@nodaro/shared 2.7.0 → 2.10.0

package/src/llm-models.ts

@@ -15,6 +15,7 @@
 
 export type LlmTier = "economy" | "standard" | "premium"
 export type KieApiFormat = "chat-completions" | "messages" | "responses"
+export type LlmVendor = "anthropic" | "google" | "openai" | "xai"
 
 export const LLM_REASONING_EFFORTS = ["none", "low", "medium", "high", "xhigh", "max"] as const
 export type LlmReasoningEffort = (typeof LLM_REASONING_EFFORTS)[number]
@@ -32,7 +33,7 @@ export interface LlmModelDef {
    *  For messages: the model id sent in the body (e.g. "claude-haiku-4-5-v1messages").
    *  For responses: the model id sent in the body (e.g. "gpt-5-4"). */
   kieSlugOrModel: string
-  vendor: "anthropic" | "google" | "openai"
+  vendor: LlmVendor
   supportsImages: boolean
   maxOutputTokens: number
   /**
@@ -159,6 +160,30 @@ export const LLM_MODELS: readonly LlmModelDef[] = [
     // direct is the reliability fallback only.
     directGeminiModel: "gemini-3.6-flash",
   },
+  {
+    id: "gemini-3.7-flash",
+    displayName: "Gemini 3.7 Flash",
+    desc: "Newest fast Gemini, agentic-tuned",
+    tier: "economy",
+    kieFormat: "chat-completions",
+    // KIE serves it on the OpenAI-compatible dialect under this slug
+    // (docs.kie.ai/market/gemini/gemini-3-7-flash-openai.md) — same
+    // chat-completions path shape as gemini-3.6-flash.
+    kieSlugOrModel: "gemini-3-7-flash-openai",
+    vendor: "google",
+    structuredOutputMode: "kie-response-format",
+    supportsImages: true,
+    // Google's own cap is 65,536, but the field feeds BOTH lanes and the KIE
+    // flash endpoints cap at 8192 (the measured 3.6 posture) — stay at the
+    // KIE-safe intersection, same reasoning as `reasoningEfforts` below.
+    maxOutputTokens: 8192,
+    // KIE's 3.7 endpoint enumerates reasoning_effort low | high (verified
+    // against its OpenAPI spec 2026-08-18), identical to 3.6.
+    reasoningEfforts: ["low", "high"],
+    // Assumed parity with 3.6 pending a live probe on the direct lane.
+    directReasoningEfforts: ["none", "low", "medium", "high"],
+    directGeminiModel: "gemini-3.7-flash",
+  },
   {
     id: "claude-haiku-4.5",
     displayName: "Claude Haiku 4.5",
@@ -321,7 +346,35 @@ export const LLM_MODELS: readonly LlmModelDef[] = [
     reasoningEfforts: ["none", "low", "medium", "high", "xhigh", "max"],
     supportsTemperature: false,
   },
-  // grok-4.5 deferred — KIE chat endpoint not yet live (2026-07-13); add entry + rate row + docs when it activates.
+  {
+    id: "grok-4.6",
+    displayName: "Grok 4.6",
+    desc: "xAI flagship, strong reasoning",
+    tier: "standard",
+    kieFormat: "responses",
+    // KIE serves Grok on the responses dialect under its own family path —
+    // grok/v1/responses, NOT codex/v1/responses (llm-client derives the path
+    // from `vendor`). Live-verified end-to-end 2026-08-18: array `input`,
+    // `developer` system role, `input_image` URL vision, `text.format`
+    // json_schema enforcement, SSE `response.output_text.delta` stream, and
+    // `credits_consumed` actual-cost capture. (grok-4.5 was deferred 2026-07-13
+    // because none of this was live; 4.6 is its activation.)
+    kieSlugOrModel: "grok-4-6",
+    vendor: "xai",
+    structuredOutputMode: "responses-json-schema",
+    supportsImages: true,
+    maxOutputTokens: 16384,
+    // KIE's documented enum, each level live-verified (echoed back) 2026-08-18.
+    // No `none`: the endpoint reasons unconditionally (see thinkingDefaultOn).
+    reasoningEfforts: ["low", "medium", "high", "xhigh"],
+    // Live-probed 2026-08-18: `temperature` is silently IGNORED (request echo
+    // stays at the 0.7 default), so never send it — same treatment as GPT-5.5+.
+    supportsTemperature: false,
+    // Reasons with NO reasoning param sent (effort defaults to "low" server-side
+    // — a trivial probe spent 169 of 170 output tokens on reasoning), so every
+    // call needs output headroom, not just xhigh.
+    thinkingDefaultOn: true,
+  },
   {
     id: "claude-sonnet-5",
     displayName: "Claude Sonnet 5",
@@ -407,6 +460,55 @@ export const STRUCTURED_VISION_MODELS = LLM_MODELS.filter(
   (m) => m.supportsImages && m.structuredOutputMode != null,
 )
 
