@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/organizations/application-owner-organization.shared.schemas.d.ts

@@ -0,0 +1,145 @@
+/**
+ * The application-owner organization — refusal codes and the operator promotion contract (#1054).
+ *
+ * An application whose `organizationTypes` declare `ownsApplication` on one type has an OWNER
+ * ORGANIZATION: the single organization of that type, the one that operates the application. Its
+ * singularity is protected at three moments — it cannot be created through an ordinary door, it
+ * cannot be promoted into while one exists, and it cannot be deleted — and every refusal carries a
+ * stable, client-branchable code declared here.
+ *
+ * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — the organization that operates the
+ * application is singular, and the doors that could create a second one, or destroy the only one,
+ * refuse rather than leave the application with no operator.
+ *
+ * ## Why these codes are a shared enum rather than a `reason` string
+ *
+ * The refusals are `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an ALLOWLIST of
+ * context keys on a CONFLICT — `reason` is not on it. The backend-side `reason` stays (it is the log
+ * and audit identity, richer than the wire and free to stay so), but a CLIENT wanting to tell these
+ * apart from any other 409 has only the stable `code` key, sourced from an enum in
+ * `@wildo-ai/saas-models` so backend and frontend share one definition.
+ *
+ * This is the trap `organizationMembers.grantOwnership` fell into and the reason the allowlist's own
+ * documented rule exists: its two CONFLICTs carry only `reason`, so they are invisible to every
+ * client and a caller must regex-parse a message that is free to be reworded.
+ *
+ * @see AdministrativeContinuityErrorCode — the sibling enum for the two authority floors. Distinct
+ *   populations: those protect a scope's ADMINISTRATORS, these protect the identity of the
+ *   organization that owns the application itself.
+ */
+/** @wildo_source:part:start saas.models.organizations.application-owner-codes facet:layer:shared facet:audience:app-developer */
+/**
+ * Why a write against the application-owner organization was refused.
+ *
+ * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: the
+ * refusals, the resource specification's error scenarios and any client branch all derive from this
+ * enum rather than re-typing the literals.
+ *
+ * ## Where you meet it
+ *
+ * Each refusal is HTTP **409 CONFLICT** and the value rides under the response's stable `code` key.
+ * Branch on `code`, never on the message — the message is a human remedy and is free to be reworded,
+ * and every other field a backend might have used to carry the reason is stripped from a CONFLICT
+ * before it reaches a client.
+ *
+ * `409` and not `403`/`400` in every case, deliberately: the caller IS authorised and the payload IS
+ * valid — the type named is declared, the organization addressed exists. What forbids the write is a
+ * fact about the APPLICATION: it is operated by exactly one organization, and that singularity is what
+ * each of these writes would break.
+ *
+ * `403` was the alternative for the creation refusal and is wrong twice over. It would say the caller
+ * lacks authority, which is false — a super-administrator is refused by the same rule as a registrant,
+ * because the door is the thing that is shut and not the principal. And `sanitizeErrorForClient`
+ * strips the whole context from an AUTHORIZATION error, so the `code` below would never reach a
+ * client and this enum would be decorative.
+ */
+export declare enum ApplicationOwnerOrganizationErrorCode {
+    /**
+     * The application already has an organization of the type that declares `ownsApplication`, and this
+     * write would produce a second one.
+     *
+     * An application is operated by ONE organization; two would make every question that resolves
+     * through the marker — whose rows these are, whose credentials were spent — a choice nobody
+     * declared. Remedy: use the existing owner organization. If the existing one is the wrong one, that
+     * is a data-repair question rather than a creation question, and there is no operation that
+     * demotes an owner.
+     */
+    APPLICATION_OWNER_ORGANIZATION_EXISTS = "APPLICATION_OWNER_ORGANIZATION_EXISTS",
+    /**
+     * The organization is the application's owner and may not be put on the deletion path.
+     *
+     * Refused for `requestDeletion` (both variants), for the purge `delete` (both variants), and by the
+     * purge batch. Everything the application owns as an operator — the rows its systems of record
+     * project, the pipelines that load them — belongs to this organization, so purging it strands them
+     * with no tenant and nothing that could re-create one: `Organization.type` is creation-time
+     * identity, and there is no door that mints a second owner.
+     *
+     * SUSPENSION is deliberately NOT refused. Halting the owner organization is incident response, and
+     * every read through it then refuses at the ordinary status gate — the same asymmetry the
+     * organization-owner floor is built on: a suspended tenant is recoverable, a purged one is not, so
+     * the refusal belongs on the irreversible act only.
+     *
+     * Remedy: if the application is genuinely being decommissioned, remove the `ownsApplication` marker
+     * from the declaration first — the refusal is about what the application currently says it needs.
+     */
+    OWNER_ORGANIZATION_CANNOT_BE_DELETED = "OWNER_ORGANIZATION_CANNOT_BE_DELETED",
+    /**
+     * An organization of the owner type cannot be created through this door.
+     *
+     * The refusal is by DOOR, not by count: **no** service-tier `CREATE` may produce the owner
+     * organization, whether or not one exists yet. Two doors make one — the platform's bootstrap, which
+     * seeds the first administrator's organization when the application is initialised, and
+     * `organizations.promoteToOwnerOrganization`, which re-types an existing organization under audit.
+     *
+     * Counting instead would have left a real hole: the marked type declares no `creationPolicy` (the
+     * configuration refuses one), the default `CREATE` variant is open to `APP_USER`, and the creation
+     * prefix restricts only types that HAVE a creation policy. So before the bootstrap ran, any
+     * registrant could have created the owner organization and become its founding owner.
+     *
+     * Remedy: create an ordinary organization of a non-owner type, or ask a super-administrator to
+     * promote an existing organization.
+     */
+    OWNER_ORGANIZATION_TYPE_NOT_CREATABLE = "OWNER_ORGANIZATION_TYPE_NOT_CREATABLE",
+    /**
+     * A promotion was asked for and the declaration does not name exactly ONE owner organization type, so
+     * there is nothing unambiguous to promote INTO.
+     *
+     * Its own code rather than a reuse of the three above, because the remedy is in a different place:
+     * those are about which ROWS exist, this is about what the DECLARATION says.
+     *
+     * ONE code, two opposite remedies, and the refusal message says which one you hit: either NO type
+     * carries `ownsApplication` (declare one) or SEVERAL do (remove the marker from all but one). They
+     * share a code because a client branches identically on both — the declaration is wrong and no
+     * promotion can proceed — while a human needs the distinction, which is what the message carries.
+     * Reporting the second as "no type declares it" would send an operator to add a third.
+     */
+    APPLICATION_DECLARES_NO_OWNER_ORGANIZATION_TYPE = "APPLICATION_DECLARES_NO_OWNER_ORGANIZATION_TYPE",
+    /**
+     * The organization cannot be promoted because the owner type would change what its members are or
+     * may hold — a dependent policy surface the promotion refuses rather than reconciles.
+     *
+     * Three mismatches carry this code, and the refusal names which one it hit and the exact values:
+     * the owner type grants fewer `userTypes` than the organization's current type (promoting would
+     * revoke a global grant from every member); a membership holds a role the owner type does not list
+     * in `availableOrgRoles`; or THIS organization is actively managed by a directory — the
+     * `DIRECTORY_PROVISIONING` feature is enabled for it and a live SCIM token exists — and the owner
+     * type does not declare `scimProvisioning`, so promoting would stop it being reconciled by its IdP.
+     *
+     * Note the third asks about the ORGANIZATION, not about the two type definitions.
+     * `scimProvisioning.enabled` on a type is only the application-wide MOUNT gate (the engine mounts the
+     * SCIM controllers when at least one declared type carries it) and says nothing about whether any one
+     * tenant is directory-managed — so comparing the two flags would refuse a promotion for every tenant
+     * with no directory wired at all, which is most of them.
+     *
+     * Why refuse rather than revoke-and-regrant: a promotion that changed what people can do while
+     * calling itself a re-typing is the kind of silent authority change an access review cannot see.
+     * The operation changes the tenant's identity and touches nobody's authority, and this refusal is
+     * what keeps that true.
+     *
+     * Remedy: widen the owner type in `organizationTypes` (add the user types, the roles, or the SCIM
+     * binding), run `wildo config reapply-declaration`, then retry.
+     */
+    OWNER_PROMOTION_INCOMPATIBLE_WITH_TARGET_TYPE = "OWNER_PROMOTION_INCOMPATIBLE_WITH_TARGET_TYPE"
+}
+/** @wildo_source:part:end saas.models.organizations.application-owner-codes */
+//# sourceMappingURL=application-owner-organization.shared.schemas.d.ts.map

