npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.6 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1399) hide show

package/dist/esm/organizations/organizations.shared.schemas.d.ts CHANGED Viewed

@@ -5,6 +5,7 @@
  * Related data moved to separate relational models.
  */
 import { z } from 'zod';
+import '@wildo-ai/zod-decorators';
 export declare enum OrganizationStatus {
     ACTIVE = "ACTIVE",
     SUSPENDED = "SUSPENDED",
@@ -65,7 +66,7 @@ export declare function isAuthorityConferringOrganizationStatus(status: Organiza
 export declare const OrganizationSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     name: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     slug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof OrganizationStatus>>>>>;
     platformAccessApprovalRequired: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
@@ -73,18 +74,34 @@ export declare const OrganizationSchema: z.ZodObject<{
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     deletionRequestedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>>;
     ownerFloorSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
+    serviceProviderRelationshipSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
+    autonomousAgentBindingSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
     purgeScheduledAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>>;
 }, z.core.$strip>;
 export type Organization = z.infer<typeof OrganizationSchema>;
 /**
- * Organization Context - Core organization with frequently accessed related data
+ * An organization as the frontend holds it for a signed-in member: the organization row plus what
+ * session restore fetches beside it.
  *
- * Lifecycle audit information is now tracked through auditable events
+ * **Every field here has a producer, and that is the rule for adding one.** `UserOrgsContext` obtains
+ * these with `doOperation<OrganizationContext>`, which is a CAST, not a parse — so a declared field
+ * nothing produces compiles and reads `undefined` at runtime with no warning. Until #581 this schema
+ * declared five such fields, two of them REQUIRED:
+ *
+ * | removed | why |
+ * |---|---|
+ * | `planFeatures` (required) | no producer, no consumer. Scope features have their own resource (`ORGANIZATION_FEATURES`) with its own cache invalidation; read that. |
+ * | `members` (required) | no producer, no consumer. It implied the tenant's FULL member list on every organization at session restore; the caller's own memberships already arrive on the USER_SELF context, and a people picker reads `ORGANIZATION_MEMBERS`. |
+ * | `profile`, `notifications` | no producer on the default READ session restore uses, no consumer. The ORGANIZATIONS context variant would populate the profile, and it was rejected for session restore (see `UserOrgsContext`). |
+ * | `displayName`, `logoUrl` | no producer, no consumer. `displayName` lives on `OrganizationProfileSchema`. |
+ *
+ * `preferences` stays, optional: `loadOrganizations` fetches it from `ORGANIZATION_PREFERENCES` and
+ * tolerates its absence (#563).
  */
 export declare const OrganizationContextSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     name: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     slug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof OrganizationStatus>>>>>;
     platformAccessApprovalRequired: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
@@ -92,69 +109,9 @@ export declare const OrganizationContextSchema: z.ZodObject<{
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     deletionRequestedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>>;
     ownerFloorSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
+    serviceProviderRelationshipSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
+    autonomousAgentBindingSerializationToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodNumber>>>>>>;
     purgeScheduledAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>>;
-    planFeatures: z.ZodObject<{
-        features: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("./organization-features.shared.schemas").CoreFeature>, z.ZodString]>>>>>;
-        limits: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>>>;
-        manualOverrides: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-            addedFeatures: z.ZodDefault<z.ZodArray<z.ZodString>>;
-            removedFeatures: z.ZodDefault<z.ZodArray<z.ZodString>>;
-            limitOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>;
-    members: z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
-        _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-        userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
-        userEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>>>>>;
-        organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-        roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("..").CORE_ORG_ROLES>, z.ZodString]>>>>>>;
-        status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("./organization-members.shared.schemas").OrganizationMemberStatus>>>>>>>;
-        scheduledReactivationAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
-        userTitle: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
-        invitedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
-        invitedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
-        instanceLabel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-        createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
-        updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
-    }, z.core.$strip>>>;
-    displayName: z.ZodOptional<z.ZodString>;
-    logoUrl: z.ZodOptional<z.ZodURL>;
-    profile: z.ZodOptional<z.ZodObject<{
-        _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-        organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-        displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
-        domain: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-        phone: z.ZodOptional<z.ZodString>;
-        website: z.ZodOptional<z.ZodURL>;
-        description: z.ZodOptional<z.ZodString>;
-        industry: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof import("./organization-profile.shared.schemas").OrganizationIndustry>>>;
-        size: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof import("./organization-profile.shared.schemas").OrganizationSize>>>;
-        founded: z.ZodOptional<z.ZodDate>;
-        address: z.ZodOptional<z.ZodObject<{
-            line1: z.ZodString;
-            line2: z.ZodOptional<z.ZodString>;
-            city: z.ZodString;
-            state: z.ZodOptional<z.ZodString>;
-            country: z.ZodString;
-            postalCode: z.ZodString;
-        }, z.core.$strip>>;
