default(cuid())
+  quizId       String
+  enrollmentId String
+  userId       String
+  scorePercent Int
+  passed       Boolean
+  /// [{ questionId: string, choiceId: string }, ...]
+  answers      Json
+  attemptedAt  DateTime @default(now())
+
+  quiz       CourseQuiz       @relation(fields: [quizId], references: [id], onDelete: Cascade)
+  enrollment CourseEnrollment @relation(fields: [enrollmentId], references: [id], onDelete: Cascade)
+  user       User             @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([quizId])
+  @@index([enrollmentId])
+}
+
+/// Auto-issued (server-side, never client-trusted) the moment a CourseQuizAttempt
+/// for the user's enrollment passes AND all non-preview lessons are complete.
+/// `certificateNumber` — never the DB id — is the public verification token used by
+/// GET /courses/certificates/verify/:certificateNumber.
+model CourseCertificate {
+  id                String    @id @default(cuid())
+  courseId          String
+  enrollmentId       String   @unique
+  userId            String
+  certificateNumber String    @unique @default(cuid())
+  quizAttemptId     String?
+  issuedAt          DateTime  @default(now())
+  revokedAt         DateTime?
+
+  course     Course           @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  enrollment CourseEnrollment @relation(fields: [enrollmentId], references: [id], onDelete: Cascade)
+  user       User             @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([courseId, userId])
+  @@index([certificateNumber])
+  @@index([userId])
+}
+
+// ─── Organization Workspace: Resources ────────────────────────────────────────────
+
+enum ResourceVisibility {
+  Public
+  MembersOnly
+}
+
+model OrganizationResource {
+  id             String             @id @default(cuid())
+  organizationId String
+  title          String
+  description    String?            @db.Text
+  url            String?
+  mediaId        String?
+  category       String?
+  visibility     ResourceVisibility @default(MembersOnly)
+  sortOrder      Int                @default(0)
+  createdAt      DateTime           @default(now())
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  media        Media?       @relation(fields: [mediaId], references: [id], onDelete: SetNull)
+
+  @@index([organizationId])
+}
+
+// ─── Organization Workspace: Community ────────────────────────────────────────────
+// Mirrors the EventDiscussionComment shape, scoped to an Organization instead of a
+// single BashEvent. Gated by `Organization.communityEnabled` + active membership or
+// `Organization.visibility === "Public"`.
+
+model OrganizationCommunityPost {
+  id             String    @id @default(cuid())
+  organizationId String
+  authorUserId   String
+  content        String    @db.Text
+  pinnedAt       DateTime?
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+
+  organization Organization                  @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  author       User                          @relation("OrganizationCommunityPostAuthor", fields: [authorUserId], references: [id], onDelete: Cascade)
+  comments     OrganizationCommunityComment[]
+  likes        OrganizationCommunityPostLike[]
+  reports      OrganizationCommunityPostReport[]
+
+  @@index([organizationId])
+  @@index([authorUserId])
+}
+
+model OrganizationCommunityComment {
+  id           String   @id @default(cuid())
+  postId       String
+  authorUserId String
+  content      String   @db.Text
+  createdAt    DateTime @default(now())
+
+  post   OrganizationCommunityPost @relation(fields: [postId], references: [id], onDelete: Cascade)
+  author User                      @relation("OrganizationCommunityCommentAuthor", fields: [authorUserId], references: [id], onDelete: Cascade)
+
+  @@index([postId])
+}
+
+model OrganizationCommunityPostLike {
+  id     String @id @default(cuid())
+  postId String
+  userId String
+
+  post OrganizationCommunityPost @relation(fields: [postId], references: [id], onDelete: Cascade)
+  user User                      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([postId, userId])
+  @@index([postId])
+}
+
+/// Moderation report on a top-level community post (mirrors EventDiscussionCommentReport).
+/// Scoped to posts, not comments, for MVP — the atomic unit worth a host's review.
+model OrganizationCommunityPostReport {
+  id          String               @id @default(cuid())
+  postId      String
+  userId      String
+  reason      BashFeedReportReason
+  description String?              @db.Text
+  createdAt   DateTime             @default(now())
+
+  post OrganizationCommunityPost @relation(fields: [postId], references: [id], onDelete: Cascade)
+  user User                      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([postId, userId])
+  @@index([postId])
+}
+
 /// Email-first followers of a public organizer (org landing). Authenticated users who
 /// Follow also get a row here when we know their email. Distinct from org membership.
 model OrganizationSubscriber {
@@ -6510,6 +6890,8 @@ model Budget {
   totalBudgetCents    Int? // Alias for backward compatibility
   spentCents          Int  @default(0)
   remainingCents      Int? // Can be computed: totalAllocatedCents - spentCents
+  /// Host opt-in: reveal this line's category + amount to providers on the public bash detail page.
+  showOnBashDetailPage Boolean @default(false)
 
   // Categorization
   category   String? // "Marketing", "Catering", "Venue", "Annual", "Activities"
@@ -7557,6 +7939,22 @@ model PushNotificationToken {
   @@map("push_notification_tokens")
 }
 
+// iOS ActivityKit "push-to-start" token — distinct from PushNotificationToken (FCM).
+// One per device; used to auto-start a Live Activity for an upcoming bash via raw APNs.
+// Android has no equivalent: it reuses the existing FCM token in PushNotificationToken.
+model LiveActivityPushToken {
+  id        String   @id @default(cuid())
+  userId    String
+  token     String   @unique
+  platform  String   @default("ios")
+  isActive  Boolean  @default(true)
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, platform])
+}
+
 model AmbashadorApplication {
   id             String                      @id @default(cuid())
   userId         String?

package/src/extendedSchemas.ts

@@ -544,6 +544,8 @@ type BashEventExtBase = Override<
   datePollPublicSummary?: IdeaDatePollPublicSummary;
   /** GET /event/:id — tickets sold (non-cancelled), for social proof */
   goingCount?: number;
+  /** GET /event/:id — true when at least one Budget line has `showOnBashDetailPage` set. Drives the "View budget" reveal on the public bash page; never carries dollar amounts. */
+  hasVisibleBudget?: boolean;
   /** GET /event/:id when status=Idea — total IdeaInterest rows */
   ideaInterestCount?: number;
   /** Feed/card alias for idea interest (some list payloads use this name). */

package/src/index.ts

@@ -49,6 +49,7 @@ export * from "./utils/featuredDiscoveryGeo.js";
 export * from "./utils/organizationEntitlements.js";
 export * from "./serviceTypeLabels.js";
 export * from "./targetAudienceLabels.js";
+export * from "./liveActivity/liveActivityTypes.js";
 
 // Re-export ALL Prisma enums as values (usable as runtime constants, e.g. ServiceTypes.Entertainment)
 // Excludes enums already re-exported by definitions.ts, mirroredPrismaEnums.ts, and membershipDefinitions.ts: