npm - @wildo-ai/saas-models - Versions diffs - 1.1.3 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.3 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (890) hide show

package/dist/esm/organizations/organizations.shared.schemas.d.ts CHANGED Viewed

@@ -65,7 +65,7 @@ export declare function isAuthorityConferringOrganizationStatus(status: Organiza
 export declare const OrganizationSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     name: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     slug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof OrganizationStatus>>>>>;
     platformAccessApprovalRequired: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
@@ -77,14 +77,28 @@ export declare const OrganizationSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type Organization = z.infer<typeof OrganizationSchema>;
 /**
- * Organization Context - Core organization with frequently accessed related data
+ * An organization as the frontend holds it for a signed-in member: the organization row plus what
+ * session restore fetches beside it.
  *
- * Lifecycle audit information is now tracked through auditable events
+ * **Every field here has a producer, and that is the rule for adding one.** `UserOrgsContext` obtains
+ * these with `doOperation<OrganizationContext>`, which is a CAST, not a parse — so a declared field
+ * nothing produces compiles and reads `undefined` at runtime with no warning. Until #581 this schema
+ * declared five such fields, two of them REQUIRED:
+ *
+ * | removed | why |
+ * |---|---|
+ * | `planFeatures` (required) | no producer, no consumer. Scope features have their own resource (`ORGANIZATION_FEATURES`) with its own cache invalidation; read that. |
+ * | `members` (required) | no producer, no consumer. It implied the tenant's FULL member list on every organization at session restore; the caller's own memberships already arrive on the USER_SELF context, and a people picker reads `ORGANIZATION_MEMBERS`. |
+ * | `profile`, `notifications` | no producer on the default READ session restore uses, no consumer. The ORGANIZATIONS context variant would populate the profile, and it was rejected for session restore (see `UserOrgsContext`). |
+ * | `displayName`, `logoUrl` | no producer, no consumer. `displayName` lives on `OrganizationProfileSchema`. |
+ *
+ * `preferences` stays, optional: `loadOrganizations` fetches it from `ORGANIZATION_PREFERENCES` and
+ * tolerates its absence (#563).
  */
 export declare const OrganizationContextSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     name: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     slug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof OrganizationStatus>>>>>;
     platformAccessApprovalRequired: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
@@ -93,68 +107,6 @@ export declare const OrganizationContextSchema: z.ZodObject<{
     deletionRequestedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>>;
     ownerFloorSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
     purgeScheduledAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>>;
-    planFeatures: z.ZodObject<{
-        features: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("./organization-features.shared.schemas").CoreFeature>, z.ZodString]>>>>>;
-        limits: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>>>;
-        manualOverrides: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-            addedFeatures: z.ZodDefault<z.ZodArray<z.ZodString>>;
-            removedFeatures: z.ZodDefault<z.ZodArray<z.ZodString>>;
-            limitOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>;
-    members: z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
-        _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-        userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
-        userEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>>>>>;
-        organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-        roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("..").CORE_ORG_ROLES>, z.ZodString]>>>>>>;
-        status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("./organization-members.shared.schemas").OrganizationMemberStatus>>>>>>>;
-        scheduledReactivationAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
-        userTitle: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
-        invitedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
-        invitedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
-        instanceLabel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-        createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
-        updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
-    }, z.core.$strip>>>;
-    displayName: z.ZodOptional<z.ZodString>;
-    logoUrl: z.ZodOptional<z.ZodURL>;
-    profile: z.ZodOptional<z.ZodObject<{
-        _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-        organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-        displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
-        domain: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-        phone: z.ZodOptional<z.ZodString>;
-        website: z.ZodOptional<z.ZodURL>;
-        description: z.ZodOptional<z.ZodString>;
-        industry: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof import("./organization-profile.shared.schemas").OrganizationIndustry>>>;
-        size: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof import("./organization-profile.shared.schemas").OrganizationSize>>>;
-        founded: z.ZodOptional<z.ZodDate>;
-        address: z.ZodOptional<z.ZodObject<{
-            line1: z.ZodString;
-            line2: z.ZodOptional<z.ZodString>;
-            city: z.ZodString;
-            state: z.ZodOptional<z.ZodString>;
-            country: z.ZodString;
-            postalCode: z.ZodString;
-        }, z.core.$strip>>;
-        timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodString>>;
-        branding: z.ZodDefault<z.ZodObject<{
-            logo: z.ZodOptional<z.ZodURL>;
-            favicon: z.ZodOptional<z.ZodURL>;
-            primaryColor: z.ZodOptional<z.ZodString>;
-            secondaryColor: z.ZodOptional<z.ZodString>;
-            customDomain: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>;
-        socialLinks: z.ZodOptional<z.ZodObject<{
-            linkedin: z.ZodOptional<z.ZodURL>;
-            twitter: z.ZodOptional<z.ZodURL>;
-            facebook: z.ZodOptional<z.ZodURL>;
-            github: z.ZodOptional<z.ZodURL>;
-        }, z.core.$strip>>;
-        createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-        updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-    }, z.core.$strip>>;
     preferences: z.ZodOptional<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
@@ -172,23 +124,6 @@ export declare const OrganizationContextSchema: z.ZodObject<{
         createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
         updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     }, z.core.$strip>>;
-    notifications: z.ZodOptional<z.ZodObject<{
-        _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-        organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
-        emailNotifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-            defaultEmailAddress: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>;
-            billingAddress: z.ZodOptional<z.ZodEmail>;
-            securityAddress: z.ZodOptional<z.ZodEmail>;
-            administrativeAddress: z.ZodOptional<z.ZodEmail>;
-            usersManagementAddress: z.ZodOptional<z.ZodEmail>;
-            billing: z.ZodDefault<z.ZodBoolean>;
-            administrative: z.ZodDefault<z.ZodBoolean>;
-            security: z.ZodDefault<z.ZodBoolean>;
-            usersManagement: z.ZodDefault<z.ZodBoolean>;
-        }, z.core.$strip>>>;
-        createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-        updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type OrganizationContext = z.infer<typeof OrganizationContextSchema>;
 //# sourceMappingURL=organizations.shared.schemas.d.ts.map

package/dist/esm/organizations/organizations.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizations.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAWxB~~,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,aAAa,kBAAkB;IAC/B,SAAS,cAAc;IACvB;;;;;;;OAOG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC,kBAAkB,CAIlF,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAGvG;AAID,eAAO,MAAM,kBAAkB;;;;;;;;;;;;~~iBA0L7B~~,CAAC;AAGH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D~~;;;;GAIG~~;AACH,eAAO,MAAM,yBAAyB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAapC~~,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
1	+ {"version":3,"file":"organizations.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,aAAa,kBAAkB;IAC/B,SAAS,cAAc;IACvB;;;;;;;OAOG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC,kBAAkB,CAIlF,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAGvG;AAID,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBA2M7B,CAAC;AAGH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/esm/organizations/organizations.shared.schemas.js CHANGED Viewed

