@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/identity/metadata/metadata-secret-guard.js

@@ -0,0 +1,138 @@
+"use strict";
+// =============================================================================
+// The metadata secret guard (PP-14.27)
+// =============================================================================
+//
+// `users.metadata` and `organizations.metadata` are free-form JSONB documents
+// an app fills. They are NOT a secret store: a document is copied into exports,
+// backups and (by an app that exposes it) API responses, and nothing encrypts it.
+// A secret goes in the encrypted credential store (`user_credentials`,
+// `credentials`), never here.
+//
+// The guard works at two layers, both framework-free:
+//
+//   1. REGISTRATION: the namespace's zod schema is walked as JSON Schema; a
+//      property named like a secret, or a part of the shape left open (`z.any()`,
+//      a loose object), is refused, so the shape of a namespace can be reviewed.
+//   2. WRITE: the validated value is walked; an object key named like a secret
+//      is refused. This closes what the schema cannot see (the keys of a
+//      `z.record`).
+//
+// A guard on names cannot recognise a secret by its value: it is a tripwire for
+// the honest mistake, not a defence against a determined author.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.METADATA_SECRET_FIELD_NAMES = void 0;
+exports.isSecretFieldName = isSecretFieldName;
+exports.inspectMetadataSchema = inspectMetadataSchema;
+exports.findSecretKeys = findSecretKeys;
+const zod_1 = require("zod");
+/**
+ * Field names that mark a metadata value as a secret, compared
+ * case-insensitively with `_`, `-` and `.` ignored: the settings deny-list
+ * (`secretAccessKey`, `secretKey`, `sessionToken`, `secret`, `password`,
+ * `apiKey`, `token`, `privateKey`) plus `accessToken`, `refreshToken`,
+ * `authToken`, `bearer`, `authorization`, `credential`, `credentials`,
+ * `passphrase`, `clientSecret` and `signingKey`. A name that merely ends in
+ * `secret`, `password`, `passphrase`, `apikey`, `privatekey`, `secretkey`,
+ * `signingkey` or `token` after one of those words is refused too
+ * (`webhookSecret`, `stripeApiKey`).
+ *
+ * @stability experimental
+ */
+exports.METADATA_SECRET_FIELD_NAMES = [
+    'secretAccessKey',
+    'secretKey',
+    'sessionToken',
+    'secret',
+    'password',
+    'apiKey',
+    'token',
+    'privateKey',
+    'accessToken',
+    'refreshToken',
+    'authToken',
+    'bearer',
+    'authorization',
+    'credential',
+    'credentials',
+    'passphrase',
+    'clientSecret',
+    'signingKey',
+];
+const FOLDED_EXACT = new Set(exports.METADATA_SECRET_FIELD_NAMES.map((name) => fold(name)));
+const SUFFIXES = ['secret', 'password', 'passphrase', 'apikey', 'privatekey', 'secretkey', 'signingkey', 'accesstoken', 'refreshtoken', 'authtoken', 'sessiontoken'];
+function fold(name) {
+    return name.toLowerCase().replace(/[._\-\s]/g, '');
+}
+/**
+ * Whether a field name reads as a secret (see {@link METADATA_SECRET_FIELD_NAMES}).
+ *
+ * @param name - An object key or schema property name.
+ * @returns True when the name is one of the deny-list or ends in one of its suffixes.
+ * @stability experimental
+ */
+function isSecretFieldName(name) {
+    const folded = fold(name);
+    return FOLDED_EXACT.has(folded) || SUFFIXES.some((suffix) => folded.length > suffix.length && folded.endsWith(suffix));
+}
+/**
+ * Walks a zod schema (as its input JSON Schema) for secret-named properties
+ * and open shapes.
+ *
+ * @param schema - A zod schema.
+ * @returns The findings; all empty when the schema is acceptable.
+ * @throws Error when the schema cannot be introspected (for example a recursive `z.lazy`).
+ * @stability experimental
+ */
+function inspectMetadataSchema(schema) {
+    const root = zod_1.z.toJSONSchema(schema, { unrepresentable: 'any', io: 'input' });
+    const findings = { secretFields: [], openShapes: [], rootNotObject: root.type !== 'object' };
+    const visit = (node, path, isRoot) => {
+        const keys = Object.keys(node).filter((k) => k !== '$schema' && k !== 'description' && k !== 'title' && k !== 'default');
+        if (!isRoot && keys.length === 0)
+            findings.openShapes.push(path || '(root)');
+        if (node.additionalProperties === true || (typeof node.additionalProperties === 'object' && node.additionalProperties !== null && Object.keys(node.additionalProperties).length === 0)) {
+            findings.openShapes.push(`${path || '(root)'} (additional properties)`);
+        }
+        for (const [name, child] of Object.entries(node.properties ?? {})) {
+            const childPath = path ? `${path}.${name}` : name;
+            if (isSecretFieldName(name))
+                findings.secretFields.push(childPath);
+            visit(child, childPath, false);
+        }
+        if (node.additionalProperties && typeof node.additionalProperties === 'object' && Object.keys(node.additionalProperties).length > 0)
+            visit(node.additionalProperties, `${path}.*`, false);
+        const items = node.items;
+        if (Array.isArray(items))
+            items.forEach((item) => visit(item, `${path}[]`, false));
+        else if (items)
+            visit(items, `${path}[]`, false);
+        for (const list of [node.anyOf, node.oneOf, node.allOf, node.prefixItems])
+            for (const option of list ?? [])
+                visit(option, path, false);
+    };
+    visit(root, '', true);
+    return findings;
+}
+/**
+ * Every object key in a value, at any depth, that reads as a secret. The write
+ * side of the guard: it sees the keys of a `z.record`, which the schema walk
+ * cannot.
+ *
+ * @param value - A JSON value.
+ * @param path - The path of `value` (internal).
+ * @returns The dotted paths of offending keys; empty when none.
+ * @stability experimental
+ */
+function findSecretKeys(value, path = '') {
+    if (Array.isArray(value))
+        return value.flatMap((item, index) => findSecretKeys(item, `${path}[${index}]`));
+    if (value === null || typeof value !== 'object')
+        return [];
+    return Object.entries(value).flatMap(([key, child]) => {
+        const here = path ? `${path}.${key}` : key;
+        return [...(isSecretFieldName(key) ? [here] : []), ...findSecretKeys(child, here)];
+    });
+}
+//# sourceMappingURL=metadata-secret-guard.js.map

