@devxcrew/platform 0.1.2 → 0.1.6

package/dist/modules/tenant/tenant.schema.js

@@ -0,0 +1,31 @@
+import { z } from "zod";
+export const tenantRequestSchema = z.strictObject({
+    portal: z.enum(["user", "admin", "super-admin"]).default("user"),
+    tenantId: z.string().trim().min(1).max(255).optional()
+});
+export const tenantMappingSchema = z
+    .strictObject({
+    tenantId: z.string().min(1),
+    driver: z.enum(["sqlite", "mariadb"]),
+    databaseName: z
+        .string()
+        .regex(/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/)
+        .nullable(),
+    sqlitePath: z.string().trim().min(1).nullable(),
+    active: z.number().int().min(0).max(1),
+    version: z.number().int().min(1)
+})
+    .superRefine((value, context) => {
+    if (value.driver === "mariadb" && !value.databaseName)
+        context.addIssue({
+            code: "custom",
+            path: ["databaseName"],
+            message: "Database name is required."
+        });
+    if (value.driver === "sqlite" && !value.sqlitePath)
+        context.addIssue({
+            code: "custom",
+            path: ["sqlitePath"],
+            message: "Database path is required."
+        });
+});

package/dist/modules/tenant/tenant.seed.d.ts

@@ -0,0 +1,8 @@
+import type { TenantDatabase } from "./tenant.types.js";
+import type { ConnectionTarget } from "@devxcrew/framework";
+export declare function provisionTenant(database: TenantDatabase & {
+    provisionConnection(target: ConnectionTarget): Promise<unknown>;
+}, environment: NodeJS.ProcessEnv): Promise<{
+    tenantId: string;
+    status: string;
+}>;

package/dist/modules/tenant/tenant.seed.js

@@ -0,0 +1,40 @@
+import { createHash } from "node:crypto";
+import { dirname, join, resolve } from "node:path";
+import { HttpError, readDatabaseConfiguration } from "@devxcrew/framework";
+import { createIdentityTenantDirectory } from "../identity/index.js";
+export async function provisionTenant(database, environment) {
+    const id = environment.IDENTITY_TENANT_ID ?? "default";
+    const tenant = await createIdentityTenantDirectory(database.database).active(id);
+    if (!tenant)
+        throw new HttpError(422, "tenant_missing", "Seed an active tenant before provisioning.");
+    const existing = await database.database
+        .selectFrom("tenant_connections")
+        .selectAll()
+        .where("tenant_id", "=", id)
+        .executeTakeFirst();
+    if (existing)
+        return { tenantId: id, status: "existing" };
+    const fingerprint = createHash("sha256").update(id).digest("hex").slice(0, 16);
+    const { driver } = readDatabaseConfiguration(environment);
+    const databaseName = driver === "mariadb"
+        ? `${(environment.DB_MASTER_NAME ?? "master").slice(0, 30)}_tenant_${fingerprint}`
+        : null;
+    const sqlitePath = driver === "sqlite"
+        ? join(dirname(resolve(environment.DB_SQLITE_PATH ?? "storage/private/data/identity.sqlite")), `tenant-${fingerprint}.sqlite`)
+        : null;
+    const target = { key: id, driver, databaseName, sqlitePath, version: 1 };
+    await database.provisionConnection(target);
+    // Register only after storage migrations succeed. Reruns preserve the existing mapping.
+    await database.database
+        .insertInto("tenant_connections")
+        .values({
+        tenant_id: id,
+        driver,
+        database_name: databaseName,
+        sqlite_path: sqlitePath,
+        active: 1
+    })
+        .onConflict((conflict) => conflict.column("tenant_id").doNothing())
+        .execute();
+    return { tenantId: id, status: "provisioned" };
+}

package/dist/modules/tenant/tenant.service.d.ts

@@ -0,0 +1,16 @@
+import type { IdentityTenantDirectory } from "../identity/index.js";
+import { type DatabaseInfrastructureSchema } from "@devxcrew/framework";
+import { TenantRepository } from "./tenant.repository.js";
+import type { TenantDatabase, TenantPrincipal, TenantScope } from "./tenant.types.js";
+export declare class TenantService<Schema extends DatabaseInfrastructureSchema = DatabaseInfrastructureSchema> {
+    private readonly repository;
+    private readonly directory;
+    private readonly connections;
+    private readonly mode;
+    private readonly clientId;
+    private readonly context;
+    constructor(repository: TenantRepository, directory: IdentityTenantDirectory, connections: TenantDatabase<Schema>, mode: "single-client" | "multi-tenant", clientId: string);
+    current(): TenantScope<Schema>;
+    verify(): Promise<void>;
+    withPrincipal<T>(principal: TenantPrincipal, requested: string | undefined, work: () => Promise<T>, signal?: AbortSignal): Promise<T>;
+}

