@bash-app/bash-common 30.368.0 → 30.371.0

package/prisma/schema.prisma

@@ -1039,6 +1039,12 @@ model BashEvent {
   allowMemberGuests        Boolean  @default(false) // Members can bring +1s
   maxGuestsPerMember       Int? // Guest limit per member (null = unlimited)
   restrictToOrgDepartments String[] @default([]) // Empty = all departments can see/join
+  /// Discovery opt-out for portal-created events. DB default `true` preserves current
+  /// behavior for every existing/consumer-created event. The Organization Workspace's
+  /// event wizard sets this to `false` at creation (app-level default, not this DB
+  /// default) so private-portal events don't leak into public Bash discovery unless
+  /// the host flips "Publish to Bash" on. See publicDiscoveryPredicate.ts.
+  publishToBashDiscovery Boolean @default(true)
 
   /// When true, new event expenses default to Pending until host/org approves (see Expense.status).
   requireExpenseApproval Boolean @default(false)
@@ -3380,6 +3386,14 @@ model Ticket {
   lastReminded24hAt         DateTime?
   lastReminded1weekAt       DateTime?
   lastReminded3hAt          DateTime?
+  /// Per-activity ActivityKit update/end push token, reported by the client once its
+  /// Live Activity actually starts (distinct from the user-level push-to-start token
+  /// in LiveActivityPushToken, which can only start new activities, not update/end them).
+  liveActivityPushToken      String?
+  /// Set once the liveActivityLifecycle cron has sent the start push for this ticket; avoids duplicate sends.
+  liveActivityStartPushedAt  DateTime?
+  /// Set once the liveActivityLifecycle cron has sent the end push for this ticket; avoids duplicate sends.
+  liveActivityEndPushedAt    DateTime?
   refundRequestedAt          DateTime? // Set when RefundPending; cleared once refund processes
   /// Set when the guest keeps or declines after a postponement; cleared on each new Postpone.
   postponeRespondedAt        DateTime?
@@ -3764,6 +3778,8 @@ model Media {
   sponsoredEventsReferencingMe           SponsoredEvent[]         @relation("MediaToSponsoredEvent")
   organizationsNonprofitDeterminationDoc Organization[]           @relation("OrganizationNonprofitDeterminationDoc")
   memoryCaptures                         BashMemoryCapture[]
+  courseLessonsReferencingMe              CourseLesson[]
+  organizationResourcesReferencingMe      OrganizationResource[]
 }
 
 model Prize {
@@ -4388,6 +4404,7 @@ model User {
   feedbackTeamApplications      FeedbackTeamApplication[]
   newsletterSubscriptions       NewsletterSubscriber[]
   pushNotificationTokens        PushNotificationToken[]
+  liveActivityPushTokens        LiveActivityPushToken[]
   redeemedVouchers              Voucher[]
   bashEventPromoCodesIUsed      BashEventPromoCode[]    @relation("BashEventPromoCodeToUser")
   ticketTiersWaitListsIveJoined TicketTier[]            @relation("TicketTierToUser")
@@ -4487,6 +4504,16 @@ model User {
   organizationEmailSubscriptions OrganizationSubscriber[]
   eventSeriesCreated             EventSeries[]        @relation("EventSeriesCreator")
 