package/dist/identity/metadata/metadata-secret-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata-secret-guard.js","sourceRoot":"","sources":["../../../src/identity/metadata/metadata-secret-guard.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,uEAAuE;AACvE,8BAA8B;AAC9B,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,4EAA4E;AAC5E,kFAAkF;AAClF,iFAAiF;AACjF,+EAA+E;AAC/E,yEAAyE;AACzE,oBAAoB;AACpB,EAAE;AACF,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;;;AAoDhF,8CAGC;AAqCD,sDAsBC;AAYD,wCAOC;AAnID,6BAAwB;AAExB;;;;;;;;;;;;GAYG;AACU,QAAA,2BAA2B,GAAG;IACzC,iBAAiB;IACjB,WAAW;IACX,cAAc;IACd,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,aAAa;IACb,cAAc;IACd,WAAW;IACX,QAAQ;IACR,eAAe;IACf,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,cAAc;IACd,YAAY;CACJ,CAAC;AAEX,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,mCAA2B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpF,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAErK,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACzH,CAAC;AA4BD;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,MAAiB;IACrD,MAAM,IAAI,GAAG,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAmB,CAAC;IAC/F,MAAM,QAAQ,GAA2B,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;IACrH,MAAM,KAAK,GAAG,CAAC,IAAoB,EAAE,IAAY,EAAE,MAAe,EAAQ,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;QACzH,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB,KAAK,QAAQ,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACvL,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,0BAA0B,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAClD,IAAI,iBAAiB,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,IAAI,CAAC,oBAAoB,IAAI,OAAO,IAAI,CAAC,oBAAoB,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,oBAAsC,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5M,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;aAC9E,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC;YAAE,KAAK,MAAM,MAAM,IAAI,IAAI,IAAI,EAAE;gBAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACzI,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAAC,KAAc,EAAE,IAAI,GAAG,EAAE;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IAC3G,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/identity/organizations/doctor/tenancy-mode.doctor-check.d.ts

@@ -0,0 +1,49 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DoctorCheck, DoctorCheckOutcome, DoctorCheckRegistry } from '../../../doctor/index';
+import { type TenancyMode } from '../tenancy-mode';
+import type { IdentityPrisma } from '../../ports';
+import { TenancyService } from '../tenancy.service';
+/** What the check reads from the database. */
+export interface TenancyModeFacts {
+    /** Whether the organization flagged `isDefault` exists. */
+    defaultOrgExists: boolean;
+    /** Every organization, default included. */
+    organizations: number;
+    /**
+     * Active users the mode would not let through as they are:
+     * - `single`: without an active membership in the default organization
+     *   (they self-heal at their next sign-in);
+     * - `multi`: without an active membership in any organization (they are
+     *   refused at sign-in with `no_organization`).
+     */
+    usersWithoutMembership: number;
+}
+/**
+ * Pure: does the database agree with `TENANCY_MODE`?
+ *
+ * - `fail`: no default organization (the migration backfill and the seed both
+ *   create it, so neither ran).
+ * - `fail`: single mode with more than one organization. Switching multi back
+ *   to single with several orgs is unsupported; the remedy says so.
+ * - `warn`: single mode and active users without a default-org membership.
+ * - `pass`: otherwise. In multi mode, users with no organization are reported
+ *   in the detail and the data, not graded: being refused is the designed
+ *   behaviour there.
+ */
+export declare function decideTenancyMode(mode: TenancyMode, facts: TenancyModeFacts): DoctorCheckOutcome;
+/** `auth` / `tenancy.mode` — the database matches the deployment's tenancy mode. */
+export declare class TenancyModeDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly tenancy;
+    private readonly prisma;
+    readonly id = "tenancy.mode";
+    readonly category = "auth";
+    readonly label = "Tenancy mode";
+    readonly settingsPath = "/admin/settings/users";
+    readonly dependsOn: string[];
+    constructor(registry: DoctorCheckRegistry, tenancy: TenancyService, prisma: IdentityPrisma);
+    onModuleInit(): void;
+    /** Read-only: three counts. */
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=tenancy-mode.doctor-check.d.ts.map