@@ -6,11 +6,7 @@
  */
 import { z } from 'zod';
 import { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions.js';
-import { OrganizationProfileSchema } from './organization-profile.shared.schemas.js';
 import { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas.js';
-import { OrganizationNotificationsSchema } from './organization-notifications.shared.schemas.js';
-import { ScopeFeaturesWithOverridesSchema } from '../features/scope-features.shared.schemas.js';
-import { OrganizationMemberSchema } from './organization-members.shared.schemas.js';
 export var OrganizationStatus;
 (function (OrganizationStatus) {
     OrganizationStatus["ACTIVE"] = "ACTIVE";
@@ -81,15 +77,29 @@ export const OrganizationSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
     name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),
     /**
-     * Org type from config (for example `seller` or `corporate_buyer`).
+     * Org type from config (for example `seller` or `corporate_buyer`) — REQUIRED, and it must name an entry in
+     * the application's declared `organizationTypes`.
      *
      * The type selects role policy, membership-derived user-type grants, and
      * authentication overrides. A generic patch cannot migrate those dependent
      * invariants atomically, so the value is creation-time identity. A future
      * type transition must be a dedicated migration operation that reconciles
      * every dependent member and policy surface.
+     *
+     * ONE such operation exists: `organizations.promoteToOwnerOrganization` (#1054), the paired mutation
+     * path for the one transition the framework needs — naming the organization that OPERATES the
+     * application. It discharges the sentence above by REFUSING rather than reconciling: the target type
+     * must already cover every user type the source grants, every role a membership holds must be
+     * available in it, and a SCIM binding may not be lost. So no member's authority moves, which is what
+     * makes a transition safe without a cross-resource reconciliation. Any future transition owes the
+     * same bar — refuse, or reconcile in one transaction; a generic patch still may not write this.
+     *
+     * Required since #1032: the sign-in resolver refuses a member of an organization whose type resolves to no
+     * declared entry, so an optional type was a way to create a tenant nobody could sign in to. Organizations stored
+     * before it was required are typed by the engine at boot when the application declares a single type, and the
+     * application refuses to start naming them when it declares several.
      */
-    type: z.string().optional().isSummaryField().excludeFromUpdate(),
+    type: z.string().min(1).isSummaryField().excludeFromUpdate(),
     /**
      * The tenant's URL-safe identity.
      *
@@ -222,8 +232,11 @@ export const OrganizationSchema = z.object({
      *
      * The standard remedy is to give the two transactions something to collide ON. Every owner-reducing
      * operation bumps this token on the tenant's own row inside its transaction, so two of them touch
-     * the same document and the storage engine aborts the loser. Verified as a race in
-     * `organization-owner-floor-hostile.mongo.integration.test.ts` (H-2).
+     * the same document and the storage engine aborts the loser. That holds only when the operation's
+     * transaction reaches the floor, which every owner-reducing prefix now passes as `transaction`; until
+     * 2026-09-15 none did, and the write autocommitted beside the removal. Observed on a live replica set
+     * in `organization-owner-floor-concurrent-removal.mongo-replset.integration.test.ts`, which also
+     * drives the unforwarded shape and watches it leave the tenant with no owner.
      *
      * Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a
      * modification of the organization, and it would corrupt every "recently changed tenants" surface);
@@ -261,20 +274,25 @@ export const OrganizationSchema = z.object({
     purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()
 });
 /**
- * Organization Context - Core organization with frequently accessed related data
+ * An organization as the frontend holds it for a signed-in member: the organization row plus what
+ * session restore fetches beside it.
+ *
+ * **Every field here has a producer, and that is the rule for adding one.** `UserOrgsContext` obtains
+ * these with `doOperation<OrganizationContext>`, which is a CAST, not a parse — so a declared field
+ * nothing produces compiles and reads `undefined` at runtime with no warning. Until #581 this schema
+ * declared five such fields, two of them REQUIRED:
+ *
+ * | removed | why |
+ * |---|---|
+ * | `planFeatures` (required) | no producer, no consumer. Scope features have their own resource (`ORGANIZATION_FEATURES`) with its own cache invalidation; read that. |
+ * | `members` (required) | no producer, no consumer. It implied the tenant's FULL member list on every organization at session restore; the caller's own memberships already arrive on the USER_SELF context, and a people picker reads `ORGANIZATION_MEMBERS`. |
+ * | `profile`, `notifications` | no producer on the default READ session restore uses, no consumer. The ORGANIZATIONS context variant would populate the profile, and it was rejected for session restore (see `UserOrgsContext`). |
+ * | `displayName`, `logoUrl` | no producer, no consumer. `displayName` lives on `OrganizationProfileSchema`. |
  *
- * Lifecycle audit information is now tracked through auditable events
+ * `preferences` stays, optional: `loadOrganizations` fetches it from `ORGANIZATION_PREFERENCES` and
+ * tolerates its absence (#563).
  */
 export const OrganizationContextSchema = OrganizationSchema.extend({
-    // Scope features (stored separately from billing, scope-agnostic)
-    planFeatures: ScopeFeaturesWithOverridesSchema,
-    members: z.array(OrganizationMemberSchema),
-    // Basic display info (most frequently accessed)
-    displayName: z.string().optional(), // Can be different from name
-    logoUrl: z.url().optional(),
-    // Extended related data (optional - populated as needed)
-    profile: OrganizationProfileSchema.optional(),
     preferences: OrganizationPreferencesSchema.optional(),
-    notifications: OrganizationNotificationsSchema.optional()
 });
 //# sourceMappingURL=organizations.shared.schemas.js.map