-        timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodString>>;
-        branding: z.ZodDefault<z.ZodObject<{
-            logo: z.ZodOptional<z.ZodURL>;
-            favicon: z.ZodOptional<z.ZodURL>;
-            primaryColor: z.ZodOptional<z.ZodString>;
-            secondaryColor: z.ZodOptional<z.ZodString>;
-            customDomain: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>;
-        socialLinks: z.ZodOptional<z.ZodObject<{
-            linkedin: z.ZodOptional<z.ZodURL>;
-            twitter: z.ZodOptional<z.ZodURL>;
-            facebook: z.ZodOptional<z.ZodURL>;
-            github: z.ZodOptional<z.ZodURL>;
-        }, z.core.$strip>>;
-        createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-        updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-    }, z.core.$strip>>;
     preferences: z.ZodOptional<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
@@ -172,23 +129,6 @@ export declare const OrganizationContextSchema: z.ZodObject<{
         createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
         updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     }, z.core.$strip>>;
-    notifications: z.ZodOptional<z.ZodObject<{
-        _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-        organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
-        emailNotifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-            defaultEmailAddress: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>;
-            billingAddress: z.ZodOptional<z.ZodEmail>;
-            securityAddress: z.ZodOptional<z.ZodEmail>;
-            administrativeAddress: z.ZodOptional<z.ZodEmail>;
-            usersManagementAddress: z.ZodOptional<z.ZodEmail>;
-            billing: z.ZodDefault<z.ZodBoolean>;
-            administrative: z.ZodDefault<z.ZodBoolean>;
-            security: z.ZodDefault<z.ZodBoolean>;
-            usersManagement: z.ZodDefault<z.ZodBoolean>;
-        }, z.core.$strip>>>;
-        createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-        updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type OrganizationContext = z.infer<typeof OrganizationContextSchema>;
 //# sourceMappingURL=organizations.shared.schemas.d.ts.map

package/dist/esm/organizations/organizations.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizations.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAWxB~~,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,aAAa,kBAAkB;IAC/B,SAAS,cAAc;IACvB;;;;;;;OAOG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC,kBAAkB,CAIlF,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAGvG;AAID,eAAO,MAAM,kBAAkB~~;;;;;;;;;;;;iBA0L7B~~,CAAC;AAGH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D~~;;;;GAIG~~;AACH,eAAO,MAAM,yBAAyB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAapC~~,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
1	+ {"version":3,"file":"organizations.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,0BAA0B,CAAC;AAQlC,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,aAAa,kBAAkB;IAC/B,SAAS,cAAc;IACvB;;;;;;;OAOG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC,kBAAkB,CAIlF,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAGvG;AAID,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;iBA2P7B,CAAC;AAGH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/esm/organizations/organizations.shared.schemas.js CHANGED Viewed

@@ -5,12 +5,10 @@
  * Related data moved to separate relational models.
  */
 import { z } from 'zod';
+import '@wildo-ai/zod-decorators';
+import { ApplicationConfigVocabulary } from '../i18n/application-config-vocabulary.shared.js';
 import { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions.js';
-import { OrganizationProfileSchema } from './organization-profile.shared.schemas.js';
 import { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas.js';
-import { OrganizationNotificationsSchema } from './organization-notifications.shared.schemas.js';
-import { ScopeFeaturesWithOverridesSchema } from '../features/scope-features.shared.schemas.js';
-import { OrganizationMemberSchema } from './organization-members.shared.schemas.js';
 export var OrganizationStatus;
 (function (OrganizationStatus) {
     OrganizationStatus["ACTIVE"] = "ACTIVE";
@@ -81,15 +79,34 @@ export const OrganizationSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
     name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),
     /**
-     * Org type from config (for example `seller` or `corporate_buyer`).
+     * Org type from config (for example `seller` or `corporate_buyer`) — REQUIRED, and it must name an entry in
+     * the application's declared `organizationTypes`.
      *
      * The type selects role policy, membership-derived user-type grants, and
      * authentication overrides. A generic patch cannot migrate those dependent
      * invariants atomically, so the value is creation-time identity. A future
      * type transition must be a dedicated migration operation that reconciles
      * every dependent member and policy surface.
+     *
+     * ONE such operation exists: `organizations.promoteToOwnerOrganization` (#1054), the paired mutation
+     * path for the one transition the framework needs — naming the organization that OPERATES the
+     * application. It discharges the sentence above by REFUSING rather than reconciling: the target type
+     * must already cover every user type the source grants, every role a membership holds must be
+     * available in it, and a SCIM binding may not be lost. So no member's authority moves, which is what
+     * makes a transition safe without a cross-resource reconciliation. Any future transition owes the
+     * same bar — refuse, or reconcile in one transaction; a generic patch still may not write this.
+     *
+     * Required since #1032: the sign-in resolver refuses a member of an organization whose type resolves to no
+     * declared entry, so an optional type was a way to create a tenant nobody could sign in to. Organizations stored
+     * before it was required are typed by the engine at boot when the application declares a single type, and the
+     * application refuses to start naming them when it declares several.
+     *
+     * `.systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE)`: the value is a key of the application's declared
+     * `organizationTypes`, so it is shown as that type's word (`system_enums.OrganizationType.<type>`, planned from the
+     * configuration), the missing word showing the key (#1851). It stays a string because the application, not this
+     * schema, owns the values.
      */
-    type: z.string().optional().isSummaryField().excludeFromUpdate(),
+    type: z.string().min(1).systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE).isSummaryField().excludeFromUpdate(),
     /**
      * The tenant's URL-safe identity.
