@marinoscar/platform-contract 0.1.0-next.3 → 0.1.0-next.4

package/dist/cjs/identity/schemas.js

@@ -0,0 +1,684 @@
+"use strict";
+// =============================================================================
+// The identity slice's wire shapes (issue #727, PP-6.6)
+// =============================================================================
+//
+// What the sign-in, token, personal-access-token, device-authorization and
+// organization routes accept and return, as zod schemas plus their inferred
+// types. Shared by `@marinoscar/platform-api/identity` (which wraps the REQUEST
+// schemas as its nestjs-zod DTOs, so the OpenAPI document is generated from
+// them) and the web app (which takes the types).
+//
+// REQUEST SCHEMAS were moved here verbatim from the API's DTO files; their
+// field order, messages, `.describe()` texts and enum orders are part of the
+// published OpenAPI document. Change them only as a deliberate API change.
+//
+// RESPONSE SCHEMAS of the routes whose DTOs are `@ApiProperty` classes
+// (`/api/auth/me`, the token responses, personal access tokens, the device
+// flow) describe the same payload for clients. The classes stay the source of
+// the OpenAPI document; `@marinoscar/platform-api` pins that the two declare
+// the same fields (test/identity/contract-parity.spec.ts). The organization
+// response schemas ARE the OpenAPI source (their DTOs wrap them).
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgInviteResponseSchema = exports.createOrgInviteSchema = exports.orgInviteListQuerySchema = exports.orgMemberResponseSchema = exports.updateOrgMemberSchema = exports.orgMemberListQuerySchema = exports.roleListResponseSchema = exports.roleDescriptorSchema = exports.roleListQuerySchema = exports.roleIdSchema = exports.organizationResponseSchema = exports.renameOrganizationSchema = exports.createOrganizationSchema = exports.organizationListQuerySchema = exports.deviceSessionsResponseSchema = exports.deviceSessionSchema = exports.deviceActivateResponseSchema = exports.deviceAuthorizeResponseSchema = exports.deviceAuthorizeRequestSchema = exports.deviceTokenErrorSchema = exports.deviceTokenResponseSchema = exports.deviceTokenRequestSchema = exports.deviceCodeResponseSchema = exports.deviceCodeRequestSchema = exports.deviceClientInfoSchema = exports.deviceTokenTypeSchema = exports.patListItemSchema = exports.patCreatedResponseSchema = exports.createPatSchema = exports.switchOrgSchema = exports.tokenResponseSchema = exports.currentUserSchema = exports.userExtensionsSchema = exports.authMembershipSchema = exports.activeOrgSchema = exports.authRoleSchema = exports.authProvidersResponseSchema = exports.authProviderSchema = exports.authErrorCodeSchema = void 0;
+const zod_1 = require("zod");
+const constants_js_1 = require("./constants.js");
+// Factories, not shared instances: every field gets its own enum, exactly as
+// when each was written inline (the generated OpenAPI document is unchanged).
+const tenancyModeSchema = () => zod_1.z.enum(constants_js_1.TENANCY_MODES);
+const roleScopeSchema = () => zod_1.z.enum(constants_js_1.ROLE_SCOPES);
+const patDurationUnitSchema = () => zod_1.z.enum(constants_js_1.PAT_DURATION_UNITS);
+const deviceSessionStatusSchema = () => zod_1.z.enum(constants_js_1.DEVICE_SESSION_STATUSES);
+const deviceTokenErrorCodeSchema = () => zod_1.z.enum(constants_js_1.DEVICE_TOKEN_ERROR_CODES);
+const orgMemberStatusSchema = () => zod_1.z.enum(constants_js_1.ORG_MEMBER_STATUSES);
+const orgInviteStatusSchema = () => zod_1.z.enum(constants_js_1.ORG_INVITE_STATUSES);
+// =============================================================================
+// Sign-in
+// =============================================================================
+/**
+ * A sign-in failure code on the wire: the `error` query parameter of
+ * `/auth/callback`. A client that receives anything else shows the generic
+ * failure ({@link DEFAULT_AUTH_ERROR_CODE}) without echoing the value.
+ *
+ * @stability stable
+ */
+exports.authErrorCodeSchema = zod_1.z.enum(constants_js_1.AUTH_ERROR_CODES);
+/**
+ * One OAuth provider of `GET /api/auth/providers`.