package/dist/esm/organizations/organizations.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAKjF,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;IACvB,qCAAe,CAAA;IACf,qDAA+B,CAAA;IAC/B,6CAAuB,CAAA;IACvB;;;;;;;OAOG;IACH,yCAAmB,CAAA;AACrB,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAoC,IAAI,GAAG,CAAC;IAC9F,kBAAkB,CAAC,OAAO;IAC1B,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAAsC;IAC5F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,uCAAuC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAID,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D;;;;;;;;OAQG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAChE;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACb,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,WAAW,EAAE;SACb,QAAQ,CAAC,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,wBAAwB,EAAE,CAAC;SAC5F,cAAc,EAAE;SAChB,iBAAiB,EAAE;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAExH;;;;;;;;;;;;;;;;OAgBG;IACH,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAE5E,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6CAA6C;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;IACxG;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAE3H;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;CACtG,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,kEAAkE;IAClE,YAAY,EAAE,gCAAgC;IAC9C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAE1C,gDAAgD;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,6BAA6B;IACjE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,yDAAyD;IACzD,OAAO,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC","sourcesContent":["/*\n Core Organization Shared Schemas\n \n Lean organization schema optimized for frequent fetching.\n * Related data moved to separate relational models.\n /\n\nimport { z } from 'zod';\nimport { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions';\nimport { OrganizationProfileSchema } from './organization-profile.shared.schemas';\nimport { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas';\nimport { OrganizationNotificationsSchema } from './organization-notifications.shared.schemas';\nimport { ScopeFeaturesWithOverridesSchema } from '../features/scope-features.shared.schemas';\nimport { OrganizationMemberSchema } from './organization-members.shared.schemas';\n\n\n\n\nexport enum OrganizationStatus {\n ACTIVE = 'ACTIVE',\n SUSPENDED = 'SUSPENDED',\n TRIAL = 'TRIAL',\n TRIAL_EXPIRED = 'TRIAL_EXPIRED',\n CANCELLED = 'CANCELLED',\n /\n Marked for deletion and inside its retention window — NOT removed.\n \n Written by the `request_deletion` lifecycle operation, cleared by `restore`, and consumed by\n * the `organization-purge` batch once {@link Organization.purgeScheduledAt} has elapsed. A row\n * in this state is authorization-dead (see\n * {@link isAuthorityConferringOrganizationStatus}) and data-alive.\n /\n DELETED = 'DELETED'\n}\n\n/\n Organization statuses under which a membership STOPS conferring authority.\n \n ## Why this exists as a named authority\n \n Until 2026-08-01 `OrganizationStatus` had zero backend readers: the execution-context\n * creator built `initiatorRoles` straight from ACTIVE membership rows without ever looking at the\n * organization, so no status value affected anything. That made tenant soft-delete impossible to\n * express — a tenant marked for purge would have kept handing out `ORG_ADMIN` for its whole\n * retention window, which is the original hazard with a longer fuse rather than a fix.\n \n The set is declared here, beside the enum it partitions, rather than inline at the consumer, so\n * that adding a future non-operational status is one edit in the place a reader is already\n * looking. Consumers call {@link isAuthorityConferringOrganizationStatus}; they must not test\n * `status === DELETED` inline.\n \n ## Why these three\n \n - `DELETED` — marked for purge. The whole point of the soft-delete phase.\n * - `SUSPENDED` — an administratively halted tenant. Membership must not survive the halt.\n * - `CANCELLED` — a terminated subscription/tenant. Terminal, like `DELETED`.\n \n `TRIAL_EXPIRED` is deliberately NOT here: an expired trial still needs its administrators to\n * sign in and pay, so revoking their authority would make the tenant unrecoverable by its owner.\n * `ACTIVE` and `TRIAL` are the operational states.\n \n ⚠️ Fail-CLOSED direction: an unresolvable organization is treated as non-conferring by the\n * consumer, so a missing row can never widen authority.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — access rights are removed when the\n * scope granting them stops being operational, without waiting for the data to be destroyed.\n /\nexport const ORGANIZATION_STATUSES_WITHOUT_AUTHORITY: ReadonlySet<OrganizationStatus> = new Set([\n OrganizationStatus.DELETED,\n OrganizationStatus.SUSPENDED,\n OrganizationStatus.CANCELLED,\n]);\n\n/\n True when a membership in an organization of this status still confers its roles.\n \n The single authority behind the execution-context membership gate. See\n * {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} for the rationale and the deliberate\n * `TRIAL_EXPIRED` exclusion.\n /\nexport function isAuthorityConferringOrganizationStatus(status: OrganizationStatus \| undefined): boolean {\n if (status === undefined) return false;\n return !ORGANIZATION_STATUSES_WITHOUT_AUTHORITY.has(status);\n}\n\n\n\nexport const OrganizationSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n /\n Org type from config (for example `seller` or `corporate_buyer`).\n \n The type selects role policy, membership-derived user-type grants, and\n * authentication overrides. A generic patch cannot migrate those dependent\n * invariants atomically, so the value is creation-time identity. A future\n * type transition must be a dedicated migration operation that reconciles\n * every dependent member and policy surface.\n /\n type: z.string().optional().isSummaryField().excludeFromUpdate(),\n /\n The tenant's URL-safe identity.\n \n `.isUnique()` since 2026-08-01, and it closes a real hole rather than restating a known rule:\n * uniqueness was promised by the resource specification's 409 and enforced by NOTHING — no index\n * and no application guard — so two organizations could take the same slug. Because the field is\n * also `.excludeFromUpdate()` (creation-time identity, not an editable label), such a collision\n * could never be resolved through the API afterwards. It has to be refused at creation.\n \n Uniqueness is collection-wide, which IS per-application: an application's organizations live in\n * that application's own database, and the schema carries no `applicationId` to scope by.\n \n ⚠️ MongoDB-only today. The SQL planner records uniqueness as intent and leaves enforcement\n * migration-owned, so on a SQL adapter this is a declaration rather than a guarantee.\n /\n slug: z.string()\n .min(1)\n .max(50)\n .regex(/^[a-z0-9]+(?:-[a-z0-9]+)$/)\n .isDBIndexed()\n .isUnique({ conflictMessageReference: ErrorCustomMessageReference.ORGANIZATION_SLUG_EXISTS })\n .isSummaryField()\n .excludeFromUpdate(),\n /*\n Tenant lifecycle and access posture.\n \n `.excludeFromUpdate()` since 2026-08-01, and that exclusion is the whole point of the field.\n * Before it, generic UPDATE carried `status` and the DEFAULT variant of that operation is gated\n * to `ORG_ADMIN` — while SUSPEND / ACTIVATE are `APP_ADMIN_SUPER_ADMIN`-only and gated by an\n * `enabledCondition` on the current status. So the org admin of a SUSPENDED tenant could\n * `PUT /organizations/{id}` with `{\"status\":\"ACTIVE\"}` and lift the platform's suspension on\n * their own organization: the control was defeatable by exactly the party it exists to control.\n * The configuration had claimed otherwise for a long time — both UPDATE variants carried a\n * `// status manually excluded for this variant` comment that nothing implemented.\n \n Lifecycle transitions belong to the dedicated verbs, which own the state machine, the reason,\n * and the audit trail. This mirrors `OrganizationMemberSchema.status`, whose JSDoc has always\n * described the same rule for the same reason.\n \n KNOWN CONSEQUENCE, ACCEPTED: the platform apps-manager's `upsertEntity` re-asserts\n * `status: ACTIVE` on its update branch when reconciling an existing organization. That write is\n * now dropped. This is the intended outcome — a provisioning re-run silently returning a\n * suspended tenant to ACTIVE is the same defect from the other direction. A path that must set\n * the status goes through the transition operations or a trusted `updateAsSystem`, not a generic\n * field patch.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — a tenant may not lift a platform-imposed\n * restriction on itself.\n /\n status: z.enum(OrganizationStatus).default(OrganizationStatus.ACTIVE).isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n /\n Does a platform operator need THIS tenant's approval before an elevation becomes usable?\n \n The Customer Lockbox posture, and opt-in per tenant exactly as Microsoft and Google ship it. A\n * tenant that has not staffed an approver must not thereby become unable to receive support, so\n * the default is `false`: elevations still require a request, a justification, a 4-hour ceiling and\n * an audit trail — they simply do not wait for a human in the tenant.\n \n Turning it ON is the strongest available posture and is what regulated buyers ask for by name.\n \n ⚠️ It does NOT make the tenant unreachable when it has no administrator. A tenant with no\n * administratively usable owner cannot approve anything, and requiring approval from it would make\n * its own repair impossible — see `PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE`,\n * which is measured with the owner floor's own predicate rather than assumed.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — customer-approved operator access.\n /\n platformAccessApprovalRequired: z.boolean().default(false).isAuditEvidence(),\n\n // Basic timestamps (lifecycle audit is in separate collection)\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // Tenant teardown — soft-delete marks (WS-A)\n /\n When the tenant was MARKED for deletion — the start of its retention window.\n \n Written by the `request_deletion` lifecycle operation together with `status: DELETED`, and\n * cleared by `restore`. Both fields move together: `status` is the authorization-relevant half\n * (it is what {@link isAuthorityConferringOrganizationStatus} reads) and this is the evidence\n * half.\n \n ## Why this is not called `deletedAt`\n \n It replaced a field of that name on 2026-08-01, and the rename is not cosmetic in two separate\n * ways.\n \n First, `deletedAt` is RESERVED framework vocabulary: it appears in\n * `createOrUpdateMandatoryDiscardFields`, so the runtime strips it from every create and update\n * payload on every resource. A lifecycle operation could therefore never write it — the value\n * would be discarded and the operation would answer success having recorded nothing, which is\n * the exact silent-no-op class this workstream exists to remove. No `authoritativeFields`\n * declaration rescues it; the discard happens regardless.\n \n Second, the two names mean different things. `deletedAt` answers \"when was this row deleted\",\n * and the row is emphatically NOT deleted — it is fully present and restorable for the whole\n * retention window. Reusing the name would have made every reader who trusts the framework's\n * vocabulary wrong about the state of the tenant in front of them.\n \n The predecessor field had zero readers and zero writers in the entire repository, so nothing\n * observable was lost by replacing it.\n \n Never a user-facing value on a live organization — it only ever renders as an empty \"—\", so it\n * stays hidden from every auto-rendered display/edit surface via `.isHidden()`. An admin/audit\n * surface that needs to inspect marked rows must opt it back in explicitly.\n \n ⚠️ This is NOT the purge predicate. Purge eligibility is {@link purgeScheduledAt} — see the\n * reasoning there.\n \n ## Why `.nullish()` and not `.optional()`\n \n `restore` CLEARS this field, and clearing means writing `null` — `undefined` merely omits the\n * key and leaves the stale mark in place. `preserveServerInjectedFields` copies the authored\n * value verbatim past the strict re-parse (`hasOwnProperty` + assign), so the `null` genuinely\n * reaches persistence. With `.optional()` alone the row would then be UNREADABLE: the main schema\n * rejects `null` for a `z.date()`, so every subsequent read of a restored tenant would throw on\n * output projection. Verified by probing the real schema rather than assumed.\n /\n deletionRequestedAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden(),\n /\n Serialization token for the organization-owner floor. Never read for meaning — only WRITTEN, to\n * make concurrent owner-reducing operations conflict with each other.\n \n ## Why a stored field is the fix rather than a better check\n \n The floor is a check-then-act on a COUNT: it measures the usable-owner population, then the\n * caller writes. Under snapshot isolation that is textbook WRITE SKEW — two transactions each\n * remove a DIFFERENT owner, each observes the other still present, and both commit, producing a\n * tenant with zero owners that neither was individually permitted to create. No amount of\n * additional checking closes it, because each transaction's view is internally consistent; a\n * re-measure after the write cannot see the other transaction's uncommitted row either.\n \n The standard remedy is to give the two transactions something to collide ON. Every owner-reducing\n * operation bumps this token on the tenant's own row inside its transaction, so two of them touch\n * the same document and the storage engine aborts the loser. Verified as a race in\n * `organization-owner-floor-hostile.mongo.integration.test.ts` (H-2).\n \n Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a\n * modification of the organization, and it would corrupt every \"recently changed tenants\" surface);\n * a separate lock collection (a new resource, a new registration, and a second thing to keep\n * consistent with the floor); an application-level mutex (does not survive multiple processes,\n * which is exactly the deployment this must work in).\n \n `.nullish()` because existing tenants predate it and a tenant that has never had an\n * owner-reducing write legitimately has no token. Absent and zero mean the same thing.\n /\n ownerFloorSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n\n /\n When the `organization-purge` batch becomes allowed to destroy this tenant.\n \n ## Why this is stored rather than derived from `deletionRequestedAt` + a configured window\n \n The retention window is a PROMISE made to the tenant at the moment of the mark (\"your data is\n * recoverable until <date>\"). Deriving eligibility as `deletionRequestedAt < now - window`\n * re-evaluates that promise against whatever the configuration says at PURGE time, so lowering\n * the window would retroactively shorten — or immediately expire — every tenant already inside\n * one. Pinning the deadline at mark time makes the commitment immutable, which is the property\n * a data-retention commitment has to have, and it makes a per-tenant legal hold expressible\n * later by moving one field rather than by special-casing the batch predicate.\n \n The `FILES` soft-delete precedent derives its cutoff instead. That is defensible there — an\n * orphaned upload is nobody's commitment — and is precisely why the two should not share one\n * mechanism.\n \n Server-owned: written only by the lifecycle operations that own the state machine, never by a\n * client patch.\n \n `.nullish()` for the same reason as {@link deletionRequestedAt} — `restore` clears it, and a\n * persisted `null` has to survive the next read.\n /\n purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()\n});\n\n\nexport type Organization = z.infer<typeof OrganizationSchema>;\n\n/\n Organization Context - Core organization with frequently accessed related data\n \n Lifecycle audit information is now tracked through auditable events\n */\nexport const OrganizationContextSchema = OrganizationSchema.extend({\n // Scope features (stored separately from billing, scope-agnostic)\n planFeatures: ScopeFeaturesWithOverridesSchema,\n members: z.array(OrganizationMemberSchema),\n\n // Basic display info (most frequently accessed)\n displayName: z.string().optional(), // Can be different from name\n logoUrl: z.url().optional(),\n\n // Extended related data (optional - populated as needed)\n profile: OrganizationProfileSchema.optional(),\n preferences: OrganizationPreferencesSchema.optional(),\n notifications: OrganizationNotificationsSchema.optional()\n});\n\n\nexport type OrganizationContext = z.infer<typeof OrganizationContextSchema>;\n"]}
