@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/organizations/organization-members.shared.schemas.d.ts

@@ -4,56 +4,46 @@
  * Junction entity between users and organizations with roles and permissions
  */
 import { z } from 'zod';
-import { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
-export declare enum OrganizationMemberInvitationStatus {
-    PENDING = "PENDING",
-    ACCEPTED = "ACCEPTED",
-    REJECTED = "REJECTED",
-    EXPIRED = "EXPIRED",
-    REVOKED = "REVOKED"
-}
+import { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';
+/**
+ * Organization member lifecycle status.
+ *
+ * A membership row IS the invitation — there is no separate invitation
+ * collection. `INVITED` is the pending-membership state; acceptance flips it to
+ * `ACTIVE` on the SAME row (stable `_id`, so the emailed accept-link token never
+ * orphans). SSO JIT / SCIM provisioning find-or-activate an existing `INVITED`
+ * row rather than blind-creating a second `ACTIVE` one.
+ *
+ * - `INVITED`  — membership extended, invitee has not yet accepted. Paired with a
+ *   `User` in `PENDING_INVITATION` status when the invitee has no account yet.
+ * - `ACTIVE`   — accepted / directly provisioned membership.
+ * - `INACTIVE` — deactivated (e.g. SCIM deprovision).
+ * - `SUSPENDED` — temporarily suspended (optionally time-boxed).
+ *
+ * Invite OUTCOMES (declined / revoked / expired) are NOT statuses — the row is
+ * deleted and the event recorded in the audit trail (keeps this enum about
+ * membership, not invitation bookkeeping).
+ */
 export declare enum OrganizationMemberStatus {
     INVITED = "INVITED",
     ACTIVE = "ACTIVE",
     INACTIVE = "INACTIVE",
     SUSPENDED = "SUSPENDED"
 }
-export declare const OrganizationMemberOrganizationUnitMembershipSchema: z.ZodArray<z.ZodObject<{
-    organizationUnitId: z.ZodString;
-    role: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
-export type OrganizationMemberOrganizationUnitMembership = z.infer<typeof OrganizationMemberOrganizationUnitMembershipSchema>[number];
-export declare const OrganizationMemberSchema: z.ZodObject<{
+export declare const OrganizationMemberSchema: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    userEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>>>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    organizationUnitsMembership: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        organizationUnitId: z.ZodString;
-        role: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>;
-    roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>>>>;
-    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof OrganizationMemberStatus>>>>;
-    userTitle: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof OrganizationMemberStatus>>>>>>>;
+    scheduledReactivationAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+    userTitle: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    invitedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    invitedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+    instanceLabel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>>;
 export type OrganizationMember = z.infer<typeof OrganizationMemberSchema>;
-export declare const OrganizationMemberInvitationSchema: z.ZodObject<{
-    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>>;
-    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    userId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
-    organizationUnitsMembership: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        organizationUnitId: z.ZodString;
-        role: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>;
-    roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>>>>;
-    userType: z.ZodOptional<z.ZodString>;
-    rejectionReason: z.ZodOptional<z.ZodString>;
-    userTitle: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
-    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof OrganizationMemberInvitationStatus>>>>;
-    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
-    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export type OrganizationMemberInvitation = z.infer<typeof OrganizationMemberInvitationSchema>;
 //# sourceMappingURL=organization-members.shared.schemas.d.ts.map

package/dist/esm/organizations/organization-members.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-members.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AAIjG,oBAAY,kCAAkC;IAC5C,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,kDAAkD;;;wCAG5D,CAAC;AACJ,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtI,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;uCAUnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;uCAe7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}
+{"version":3,"file":"organization-members.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AAMjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;kBAkKnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/organizations/organization-members.shared.schemas.js

@@ -5,16 +5,28 @@
  */
 import { z } from 'zod';
 import { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas.js';
-// Real TypeScript enum for organization member invitation status
-export var OrganizationMemberInvitationStatus;
-(function (OrganizationMemberInvitationStatus) {
-    OrganizationMemberInvitationStatus["PENDING"] = "PENDING";
-    OrganizationMemberInvitationStatus["ACCEPTED"] = "ACCEPTED";
-    OrganizationMemberInvitationStatus["REJECTED"] = "REJECTED";
-    OrganizationMemberInvitationStatus["EXPIRED"] = "EXPIRED";
-    OrganizationMemberInvitationStatus["REVOKED"] = "REVOKED";
-})(OrganizationMemberInvitationStatus || (OrganizationMemberInvitationStatus = {}));
-// Real TypeScript enum for organization member status
+import { forwardedLabel } from '../resources/resources.shared.schemas.js';
+import { CoreResourceType } from '../resources/resources.shared.core.definitions.js';
+import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
+/**
+ * Organization member lifecycle status.