      *
@@ -222,8 +239,11 @@ export const OrganizationSchema = z.object({
      *
      * The standard remedy is to give the two transactions something to collide ON. Every owner-reducing
      * operation bumps this token on the tenant's own row inside its transaction, so two of them touch
-     * the same document and the storage engine aborts the loser. Verified as a race in
-     * `organization-owner-floor-hostile.mongo.integration.test.ts` (H-2).
+     * the same document and the storage engine aborts the loser. That holds only when the operation's
+     * transaction reaches the floor, which every owner-reducing prefix now passes as `transaction`; until
+     * 2026-09-15 none did, and the write autocommitted beside the removal. Observed on a live replica set
+     * in `organization-owner-floor-concurrent-removal.mongo-replset.integration.test.ts`, which also
+     * drives the unforwarded shape and watches it leave the tenant with no owner.
      *
      * Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a
      * modification of the organization, and it would corrupt every "recently changed tenants" surface);
@@ -235,6 +255,49 @@ export const OrganizationSchema = z.object({
      * owner-reducing write legitimately has no token. Absent and zero mean the same thing.
      */
     ownerFloorSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),
+    /**
+     * Serializes every decision on this organization's service-provider relationships (#1597).
+     *
+     * Each relationship verb — either side's propose, accept, decline, suspend, resume, terminate, withdraw, expire,
+     * amendScope, machine-client admission, assign and unassign — decides on state it READ: "is a relationship already
+     * live?", "is this one still SUSPENDED?". Two decisions at the same moment can each read the state the other is
+     * about to change: two proposals each see none live and both commit; a resume and a terminate each see SUSPENDED and
+     * the later write turns a TERMINATED relationship back to ACTIVE with `endedAt` still set. So every verb bumps this
+     * token on the CLIENT organization's row inside its own transaction BEFORE reading what it decides on. On MongoDB the
+     * second writer hits a write conflict and is retried from a fresh read; on PostgreSQL (READ COMMITTED) it blocks on
+     * the row lock until the first commits, and its next read sees the committed state. The same remedy, and the same
+     * reasoning, as `ownerFloorSerializationToken` above.
+     *
+     * Its own FIELD rather than that token, so each token's meaning stays legible — but both are fields of this one row,
+     * and both adapters conflict per row, so an owner-reducing write and a relationship decision on the same tenant DO
+     * serialize against each other. That is accepted, not avoided: both are rare, and the loser is retried (MongoDB) or
+     * waits (PostgreSQL). A separate lock document would avoid it at the cost of a second thing to keep consistent.
+     *
+     * The write also moves the organization's `updatedAt` and version — the repository stamps both on every update, as
+     * it already did for the owner-floor token. Accepted as truthful: the row WAS written. A concurrent edit of the
+     * organization that carries an If-Match gets the ordinary precondition failure and retries.
+     *
+     * Rejected alternatives: a unique index on (organizationId, providerOrganizationId) — it would forbid the pair's
+     * HISTORY (terminated relationships stay as access evidence, and a firm may be re-engaged); a partial unique index
+     * over the live statuses — not expressible through the field decorators on both adapters; a compare-and-swap on the
+     * relationship's own status — it guards one row, while a decision also reads rows it does not write (another
+     * relationship, the assignment, the membership); bumping `updatedAt` alone as the collision point — it names a
+     * modification rather than a decision, though the write above moves it anyway.
+     *
+     * `.nullish()` because a tenant that has never received a proposal has no token. Nothing reads the value; only the
+     * write matters.
+     */
+    serviceProviderRelationshipSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),
+    /**
+     * Serializes every change of which OAuth client runs which autonomous agent in this organization
+     * (#1611). The `setAutonomousAgents` operation bumps it inside its own transaction BEFORE counting the
+     * clients that already carry a ref, so two binds of the same ref at the same moment cannot both see
+     * "none" and both commit: on MongoDB the second writer hits a write conflict on this row and is retried;
+     * on PostgreSQL (READ COMMITTED) it waits for the row lock, and its count then sees the first binding.
+     * The `ownerFloorSerializationToken` remedy, for the same write skew. Its own field so its meaning stays
+     * legible. `.nullish()`: a tenant that has never bound an agent has no token. Nothing reads the value.
+     */
+    autonomousAgentBindingSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),
     /**
      * When the `organization-purge` batch becomes allowed to destroy this tenant.
      *
@@ -261,20 +324,25 @@ export const OrganizationSchema = z.object({
     purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()
 });
 /**
- * Organization Context - Core organization with frequently accessed related data
+ * An organization as the frontend holds it for a signed-in member: the organization row plus what
+ * session restore fetches beside it.
+ *
+ * **Every field here has a producer, and that is the rule for adding one.** `UserOrgsContext` obtains
+ * these with `doOperation<OrganizationContext>`, which is a CAST, not a parse — so a declared field
+ * nothing produces compiles and reads `undefined` at runtime with no warning. Until #581 this schema
+ * declared five such fields, two of them REQUIRED:
+ *
+ * | removed | why |
+ * |---|---|
+ * | `planFeatures` (required) | no producer, no consumer. Scope features have their own resource (`ORGANIZATION_FEATURES`) with its own cache invalidation; read that. |
+ * | `members` (required) | no producer, no consumer. It implied the tenant's FULL member list on every organization at session restore; the caller's own memberships already arrive on the USER_SELF context, and a people picker reads `ORGANIZATION_MEMBERS`. |
+ * | `profile`, `notifications` | no producer on the default READ session restore uses, no consumer. The ORGANIZATIONS context variant would populate the profile, and it was rejected for session restore (see `UserOrgsContext`). |
+ * | `displayName`, `logoUrl` | no producer, no consumer. `displayName` lives on `OrganizationProfileSchema`. |
  *
- * Lifecycle audit information is now tracked through auditable events
+ * `preferences` stays, optional: `loadOrganizations` fetches it from `ORGANIZATION_PREFERENCES` and
+ * tolerates its absence (#563).