package/dist/identity/organizations/doctor/tenancy-mode.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy-mode.doctor-check.d.ts","sourceRoot":"","sources":["../../../../src/identity/organizations/doctor/tenancy-mode.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAU,MAAM,gBAAgB,CAAC;AAElE,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,GAAG,kBAAkB,CAsDhG;AAED,oFAAoF;AACpF,qBACa,sBAAuB,YAAW,WAAW,EAAE,YAAY;IAQpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACC,OAAO,CAAC,QAAQ,CAAC,MAAM;IATlD,QAAQ,CAAC,EAAE,kBAAkB;IAC7B,QAAQ,CAAC,QAAQ,UAAU;IAC3B,QAAQ,CAAC,KAAK,kBAAkB;IAChC,QAAQ,CAAC,YAAY,2BAA2B;IAChD,QAAQ,CAAC,SAAS,WAAqB;gBAGpB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,cAAc,EACE,MAAM,EAAE,cAAc;IAGlE,YAAY,IAAI,IAAI;IAIpB,+BAA+B;IACzB,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAwBzC"}

package/dist/identity/organizations/doctor/tenancy-mode.doctor-check.js

@@ -0,0 +1,129 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenancyModeDoctorCheck = void 0;
+exports.decideTenancyMode = decideTenancyMode;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../doctor/index");
+const tenancy_mode_1 = require("../tenancy-mode");
+const index_2 = require("../../../core/index");
+const tenancy_service_1 = require("../tenancy.service");
+/**
+ * Pure: does the database agree with `TENANCY_MODE`?
+ *
+ * - `fail`: no default organization (the migration backfill and the seed both
+ *   create it, so neither ran).
+ * - `fail`: single mode with more than one organization. Switching multi back
+ *   to single with several orgs is unsupported; the remedy says so.
+ * - `warn`: single mode and active users without a default-org membership.
+ * - `pass`: otherwise. In multi mode, users with no organization are reported
+ *   in the detail and the data, not graded: being refused is the designed
+ *   behaviour there.
+ */
+function decideTenancyMode(mode, facts) {
+    const data = {
+        mode,
+        organizations: facts.organizations,
+        usersWithoutMembership: facts.usersWithoutMembership,
+    };
+    if (!facts.defaultOrgExists) {
+        return {
+            status: 'fail',
+            detail: 'No default organization exists',
+            remedy: 'Run the database migrations (npm run prisma:migrate) and the seed (npm run prisma:seed); ' +
+                'both create the default organization. Until then no new user can sign up.',
+            data,
+        };
+    }
+    if (mode === 'single' && facts.organizations > 1) {
+        return {
+            status: 'fail',
+            detail: `Single-org mode, but ${facts.organizations} organizations exist`,
+            remedy: `Set ${tenancy_mode_1.TENANCY_MODE_ENV_VAR}=multi in the deployment environment and restart the API, or ` +
+                'consolidate the organizations into the default one. Running several organizations in ' +
+                'single mode is unsupported.',
+            data,
+        };
+    }
+    if (mode === 'single' && facts.usersWithoutMembership > 0) {
+        return {
+            status: 'warn',
+            detail: `${facts.usersWithoutMembership} active user(s) are not members of the default organization`,
+            remedy: 'No action is required: each one is joined to the default organization at their next ' +
+                'sign-in. If the number keeps growing, check the sign-in logs for membership errors.',
+            data,
+        };
+    }
+    if (mode === 'single') {
+        return { status: 'pass', detail: 'Single-org: every active user is in the default organization', data };
+    }
+    return {
+        status: 'pass',
+        detail: facts.usersWithoutMembership > 0
+            ? `Multi-org: ${facts.organizations} organization(s); ${facts.usersWithoutMembership} active ` +
+                'user(s) belong to none and are refused at sign-in until invited'
+            : `Multi-org: ${facts.organizations} organization(s)`,
+        data,
+    };
+}
+/** `auth` / `tenancy.mode` — the database matches the deployment's tenancy mode. */
+let TenancyModeDoctorCheck = class TenancyModeDoctorCheck {
+    registry;
+    tenancy;
+    prisma;
+    id = 'tenancy.mode';
+    category = 'auth';
+    label = 'Tenancy mode';
+    settingsPath = '/admin/settings/users';
+    dependsOn = ['db.connection'];
+    constructor(registry, tenancy, prisma) {
+        this.registry = registry;
+        this.tenancy = tenancy;
+        this.prisma = prisma;
+    }
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    /** Read-only: three counts. */
+    async run() {
+        const mode = this.tenancy.mode();
+        const [defaultOrgs, organizations, usersWithoutMembership] = await Promise.all([
+            this.prisma.organization.count({ where: { isDefault: true } }),
+            this.prisma.organization.count(),
+            this.prisma.user.count({
+                where: {
+                    isActive: true,
+                    memberships: {
+                        none: mode === 'single'
+                            ? { status: 'active', org: { isDefault: true } }
+                            : { status: 'active' },
+                    },
+                },
+            }),
+        ]);
+        return decideTenancyMode(mode, {
+            defaultOrgExists: Number(defaultOrgs ?? 0) > 0,
+            organizations: Number(organizations ?? 0),
+            usersWithoutMembership: Number(usersWithoutMembership ?? 0),
+        });
+    }
+};
+exports.TenancyModeDoctorCheck = TenancyModeDoctorCheck;
+exports.TenancyModeDoctorCheck = TenancyModeDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(index_2.PLATFORM_PRISMA)),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry,
+        tenancy_service_1.TenancyService, Object])
+], TenancyModeDoctorCheck);
+//# sourceMappingURL=tenancy-mode.doctor-check.js.map