+ *
+ * @stability stable
+ */
+exports.authProviderSchema = zod_1.z.object({
+    /** The provider id, e.g. `google`. */
+    name: zod_1.z.string(),
+    /** Whether the provider is configured and offered on the login page. */
+    enabled: zod_1.z.boolean(),
+    /** `custom` for a provider that owns its sign-in flow; absent for a redirect provider (`/api/auth/<name>`). */
+    mode: zod_1.z.literal('custom').optional(),
+});
+/**
+ * `GET /api/auth/providers`: every registered provider and whether it is enabled.
+ *
+ * @stability stable
+ */
+exports.authProvidersResponseSchema = zod_1.z.object({
+    /** The registered providers, in registration order. */
+    providers: zod_1.z.array(exports.authProviderSchema),
+});
+/**
+ * A role of the current user (`/api/auth/me` `roles[]`).
+ *
+ * @stability stable
+ */
+exports.authRoleSchema = zod_1.z.object({
+    /** The role name, e.g. `admin` or `viewer`. */
+    name: zod_1.z.string(),
+});
+/**
+ * The organization the session acts in (`/api/auth/me` `activeOrg`).
+ *
+ * @stability stable
+ */
+exports.activeOrgSchema = zod_1.z.object({
+    /** The organization's id (a UUID). */
+    id: zod_1.z.string(),
+    /** The organization's name. */
+    name: zod_1.z.string(),
+    /** The organization's slug. */
+    slug: zod_1.z.string(),
+});
+/**
+ * One organization the user is an active member of (`/api/auth/me`
+ * `memberships[]`).
+ *
+ * @stability stable
+ */
+exports.authMembershipSchema = zod_1.z.object({
+    /** The organization's id (a UUID). */
+    orgId: zod_1.z.string(),
+    /** The organization's name. */
+    name: zod_1.z.string(),
+    /** The organization's slug. */
+    slug: zod_1.z.string(),
+    /** The org role on this membership (`org_admin`, `contributor` or `viewer`). */
+    role: zod_1.z.string(),
+});
+/**
+ * What user extensions add to a user payload: `extensions` of `GET /api/auth/me`
+ * and of each row of `GET /api/users`. One entry per extension that contributed,
+ * keyed by the extension's id ({@link USER_EXTENSION_ID_PATTERN}); each value is
+ * a JSON object the extension chose, bounded by `USER_EXTENSION_LIMITS` and never
+ * a secret. Absent when no extension contributed.
+ *
+ * @extensionPoint schema
+ * @stability experimental
+ */
+exports.userExtensionsSchema = zod_1.z.record(zod_1.z.string().regex(constants_js_1.USER_EXTENSION_ID_PATTERN), zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()));
+/**
+ * `GET /api/auth/me`: the signed-in user, their roles and effective
+ * permissions in the active organization, the deployment's tenancy mode, the
+ * active organization and every organization they may switch to.
+ *
+ * @extensionPoint schema
+ * @stability stable
+ */
+exports.currentUserSchema = zod_1.z.object({
+    /** The user's id. */
+    id: zod_1.z.string(),
+    /** The user's email address. */
+    email: zod_1.z.string(),
+    /** Display name (computed from the override or the provider), or `null`. */
+    displayName: zod_1.z.string().nullable(),
+    /** The picture representing the user, resolved from `profile.imageSource`, or `null`. */
+    profileImageUrl: zod_1.z.string().nullable(),
+    /** The OAuth provider picture, regardless of the selected source, or `null`. */
+    providerProfileImageUrl: zod_1.z.string().nullable(),
+    /** Whether an uploaded picture is stored, regardless of the selected source. */
+    hasUploadedProfileImage: zod_1.z.boolean(),
+    /** Whether the account is active. */
+    isActive: zod_1.z.boolean(),
+    /** The system roles plus the role on the active organization membership. */
+    roles: zod_1.z.array(exports.authRoleSchema),
+    /** The effective permissions in the active organization. */
+    permissions: zod_1.z.array(zod_1.z.string()),
+    /** The deployment's tenancy mode (`TENANCY_MODE`). */
+    tenancyMode: tenancyModeSchema(),
+    /** The organization this session acts in, or `null` when the user has no active membership there. */
+    activeOrg: exports.activeOrgSchema.nullable(),
+    /** Every organization the user is an active member of, with the org role on each. */
+    memberships: zod_1.z.array(exports.authMembershipSchema),
+    /** What the app's current-user extensions added (`registerCurrentUserExtension`), by extension id. Absent when none contributed. */
+    extensions: exports.userExtensionsSchema.optional(),
+});
+/**
+ * `POST /api/auth/refresh` and `POST /api/auth/switch-org`: a new access token
+ * (the refresh token travels in the HttpOnly cookie, never in the body).