  */
 export const OrganizationContextSchema = OrganizationSchema.extend({
-    // Scope features (stored separately from billing, scope-agnostic)
-    planFeatures: ScopeFeaturesWithOverridesSchema,
-    members: z.array(OrganizationMemberSchema),
-    // Basic display info (most frequently accessed)
-    displayName: z.string().optional(), // Can be different from name
-    logoUrl: z.url().optional(),
-    // Extended related data (optional - populated as needed)
-    profile: OrganizationProfileSchema.optional(),
     preferences: OrganizationPreferencesSchema.optional(),
-    notifications: OrganizationNotificationsSchema.optional()
 });
 //# sourceMappingURL=organizations.shared.schemas.js.map

package/dist/esm/organizations/organizations.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAKjF,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;IACvB,qCAAe,CAAA;IACf,qDAA+B,CAAA;IAC/B,6CAAuB,CAAA;IACvB;;;;;;;OAOG;IACH,yCAAmB,CAAA;AACrB,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAoC,IAAI,GAAG,CAAC;IAC9F,kBAAkB,CAAC,OAAO;IAC1B,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAAsC;IAC5F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,uCAAuC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAID,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D;;;;;;;;OAQG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAChE;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACb,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,WAAW,EAAE;SACb,QAAQ,CAAC,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,wBAAwB,EAAE,CAAC;SAC5F,cAAc,EAAE;SAChB,iBAAiB,EAAE;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAExH;;;;;;;;;;;;;;;;OAgBG;IACH,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAE5E,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6CAA6C;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;IACxG;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAE3H;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;CACtG,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,kEAAkE;IAClE,YAAY,EAAE,gCAAgC;IAC9C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAE1C,gDAAgD;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,6BAA6B;IACjE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,yDAAyD;IACzD,OAAO,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC","sourcesContent":["/*\n Core Organization Shared Schemas\n \n Lean organization schema optimized for frequent fetching.\n * Related data moved to separate relational models.\n /\n\nimport { z } from 'zod';\nimport { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions';\nimport { OrganizationProfileSchema } from './organization-profile.shared.schemas';\nimport { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas';\nimport { OrganizationNotificationsSchema } from './organization-notifications.shared.schemas';\nimport { ScopeFeaturesWithOverridesSchema } from '../features/scope-features.shared.schemas';\nimport { OrganizationMemberSchema } from './organization-members.shared.schemas';\n\n\n\n\nexport enum OrganizationStatus {\n ACTIVE = 'ACTIVE',\n SUSPENDED = 'SUSPENDED',\n TRIAL = 'TRIAL',\n TRIAL_EXPIRED = 'TRIAL_EXPIRED',\n CANCELLED = 'CANCELLED',\n /\n Marked for deletion and inside its retention window — NOT removed.\n \n Written by the `request_deletion` lifecycle operation, cleared by `restore`, and consumed by\n * the `organization-purge` batch once {@link Organization.purgeScheduledAt} has elapsed. A row\n * in this state is authorization-dead (see\n * {@link isAuthorityConferringOrganizationStatus}) and data-alive.\n /\n DELETED = 'DELETED'\n}\n\n/\n Organization statuses under which a membership STOPS conferring authority.\n \n ## Why this exists as a named authority\n \n Until 2026-08-01 `OrganizationStatus` had zero backend readers: the execution-context\n * creator built `initiatorRoles` straight from ACTIVE membership rows without ever looking at the\n * organization, so no status value affected anything. That made tenant soft-delete impossible to\n * express — a tenant marked for purge would have kept handing out `ORG_ADMIN` for its whole\n * retention window, which is the original hazard with a longer fuse rather than a fix.\n \n The set is declared here, beside the enum it partitions, rather than inline at the consumer, so\n * that adding a future non-operational status is one edit in the place a reader is already\n * looking. Consumers call {@link isAuthorityConferringOrganizationStatus}; they must not test\n * `status === DELETED` inline.\n \n ## Why these three\n \n - `DELETED` — marked for purge. The whole point of the soft-delete phase.\n * - `SUSPENDED` — an administratively halted tenant. Membership must not survive the halt.\n * - `CANCELLED` — a terminated subscription/tenant. Terminal, like `DELETED`.\n \n `TRIAL_EXPIRED` is deliberately NOT here: an expired trial still needs its administrators to\n * sign in and pay, so revoking their authority would make the tenant unrecoverable by its owner.\n * `ACTIVE` and `TRIAL` are the operational states.\n \n ⚠️ Fail-CLOSED direction: an unresolvable organization is treated as non-conferring by the\n * consumer, so a missing row can never widen authority.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — access rights are removed when the\n * scope granting them stops being operational, without waiting for the data to be destroyed.\n /\nexport const ORGANIZATION_STATUSES_WITHOUT_AUTHORITY: ReadonlySet<OrganizationStatus> = new Set([\n OrganizationStatus.DELETED,\n OrganizationStatus.SUSPENDED,\n OrganizationStatus.CANCELLED,\n]);\n\n/\n True when a membership in an organization of this status still confers its roles.\n \n The single authority behind the execution-context membership gate. See\n * {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} for the rationale and the deliberate\n * `TRIAL_EXPIRED` exclusion.