package/dist/identity/organizations/doctor/tenancy-mode.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy-mode.doctor-check.js","sourceRoot":"","sources":["../../../../src/identity/organizations/doctor/tenancy-mode.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAwCA,8CAsDC;AA9FD,2CAAkE;AAElE,iDAI+B;AAC/B,kDAAyE;AACzE,+CAAsD;AAEtD,wDAAoD;AAkBpD;;;;;;;;;;;GAWG;AACH,SAAgB,iBAAiB,CAAC,IAAiB,EAAE,KAAuB;IAC1E,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;KACrD,CAAC;IAEF,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gCAAgC;YACxC,MAAM,EACJ,2FAA2F;gBAC3F,2EAA2E;YAC7E,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,wBAAwB,KAAK,CAAC,aAAa,sBAAsB;YACzE,MAAM,EACJ,OAAO,mCAAoB,+DAA+D;gBAC1F,uFAAuF;gBACvF,6BAA6B;YAC/B,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,KAAK,CAAC,sBAAsB,6DAA6D;YACpG,MAAM,EACJ,sFAAsF;gBACtF,qFAAqF;YACvF,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,8DAA8D,EAAE,IAAI,EAAE,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,MAAM,EACJ,KAAK,CAAC,sBAAsB,GAAG,CAAC;YAC9B,CAAC,CAAC,cAAc,KAAK,CAAC,aAAa,qBAAqB,KAAK,CAAC,sBAAsB,UAAU;gBAC5F,iEAAiE;YACnE,CAAC,CAAC,cAAc,KAAK,CAAC,aAAa,kBAAkB;QACzD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,oFAAoF;AAE7E,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAQd;IACA;IACyB;IATnC,EAAE,GAAG,cAAc,CAAC;IACpB,QAAQ,GAAG,MAAM,CAAC;IAClB,KAAK,GAAG,cAAc,CAAC;IACvB,YAAY,GAAG,uBAAuB,CAAC;IACvC,SAAS,GAAG,CAAC,eAAe,CAAC,CAAC;IAEvC,YACmB,QAA6B,EAC7B,OAAuB,EACE,MAAsB;QAF/C,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,YAAO,GAAP,OAAO,CAAgB;QACE,WAAM,GAAN,MAAM,CAAgB;IAC/D,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,+BAA+B;IAC/B,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,sBAAsB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;YAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBACrB,KAAK,EAAE;oBACL,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAE;wBACX,IAAI,EACF,IAAI,KAAK,QAAQ;4BACf,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;4BAChD,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE;qBAC3B;iBACF;aACF,CAAC;SACH,CAAC,CAAC;QAEH,OAAO,iBAAiB,CAAC,IAAI,EAAE;YAC7B,gBAAgB,EAAE,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC;YAC9C,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YACzC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,CAAC,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA1CY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAWR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;qCAFG,2BAAmB;QACpB,gCAAc;GAT/B,sBAAsB,CA0ClC"}