package/dist/esm/organizations/application-owner-organization.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-owner-organization.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/application-owner-organization.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,iIAAiI;AACjI;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,qCAAqC;IAC/C;;;;;;;;;OASG;IACH,qCAAqC,0CAA0C;IAE/E;;;;;;;;;;;;;;;;OAgBG;IACH,oCAAoC,yCAAyC;IAE7E;;;;;;;;;;;;;;;OAeG;IACH,qCAAqC,0CAA0C;IAE/E;;;;;;;;;;;;OAYG;IACH,+CAA+C,oDAAoD;IAEnG;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,6CAA6C,kDAAkD;CAChG;AACD,+EAA+E"}

package/dist/esm/organizations/application-owner-organization.shared.schemas.js

@@ -0,0 +1,146 @@
+/**
+ * The application-owner organization — refusal codes and the operator promotion contract (#1054).
+ *
+ * An application whose `organizationTypes` declare `ownsApplication` on one type has an OWNER
+ * ORGANIZATION: the single organization of that type, the one that operates the application. Its
+ * singularity is protected at three moments — it cannot be created through an ordinary door, it
+ * cannot be promoted into while one exists, and it cannot be deleted — and every refusal carries a
+ * stable, client-branchable code declared here.
+ *
+ * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — the organization that operates the
+ * application is singular, and the doors that could create a second one, or destroy the only one,
+ * refuse rather than leave the application with no operator.
+ *
+ * ## Why these codes are a shared enum rather than a `reason` string
+ *
+ * The refusals are `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an ALLOWLIST of
+ * context keys on a CONFLICT — `reason` is not on it. The backend-side `reason` stays (it is the log
+ * and audit identity, richer than the wire and free to stay so), but a CLIENT wanting to tell these
+ * apart from any other 409 has only the stable `code` key, sourced from an enum in
+ * `@wildo-ai/saas-models` so backend and frontend share one definition.
+ *
+ * This is the trap `organizationMembers.grantOwnership` fell into and the reason the allowlist's own
+ * documented rule exists: its two CONFLICTs carry only `reason`, so they are invisible to every
+ * client and a caller must regex-parse a message that is free to be reworded.
+ *
+ * @see AdministrativeContinuityErrorCode — the sibling enum for the two authority floors. Distinct
+ *   populations: those protect a scope's ADMINISTRATORS, these protect the identity of the
+ *   organization that owns the application itself.
+ */
+/** @wildo_source:part:start saas.models.organizations.application-owner-codes facet:layer:shared facet:audience:app-developer */
+/**
+ * Why a write against the application-owner organization was refused.
+ *
+ * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: the
+ * refusals, the resource specification's error scenarios and any client branch all derive from this
+ * enum rather than re-typing the literals.
+ *
+ * ## Where you meet it
+ *
+ * Each refusal is HTTP **409 CONFLICT** and the value rides under the response's stable `code` key.
+ * Branch on `code`, never on the message — the message is a human remedy and is free to be reworded,
+ * and every other field a backend might have used to carry the reason is stripped from a CONFLICT
+ * before it reaches a client.
+ *
+ * `409` and not `403`/`400` in every case, deliberately: the caller IS authorised and the payload IS
+ * valid — the type named is declared, the organization addressed exists. What forbids the write is a
+ * fact about the APPLICATION: it is operated by exactly one organization, and that singularity is what
+ * each of these writes would break.
+ *
+ * `403` was the alternative for the creation refusal and is wrong twice over. It would say the caller
+ * lacks authority, which is false — a super-administrator is refused by the same rule as a registrant,
+ * because the door is the thing that is shut and not the principal. And `sanitizeErrorForClient`
+ * strips the whole context from an AUTHORIZATION error, so the `code` below would never reach a
+ * client and this enum would be decorative.
+ */
+export var ApplicationOwnerOrganizationErrorCode;
+(function (ApplicationOwnerOrganizationErrorCode) {
+    /**
+     * The application already has an organization of the type that declares `ownsApplication`, and this
+     * write would produce a second one.
+     *
+     * An application is operated by ONE organization; two would make every question that resolves
+     * through the marker — whose rows these are, whose credentials were spent — a choice nobody
+     * declared. Remedy: use the existing owner organization. If the existing one is the wrong one, that
+     * is a data-repair question rather than a creation question, and there is no operation that
+     * demotes an owner.
+     */
+    ApplicationOwnerOrganizationErrorCode["APPLICATION_OWNER_ORGANIZATION_EXISTS"] = "APPLICATION_OWNER_ORGANIZATION_EXISTS";
+    /**
+     * The organization is the application's owner and may not be put on the deletion path.
+     *
+     * Refused for `requestDeletion` (both variants), for the purge `delete` (both variants), and by the
+     * purge batch. Everything the application owns as an operator — the rows its systems of record
+     * project, the pipelines that load them — belongs to this organization, so purging it strands them