+ *
+ * A membership row IS the invitation — there is no separate invitation
+ * collection. `INVITED` is the pending-membership state; acceptance flips it to
+ * `ACTIVE` on the SAME row (stable `_id`, so the emailed accept-link token never
+ * orphans). SSO JIT / SCIM provisioning find-or-activate an existing `INVITED`
+ * row rather than blind-creating a second `ACTIVE` one.
+ *
+ * - `INVITED`  — membership extended, invitee has not yet accepted. Paired with a
+ *   `User` in `PENDING_INVITATION` status when the invitee has no account yet.
+ * - `ACTIVE`   — accepted / directly provisioned membership.
+ * - `INACTIVE` — deactivated (e.g. SCIM deprovision).
+ * - `SUSPENDED` — temporarily suspended (optionally time-boxed).
+ *
+ * Invite OUTCOMES (declined / revoked / expired) are NOT statuses — the row is
+ * deleted and the event recorded in the audit trail (keeps this enum about
+ * membership, not invitation bookkeeping).
+ */
 export var OrganizationMemberStatus;
 (function (OrganizationMemberStatus) {
     OrganizationMemberStatus["INVITED"] = "INVITED";
@@ -22,35 +34,167 @@ export var OrganizationMemberStatus;
     OrganizationMemberStatus["INACTIVE"] = "INACTIVE";
     OrganizationMemberStatus["SUSPENDED"] = "SUSPENDED";
 })(OrganizationMemberStatus || (OrganizationMemberStatus = {}));
-export const OrganizationMemberOrganizationUnitMembershipSchema = z.array(z.object({
-    organizationUnitId: z.string().min(1),
-    role: OrgRolesSchema,
-}));
 export const OrganizationMemberSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
-    userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
+    /**
+     * FK to the member `User`. ALWAYS present on a persisted row (a membership with
+     * no member is meaningless) — even an `INVITED` invitee has an eagerly-created
+     * `User` in `PENDING_INVITATION` status, so this FK is never null.
+     *
+     * SERVER-INJECTED on create (`.excludeFromCreate()`), via one of two paths:
+     *   - Invite (org-admin CREATE): the admin supplies {@link userEmail} instead;
+     *     the CREATE prefix find-or-creates the user by normalized email and injects
+     *     the resolved `_id` here (email is the strict unique identity anchor — see
+     *     `User.email.isUnique()`).
+     *   - System provisioning (invite-acceptance / SSO JIT / SCIM): passes `userId`
+     *     directly through `createAsSystem`, which re-attaches this context FK past
+     *     the strict-DTO strip.
+     * `.excludeFromUpdate()` keeps the member↔user binding immutable.
+     */
+    userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate(),
+    /**
+     * The linked user's email — DUAL ROLE:
+     *
+     *   1. INVITE CREATE INPUT. On the org-admin invite CREATE the admin supplies
+     *      an email (not a `userId`); the CREATE prefix normalizes it, find-or-creates
+     *      the `User` by it (unique identity anchor), and derives {@link userId}. This
+     *      is why the field is client-writable on CREATE (no `.excludeFromCreate()`).
+     *   2. DENORMALIZED IMMUTABLE COPY. After creation it is the immutable mirror of
+     *      `USERS.email` (which is `.excludeFromUpdate()`, so this copy never drifts).
+     *      It feeds member SEARCH (`searchableFields: ['userEmail']` — no async hop)
+     *      and the {@link instanceLabel} fallback when the related profile/name is
+     *      unavailable (e.g. a `PENDING_INVITATION` invitee has no `USER_PROFILE` yet).
+     *
+     * For system creates (SSO/SCIM/acceptance) that pass `userId` instead of an
+     * email, the CREATE prefix DERIVES this value from the authoritative user record,
+     * so it is `.optional()` at the input boundary. `.excludeFromUpdate()` keeps it
+     * immutable post-creation. `.isHidden({ display: true })` keeps it out of
+     * auto-rendered display cards/columns (the user-facing email is surfaced by
+     * resolving the `userId` reference) — it still renders on the CREATE form.
+     */
+    userEmail: z.email().optional().isDBIndexed().isSummaryField().isHidden({ display: true }).excludeFromUpdate()
+        .dataCategories(PersonalDataCategory.CONTACT_DETAILS),
     organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
-    organizationUnitsMembership: OrganizationMemberOrganizationUnitMembershipSchema.optional(),
-    roles: z.array(OrgRolesSchema).default([CORE_ORG_ROLES.ORG_MEMBER]).isDBIndexed().isSummaryField(),
-    status: z.enum(OrganizationMemberStatus).default(OrganizationMemberStatus.ACTIVE).isDBIndexed().isSummaryField(),
-    userTitle: z.string().max(100).optional().isDBIndexed().isSummaryField(),
+    /*
+     * `organizationUnitsMembership` (an embedded `[{ organizationUnitId, role }]` array) was REMOVED
+     * here on 2026-07-31 and promoted to the `ORGANIZATION_UNIT_MEMBERS` junction resource
+     * (plan decision D-B5). The array could not be queried portably — a dot-path filter into an
+     * array field resolves to NULL on PostgreSQL and the LIST summary projection strips the field —
+     * so every "who is assigned to this unit?" question failed OPEN, it could not carry a registered
+     * relationship (no cascade), and it admitted two conflicting roles for the same unit. Read unit
+     * assignments through `ORGANIZATION_UNIT_MEMBERS` filtered by `organizationMemberId`.