+ *
+ * @stability stable
+ */
+exports.tokenResponseSchema = zod_1.z.object({
+    /** The JWT access token, presented as `Authorization: Bearer <token>`. */
+    accessToken: zod_1.z.string(),
+    /** Its lifetime in seconds. */
+    expiresIn: zod_1.z.number(),
+});
+/**
+ * `POST /api/auth/switch-org` body: the organization to act in next. The ONLY
+ * place an org id enters the auth path from request input, and it is checked
+ * against the caller's active memberships before anything is issued.
+ *
+ * @stability stable
+ */
+exports.switchOrgSchema = zod_1.z.object({
+    /** The organization to switch to (an active membership of the caller). */
+    orgId: zod_1.z.uuid('orgId must be a UUID').describe('The organization to switch to (an active membership of the caller).'),
+});
+// =============================================================================
+// Personal access tokens
+// =============================================================================
+/**
+ * `POST /api/pat` body: a name, a lifetime and, optionally, the organization
+ * the token is bound to.
+ *
+ * @stability stable
+ */
+exports.createPatSchema = zod_1.z.object({
+    /** A human-readable name, 1 to 100 characters after trimming. */
+    name: zod_1.z
+        .string()
+        .trim()
+        .min(1, 'Name is required')
+        .max(constants_js_1.PAT_LIMITS.nameMaxLength, 'Name must be 100 characters or less'),
+    /** The lifetime, in `durationUnit`, 1 to 999. */
+    durationValue: zod_1.z
+        .number()
+        .int('Duration value must be an integer')
+        .min(constants_js_1.PAT_LIMITS.durationMin, 'Duration value must be at least 1')
+        .max(constants_js_1.PAT_LIMITS.durationMax, 'Duration value must be at most 999'),
+    /** The unit of `durationValue`. */
+    durationUnit: zod_1.z.enum(constants_js_1.PAT_DURATION_UNITS, {
+        error: 'Duration unit must be one of: minutes, days, months',
+    }),
+    /** The organization the token is bound to; defaults to the caller's active organization. */
+    orgId: zod_1.z
+        .uuid('orgId must be a UUID')
+        .optional()
+        .describe("The organization the token is bound to. Must be one you are an active member of; defaults to the caller's active organization."),
+});
+/**
+ * `POST /api/pat` response: the new token, whose raw value is shown only once.
+ *
+ * @stability stable
+ */
+exports.patCreatedResponseSchema = zod_1.z.object({
+    /** The raw token value (`pat_...`); shown only once. */
+    token: zod_1.z.string(),
+    /** The token's id. */
+    id: zod_1.z.string(),
+    /** Its name. */
+    name: zod_1.z.string(),
+    /** Its prefix, for identification (`pat_xxxx`). */
+    tokenPrefix: zod_1.z.string(),
+    /** ISO 8601 expiry. */
+    expiresAt: zod_1.z.string(),
+    /** ISO 8601 creation time. */
+    createdAt: zod_1.z.string(),
+    /** The organization the token is bound to. */
+    orgId: zod_1.z.string(),
+});
+/**
+ * One row of `GET /api/pat`. Never carries the token value.