+/**
+ * Vendor presentation order + labels for model pickers. Every LlmVendor MUST
+ * appear in the order list (guarded by a registry test) so a new vendor can't
+ * ship with its models silently sorted to the end of every menu unlabeled.
+ * Alphabetical on purpose: stable, and no vendor-preference fights.
+ */
+export const LLM_VENDOR_ORDER: readonly LlmVendor[] = ["anthropic", "google", "openai", "xai"]
+export const LLM_VENDOR_LABELS: Record<LlmVendor, string> = {
+  anthropic: "Anthropic",
+  google: "Google",
+  openai: "OpenAI",
+  xai: "xAI",
+}
+
+const TIER_RANK: Record<LlmTier, number> = { economy: 0, standard: 1, premium: 2 }
+
+export interface LlmModelGroup {
+  vendor: LlmVendor
+  /** Display heading for the group (LLM_VENDOR_LABELS[vendor]). */
+  label: string
+  models: LlmModelDef[]
+}
+
+/**
+ * The ONE ordering every LLM model menu renders: grouped by vendor (in
+ * LLM_VENDOR_ORDER), and inside each group sorted economy → standard → premium
+ * (registry order breaks ties, which keeps family generations adjacent).
+ * A flat registry-order dump was genuinely hard to scan at 17 models — every
+ * picker (config panel, quick strips, quick toolbar) derives from this so the
+ * menus can't drift apart. Groups with no models (after `filter`) are omitted.
+ */
+export function groupLlmModelsByVendor(models: readonly LlmModelDef[] = LLM_MODELS): LlmModelGroup[] {
+  const groups: LlmModelGroup[] = []
+  for (const vendor of LLM_VENDOR_ORDER) {
+    const members = models
+      .filter((m) => m.vendor === vendor)
+      .sort((a, b) => TIER_RANK[a.tier] - TIER_RANK[b.tier])
+    if (members.length > 0) groups.push({ vendor, label: LLM_VENDOR_LABELS[vendor], models: members })
+  }
+  return groups
+}
+
+/** {@link groupLlmModelsByVendor} flattened — for menus that can't render
+ *  group headers (e.g. the compact node quick strips) but should still read
+ *  vendor-clustered and tier-ordered. */
+export function orderedLlmModels(models: readonly LlmModelDef[] = LLM_MODELS): LlmModelDef[] {
+  return groupLlmModelsByVendor(models).flatMap((g) => g.models)
+}
+
 export type LlmFeature =
   | "ai-writer"
   | "llm-chat"
@@ -427,6 +529,9 @@ export type LlmFeature =
   // feature (not ai-writer, which it used to piggyback on) so the model
   // default and the tiered credit ids are the strategy's own.
   | "pick-best-llm"
+  // In-app Workflow Copilot turns (backend agent loop; metered, reservation
+  // ceiling under `STATIC_CREDIT_COSTS["workflow-copilot"]`).
+  | "workflow-copilot"
 
 /** Engine-dependent LlmFeature for the motion-graphics node (design §8: every credit-id site must branch on engine). */
 export function motionGraphicsFeature(engine?: string): LlmFeature {
@@ -451,6 +556,7 @@ export const LLM_FEATURE_DEFAULTS: Record<LlmFeature, string> = {
   "translate": "gemini-3.6-flash",
   "image-critic": "claude-sonnet-4.6",
   "pick-best-llm": "claude-sonnet-4.6",
+  "workflow-copilot": "claude-sonnet-5",
 }
 
