@company-semantics/contracts 87.0.0 → 88.0.0

package/src/org/README.md

@@ -17,10 +17,8 @@ Shared type vocabulary for organization ownership, type classification, and tran
 ## Public API
 
 - `AcceptInviteRequest` _(type)_ — Request payload for accepting an organization invite.
-- `AccessLevel` _(type)_ — Document access level.
 - `AcknowledgeSystemEventResponse` _(type)_
 - `AcknowledgeSystemEventResponseSchema`
-- `AclEntry` _(type)_
 - `ActionCapability` _(type)_
 - `ActionCapabilitySchema` — An action's gate: allowed, or blocked with the scope that would unlock it.
 - `AuthMethodConfig` _(type)_ — Authentication method configuration.
@@ -36,7 +34,6 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `AuthorityOriginSchema`
 - `AuthoritySource` _(type)_
 - `AuthoritySourceSchema` — Engine-internal authority source.
-- `AuthorizableView` _(type)_ — Type for views that can be checked against VIEWSCOPEMAP.
 - `BATCH_INVITE_PERSONS_MAX` — Cap on one batch.
 - `BATCH_INVITE_SKIP_REASONS` — Why one person in a batch did not receive an invite. - `already-member` — holds an account in this org…
 - `BatchInviteRequest` _(type)_
@@ -45,74 +42,11 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `BatchInviteResponseSchema`
 - `BatchInviteSkipReason` _(type)_
 - `BatchInviteSkipReasonSchema`
-- `COMPANY_MD_COLLAB_MAX_DOC_TEXT_BYTES` — Cap on the MATERIALIZED document text, in UTF-8 bytes of the expanded result.
-- `COMPANY_MD_COLLAB_MAX_PRESENCE_POSITION_CHARS` — Cap on ONE presence position blob (`anchor` or `head`), in base64 chars.
-- `COMPANY_MD_COLLAB_MAX_UPDATE_B64_CHARS` — Cap on ONE encoded update, measured on the base64 payload as it is sent.
-- `COMPANY_MD_COLLAB_PRESENCE_HEARTBEAT_MS` — The cadence clients must re-POST presence at.
-- `COMPANY_MD_COLLAB_PRESENCE_TTL_MS` — How long the server keeps a presence entry alive with no fresh signal.
-- `COMPANY_MD_COLLAB_TEXT_KEY` — The Y.Doc root key holding the document body — a CONTRACT, not a detail.
-- `CanonicalFacts` _(type)_
-- `CanonicalFactsSchema` — The full normalized batch an external-source adapter emits in one pass: every person, org unit, position…
-- `CanonicalOccupancy` _(type)_
-- `CanonicalOccupancySchema` — An occupancy (a person holds a seat) as reported by an external source.
-- `CanonicalOrgUnit` _(type)_
-- `CanonicalOrgUnitSchema` — An org unit as reported by an external source.
-- `CanonicalPerson` _(type)_
-- `CanonicalPersonSchema` — A person as reported by an external source, keyed by external identity.
-- `CanonicalPosition` _(type)_
-- `CanonicalPositionSchema` — A position (seat) as reported by an external source, placed in a unit by external reference…
-- `CanonicalPositionStatus` _(type)_
-- `CanonicalPositionStatusSchema` — Seat-existence as the SOURCE reported it.
-- `CanonicalReportingEdge` _(type)_
-- `CanonicalReportingEdgeSchema` — A reporting edge (a seat reports to a manager seat) as reported by an external source.
-- `CanonicalUnresolvedManager` _(type)_
-- `CanonicalUnresolvedManagerResolution` _(type)_
-- `CanonicalUnresolvedManagerResolutionSchema` — Why a supervisory reference could not be resolved to a seat in this batch.
-- `CanonicalUnresolvedManagerSchema` — A supervisory reference the source reported that we could NOT resolve to a seat in this batch.
 - `CapabilitiesResponse` _(type)_
 - `CapabilitiesResponseSchema` — The single validated capability surface the UI reads.
 - `ChangeMemberRoleRequest` _(type)_ — Request payload for changing a member's role.
 - `ChangeMemberRoleResponse` _(type)_
 - `ChangeMemberRoleResponseSchema`
-- `CompanyMdClassification` _(type)_ — Information classification for a Company.md node — what the document is, for governance, NOT permissions.
-- `CompanyMdCollabAccessRevokedEvent` _(type)_
-- `CompanyMdCollabAccessRevokedEventSchema` — `event: access-revoked` — the actor's read grant went away mid-stream.
-- `CompanyMdCollabConnectedEvent` _(type)_
-- `CompanyMdCollabConnectedEventSchema` — `event: connected` — the stream is open.