+  /// Organization Workspace: courses, quizzes/certificates, and community.
+  coursesInstructed        Course[]                        @relation("CourseInstructor")
+  courseEnrollments        CourseEnrollment[]
+  courseQuizAttempts       CourseQuizAttempt[]
+  courseCertificates       CourseCertificate[]
+  communityPostsAuthored   OrganizationCommunityPost[]      @relation("OrganizationCommunityPostAuthor")
+  communityCommentsAuthored OrganizationCommunityComment[]  @relation("OrganizationCommunityCommentAuthor")
+  communityPostLikes       OrganizationCommunityPostLike[]
+  communityPostReports     OrganizationCommunityPostReport[]
+
   // Service Includes & Add-On Requests
   suggestedIncludes ServiceInclude[]      @relation("SuggestedIncludes")
   includeVotes      ServiceIncludeVote[]
@@ -5893,6 +5920,31 @@ model Organization {
   stripeConnectedAccountId    String? // Org-level Stripe account for wallet display
   accentColor                 String? // Hex color for org page branding (e.g. "#6366f1")
   inheritBrandingFromParent   Boolean              @default(true)
+
+  /// White-label branding + Organization Workspace modules. All additive with safe
+  /// defaults — existing orgs are unaffected until a module is explicitly enabled.
+  faviconUrl          String?
+  secondaryBrandColor String?
+  fontPreset          String?  @default("default")
+  coursesEnabled      Boolean  @default(false)
+  communityEnabled    Boolean  @default(false)
+  resourcesEnabled    Boolean  @default(false)
+  removeBashBranding  Boolean  @default(false)
+  /// Marks the single first-party "Bash Academy" org that hosts Bash's own courses/
+  /// certificates (e.g. the event-planning certification program). Drives a
+  /// "Certified by Bash" trust badge; no other special-casing anywhere else in the stack.
+  isBashOfficial      Boolean  @default(false)
+
+  /// Custom domain (white-label tier), provisioned via AWS CloudFront SaaS Manager
+  /// Distribution Tenants + CloudFront-managed ACM certs. See organizationDomainApi.ts.
+  customDomain              String?            @unique
+  customDomainStatus        CustomDomainStatus @default(Unverified)
+  customDomainCname         String?
+  cloudfrontTenantId        String?
+  cloudfrontTenantArn       String?
+  customDomainVerifiedAt    DateTime?
+  customDomainLastCheckedAt DateTime?
+
   latitude                    Float?
   longitude                   Float?
   createdAt                   DateTime             @default(now())
@@ -5914,6 +5966,11 @@ model Organization {
   awayTeamGames               Game[]               @relation("AwayTeamGames")
   products                    OrgProduct[]
 
+  /// Organization Workspace modules (additive, gated by the *Enabled flags above).
+  courses       Course[]
+  communityPosts OrganizationCommunityPost[]
+  resources     OrganizationResource[]
+
   /// Verified-nonprofit fields. Verification is a Bash-side admin action driven by
   /// the host's uploaded determination letter (nonprofitDeterminationDocId). These
   /// are the ONLY signals fee-math is allowed to read — `BashEvent.nonProfit` is
@@ -5968,6 +6025,15 @@ model Organization {
   accountManager            User?     @relation("OrganizationAccountManager", fields: [accountManagerUserId], references: [id], onDelete: SetNull)
   /// "Standard" | "Priority" | "Dedicated" — drives named-AM banner + support routing copy.
   supportTier               String    @default("Standard")
+  /// True only when ops set subscriptionTier="Enterprise" via the admin
+  /// enterprise-provisioning endpoint (a signed deal). Self-serve Stripe checkout
+  /// (organizationSubscriptionUtils.ts) can also set subscriptionTier="Enterprise"
+  /// but never sets this flag. organizationHasEnterprisePlatformAccess() and the
+  /// SSO/audit-log/procurement/compliance/API entitlements below require this flag
+  /// in addition to the Enterprise tier — self-serve Enterprise unlocks white-label
+  /// (organizationHasCustomDomainAccess/organizationHasVanitySubdomain do NOT
+  /// require this flag) but not the sales-negotiated platform surface.
+  enterpriseSalesProvisioned Boolean  @default(false)
 
   /// SSO / identity (Organization Enterprise only). `ssoEnforced` blocks password
   /// login for members whose email matches `ssoDomain` once `ssoConnection.status`
@@ -6008,6 +6074,301 @@ model Organization {
   @@index([accountManagerUserId])
 }
 