+     * with no tenant and nothing that could re-create one: `Organization.type` is creation-time
+     * identity, and there is no door that mints a second owner.
+     *
+     * SUSPENSION is deliberately NOT refused. Halting the owner organization is incident response, and
+     * every read through it then refuses at the ordinary status gate — the same asymmetry the
+     * organization-owner floor is built on: a suspended tenant is recoverable, a purged one is not, so
+     * the refusal belongs on the irreversible act only.
+     *
+     * Remedy: if the application is genuinely being decommissioned, remove the `ownsApplication` marker
+     * from the declaration first — the refusal is about what the application currently says it needs.
+     */
+    ApplicationOwnerOrganizationErrorCode["OWNER_ORGANIZATION_CANNOT_BE_DELETED"] = "OWNER_ORGANIZATION_CANNOT_BE_DELETED";
+    /**
+     * An organization of the owner type cannot be created through this door.
+     *
+     * The refusal is by DOOR, not by count: **no** service-tier `CREATE` may produce the owner
+     * organization, whether or not one exists yet. Two doors make one — the platform's bootstrap, which
+     * seeds the first administrator's organization when the application is initialised, and
+     * `organizations.promoteToOwnerOrganization`, which re-types an existing organization under audit.
+     *
+     * Counting instead would have left a real hole: the marked type declares no `creationPolicy` (the
+     * configuration refuses one), the default `CREATE` variant is open to `APP_USER`, and the creation
+     * prefix restricts only types that HAVE a creation policy. So before the bootstrap ran, any
+     * registrant could have created the owner organization and become its founding owner.
+     *
+     * Remedy: create an ordinary organization of a non-owner type, or ask a super-administrator to
+     * promote an existing organization.
+     */
+    ApplicationOwnerOrganizationErrorCode["OWNER_ORGANIZATION_TYPE_NOT_CREATABLE"] = "OWNER_ORGANIZATION_TYPE_NOT_CREATABLE";
+    /**
+     * A promotion was asked for and the declaration does not name exactly ONE owner organization type, so
+     * there is nothing unambiguous to promote INTO.
+     *
+     * Its own code rather than a reuse of the three above, because the remedy is in a different place:
+     * those are about which ROWS exist, this is about what the DECLARATION says.
+     *
+     * ONE code, two opposite remedies, and the refusal message says which one you hit: either NO type
+     * carries `ownsApplication` (declare one) or SEVERAL do (remove the marker from all but one). They
+     * share a code because a client branches identically on both — the declaration is wrong and no
+     * promotion can proceed — while a human needs the distinction, which is what the message carries.
+     * Reporting the second as "no type declares it" would send an operator to add a third.
+     */
+    ApplicationOwnerOrganizationErrorCode["APPLICATION_DECLARES_NO_OWNER_ORGANIZATION_TYPE"] = "APPLICATION_DECLARES_NO_OWNER_ORGANIZATION_TYPE";
+    /**
+     * The organization cannot be promoted because the owner type would change what its members are or
+     * may hold — a dependent policy surface the promotion refuses rather than reconciles.
+     *
+     * Three mismatches carry this code, and the refusal names which one it hit and the exact values:
+     * the owner type grants fewer `userTypes` than the organization's current type (promoting would
+     * revoke a global grant from every member); a membership holds a role the owner type does not list
+     * in `availableOrgRoles`; or THIS organization is actively managed by a directory — the
+     * `DIRECTORY_PROVISIONING` feature is enabled for it and a live SCIM token exists — and the owner
+     * type does not declare `scimProvisioning`, so promoting would stop it being reconciled by its IdP.
+     *
+     * Note the third asks about the ORGANIZATION, not about the two type definitions.
+     * `scimProvisioning.enabled` on a type is only the application-wide MOUNT gate (the engine mounts the
+     * SCIM controllers when at least one declared type carries it) and says nothing about whether any one
+     * tenant is directory-managed — so comparing the two flags would refuse a promotion for every tenant
+     * with no directory wired at all, which is most of them.
+     *
+     * Why refuse rather than revoke-and-regrant: a promotion that changed what people can do while
+     * calling itself a re-typing is the kind of silent authority change an access review cannot see.
+     * The operation changes the tenant's identity and touches nobody's authority, and this refusal is
+     * what keeps that true.
+     *
+     * Remedy: widen the owner type in `organizationTypes` (add the user types, the roles, or the SCIM
+     * binding), run `wildo config reapply-declaration`, then retry.
+     */
+    ApplicationOwnerOrganizationErrorCode["OWNER_PROMOTION_INCOMPATIBLE_WITH_TARGET_TYPE"] = "OWNER_PROMOTION_INCOMPATIBLE_WITH_TARGET_TYPE";
+})(ApplicationOwnerOrganizationErrorCode || (ApplicationOwnerOrganizationErrorCode = {}));
+/** @wildo_source:part:end saas.models.organizations.application-owner-codes */
+//# sourceMappingURL=application-owner-organization.shared.schemas.js.map