-- `CompanyMdCollabPresenceEvent` _(type)_
-- `CompanyMdCollabPresenceEventSchema` — `event: collab-presence` — one participant's presence signal, either live or replayed from the roster right…
-- `CompanyMdCollabResetEvent` _(type)_
-- `CompanyMdCollabResetEventSchema` — `event: collab-reset` — the client's cursor was unusable (a superseded generation, older than what compaction…
-- `CompanyMdCollabServerDrainEvent` _(type)_
-- `CompanyMdCollabServerDrainEventSchema` — `event: server_drain` — the server is shutting the stream down deliberately (a rolling restart, not a…
-- `CompanyMdCollabSseEvent` _(type)_
-- `CompanyMdCollabSseEventSchema` — Every frame the collaboration stream emits, discriminated on the `type` the client stamps from the SSE…
-- `CompanyMdCollabSyncLimits` _(type)_
-- `CompanyMdCollabSyncLimitsSchema` — Protocol limits the client needs BEFORE it sends anything.
-- `CompanyMdCollabSyncResponse` _(type)_
-- `CompanyMdCollabSyncResponseSchema` — `GET /collab/sync` response body — merged collaboration state plus the cursor the stream resumes from.
-- `CompanyMdCollabUpdateAccepted` _(type)_
-- `CompanyMdCollabUpdateAcceptedSchema` — `POST /collab/updates` response body.
-- `CompanyMdCollabUpdateEvent` _(type)_
-- `CompanyMdCollabUpdateEventSchema` — `event: collab-update` — one durable collaboration update.
-- `CompanyMdContextBankItem` _(type)_ — A context bank item — a company.md doc associated with one or more parent nodes.
-- `CompanyMdDependency` _(type)_
-- `CompanyMdDiscoverabilityPolicy` _(type)_ — Discoverability policy for a Company.md node — who knows it exists, orthogonal to who may read it (authority…
-- `CompanyMdDoc` _(type)_
-- `CompanyMdDocCollaborators` _(type)_
-- `CompanyMdDocCore` _(type)_
-- `CompanyMdDocKind` _(type)_ — Structural discriminator for a Company.md document. - `'root'`: the single org-wide doc (one per org). -…
-- `CompanyMdDocLevel` _(type)_
-- `CompanyMdDocRelations` _(type)_
-- `CompanyMdNodeIdentity` _(type)_
-- `CompanyMdNodeType` _(type)_ — Semantic node type used by the Company.md tree.
-- `CompanyMdSource` _(type)_
-- `CompanyMdTreeNode` _(type)_
-- `CompanyMdVisibility` _(type)_ — Visibility band for a Company.md document — the canonical AUTH `entity_visibility` vocabulary (, backend ). -…
-- `ConflictRecord` _(type)_
-- `ConflictRecordSchema`
-- `ConstraintViolation` _(type)_
-- `ConstraintViolationSchema` — One constraint the transformation engine evaluated and found violated.
 - `CreateDelegationRequest` _(type)_
 - `CreateDelegationRequestSchema`
 - `CreateInviteBatchRequest` _(type)_
@@ -126,38 +60,15 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `DelegationListResponse` _(type)_
 - `DelegationListResponseSchema`
 - `DelegationSchema`
-- `DismissStructureFindingRequest` _(type)_
-- `DismissStructureFindingRequestSchema`
 - `DomainListResponse` _(type)_
 - `DomainListResponseSchema`
 - `DomainResponse` _(type)_
 - `DomainResponseSchema`
-- `DomainStatus` _(type)_ — Status of a domain claim within an organization. - 'pending': Domain claimed but not yet verified -…
-- `DomainVerificationMethod` _(type)_ — Method used to verify domain ownership. - 'dnstxt': DNS TXT record verification (primary method) - 'email'…
-- `ExecutionContext` _(type)_
-- `ExecutionContextSchema` — ExecutionContext — the RUN in which an intent was produced or applied.
 - `ExecutionScope` _(type)_ — Execution scope determines whose identity is used when executing actions. - 'self': Actions execute under the…
-- `ExistingPlacementFact` _(type)_
-- `ExistingPlacementFactSchema` — Where a person already sits, and on whose authority they sit there.
-- `ExistingUnitFact` _(type)_
-- `ExistingUnitFactSchema` — An org unit that already exists, with the license the engine has over it.
-- `FACT_SOURCE_TIER_PRECEDENCE` — Truth hierarchy, highest precedence first.
-- `FactMutation` _(type)_
-- `FactMutationSchema` — A single atomic fact change the engine applies to the live org graph.
-- `FactProvenance` _(type)_
-- `FactProvenanceSchema` — Provenance envelope attached to a structural fact (reporting edge, org unit, membership, home assignment).
-- `FactSourceTier` _(type)_
-- `FactSourceTierSchema` — The precedence axis for a fact.
 - `FieldCapability` _(type)_
 - `FieldCapabilitySchema` — A mutable field's gate: editable, or locked with attribution (sso vs rbac).