+ *
+ * @stability stable
+ */
+exports.patListItemSchema = zod_1.z.object({
+    /** The token's id. */
+    id: zod_1.z.string(),
+    /** Its name. */
+    name: zod_1.z.string(),
+    /** Its prefix, for identification (`pat_xxxx`). */
+    tokenPrefix: zod_1.z.string(),
+    /** The duration value used when creating it. */
+    durationValue: zod_1.z.number(),
+    /** The duration unit used when creating it. */
+    durationUnit: patDurationUnitSchema(),
+    /** ISO 8601 expiry. */
+    expiresAt: zod_1.z.string(),
+    /** ISO 8601 time of last use, `null` if never used. */
+    lastUsedAt: zod_1.z.string().nullable(),
+    /** ISO 8601 creation time. */
+    createdAt: zod_1.z.string(),
+    /** ISO 8601 revocation time, `null` if not revoked. */
+    revokedAt: zod_1.z.string().nullable(),
+    /** The organization it is bound to; `null` only for a token created before tokens were bound. */
+    orgId: zod_1.z.string().nullable(),
+});
+// =============================================================================
+// Device authorization (RFC 8628)
+// =============================================================================
+/**
+ * The credential a device flow mints: `session` (default) or `pat`.
+ *
+ * `'session'` is the historical behaviour and MUST stay the default: the web
+ * activation page sends no `tokenType` at all.
+ *
+ * @stability stable
+ */
+exports.deviceTokenTypeSchema = zod_1.z.enum(constants_js_1.DEVICE_TOKEN_TYPES);
+/**
+ * Client information of a device authorization request.
+ *
+ * WARNING: every field arrives from an UNAUTHENTICATED caller, is persisted
+ * verbatim and is later rendered where a human trusts it (the activation
+ * page, the Access Tokens list). Treat it as hostile at every point of use.
+ *
+ * `tokenType` defaults to `session`; an unknown value is rejected with a 400,
+ * never quietly replaced.
+ *
+ * @stability stable
+ */
+exports.deviceClientInfoSchema = zod_1.z.object({
+    /** A name for the device, shown to the approving user. */
+    deviceName: zod_1.z.string().optional(),
+    /** The device's user agent. */
+    userAgent: zod_1.z.string().optional(),
+    /** The credential to mint on the poll after approval. */
+    tokenType: exports.deviceTokenTypeSchema.default('session'),
+});
+/**
+ * `POST /api/auth/device/code` body.
+ *
+ * @stability stable
+ */
+exports.deviceCodeRequestSchema = zod_1.z.object({
+    /** Optional client information. */
+    clientInfo: exports.deviceClientInfoSchema.optional(),
+});
+/**
+ * `POST /api/auth/device/code` response.
+ *
+ * @stability stable
+ */
+exports.deviceCodeResponseSchema = zod_1.z.object({
+    /** The opaque device verification code the device polls with. */
+    deviceCode: zod_1.z.string(),
+    /** The human-readable user code (`XXXX-XXXX`). */
+    userCode: zod_1.z.string(),
+    /** The `/activate` page of this deployment. */
+    verificationUri: zod_1.z.string(),
+    /** The same URI with the user code pre-filled as `code`. */
+    verificationUriComplete: zod_1.z.string(),
+    /** Lifetime of the codes, in seconds. */
+    expiresIn: zod_1.z.number(),
+    /** Minimum polling interval, in seconds. */
+    interval: zod_1.z.number(),
+});
+/**
+ * `POST /api/auth/device/token` body.
+ *
+ * @stability stable
+ */
+exports.deviceTokenRequestSchema = zod_1.z.object({
+    /** The `deviceCode` of `POST /api/auth/device/code`. */
+    deviceCode: zod_1.z.string().min(1, 'Device code is required'),
+});
+/**
+ * `POST /api/auth/device/token` success: a session credential (access plus
+ * refresh token) or, when `credentialType` is `pat`, a personal access token.
+ *
+ * @stability stable
+ */
+exports.deviceTokenResponseSchema = zod_1.z.object({
+    /** The credential, presented as `Authorization: Bearer <token>`. */
+    accessToken: zod_1.z.string(),
+    /** The refresh token; session credential only. */
+    refreshToken: zod_1.z.string().optional(),
+    /** Always `Bearer`. */
+    tokenType: zod_1.z.string(),
+    /** Lifetime in seconds. */
+    expiresIn: zod_1.z.number(),
+    /** `pat` when a personal access token was issued; absent for a session credential. */
+    credentialType: zod_1.z.literal('pat').optional(),
+    /** Absolute ISO 8601 expiry; PAT only. */
+    expiresAt: zod_1.z.string().optional(),
+    /** The issued PAT's id; PAT only. */
+    tokenId: zod_1.z.string().optional(),
+    /** The issued PAT's name; PAT only. */
+    tokenName: zod_1.z.string().optional(),
+});
+/**
+ * `POST /api/auth/device/token` failure (RFC 8628 section 3.5). Branch on
+ * `error`, never on the description or the status.