 /**
@@ -465,6 +571,12 @@ export const LLM_FEATURE_DEFAULTS: Record<LlmFeature, string> = {
 export const LLM_MODALITY_CAPS: Record<string, { image: boolean; video: boolean; audio: boolean }> = {
   "gemini-3-flash":    { image: true,  video: true,  audio: true  },
   "gemini-3.6-flash":  { image: true,  video: true,  audio: true  },
+  // gemini-3.7-flash is IMAGE-ONLY by DECISION, not omission: full video+audio
+  // caps would auto-enroll it in VIDEO_ANALYSIS_LLM_MODELS (derived below) and
+  // force a video-analysis tier + pricing decision that is deliberately
+  // deferred while the smart-family A/B routes this model internally (#747).
+  // Flip these two flags ONLY together with that VA-side decision.
+  "gemini-3.7-flash":  { image: true,  video: false, audio: false },
   "gemini-3.1-pro":    { image: true,  video: true,  audio: true  },
   "claude-haiku-4.5":  { image: true,  video: false, audio: false },
   "claude-sonnet-4.6": { image: true,  video: false, audio: false },
@@ -475,6 +587,7 @@ export const LLM_MODALITY_CAPS: Record<string, { image: boolean; video: boolean;
   "gpt-5.6-luna":      { image: true,  video: false, audio: false },
   "gpt-5.6-terra":     { image: true,  video: false, audio: false },
   "gpt-5.6-sol":       { image: true,  video: false, audio: false },
+  "grok-4.6":          { image: true,  video: false, audio: false },
   "claude-sonnet-5":   { image: true,  video: false, audio: false },
   "claude-opus-4.8":   { image: true,  video: false, audio: false },
   "claude-opus-5":     { image: true,  video: false, audio: false },

package/src/model-catalog.ts

@@ -886,6 +886,9 @@ const IMAGE_MODELS: Record<string, ModelCatalogEntry> = {
     description:
       "Grok Imagine Image 2.0 — expressive, high-contrast t2i. Generations chain into grok-2-segment (free named region masks) and grok-2-edit (region-targeted edits).",
     useCases: ["stylized", "expressive", "general"],
+    // Refs auto-route to grok-2-i2i (segment-map → image-edit chain); ONE
+    // reference (REF_IMAGE_MAX_LIMITS).
+    features: ["reference-image"],
     aspectRatios: GROK_RATIOS,
     pricing: [{ identifier: "grok-2", credits: 10 }],
   },
@@ -901,6 +904,22 @@ const IMAGE_MODELS: Record<string, ModelCatalogEntry> = {
     useCases: ["edit", "region-edit"],
     pricing: [{ identifier: "grok-2-edit", credits: 10 }],
   },
+  // Auto-selected when references are attached to grok-2 (T2I_TO_I2I_VARIANT):
+  // the t2i endpoint takes no image, so the FREE segment-map mints a task id
+  // from the reference URL and image-edit consumes it. Single reference.
+  "grok-2-i2i": {
+    id: "grok-2-i2i",
+    kind: "image",
+    modes: ["i2i"] as const,
+    family: "xAI",
+    label: "Grok Imagine 2 (reference)",
+    series: "Grok",
+    description:
+      "grok-2 guided by ONE reference image via the segment-map → image-edit chain — preserves the reference's composition while applying the prompt.",
+    useCases: ["restyle", "edit", "reference"],
+    features: ["reference-image"],
+    pricing: [{ identifier: "grok-2-i2i", credits: 10 }],
+  },
   "grok-2-segment": {
     id: "grok-2-segment",
     kind: "image",

package/src/model-constants.ts

@@ -5,7 +5,7 @@
 import { z } from "zod"
 import { MODEL_CATALOG } from "./model-catalog.js"
 
-/** Base USD cost per 1 Nodaro credit, at cost. Used for cost→credit conversion. */
+/** Base USD value of 1 Nodaro credit. Used for cost→credit conversion. */
 export const CREDIT_BASE_USD = 0.002
 
 /** Max characters for the (assembled) prompt accepted by the image-generation routes
@@ -232,16 +232,25 @@ export function getMaxTtsChars(provider: string | undefined): number {
  * Suno per-version field caps (from docs.kie.ai/suno-api/generate-music). The old
  * flat {@link SUNO_TEXT_MAX} (3000) was simultaneously too low for V4.5+/V5
  * prompts (5000) and too high for `style` (1000) and `title` (80).
- *   - prompt / lyrics: 500 in non-custom mode (all versions); in custom mode
+ *   - prompt / lyrics: 3000 in non-custom mode (all versions); in custom mode
  *     3000 for V4/V3.5 and 5000 for V4.5 / V4.5PLUS / V4.5ALL / V5 / V5.5.
  *   - style: 200 for V4/V3.5, 1000 for V4.5+.
  *   - title: 80 (all versions).
  */
 export const SUNO_TITLE_MAX = 80
 