 - `FillOpenRoleRequest` _(type)_
 - `FillOpenRoleRequestSchema` — Fill an open role by seating an existing org member (`userId`) or inviting a new person by email.
-- `Finding` _(type)_
-- `FindingSchema` — A single diagnostic the system emits about the org graph — the GENERAL model of which {@link…
-- `FindingSeverity` _(type)_
-- `FindingSeveritySchema` — Severity of a {@link FindingSchema}.
-- `HomeAssignment` _(type)_
-- `HomeAssignmentSchema` — A person's single structural home unit — at most one per person per org.
 - `HomeUnitRole` _(type)_
 - `HomeUnitRoleSchema` — Role the invitee takes in their home unit on acceptance.
 - `IDENTITY_TRUST_LEVEL_LABELS`
@@ -194,14 +105,8 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `MemberRecentAction` _(type)_ — Recent audit action attached to a member-detail response.
 - `MissingAtNextLevel` _(type)_
 - `MissingAtNextLevelSchema` — Active users home directly at this unit who have no level-(depth+1) home assignment within its subtree.
-- `ORG_SHARED_TRANSITION_TRIGGERS` — WHY an org stopped being personal.
-- `ORG_UNITS_ROUTES` — Canonical route path constants for the `/api/org-units` surface.
 - `ORG_UNIT_ABSOLUTE_MAX_DEPTH` — Hard ceiling mirrored by the `org_units_depth_max` CHECK; ingest-only past designed.
 - `ORG_UNIT_DESIGNED_MAX_DEPTH` — Depth a human may build from scratch; the UI ceiling for a fresh org.
-- `Occupancy` _(type)_
-- `OccupancySchema`
-- `OccupancyStatus` _(type)_
-- `OccupancyStatusSchema` — Lifecycle of a single occupancy of a position.
 - `OidcValidationResult` _(type)_ — Result of validating an OIDC discovery URL.
 - `OidcValidationResultDto` _(type)_ — Result of validating an OIDC discovery URL.
 - `OidcValidationResultSchema`
@@ -211,7 +116,6 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `OpenRoleResponse` _(type)_
 - `OpenRoleResponseSchema`
 - `OpenRoleSchema` — An open role — a persisted placeholder for the person who will sit in a unit.
-- `OpenRoleStatus` _(type)_ — Hiring lifecycle of an open role — a persisted placeholder for the person who will sit in an org unit (PRD…
 - `OpenRoleStatusSchema` — Hiring lifecycle of an open role.
 - `OrgAuthPolicy` _(type)_ — Organization authentication policy.
 - `OrgAuthPolicyDto` _(type)_ — Organization authentication policy.
@@ -222,13 +126,6 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `OrgDirectoryPersonSchema`
 - `OrgDirectoryResponse` _(type)_
 - `OrgDirectoryResponseSchema`
-- `OrgDivergence` _(type)_
-- `OrgDivergenceResolution` _(type)_
-- `OrgDivergenceResolutionSchema` — What resolving a divergence means today.
-- `OrgDivergenceSchema`
-- `OrgDomain` _(type)_ — Organization domain claim and verification status.
-- `OrgIntent` _(type)_
-- `OrgIntentSchema` — A requested org-graph change expressed as intent.
 - `OrgInvite` _(type)_ — Organization invite for the workspace invites list.
 - `OrgInviteStatus` _(type)_ — Status of an organization invite.
 - `OrgLevelConfig` _(type)_
@@ -241,26 +138,20 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `OrgLogosSchema` — An org's stored marks.
 - `OrgOwnerIcon` _(type)_
 - `OrgOwnerIconSchema` — Icon options for the `owner` org-chart role.
-- `OrgReconciliationLedger` _(type)_
-- `OrgReconciliationLedgerSchema`
 - `OrgScopedContext` _(type)_ — Validated organization-scoped context for policy implementations.
-- `OrgSharedTransitionTrigger` _(type)_
 - `OrgSystemEventsList` _(type)_
 - `OrgSystemEventsListSchema`
-- `OrgTreeResponse` _(type)_
 - `OrgType` _(type)_ — Organization type distinguishes personal workspaces from shared organizations. - 'personal': Single-user…
 - `OrgUnit` _(type)_
 - `OrgUnitAncestorsResponse` _(type)_
 - `OrgUnitAncestorsResponseSchema`
 - `OrgUnitChildrenResponse` _(type)_
 - `OrgUnitChildrenResponseSchema`
-- `OrgUnitClassification` _(type)_ — Semantic classification — projection-only, never drives traversal.
 - `OrgUnitClassificationSchema`
 - `OrgUnitDescendantsResponse` _(type)_
 - `OrgUnitDescendantsResponseSchema`
 - `OrgUnitDesignation` _(type)_
 - `OrgUnitDesignationSchema` — Designation a member holds over a unit they manage.
-- `OrgUnitErrorCode` _(type)_ — Error codes returned by `POST /api/org-units/:id/reparent` and related mutation endpoints.