+ *
+ * @stability stable
+ */
+exports.deviceTokenErrorSchema = zod_1.z.object({
+    /** The RFC error code. */
+    error: deviceTokenErrorCodeSchema(),
+    /** Human-readable prose; may change. */
+    error_description: zod_1.z.string(),
+});
+/**
+ * `POST /api/auth/device/authorize` body: approve or deny a user code.
+ *
+ * @stability stable
+ */
+exports.deviceAuthorizeRequestSchema = zod_1.z.object({
+    /** The user code shown on the device (`XXXX-XXXX`). */
+    userCode: zod_1.z
+        .string()
+        .min(1, 'User code is required')
+        .regex(constants_js_1.DEVICE_USER_CODE_PATTERN, 'Invalid user code format'),
+    /** `true` approves, `false` denies. */
+    approve: zod_1.z.boolean(),
+});
+/**
+ * `POST /api/auth/device/authorize` response.
+ *
+ * @stability stable
+ */
+exports.deviceAuthorizeResponseSchema = zod_1.z.object({
+    /** Whether the operation succeeded. */
+    success: zod_1.z.boolean(),
+    /** A result message. */
+    message: zod_1.z.string(),
+});
+/**
+ * `GET /api/auth/device/activate` response: what the activation page shows.
+ *
+ * @stability stable
+ */
+exports.deviceActivateResponseSchema = zod_1.z.object({
+    /** The `/activate` page of this deployment. */
+    verificationUri: zod_1.z.string(),
+    /** The user code, when one was given in the query. */
+    userCode: zod_1.z.string().optional(),
+    /** The device's client information, when the code is valid. */
+    clientInfo: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+    /** The code's expiry, when the code is valid. */
+    expiresAt: zod_1.z.string().optional(),
+});
+/**
+ * One device session of `GET /api/auth/device/sessions`.
+ *
+ * @stability stable
+ */
+exports.deviceSessionSchema = zod_1.z.object({
+    /** The session's id. */
+    id: zod_1.z.string(),
+    /** Its user code. */
+    userCode: zod_1.z.string(),
+    /** Its status. */
+    status: deviceSessionStatusSchema(),
+    /** The device's client information. */
+    clientInfo: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+    /** When the device started the flow. */
+    createdAt: zod_1.z.string(),
+    /** When the device CODE expires. */
+    expiresAt: zod_1.z.string(),
+    /** When the device collected its credential, `null` until then. */
+    collectedAt: zod_1.z.string().nullable(),
+    /** When the collected credential expires, `null` until collection. */
+    credentialExpiresAt: zod_1.z.string().nullable(),
+    /** The kind of credential collected, `null` until collection. */
+    credentialType: exports.deviceTokenTypeSchema.nullable(),
+});
+/**
+ * `GET /api/auth/device/sessions`: one page of device sessions, newest first.
+ *
+ * @stability stable
+ */
+exports.deviceSessionsResponseSchema = zod_1.z.object({
+    /** The sessions on this page. */
+    sessions: zod_1.z.array(exports.deviceSessionSchema),
+    /** The number of listed sessions across all pages. */
+    total: zod_1.z.number(),
+    /** The current page. */
+    page: zod_1.z.number(),
+    /** The page size. */
+    limit: zod_1.z.number(),
+});
+// =============================================================================
+// Organizations, members and invitations (issue #726)
+// =============================================================================
+const orgName = zod_1.z
+    .string()
+    .trim()
+    .min(1, 'Name is required')
+    .max(100, 'Name must be 100 characters or less');
+/**
+ * `GET /api/admin/organizations` query: paging and an optional name or slug search.
+ *
+ * @stability stable
+ */
+exports.organizationListQuerySchema = zod_1.z.object({
+    /** One-based page number. */
+    page: zod_1.z.coerce.number().int().min(1).default(1),
+    /** Page size, 1 to 100. */
+    pageSize: zod_1.z.coerce.number().int().min(1).max(100).default(20),
+    /** Matches the name or slug, case-insensitively. */
+    search: zod_1.z.string().trim().max(100).optional(),
+});
+/**
+ * `POST /api/admin/organizations` body: a name, a slug and the email of the
+ * first organization administrator (invited).