-/** Max Suno `prompt` (= lyrics in custom mode) length for a model version. */
+/**
+ * Max Suno `prompt` (= lyrics in custom mode) length for a model version.
+ *
+ * NON-CUSTOM WAS 500 UNTIL 2026-08-19 — six times under the provider's
+ * documented 3000, and the route TRUNCATES to this number instead of
+ * rejecting, so everything past it vanished without a trace. Field evidence:
+ * a 950-character recast score brief (instruments, vocal, the source's own
+ * scat syllables, the arrangement's arc) reached Suno as exactly 500
+ * characters, cut mid-word.
+ */
 export function getMaxSunoPromptChars(model: string | undefined, customMode: boolean): number {
-  if (!customMode) return 500
+  if (!customMode) return 3000
   return model === "V4" || model === "V3_5" ? 3000 : 5000
 }
 
@@ -364,6 +373,7 @@ export const MODELS_WITH_REFERENCE_IMAGE_SUPPORT = new Set([
   "gpt-image",
   "gpt-image-2",
   "grok",
+  "grok-2",
   "qwen",
   "seedream",
   "seedream-5-lite",
@@ -374,6 +384,7 @@ export const MODELS_WITH_REFERENCE_IMAGE_SUPPORT = new Set([
   "nano-banana-edit",
   "gpt-image-i2i",
   "gpt-image-2-i2i",
+  "grok-2-i2i",
   "flux-i2i",
   "flux-pro-i2i",
   "flux-kontext",
@@ -412,6 +423,9 @@ export const T2I_TO_I2I_VARIANT: Record<string, string> = {
   "gpt-image": "gpt-image-i2i",
   "gpt-image-2": "gpt-image-2-i2i",
   "grok": "grok-i2i",
+  // grok-2's t2i takes NO image input; its "i2i" is the segment-map(image_url)
+  // → image-edit(task_id) chain in the KIE provider (single reference).
+  "grok-2": "grok-2-i2i",
   "qwen": "qwen-i2i",
   "seedream": "seedream-edit",
   "seedream-5-lite": "seedream-5-lite-i2i",
@@ -437,6 +451,8 @@ export const REF_IMAGE_MAX_LIMITS: Record<string, number> = {
   "nano-banana-2": 4,
   "nano-banana-2-lite": 10,
   "wan-2.7": 9,
+  // grok-2 reference chain consumes exactly one image (segment-map input).
+  "grok-2-i2i": 1,
   // Image-to-image (multi-source array)
   "nano-banana-edit": 8,
   "gpt-image-i2i": 16,
@@ -592,6 +608,7 @@ export const IMAGE_I2I_PROVIDERS = [
   "flux-pro-i2i",
   "gpt-image-i2i",
   "gpt-image-2-i2i",
+  "grok-2-i2i",
   "ideogram-edit",
   "ideogram-remix",
   "ideogram-reframe",
@@ -824,6 +841,35 @@ export function resolveVideoProviderForMode(
   return provider
 }
 