+     */
+    // `.isAuditEvidence()` — this member's authority INSIDE the organization. Roles are the
+    // framework's single authorization axis, so a change here is an access-control decision and the
+    // before/after sets ARE the evidence: a trail that records only "roles changed" proves nothing
+    // about what authority resulted. Safe to record in full — a role name is vocabulary, not personal
+    // data, so it carries no erasure obligation into the immutable audit ledger.
+    // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+    roles: z.array(OrgRolesSchema).default([CORE_ORG_ROLES.ORG_MEMBER]).isDBIndexed().isSummaryField().isAuditEvidence(),
+    /**
+     * Server-owned lifecycle state. Default `ACTIVE` covers direct/system
+     * provisioning (SSO JIT / SCIM / self-registration org-owner grant), while
+     * the org-admin invite CREATE prefix forces `INVITED`.
+     *
+     * Neither CREATE nor generic UPDATE may accept this field from a client:
+     * lifecycle transitions carry security side effects that a field update
+     * cannot reproduce. In particular, invitation acceptance must validate and
+     * consume the invitation token, grant the derived user type, and serialize
+     * against revocation; suspension/reactivation likewise have dedicated
+     * operations. Keeping status out of both DTOs makes those trusted transition
+     * operations the only way to change it.
+     */
+    status: z.enum(OrganizationMemberStatus)
+        .default(OrganizationMemberStatus.ACTIVE)
+        .isDBIndexed()
+        .isSummaryField()
+        .excludeFromCreate()
+        .excludeFromUpdate()
+        // Lifecycle state gates access as surely as roles do — a SUSPENDED member is denied, an ACTIVE
+        // one is not — so a suspension or reactivation is an authorization event and its before/after
+        // values are the evidence. The enum's values are closed vocabulary, never personal data, so
+        // recording them carries no GDPR Art. 17 obligation into the immutable ledger — the same
+        // reasoning `UserSchema.status` records. Without this the framework's
+        // `RESOURCE_OPERATION_PERFORMED` event notes only that `status` was among the changed fields,
+        // never what it changed FROM or TO, which is the half an access review actually reads.
+        // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+        .isAuditEvidence(),
+    /**
+     * When an automated sweep must return this membership to `ACTIVE`.
+     *
+     * Set by SUSPEND when the caller time-boxes the suspension (`suspensionEndDate` in that verb's
+     * request contract), cleared by REACTIVATE. Absent means the suspension is indefinite and only a
+     * deliberate REACTIVATE lifts it — which is the default, since an unbounded suspension is the
+     * safer reading of "suspend".
+     *
+     * NAMED FOR THE EFFECT, NOT THE CAUSE. `scheduledReactivationAt` says what the system will do;
+     * a `suspensionEndsAt` would describe only the suspension branch while the identical field on
+     * `USERS` also serves self-service deactivation. One concept, one name across both resources,
+     * so the reactivation sweep reads the same field everywhere. The request contracts keep their
+     * own caller-facing vocabulary and the transition hook translates — the same split
+     * `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in, `parentUnitId` + `path` persisted).
+     *
+     * Server-owned on both sides (`.excludeFromCreate().excludeFromUpdate()`): only the transition
+     * operations write it, exactly as for {@link status} above. Indexed because the sweep's whole
+     * query is "rows whose scheduled reactivation has passed".
+     *
+     * ⚠️ A value here is a PROMISE the framework keeps: the reactivation batch is what makes it
+     * true. Persisting the date without that sweep would be the same defect as a verb that answers
+     * success and writes nothing — an authored intention nothing honors.
+     */
+    // Deliberately NOT `.isAuditEvidence()`. The rationale that briefly sat here — "lifecycle state
+    // gates access as surely as roles do" — is true of {@link status}, which is where it now lives.
+    // This field decides nothing about what the principal may do; it is a scheduling detail, and the
+    // transition's audit row already records the resulting status.
+    scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+    // The person's role in the customer's organization — their working life, not this application's
+    // authorization model (`roles` is that, and it is a closed vocabulary rather than personal data).
+    userTitle: z.string().max(100).optional().isDBIndexed().isSummaryField()
+        .dataCategories(PersonalDataCategory.PROFESSIONAL),
+    /**
+     * The `User._id` of the org admin who issued the invite. Server-set by the invite
+     * CREATE prefix from the execution-context actor; absent on direct/system
+     * provisioning. Immutable. Feeds the audit trail and the user-facing "invited by"
+     * cue in the pending-invitations inbox.