package/dist/modules/tenant/tenant.service.js

@@ -0,0 +1,72 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { HttpError } from "@devxcrew/framework";
+import { DatabaseCapacityError, ResumableTransfer, DatabaseExecution } from "@devxcrew/framework";
+import { tenantMappingSchema } from "./tenant.schema.js";
+export class TenantService {
+    repository;
+    directory;
+    connections;
+    mode;
+    clientId;
+    context = new AsyncLocalStorage();
+    constructor(repository, directory, connections, mode, clientId) {
+        this.repository = repository;
+        this.directory = directory;
+        this.connections = connections;
+        this.mode = mode;
+        this.clientId = clientId;
+    }
+    current() {
+        const scope = this.context.getStore();
+        if (!scope)
+            throw new HttpError(401, "tenant_context_required", "An authenticated tenant context is required.");
+        return scope;
+    }
+    verify() {
+        return this.repository.verify();
+    }
+    async withPrincipal(principal, requested, work, signal) {
+        signal?.throwIfAborted();
+        const id = principal.tenant.id;
+        if (!id ||
+            (requested && requested !== id) ||
+            (this.mode === "single-client" && id !== this.clientId))
+            throw new HttpError(403, "tenant_denied", "The session does not authorize this tenant.");
+        const activeTenant = await this.directory.active(id);
+        const mapping = await this.repository.find(id);
+        if (!activeTenant || !mapping || Number(mapping.active) !== 1)
+            throw new HttpError(403, "tenant_unavailable", "No active tenant database is available.");
+        const target = tenantMappingSchema.safeParse({
+            tenantId: id,
+            driver: mapping.driver,
+            databaseName: mapping.databaseName,
+            sqlitePath: mapping.sqlitePath,
+            active: Number(mapping.active),
+            version: Number(mapping.version)
+        });
+        if (!target.success)
+            throw new HttpError(503, "tenant_mapping_invalid", "Tenant database configuration is invalid.");
+        return this.connections
+            .withConnection({
+            key: id,
+            driver: target.data.driver,
+            databaseName: target.data.databaseName,
+            sqlitePath: target.data.sqlitePath,
+            version: target.data.version
+        }, async (database) => {
+            signal?.throwIfAborted();
+            return this.context.run({
+                tenantId: id,
+                principal,
+                database,
+                data: new DatabaseExecution(database),
+                transfers: new ResumableTransfer(database)
+            }, work);
+        })
+            .catch((error) => {
+            if (error instanceof DatabaseCapacityError)
+                throw new HttpError(503, "tenant_busy", "Tenant connection capacity is currently busy.");
+            throw error;
+        });
+    }
+}

package/dist/modules/tenant/tenant.types.d.ts

@@ -0,0 +1,39 @@
+import type { ResumableTransfer } from "@devxcrew/framework";
+import type { Principal, Portal, IdentitySchema } from "../identity/index.js";
+import type { Generated, Kysely } from "kysely";
+import type { IncomingMessage } from "node:http";
+import type { DatabaseInfrastructureSchema, ConnectionTarget, DatabaseExecution } from "@devxcrew/framework";
+export type TenantPrincipal = Principal;
+export interface TenantIdentity {
+    authenticateRequest(request: IncomingMessage, portal: Portal, signal?: AbortSignal): Promise<Principal>;
+}
+export interface TenantRegistrySchema {
+    tenant_connections: {
+        tenant_id: string;
+        driver: "sqlite" | "mariadb";
+        database_name: string | null;
+        sqlite_path: string | null;
+        active: number;
+        version: Generated<number>;
+    };
+}
+export interface TenantMasterSchema extends IdentitySchema, TenantRegistrySchema, DatabaseInfrastructureSchema {
+}
+export interface TenantScope<Schema extends DatabaseInfrastructureSchema = DatabaseInfrastructureSchema> {
+    tenantId: string;
+    principal: Principal;
+    database: Kysely<Schema>;
+    data: DatabaseExecution<Schema>;
+    transfers: ResumableTransfer<Schema>;
+}
+export interface TenantProvider<Schema extends DatabaseInfrastructureSchema = DatabaseInfrastructureSchema> {
+    handle(request: IncomingMessage, response: import("node:http").ServerResponse, signal?: AbortSignal): boolean | Promise<boolean>;
+    verify(): Promise<void>;
+    runRequest<T>(request: IncomingMessage, work: () => Promise<T>, signal?: AbortSignal): Promise<T>;
+    withPrincipal<T>(principal: Principal, requestedTenant: string | undefined, work: () => Promise<T>, signal?: AbortSignal): Promise<T>;
+    current(): TenantScope<Schema>;
+}
+export interface TenantDatabase<Schema extends DatabaseInfrastructureSchema = DatabaseInfrastructureSchema> {
+    database: Kysely<TenantMasterSchema>;
+    withConnection<T>(target: ConnectionTarget, work: (database: Kysely<Schema>) => Promise<T>): Promise<T>;
+}