1	+ {"version":3,"file":"organizations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAK1F,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;IACvB,qCAAe,CAAA;IACf,qDAA+B,CAAA;IAC/B,6CAAuB,CAAA;IACvB;;;;;;;OAOG;IACH,yCAAmB,CAAA;AACrB,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAoC,IAAI,GAAG,CAAC;IAC9F,kBAAkB,CAAC,OAAO;IAC1B,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAAsC;IAC5F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,uCAAuC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAID,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5D;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACb,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,WAAW,EAAE;SACb,QAAQ,CAAC,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,wBAAwB,EAAE,CAAC;SAC5F,cAAc,EAAE;SAChB,iBAAiB,EAAE;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAExH;;;;;;;;;;;;;;;;OAgBG;IACH,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAE5E,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6CAA6C;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;IACxG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAE3H;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;CACtG,CAAC,CAAC;AAKH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC","sourcesContent":["/*\n Core Organization Shared Schemas\n \n Lean organization schema optimized for frequent fetching.\n * Related data moved to separate relational models.\n /\n\nimport { z } from 'zod';\nimport { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions';\nimport { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas';\n\n\n\n\nexport enum OrganizationStatus {\n ACTIVE = 'ACTIVE',\n SUSPENDED = 'SUSPENDED',\n TRIAL = 'TRIAL',\n TRIAL_EXPIRED = 'TRIAL_EXPIRED',\n CANCELLED = 'CANCELLED',\n /\n Marked for deletion and inside its retention window — NOT removed.\n \n Written by the `request_deletion` lifecycle operation, cleared by `restore`, and consumed by\n * the `organization-purge` batch once {@link Organization.purgeScheduledAt} has elapsed. A row\n * in this state is authorization-dead (see\n * {@link isAuthorityConferringOrganizationStatus}) and data-alive.\n /\n DELETED = 'DELETED'\n}\n\n/\n Organization statuses under which a membership STOPS conferring authority.\n \n ## Why this exists as a named authority\n \n Until 2026-08-01 `OrganizationStatus` had zero backend readers: the execution-context\n * creator built `initiatorRoles` straight from ACTIVE membership rows without ever looking at the\n * organization, so no status value affected anything. That made tenant soft-delete impossible to\n * express — a tenant marked for purge would have kept handing out `ORG_ADMIN` for its whole\n * retention window, which is the original hazard with a longer fuse rather than a fix.\n \n The set is declared here, beside the enum it partitions, rather than inline at the consumer, so\n * that adding a future non-operational status is one edit in the place a reader is already\n * looking. Consumers call {@link isAuthorityConferringOrganizationStatus}; they must not test\n * `status === DELETED` inline.\n \n ## Why these three\n \n - `DELETED` — marked for purge. The whole point of the soft-delete phase.\n * - `SUSPENDED` — an administratively halted tenant. Membership must not survive the halt.\n * - `CANCELLED` — a terminated subscription/tenant. Terminal, like `DELETED`.\n \n `TRIAL_EXPIRED` is deliberately NOT here: an expired trial still needs its administrators to\n * sign in and pay, so revoking their authority would make the tenant unrecoverable by its owner.\n * `ACTIVE` and `TRIAL` are the operational states.\n \n ⚠️ Fail-CLOSED direction: an unresolvable organization is treated as non-conferring by the\n * consumer, so a missing row can never widen authority.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — access rights are removed when the\n * scope granting them stops being operational, without waiting for the data to be destroyed.\n /\nexport const ORGANIZATION_STATUSES_WITHOUT_AUTHORITY: ReadonlySet<OrganizationStatus> = new Set([\n OrganizationStatus.DELETED,\n OrganizationStatus.SUSPENDED,\n OrganizationStatus.CANCELLED,\n]);\n\n/\n True when a membership in an organization of this status still confers its roles.\n \n The single authority behind the execution-context membership gate. See\n * {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} for the rationale and the deliberate\n * `TRIAL_EXPIRED` exclusion.\n /\nexport function isAuthorityConferringOrganizationStatus(status: OrganizationStatus \| undefined): boolean {\n if (status === undefined) return false;\n return !ORGANIZATION_STATUSES_WITHOUT_AUTHORITY.has(status);\n}\n\n\n\nexport const OrganizationSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n /\n Org type from config (for example `seller` or `corporate_buyer`) — REQUIRED, and it must name an entry in\n * the application's declared `organizationTypes`.\n \n The type selects role policy, membership-derived user-type grants, and\n * authentication overrides. A generic patch cannot migrate those dependent\n * invariants atomically, so the value is creation-time identity. A future\n * type transition must be a dedicated migration operation that reconciles\n * every dependent member and policy surface.\n \n ONE such operation exists: `organizations.promoteToOwnerOrganization` (#1054), the paired mutation\n * path for the one transition the framework needs — naming the organization that OPERATES the\n * application. It discharges the sentence above by REFUSING rather than reconciling: the target type\n * must already cover every user type the source grants, every role a membership holds must be\n * available in it, and a SCIM binding may not be lost. So no member's authority moves, which is what\n * makes a transition safe without a cross-resource reconciliation. Any future transition owes the\n * same bar — refuse, or reconcile in one transaction; a generic patch still may not write this.\n \n Required since #1032: the sign-in resolver refuses a member of an organization whose type resolves to no\n * declared entry, so an optional type was a way to create a tenant nobody could sign in to. Organizations stored\n * before it was required are typed by the engine at boot when the application declares a single type, and the\n * application refuses to start naming them when it declares several.\n /\n type: z.string().min(1).isSummaryField().excludeFromUpdate(),\n /\n The tenant's URL-safe identity.\n \n `.isUnique()` since 2026-08-01, and it closes a real hole rather than restating a known rule:\n * uniqueness was promised by the resource specification's 409 and enforced by NOTHING — no index\n * and no application guard — so two organizations could take the same slug. Because the field is\n * also `.excludeFromUpdate()` (creation-time identity, not an editable label), such a collision\n * could never be resolved through the API afterwards. It has to be refused at creation.\n \n Uniqueness is collection-wide, which IS per-application: an application's organizations live in\n * that application's own database, and the schema carries no `applicationId` to scope by.\n \n ⚠️ MongoDB-only today. The SQL planner records uniqueness as intent and leaves enforcement\n * migration-owned, so on a SQL adapter this is a declaration rather than a guarantee.\n /\n slug: z.string()\n .min(1)\n .max(50)\n .regex(/^[a-z0-9]+(?:-[a-z0-9]+)$/)\n .isDBIndexed()\n .isUnique({ conflictMessageReference: ErrorCustomMessageReference.ORGANIZATION_SLUG_EXISTS })\n .isSummaryField()\n .excludeFromUpdate(),\n /*\n Tenant lifecycle and access posture.\n \n `.excludeFromUpdate()` since 2026-08-01, and that exclusion is the whole point of the field.\n * Before it, generic UPDATE carried `status` and the DEFAULT variant of that operation is gated\n * to `ORG_ADMIN` — while SUSPEND / ACTIVATE are `APP_ADMIN_SUPER_ADMIN`-only and gated by an\n * `enabledCondition` on the current status. So the org admin of a SUSPENDED tenant could\n * `PUT /organizations/{id}` with `{\"status\":\"ACTIVE\"}` and lift the platform's suspension on\n * their own organization: the control was defeatable by exactly the party it exists to control.\n * The configuration had claimed otherwise for a long time — both UPDATE variants carried a\n * `// status manually excluded for this variant` comment that nothing implemented.\n \n Lifecycle transitions belong to the dedicated verbs, which own the state machine, the reason,\n * and the audit trail. This mirrors `OrganizationMemberSchema.status`, whose JSDoc has always\n * described the same rule for the same reason.\n \n KNOWN CONSEQUENCE, ACCEPTED: the platform apps-manager's `upsertEntity` re-asserts\n * `status: ACTIVE` on its update branch when reconciling an existing organization. That write is\n * now dropped. This is the intended outcome — a provisioning re-run silently returning a\n * suspended tenant to ACTIVE is the same defect from the other direction. A path that must set\n * the status goes through the transition operations or a trusted `updateAsSystem`, not a generic\n * field patch.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — a tenant may not lift a platform-imposed\n * restriction on itself.\n /\n status: z.enum(OrganizationStatus).default(OrganizationStatus.ACTIVE).isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n /\n Does a platform operator need THIS tenant's approval before an elevation becomes usable?\n \n The Customer Lockbox posture, and opt-in per tenant exactly as Microsoft and Google ship it. A\n * tenant that has not staffed an approver must not thereby become unable to receive support, so\n * the default is `false`: elevations still require a request, a justification, a 4-hour ceiling and\n * an audit trail — they simply do not wait for a human in the tenant.\n \n Turning it ON is the strongest available posture and is what regulated buyers ask for by name.\n \n ⚠️ It does NOT make the tenant unreachable when it has no administrator. A tenant with no\n * administratively usable owner cannot approve anything, and requiring approval from it would make\n * its own repair impossible — see `PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE`,\n * which is measured with the owner floor's own predicate rather than assumed.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — customer-approved operator access.\n /\n platformAccessApprovalRequired: z.boolean().default(false).isAuditEvidence(),\n\n // Basic timestamps (lifecycle audit is in separate collection)\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // Tenant teardown — soft-delete marks (WS-A)\n /\n When the tenant was MARKED for deletion — the start of its retention window.\n \n Written by the `request_deletion` lifecycle operation together with `status: DELETED`, and\n * cleared by `restore`. Both fields move together: `status` is the authorization-relevant half\n * (it is what {@link isAuthorityConferringOrganizationStatus} reads) and this is the evidence\n * half.\n \n ## Why this is not called `deletedAt`\n \n It replaced a field of that name on 2026-08-01, and the rename is not cosmetic in two separate\n * ways.\n \n First, `deletedAt` is RESERVED framework vocabulary: it appears in\n * `createOrUpdateMandatoryDiscardFields`, so the runtime strips it from every create and update\n * payload on every resource. A lifecycle operation could therefore never write it — the value\n * would be discarded and the operation would answer success having recorded nothing, which is\n * the exact silent-no-op class this workstream exists to remove. No `authoritativeFields`\n * declaration rescues it; the discard happens regardless.\n \n Second, the two names mean different things. `deletedAt` answers \"when was this row deleted\",\n * and the row is emphatically NOT deleted — it is fully present and restorable for the whole\n * retention window. Reusing the name would have made every reader who trusts the framework's\n * vocabulary wrong about the state of the tenant in front of them.\n \n The predecessor field had zero readers and zero writers in the entire repository, so nothing\n * observable was lost by replacing it.\n \n Never a user-facing value on a live organization — it only ever renders as an empty \"—\", so it\n * stays hidden from every auto-rendered display/edit surface via `.isHidden()`. An admin/audit\n * surface that needs to inspect marked rows must opt it back in explicitly.\n \n ⚠️ This is NOT the purge predicate. Purge eligibility is {@link purgeScheduledAt} — see the\n * reasoning there.\n \n ## Why `.nullish()` and not `.optional()`\n \n `restore` CLEARS this field, and clearing means writing `null` — `undefined` merely omits the\n * key and leaves the stale mark in place. `preserveServerInjectedFields` copies the authored\n * value verbatim past the strict re-parse (`hasOwnProperty` + assign), so the `null` genuinely\n * reaches persistence. With `.optional()` alone the row would then be UNREADABLE: the main schema\n * rejects `null` for a `z.date()`, so every subsequent read of a restored tenant would throw on\n * output projection. Verified by probing the real schema rather than assumed.\n /\n deletionRequestedAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden(),\n /\n Serialization token for the organization-owner floor. Never read for meaning — only WRITTEN, to\n * make concurrent owner-reducing operations conflict with each other.\n \n ## Why a stored field is the fix rather than a better check\n \n The floor is a check-then-act on a COUNT: it measures the usable-owner population, then the\n * caller writes. Under snapshot isolation that is textbook WRITE SKEW — two transactions each\n * remove a DIFFERENT owner, each observes the other still present, and both commit, producing a\n * tenant with zero owners that neither was individually permitted to create. No amount of\n * additional checking closes it, because each transaction's view is internally consistent; a\n * re-measure after the write cannot see the other transaction's uncommitted row either.\n \n The standard remedy is to give the two transactions something to collide ON. Every owner-reducing\n * operation bumps this token on the tenant's own row inside its transaction, so two of them touch\n * the same document and the storage engine aborts the loser. That holds only when the operation's\n * transaction reaches the floor, which every owner-reducing prefix now passes as `transaction`; until\n * 2026-09-15 none did, and the write autocommitted beside the removal. Observed on a live replica set\n * in `organization-owner-floor-concurrent-removal.mongo-replset.integration.test.ts`, which also\n * drives the unforwarded shape and watches it leave the tenant with no owner.\n \n Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a\n * modification of the organization, and it would corrupt every \"recently changed tenants\" surface);\n * a separate lock collection (a new resource, a new registration, and a second thing to keep\n * consistent with the floor); an application-level mutex (does not survive multiple processes,\n * which is exactly the deployment this must work in).\n \n `.nullish()` because existing tenants predate it and a tenant that has never had an\n * owner-reducing write legitimately has no token. Absent and zero mean the same thing.\n /\n ownerFloorSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n\n /\n When the `organization-purge` batch becomes allowed to destroy this tenant.\n \n ## Why this is stored rather than derived from `deletionRequestedAt` + a configured window\n \n The retention window is a PROMISE made to the tenant at the moment of the mark (\"your data is\n * recoverable until <date>\"). Deriving eligibility as `deletionRequestedAt < now - window`\n * re-evaluates that promise against whatever the configuration says at PURGE time, so lowering\n * the window would retroactively shorten — or immediately expire — every tenant already inside\n * one. Pinning the deadline at mark time makes the commitment immutable, which is the property\n * a data-retention commitment has to have, and it makes a per-tenant legal hold expressible\n * later by moving one field rather than by special-casing the batch predicate.\n \n The `FILES` soft-delete precedent derives its cutoff instead. That is defensible there — an\n * orphaned upload is nobody's commitment — and is precisely why the two should not share one\n * mechanism.\n \n Server-owned: written only by the lifecycle operations that own the state machine, never by a\n * client patch.\n \n `.nullish()` for the same reason as {@link deletionRequestedAt} — `restore` clears it, and a\n * persisted `null` has to survive the next read.\n /\n purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()\n});\n\n\nexport type Organization = z.infer<typeof OrganizationSchema>;\n\n/\n An organization as the frontend holds it for a signed-in member: the organization row plus what\n * session restore fetches beside it.\n \n Every field here has a producer, and that is the rule for adding one. `UserOrgsContext` obtains\n * these with `doOperation<OrganizationContext>`, which is a CAST, not a parse — so a declared field\n * nothing produces compiles and reads `undefined` at runtime with no warning. Until #581 this schema\n * declared five such fields, two of them REQUIRED:\n \n \| removed \| why \|\n * \|---\|---\|\n * \| `planFeatures` (required) \| no producer, no consumer. Scope features have their own resource (`ORGANIZATION_FEATURES`) with its own cache invalidation; read that. \|\n * \| `members` (required) \| no producer, no consumer. It implied the tenant's FULL member list on every organization at session restore; the caller's own memberships already arrive on the USER_SELF context, and a people picker reads `ORGANIZATION_MEMBERS`. \|\n * \| `profile`, `notifications` \| no producer on the default READ session restore uses, no consumer. The ORGANIZATIONS context variant would populate the profile, and it was rejected for session restore (see `UserOrgsContext`). \|\n * \| `displayName`, `logoUrl` \| no producer, no consumer. `displayName` lives on `OrganizationProfileSchema`. \|\n \n `preferences` stays, optional: `loadOrganizations` fetches it from `ORGANIZATION_PREFERENCES` and\n * tolerates its absence (#563).\n */\nexport const OrganizationContextSchema = OrganizationSchema.extend({\n preferences: OrganizationPreferencesSchema.optional(),\n});\n\n\nexport type OrganizationContext = z.infer<typeof OrganizationContextSchema>;\n"]}