+/// Custom-domain provisioning status (white-label tier). See Organization.customDomain*
+/// fields and organizationDomainApi.ts (AWS CloudFront SaaS Manager Distribution Tenants).
+enum CustomDomainStatus {
+  Unverified
+  PendingValidation
+  Active
+  Failed
+}
+
+// ─── Organization Workspace: Courses, Quizzes & Certificates ─────────────────────
+// Generic, org-scoped course platform any Organization can enable via
+// `Organization.coursesEnabled`. Bash's own event-planning certification program
+// is not special-cased here — it is authored on a first-party "Bash Academy"
+// Organization (`Organization.isBashOfficial`) through this exact same model.
+
+enum CourseVisibility {
+  Public
+  MembersOnly
+  PremiumOnly
+  Paid
+}
+
+enum CourseStatus {
+  Draft
+  Published
+  Archived
+}
+
+model Course {
+  id               String           @id @default(cuid())
+  organizationId   String
+  title            String
+  slug             String
+  description      String?          @db.Text
+  coverImage       String?
+  instructorUserId String
+  visibility       CourseVisibility @default(MembersOnly)
+  priceCents       Int?
+  status           CourseStatus     @default(Draft)
+  /// Requires a published CourseQuiz with >=1 question before this can be turned on.
+  certificateEnabled Boolean        @default(false)
+  createdAt        DateTime         @default(now())
+  updatedAt        DateTime         @updatedAt
+
+  organization Organization       @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  instructor   User               @relation("CourseInstructor", fields: [instructorUserId], references: [id], onDelete: Restrict)
+  modules      CourseModule[]
+  lessons      CourseLesson[]
+  enrollments  CourseEnrollment[]
+  quiz         CourseQuiz?
+  certificates CourseCertificate[]
+
+  @@unique([organizationId, slug])
+  @@index([organizationId])
+  @@index([instructorUserId])
+}
+
+model CourseModule {
+  id        String @id @default(cuid())
+  courseId  String
+  title     String
+  sortOrder Int    @default(0)
+
+  course  Course         @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  lessons CourseLesson[]
+
+  @@index([courseId])
+}
+
+enum CourseLessonContentType {
+  Video
+  Text
+  Embed
+  File
+}
+
+model CourseLesson {
+  id              String                   @id @default(cuid())
+  courseId        String
+  moduleId        String?
+  title           String
+  contentType     CourseLessonContentType  @default(Text)
+  videoUrl        String?
+  richTextContent String?                  @db.Text
+  mediaId         String?
+  sortOrder       Int                      @default(0)
+  /// Viewable without enrolling — course "trailer" lesson(s).
+  isPreviewable   Boolean                  @default(false)
+
+  course           Course                  @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  module           CourseModule?           @relation(fields: [moduleId], references: [id], onDelete: SetNull)
+  media            Media?                  @relation(fields: [mediaId], references: [id], onDelete: SetNull)
+  progressEntries  CourseLessonProgress[]
+
+  @@index([courseId])
+  @@index([moduleId])
+}
+
+enum CourseEnrollmentSource {
+  Membership
+  Purchase
+  Manual
+}
+
+model CourseEnrollment {
+  id                    String                 @id @default(cuid())
+  courseId              String
+  userId                String
+  source                CourseEnrollmentSource @default(Membership)
+  stripePaymentIntentId String?
+  enrolledAt            DateTime               @default(now())
+
+  course          Course                 @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  user            User                   @relation(fields: [userId], references: [id], onDelete: Cascade)
+  lessonProgress  CourseLessonProgress[]
+  quizAttempts    CourseQuizAttempt[]
+  certificate     CourseCertificate?
+
+  @@unique([courseId, userId])
+  @@index([courseId])
+  @@index([userId])
+}
+
+model CourseLessonProgress {
+  id           String    @id @default(cuid())
+  enrollmentId String
+  lessonId     String
+  completedAt  DateTime?
+
+  enrollment CourseEnrollment @relation(fields: [enrollmentId], references: [id], onDelete: Cascade)
+  lesson     CourseLesson     @relation(fields: [lessonId], references: [id], onDelete: Cascade)
+
+  @@unique([enrollmentId, lessonId])
+  @@index([lessonId])
+}
+
+/// One final quiz gates the certificate (MVP). Per-module quizzes are a natural
+/// fast-follow with the same shape.
+model CourseQuiz {
+  id                   String @id @default(cuid())
+  courseId             String @unique
+  passThresholdPercent Int    @default(80)
+
+  course    Course               @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  questions CourseQuizQuestion[]
+  attempts  CourseQuizAttempt[]
+}
+
+model CourseQuizQuestion {
+  id              String @id @default(cuid())
+  quizId          String
+  prompt          String @db.Text
+  /// [{ id: string, text: string }, ...]
+  choices         Json
+  correctChoiceId String
+  sortOrder       Int    @default(0)
+
+  quiz CourseQuiz @relation(fields: [quizId], references: [id], onDelete: Cascade)
+
+  @@index([quizId])