package/dist/modules/tenant/tenant.types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devxcrew/platform",
-  "version": "0.1.2",
+  "version": "0.1.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/devxcrew/platform.git"
@@ -24,9 +24,9 @@
     "node": ">=26.10.0"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
     "prepack": "npm run build",
-    "test": "tsx --test src/modules/identity/*.test.ts",
+    "test": "tsx --test src/modules/identity/composition/tests/*.test.ts src/modules/tenant/tests/*.test.ts",
     "mcp:connect": "node agent/connect.mjs",
     "mcp:verify": "node agent/connect.mjs --strict",
     "version-bump": "devxcrew-tools version:bump",
@@ -49,7 +49,8 @@
     "zod": "^4.0.0"
   },
   "devDependencies": {
-    "@devxcrew/tools": "0.1.7",
+    "@devxcrew/framework": "0.1.12",
+    "@devxcrew/tools": "0.1.8",
     "@types/node": "^26.0.0",
     "tsx": "^4.23.12",
     "typescript": "7.0.2"
@@ -58,5 +59,8 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "peerDependencies": {
+    "@devxcrew/framework": ">=0.1.12 <1"
+  }
 }

package/dist/modules/identity/identity.administration-repository.d.ts

@@ -1,19 +0,0 @@
-import { type Kysely } from "kysely";
-import type { IdentitySchema, Principal } from "./identity.types.js";
-import type { IdentityListQuery, IdentityResource } from "./identity.administration-schema.js";
-export declare class IdentityAdministrationRepository {
-    private readonly db;
-    constructor(db: Kysely<IdentitySchema>);
-    list(actor: Principal, resource: IdentityResource, query: IdentityListQuery): Promise<{
-        data: Record<string, unknown>[];
-        meta: {
-            page: number;
-            perPage: number;
-            total: number;
-            lastPage: number;
-        };
-    }>;
-    show(actor: Principal, resource: IdentityResource, id: string): Promise<Record<string, unknown> | undefined>;
-    private source;
-    private present;
-}