package/dist/esm/organizations/tenant-teardown-config.shared.schemas.d.ts CHANGED Viewed

@@ -1,7 +1,19 @@
 import { z } from 'zod';
+/** @wildo_source:part:start saas.models.config.tenant-teardown facet:layer:shared facet:audience:app-developer */
 /**
  * Tenant teardown — the operator-tunable half of soft-delete + retention window + purge.
  *
+ * Declared as the optional `tenantTeardown` block of your application's backend-authored
+ * configuration (`backend-api/src/saas-config.backend.ts`), beside `lifecycle` and `compliance`.
+ *
+ * ## What it governs, and why you cannot ignore it by omitting it
+ *
+ * Deleting a tenant is TWO acts. Requesting deletion MARKS the organization, at which point it
+ * stops conferring any authority and its data is still entirely intact; an engine-owned batch
+ * destroys it later. The three fields here decide how long "later" is, when the batch runs, and how
+ * many tenants one run may destroy — so an application that declares nothing still deletes its
+ * customers' tenants, on this block's defaults, thirty days after the mark.
+ *
  * ## Why this is its own config block
  *
  * `LifecycleConfigSchema` already exists and is about the USER lifecycle (activation, engagement,
@@ -25,6 +37,7 @@ export declare const TenantTeardownConfigSchema: z.ZodObject<{
 export type TenantTeardownConfig = z.infer<typeof TenantTeardownConfigSchema>;
 /** Defaults applied when an application declares no `tenantTeardown` block at all. */
 export declare const TENANT_TEARDOWN_CONFIG_DEFAULTS: TenantTeardownConfig;
+/** @wildo_source:part:end saas.models.config.tenant-teardown */
 /**
  * Resolve the purge deadline for a tenant being marked right now.
  *

package/dist/esm/organizations/tenant-teardown-config.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tenant-teardown-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/tenant-teardown-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB~~;;;;;;;;;;;;;;;;;GAiBG~~;AACH,eAAO,MAAM,0BAA0B;;;;iBAkCrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,sFAAsF;AACtF,eAAO,MAAM,+BAA+B,EAAE,oBAA2D,CAAC;~~AAE1G~~;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,IAAI,EACd,MAAM,EAAE,oBAAoB,GAAG,SAAS,GACvC,IAAI,CAGN"}
1	+ {"version":3,"file":"tenant-teardown-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/tenant-teardown-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kHAAkH;AAClH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,0BAA0B;;;;iBAkCrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,sFAAsF;AACtF,eAAO,MAAM,+BAA+B,EAAE,oBAA2D,CAAC;AAC1G,gEAAgE;AAEhE;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,IAAI,EACd,MAAM,EAAE,oBAAoB,GAAG,SAAS,GACvC,IAAI,CAGN"}

package/dist/esm/organizations/tenant-teardown-config.shared.schemas.js CHANGED Viewed