package/dist/identity/organizations/dto/org-invite.dto.d.ts

@@ -0,0 +1,37 @@
+import { createOrgInviteSchema, orgInviteListQuerySchema, orgInviteResponseSchema } from '@marinoscar/platform-contract/identity';
+export { createOrgInviteSchema, orgInviteListQuerySchema, orgInviteResponseSchema, };
+declare const OrgInviteListQueryDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    page: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+    pageSize: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+    status: import("zod").ZodDefault<import("zod").ZodEnum<import("@marinoscar/platform-contract/identity").OrgInviteStatusFilterEnum>>;
+}, import("zod/v4/core").$strip>, false>;
+export declare class OrgInviteListQueryDto extends OrgInviteListQueryDto_base {
+}
+declare const CreateOrgInviteDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    email: import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string, string>>;
+    roleName: import("zod").ZodString;
+    notes: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strict>, false>;
+export declare class CreateOrgInviteDto extends CreateOrgInviteDto_base {
+}
+declare const OrgInviteResponseDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    id: import("zod").ZodUUID;
+    email: import("zod").ZodEmail;
+    role: import("zod").ZodString;
+    status: import("zod").ZodEnum<import("@marinoscar/platform-contract/identity").OrgInviteStatusEnum>;
+    notes: import("zod").ZodNullable<import("zod").ZodString>;
+    expiresAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+    createdAt: import("zod").ZodISODateTime;
+    acceptedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+    invitedBy: import("zod").ZodNullable<import("zod").ZodObject<{
+        id: import("zod").ZodUUID;
+        email: import("zod").ZodEmail;
+    }, import("zod/v4/core").$strip>>;
+    acceptedBy: import("zod").ZodNullable<import("zod").ZodObject<{
+        id: import("zod").ZodUUID;
+        email: import("zod").ZodEmail;
+    }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>, false>;
+export declare class OrgInviteResponseDto extends OrgInviteResponseDto_base {
+}
+//# sourceMappingURL=org-invite.dto.d.ts.map

package/dist/identity/organizations/dto/org-invite.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-invite.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/organizations/dto/org-invite.dto.ts"],"names":[],"mappings":"AACA,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAGhD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,GACxB,CAAC;;;;;;AAMF,qBAAa,qBAAsB,SAAQ,0BAAsC;CAAG;;;;;;AAEpF,qBAAa,kBAAmB,SAAQ,uBAAmC;CAAG;;;;;;;;;;;;;;;;;;;AAE9E,qBAAa,oBAAqB,SAAQ,yBAAqC;CAAG"}

package/dist/identity/organizations/dto/org-invite.dto.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgInviteResponseDto = exports.CreateOrgInviteDto = exports.OrgInviteListQueryDto = exports.orgInviteResponseSchema = exports.orgInviteListQuerySchema = exports.createOrgInviteSchema = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const identity_1 = require("@marinoscar/platform-contract/identity");
+Object.defineProperty(exports, "createOrgInviteSchema", { enumerable: true, get: function () { return identity_1.createOrgInviteSchema; } });
+Object.defineProperty(exports, "orgInviteListQuerySchema", { enumerable: true, get: function () { return identity_1.orgInviteListQuerySchema; } });
+Object.defineProperty(exports, "orgInviteResponseSchema", { enumerable: true, get: function () { return identity_1.orgInviteResponseSchema; } });
+// =============================================================================
+// The active organization's invitations: `/api/org/invites` (#726, PP-6.7)
+// =============================================================================
+class OrgInviteListQueryDto extends (0, nestjs_zod_1.createZodDto)(identity_1.orgInviteListQuerySchema) {
+}
+exports.OrgInviteListQueryDto = OrgInviteListQueryDto;
+class CreateOrgInviteDto extends (0, nestjs_zod_1.createZodDto)(identity_1.createOrgInviteSchema) {
+}
+exports.CreateOrgInviteDto = CreateOrgInviteDto;
+class OrgInviteResponseDto extends (0, nestjs_zod_1.createZodDto)(identity_1.orgInviteResponseSchema) {
+}
+exports.OrgInviteResponseDto = OrgInviteResponseDto;
+//# sourceMappingURL=org-invite.dto.js.map

package/dist/identity/organizations/dto/org-invite.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-invite.dto.js","sourceRoot":"","sources":["../../../../src/identity/organizations/dto/org-invite.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,qEAIgD;AAI9C,sGAPA,gCAAqB,OAOA;AACrB,yGAPA,mCAAwB,OAOA;AACxB,wGAPA,kCAAuB,OAOA;AAGzB,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAEhF,MAAa,qBAAsB,SAAQ,IAAA,yBAAY,EAAC,mCAAwB,CAAC;CAAG;AAApF,sDAAoF;AAEpF,MAAa,kBAAmB,SAAQ,IAAA,yBAAY,EAAC,gCAAqB,CAAC;CAAG;AAA9E,gDAA8E;AAE9E,MAAa,oBAAqB,SAAQ,IAAA,yBAAY,EAAC,kCAAuB,CAAC;CAAG;AAAlF,oDAAkF"}