package/dist/modules/identity/identity.administration-repository.js

@@ -1,102 +0,0 @@
-import { sql } from "kysely";
-import { IdentityError } from "./identity.error.js";
-export class IdentityAdministrationRepository {
-    db;
-    constructor(db) {
-        this.db = db;
-    }
-    async list(actor, resource, query) {
-        const source = this.source(actor, resource);
-        const fields = resource === "users"
-            ? ["id", "name", "email"]
-            : resource === "organizations" || resource === "roles"
-                ? ["id", "name"]
-                : resource === "memberships"
-                    ? ["id", "userName", "organizationName", "roleName"]
-                    : ["id"];
-        if (!fields.includes(query.sort))
-            throw new IdentityError(422, "This sort field is not supported for this resource.");
-        const search = query.search
-            ? sql `where ${sql.join(fields.map((field) => sql `lower(cast(${sql.ref(field)} as text)) like ${`%${query.search.toLowerCase()}%`}`), sql ` or `)}`
-            : sql ``;
-        const count = await sql `select count(*) as total from (${source}) as resources ${search}`.execute(this.db);
-        const sort = query.sort;
-        const rows = await sql `select * from (${source}) as resources ${search}
-      order by ${sql.ref(sort)} ${query.direction === "asc" ? sql `asc` : sql `desc`}, id asc
-      limit ${query.perPage} offset ${(query.page - 1) * query.perPage}`.execute(this.db);
-        const total = Number(count.rows[0].total);
-        return {
-            data: rows.rows.map((row) => this.present(resource, row)),
-            meta: {
-                page: query.page,
-                perPage: query.perPage,
-                total,
-                lastPage: Math.max(1, Math.ceil(total / query.perPage)),
-            },
-        };
-    }
-    async show(actor, resource, id) {
-        const result = await sql `select * from (${this.source(actor, resource)}) as resources where id = ${id} limit 1`.execute(this.db);
-        return result.rows[0] ? this.present(resource, result.rows[0]) : undefined;
-    }
-    source(actor, resource) {
-        const global = actor.portal === "super-admin";
-        if (resource === "users")
-            return sql `select u.id,u.name,u.email,u.active,u.version from identity_users u
-      where exists (select 1 from identity_memberships m left join identity_custom_roles c on c.id=m.custom_role_id
-        where m.user_id=u.id and (m.custom_role_id is null or c.app_id=${actor.appId})
-        ${global ? sql `` : sql `and m.tenant_id=${actor.tenant.id}`})
-        ${global ? sql `or not exists(select 1 from identity_memberships m where m.user_id=u.id)` : sql ``}`;
-        if (resource === "organizations")
-            return sql `select id,name,active,version from identity_tenants ${global ? sql `` : sql `where id=${actor.tenant.id}`}`;
-        if (resource === "memberships")
-            return sql `select m.user_id||'~'||m.tenant_id||'~'||m.role_id as id,m.user_id as userId,m.tenant_id as tenantId,
-      coalesce(m.custom_role_id,m.role_id) as roleId,m.role_id as portal,m.active,m.version,u.name as userName,t.name as organizationName,
-      coalesce(c.name,m.role_id) as roleName from identity_memberships m
-      join identity_users u on u.id=m.user_id join identity_tenants t on t.id=m.tenant_id
-      left join identity_custom_roles c on c.id=m.custom_role_id
-      where (m.custom_role_id is null or c.app_id=${actor.appId}) ${global ? sql `` : sql `and m.tenant_id=${actor.tenant.id}`}`;
-        if (resource === "roles")
-            return sql `select r.id,r.id as name,r.id as portal,1 as system,null as tenantId,1 as active,r.version,(select json_group_array(permission_id) from identity_role_permissions p where p.role_id=r.id) as permissionIds from identity_roles r
-        union all select c.id,c.name,'user' as portal,0 as system,c.tenant_id as tenantId,c.active,c.version,
-        (select json_group_array(permission_id) from identity_custom_role_permissions p where p.role_id=c.id) as permissionIds
-        from identity_custom_roles c where c.app_id=${actor.appId} ${global ? sql `` : sql `and c.tenant_id=${actor.tenant.id}`}`;
-        if (resource === "permissions")
-            return sql `select p.id,coalesce(d.label,p.id) as label,
-        coalesce(d.owner,case when p.id like 'desk.%' then 'desk' else 'identity' end) as owner,
-        d.app_id as appId,
-        coalesce(d.portals,case when p.id='desk.user' then '["user"]' when p.id='desk.admin' then '["admin"]'
-          when p.id='desk.super-admin' then '["super-admin"]' when p.id='identity.manage' then '["admin","super-admin"]'
-          else '["user","admin","super-admin"]' end) as portals
-        from identity_permissions p left join identity_permission_declarations d on d.permission_id=p.id
-        where d.permission_id is null or d.app_id=${actor.appId}`;
-        if (resource === "sessions")
-            return sql `select token_hash as id,user_id as userId,tenant_id as tenantId,portal,expires_at as expiresAt from identity_sessions
-      where app_id=${actor.appId} and expires_at>${new Date().toISOString()}
-      ${global ? sql `` : sql `and tenant_id=${actor.tenant.id}`}
-      ${actor.portal === "user" ? sql `and user_id=${actor.user.id}` : sql ``}`;
-        return sql `select id,actor_id as actorId,tenant_id as tenantId,action,resource_id as resourceId,created_at as createdAt
-      from identity_audit_events where app_id=${actor.appId} ${global ? sql `` : sql `and tenant_id=${actor.tenant.id}`}`;
-    }
-    present(resource, row) {
-        if (resource === "permissions")
-            return { ...row, portals: JSON.parse(String(row.portals)) };
-        if (resource === "roles")
-            return {
-                ...row,
-                version: Number(row.version),
-                active: Boolean(row.active),
-                system: Boolean(row.system),
-                permissionIds: JSON.parse(String(row.permissionIds)),
-            };
-        if (resource === "users" ||
-            resource === "organizations" ||
-            resource === "memberships")
-            return {
-                ...row,
-                active: Boolean(row.active),
-                version: Number(row.version),
-            };
-        return row;
-    }
-}