@@ -1,7 +1,19 @@
 import { z } from 'zod';
+/** @wildo_source:part:start saas.models.config.tenant-teardown facet:layer:shared facet:audience:app-developer */
 /**
  * Tenant teardown — the operator-tunable half of soft-delete + retention window + purge.
  *
+ * Declared as the optional `tenantTeardown` block of your application's backend-authored
+ * configuration (`backend-api/src/saas-config.backend.ts`), beside `lifecycle` and `compliance`.
+ *
+ * ## What it governs, and why you cannot ignore it by omitting it
+ *
+ * Deleting a tenant is TWO acts. Requesting deletion MARKS the organization, at which point it
+ * stops conferring any authority and its data is still entirely intact; an engine-owned batch
+ * destroys it later. The three fields here decide how long "later" is, when the batch runs, and how
+ * many tenants one run may destroy — so an application that declares nothing still deletes its
+ * customers' tenants, on this block's defaults, thirty days after the mark.
+ *
  * ## Why this is its own config block
  *
  * `LifecycleConfigSchema` already exists and is about the USER lifecycle (activation, engagement,
@@ -52,6 +64,7 @@ export const TenantTeardownConfigSchema = z.object({
 });
 /** Defaults applied when an application declares no `tenantTeardown` block at all. */
 export const TENANT_TEARDOWN_CONFIG_DEFAULTS = TenantTeardownConfigSchema.parse({});
+/** @wildo_source:part:end saas.models.config.tenant-teardown */
 /**
  * Resolve the purge deadline for a tenant being marked right now.
  *

package/dist/esm/organizations/tenant-teardown-config.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tenant-teardown-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/tenant-teardown-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB~~;;;;;;;;;;;;;;;;;GAiBG~~;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;;;;;;;;;OAaG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE5D;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAElD;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAIH,sFAAsF;AACtF,MAAM,CAAC,MAAM,+BAA+B,GAAyB,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;~~AAE1G~~;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,QAAc,EACd,MAAwC;IAExC,MAAM,mBAAmB,GAAG,MAAM,EAAE,mBAAmB,IAAI,+BAA+B,CAAC,mBAAmB,CAAC;IAC/G,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAClF,CAAC","sourcesContent":["import { z } from 'zod';\n\n/*\n Tenant teardown — the operator-tunable half of soft-delete + retention window + purge.\n \n ## Why this is its own config block\n \n `LifecycleConfigSchema` already exists and is about the USER lifecycle (activation, engagement,\n * dormancy detection). Folding tenant teardown into it would merge two unrelated concerns behind\n * one master switch — and that switch defaults to `enabled: false`, which would make an\n * organization's retention window silently depend on whether the app opted into user-engagement\n * tracking. Tenant teardown has no such opt-in: an application that deletes tenants always has a\n * retention window, so the block is optional only in the sense that its defaults are usually right.\n \n ## Why every value has a default\n \n Omitting the block entirely must produce a working, safe configuration — the alternative is an\n * application that ships without a purge schedule and accumulates marked-but-never-destroyed\n * tenants, which is the failure mode a retention window is supposed to prevent.\n /\nexport const TenantTeardownConfigSchema = z.object({\n /\n How long a marked tenant stays restorable before the purge batch may destroy it.\n \n Default 30 days. The window is a commitment, not a scheduling hint: the value is read ONCE,\n * when the tenant is marked, and pinned onto `Organization.purgeScheduledAt`. Lowering this\n * setting therefore affects only tenants marked afterwards — tenants already inside a window\n * keep the deadline they were promised. See `Organization.purgeScheduledAt` for why the deadline\n * is stored rather than recomputed.\n \n 30 days sits inside the band comparable products use (roughly 20–90 days) and inside the\n * one-month response period GDPR Art. 12(3) allows for acting on an erasure request, so the\n * default does not put an application in breach by itself. It is not legal advice: an\n * application with its own retention obligations must set this deliberately.\n /\n retentionWindowDays: z.number().int().positive().default(30),\n\n /\n Cron schedule for the engine-owned `organization-purge` batch. Default 03:00 daily.\n \n Daily rather than hourly on purpose: the window is measured in days, so a finer cadence buys\n * no promptness that anyone can observe and only multiplies the scans.\n /\n purgeCronSchedule: z.string().default('0 3 * '),\n\n /\n Maximum tenants destroyed per purge run.\n \n A purge cascades across every child resource of a tenant, so an unbounded run after a mass\n * offboarding could hold database resources for a long time. Anything not reached this run is\n * reached by the next one — the deadline has passed, so there is no correctness cost to\n * spreading the work, and a bounded run keeps one bad batch from becoming an outage.\n /\n purgeBatchSize: z.number().int().positive().default(50),\n});\n\nexport type TenantTeardownConfig = z.infer<typeof TenantTeardownConfigSchema>;\n\n/* Defaults applied when an application declares no `tenantTeardown` block at all. /\nexport const TENANT_TEARDOWN_CONFIG_DEFAULTS: TenantTeardownConfig = TenantTeardownConfigSchema.parse({});\n\n/\n Resolve the purge deadline for a tenant being marked right now.\n \n Shared by the lifecycle operation that writes `purgeScheduledAt` and by the tests that pin it,\n * so the window arithmetic has one home. Takes `markedAt` explicitly rather than reading the clock\n * so the caller's transaction timestamp and the deadline cannot disagree.\n /\nexport function resolveOrganizationPurgeScheduledAt(\n markedAt: Date,\n config: TenantTeardownConfig \| undefined,\n): Date {\n const retentionWindowDays = config?.retentionWindowDays ?? TENANT_TEARDOWN_CONFIG_DEFAULTS.retentionWindowDays;\n return new Date(markedAt.getTime() + retentionWindowDays 24 * 60 * 60 * 1000);\n}\n"]}
1	+ {"version":3,"file":"tenant-teardown-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/tenant-teardown-config.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kHAAkH;AAClH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;;;;;;;;;OAaG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE5D;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAElD;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAIH,sFAAsF;AACtF,MAAM,CAAC,MAAM,+BAA+B,GAAyB,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1G,gEAAgE;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,QAAc,EACd,MAAwC;IAExC,MAAM,mBAAmB,GAAG,MAAM,EAAE,mBAAmB,IAAI,+BAA+B,CAAC,mBAAmB,CAAC;IAC/G,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAClF,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** @wildo_source:part:start saas.models.config.tenant-teardown facet:layer:shared facet:audience:app-developer /\n/\n Tenant teardown — the operator-tunable half of soft-delete + retention window + purge.\n \n Declared as the optional `tenantTeardown` block of your application's backend-authored\n * configuration (`backend-api/src/saas-config.backend.ts`), beside `lifecycle` and `compliance`.\n \n ## What it governs, and why you cannot ignore it by omitting it\n \n Deleting a tenant is TWO acts. Requesting deletion MARKS the organization, at which point it\n * stops conferring any authority and its data is still entirely intact; an engine-owned batch\n * destroys it later. The three fields here decide how long \"later\" is, when the batch runs, and how\n * many tenants one run may destroy — so an application that declares nothing still deletes its\n * customers' tenants, on this block's defaults, thirty days after the mark.\n \n ## Why this is its own config block\n \n `LifecycleConfigSchema` already exists and is about the USER lifecycle (activation, engagement,\n * dormancy detection). Folding tenant teardown into it would merge two unrelated concerns behind\n * one master switch — and that switch defaults to `enabled: false`, which would make an\n * organization's retention window silently depend on whether the app opted into user-engagement\n * tracking. Tenant teardown has no such opt-in: an application that deletes tenants always has a\n * retention window, so the block is optional only in the sense that its defaults are usually right.\n \n ## Why every value has a default\n \n Omitting the block entirely must produce a working, safe configuration — the alternative is an\n * application that ships without a purge schedule and accumulates marked-but-never-destroyed\n * tenants, which is the failure mode a retention window is supposed to prevent.\n /\nexport const TenantTeardownConfigSchema = z.object({\n /\n How long a marked tenant stays restorable before the purge batch may destroy it.\n \n Default 30 days. The window is a commitment, not a scheduling hint: the value is read ONCE,\n * when the tenant is marked, and pinned onto `Organization.purgeScheduledAt`. Lowering this\n * setting therefore affects only tenants marked afterwards — tenants already inside a window\n * keep the deadline they were promised. See `Organization.purgeScheduledAt` for why the deadline\n * is stored rather than recomputed.\n \n 30 days sits inside the band comparable products use (roughly 20–90 days) and inside the\n * one-month response period GDPR Art. 12(3) allows for acting on an erasure request, so the\n * default does not put an application in breach by itself. It is not legal advice: an\n * application with its own retention obligations must set this deliberately.\n /\n retentionWindowDays: z.number().int().positive().default(30),\n\n /\n Cron schedule for the engine-owned `organization-purge` batch. Default 03:00 daily.\n \n Daily rather than hourly on purpose: the window is measured in days, so a finer cadence buys\n * no promptness that anyone can observe and only multiplies the scans.\n /\n purgeCronSchedule: z.string().default('0 3 * '),\n\n /\n Maximum tenants destroyed per purge run.\n \n A purge cascades across every child resource of a tenant, so an unbounded run after a mass\n * offboarding could hold database resources for a long time. Anything not reached this run is\n * reached by the next one — the deadline has passed, so there is no correctness cost to\n * spreading the work, and a bounded run keeps one bad batch from becoming an outage.\n /\n purgeBatchSize: z.number().int().positive().default(50),\n});\n\nexport type TenantTeardownConfig = z.infer<typeof TenantTeardownConfigSchema>;\n\n/* Defaults applied when an application declares no `tenantTeardown` block at all. /\nexport const TENANT_TEARDOWN_CONFIG_DEFAULTS: TenantTeardownConfig = TenantTeardownConfigSchema.parse({});\n/* @wildo_source:part:end saas.models.config.tenant-teardown /\n\n/\n Resolve the purge deadline for a tenant being marked right now.\n \n Shared by the lifecycle operation that writes `purgeScheduledAt` and by the tests that pin it,\n * so the window arithmetic has one home. Takes `markedAt` explicitly rather than reading the clock\n * so the caller's transaction timestamp and the deadline cannot disagree.\n /\nexport function resolveOrganizationPurgeScheduledAt(\n markedAt: Date,\n config: TenantTeardownConfig \| undefined,\n): Date {\n const retentionWindowDays = config?.retentionWindowDays ?? TENANT_TEARDOWN_CONFIG_DEFAULTS.retentionWindowDays;\n return new Date(markedAt.getTime() + retentionWindowDays 24 * 60 * 60 * 1000);\n}\n"]}