package/dist/identity/organizations/dto/org-member.dto.d.ts

@@ -0,0 +1,29 @@
+import { ASSIGNABLE_ORG_ROLES, orgMemberListQuerySchema, orgMemberResponseSchema, updateOrgMemberSchema } from '@marinoscar/platform-contract/identity';
+export { ASSIGNABLE_ORG_ROLES, orgMemberListQuerySchema, orgMemberResponseSchema, updateOrgMemberSchema, };
+export type { AssignableOrgRole } from '@marinoscar/platform-contract/identity';
+declare const OrgMemberListQueryDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    page: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+    pageSize: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+    search: import("zod").ZodOptional<import("zod").ZodString>;
+    status: import("zod").ZodDefault<import("zod").ZodEnum<import("@marinoscar/platform-contract/identity").OrgMemberStatusFilterEnum>>;
+}, import("zod/v4/core").$strip>, false>;
+export declare class OrgMemberListQueryDto extends OrgMemberListQueryDto_base {
+}
+declare const UpdateOrgMemberDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    roleName: import("zod").ZodOptional<import("zod").ZodString>;
+    status: import("zod").ZodOptional<import("zod").ZodEnum<import("@marinoscar/platform-contract/identity").OrgMemberStatusEnum>>;
+}, import("zod/v4/core").$strict>, false>;
+export declare class UpdateOrgMemberDto extends UpdateOrgMemberDto_base {
+}
+declare const OrgMemberResponseDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    userId: import("zod").ZodUUID;
+    email: import("zod").ZodEmail;
+    displayName: import("zod").ZodNullable<import("zod").ZodString>;
+    role: import("zod").ZodString;
+    status: import("zod").ZodEnum<import("@marinoscar/platform-contract/identity").OrgMemberStatusEnum>;
+    lastActiveAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+    joinedAt: import("zod").ZodISODateTime;
+}, import("zod/v4/core").$strip>, false>;
+export declare class OrgMemberResponseDto extends OrgMemberResponseDto_base {
+}
+//# sourceMappingURL=org-member.dto.d.ts.map

package/dist/identity/organizations/dto/org-member.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-member.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/organizations/dto/org-member.dto.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,wCAAwC,CAAC;AAGhD,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,GACtB,CAAC;AACF,YAAY,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;;;;;;;AAMhF,qBAAa,qBAAsB,SAAQ,0BAAsC;CAAG;;;;;AAEpF,qBAAa,kBAAmB,SAAQ,uBAAmC;CAAG;;;;;;;;;;AAE9E,qBAAa,oBAAqB,SAAQ,yBAAqC;CAAG"}

package/dist/identity/organizations/dto/org-member.dto.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgMemberResponseDto = exports.UpdateOrgMemberDto = exports.OrgMemberListQueryDto = exports.updateOrgMemberSchema = exports.orgMemberResponseSchema = exports.orgMemberListQuerySchema = exports.ASSIGNABLE_ORG_ROLES = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const identity_1 = require("@marinoscar/platform-contract/identity");
+Object.defineProperty(exports, "ASSIGNABLE_ORG_ROLES", { enumerable: true, get: function () { return identity_1.ASSIGNABLE_ORG_ROLES; } });
+Object.defineProperty(exports, "orgMemberListQuerySchema", { enumerable: true, get: function () { return identity_1.orgMemberListQuerySchema; } });
+Object.defineProperty(exports, "orgMemberResponseSchema", { enumerable: true, get: function () { return identity_1.orgMemberResponseSchema; } });
+Object.defineProperty(exports, "updateOrgMemberSchema", { enumerable: true, get: function () { return identity_1.updateOrgMemberSchema; } });
+// =============================================================================
+// The active organization's members: `/api/org/members` (#726, PP-6.7)
+// =============================================================================
+class OrgMemberListQueryDto extends (0, nestjs_zod_1.createZodDto)(identity_1.orgMemberListQuerySchema) {
+}
+exports.OrgMemberListQueryDto = OrgMemberListQueryDto;
+class UpdateOrgMemberDto extends (0, nestjs_zod_1.createZodDto)(identity_1.updateOrgMemberSchema) {
+}
+exports.UpdateOrgMemberDto = UpdateOrgMemberDto;
+class OrgMemberResponseDto extends (0, nestjs_zod_1.createZodDto)(identity_1.orgMemberResponseSchema) {
+}
+exports.OrgMemberResponseDto = OrgMemberResponseDto;
+//# sourceMappingURL=org-member.dto.js.map