package/dist/esm/organizations/application-owner-organization.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-owner-organization.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/application-owner-organization.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,iIAAiI;AACjI;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,qCA2FX;AA3FD,WAAY,qCAAqC;IAC/C;;;;;;;;;OASG;IACH,wHAA+E,CAAA;IAE/E;;;;;;;;;;;;;;;;OAgBG;IACH,sHAA6E,CAAA;IAE7E;;;;;;;;;;;;;;;OAeG;IACH,wHAA+E,CAAA;IAE/E;;;;;;;;;;;;OAYG;IACH,4IAAmG,CAAA;IAEnG;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,wIAA+F,CAAA;AACjG,CAAC,EA3FW,qCAAqC,KAArC,qCAAqC,QA2FhD;AACD,+EAA+E","sourcesContent":["/**\n * The application-owner organization — refusal codes and the operator promotion contract (#1054).\n *\n * An application whose `organizationTypes` declare `ownsApplication` on one type has an OWNER\n * ORGANIZATION: the single organization of that type, the one that operates the application. Its\n * singularity is protected at three moments — it cannot be created through an ordinary door, it\n * cannot be promoted into while one exists, and it cannot be deleted — and every refusal carries a\n * stable, client-branchable code declared here.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — the organization that operates the\n * application is singular, and the doors that could create a second one, or destroy the only one,\n * refuse rather than leave the application with no operator.\n *\n * ## Why these codes are a shared enum rather than a `reason` string\n *\n * The refusals are `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an ALLOWLIST of\n * context keys on a CONFLICT — `reason` is not on it. The backend-side `reason` stays (it is the log\n * and audit identity, richer than the wire and free to stay so), but a CLIENT wanting to tell these\n * apart from any other 409 has only the stable `code` key, sourced from an enum in\n * `@wildo-ai/saas-models` so backend and frontend share one definition.\n *\n * This is the trap `organizationMembers.grantOwnership` fell into and the reason the allowlist's own\n * documented rule exists: its two CONFLICTs carry only `reason`, so they are invisible to every\n * client and a caller must regex-parse a message that is free to be reworded.\n *\n * @see AdministrativeContinuityErrorCode — the sibling enum for the two authority floors. Distinct\n *   populations: those protect a scope's ADMINISTRATORS, these protect the identity of the\n *   organization that owns the application itself.\n */\n\n/** @wildo_source:part:start saas.models.organizations.application-owner-codes facet:layer:shared facet:audience:app-developer */\n/**\n * Why a write against the application-owner organization was refused.\n *\n * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: the\n * refusals, the resource specification's error scenarios and any client branch all derive from this\n * enum rather than re-typing the literals.\n *\n * ## Where you meet it\n *\n * Each refusal is HTTP **409 CONFLICT** and the value rides under the response's stable `code` key.\n * Branch on `code`, never on the message — the message is a human remedy and is free to be reworded,\n * and every other field a backend might have used to carry the reason is stripped from a CONFLICT\n * before it reaches a client.\n *\n * `409` and not `403`/`400` in every case, deliberately: the caller IS authorised and the payload IS\n * valid — the type named is declared, the organization addressed exists. What forbids the write is a\n * fact about the APPLICATION: it is operated by exactly one organization, and that singularity is what\n * each of these writes would break.\n *\n * `403` was the alternative for the creation refusal and is wrong twice over. It would say the caller\n * lacks authority, which is false — a super-administrator is refused by the same rule as a registrant,\n * because the door is the thing that is shut and not the principal. And `sanitizeErrorForClient`\n * strips the whole context from an AUTHORIZATION error, so the `code` below would never reach a\n * client and this enum would be decorative.\n */\nexport enum ApplicationOwnerOrganizationErrorCode {\n  /**\n   * The application already has an organization of the type that declares `ownsApplication`, and this\n   * write would produce a second one.\n   *\n   * An application is operated by ONE organization; two would make every question that resolves\n   * through the marker — whose rows these are, whose credentials were spent — a choice nobody\n   * declared. Remedy: use the existing owner organization. If the existing one is the wrong one, that\n   * is a data-repair question rather than a creation question, and there is no operation that\n   * demotes an owner.\n   */\n  APPLICATION_OWNER_ORGANIZATION_EXISTS = 'APPLICATION_OWNER_ORGANIZATION_EXISTS',\n\n  /**\n   * The organization is the application's owner and may not be put on the deletion path.\n   *\n   * Refused for `requestDeletion` (both variants), for the purge `delete` (both variants), and by the\n   * purge batch. Everything the application owns as an operator — the rows its systems of record\n   * project, the pipelines that load them — belongs to this organization, so purging it strands them\n   * with no tenant and nothing that could re-create one: `Organization.type` is creation-time\n   * identity, and there is no door that mints a second owner.\n   *\n   * SUSPENSION is deliberately NOT refused. Halting the owner organization is incident response, and\n   * every read through it then refuses at the ordinary status gate — the same asymmetry the\n   * organization-owner floor is built on: a suspended tenant is recoverable, a purged one is not, so\n   * the refusal belongs on the irreversible act only.\n   *\n   * Remedy: if the application is genuinely being decommissioned, remove the `ownsApplication` marker\n   * from the declaration first — the refusal is about what the application currently says it needs.\n   */\n  OWNER_ORGANIZATION_CANNOT_BE_DELETED = 'OWNER_ORGANIZATION_CANNOT_BE_DELETED',\n\n  /**\n   * An organization of the owner type cannot be created through this door.\n   *\n   * The refusal is by DOOR, not by count: **no** service-tier `CREATE` may produce the owner\n   * organization, whether or not one exists yet. Two doors make one — the platform's bootstrap, which\n   * seeds the first administrator's organization when the application is initialised, and\n   * `organizations.promoteToOwnerOrganization`, which re-types an existing organization under audit.\n   *\n   * Counting instead would have left a real hole: the marked type declares no `creationPolicy` (the\n   * configuration refuses one), the default `CREATE` variant is open to `APP_USER`, and the creation\n   * prefix restricts only types that HAVE a creation policy. So before the bootstrap ran, any\n   * registrant could have created the owner organization and become its founding owner.\n   *\n   * Remedy: create an ordinary organization of a non-owner type, or ask a super-administrator to\n   * promote an existing organization.\n   */\n  OWNER_ORGANIZATION_TYPE_NOT_CREATABLE = 'OWNER_ORGANIZATION_TYPE_NOT_CREATABLE',\n\n  /**\n   * A promotion was asked for and the declaration does not name exactly ONE owner organization type, so\n   * there is nothing unambiguous to promote INTO.\n   *\n   * Its own code rather than a reuse of the three above, because the remedy is in a different place:\n   * those are about which ROWS exist, this is about what the DECLARATION says.\n   *\n   * ONE code, two opposite remedies, and the refusal message says which one you hit: either NO type\n   * carries `ownsApplication` (declare one) or SEVERAL do (remove the marker from all but one). They\n   * share a code because a client branches identically on both — the declaration is wrong and no\n   * promotion can proceed — while a human needs the distinction, which is what the message carries.\n   * Reporting the second as \"no type declares it\" would send an operator to add a third.\n   */\n  APPLICATION_DECLARES_NO_OWNER_ORGANIZATION_TYPE = 'APPLICATION_DECLARES_NO_OWNER_ORGANIZATION_TYPE',\n\n  /**\n   * The organization cannot be promoted because the owner type would change what its members are or\n   * may hold — a dependent policy surface the promotion refuses rather than reconciles.\n   *\n   * Three mismatches carry this code, and the refusal names which one it hit and the exact values:\n   * the owner type grants fewer `userTypes` than the organization's current type (promoting would\n   * revoke a global grant from every member); a membership holds a role the owner type does not list\n   * in `availableOrgRoles`; or THIS organization is actively managed by a directory — the\n   * `DIRECTORY_PROVISIONING` feature is enabled for it and a live SCIM token exists — and the owner\n   * type does not declare `scimProvisioning`, so promoting would stop it being reconciled by its IdP.\n   *\n   * Note the third asks about the ORGANIZATION, not about the two type definitions.\n   * `scimProvisioning.enabled` on a type is only the application-wide MOUNT gate (the engine mounts the\n   * SCIM controllers when at least one declared type carries it) and says nothing about whether any one\n   * tenant is directory-managed — so comparing the two flags would refuse a promotion for every tenant\n   * with no directory wired at all, which is most of them.\n   *\n   * Why refuse rather than revoke-and-regrant: a promotion that changed what people can do while\n   * calling itself a re-typing is the kind of silent authority change an access review cannot see.\n   * The operation changes the tenant's identity and touches nobody's authority, and this refusal is\n   * what keeps that true.\n   *\n   * Remedy: widen the owner type in `organizationTypes` (add the user types, the roles, or the SCIM\n   * binding), run `wildo config reapply-declaration`, then retry.\n   */\n  OWNER_PROMOTION_INCOMPATIBLE_WITH_TARGET_TYPE = 'OWNER_PROMOTION_INCOMPATIBLE_WITH_TARGET_TYPE',\n}\n/** @wildo_source:part:end saas.models.organizations.application-owner-codes */\n"]}