\n /\nexport function isAuthorityConferringOrganizationStatus(status: OrganizationStatus \| undefined): boolean {\n if (status === undefined) return false;\n return !ORGANIZATION_STATUSES_WITHOUT_AUTHORITY.has(status);\n}\n\n\n\nexport const OrganizationSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n /\n Org type from config (for example `seller` or `corporate_buyer`).\n \n The type selects role policy, membership-derived user-type grants, and\n * authentication overrides. A generic patch cannot migrate those dependent\n * invariants atomically, so the value is creation-time identity. A future\n * type transition must be a dedicated migration operation that reconciles\n * every dependent member and policy surface.\n /\n type: z.string().optional().isSummaryField().excludeFromUpdate(),\n /\n The tenant's URL-safe identity.\n \n `.isUnique()` since 2026-08-01, and it closes a real hole rather than restating a known rule:\n * uniqueness was promised by the resource specification's 409 and enforced by NOTHING — no index\n * and no application guard — so two organizations could take the same slug. Because the field is\n * also `.excludeFromUpdate()` (creation-time identity, not an editable label), such a collision\n * could never be resolved through the API afterwards. It has to be refused at creation.\n \n Uniqueness is collection-wide, which IS per-application: an application's organizations live in\n * that application's own database, and the schema carries no `applicationId` to scope by.\n \n ⚠️ MongoDB-only today. The SQL planner records uniqueness as intent and leaves enforcement\n * migration-owned, so on a SQL adapter this is a declaration rather than a guarantee.\n /\n slug: z.string()\n .min(1)\n .max(50)\n .regex(/^[a-z0-9]+(?:-[a-z0-9]+)$/)\n .isDBIndexed()\n .isUnique({ conflictMessageReference: ErrorCustomMessageReference.ORGANIZATION_SLUG_EXISTS })\n .isSummaryField()\n .excludeFromUpdate(),\n /*\n Tenant lifecycle and access posture.\n \n `.excludeFromUpdate()` since 2026-08-01, and that exclusion is the whole point of the field.\n * Before it, generic UPDATE carried `status` and the DEFAULT variant of that operation is gated\n * to `ORG_ADMIN` — while SUSPEND / ACTIVATE are `APP_ADMIN_SUPER_ADMIN`-only and gated by an\n * `enabledCondition` on the current status. So the org admin of a SUSPENDED tenant could\n * `PUT /organizations/{id}` with `{\"status\":\"ACTIVE\"}` and lift the platform's suspension on\n * their own organization: the control was defeatable by exactly the party it exists to control.\n * The configuration had claimed otherwise for a long time — both UPDATE variants carried a\n * `// status manually excluded for this variant` comment that nothing implemented.\n \n Lifecycle transitions belong to the dedicated verbs, which own the state machine, the reason,\n * and the audit trail. This mirrors `OrganizationMemberSchema.status`, whose JSDoc has always\n * described the same rule for the same reason.\n \n KNOWN CONSEQUENCE, ACCEPTED: the platform apps-manager's `upsertEntity` re-asserts\n * `status: ACTIVE` on its update branch when reconciling an existing organization. That write is\n * now dropped. This is the intended outcome — a provisioning re-run silently returning a\n * suspended tenant to ACTIVE is the same defect from the other direction. A path that must set\n * the status goes through the transition operations or a trusted `updateAsSystem`, not a generic\n * field patch.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — a tenant may not lift a platform-imposed\n * restriction on itself.\n /\n status: z.enum(OrganizationStatus).default(OrganizationStatus.ACTIVE).isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n /\n Does a platform operator need THIS tenant's approval before an elevation becomes usable?\n \n The Customer Lockbox posture, and opt-in per tenant exactly as Microsoft and Google ship it. A\n * tenant that has not staffed an approver must not thereby become unable to receive support, so\n * the default is `false`: elevations still require a request, a justification, a 4-hour ceiling and\n * an audit trail — they simply do not wait for a human in the tenant.\n \n Turning it ON is the strongest available posture and is what regulated buyers ask for by name.\n \n ⚠️ It does NOT make the tenant unreachable when it has no administrator. A tenant with no\n * administratively usable owner cannot approve anything, and requiring approval from it would make\n * its own repair impossible — see `PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE`,\n * which is measured with the owner floor's own predicate rather than assumed.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — customer-approved operator access.\n /\n platformAccessApprovalRequired: z.boolean().default(false).isAuditEvidence(),\n\n // Basic timestamps (lifecycle audit is in separate collection)\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // Tenant teardown — soft-delete marks (WS-A)\n /\n When the tenant was MARKED for deletion — the start of its retention window.\n \n Written by the `request_deletion` lifecycle operation together with `status: DELETED`, and\n * cleared by `restore`. Both fields move together: `status` is the authorization-relevant half\n * (it is what {@link isAuthorityConferringOrganizationStatus} reads) and this is the evidence\n * half.\n \n ## Why this is not called `deletedAt`\n \n It replaced a field of that name on 2026-08-01, and the rename is not cosmetic in two separate\n * ways.\n \n First, `deletedAt` is RESERVED framework vocabulary: it appears in\n * `createOrUpdateMandatoryDiscardFields`, so the runtime strips it from every create and update\n * payload on every resource. A lifecycle operation could therefore never write it — the value\n * would be discarded and the operation would answer success having recorded nothing, which is\n * the exact silent-no-op class this workstream exists to remove. No `authoritativeFields`\n * declaration rescues it; the discard happens regardless.