package/dist/identity/organizations/dto/org-member.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-member.dto.js","sourceRoot":"","sources":["../../../../src/identity/organizations/dto/org-member.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,qEAKgD;AAI9C,qGARA,+BAAoB,OAQA;AACpB,yGARA,mCAAwB,OAQA;AACxB,wGARA,kCAAuB,OAQA;AACvB,sGARA,gCAAqB,OAQA;AAIvB,gFAAgF;AAChF,uEAAuE;AACvE,gFAAgF;AAEhF,MAAa,qBAAsB,SAAQ,IAAA,yBAAY,EAAC,mCAAwB,CAAC;CAAG;AAApF,sDAAoF;AAEpF,MAAa,kBAAmB,SAAQ,IAAA,yBAAY,EAAC,gCAAqB,CAAC;CAAG;AAA9E,gDAA8E;AAE9E,MAAa,oBAAqB,SAAQ,IAAA,yBAAY,EAAC,kCAAuB,CAAC;CAAG;AAAlF,oDAAkF"}

package/dist/identity/organizations/dto/organization.dto.d.ts

@@ -0,0 +1,34 @@
+import { ORG_SLUG_PATTERN, createOrganizationSchema, organizationListQuerySchema, organizationResponseSchema, renameOrganizationSchema } from '@marinoscar/platform-contract/identity';
+export { ORG_SLUG_PATTERN, createOrganizationSchema, organizationListQuerySchema, organizationResponseSchema, renameOrganizationSchema, };
+declare const OrganizationListQueryDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    page: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+    pageSize: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+    search: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, false>;
+export declare class OrganizationListQueryDto extends OrganizationListQueryDto_base {
+}
+declare const CreateOrganizationDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    slug: import("zod").ZodString;
+    firstAdminEmail: import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string, string>>;
+}, import("zod/v4/core").$strict>, false>;
+export declare class CreateOrganizationDto extends CreateOrganizationDto_base {
+}
+declare const RenameOrganizationDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    name: import("zod").ZodString;
+}, import("zod/v4/core").$strict>, false>;
+/** Rename only: the slug is immutable here, and `isDefault` cannot be changed. */
+export declare class RenameOrganizationDto extends RenameOrganizationDto_base {
+}
+declare const OrganizationResponseDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    id: import("zod").ZodUUID;
+    name: import("zod").ZodString;
+    slug: import("zod").ZodString;
+    isDefault: import("zod").ZodBoolean;
+    memberCount: import("zod").ZodNumber;
+    createdAt: import("zod").ZodISODateTime;
+    updatedAt: import("zod").ZodISODateTime;
+}, import("zod/v4/core").$strip>, false>;
+export declare class OrganizationResponseDto extends OrganizationResponseDto_base {
+}
+//# sourceMappingURL=organization.dto.d.ts.map

package/dist/identity/organizations/dto/organization.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/organizations/dto/organization.dto.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,wCAAwC,CAAC;AAGhD,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,EAC1B,wBAAwB,GACzB,CAAC;;;;;;AAMF,qBAAa,wBAAyB,SAAQ,6BAAyC;CAAG;;;;;;AAE1F,qBAAa,qBAAsB,SAAQ,0BAAsC;CAAG;;;;AAEpF,kFAAkF;AAClF,qBAAa,qBAAsB,SAAQ,0BAAsC;CAAG;;;;;;;;;;AAEpF,qBAAa,uBAAwB,SAAQ,4BAAwC;CAAG"}

package/dist/identity/organizations/dto/organization.dto.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrganizationResponseDto = exports.RenameOrganizationDto = exports.CreateOrganizationDto = exports.OrganizationListQueryDto = exports.renameOrganizationSchema = exports.organizationResponseSchema = exports.organizationListQuerySchema = exports.createOrganizationSchema = exports.ORG_SLUG_PATTERN = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const identity_1 = require("@marinoscar/platform-contract/identity");
+Object.defineProperty(exports, "ORG_SLUG_PATTERN", { enumerable: true, get: function () { return identity_1.ORG_SLUG_PATTERN; } });
+Object.defineProperty(exports, "createOrganizationSchema", { enumerable: true, get: function () { return identity_1.createOrganizationSchema; } });
+Object.defineProperty(exports, "organizationListQuerySchema", { enumerable: true, get: function () { return identity_1.organizationListQuerySchema; } });
+Object.defineProperty(exports, "organizationResponseSchema", { enumerable: true, get: function () { return identity_1.organizationResponseSchema; } });
+Object.defineProperty(exports, "renameOrganizationSchema", { enumerable: true, get: function () { return identity_1.renameOrganizationSchema; } });
+// =============================================================================
+// The deployment's organizations: `/api/admin/organizations` (#726, PP-6.7)
+// =============================================================================
+class OrganizationListQueryDto extends (0, nestjs_zod_1.createZodDto)(identity_1.organizationListQuerySchema) {
+}
+exports.OrganizationListQueryDto = OrganizationListQueryDto;
+class CreateOrganizationDto extends (0, nestjs_zod_1.createZodDto)(identity_1.createOrganizationSchema) {
+}
+exports.CreateOrganizationDto = CreateOrganizationDto;
+/** Rename only: the slug is immutable here, and `isDefault` cannot be changed. */
+class RenameOrganizationDto extends (0, nestjs_zod_1.createZodDto)(identity_1.renameOrganizationSchema) {
+}
+exports.RenameOrganizationDto = RenameOrganizationDto;
+class OrganizationResponseDto extends (0, nestjs_zod_1.createZodDto)(identity_1.organizationResponseSchema) {
+}
+exports.OrganizationResponseDto = OrganizationResponseDto;
+//# sourceMappingURL=organization.dto.js.map