package/dist/esm/organizations/organization-features.shared.resources-config.schemas.d.ts

@@ -33,6 +33,8 @@ export declare const organizationFeaturesResourceConfiguration_InitializationFac
         removedFeatures: z.ZodDefault<z.ZodArray<z.ZodString>>;
         limitOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>;
     }, z.core.$strip>>>;
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
 }, z.core.$strip>>;
 export {};
 //# sourceMappingURL=organization-features.shared.resources-config.schemas.d.ts.map

package/dist/esm/organizations/organization-features.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-features.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAGrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAU/H,oBAAY,+BAA+B;IACzC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;CAClC;AAED,eAAO,MAAM,iDAAiD;;;iBAG5D,CAAC;AAEH,eAAO,MAAM,kDAAkD;;;iBAG7D,CAAC;AAEH,eAAO,MAAM,iDAAiD;;iBAE5D,CAAC;AAQH,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;kBA6I5H,CAAC"}
+{"version":3,"file":"organization-features.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAGrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoF,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAW/J,oBAAY,+BAA+B;IACzC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;CAClC;AAED,eAAO,MAAM,iDAAiD;;;iBAG5D,CAAC;AAEH,eAAO,MAAM,kDAAkD;;;iBAG7D,CAAC;AAEH,eAAO,MAAM,iDAAiD;;iBAE5D,CAAC;AAQH,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;kBAiL5H,CAAC"}

package/dist/esm/organizations/organization-features.shared.resources-config.schemas.js

@@ -6,11 +6,12 @@
  */
 import { z } from 'zod';
 import { CoreFeature } from './organization-features.shared.schemas.js';
-import { ScopeFeaturesWithOverridesSchema } from '../features/scope-features.shared.schemas.js';
+import { OrganizationFeaturesSchema, ScopeFeaturesWithOverridesSchema } from '../features/scope-features.shared.schemas.js';
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions.js';
-import { ResourceOperationRiskLevel } from '../resources/resources.shared.schemas.js';
+import { ResourceOperationRiskLevel, ResourceOperationReversibility } from '../resources/resources.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
 import { ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
 // Custom operations enum for organization features
@@ -39,11 +40,30 @@ const ORGANIZATION_FEATURES_FILTER_FIELDS = {
 Organization Features Resource Configuration Factory
 */
 export const organizationFeaturesResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
-    mainSchema: ScopeFeaturesWithOverridesSchema,
+    mainSchema: OrganizationFeaturesSchema,
     resourceIdentifier: CoreResourceType.ORGANIZATION_FEATURES,
     resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_FEATURES],
     resourceRelationships: resourcesRelationships,
     isSystemResource: true,
+    /*
+     * The framework may materialise this scope's row on a caller's behalf — the same opt-in, for the
+     * same reason, as the APPLICATION_FEATURES twin beside it.
+     *
+     * `systemAccessPolicy.create: ALLOWED` is what #1179's seam reads before materialising a
+     * context-addressed singleton the caller never named, so an administrator can START setting a
+     * tenant's entitlement overrides instead of being 404ed for the framework's own omission. The row
+     * written is the scope foreign key and nothing else; this resource's schema fills the rest.
+     *
+     * NOTE, measured 2026-09-19: this does NOT make a READ materialise. That seam is reached for
+     * UPDATE and DELETE only — extending it to READ was tried and reverted, because a probe of the
+     * running backend showed the read route never enters it. A tenant whose row is still absent
+     * therefore still 404s when the Entitlements pane reads it; making that row EXIST is a seeding
+     * question, not an access-policy one.
+     */
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+    },
     coreOperations: [
         CoreResourceOperation.CREATE,
         CoreResourceOperation.READ,
@@ -55,6 +75,19 @@ export const organizationFeaturesResourceConfiguration_InitializationFactory = (
         CoreResourceOperation.DELETE
     ],
     customOperation: OrganizationFeatures_Operations,
+    // assurance-control: WILDO.ENTITLEMENT.NO_SELF_GRANT — a tenant cannot widen its own entitlements.
+    //
+    // This ledger IS the organization's entitlement set, so the only thing standing between a tenant
+    // administrator and an arbitrary feature grant is the role on each WRITE below. Every one of them —
+    // CREATE, UPDATE, DELETE, ENABLE_FEATURE, DISABLE_FEATURE, RESET_FEATURES — is
+    // `APP_ADMIN_SUPER_ADMIN`, a role no organization-scope entry can confer, while READ and SEARCH are
+    // deliberately `ORG_MEMBER` so a tenant can see what it has without being able to change it.
+    //
+    // Field-level protection is NOT available here and would be the wrong instrument if it were: the
+    // super-admin path has to write these same fields, so `excludeFromUpdate` would block the legitimate
+    // grant along with the illegitimate one. The role gate is therefore the whole control, and adding a
+    // tenant role to any write below removes it entirely rather than weakening it. Pinned by
+    // `security-sensitive-operation-reachability.backend.test.ts`, which asserts the exact role array.
     operationsConfiguration: {
         [CoreResourceOperation.CREATE]: {
             variants: [
@@ -158,6 +191,9 @@ export const organizationFeaturesResourceConfiguration_InitializationFactory = (
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Only super admins can reset features
                     riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                    // IRREVERSIBLE: Clears every override on the organization. No backup of the list exists.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     resourceOperationLike: CoreResourceOperation.UPDATE_MANY,
                     requestDto: OrganizationFeaturesResetFeaturesRequestDtoSchema,
                     customResponseDto: ScopeFeaturesWithOverridesSchema,