+     *
+     * PROVENANCE STAMP, NOT a navigable FK — deliberately a plain indexed string (same
+     * idiom as `scim-tokens.createdByUserId`), NOT `.isForeignKey()`. The primary
+     * member↔user link is `userId` (registered M2M relationship); adding `.isForeignKey()`
+     * here would demand a SECOND `ORGANIZATION_MEMBERS → USERS` relationship (else the
+     * registry warns "cannot be resolved to a resource type") and would graft nested-route /
+     * parent-scope machinery onto a field that only records who clicked "invite". Resolve
+     * the inviter's display name with a bounded lookup at render time if the cue needs it.
+     */
+    invitedByUserId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+    /**
+     * When the invite was issued. Server-set by the invite CREATE prefix; absent on
+     * direct/system provisioning. Immutable. Used by the inbox ordering and the
+     * expiry-reap CRON batch.
+     */
+    invitedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+    /**
+     * Computed instance label — the linked user's name, forwarded live from
+     * `USER_PROFILES`. A junction row has no inherent name; its identity is the
+     * related party. {@link forwardedLabel} resolves it SERVER-SIDE at read time
+     * (joining `userId` → `USER_PROFILES.userId`, rendering `firstName lastName`)
+     * and projects it onto the summary/read DTO via the virtual-field pipeline, so
+     * the frontend label is a plain field ref (`getFrontendResourceLabel:
+     * ['instanceLabel']`). Never stale (read live), never denormalized, tenant-safe
+     * (a bounded system read over the userIds already on the org-scoped page). NOT
+     * persisted (virtual). When the profile/name is unavailable it falls back to the
+     * immutable {@link userEmail} (`fallbackField`) rather than a raw id.
+     */
+    instanceLabel: forwardedLabel({
+        localField: 'userId',
+        relatedResource: CoreResourceType.USER_PROFILES,
+        relatedJoinField: 'userId',
+        fields: ['firstName', 'lastName'],
+        fallbackField: 'userEmail',
+    }),
     createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
-});
-export const OrganizationMemberInvitationSchema = z.object({
-    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
-    email: z.email().isDBIndexed().isSummaryField(),
-    organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
-    userId: z.string().min(1).isDBIndexed().isForeignKey().optional(),
-    organizationUnitsMembership: OrganizationMemberOrganizationUnitMembershipSchema.optional(),
-    roles: z.array(OrgRolesSchema).default([CORE_ORG_ROLES.ORG_MEMBER]).isDBIndexed().isSummaryField(),
-    /** W4.4: User type hint for frontend routing during acceptance (determines auth UI / password policy). Actual user type assignment is handled by W5.2 on org join. */
-    userType: z.string().optional(),
-    /** Invitee-provided optional decline note from the public rejection flow. */
-    rejectionReason: z.string().max(500).optional(),
-    userTitle: z.string().max(100).optional().isDBIndexed().isSummaryField(),
-    status: z.enum(OrganizationMemberInvitationStatus).default(OrganizationMemberInvitationStatus.PENDING).isDBIndexed().isSummaryField(),
-    createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
-    updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()
-});
-//# sourceMappingURL=organization-members.shared.schemas.js.map
+}).businessKeySet([
+    'userId',
+    'organizationId',
+]);
+//# sourceMappingURL=organization-members.shared.schemas.js.map

package/dist/esm/organizations/organization-members.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-members.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjG,iEAAiE;AACjE,MAAM,CAAN,IAAY,kCAMX;AAND,WAAY,kCAAkC;IAC5C,yDAAmB,CAAA;IACnB,2DAAqB,CAAA;IACrB,2DAAqB,CAAA;IACrB,yDAAmB,CAAA;IACnB,yDAAmB,CAAA;AACrB,CAAC,EANW,kCAAkC,KAAlC,kCAAkC,QAM7C;AAED,sDAAsD;AACtD,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACjF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,EAAE,cAAc;CACrB,CAAC,CAAC,CAAC;AAGJ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,2BAA2B,EAAE,kDAAkD,CAAC,QAAQ,EAAE;IAC1F,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAClG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAChH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACxE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE;IACjE,2BAA2B,EAAE,kDAAkD,CAAC,QAAQ,EAAE;IAC1F,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAClG,sKAAsK;IACtK,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,6EAA6E;IAC7E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACxE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACrI,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC"}
+{"version":3,"file":"organization-members.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAGnG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;OAcG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC/G;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE;SAC3G,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;;;;;OAQG;IACH,wFAAwF;IACxF,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,6EAA6E;IAC7E,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACpH;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;SACrC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;SACxC,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;QACpB,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,yFAAyF;QACzF,sEAAsE;QACtE,8FAA8F;QAC9F,uFAAuF;QACvF,qDAAqD;SACpD,eAAe,EAAE;IACpB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,+DAA+D;IAC/D,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,gGAAgG;IAChG,kGAAkG;IAClG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SACrE,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IACpD;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpF;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,QAAQ;QACpB,eAAe,EAAE,gBAAgB,CAAC,aAAa;QAC/C,gBAAgB,EAAE,QAAQ;QAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,aAAa,EAAE,WAAW;KAC3B,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC","sourcesContent":["\n/**\n * Organization Member Shared Schemas\n * \n * Junction entity between users and organizations with roles and permissions\n */\n\nimport { z } from 'zod';\n\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { forwardedLabel } from '../resources/resources.