 - `OrgUnitErrorCodeSchema`
 - `OrgUnitMembership` _(type)_
 - `OrgUnitMembershipListResponse` _(type)_
@@ -268,9 +159,7 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `OrgUnitMembershipResponse` _(type)_
 - `OrgUnitMembershipResponseSchema`
 - `OrgUnitMembershipSchema`
-- `OrgUnitMembershipSource` _(type)_ — External directory origin of a membership row.
 - `OrgUnitMembershipSourceSchema`
-- `OrgUnitMembershipStatus` _(type)_ — Active/pending/removed lifecycle for a unit membership.
 - `OrgUnitMembershipStatusSchema`
 - `OrgUnitOwner` _(type)_
 - `OrgUnitOwnerSchema`
@@ -279,23 +168,19 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `OrgUnitPermissionsEntry` _(type)_
 - `OrgUnitPermissionsEntrySchema` — Effective manager of an org unit — a user whose membership (direct or inherited from an ancestor) grants the…
 - `OrgUnitRelationship` _(type)_
-- `OrgUnitRelationshipRole` _(type)_ — Edge role — refines the collaboration nature on a graph edge.
 - `OrgUnitRelationshipRoleSchema`
 - `OrgUnitRelationshipSchema`
-- `OrgUnitRelationshipType` _(type)_ — Edge classification for `org_unit_relationships`.
 - `OrgUnitRelationshipTypeSchema`
 - `OrgUnitRelationshipsResponse` _(type)_
 - `OrgUnitRelationshipsResponseSchema`
 - `OrgUnitResponse` _(type)_
 - `OrgUnitResponseSchema`
 - `OrgUnitSchema`
-- `OrgUnitSyncMode` _(type)_ — External directory reconciliation policy for a unit.
 - `OrgUnitSyncModeSchema`
 - `OrgUnitTreeNode` _(type)_
 - `OrgUnitTreeNodeSchema`
 - `OrgUnitTreeResponse` _(type)_
 - `OrgUnitTreeResponseSchema`
-- `OrgUnitVisibility` _(type)_ — Default visibility inherited by new docs under this unit.
 - `OrgUnitVisibilitySchema`
 - `OrgUsageResponse` _(type)_
 - `OrgUsageResponseSchema`
@@ -311,62 +196,25 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `OwnershipTransferStatus` _(type)_ — Status of pending ownership transfer for an organization.
 - `PendingUnitOwner` _(type)_
 - `PendingUnitOwnerSchema` — A lead the structure review chose who is NOT YET an owner, because they have no account to grant to.
-- `PermissionAuditEntry` _(type)_ — Single entry in the permission change audit log.
-- `PersonStructureOutcome` _(type)_
-- `PersonStructureOutcomeSchema` — EXACTLY ONE outcome per person in the snapshot. "Zero or one placement" would accept a proposal that simply…
 - `Phase3AuditAction` _(type)_ — Audit actions for Phase 3 workspace expansion features.
-- `Phase4AuditAction` _(type)_ — Audit actions for Phase 4 enterprise identity features.
-- `Position` _(type)_
-- `PositionReporting` _(type)_
-- `PositionReportingRelationshipType` _(type)_
-- `PositionReportingRelationshipTypeSchema` — The kind of reporting line.
-- `PositionReportingSchema`
-- `PositionSchema`
-- `PositionStatus` _(type)_
-- `PositionStatusSchema` — Lifecycle of a seat's EXISTENCE — distinct from a hiring pipeline.
-- `ProposedOrgUnit` _(type)_
-- `ProposedOrgUnitSchema` — A unit the proposal wants the org to have.
-- `Provenance` _(type)_
-- `ProvenanceSchema` — Provenance — WHO/WHAT generated an intent.
 - `ProviderStatus` _(type)_ — Provider-level configuration lifecycle.
 - `ProviderSuggestion` _(type)_ — MX-based provider suggestion for SSO setup.
-- `Recommendation` _(type)_
-- `RecommendationSchema`
 - `RemoveMemberRequest` _(type)_ — Request payload for removing a member from the workspace.
 - `RemoveMemberResponse` _(type)_
 - `RemoveMemberResponseSchema`
-- `ReportingEdgeProvenance` _(type)_
-- `ReportingEdgeProvenanceSchema` — The provenance of a reporting edge a change would supersede, as the operator must see it before confirming…
-- `ReportingErrorCode` _(type)_
-- `ReportingErrorCodeSchema` — Structured codes for reporting-line mutation rejections, surfaced as `ErrorResponse.meta.reportingCode` by…
-- `ReportingLineAnomalyFacts` _(type)_
-- `ReportingLineAnomalyFactsSchema`
-- `ReportingLineAnomalyReport` _(type)_
-- `ReportingLineAnomalyReportSchema` — One report parked on the pivot, and who actually leads their department.