+}
+
+model CourseQuizAttempt {
+  id           String   @id @default(cuid())
+  quizId       String
+  enrollmentId String
+  userId       String
+  scorePercent Int
+  passed       Boolean
+  /// [{ questionId: string, choiceId: string }, ...]
+  answers      Json
+  attemptedAt  DateTime @default(now())
+
+  quiz       CourseQuiz       @relation(fields: [quizId], references: [id], onDelete: Cascade)
+  enrollment CourseEnrollment @relation(fields: [enrollmentId], references: [id], onDelete: Cascade)
+  user       User             @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([quizId])
+  @@index([enrollmentId])
+}
+
+/// Auto-issued (server-side, never client-trusted) the moment a CourseQuizAttempt
+/// for the user's enrollment passes AND all non-preview lessons are complete.
+/// `certificateNumber` — never the DB id — is the public verification token used by
+/// GET /courses/certificates/verify/:certificateNumber.
+model CourseCertificate {
+  id                String    @id @default(cuid())
+  courseId          String
+  enrollmentId       String   @unique
+  userId            String
+  certificateNumber String    @unique @default(cuid())
+  quizAttemptId     String?
+  issuedAt          DateTime  @default(now())
+  revokedAt         DateTime?
+
+  course     Course           @relation(fields: [courseId], references: [id], onDelete: Cascade)
+  enrollment CourseEnrollment @relation(fields: [enrollmentId], references: [id], onDelete: Cascade)
+  user       User             @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([courseId, userId])
+  @@index([certificateNumber])
+  @@index([userId])
+}
+
+// ─── Organization Workspace: Resources ────────────────────────────────────────────
+
+enum ResourceVisibility {
+  Public
+  MembersOnly
+}
+
+model OrganizationResource {
+  id             String             @id @default(cuid())
+  organizationId String
+  title          String
+  description    String?            @db.Text
+  url            String?
+  mediaId        String?
+  category       String?
+  visibility     ResourceVisibility @default(MembersOnly)
+  sortOrder      Int                @default(0)
+  createdAt      DateTime           @default(now())
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  media        Media?       @relation(fields: [mediaId], references: [id], onDelete: SetNull)
+
+  @@index([organizationId])
+}
+
+// ─── Organization Workspace: Community ────────────────────────────────────────────
+// Mirrors the EventDiscussionComment shape, scoped to an Organization instead of a
+// single BashEvent. Gated by `Organization.communityEnabled` + active membership or
+// `Organization.visibility === "Public"`.
+
+model OrganizationCommunityPost {
+  id             String    @id @default(cuid())
+  organizationId String
+  authorUserId   String
+  content        String    @db.Text
+  pinnedAt       DateTime?
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+
+  organization Organization                  @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  author       User                          @relation("OrganizationCommunityPostAuthor", fields: [authorUserId], references: [id], onDelete: Cascade)
+  comments     OrganizationCommunityComment[]
+  likes        OrganizationCommunityPostLike[]
+  reports      OrganizationCommunityPostReport[]
+
+  @@index([organizationId])
+  @@index([authorUserId])
+}
+
+model OrganizationCommunityComment {
+  id           String   @id @default(cuid())
+  postId       String
+  authorUserId String
+  content      String   @db.Text
+  createdAt    DateTime @default(now())
+
+  post   OrganizationCommunityPost @relation(fields: [postId], references: [id], onDelete: Cascade)
+  author User                      @relation("OrganizationCommunityCommentAuthor", fields: [authorUserId], references: [id], onDelete: Cascade)
+
+  @@index([postId])
+}
+
+model OrganizationCommunityPostLike {
+  id     String @id @default(cuid())
+  postId String
+  userId String
+
+  post OrganizationCommunityPost @relation(fields: [postId], references: [id], onDelete: Cascade)
+  user User                      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([postId, userId])
+  @@index([postId])
+}
+
+/// Moderation report on a top-level community post (mirrors EventDiscussionCommentReport).
+/// Scoped to posts, not comments, for MVP — the atomic unit worth a host's review.
+model OrganizationCommunityPostReport {
+  id          String               @id @default(cuid())
+  postId      String
+  userId      String
+  reason      BashFeedReportReason
+  description String?              @db.Text
+  createdAt   DateTime             @default(now())
+
+  post OrganizationCommunityPost @relation(fields: [postId], references: [id], onDelete: Cascade)
+  user User                      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([postId, userId])
+  @@index([postId])
+}
+
 /// Email-first followers of a public organizer (org landing). Authenticated users who
 /// Follow also get a row here when we know their email. Distinct from org membership.
 model OrganizationSubscriber {
@@ -7578,6 +7939,22 @@ model PushNotificationToken {
   @@map("push_notification_tokens")
 }
 