+ *
+ * @stability stable
+ */
+exports.createOrganizationSchema = zod_1.z
+    .object({
+    /** The organization's name. */
+    name: orgName,
+    /** The organization's slug, see {@link ORG_SLUG_PATTERN}. */
+    slug: zod_1.z
+        .string()
+        .trim()
+        .toLowerCase()
+        .regex(constants_js_1.ORG_SLUG_PATTERN, 'Slug must be 2-63 lower-case letters, digits or hyphens, starting and ending with a letter or digit'),
+    /** Who is invited as the first organization administrator. */
+    firstAdminEmail: zod_1.z
+        .string()
+        .trim()
+        .email('Invalid email format')
+        .transform((email) => email.toLowerCase()),
+})
+    .strict();
+/**
+ * `PATCH /api/admin/organizations/:id` body: a new name. The slug never changes.
+ *
+ * @stability stable
+ */
+exports.renameOrganizationSchema = zod_1.z
+    .object({
+    /** The new name. */
+    name: orgName,
+})
+    .strict();
+/**
+ * One organization, as the admin organization routes return it.
+ *
+ * @stability stable
+ */
+exports.organizationResponseSchema = zod_1.z.object({
+    /** The organization's id. */
+    id: zod_1.z.uuid(),
+    /** Its name. */
+    name: zod_1.z.string(),
+    /** Its slug. */
+    slug: zod_1.z.string(),
+    /** Whether it is the deployment's default organization. */
+    isDefault: zod_1.z.boolean(),
+    /** Its number of memberships. */
+    memberCount: zod_1.z.number().int(),
+    /** ISO 8601 creation time. */
+    createdAt: zod_1.z.iso.datetime(),
+    /** ISO 8601 last update time. */
+    updatedAt: zod_1.z.iso.datetime(),
+});
+/**
+ * A role id on the wire: lower-case letters, digits, `_` and `-`, starting with
+ * a letter ({@link ROLE_ID_PATTERN}). Only the SHAPE is checked here; whether
+ * the role exists, has the right scope and may be assigned is decided by the
+ * API against the role registry (a 400 whose `details.reason` is
+ * `ROLE_NOT_ASSIGNABLE`).
+ *
+ * @stability experimental
+ */
+exports.roleIdSchema = zod_1.z
+    .string()
+    .regex(constants_js_1.ROLE_ID_PATTERN, 'A role id is lower-case letters, digits, "_" and "-", starting with a letter')
+    .describe('A role id (for example `viewer` or an app role such as `coach`).');
+/**
+ * `GET /api/roles` query: the scope to list. Without it the API lists every
+ * scope the caller may read (`users:read` for `system`, `org_members:read`
+ * for `org`).
+ *
+ * @stability experimental
+ */
+exports.roleListQuerySchema = zod_1.z.object({
+    /** `system` or `org`. */
+    scope: roleScopeSchema().optional().describe('Only roles of this scope. Omit for every scope the caller may read.'),
+});
+/**
+ * One role as `GET /api/roles` describes it.
+ *
+ * @stability experimental
+ */
+exports.roleDescriptorSchema = zod_1.z.object({
+    /** The role id (`roles.name`). */
+    id: exports.roleIdSchema,
+    /** A short display name. */
+    label: zod_1.z.string(),
+    /** What the role is for. */
+    description: zod_1.z.string(),
+    /** `system` (held in `user_roles`) or `org` (held on a membership). */
+    scope: roleScopeSchema(),
+    /** Whether a caller may assign it through the invite, member and user-role routes. */
+    assignable: zod_1.z.boolean(),
+});
+/**
+ * `GET /api/roles` response data: the roles, in registration order.
+ *
+ * @stability experimental
+ */
+exports.roleListResponseSchema = zod_1.z.array(exports.roleDescriptorSchema);
+/**
+ * `GET /api/org/members` query: paging, a search and a status filter.