package/dist/esm/organizations/organization-features.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-features.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAE7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAEtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,mDAAmD;AACnD,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACzC,oEAAiC,CAAA;IACjC,sEAAmC,CAAA;IACnC,oEAAiC,CAAA;AACnC,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AAED,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,CAAC,UAAU,CAAC,CAAC;AAEvD,MAAM,mCAAmC,GAAG;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;CAC9B,CAAC;AASF;;EAEE;AACF,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI3K;IACA,UAAU,EAAE,gCAAgC;IAC5C,kBAAkB,EAAE,gBAAgB,CAAC,qBAAqB;IAC1D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;IACnG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mFAAmF;QACnF,mFAAmF;QACnF,6EAA6E;QAC7E,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,+BAA+B;IAEhD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,gCAAgC;oBACpE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,UAAU,CAAC;oBAC9B,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,mCAAmC;oBACjD,UAAU,EAAE,iCAAiC;oBAC7C,8BAA8B,EAAE,EAAE;iBACnC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qDAAqD;oBACpG,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,UAAU,EAAE,gCAAgC,CAAC,OAAO,EAAE;iBACvD;aACF;SACF;QAED,kFAAkF;QAClF,4EAA4E;QAC5E,gFAAgF;QAChF,+EAA+E;QAC/E,mFAAmF;QACnF,sFAAsF;QACtF,oFAAoF;QACpF,mFAAmF;QACnF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,iDAAiD;oBAC7D,iEAAiE;oBACjE,iEAAiE;oBACjE,gEAAgE;oBAChE,mEAAmE;oBACnE,iBAAiB,EAAE,gCAAgC;iBACpD;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,eAAe,CAAC,EAAE;YACjD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kDAAkD;oBAC9D,iBAAiB,EAAE,gCAAgC;iBACpD;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uCAAuC;oBACtF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,iDAAiD;oBAC7D,iBAAiB,EAAE,gCAAgC;iBACpD;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Features Shared Resource Configuration\n *\n * Resource configuration for organization feature management.\n * Controls which features are available to organizations.\n */\n\nimport { z } from 'zod';\nimport { CoreFeature } from './organization-features.shared.schemas';\nimport { ScopeFeaturesWithOverridesSchema } from '../features/scope-features.shared.schemas';\n\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for organization features\nexport enum OrganizationFeatures_Operations {\n  ENABLE_FEATURE = 'enable_feature',\n  DISABLE_FEATURE = 'disable_feature',\n  RESET_FEATURES = 'reset_features', // Reset to default features\n}\n\nexport const OrganizationFeaturesEnableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().max(500).optional()\n});\n\nexport const OrganizationFeaturesDisableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().min(1).max(500)\n});\n\nexport const OrganizationFeaturesResetFeaturesRequestDtoSchema = z.object({\n  reason: z.string().min(1).max(500)\n});\n\nconst ORGANIZATION_FEATURES_SORT_FIELDS = ['features'];\n\nconst ORGANIZATION_FEATURES_FILTER_FIELDS = {\n  features: z.enum(CoreFeature),\n};\n\ntype OrganizationFeaturesCoreOperations =\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Features Resource Configuration Factory\n*/\nexport const organizationFeaturesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrganizationFeatures_Operations,\n  OrganizationFeaturesCoreOperations,\n  typeof ScopeFeaturesWithOverridesSchema\n>({\n  mainSchema: ScopeFeaturesWithOverridesSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_FEATURES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_FEATURES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition onParentDelete\n    // cascade so the row is physically removed when its org is deleted. Without it the\n    // cascade throws ErrorType.CONFIGURATION on any org that has a features row.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: OrganizationFeatures_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view features\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['features'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORGANIZATION_FEATURES_FILTER_FIELDS,\n          sortFields: ORGANIZATION_FEATURES_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Only super admins can update organization features\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          requestDto: ScopeFeaturesWithOverridesSchema.partial(),\n        }\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY): powers the composition onParentDelete cascade,\n    // not a public API surface — the ledger is reset, never DELETEd, over HTTP.\n    // Role is APP_ADMIN_SUPER_ADMIN (matching this ledger's CREATE/UPDATE), NOT the\n    // org-scope-admin (ORG_ADMIN) used by other org-scoped onParentDelete adopters\n    // (progression/guidance/preferences): the features ledger is super-admin-managed —\n    // org-admins have no authority over it — so its teardown tracks the super-admin tier.\n    // Ratified 2026-07-11; the role is inert here anyway (REPOSITORY_ONLY → the cascade\n    // calls repository.delete() with no role check). Do NOT \"align\" this to ORG_ADMIN.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [OrganizationFeatures_Operations.ENABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Only super admins can enable features\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: OrganizationFeaturesEnableFeatureRequestDtoSchema,\n          // The collection-scoped route shape is UPDATE_MANY-like, but the\n          // override-all implementation persists and returns the singleton\n          // feature ledger. Keep the wire response owned here rather than\n          // inheriting DefaultUpdateManyResponseSchema from the route shape.\n          customResponseDto: ScopeFeaturesWithOverridesSchema,\n        }\n      ],\n    },\n\n    [OrganizationFeatures_Operations.DISABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Only super admins can disable features\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: OrganizationFeaturesDisableFeatureRequestDtoSchema,\n          customResponseDto: ScopeFeaturesWithOverridesSchema,\n        }\n      ],\n    },\n\n    [OrganizationFeatures_Operations.RESET_FEATURES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Only super admins can reset features\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: OrganizationFeaturesResetFeaturesRequestDtoSchema,\n          customResponseDto: ScopeFeaturesWithOverridesSchema,\n        }\n      ],\n    }\n  },\n});\n"]}
+{"version":3,"file":"organization-features.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAEzH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,uCAAuC,CAAC;AAC/J,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAEtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,mDAAmD;AACnD,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACzC,oEAAiC,CAAA;IACjC,sEAAmC,CAAA;IACnC,oEAAiC,CAAA;AACnC,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AAED,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,MAAM,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,CAAC,UAAU,CAAC,CAAC;AAEvD,MAAM,mCAAmC,GAAG;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;CAC9B,CAAC;AASF;;EAEE;AACF,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI3K;IACA,UAAU,EAAE,0BAA0B;IACtC,kBAAkB,EAAE,gBAAgB,CAAC,qBAAqB;IAC1D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;IACnG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mFAAmF;QACnF,mFAAmF;QACnF,6EAA6E;QAC7E,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,+BAA+B;IAEhD,mGAAmG;IACnG,EAAE;IACF,iGAAiG;IACjG,oGAAoG;IACpG,+EAA+E;IAC/E,oGAAoG;IACpG,6FAA6F;IAC7F,EAAE;IACF,iGAAiG;IACjG,qGAAqG;IACrG,oGAAoG;IACpG,yFAAyF;IACzF,mGAAmG;IACnG,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,gCAAgC;oBACpE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,UAAU,CAAC;oBAC9B,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,mCAAmC;oBACjD,UAAU,EAAE,iCAAiC;oBAC7C,8BAA8B,EAAE,EAAE;iBACnC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qDAAqD;oBACpG,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,UAAU,EAAE,gCAAgC,CAAC,OAAO,EAAE;iBACvD;aACF;SACF;QAED,kFAAkF;QAClF,4EAA4E;QAC5E,gFAAgF;QAChF,+EAA+E;QAC/E,mFAAmF;QACnF,sFAAsF;QACtF,oFAAoF;QACpF,mFAAmF;QACnF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,iDAAiD;oBAC7D,iEAAiE;oBACjE,iEAAiE;oBACjE,gEAAgE;oBAChE,mEAAmE;oBACnE,iBAAiB,EAAE,gCAAgC;iBACpD;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,eAAe,CAAC,EAAE;YACjD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kDAAkD;oBAC9D,iBAAiB,EAAE,gCAAgC;iBACpD;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uCAAuC;oBACtF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,yFAAyF;oBACzF,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,iDAAiD;oBAC7D,iBAAiB,EAAE,gCAAgC;iBACpD;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Features Shared Resource Configuration\n *\n * Resource configuration for organization feature management.