+/**
+ * Which execution mode a unified Generate Video run takes from what is wired.
+ * Shared by the frontend DAG executor (`execute-node.ts`) and the backend
+ * orchestrator (`payload-builder.ts`) so the two cannot disagree.
+ *
+ * A start frame is image-to-video, full stop. Reference images ALONE are the
+ * nuance: most models forward refs on either path, but a split-id model
+ * (VIDEO_MODE_ALIASES) can carry them on one twin only — Grok Imagine 1's
+ * text-to-video endpoint has no image parameter at all, while its i2v twin
+ * takes up to 7. Refs wired without a start frame used to resolve to t2v →
+ * `grok` → silently dropped (#861). When refs are present and ONLY the i2v
+ * twin can carry them, the run is image-to-video with the refs as its images.
+ * Derived from VIDEO_REF_LIMITS_BY_PROVIDER (= the catalog's `reference-image`
+ * feature), never from a provider name; single-id models are untouched
+ * because both twins are the same id.
+ */
+export function resolveVideoModeForInputs(
+  provider: string | undefined,
+  inputs: { readonly hasStartFrame: boolean; readonly hasImageRefs: boolean },
+): "image-to-video" | "text-to-video" {
+  if (inputs.hasStartFrame) return "image-to-video"
+  if (!provider || !inputs.hasImageRefs) return "text-to-video"
+  const i2v = resolveVideoProviderForMode(provider, "image-to-video")
+  const t2v = resolveVideoProviderForMode(provider, "text-to-video")
+  if (i2v === t2v) return "text-to-video"
+  const carriesImageRefs = (id: string) => (VIDEO_REF_LIMITS_BY_PROVIDER[id]?.images ?? 0) > 0
+  return carriesImageRefs(i2v) && !carriesImageRefs(t2v) ? "image-to-video" : "text-to-video"
+}
+
 /**
  * t2v twin ids hidden from the unified Generate Video picker — the i2v/base
  * entry already represents both modes (execution remaps by image presence).
@@ -1526,9 +1572,8 @@ export const SEEDANCE_2_R2V_MIN_REF_VIDEO_SEC = 1.8
  * credit formulas bill per continuation join. Clears the provider floor
  * above with margin while staying short enough to keep the model focused on
  * continuing the boundary motion instead of re-staging the whole clip.
- * Guarded ≥ floor by model-constants tests; the private-plugin twin
- * (nodaro-cloud-plugins chain.ts TAIL_SEC / bridge-math.ts MIN_REF) is
- * guarded by that repo's r2v-ref-floor.test.ts — keep the two in sync.
+ * Guarded ≥ floor by model-constants tests; the plugin repo carries a twin
+ * constant guarded by its own tests — keep the two in sync.
  */
 export const SEEDANCE_2_CONTINUATION_REF_SEC = 2
 

package/src/organizations/index.ts

@@ -0,0 +1,2 @@
+export * from "./types.js"
+export * from "./views.js"