+// iOS ActivityKit "push-to-start" token — distinct from PushNotificationToken (FCM).
+// One per device; used to auto-start a Live Activity for an upcoming bash via raw APNs.
+// Android has no equivalent: it reuses the existing FCM token in PushNotificationToken.
+model LiveActivityPushToken {
+  id        String   @id @default(cuid())
+  userId    String
+  token     String   @unique
+  platform  String   @default("ios")
+  isActive  Boolean  @default(true)
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, platform])
+}
+
 model AmbashadorApplication {
   id             String                      @id @default(cuid())
   userId         String?

package/src/index.ts

@@ -49,6 +49,7 @@ export * from "./utils/featuredDiscoveryGeo.js";
 export * from "./utils/organizationEntitlements.js";
 export * from "./serviceTypeLabels.js";
 export * from "./targetAudienceLabels.js";
+export * from "./liveActivity/liveActivityTypes.js";
 
 // Re-export ALL Prisma enums as values (usable as runtime constants, e.g. ServiceTypes.Entertainment)
 // Excludes enums already re-exported by definitions.ts, mirroredPrismaEnums.ts, and membershipDefinitions.ts:

package/src/liveActivity/liveActivityTypes.ts

@@ -0,0 +1,75 @@
+/**
+ * Shared shapes for the bash-ticket Live Activity (iOS ActivityKit Lock Screen /
+ * Dynamic Island) and Android Live Update / sticky-notification fallback.
+ *
+ * `api` builds `LiveActivityContentState` server-side to push via APNs
+ * (push-to-start/update/end) or an FCM data message; `bash-app` uses the same
+ * shape to type the native plugin's `start`/`update` calls for the manual
+ * "Track this bash" toggle. Keeping this in bash-common avoids the two repos
+ * drifting on field names for what is ultimately one wire contract.
+ */
+
+/** Static, per-activity identifiers — set once, never change during the activity. */
+export interface LiveActivityAttributes {
+  bashEventId: string;
+  ticketId: string;
+}
+
+/**
+ * Dynamic content shown on the Lock Screen / Dynamic Island / Android chip.
+ * Kept intentionally small — ActivityKit caps combined attributes + state at 4KB,
+ * and every field here is re-sent in full on every update (no partial merges).
+ */
+export interface LiveActivityContentState {
+  /** Bash event title — primary headline. */
+  eventTitle: string;
+  /** Short venue/location line — subtitle (e.g. venue name or first line of address). */
+  venueLabel: string;
+  /** ISO 8601 — bash start time. Widget shows a countdown until this, then a "LIVE" badge. */
+  startTime: string;
+  /** ISO 8601 — bash end time. Used for the lazy client-side end fallback. */
+  endTime: string;
+  /**
+   * Absolute URL that opens the device's native Maps app for directions
+   * (Apple Maps on iOS, Google Maps on Android) — never a relative path,