package/dist/esm/provider-registration-runtime.exports.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 export * from "./external-providers/provider-capability.shared.schemas";
 export * from "./external-providers/provider-metadata.shared.schemas";
 export * from './external-providers/provider-usage-pricing.shared.schemas';
+export * from './external-providers/provider-authentication-assurance.shared.schemas';
 //# sourceMappingURL=provider-registration-runtime.exports.d.ts.map

package/dist/esm/provider-registration-runtime.exports.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-registration-runtime.exports.d.ts","sourceRoot":"","sources":["../../../src/provider-registration-runtime.exports.ts"],"names":[],"mappings":"AAAA,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC"}
1	+ {"version":3,"file":"provider-registration-runtime.exports.d.ts","sourceRoot":"","sources":["../../../src/provider-registration-runtime.exports.ts"],"names":[],"mappings":"AAAA,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC;AAE3E,cAAc,uEAAuE,CAAC"}

package/dist/esm/provider-registration-runtime.exports.js CHANGED Viewed

@@ -1,4 +1,5 @@
 export * from "./external-providers/provider-capability.shared.schemas.js";
 export * from "./external-providers/provider-metadata.shared.schemas.js";
 export * from './external-providers/provider-usage-pricing.shared.schemas.js';
+export * from './external-providers/provider-authentication-assurance.shared.schemas.js';
 //# sourceMappingURL=provider-registration-runtime.exports.js.map

package/dist/esm/provider-registration-runtime.exports.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-registration-runtime.exports.js","sourceRoot":"","sources":["../../../src/provider-registration-runtime.exports.ts"],"names":[],"mappings":"AAAA,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC","sourcesContent":["export * from \"./external-providers/provider-capability.shared.schemas\";\nexport * from \"./external-providers/provider-metadata.shared.schemas\";\nexport * from './external-providers/provider-usage-pricing.shared.schemas';\n"]}
1	+ {"version":3,"file":"provider-registration-runtime.exports.js","sourceRoot":"","sources":["../../../src/provider-registration-runtime.exports.ts"],"names":[],"mappings":"AAAA,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC;AAE3E,cAAc,uEAAuE,CAAC","sourcesContent":["export * from \"./external-providers/provider-capability.shared.schemas\";\nexport * from \"./external-providers/provider-metadata.shared.schemas\";\nexport * from './external-providers/provider-usage-pricing.shared.schemas';\n\nexport * from './external-providers/provider-authentication-assurance.shared.schemas';\n"]}