package/src/organizations/types.ts

@@ -0,0 +1,152 @@
+import { z } from "zod"
+
+/**
+ * Organizations — wire contract for the second tenancy axis
+ * (Organization -> Workspace -> Member).
+ *
+ * Lives in @nodaro/shared because SDK/MCP consumers need these enums, the
+ * request schemas the API validates, and the error codes it returns. This
+ * package carries the CONTRACT ONLY — no resolution logic, no presets, no
+ * vocabulary, no access rule. Those are server-side.
+ */
+
+/**
+ * Selects which workspace a request LISTS from and CREATES into. It never
+ * authorizes: reading, updating, deleting or running an identified object is
+ * decided by that object's own workspace, so a forgotten or forged header can
+ * neither widen access nor move a charge.
+ *
+ * Fastify lower-cases incoming header keys, hence the second constant — read
+ * `req.headers[WORKSPACE_HEADER_LOWER]`, send `WORKSPACE_HEADER`.
+ */
+export const WORKSPACE_HEADER = "X-Nodaro-Workspace"
+export const WORKSPACE_HEADER_LOWER = "x-nodaro-workspace"
+
+export const ORG_KINDS = ["school", "team"] as const
+export type OrgKind = (typeof ORG_KINDS)[number]
+
+export const ORG_ROLES = ["owner", "admin", "member"] as const
+export type OrgRole = (typeof ORG_ROLES)[number]
+
+export const WORKSPACE_ROLES = ["admin", "member"] as const
+export type WorkspaceRole = (typeof WORKSPACE_ROLES)[number]
+
+export const MEMBER_STATUSES = ["active", "suspended"] as const
+export type MemberStatus = (typeof MEMBER_STATUSES)[number]
+
+/** `pending` = created, awaiting platform-admin approval. */
+export const ORG_STATUSES = ["pending", "active", "suspended", "deleted"] as const
+export type OrgStatus = (typeof ORG_STATUSES)[number]
+
+/** An explicit per-workflow grant (works for personal workflows too). */
+export const COLLABORATOR_ROLES = ["editor", "viewer"] as const
+export type CollaboratorRole = (typeof COLLABORATOR_ROLES)[number]
+
+export const WORKFLOW_VISIBILITIES = ["private", "workspace"] as const
+export type WorkflowVisibility = (typeof WORKFLOW_VISIBILITIES)[number]
+
+/** What an identity may do with a workflow, strongest first. */
+export const ACCESS_LEVELS = ["own", "edit", "view", "none"] as const
+export type AccessLevel = (typeof ACCESS_LEVELS)[number]
+
+/** The access a setting may grant to a non-creator. */
+export const GRANTED_ACCESS = ["view", "edit"] as const
+export type GrantedAccess = (typeof GRANTED_ACCESS)[number]
+
+export const SUBMISSION_STATUSES = ["submitted", "in_review", "returned", "approved"] as const
+export type SubmissionStatus = (typeof SUBMISSION_STATUSES)[number]
+
+/**
+ * Error codes the organization endpoints add to the standard envelope
+ * (`{ error: { code, message } }`). Clients dispatch on the code, never on
+ * the message text.
+ */
+export const ORG_ERROR_CODES = [
+  "not_a_member",
+  "insufficient_role",
+  "org_not_active",
+  "member_suspended",
+  "workspace_archived",
+  "personal_space_disabled",
+  "token_workspace_mismatch",
+  "run_requires_authenticated_member",
+  "budget_exceeded",
+  "member_cap_exceeded",
+  "model_not_allowed",
+  "invitation_expired",
+  "invitation_revoked",
+  "email_mismatch",
+  "join_code_invalid",
+  "domain_not_allowed",
+  "already_started",
+  "collab_unavailable",
+  // Organization, workspace and membership endpoints.
+  "terms_required",
+  "not_org_member",
+  "already_a_member",
+  "owner_cannot_leave",
+  "has_active_workspaces",
+  // Invitations and join codes.
+  "invitation_not_found",
+  "invitation_accepted",
+  "bulk_invite_cap_exceeded",
+] as const
+export type OrgErrorCode = (typeof ORG_ERROR_CODES)[number]
+
+/**
+ * The settings every organization kind has a default for. `organizations.
+ * settings` and `workspaces.settings` store PARTIAL overrides of this shape;
+ * `resolveEffectiveSettings` (./settings.ts) produces the full one.
+ */
+export const PresetSettingsSchema = z.object({
+  /** What org/workspace admins may do with a member's workflow. */
+  admin_access: z.enum(GRANTED_ACCESS),
+  default_workflow_visibility: z.enum(WORKFLOW_VISIBILITIES),
+  /** What a plain member may do with a `visibility = workspace` workflow. */
+  member_access_to_shared: z.enum(GRANTED_ACCESS),
+  members_can_create_projects: z.boolean(),
+  member_caps_enabled: z.boolean(),
+  /** Whether members keep a personal (non-workspace) space at all. */
+  personal_space_enabled: z.boolean(),
+  /** Whether a workspace admin may invite NEW people into the org. */
+  workspace_admins_can_invite: z.boolean(),
+  /** Whether an editor collaborator may invite further collaborators. */
+  collaborators_can_invite: z.boolean(),
+  /**
+   * When the organization is SUSPENDED, do its content rules still bind its
+   * members?
+   *
+   * Today this governs exactly one rule — `personal_space_enabled` — and that
+   * is not an accident: every other key above governs behaviour INSIDE a
+   * workspace, and a suspended organization grants no workspace context at
+   * all, so those are already moot.
+   *
+   * The name is general because an organization is deciding a principle here,
+   * not one checkbox's fate. Default `false`, which is today's behaviour: a
+   * suspended organization stops binding, and its members work independently
+   * until it resumes. An organization whose reason for disabling the personal
+   * space is contractual — the work made here belongs to the institution —
+   * turns this on, because an unpaid invoice does not void a contract.
+   */
+  policy_survives_suspension: z.boolean(),
+})
+export type PresetSettings = z.infer<typeof PresetSettingsSchema>
+export type PresetSettingKey = keyof PresetSettings
+export const PRESET_SETTING_KEYS = Object.freeze(
+  Object.keys(PresetSettingsSchema.shape) as readonly PresetSettingKey[],
+)
+
+/** `workspaces.settings` — per-workspace overrides only. */
+export const WorkspaceSettingsSchema = PresetSettingsSchema.partial()
+export type WorkspaceSettings = z.infer<typeof WorkspaceSettingsSchema>
+
+const EMAIL_DOMAIN_PATTERN = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/
+
+/** `organizations.settings` — preset overrides plus org-only keys. */
+export const OrgSettingsSchema = PresetSettingsSchema.partial().extend({
+  /** Lower-case domains that join codes / domain auto-join accept. Empty = any. */
+  allowed_email_domains: z.array(z.string().regex(EMAIL_DOMAIN_PATTERN)).optional(),
+  /** Per-org relabelling of the kind vocabulary (./vocabulary.ts). */
+  vocabulary_overrides: z.record(z.string(), z.string()).optional(),
+})
+export type OrgSettings = z.infer<typeof OrgSettingsSchema>