+   * since the widget/notification has no app routing context.
+   */
+  directionsUrl: string;
+  /**
+   * Absolute universal-link URL back into bash-app's ticket QR screen
+   * (`bashEventQrCodeUrl` + the app's public origin). Deliberately NOT an
+   * embedded QR image/token — keeps the payload small and the QR always fresh.
+   */
+  ticketUrl: string;
+}
+
+/** Discriminates the three lifecycle pushes sent over APNs (iOS) or as an FCM data message (Android). */
+export type LiveActivityPushEventType =
+  | "live_activity_start"
+  | "live_activity_update"
+  | "live_activity_end";
+
+/** Platform values accepted on `LiveActivityPushToken.platform` — iOS only today (Android reuses the FCM token). */
+export const LIVE_ACTIVITY_TOKEN_PLATFORM_IOS = "ios" as const;
+
+/** Which native Maps app `buildLiveActivityDirectionsUrl` should target. */
+export type LiveActivityMapsPlatform = "ios" | "android";
+
+/**
+ * Builds the "Directions" deep link shared by the api (server-built push
+ * payloads) and bash-app (client-built manual-start payload) — Apple Maps on
+ * iOS, Google Maps everywhere else, preferring coordinates over the raw
+ * address/title string when available.
+ */
+export function buildLiveActivityDirectionsUrl(
+  destinationCoords: { lat: number; lng: number } | null | undefined,
+  fallbackLabel: string,
+  platform: LiveActivityMapsPlatform
+): string {
+  const destination = destinationCoords
+    ? `${destinationCoords.lat},${destinationCoords.lng}`
+    : encodeURIComponent(fallbackLabel);
+  return platform === "ios"
+    ? `https://maps.apple.com/?daddr=${destination}`
+    : `https://www.google.com/maps/search/?api=1&query=${destination}`;
+}

package/src/utils/__tests__/organizationEntitlements.test.ts

@@ -4,6 +4,7 @@ import {
   organizationHasApiAccess,
   organizationHasAuditLogAccess,
   organizationHasComplianceAccess,
+  organizationHasCustomDomainAccess,
   organizationHasEnterprisePlatformAccess,
   organizationHasProcurementAccess,
   organizationHasSsoAccess,
@@ -67,41 +68,79 @@ describe("organizationHasVanitySubdomain", () => {
 });
 
 describe("enterprise platform gates (audit logs, SSO, procurement, API access)", () => {
-  const enterpriseActive = {
+  // Sales-provisioned: ops set enterpriseSalesProvisioned via the admin
+  // enterprise-provisioning endpoint after a signed deal.
+  const salesProvisionedEnterprise = {
     subscriptionTier: "Enterprise",
     subscriptionStatus: "Active",
+    enterpriseSalesProvisioned: true,
+  };
+  // Self-serve: bought via Stripe checkout, never grants the platform surface.
+  const selfServeEnterprise = {
+    subscriptionTier: "Enterprise",
+    subscriptionStatus: "Active",
+    enterpriseSalesProvisioned: false,
   };
   const growthActive = { subscriptionTier: "Growth", subscriptionStatus: "Active" };
 