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n\n/**\n * Organization member lifecycle status.\n *\n * A membership row IS the invitation — there is no separate invitation\n * collection. `INVITED` is the pending-membership state; acceptance flips it to\n * `ACTIVE` on the SAME row (stable `_id`, so the emailed accept-link token never\n * orphans). SSO JIT / SCIM provisioning find-or-activate an existing `INVITED`\n * row rather than blind-creating a second `ACTIVE` one.\n *\n * - `INVITED`  — membership extended, invitee has not yet accepted. Paired with a\n *   `User` in `PENDING_INVITATION` status when the invitee has no account yet.\n * - `ACTIVE`   — accepted / directly provisioned membership.\n * - `INACTIVE` — deactivated (e.g. SCIM deprovision).\n * - `SUSPENDED` — temporarily suspended (optionally time-boxed).\n *\n * Invite OUTCOMES (declined / revoked / expired) are NOT statuses — the row is\n * deleted and the event recorded in the audit trail (keeps this enum about\n * membership, not invitation bookkeeping).\n */\nexport enum OrganizationMemberStatus {\n  INVITED = 'INVITED',\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED'\n}\n\nexport const OrganizationMemberSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * FK to the member `User`. ALWAYS present on a persisted row (a membership with\n   * no member is meaningless) — even an `INVITED` invitee has an eagerly-created\n   * `User` in `PENDING_INVITATION` status, so this FK is never null.\n   *\n   * SERVER-INJECTED on create (`.excludeFromCreate()`), via one of two paths:\n   *   - Invite (org-admin CREATE): the admin supplies {@link userEmail} instead;\n   *     the CREATE prefix find-or-creates the user by normalized email and injects\n   *     the resolved `_id` here (email is the strict unique identity anchor — see\n   *     `User.email.isUnique()`).\n   *   - System provisioning (invite-acceptance / SSO JIT / SCIM): passes `userId`\n   *     directly through `createAsSystem`, which re-attaches this context FK past\n   *     the strict-DTO strip.\n   * `.excludeFromUpdate()` keeps the member↔user binding immutable.\n   */\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * The linked user's email — DUAL ROLE:\n   *\n   *   1. INVITE CREATE INPUT. On the org-admin invite CREATE the admin supplies\n   *      an email (not a `userId`); the CREATE prefix normalizes it, find-or-creates\n   *      the `User` by it (unique identity anchor), and derives {@link userId}. This\n   *      is why the field is client-writable on CREATE (no `.excludeFromCreate()`).\n   *   2. DENORMALIZED IMMUTABLE COPY. After creation it is the immutable mirror of\n   *      `USERS.email` (which is `.excludeFromUpdate()`, so this copy never drifts).\n   *      It feeds member SEARCH (`searchableFields: ['userEmail']` — no async hop)\n   *      and the {@link instanceLabel} fallback when the related profile/name is\n   *      unavailable (e.g. a `PENDING_INVITATION` invitee has no `USER_PROFILE` yet).\n   *\n   * For system creates (SSO/SCIM/acceptance) that pass `userId` instead of an\n   * email, the CREATE prefix DERIVES this value from the authoritative user record,\n   * so it is `.optional()` at the input boundary. `.excludeFromUpdate()` keeps it\n   * immutable post-creation. `.isHidden({ display: true })` keeps it out of\n   * auto-rendered display cards/columns (the user-facing email is surfaced by\n   * resolving the `userId` reference) — it still renders on the CREATE form.\n   */\n  userEmail: z.email().optional().isDBIndexed().isSummaryField().isHidden({ display: true }).excludeFromUpdate()\n    .dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /*\n   * `organizationUnitsMembership` (an embedded `[{ organizationUnitId, role }]` array) was REMOVED\n   * here on 2026-07-31 and promoted to the `ORGANIZATION_UNIT_MEMBERS` junction resource\n   * (plan decision D-B5). The array could not be queried portably — a dot-path filter into an\n   * array field resolves to NULL on PostgreSQL and the LIST summary projection strips the field —\n   * so every \"who is assigned to this unit?\" question failed OPEN, it could not carry a registered\n   * relationship (no cascade), and it admitted two conflicting roles for the same unit. Read unit\n   * assignments through `ORGANIZATION_UNIT_MEMBERS` filtered by `organizationMemberId`.\n   */\n  // `.isAuditEvidence()` — this member's authority INSIDE the organization. Roles are the\n  // framework's single authorization axis, so a change here is an access-control decision and the\n  // before/after sets ARE the evidence: a trail that records only \"roles changed\" proves nothing\n  // about what authority resulted. Safe to record in full — a role name is vocabulary, not personal\n  // data, so it carries no erasure obligation into the immutable audit ledger.