\n * Controls which features are available to organizations.\n */\n\nimport { z } from 'zod';\nimport { CoreFeature } from './organization-features.shared.schemas';\nimport { OrganizationFeaturesSchema, ScopeFeaturesWithOverridesSchema } from '../features/scope-features.shared.schemas';\n\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for organization features\nexport enum OrganizationFeatures_Operations {\n  ENABLE_FEATURE = 'enable_feature',\n  DISABLE_FEATURE = 'disable_feature',\n  RESET_FEATURES = 'reset_features', // Reset to default features\n}\n\nexport const OrganizationFeaturesEnableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().max(500).optional()\n});\n\nexport const OrganizationFeaturesDisableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().min(1).max(500)\n});\n\nexport const OrganizationFeaturesResetFeaturesRequestDtoSchema = z.object({\n  reason: z.string().min(1).max(500)\n});\n\nconst ORGANIZATION_FEATURES_SORT_FIELDS = ['features'];\n\nconst ORGANIZATION_FEATURES_FILTER_FIELDS = {\n  features: z.enum(CoreFeature),\n};\n\ntype OrganizationFeaturesCoreOperations =\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Features Resource Configuration Factory\n*/\nexport const organizationFeaturesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrganizationFeatures_Operations,\n  OrganizationFeaturesCoreOperations,\n  typeof OrganizationFeaturesSchema\n>({\n  mainSchema: OrganizationFeaturesSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_FEATURES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_FEATURES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /*\n   * The framework may materialise this scope's row on a caller's behalf — the same opt-in, for the\n   * same reason, as the APPLICATION_FEATURES twin beside it.\n   *\n   * `systemAccessPolicy.create: ALLOWED` is what #1179's seam reads before materialising a\n   * context-addressed singleton the caller never named, so an administrator can START setting a\n   * tenant's entitlement overrides instead of being 404ed for the framework's own omission. The row\n   * written is the scope foreign key and nothing else; this resource's schema fills the rest.\n   *\n   * NOTE, measured 2026-09-19: this does NOT make a READ materialise. That seam is reached for\n   * UPDATE and DELETE only — extending it to READ was tried and reverted, because a probe of the\n   * running backend showed the read route never enters it. A tenant whose row is still absent\n   * therefore still 404s when the Entitlements pane reads it; making that row EXIST is a seeding\n   * question, not an access-policy one.\n   */\n  systemAccessPolicy: {\n    read: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition onParentDelete\n    // cascade so the row is physically removed when its org is deleted. Without it the\n    // cascade throws ErrorType.CONFIGURATION on any org that has a features row.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: OrganizationFeatures_Operations,\n\n  // assurance-control: WILDO.ENTITLEMENT.NO_SELF_GRANT — a tenant cannot widen its own entitlements.\n  //\n  // This ledger IS the organization's entitlement set, so the only thing standing between a tenant\n  // administrator and an arbitrary feature grant is the role on each WRITE below. Every one of them —\n  // CREATE, UPDATE, DELETE, ENABLE_FEATURE, DISABLE_FEATURE, RESET_FEATURES — is\n  // `APP_ADMIN_SUPER_ADMIN`, a role no organization-scope entry can confer, while READ and SEARCH are\n  // deliberately `ORG_MEMBER` so a tenant can see what it has without being able to change it.\n  //\n  // Field-level protection is NOT available here and would be the wrong instrument if it were: the\n  // super-admin path has to write these same fields, so `excludeFromUpdate` would block the legitimate\n  // grant along with the illegitimate one. The role gate is therefore the whole control, and adding a\n  // tenant role to any write below removes it entirely rather than weakening it. Pinned by\n  // `security-sensitive-operation-reachability.backend.test.ts`, which asserts the exact role array.\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can view features\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['features'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORGANIZATION_FEATURES_FILTER_FIELDS,\n          sortFields: ORGANIZATION_FEATURES_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Only super admins can update organization features\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          requestDto: ScopeFeaturesWithOverridesSchema.partial(),\n        }\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY): powers the composition onParentDelete cascade,\n    // not a public API surface — the ledger is reset, never DELETEd, over HTTP.\n    // Role is APP_ADMIN_SUPER_ADMIN (matching this ledger's CREATE/UPDATE), NOT the\n    // org-scope-admin (ORG_ADMIN) used by other org-scoped onParentDelete adopters\n    // (progression/guidance/preferences): the features ledger is super-admin-managed —\n    // org-admins have no authority over it — so its teardown tracks the super-admin tier.\n    // Ratified 2026-07-11; the role is inert here anyway (REPOSITORY_ONLY → the cascade\n    // calls repository.delete() with no role check). Do NOT \"align\" this to ORG_ADMIN.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [OrganizationFeatures_Operations.ENABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Only super admins can enable features\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: OrganizationFeaturesEnableFeatureRequestDtoSchema,\n          // The collection-scoped route shape is UPDATE_MANY-like, but the\n          // override-all implementation persists and returns the singleton\n          // feature ledger. Keep the wire response owned here rather than\n          // inheriting DefaultUpdateManyResponseSchema from the route shape.\n          customResponseDto: ScopeFeaturesWithOverridesSchema,\n        }\n      ],\n    },\n\n    [OrganizationFeatures_Operations.DISABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Only super admins can disable features\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: OrganizationFeaturesDisableFeatureRequestDtoSchema,\n          customResponseDto: ScopeFeaturesWithOverridesSchema,\n        }\n      ],\n    },\n\n    [OrganizationFeatures_Operations.RESET_FEATURES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Only super admins can reset features\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // IRREVERSIBLE: Clears every override on the organization. No backup of the list exists.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: OrganizationFeaturesResetFeaturesRequestDtoSchema,\n          customResponseDto: ScopeFeaturesWithOverridesSchema,\n        }\n      ],\n    }\n  },\n});\n"]}