\n \n Second, the two names mean different things. `deletedAt` answers \"when was this row deleted\",\n * and the row is emphatically NOT deleted — it is fully present and restorable for the whole\n * retention window. Reusing the name would have made every reader who trusts the framework's\n * vocabulary wrong about the state of the tenant in front of them.\n \n The predecessor field had zero readers and zero writers in the entire repository, so nothing\n * observable was lost by replacing it.\n \n Never a user-facing value on a live organization — it only ever renders as an empty \"—\", so it\n * stays hidden from every auto-rendered display/edit surface via `.isHidden()`. An admin/audit\n * surface that needs to inspect marked rows must opt it back in explicitly.\n \n ⚠️ This is NOT the purge predicate. Purge eligibility is {@link purgeScheduledAt} — see the\n * reasoning there.\n \n ## Why `.nullish()` and not `.optional()`\n \n `restore` CLEARS this field, and clearing means writing `null` — `undefined` merely omits the\n * key and leaves the stale mark in place. `preserveServerInjectedFields` copies the authored\n * value verbatim past the strict re-parse (`hasOwnProperty` + assign), so the `null` genuinely\n * reaches persistence. With `.optional()` alone the row would then be UNREADABLE: the main schema\n * rejects `null` for a `z.date()`, so every subsequent read of a restored tenant would throw on\n * output projection. Verified by probing the real schema rather than assumed.\n /\n deletionRequestedAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden(),\n /\n Serialization token for the organization-owner floor. Never read for meaning — only WRITTEN, to\n * make concurrent owner-reducing operations conflict with each other.\n \n ## Why a stored field is the fix rather than a better check\n \n The floor is a check-then-act on a COUNT: it measures the usable-owner population, then the\n * caller writes. Under snapshot isolation that is textbook WRITE SKEW — two transactions each\n * remove a DIFFERENT owner, each observes the other still present, and both commit, producing a\n * tenant with zero owners that neither was individually permitted to create. No amount of\n * additional checking closes it, because each transaction's view is internally consistent; a\n * re-measure after the write cannot see the other transaction's uncommitted row either.\n \n The standard remedy is to give the two transactions something to collide ON. Every owner-reducing\n * operation bumps this token on the tenant's own row inside its transaction, so two of them touch\n * the same document and the storage engine aborts the loser. Verified as a race in\n * `organization-owner-floor-hostile.mongo.integration.test.ts` (H-2).\n \n Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a\n * modification of the organization, and it would corrupt every \"recently changed tenants\" surface);\n * a separate lock collection (a new resource, a new registration, and a second thing to keep\n * consistent with the floor); an application-level mutex (does not survive multiple processes,\n * which is exactly the deployment this must work in).\n \n `.nullish()` because existing tenants predate it and a tenant that has never had an\n * owner-reducing write legitimately has no token. Absent and zero mean the same thing.\n /\n ownerFloorSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n\n /\n When the `organization-purge` batch becomes allowed to destroy this tenant.\n \n ## Why this is stored rather than derived from `deletionRequestedAt` + a configured window\n \n The retention window is a PROMISE made to the tenant at the moment of the mark (\"your data is\n * recoverable until <date>\"). Deriving eligibility as `deletionRequestedAt < now - window`\n * re-evaluates that promise against whatever the configuration says at PURGE time, so lowering\n * the window would retroactively shorten — or immediately expire — every tenant already inside\n * one. Pinning the deadline at mark time makes the commitment immutable, which is the property\n * a data-retention commitment has to have, and it makes a per-tenant legal hold expressible\n * later by moving one field rather than by special-casing the batch predicate.\n \n The `FILES` soft-delete precedent derives its cutoff instead. That is defensible there — an\n * orphaned upload is nobody's commitment — and is precisely why the two should not share one\n * mechanism.\n \n Server-owned: written only by the lifecycle operations that own the state machine, never by a\n * client patch.\n \n `.nullish()` for the same reason as {@link deletionRequestedAt} — `restore` clears it, and a\n * persisted `null` has to survive the next read.\n /\n purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()\n});\n\n\nexport type Organization = z.infer<typeof OrganizationSchema>;\n\n/\n Organization Context - Core organization with frequently accessed related data\n \n Lifecycle audit information is now tracked through auditable events\n */\nexport const OrganizationContextSchema = OrganizationSchema.extend({\n // Scope features (stored separately from billing, scope-agnostic)\n planFeatures: ScopeFeaturesWithOverridesSchema,\n members: z.array(OrganizationMemberSchema),\n\n // Basic display info (most frequently accessed)\n displayName: z.string().optional(), // Can be different from name\n logoUrl: z.url().optional(),\n\n // Extended related data (optional - populated as needed)\n profile: OrganizationProfileSchema.optional(),\n preferences: OrganizationPreferencesSchema.optional(),\n notifications: OrganizationNotificationsSchema.optional()\n});\n\n\nexport type OrganizationContext = z.infer<typeof OrganizationContextSchema>;\n"]}