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  roles: z.array(OrgRolesSchema).default([CORE_ORG_ROLES.ORG_MEMBER]).isDBIndexed().isSummaryField().isAuditEvidence(),\n  /**\n   * Server-owned lifecycle state. Default `ACTIVE` covers direct/system\n   * provisioning (SSO JIT / SCIM / self-registration org-owner grant), while\n   * the org-admin invite CREATE prefix forces `INVITED`.\n   *\n   * Neither CREATE nor generic UPDATE may accept this field from a client:\n   * lifecycle transitions carry security side effects that a field update\n   * cannot reproduce. In particular, invitation acceptance must validate and\n   * consume the invitation token, grant the derived user type, and serialize\n   * against revocation; suspension/reactivation likewise have dedicated\n   * operations. Keeping status out of both DTOs makes those trusted transition\n   * operations the only way to change it.\n   */\n  status: z.enum(OrganizationMemberStatus)\n    .default(OrganizationMemberStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    // Lifecycle state gates access as surely as roles do — a SUSPENDED member is denied, an ACTIVE\n    // one is not — so a suspension or reactivation is an authorization event and its before/after\n    // values are the evidence. The enum's values are closed vocabulary, never personal data, so\n    // recording them carries no GDPR Art. 17 obligation into the immutable ledger — the same\n    // reasoning `UserSchema.status` records. Without this the framework's\n    // `RESOURCE_OPERATION_PERFORMED` event notes only that `status` was among the changed fields,\n    // never what it changed FROM or TO, which is the half an access review actually reads.\n    // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n    .isAuditEvidence(),\n  /**\n   * When an automated sweep must return this membership to `ACTIVE`.\n   *\n   * Set by SUSPEND when the caller time-boxes the suspension (`suspensionEndDate` in that verb's\n   * request contract), cleared by REACTIVATE. Absent means the suspension is indefinite and only a\n   * deliberate REACTIVATE lifts it — which is the default, since an unbounded suspension is the\n   * safer reading of \"suspend\".\n   *\n   * NAMED FOR THE EFFECT, NOT THE CAUSE. `scheduledReactivationAt` says what the system will do;\n   * a `suspensionEndsAt` would describe only the suspension branch while the identical field on\n   * `USERS` also serves self-service deactivation. One concept, one name across both resources,\n   * so the reactivation sweep reads the same field everywhere. The request contracts keep their\n   * own caller-facing vocabulary and the transition hook translates — the same split\n   * `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in, `parentUnitId` + `path` persisted).\n   *\n   * Server-owned on both sides (`.excludeFromCreate().excludeFromUpdate()`): only the transition\n   * operations write it, exactly as for {@link status} above. Indexed because the sweep's whole\n   * query is \"rows whose scheduled reactivation has passed\".\n   *\n   * ⚠️ A value here is a PROMISE the framework keeps: the reactivation batch is what makes it\n   * true. Persisting the date without that sweep would be the same defect as a verb that answers\n   * success and writes nothing — an authored intention nothing honors.\n   */\n  // Deliberately NOT `.isAuditEvidence()`. The rationale that briefly sat here — \"lifecycle state\n  // gates access as surely as roles do\" — is true of {@link status}, which is where it now lives.\n  // This field decides nothing about what the principal may do; it is a scheduling detail, and the\n  // transition's audit row already records the resulting status.\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  // The person's role in the customer's organization — their working life, not this application's\n  // authorization model (`roles` is that, and it is a closed vocabulary rather than personal data).\n  userTitle: z.string().max(100).optional().isDBIndexed().isSummaryField()\n    .dataCategories(PersonalDataCategory.PROFESSIONAL),\n  /**\n   * The `User._id` of the org admin who issued the invite. Server-set by the invite\n   * CREATE prefix from the execution-context actor; absent on direct/system\n   * provisioning. Immutable. Feeds the audit trail and the user-facing \"invited by\"\n   * cue in the pending-invitations inbox.\n   *\n   * PROVENANCE STAMP, NOT a navigable FK — deliberately a plain indexed string (same\n   * idiom as `scim-tokens.createdByUserId`), NOT `.isForeignKey()`. The primary\n   * member↔user link is `userId` (registered M2M relationship); adding `.isForeignKey()`\n   * here would demand a SECOND `ORGANIZATION_MEMBERS → USERS` relationship (else the\n   * registry warns \"cannot be resolved to a resource type\") and would graft nested-route /\n   * parent-scope machinery onto a field that only records who clicked \"invite\". Resolve\n   * the inviter's display name with a bounded lookup at render time if the cue needs it.\n   */\n  invitedByUserId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * When the invite was issued. Server-set by the invite CREATE prefix; absent on\n   * direct/system provisioning. Immutable. Used by the inbox ordering and the\n   * expiry-reap CRON batch.