-  test("organizationHasEnterprisePlatformAccess mirrors organizationHasVanitySubdomain", () => {
-    expect(organizationHasEnterprisePlatformAccess(enterpriseActive)).toBe(true);
+  test("organizationHasEnterprisePlatformAccess requires enterpriseSalesProvisioned", () => {
+    expect(organizationHasEnterprisePlatformAccess(salesProvisionedEnterprise)).toBe(true);
+    expect(organizationHasEnterprisePlatformAccess(selfServeEnterprise)).toBe(false);
     expect(organizationHasEnterprisePlatformAccess(growthActive)).toBe(false);
     expect(organizationHasEnterprisePlatformAccess(null)).toBe(false);
     expect(organizationHasEnterprisePlatformAccess(undefined)).toBe(false);
   });
 
+  test("missing enterpriseSalesProvisioned on an Enterprise org fails closed (not entitled)", () => {
+    expect(
+      organizationHasEnterprisePlatformAccess({
+        subscriptionTier: "Enterprise",
+        subscriptionStatus: "Active",
+      })
+    ).toBe(false);
+  });
+
   test("organizationHasAuditLogAccess follows the shared enterprise gate", () => {
-    expect(organizationHasAuditLogAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasAuditLogAccess(salesProvisionedEnterprise)).toBe(true);
+    expect(organizationHasAuditLogAccess(selfServeEnterprise)).toBe(false);
     expect(organizationHasAuditLogAccess(growthActive)).toBe(false);
   });
 
   test("organizationHasSsoAccess follows the shared enterprise gate", () => {
-    expect(organizationHasSsoAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasSsoAccess(salesProvisionedEnterprise)).toBe(true);
+    expect(organizationHasSsoAccess(selfServeEnterprise)).toBe(false);
     expect(organizationHasSsoAccess(growthActive)).toBe(false);
   });
 
   test("organizationHasProcurementAccess follows the shared enterprise gate", () => {
-    expect(organizationHasProcurementAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasProcurementAccess(salesProvisionedEnterprise)).toBe(true);
+    expect(organizationHasProcurementAccess(selfServeEnterprise)).toBe(false);
     expect(organizationHasProcurementAccess(growthActive)).toBe(false);
   });
 
   test("organizationHasApiAccess follows the shared enterprise gate", () => {
-    expect(organizationHasApiAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasApiAccess(salesProvisionedEnterprise)).toBe(true);
+    expect(organizationHasApiAccess(selfServeEnterprise)).toBe(false);
     expect(organizationHasApiAccess(growthActive)).toBe(false);
   });
 
   test("organizationHasComplianceAccess follows the shared enterprise gate", () => {
-    expect(organizationHasComplianceAccess(enterpriseActive)).toBe(true);
+    expect(organizationHasComplianceAccess(salesProvisionedEnterprise)).toBe(true);
+    expect(organizationHasComplianceAccess(selfServeEnterprise)).toBe(false);
     expect(organizationHasComplianceAccess(growthActive)).toBe(false);
   });
+
+  test("organizationHasCustomDomainAccess (white-label) is self-serve-eligible — no sales flag required", () => {
+    expect(organizationHasCustomDomainAccess(salesProvisionedEnterprise)).toBe(true);
+    expect(organizationHasCustomDomainAccess(selfServeEnterprise)).toBe(true);
+    expect(organizationHasCustomDomainAccess(growthActive)).toBe(false);
+    expect(organizationHasCustomDomainAccess(null)).toBe(false);
+    expect(organizationHasCustomDomainAccess(undefined)).toBe(false);
+  });
+
+  test("organizationHasVanitySubdomain is self-serve-eligible — no sales flag required", () => {
+    expect(organizationHasVanitySubdomain(salesProvisionedEnterprise)).toBe(true);
+    expect(organizationHasVanitySubdomain(selfServeEnterprise)).toBe(true);
+    expect(organizationHasVanitySubdomain(growthActive)).toBe(false);
+  });
 });