1	+ {"version":3,"file":"organizations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAK1F,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;IACvB,qCAAe,CAAA;IACf,qDAA+B,CAAA;IAC/B,6CAAuB,CAAA;IACvB;;;;;;;OAOG;IACH,yCAAmB,CAAA;AACrB,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAoC,IAAI,GAAG,CAAC;IAC9F,kBAAkB,CAAC,OAAO;IAC1B,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAAsC;IAC5F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,uCAAuC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAID,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtH;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACb,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,WAAW,EAAE;SACb,QAAQ,CAAC,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,wBAAwB,EAAE,CAAC;SAC5F,cAAc,EAAE;SAChB,iBAAiB,EAAE;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAExH;;;;;;;;;;;;;;;;OAgBG;IACH,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAE5E,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6CAA6C;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;IACxG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAC3H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,6CAA6C,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAC5I;;;;;;;;OAQG;IACH,wCAAwC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAEvI;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;CACtG,CAAC,CAAC;AAKH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC","sourcesContent":["/*\n Core Organization Shared Schemas\n \n Lean organization schema optimized for frequent fetching.\n * Related data moved to separate relational models.\n /\n\nimport { z } from 'zod';\nimport '@wildo-ai/zod-decorators';\nimport { ApplicationConfigVocabulary } from '../i18n/application-config-vocabulary.shared';\nimport { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions';\nimport { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas';\n\n\n\n\nexport enum OrganizationStatus {\n ACTIVE = 'ACTIVE',\n SUSPENDED = 'SUSPENDED',\n TRIAL = 'TRIAL',\n TRIAL_EXPIRED = 'TRIAL_EXPIRED',\n CANCELLED = 'CANCELLED',\n /\n Marked for deletion and inside its retention window — NOT removed.\n \n Written by the `request_deletion` lifecycle operation, cleared by `restore`, and consumed by\n * the `organization-purge` batch once {@link Organization.purgeScheduledAt} has elapsed. A row\n * in this state is authorization-dead (see\n * {@link isAuthorityConferringOrganizationStatus}) and data-alive.\n /\n DELETED = 'DELETED'\n}\n\n/\n Organization statuses under which a membership STOPS conferring authority.\n \n ## Why this exists as a named authority\n \n Until 2026-08-01 `OrganizationStatus` had zero backend readers: the execution-context\n * creator built `initiatorRoles` straight from ACTIVE membership rows without ever looking at the\n * organization, so no status value affected anything. That made tenant soft-delete impossible to\n * express — a tenant marked for purge would have kept handing out `ORG_ADMIN` for its whole\n * retention window, which is the original hazard with a longer fuse rather than a fix.\n \n The set is declared here, beside the enum it partitions, rather than inline at the consumer, so\n * that adding a future non-operational status is one edit in the place a reader is already\n * looking. Consumers call {@link isAuthorityConferringOrganizationStatus}; they must not test\n * `status === DELETED` inline.\n \n ## Why these three\n \n - `DELETED` — marked for purge. The whole point of the soft-delete phase.\n * - `SUSPENDED` — an administratively halted tenant. Membership must not survive the halt.\n * - `CANCELLED` — a terminated subscription/tenant. Terminal, like `DELETED`.\n \n `TRIAL_EXPIRED` is deliberately NOT here: an expired trial still needs its administrators to\n * sign in and pay, so revoking their authority would make the tenant unrecoverable by its owner.\n * `ACTIVE` and `TRIAL` are the operational states.\n \n ⚠️ Fail-CLOSED direction: an unresolvable organization is treated as non-conferring by the\n * consumer, so a missing row can never widen authority.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — access rights are removed when the\n * scope granting them stops being operational, without waiting for the data to be destroyed.\n /\nexport const ORGANIZATION_STATUSES_WITHOUT_AUTHORITY: ReadonlySet<OrganizationStatus> = new Set([\n OrganizationStatus.DELETED,\n OrganizationStatus.SUSPENDED,\n OrganizationStatus.CANCELLED,\n]);\n\n/\n True when a membership in an organization of this status still confers its roles.\n \n The single authority behind the execution-context membership gate. See\n * {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} for the rationale and the deliberate\n * `TRIAL_EXPIRED` exclusion.\n /\nexport function isAuthorityConferringOrganizationStatus(status: OrganizationStatus \| undefined): boolean {\n if (status === undefined) return false;\n return !ORGANIZATION_STATUSES_WITHOUT_AUTHORITY.has(status);\n}\n\n\n\nexport const OrganizationSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n /\n Org type from config (for example `seller` or `corporate_buyer`) — REQUIRED, and it must name an entry in\n * the application's declared `organizationTypes`.\n \n The type selects role policy, membership-derived user-type grants, and\n * authentication overrides. A generic patch cannot migrate those dependent\n * invariants atomically, so the value is creation-time identity. A future\n * type transition must be a dedicated migration operation that reconciles\n * every dependent member and policy surface.\n \n ONE such operation exists: `organizations.promoteToOwnerOrganization` (#1054), the paired mutation\n * path for the one transition the framework needs — naming the organization that OPERATES the\n * application. It discharges the sentence above by REFUSING rather than reconciling: the target type\n * must already cover every user type the source grants, every role a membership holds must be\n * available in it, and a SCIM binding may not be lost. So no member's authority moves, which is what\n * makes a transition safe without a cross-resource reconciliation. Any future transition owes the\n * same bar — refuse, or reconcile in one transaction; a generic patch still may not write this.