\n   */\n  invitedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * Computed instance label — the linked user's name, forwarded live from\n   * `USER_PROFILES`. A junction row has no inherent name; its identity is the\n   * related party. {@link forwardedLabel} resolves it SERVER-SIDE at read time\n   * (joining `userId` → `USER_PROFILES.userId`, rendering `firstName lastName`)\n   * and projects it onto the summary/read DTO via the virtual-field pipeline, so\n   * the frontend label is a plain field ref (`getFrontendResourceLabel:\n   * ['instanceLabel']`). Never stale (read live), never denormalized, tenant-safe\n   * (a bounded system read over the userIds already on the org-scoped page). NOT\n   * persisted (virtual). When the profile/name is unavailable it falls back to the\n   * immutable {@link userEmail} (`fallbackField`) rather than a raw id.\n   */\n  instanceLabel: forwardedLabel({\n    localField: 'userId',\n    relatedResource: CoreResourceType.USER_PROFILES,\n    relatedJoinField: 'userId',\n    fields: ['firstName', 'lastName'],\n    fallbackField: 'userEmail',\n  }),\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'userId',\n  'organizationId',\n]);\nexport type OrganizationMember = z.infer<typeof OrganizationMemberSchema>;\n"]}

package/dist/esm/organizations/organization-notifications.shared.resources-config.schemas.d.ts

@@ -5,13 +5,13 @@
  * App-focused management for notification settings and preferences.
  */
 import { z } from 'zod';
-import { CoreResourceOperation } from '../resources/resources.shared.core.definitions.js';
-import { ResourceRelationship } from '../resources/resources.shared.schemas.js';
-type OrganizationNotificationsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE;
-export declare const organizationNotificationsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../index.js").ResourceConfiguration<undefined, OrganizationNotificationsCoreOperations, z.ZodObject<{
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../resources/resources.shared.schemas';
+type OrganizationNotificationsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE;
+export declare const organizationNotificationsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, OrganizationNotificationsCoreOperations, z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    emailNotifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    emailNotifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
         defaultEmailAddress: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>;
         billingAddress: z.ZodOptional<z.ZodEmail>;
         securityAddress: z.ZodOptional<z.ZodEmail>;
@@ -21,9 +21,9 @@ export declare const organizationNotificationsResourceConfiguration_Initializati
         administrative: z.ZodDefault<z.ZodBoolean>;
         security: z.ZodDefault<z.ZodBoolean>;
         usersManagement: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 export {};
 //# sourceMappingURL=organization-notifications.shared.resources-config.schemas.d.ts.map

package/dist/esm/organizations/organization-notifications.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAQ/H,KAAK,uCAAuC,GACxC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,oEAAoE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;wCAyDjI,CAAC"}
+{"version":3,"file":"organization-notifications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS/H,KAAK,uCAAuC,GACxC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,oEAAoE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAmGjI,CAAC"}

package/dist/esm/organizations/organization-notifications.shared.resources-config.schemas.js

@@ -11,6 +11,7 @@ import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resourc
 import { ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
 /*
 Organization Notifications Resource Configuration Factory
@@ -21,9 +22,24 @@ export const organizationNotificationsResourceConfiguration_InitializationFactor
     resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_NOTIFICATIONS],
     resourceRelationships: resourcesRelationships,
     isSystemResource: true,
+    // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_NOTIFICATIONS
+    // relationship declares `onParentCreate.enabled`, so a default notifications
+    // row (its `emailNotifications` block materialized to interior defaults) is
+    // written via `createAsSystem` on organization creation (fixes the latent
+    // missing-row gap — org notifications were never hand-seeded). Guard-1 is
+    // fail-closed by omission, so the system seed requires this explicit CREATE
+    // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the
+    // seed resolves.
+    systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },
     coreOperations: [
         CoreResourceOperation.READ,
+        CoreResourceOperation.CREATE,
         CoreResourceOperation.UPDATE,
+        // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition
+        // onParentDelete cascade so the eager-seeded notifications row is physically
+        // removed when its owning organization is deleted. Without it the cascade
+        // throws ErrorType.CONFIGURATION on any org that has a notifications row.
+        CoreResourceOperation.DELETE,
     ],
     operationsConfiguration: {
         [CoreResourceOperation.READ]: {
@@ -39,7 +55,16 @@ export const organizationNotificationsResourceConfiguration_InitializationFactor
         [CoreResourceOperation.CREATE]: {
             variants: [
                 {
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls
+                    // `createAsSystem`, which resolves the default CREATE op through the
+                    // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts
+                    // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE
+                    // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is
+                    // swallowed (silent missing row). INTERNAL_CALL is the service-layer
+                    // internal transport (no HTTP route) — the correct tier for a system seed.