-- `ResolveOrgDivergenceResult` _(type)_
-- `ResolveOrgDivergenceResultSchema`
 - `RoleCatalogEntry` _(type)_ — Entry in the RBAC roles catalog (GET /api/rbac/roles).
 - `RoleCatalogEntrySchema`
 - `RoleCatalogResponseSchema`
-- `STRUCTURE_FINDING_KINDS`
-- `STRUCTURE_FINDING_STATUSES`
-- `STRUCTURE_REVIEW_ITEM_KINDS` — A question the engine is asking a human, with the competing signals attached.
 - `ScopeCheckBatchResponse` _(type)_
 - `ScopeCheckBatchResponseSchema`
 - `ScopeCheckResponse` _(type)_
 - `ScopeCheckResponseSchema`
-- `SelectionRationale` _(type)_
-- `SelectionRationaleSchema`
 - `SendInviteBatchRequest` _(type)_
 - `SendInviteBatchRequestSchema` — `expectedRevision` is REQUIRED and has no default.
 - `SetActiveOrgResponse` _(type)_
 - `SetActiveOrgResponseSchema`
 - `SetSeatManagerResponse` _(type)_
 - `SetSeatManagerResponseSchema` — Response for the one idempotent set-or-clear of a seat's solid-line manager — the reporting edge the org…
-- `SharePolicy` _(type)_ — Document sharing policy. - restricted: Only explicit ACL + owning unit + org admins - orgread: All org…
-- `ShareState` _(type)_ — Complete sharing state for a document.
-- `SourceAuthority` _(type)_
-- `SourceAuthoritySchema`
 - `SsoCredentialStatus` _(type)_ — Boolean credential presence indicators (never expose actual values).
 - `SsoDiscoveryConfig` _(type)_ — OIDC discovery configuration for the SSO provider.
 - `SsoEnforcementStatus` _(type)_ — SSO enforcement status for the workspace.
@@ -377,51 +225,8 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `SsoStepperStep` _(type)_ — Backend-authoritative stepper step.
 - `StagedPlacement` _(type)_ — Staged member placement: the fuller org position an invitee is slotted into, applied as deferred grants when…
 - `StagedPlacementSchema` — Staged member placement: the fuller org position an invitee is slotted into, applied as deferred grants when…
-- `StructureAcceptedBy` _(type)_
-- `StructureAcceptedBySchema` — WHO accepted the fact.
-- `StructureAuthority` _(type)_
-- `StructureAuthoritySchema` — The authority axis — the ONLY axis precedence runs on: `human_confirmed` `ai_inferred` `hris_source`.
-- `StructureEvidence` _(type)_
-- `StructureEvidenceSchema` — TYPED evidence.
-- `StructureFinding` _(type)_
-- `StructureFindingDismissal` _(type)_
-- `StructureFindingDismissalSchema` — Who said a finding is intentional, when, and about which content.
-- `StructureFindingKind` _(type)_
-- `StructureFindingKindSchema`
-- `StructureFindingListResponse` _(type)_
-- `StructureFindingListResponseSchema`
-- `StructureFindingListStatus` _(type)_
-- `StructureFindingListStatusSchema` — Which findings a list read returns.
-- `StructureFindingResponse` _(type)_
-- `StructureFindingResponseSchema`
-- `StructureFindingSchema`
-- `StructureFindingStatus` _(type)_
-- `StructureFindingStatusSchema`
-- `StructureInferenceSnapshot` _(type)_
-- `StructureInferenceSnapshotSchema` — The inference INPUT: a point-in-time view of the PERSISTED canonical graph.
-- `StructurePersonFact` _(type)_
-- `StructurePersonFactSchema` — A person as the inference engine sees them.
-- `StructureProposal` _(type)_
-- `StructureProposalOrigin` _(type)_
-- `StructureProposalOriginSchema` — How a structural fact came to be PROPOSED.
-- `StructureProposalSchema` — A proposed desired state for one org.
-- `StructureProvenance` _(type)_
-- `StructureProvenanceSchema` — The three axes together, as one accepted structural fact records them. - v1 — AI proposes, an admin clicks…
-- `StructureReportingFact` _(type)_
-- `StructureReportingFactSchema` — One reporting edge, at person granularity.
-- `StructureReviewItem` _(type)_
-- `StructureReviewItemSchema` — A review item IS a {@link DecisionQuestion}, plus the addressing that says what the question is about.
-- `StructureUnitAuthority` _(type)_
-- `StructureUnitAuthoritySchema` — How much license the engine has over an EXISTING unit or placement.