package/dist/modules/identity/identity.administration-schema.d.ts

@@ -1,113 +0,0 @@
-import { z } from "zod";
-export declare const resourceIdSchema: z.ZodString;
-export declare const listSchema: z.ZodObject<{
-    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    perPage: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    search: z.ZodDefault<z.ZodString>;
-    sort: z.ZodDefault<z.ZodEnum<{
-        email: "email";
-        id: "id";
-        name: "name";
-    }>>;
-    direction: z.ZodDefault<z.ZodEnum<{
-        asc: "asc";
-        desc: "desc";
-    }>>;
-}, z.core.$strict>;
-export declare const resourceListQuerySchema: z.ZodPipe<z.ZodObject<{
-    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    search: z.ZodDefault<z.ZodString>;
-    sort: z.ZodDefault<z.ZodEnum<{
-        email: "email";
-        id: "id";
-        name: "name";
-    }>>;
-    direction: z.ZodDefault<z.ZodEnum<{
-        asc: "asc";
-        desc: "desc";
-    }>>;
-    per_page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-}, z.core.$strict>, z.ZodTransform<{
-    page: number;
-    search: string;
-    sort: "email" | "id" | "name";
-    direction: "asc" | "desc";
-    perPage: number;
-}, {
-    page: number;
-    search: string;
-    sort: "email" | "id" | "name";
-    direction: "asc" | "desc";
-    per_page: number;
-}>>;
-export declare const membershipDeleteQuerySchema: z.ZodObject<{
-    expectedVersion: z.ZodPipe<z.ZodString, z.ZodTransform<number, string>>;
-}, z.core.$strict>;
-export declare const userCreateSchema: z.ZodObject<{
-    name: z.ZodString;
-    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
-    password: z.ZodString;
-    roleId: z.ZodDefault<z.ZodString>;
-    tenantId: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-export declare const userUpdateSchema: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    email: z.ZodOptional<z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>>;
-    active: z.ZodOptional<z.ZodBoolean>;
-    expectedVersion: z.ZodNumber;
-}, z.core.$strict>;
-export declare const organizationCreateSchema: z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodString;
-    active: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strict>;
-export declare const organizationUpdateSchema: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    active: z.ZodOptional<z.ZodBoolean>;
-    expectedVersion: z.ZodNumber;
-}, z.core.$strict>;
-export declare const membershipSchema: z.ZodObject<{
-    userId: z.ZodString;
-    tenantId: z.ZodOptional<z.ZodString>;
-    roleId: z.ZodString;
-}, z.core.$strict>;
-export declare const roleUpdateSchema: z.ZodObject<{
-    permissionIds: z.ZodArray<z.ZodString>;
-    expectedVersion: z.ZodNumber;
-}, z.core.$strict>;
-export declare const profileSchema: z.ZodObject<{
-    name: z.ZodString;
-    expectedVersion: z.ZodNumber;
-}, z.core.$strict>;
-export declare const customRoleCreateSchema: z.ZodObject<{
-    name: z.ZodString;
-    permissionIds: z.ZodArray<z.ZodString>;
-    tenantId: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-export declare const customRoleUpdateSchema: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    permissionIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    active: z.ZodOptional<z.ZodBoolean>;
-    expectedVersion: z.ZodNumber;
-}, z.core.$strict>;
-export declare const membershipUpdateSchema: z.ZodObject<{
-    roleId: z.ZodString;
-    active: z.ZodBoolean;
-    expectedVersion: z.ZodNumber;
-}, z.core.$strict>;
-export declare const settingsSchema: z.ZodObject<{
-    displayName: z.ZodString;
-    expectedVersion: z.ZodNumber;
-    locale: z.ZodEnum<{
-        en: "en";
-        "en-GB": "en-GB";
-        "en-US": "en-US";
-    }>;
-    timeZone: z.ZodString;
-}, z.core.$strict>;
-export declare const securitySettingsSchema: z.ZodObject<{
-    sessionSeconds: z.ZodNumber;
-    expectedVersion: z.ZodNumber;
-}, z.core.$strict>;
-export type IdentityListQuery = z.infer<typeof listSchema>;
-export type IdentityResource = "users" | "organizations" | "memberships" | "roles" | "permissions" | "sessions" | "audit-events";