+                    // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the
+                    // repository tier, which is variant-agnostic. See composition-oncreate plan.)
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     roles: [CORE_ORG_ROLES.ORG_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
@@ -62,7 +87,23 @@ export const organizationNotificationsResourceConfiguration_InitializationFactor
                     channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,
                 }
             ]
+        },
+        // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition
+        // onParentDelete cascade so this eager-seeded notifications row is physically
+        // removed when its owning organization is deleted. Without a DELETE op the
+        // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row
+        // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope
+        // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }
+            ],
         }
     },
 });
-//# sourceMappingURL=organization-notifications.shared.resources-config.schemas.js.map
+//# sourceMappingURL=organization-notifications.shared.resources-config.schemas.js.map

package/dist/esm/organizations/organization-notifications.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAOjF;;EAEE;AACF,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIhL;IACA,UAAU,EAAE,+BAA+B;IAC3C,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"organization-notifications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF;;EAEE;AACF,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIhL;IACA,UAAU,EAAE,+BAA+B;IAC3C,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,iBAAiB;IACjB,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,0EAA0E;QAC1E,0EAA0E;QAC1E,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,qEAAqE;oBACrE,qEAAqE;oBACrE,yEAAyE;oBACzE,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;oBACrE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Notifications Shared Resource Configuration\n *\n * Resource configuration for organization notification preferences.\n * App-focused management for notification settings and preferences.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationNotificationsSchema\n} from './organization-notifications.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\ntype OrganizationNotificationsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Notifications Resource Configuration Factory\n*/\nexport const organizationNotificationsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  OrganizationNotificationsCoreOperations,\n  typeof OrganizationNotificationsSchema\n>({\n  mainSchema: OrganizationNotificationsSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_NOTIFICATIONS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_NOTIFICATIONS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_NOTIFICATIONS\n  // relationship declares `onParentCreate.enabled`, so a default notifications\n  // row (its `emailNotifications` block materialized to interior defaults) is\n  // written via `createAsSystem` on organization creation (fixes the latent\n  // missing-row gap — org notifications were never hand-seeded). Guard-1 is\n  // fail-closed by omission, so the system seed requires this explicit CREATE\n  // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the\n  // seed resolves.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a notifications row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls\n          // `createAsSystem`, which resolves the default CREATE op through the\n          // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts\n          // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE\n          // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is\n          // swallowed (silent missing row). INTERNAL_CALL is the service-layer\n          // internal transport (no HTTP route) — the correct tier for a system seed.\n          // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the\n          // repository tier, which is variant-agnostic. See composition-oncreate plan.)\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    }\n  },\n});\n"]}

package/dist/esm/organizations/organization-notifications.shared.schemas.d.ts

@@ -5,10 +5,31 @@
  * Separated from core organization for performance optimization.
  */
 import { z } from 'zod';
+/**
+ * Per-category notification routing block for an organization.
+ *
+ * Every interior field is optional (the routing addresses) or carries a
+ * `.default(...)` (the category opt-in booleans), so the object is fully
+ * materializable from `{}`. Extracted as a named schema so
+ * {@link OrganizationNotificationsSchema} can default it via the Zod-4-safe
+ * `Schema.default(Schema.parse({}))` idiom — see the `emailNotifications` field.
+ */
+export declare const OrganizationEmailNotificationsSchema: z.ZodObject<{
+    defaultEmailAddress: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>;
+    billingAddress: z.ZodOptional<z.ZodEmail>;
+    securityAddress: z.ZodOptional<z.ZodEmail>;
+    administrativeAddress: z.ZodOptional<z.ZodEmail>;
+    usersManagementAddress: z.ZodOptional<z.ZodEmail>;
+    billing: z.ZodDefault<z.ZodBoolean>;
+    administrative: z.ZodDefault<z.ZodBoolean>;
+    security: z.ZodDefault<z.ZodBoolean>;
+    usersManagement: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type OrganizationEmailNotifications = z.infer<typeof OrganizationEmailNotificationsSchema>;
 export declare const OrganizationNotificationsSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    emailNotifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    emailNotifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
         defaultEmailAddress: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>;
         billingAddress: z.ZodOptional<z.ZodEmail>;
         securityAddress: z.ZodOptional<z.ZodEmail>;
@@ -18,9 +39,9 @@ export declare const OrganizationNotificationsSchema: z.ZodObject<{
         administrative: z.ZodDefault<z.ZodBoolean>;
         security: z.ZodDefault<z.ZodBoolean>;
         usersManagement: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type OrganizationNotifications = z.infer<typeof OrganizationNotificationsSchema>;
 //# sourceMappingURL=organization-notifications.shared.schemas.d.ts.map

package/dist/esm/organizations/organization-notifications.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;uCAsB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}
+{"version":3,"file":"organization-notifications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAY/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;iBAoB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}