 - `SubmitInteractiveTaskResponse` _(type)_
 - `SubmitInteractiveTaskResponseSchema` — Response for submitting a filled-in interactive chat task surface (e.g. the editable "change reporting…
-- `SubunitCandidateFacts` _(type)_
-- `SubunitCandidateFactsSchema`
-- `SupersededReportingEdge` _(type)_
-- `SupersededReportingEdgeSchema`
-- `SyncRunSummary` _(type)_
-- `SyncRunSummarySchema`
-- `TOPOLOGY_ONLY_EVIDENCE_KINDS` — Evidence kinds that alone are NOT sufficient to justify a unit boundary.
 - `TRANSFER_RESPONSIBILITIES` — Responsibility checklist items shown on the acceptance page.
 - `TestSsoInitiation` _(type)_ — Initiation payload for a test SSO login attempt.
 - `TestSsoInitiationDto` _(type)_ — Initiation payload for a test SSO login attempt.
@@ -435,20 +240,10 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `TransferMemberEligibility` _(type)_ — Per-member eligibility for transfer recipient picker
 - `TransferResponsibility` _(type)_
 - `TransferStatusResponse` _(type)_ — Response for transfer status queries — extends existing OwnershipTransferStatus.
-- `TransformStrategy` _(type)_
-- `TransformStrategySchema`
-- `TransformationOrigin` _(type)_
-- `TransformationOriginSchema` — Where a transformation originated.
-- `TransformationPreview` _(type)_
-- `TransformationPreviewSchema`
-- `TransformationRequest` _(type)_
-- `TransformationRequestSchema`
-- `TreeOrderableNode` _(type)_ — Canonical per-parent sibling ordering for OrgUnit trees.
 - `UnitLeadCleared` _(type)_
 - `UnitLeadClearedSchema` — "No lead for now": the latest `unit_head` review answer for the unit was an explicit clear, and no later…
 - `UnitMembershipRole` _(type)_
 - `UnitMembershipRoleSchema` — Positional slot a member holds in the org-unit tree.
-- `UnitRouteLevel` _(type)_ — One level of the org's chart as the route needs it: `OrgLevelConfig` satisfies this, and so does a plainer `{…
 - `UpdateAuthPolicyRequest` _(type)_ — Request payload for updating organization auth policy.
 - `UpdateDelegationRequest` _(type)_
 - `UpdateDelegationRequestSchema` — Change a delegation's expiry without revoking it: extend, shorten, or clear (set `expiresAt: null` to make it…
@@ -463,7 +258,6 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `UserOrgMembership` _(type)_ — User organization membership summary.
 - `UserOrgsResponse` _(type)_
 - `UserOrgsResponseSchema`
-- `VIEW_SCOPE_MAP` — View-to-scope mapping for frontend authorization. - Views with string values require that scope for access -…
 - `WorkspaceAccessResponse` _(type)_
 - `WorkspaceAccessResponseSchema`
 - `WorkspaceAuditEvent` _(type)_ — Audit event for the workspace audit log.
@@ -493,12 +287,6 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `WorkspaceSettingsOverview` _(type)_ — Full workspace overview for the Settings surface.
 - `WorkspaceSsoState` _(type)_ — Workspace SSO state derived from provider status + policy.
 - `WorkspaceSurface` _(type)_ — Discriminator for workspace surface routing. - 'info': Read-only surface, any member, org.view capabilities -…
-- `getViewScope` — Get the required scope for a view, or null if public.
-- `levelSlugForDepth` — The level segment for a depth: the configured label slugified, else `level-<depth>`.
-- `mayOverrideAuthority` — True when `incoming` may overwrite a fact currently held at `existing`.
-- `orderTreeNodes`
-- `slugifyLevelLabel` — A level label's URL form: lowercased, runs of non-alphanumerics collapsed to one hyphen, hyphens trimmed.
-- `unitRouteSegments` — The route segments one unit contributes at its depth: `[]` at the root, `[levelSlug, unitSlug]` below it.
 
 <!-- END GENERATED: readme-public-api -->
 

package/src/org/authority-schemas.ts

@@ -0,0 +1,242 @@
+/**
+ * Authority & Delegation Schemas
+ *
+ * Authority axes (mechanism × locality × mutability), unit owners, pending
+ * owners and delegations.
+ *
+ * Split out of `./schemas.ts`, which re-exports this module unchanged — import
+ * from `./schemas` (or the `./org` entry), not from this file directly.
+ */
+import { z } from "zod";
+import { IsoDateTime } from "../api/primitives";
+
+// ---------------------------------------------------------------------------
+// Authority & Delegation vocabulary
+//
+// The API expresses authority as orthogonal axes (mechanism × locality ×
+// mutability) instead of a single overloaded `source` enum, so future
+// combinations like inherited-delegated or hris-delegated compose by
+// construction rather than forcing each consumer to add a new switch case.
+// The engine's internal AuthoritySource enum stays narrower than the wire
+// shape — it's debug/audit vocabulary, not API vocabulary.
+// ---------------------------------------------------------------------------
+
+/**
+ * Engine-internal authority source. Used by the projection storage layer for
+ * debugging and drift records; not part of the public API response shape.