package/dist/identity/organizations/dto/organization.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.dto.js","sourceRoot":"","sources":["../../../../src/identity/organizations/dto/organization.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,qEAMgD;AAI9C,iGATA,2BAAgB,OASA;AAChB,yGATA,mCAAwB,OASA;AACxB,4GATA,sCAA2B,OASA;AAC3B,2GATA,qCAA0B,OASA;AAC1B,yGATA,mCAAwB,OASA;AAG1B,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAEhF,MAAa,wBAAyB,SAAQ,IAAA,yBAAY,EAAC,sCAA2B,CAAC;CAAG;AAA1F,4DAA0F;AAE1F,MAAa,qBAAsB,SAAQ,IAAA,yBAAY,EAAC,mCAAwB,CAAC;CAAG;AAApF,sDAAoF;AAEpF,kFAAkF;AAClF,MAAa,qBAAsB,SAAQ,IAAA,yBAAY,EAAC,mCAAwB,CAAC;CAAG;AAApF,sDAAoF;AAEpF,MAAa,uBAAwB,SAAQ,IAAA,yBAAY,EAAC,qCAA0B,CAAC;CAAG;AAAxF,0DAAwF"}

package/dist/identity/organizations/org-admin.common.d.ts

@@ -0,0 +1,34 @@
+import { ConflictException } from '@nestjs/common';
+import type { Principal } from '../../core/index';
+import type { IdentityTx } from '../data/identity-db';
+/**
+ * The organization an `/api/org/*` request acts on: the ACTIVE org of the
+ * request's principal, which the guard took from the signed token (or the
+ * PAT's / device session's binding) and checked is an active membership.
+ *
+ * NEVER an org id from the path, the query or the body: that is the
+ * confused-deputy hole this API is shaped to avoid (an admin of org A naming
+ * org B). A principal with no active org (a system-scoped node credential)
+ * is refused.
+ */
+export declare function requireActiveOrgId(principal: Principal | undefined): string;
+/** The rank of an org role name (0 for a role the platform does not rank). */
+export declare function orgRoleRank(roleName: string | null | undefined): number;
+/** `details.reason` of the 409 refusing to remove the last active org admin. */
+export declare const LAST_ORG_ADMIN_REASON = "LAST_ORG_ADMIN";
+/** `details.reason` of the 409 refusing to create an organization in single mode. */
+export declare const TENANCY_SINGLE_ORG_REASON = "TENANCY_SINGLE_ORG";
+/** The 409 for an action that would leave the organization without an active `org_admin`. */
+export declare function lastOrgAdminConflict(): ConflictException;
+/**
+ * Serializes the membership writes of one organization for the rest of the
+ * transaction (`SELECT ... FOR UPDATE` on its `organizations` row), so two
+ * administrators demoting each other at once cannot both pass the last-admin
+ * check. The lock is released when the transaction ends.
+ */
+export declare function lockOrganization(tx: IdentityTx, orgId: string): Promise<void>;
+/** Writes one audit row inside the caller's transaction. */
+export declare function writeAudit(tx: IdentityTx, actorUserId: string | null, action: string, targetType: string, targetId: string, meta: Record<string, unknown>): Promise<void>;
+/** The absolute sign-in URL for an invitation's CTA, or `undefined` without `APP_URL`. */
+export declare function signInUrlFrom(appUrl: string | undefined): string | undefined;
+//# sourceMappingURL=org-admin.common.d.ts.map

package/dist/identity/organizations/org-admin.common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-admin.common.d.ts","sourceRoot":"","sources":["../../../src/identity/organizations/org-admin.common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAsB,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAMtD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAM3E;AAaD,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEvE;AAED,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D,6FAA6F;AAC7F,wBAAgB,oBAAoB,IAAI,iBAAiB,CAMxD;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;AAED,4DAA4D;AAC5D,wBAAsB,UAAU,CAC9B,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE5E"}