package/dist/esm/public-runtime/index.d.ts CHANGED Viewed

@@ -110,6 +110,13 @@ export { WildoHeaderKeys } from '../requests/header-keys.shared';
  * nothing to the decorator-free bundle budget.
  */
 export { MAIN_API_BASE_PATH } from '../requests/manual-controllers-routes-urls';
+/**
+ * A caught value as one readable line, for a bundle-isolated package (`saas-website`). The root's
+ * `describeCaughtError` also recognises the engine's own error type and so imports the error schemas;
+ * this atom imports nothing, and `describeCaughtError` delegates to it for every other value — one
+ * rendering, two doors (#1518's "[object Object]" fix, reachable from the browser-safe seam).
+ */
+export { describeThrownValue } from '../errors/thrown-value-description.shared.utils';
 export { AppFrontendType } from '../config/app-frontend-type.shared.schemas';
 /**
  * Canonical Zod-issue rendering. Browser-bound runtimes validate untrusted
@@ -145,6 +152,13 @@ export { buildProviderDisplayNameLabelKey, defineProviderMetadata, ENGINE_PROVID
  * side effects, which is the same bar the tier rule below is exported under.
  */
 export { ProviderDeploymentModel, ProviderComplianceProfileSchema, type ProviderComplianceProfile, } from '../external-providers/provider-compliance-profile.shared.schemas';
+/**
+ * Consent purposes (#534) — the set a person grants, read by the visitor-tier `WebsiteConsentGate` in
+ * the browser bundle and stored by the application. Carved into an import-free atom
+ * (`consent-purposes.shared.ts`) so the website and the engine share ONE vocabulary: a website that
+ * mirrored the string literals would be a second copy that drifts the day a purpose is added.
+ */
+export { ANONYMOUS_CONSENT_RECORD_METHOD, ANONYMOUS_CONSENT_RECORD_PATH, applicationAskedConsentPurposes, CONSENT_PURPOSES, ConsentPurpose, hasGrantedConsentPurposes, missingConsentPurposes, normalizeConsentPurposes, WEBSITE_VISITOR_CONSENT_STORAGE_KEY, } from '../compliance/privacy/consent-purposes.shared';
 /**
  * The tier rule (#328) is enforced by every facet's `compose*Providers`,
  * three of which are browser-bound and reach this package only here. It
@@ -160,7 +174,7 @@ export { assertProviderTierCoherence, engineSlotsBoundByCapabilities, findProvid
  * `AppConfiguration_FrontendBootstrapResponse` contract stays on the root-barrel
  * side.
  */
-export { FrontendProviderEntrySchema, FrontendProvidersBlockSchema, type FrontendProviderEntry, type FrontendProvidersBlock, } from '../external-providers/frontend-provider-entry.shared.schemas';
+export { FileStorageAccepted, FrontendProviderEntrySchema, FrontendProvidersBlockSchema, type FrontendProviderEntry, type FrontendProvidersBlock, } from '../external-providers/frontend-provider-entry.shared.schemas';
 /**
  * Frontend-surface atoms a provider declares (#332, slice S4a): its CSP
  * footprint, the vendor SDK package it loads, and any third-party `<script>` it
@@ -173,12 +187,26 @@ export { FrontendProviderEntrySchema, FrontendProvidersBlockSchema, type Fronten
  * `@wildo-ai/external-connectors-public` and never crosses this seam.
  */
 export { normalizeProviderFrontendCspFootprint, ProviderFrontendComponentDescriptorSchema, ProviderFrontendComponentDescriptorsSchema, ProviderFrontendCspDerivedOriginSchema, ProviderFrontendCspFootprintSchema, ProviderFrontendCspOriginBucket, ProviderFrontendScriptCrossOrigin, ProviderFrontendScriptDeclarationSchema, ProviderFrontendSdkDescriptorSchema, ProviderFrontendSelectionDelivery, type ProviderFrontendComponentDescriptor, type ProviderFrontendComponentDescriptors, type ProviderFrontendCspDerivedOrigin, type ProviderFrontendCspFootprint, type ProviderFrontendCspFootprintDeclaration, type ProviderFrontendScriptDeclaration, type ProviderFrontendSdkDescriptor, } from '../external-providers/provider-frontend-surface.shared.schemas';
+/**
+ * The contract between a provider's frontend COMPONENT and the surface that
+ * mounts it (#394). Types only — no schema, no runtime value — and it lives in
+ * this package rather than beside the module types it serves because a component
+ * ships in its OWN package and that package would otherwise close a dependency
+ * cycle through emitted declarations. Its own file says why in full.
+ */
+export type { ProviderFilePickerConstraints, ProviderFilePickerProps, ProviderFileSelection, } from '../external-providers/provider-frontend-component-contract.shared.types';
+/**
+ * How an application supplies a frontend provider's public keys, and the
+ * dependency-free schema helper the engine's own provider modules declare their
+ * keys with (#394 P3). Browser-safe: pure functions and one enum, no Zod.
+ */
+export { defineFrontendPublicConfigSchema, FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY, FrontendProviderPublicConfigError, FrontendProviderPublicConfigRefusal, FrontendPublicConfigValueKind, overlayFrontendProviderPublicConfig, readDeclaredPublicConfigKeys, type FrontendPublicConfigKeySpec, type FrontendPublicConfigSchema, type OverlayFrontendProviderPublicConfigInput, } from '../external-providers/frontend-provider-public-config.shared';
 /**
  * The public-config shape a built-in frontend capability expects (#380). Named
  * rather than conventional: the keys were previously read by hand at each use
  * site, where a renamed one produced `undefined` and a silently wrong surface.
  */
-export { FrontendFilePickerPublicConfigSchema, type FrontendFilePickerPublicConfig, } from '../external-providers/frontend-capability-public-config.shared.schemas';
+export { admissibleFrontendPublicConfigKeys, FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS, FrontendFilePickerPublicConfigSchema, frontendCapabilityPublicConfigKeys, layerProviderFilePickerConstraints, partitionFrontendCapabilityPublicConfig, type FrontendFilePickerPublicConfig, } from '../external-providers/frontend-capability-public-config.shared.schemas';
 /**
  * The RUNTIME half of the same idea (#437): what a built-in frontend capability
  * calls on the provider that fills it. `FRONTEND_ERROR_MONITORING` is the first —
@@ -207,5 +235,28 @@ export { BUILTIN_PROVIDER_PROTOCOL, type BuiltinProviderProtocol, type ProviderP
  * above, so the closure stays decorator-free.
  */
 export { composeProviderRegistry, ProviderCompositionConflictError, type ProviderRegistryFragment, type ComposedProviderRegistry, type ProviderCompositionConflict, } from '../external-providers/compose-provider-registry.shared';
+/**
+ * Portable lexical primitives — a sha256-digest grammar, a namespaced/opaque ref grammar, a
+ * positive version, a lowercase UUIDv4, an ISO datetime, and two array-canonicality predicates.
+ *
+ * ## Why they are HERE and not only behind `@wildo-ai/saas-models/meta-workflows`
+ *
+ * They are shared by two domains, and only one of them is meta-workflows. Measured 2026-09-19: of
+ * 41 import sites of the meta-workflows subpath, **7 take nothing but these primitives**, and all
+ * seven are `saas-specifications/src/technical-documentation/*.schemas.ts` — a browser-bound tier
+ * whose bundle-isolation allow-list had to admit an entire authoring domain to obtain seven
+ * regexes.
+ *
+ * No K-2 extraction was needed: `portable-primitives.meta-workflows.shared.schemas` imports `zod`
+ * and nothing else, so it is already the zero-dependency atom K-2 asks for — the
+ * `WildoHeaderKeys` case, re-exported whole. The meta-workflows door keeps publishing it for its
+ * 34 mixed consumers; that is two SUBPATHS onto one atom, which `check:package-entrypoints` rule 1
+ * does not refuse (it is root-vs-subpath), and it is what a curated bundle-safe subset IS.
+ *
+ * The `MetaWorkflow_` prefix is kept deliberately: renaming a symbol that 34 other sites import is
+ * a separate change from making it reachable on the bundle-safe seam, and doing both at once would
+ * hide one in the other.
+ */
+export { MetaWorkflow_Sha256DigestSchema, MetaWorkflow_NamespacedRefSchema, MetaWorkflow_OpaqueRefSchema, MetaWorkflow_PositiveVersionSchema, MetaWorkflow_PositiveOrdinalSchema, MetaWorkflow_NonNegativeRevisionSchema, MetaWorkflow_LowercaseUuidV4Schema, MetaWorkflow_IsoDateTimeSchema, MetaWorkflow_NonNegativeFiniteNumberSchema, metaWorkflowValuesAreUnique, metaWorkflowValuesAreLexicallySorted, compareMetaWorkflowCanonicalStrings, } from '../meta-workflows/portable-primitives.meta-workflows.shared.schemas';
 /** @wildo_source:part:end saas.public-runtime.contract */
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/public-runtime/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/public-runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EACH,6BAA6B,EAC7B,iCAAiC,EACjC,kCAAkC,EAClC,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC7B,MAAM,uEAAuE,CAAC;AAE/E;;;;;;;;GAQG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AAExG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAE7E;;;;;;GAMG;AACH,OAAO,EACH,cAAc,EACd,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,GACjC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EACH,iBAAiB,EACjB,aAAa,GAChB,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;;;GASG;AACH,OAAO,EACH,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACtB,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,OAAO,EACH,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,yBAAyB,GACjC,MAAM,kEAAkE,CAAC;AAE1E;;;;;GAKG;AACH,OAAO,EACH,2BAA2B,EAC3B,8BAA8B,EAC9B,0BAA0B,EAC1B,KAAK,uBAAuB,GAC/B,MAAM,uDAAuD,CAAC;AAE/D;;;;;;;GAOG;AACH,OAAO,EACH,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC9B,MAAM,8DAA8D,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,OAAO,EACH,qCAAqC,EACrC,yCAAyC,EACzC,0CAA0C,EAC1C,sCAAsC,EACtC,kCAAkC,EAClC,+BAA+B,EAC/B,iCAAiC,EACjC,uCAAuC,EACvC,mCAAmC,EACnC,iCAAiC,EACjC,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EACjC,KAAK,uCAAuC,EAC5C,KAAK,iCAAiC,EACtC,KAAK,6BAA6B,GACrC,MAAM,gEAAgE,CAAC;AAExE;;;;GAIG;AACH,OAAO,EACH,oCAAoC,EACpC,KAAK,8BAA8B,GACtC,MAAM,wEAAwE,CAAC;AAEhF;;;;;;GAMG;AACH,OAAO,EACH,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,GACnC,MAAM,gEAAgE,CAAC;AAExE;;;;;;GAMG;AACH,OAAO,EACH,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GAC1B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACxB,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;GASG;AACH,OAAO,EACH,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,GACnC,MAAM,wDAAwD,CAAC;AAEhE,0DAA0D"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/public-runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,EACH,6BAA6B,EAC7B,iCAAiC,EACjC,kCAAkC,EAClC,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC7B,MAAM,uEAAuE,CAAC;AAE/E;;;;;;;;GAQG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AAExG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAE7E;;;;;;GAMG;AACH,OAAO,EACH,cAAc,EACd,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,GACjC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EACH,iBAAiB,EACjB,aAAa,GAChB,MAAM,oDAAoD,CAAC;AAE5D;;;;;;;;;GASG;AACH,OAAO,EACH,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACtB,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,OAAO,EACH,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,yBAAyB,GACjC,MAAM,kEAAkE,CAAC;AAE1E;;;;;GAKG;AACH,OAAO,EACH,+BAA+B,EAC/B,6BAA6B,EAC7B,+BAA+B,EAC/B,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,mCAAmC,GACtC,MAAM,+CAA+C,CAAC;AAEvD;;;;;GAKG;AACH,OAAO,EACH,2BAA2B,EAC3B,8BAA8B,EAC9B,0BAA0B,EAC1B,KAAK,uBAAuB,GAC/B,MAAM,uDAAuD,CAAC;AAE/D;;;;;;;GAOG;AACH,OAAO,EACH,mBAAmB,EACnB,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC9B,MAAM,8DAA8D,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,OAAO,EACH,qCAAqC,EACrC,yCAAyC,EACzC,0CAA0C,EAC1C,sCAAsC,EACtC,kCAAkC,EAClC,+BAA+B,EAC/B,iCAAiC,EACjC,uCAAuC,EACvC,mCAAmC,EACnC,iCAAiC,EACjC,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EACjC,KAAK,uCAAuC,EAC5C,KAAK,iCAAiC,EACtC,KAAK,6BAA6B,GACrC,MAAM,gEAAgE,CAAC;AAExE;;;;;;GAMG;AACH,YAAY,EACR,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,GACxB,MAAM,yEAAyE,CAAC;AAEjF;;;;GAIG;AACH,OAAO,EACH,gCAAgC,EAChC,mCAAmC,EACnC,iCAAiC,EACjC,mCAAmC,EACnC,6BAA6B,EAC7B,mCAAmC,EACnC,4BAA4B,EAC5B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,wCAAwC,GAChD,MAAM,8DAA8D,CAAC;AAEtE;;;;GAIG;AACH,OAAO,EACH,kCAAkC,EAClC,yCAAyC,EACzC,oCAAoC,EACpC,kCAAkC,EAClC,kCAAkC,EAClC,uCAAuC,EACvC,KAAK,8BAA8B,GACtC,MAAM,wEAAwE,CAAC;AAEhF;;;;;;GAMG;AACH,OAAO,EACH,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,GACnC,MAAM,gEAAgE,CAAC;AAExE;;;;;;GAMG;AACH,OAAO,EACH,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GAC1B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EACH,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACxB,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;GASG;AACH,OAAO,EACH,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,GACnC,MAAM,wDAAwD,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACH,+BAA+B,EAC/B,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,kCAAkC,EAClC,sCAAsC,EACtC,kCAAkC,EAClC,8BAA8B,EAC9B,0CAA0C,EAC1C,2BAA2B,EAC3B,oCAAoC,EACpC,mCAAmC,GACtC,MAAM,qEAAqE,CAAC;AAE7E,0DAA0D"}