+ * `manual_membership` was removed when the legacy `l{N}_unit_owner` track was
+ * canonicalized onto delegations.
+ */
+export const AuthoritySourceSchema = z.enum([
+  "structural",
+  "delegated",
+  "org_admin",
+]);
+export type AuthoritySource = z.infer<typeof AuthoritySourceSchema>;
+
+export const AuthorityOriginSchema = z.enum([
+  "topology",
+  "delegation",
+  "administrative_override",
+]);
+export type AuthorityOrigin = z.infer<typeof AuthorityOriginSchema>;
+
+export const AuthorityConfidenceSchema = z.enum(["authoritative", "inferred"]);
+export type AuthorityConfidence = z.infer<typeof AuthorityConfidenceSchema>;
+
+/** How the authority arose. */
+export const AuthorityMechanismSchema = z.enum([
+  "structural",
+  "delegated",
+  "rbac",
+]);
+export type AuthorityMechanism = z.infer<typeof AuthorityMechanismSchema>;
+
+/** Whether the grant lives on the target unit or is inherited from an ancestor. */
+export const AuthorityLocalitySchema = z.enum(["local", "inherited"]);
+export type AuthorityLocality = z.infer<typeof AuthorityLocalitySchema>;
+
+/**
+ * Whether the user can change this authority from this surface.
+ *  - `derived`: change the upstream source instead (the org chart, RBAC roles).
+ *  - `user_managed`: removable from this UI.
+ *
+ * Consumed by {@link OwnerAuthoritySchema} and by the per-unit
+ * `WorkspaceMemberUnitDesignationEntrySchema` in `./schemas`.
+ */
+export const AuthorityMutabilitySchema = z.enum(["derived", "user_managed"]);
+export type AuthorityMutability = z.infer<typeof AuthorityMutabilitySchema>;
+
+export const OwnerAuthoritySchema = z.object({
+  mechanism: AuthorityMechanismSchema,
+  locality: AuthorityLocalitySchema,
+  mutability: AuthorityMutabilitySchema,
+  derivedFromUnitId: z.string().uuid(),
+  derivedFromUnitName: z.string().min(1).optional(),
+  /**
+   * True when this authority derives from the org ROOT unit — i.e. the holder
+   * is a CEO (a unit owner of the org root, observed locally on the root
+   * or as inherited authority on a descendant). Lets consumers classify CEO
+   * without a separate org-tree lookup, the same way `mechanism === 'rbac'`
+   * identifies an org admin. Omitted (falsy) for non-root derivations.
+   */
+  derivedFromRoot: z.boolean().optional(),
+  derivedFromUserId: z.string().uuid().nullable().optional(),
+  /**
+   * Human-readable reason this authority applies, built at serialize time from
+   * the strategy's derivation metadata. Foundation for trust UI, debugging,
+   * AI explainability, governance reports, and audits.
+   */
+  explanation: z.string(),
+  /**
+   * Strategy-specific structured metadata, preserved verbatim for tooling that
+   * needs more than the explanation string (drift detection, audits).
+   */
+  derivationMetadata: z.record(z.string(), z.unknown()).optional(),
+  /**
+   * `org_unit_delegations.id` when `mechanism === 'delegated'`. Surfaced
+   * separately so the UI doesn't need to inspect derivationMetadata to render
+   * the revoke action.
+   */
+  delegationId: z.string().uuid().optional(),
+  /**
+   * Delegation expiry as an ISO-8601 timestamp when `mechanism === 'delegated'`
+   * and the delegation is time-boxed; `null` for a permanent delegation; omitted
+   * for non-delegated mechanisms. Expired delegations never reach this surface —
+   * the projection read filters `expires_at > now()` — so a present value is
+   * always in the future.
+   */
+  expiresAt: IsoDateTime.nullable().optional(),
+});
+export type OwnerAuthority = z.infer<typeof OwnerAuthoritySchema>;
+
+export const OrgUnitOwnerSchema = z.object({
+  userId: z.string().uuid(),
+  fullName: z.string().min(1),
+  jobTitle: z.string().nullable(),
+  avatarUrl: z.string().nullable(),
+  /** All authority grants this user holds for the unit. At least one entry. */
+  authorities: z.array(OwnerAuthoritySchema).min(1),
+});
+export type OrgUnitOwner = z.infer<typeof OrgUnitOwnerSchema>;
+
+/**
+ * A lead the structure review chose who is NOT YET an owner, because they have
+ * no account to grant to. Mirrors one `staged` row of the backend's lead → owner
+ * bridge ledger (ADR-BE-734): the grant is minted the moment the person links an
+ * account, attributed to the reviewer who decided it. Person-keyed on purpose —
+ * an owner is user-keyed and this person has no user.
+ *
+ * DISPLAY ONLY. Never an authorization input: a pending owner holds nothing
+ * until the grant exists, and consumers must not derive a capability from it.