package/dist/modules/identity/identity.administration-schema.js

@@ -1,121 +0,0 @@
-import { z } from "zod";
-import { identityKeySchema } from "./identity.schema.js";
-export const resourceIdSchema = z
-    .string()
-    .regex(/^[a-zA-Z0-9._~-]{1,300}$/)
-    .refine((value) => !/^\.+$/.test(value), "Use an identifier with a letter or number.");
-export const listSchema = z
-    .object({
-    page: z.coerce.number().int().min(1).max(100000).default(1),
-    perPage: z.coerce.number().int().min(1).max(100).default(20),
-    search: z.string().trim().max(100).default(""),
-    sort: z.enum(["id", "name", "email"]).default("id"),
-    direction: z.enum(["asc", "desc"]).default("asc"),
-})
-    .strict();
-export const resourceListQuerySchema = listSchema
-    .omit({ perPage: true })
-    .extend({ per_page: listSchema.shape.perPage })
-    .strict()
-    .transform(({ per_page, ...input }) => ({ ...input, perPage: per_page }));
-export const membershipDeleteQuerySchema = z
-    .object({
-    expectedVersion: z
-        .string()
-        .regex(/^(0|[1-9][0-9]{0,9})$/)
-        .transform(Number),
-})
-    .strict();
-const name = z.string().trim().min(1).max(100);
-const email = z
-    .email()
-    .max(254)
-    .transform((v) => v.trim().toLowerCase());
-export const userCreateSchema = z
-    .object({
-    name,
-    email,
-    password: z.string().min(12).max(256),
-    roleId: resourceIdSchema.default("user"),
-    tenantId: identityKeySchema.optional(),
-})
-    .strict();
-const expectedVersion = z.number().int().min(0);
-export const userUpdateSchema = z
-    .object({
-    name: name.optional(),
-    email: email.optional(),
-    active: z.boolean().optional(),
-    expectedVersion,
-})
-    .strict()
-    .refine((v) => Object.keys(v).length > 1, "Provide a changed field.");
-export const organizationCreateSchema = z
-    .object({ id: identityKeySchema, name, active: z.boolean().default(true) })
-    .strict();
-export const organizationUpdateSchema = z
-    .object({
-    name: name.optional(),
-    active: z.boolean().optional(),
-    expectedVersion,
-})
-    .strict()
-    .refine((v) => Object.keys(v).length > 1, "Provide a changed field.");
-export const membershipSchema = z
-    .object({
-    userId: identityKeySchema,
-    tenantId: identityKeySchema.optional(),
-    roleId: resourceIdSchema,
-})
-    .strict();
-export const roleUpdateSchema = z
-    .object({
-    permissionIds: z.array(resourceIdSchema).max(100),
-    expectedVersion,
-})
-    .strict();
-export const profileSchema = z.object({ name, expectedVersion }).strict();
-export const customRoleCreateSchema = z
-    .object({
-    name,
-    permissionIds: z.array(resourceIdSchema).max(100),
-    tenantId: identityKeySchema.optional(),
-})
-    .strict();
-export const customRoleUpdateSchema = z
-    .object({
-    name: name.optional(),
-    permissionIds: z.array(resourceIdSchema).max(100).optional(),
-    active: z.boolean().optional(),
-    expectedVersion,
-})
-    .strict()
-    .refine((input) => Object.keys(input).length > 1, "Provide a changed field.");
-export const membershipUpdateSchema = z
-    .object({ roleId: resourceIdSchema, active: z.boolean(), expectedVersion })
-    .strict();
-export const settingsSchema = z
-    .object({
-    displayName: name,
-    expectedVersion,
-    locale: z.enum(["en", "en-US", "en-GB"]),
-    timeZone: z
-        .string()
-        .max(100)
-        .refine((v) => {
-        try {
-            new Intl.DateTimeFormat("en", { timeZone: v });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }, "Use a supported IANA time zone."),
-})
-    .strict();
-export const securitySettingsSchema = z
-    .object({
-    sessionSeconds: z.number().int().min(300).max(86400),
-    expectedVersion,
-})
-    .strict();