+ *
+ * @stability stable
+ */
+exports.orgMemberListQuerySchema = zod_1.z.object({
+    /** One-based page number. */
+    page: zod_1.z.coerce.number().int().min(1).default(1),
+    /** Page size, 1 to 100. */
+    pageSize: zod_1.z.coerce.number().int().min(1).max(100).default(20),
+    /** Matches the email or display name. */
+    search: zod_1.z.string().trim().max(200).optional(),
+    /** Which memberships to list. */
+    status: zod_1.z.enum(['all', ...constants_js_1.ORG_MEMBER_STATUSES]).default('all'),
+});
+/**
+ * `PATCH /api/org/members/:userId` body: a new org role, a new status, or both.
+ *
+ * @stability stable
+ */
+exports.updateOrgMemberSchema = zod_1.z
+    .object({
+    /** The new org role. */
+    roleName: exports.roleIdSchema.optional(),
+    /** The new status. */
+    status: orgMemberStatusSchema().optional(),
+})
+    .strict()
+    .refine((value) => value.roleName !== undefined || value.status !== undefined, {
+    message: 'Provide roleName, status or both',
+});
+/**
+ * One member of the active organization.
+ *
+ * @stability stable
+ */
+exports.orgMemberResponseSchema = zod_1.z.object({
+    /** The member's user id. */
+    userId: zod_1.z.uuid(),
+    /** Their email. */
+    email: zod_1.z.email(),
+    /** Their display name, or `null`. */
+    displayName: zod_1.z.string().nullable(),
+    /** Their org role. */
+    role: zod_1.z.string(),
+    /** The membership's status. */
+    status: orgMemberStatusSchema(),
+    /** ISO 8601 time of their last activity, or `null`. */
+    lastActiveAt: zod_1.z.iso.datetime().nullable(),
+    /** ISO 8601 time the membership was created. */
+    joinedAt: zod_1.z.iso.datetime(),
+});
+/**
+ * `GET /api/org/invites` query: paging and a status filter.
+ *
+ * @stability stable
+ */
+exports.orgInviteListQuerySchema = zod_1.z.object({
+    /** One-based page number. */
+    page: zod_1.z.coerce.number().int().min(1).default(1),
+    /** Page size, 1 to 100. */
+    pageSize: zod_1.z.coerce.number().int().min(1).max(100).default(20),
+    /** Which invitations to list. */
+    status: zod_1.z.enum(['all', ...constants_js_1.ORG_INVITE_STATUSES]).default('all'),
+});
+/**
+ * `POST /api/org/invites` body: who to invite, with which org role. Takes no
+ * org id: the invitation is always for the caller's active organization.
+ *
+ * @stability stable
+ */
+exports.createOrgInviteSchema = zod_1.z
+    .object({
+    /** The invitee's email, lower-cased. */
+    email: zod_1.z
+        .string()
+        .trim()
+        .email('Invalid email format')
+        .transform((email) => email.toLowerCase()),
+    /** The org role the invitee gets on accepting. */
+    roleName: exports.roleIdSchema,
+    /** An optional note, up to 500 characters. */
+    notes: zod_1.z.string().max(500, 'Notes must be 500 characters or less').optional(),
+})
+    .strict();
+const actorSchema = zod_1.z.object({
+    /** The user's id. */
+    id: zod_1.z.uuid(),
+    /** The user's email. */
+    email: zod_1.z.email(),
+});
+/**
+ * One invitation of the active organization.
+ *
+ * @stability stable
+ */
+exports.orgInviteResponseSchema = zod_1.z.object({
+    /** The invitation's id. */
+    id: zod_1.z.uuid(),
+    /** The invitee's email. */
+    email: zod_1.z.email(),
+    /** The org role it grants. */
+    role: zod_1.z.string(),
+    /** Its status. */
+    status: orgInviteStatusSchema(),
+    /** The note, or `null`. */
+    notes: zod_1.z.string().nullable(),
+    /** ISO 8601 expiry, or `null`. */
+    expiresAt: zod_1.z.iso.datetime().nullable(),
+    /** ISO 8601 creation time. */
+    createdAt: zod_1.z.iso.datetime(),
+    /** ISO 8601 acceptance time, or `null`. */
+    acceptedAt: zod_1.z.iso.datetime().nullable(),
+    /** Who sent it, or `null`. */
+    invitedBy: actorSchema.nullable(),
+    /** Who accepted it, or `null`. */
+    acceptedBy: actorSchema.nullable(),
+});
+//# sourceMappingURL=schemas.js.map