package/dist/esm/organizations/organization-members.shared.resources-config.schemas.d.ts

@@ -32,7 +32,7 @@ export declare const ORGANIZATION_MEMBER_INVITATION_TOKEN_REVOCATION: {
 type OrganizationMembersCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.COUNT | CoreResourceOperation.UPDATE_MANY;
 export declare const organizationMembersResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<typeof OrganizationMembers_Operations, OrganizationMembersCoreOperations, import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
     userEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>>>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>>>>>;

package/dist/esm/organizations/organization-members.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-members.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-members.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,wBAAwB,EACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAA+B,MAAM,uCAAuC,CAAC;AAO5J,OAAO,EACL,wBAAwB,EAEzB,MAAM,6DAA6D,CAAC;AAMrE,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAmCjG,oBAAY,8BAA8B;IACxC,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,eAAe,mBAAmB;CACnC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+CAA+C;;;CAK3B,CAAC;AAsBlC,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,GAE3B,qBAAqB,CAAC,WAAW,CAAC;AAKtC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;mBA4f3H,CAAC"}
+{"version":3,"file":"organization-members.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-members.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,wBAAwB,EACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAA+B,MAAM,uCAAuC,CAAC;AAO5J,OAAO,EACL,wBAAwB,EAEzB,MAAM,6DAA6D,CAAC;AAMrE,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAmCjG,oBAAY,8BAA8B;IACxC,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,eAAe,mBAAmB;CACnC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+CAA+C;;;CAK3B,CAAC;AAsBlC,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,GAE3B,qBAAqB,CAAC,WAAW,CAAC;AAKtC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;mBAggB3H,CAAC"}

package/dist/esm/organizations/organization-members.shared.resources-config.schemas.js

@@ -44,7 +44,7 @@ import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/pri
 // operation path, so it does NOT inherit the UPDATE variant's ceiling gate. Follow the
 // organization-units MOVE/ARCHIVE pattern (a `prefixCoreOperations` hook returning the field
 // patch the core UPDATE persists). See
-// `.claude/plans/routed-unimplemented-operations-fail-closed.md`.
+// the 2026-08-01 routed-but-unimplemented operation sweep (#1275).
 //
 // GRANT_OWNERSHIP is the ONE exception to "role changes are UPDATE", and it exists for a reason
 // UPDATE structurally cannot serve: it is the only operation on this resource a caller who is NOT a
@@ -288,18 +288,17 @@ export const organizationMembersResourceConfiguration_InitializationFactory = (r
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     // requestDto auto-derived from decorators
                     //
-                    // Audited despite being below the HIGH/CRITICAL floor: since PROMOTE / DEMOTE were removed
-                    // (2026-08-01), **this operation IS the only org-member role-change path**, and a role
-                    // change is an access-control decision whatever the verb's risk level says. MEDIUM is the
-                    // right answer for the UI axis riskLevel primarily serves — updating a member's details
-                    // does not deserve a danger-zone affordance or a typed confirmation — but it is the wrong
-                    // answer for the evidence axis, and this flag is exactly that divergence.
+                    // Ordinary UPDATE remains audited below the HIGH/CRITICAL floor: editing member details
+                    // is MEDIUM risk for the UI, but changing roles still requires privilege evidence.
+                    // The registered UPDATE implementation also emits ORGANIZATION_MEMBER_ROLE_CHANGED after
+                    // a durable role change, with previous, requested and resulting roles. That specialized
+                    // event complements the automatic operation event; it is not an unimplemented producer.
                     //
-                    // This also closes the follow-up left open by the routed-unimplemented-operations sweep:
-                    // `CoreAuditableEventType.ORGANIZATION_MEMBER_ROLE_CHANGED` is declared and classified but
-                    // emitted by nothing, so org-member role changes produced no trail at all. The generic
-                    // mechanism covers it — with `roles` marked as audit evidence, the row carries the before
-                    // and after sets — rather than adding a sixth hand-rolled emission.
+                    // GRANT_OWNERSHIP is a separate named role-change path. Its UPDATE-like core behavior does
+                    // not inherit UPDATE's custom hooks: registration resolves the exact operation identity.
+                    // Its CRITICAL risk triggers RESOURCE_OPERATION_PERFORMED automatically, with changed
+                    // role sets carried by the roles field's audit-evidence marker. Queries covering ownership
+                    // repair must include that operation family, not only the specialized role-change event.
                     //
                     // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.
                     auditableEvent: { auditBelowRiskFloor: true },
@@ -355,7 +354,8 @@ export const organizationMembersResourceConfiguration_InitializationFactory = (r
          * it. Putting it on generic UPDATE would open every field of every membership row in every
          * tenant to a cross-tenant caller. The whole safety argument is that the opened surface is
          * exactly one field with one direction, so it is authored as its own operation whose custom
-         * implementation ignores the payload for anything but the justification.
+         * implementation reads nothing from the payload but the justification — which it records, and
+         * never persists onto the row.
          *
          * ## Deliberate narrowness
          *
@@ -366,7 +366,11 @@ export const organizationMembersResourceConfiguration_InitializationFactory = (r
          * - **`justification` is required**, not optional. This is a break-glass action against a tenant
          *   the operator is not a member of; the audit row is worth nothing without the why. `AC-2(7)`
          *   asks for privileged assignment to be monitored — the trail IS the control here, since by
-         *   construction no authorization check downstream can second-guess the caller.
+         *   construction no authorization check downstream can second-guess the caller. It lands on the
+         *   `ORGANIZATION_MEMBER_ROLE_CHANGED` row the grant emits post-commit (`eventData.justification`),
+         *   beside the before/after role sets. `RESOURCE_OPERATION_PERFORMED`, which this CRITICAL verb
+         *   also emits, carries no request payload and so cannot hold it. Until #593 it was validated here
+         *   and discarded at the service boundary.
          *
          * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — restore administrability of a scope
          * that has no usable administrator.