+ */
+export const PendingUnitOwnerSchema = z.object({
+  personId: z.string().uuid(),
+  fullName: z.string().min(1),
+  jobTitle: z.string().nullable(),
+  /** When the reviewer decided it — the answer's time, not the row's. */
+  decidedAt: IsoDateTime,
+  /** Why it is pending. One reason today; a closed enum so a second is a decision. */
+  reason: z.enum(["no_account"]),
+});
+export type PendingUnitOwner = z.infer<typeof PendingUnitOwnerSchema>;
+
+/**
+ * "No lead for now" (ADR-BE-733): the latest `unit_head` review answer for the
+ * unit was an explicit clear, and no later answer superseded it. Distinct from
+ * "never had one" — an absence a person recorded, not a default. Display only.
+ */
+export const UnitLeadClearedSchema = z.object({
+  decidedAt: IsoDateTime,
+});
+export type UnitLeadCleared = z.infer<typeof UnitLeadClearedSchema>;
+
+/**
+ * Contract-level invariant: each owner list contains each userId at most once.
+ * Duplicate userIds are a serializer bug, not a presentation concern, so we
+ * fail Zod parse at the API boundary on both server and client.
+ */
+const uniqueByUserId = (arr: ReadonlyArray<{ userId: string }>): boolean =>
+  new Set(arr.map((o) => o.userId)).size === arr.length;
+const uniqueByPersonId = (arr: ReadonlyArray<{ personId: string }>): boolean =>
+  new Set(arr.map((o) => o.personId)).size === arr.length;
+
+export const OrgUnitOwnersResponseSchema = z.object({
+  owners: z
+    .array(OrgUnitOwnerSchema)
+    .refine(uniqueByUserId, { message: "duplicate userId in owners" }),
+  inherited: z
+    .array(OrgUnitOwnerSchema)
+    .refine(uniqueByUserId, { message: "duplicate userId in inherited" })
+    .optional(),
+  /**
+   * Leads chosen in the structure review who become owners once they have an
+   * account. Always present (`[]` when none) — the server knows, so the client
+   * never has to guess between "none" and "not asked".
+   */
+  pending: z
+    .array(PendingUnitOwnerSchema)
+    .refine(uniqueByPersonId, { message: "duplicate personId in pending" }),
+  /** The recorded "no lead for now", or null when no such answer stands. */
+  leadCleared: UnitLeadClearedSchema.nullable(),
+});
+export type OrgUnitOwnersResponse = z.infer<typeof OrgUnitOwnersResponseSchema>;
+
+export const DelegationSchema = z.object({
+  id: z.string().uuid(),
+  orgId: z.string().uuid(),
+  unitId: z.string().uuid(),
+  userId: z.string().uuid(),
+  grantedBy: z.string().uuid().nullable(),
+  grantedAt: z.string(),
+  revokedAt: z.string().nullable(),
+  status: z.enum(["active", "revoked"]),
+  note: z.string().nullable(),
+  /**
+   * ISO-8601 timestamp at which the delegation stops conferring authority, or
+   * `null` for a permanent delegation. Enforcement is read-time (the projection
+   * read filters `expires_at > now()`); the row itself stays `status='active'`
+   * until explicitly revoked.
+   */
+  expiresAt: z.string().nullable(),
+});
+export type Delegation = z.infer<typeof DelegationSchema>;
+
+export const CreateDelegationRequestSchema = z.object({
+  userId: z.string().uuid(),
+  note: z.string().max(2000).optional(),
+  /**
+   * Optional ISO-8601 expiry. Omitted or `null` ⇒ a permanent delegation. The
+   * UI captures a date and sends end-of-day in the user's timezone.
+   */
+  expiresAt: IsoDateTime.nullable().optional(),
+  /**
+   * When true, the granted user is emailed a notification (carrying `note` as
+   * the message). Not persisted — it only gates the side-effect email. Omitted
+   * is treated as false; left without a default so the inferred request type
+   * keeps `notify` optional rather than forcing every caller to pass it.
+   */
+  notify: z.boolean().optional(),
+});
+export type CreateDelegationRequest = z.infer<
+  typeof CreateDelegationRequestSchema
+>;
+
+/**
+ * Change a delegation's expiry without revoking it: extend, shorten, or clear
+ * (set `expiresAt: null` to make it permanent). Used by the inline expiry edit
+ * on an existing delegate row.
+ */
+export const UpdateDelegationRequestSchema = z.object({
+  expiresAt: IsoDateTime.nullable(),
+});
+export type UpdateDelegationRequest = z.infer<
+  typeof UpdateDelegationRequestSchema
+>;
+
+export const DelegationListResponseSchema = z.object({
+  delegations: z.array(DelegationSchema),
+});
+export type DelegationListResponse = z.infer<
+  typeof DelegationListResponseSchema
+>;