\n \n Required since #1032: the sign-in resolver refuses a member of an organization whose type resolves to no\n * declared entry, so an optional type was a way to create a tenant nobody could sign in to. Organizations stored\n * before it was required are typed by the engine at boot when the application declares a single type, and the\n * application refuses to start naming them when it declares several.\n \n `.systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE)`: the value is a key of the application's declared\n * `organizationTypes`, so it is shown as that type's word (`system_enums.OrganizationType.<type>`, planned from the\n * configuration), the missing word showing the key (#1851). It stays a string because the application, not this\n * schema, owns the values.\n /\n type: z.string().min(1).systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE).isSummaryField().excludeFromUpdate(),\n /\n The tenant's URL-safe identity.\n \n `.isUnique()` since 2026-08-01, and it closes a real hole rather than restating a known rule:\n * uniqueness was promised by the resource specification's 409 and enforced by NOTHING — no index\n * and no application guard — so two organizations could take the same slug. Because the field is\n * also `.excludeFromUpdate()` (creation-time identity, not an editable label), such a collision\n * could never be resolved through the API afterwards. It has to be refused at creation.\n \n Uniqueness is collection-wide, which IS per-application: an application's organizations live in\n * that application's own database, and the schema carries no `applicationId` to scope by.\n \n ⚠️ MongoDB-only today. The SQL planner records uniqueness as intent and leaves enforcement\n * migration-owned, so on a SQL adapter this is a declaration rather than a guarantee.\n /\n slug: z.string()\n .min(1)\n .max(50)\n .regex(/^[a-z0-9]+(?:-[a-z0-9]+)$/)\n .isDBIndexed()\n .isUnique({ conflictMessageReference: ErrorCustomMessageReference.ORGANIZATION_SLUG_EXISTS })\n .isSummaryField()\n .excludeFromUpdate(),\n /*\n Tenant lifecycle and access posture.\n \n `.excludeFromUpdate()` since 2026-08-01, and that exclusion is the whole point of the field.\n * Before it, generic UPDATE carried `status` and the DEFAULT variant of that operation is gated\n * to `ORG_ADMIN` — while SUSPEND / ACTIVATE are `APP_ADMIN_SUPER_ADMIN`-only and gated by an\n * `enabledCondition` on the current status. So the org admin of a SUSPENDED tenant could\n * `PUT /organizations/{id}` with `{\"status\":\"ACTIVE\"}` and lift the platform's suspension on\n * their own organization: the control was defeatable by exactly the party it exists to control.\n * The configuration had claimed otherwise for a long time — both UPDATE variants carried a\n * `// status manually excluded for this variant` comment that nothing implemented.\n \n Lifecycle transitions belong to the dedicated verbs, which own the state machine, the reason,\n * and the audit trail. This mirrors `OrganizationMemberSchema.status`, whose JSDoc has always\n * described the same rule for the same reason.\n \n KNOWN CONSEQUENCE, ACCEPTED: the platform apps-manager's `upsertEntity` re-asserts\n * `status: ACTIVE` on its update branch when reconciling an existing organization. That write is\n * now dropped. This is the intended outcome — a provisioning re-run silently returning a\n * suspended tenant to ACTIVE is the same defect from the other direction. A path that must set\n * the status goes through the transition operations or a trusted `updateAsSystem`, not a generic\n * field patch.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — a tenant may not lift a platform-imposed\n * restriction on itself.\n /\n status: z.enum(OrganizationStatus).default(OrganizationStatus.ACTIVE).isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n /\n Does a platform operator need THIS tenant's approval before an elevation becomes usable?\n \n The Customer Lockbox posture, and opt-in per tenant exactly as Microsoft and Google ship it. A\n * tenant that has not staffed an approver must not thereby become unable to receive support, so\n * the default is `false`: elevations still require a request, a justification, a 4-hour ceiling and\n * an audit trail — they simply do not wait for a human in the tenant.\n \n Turning it ON is the strongest available posture and is what regulated buyers ask for by name.\n \n ⚠️ It does NOT make the tenant unreachable when it has no administrator. A tenant with no\n * administratively usable owner cannot approve anything, and requiring approval from it would make\n * its own repair impossible — see `PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE`,\n * which is measured with the owner floor's own predicate rather than assumed.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — customer-approved operator access.\n /\n platformAccessApprovalRequired: z.boolean().default(false).isAuditEvidence(),\n\n // Basic timestamps (lifecycle audit is in separate collection)\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // Tenant teardown — soft-delete marks (WS-A)\n /\n When the tenant was MARKED for deletion — the start of its retention window.\n \n Written by the `request_deletion` lifecycle operation together with `status: DELETED`, and\n * cleared by `restore`. Both fields move together: `status` is the authorization-relevant half\n * (it is what {@link isAuthorityConferringOrganizationStatus} reads) and this is the evidence\n * half.\n \n ## Why this is not called `deletedAt`\n \n It replaced a field of that name on 2026-08-01, and the rename is not cosmetic in two separate\n * ways.\n \n First, `deletedAt` is RESERVED framework vocabulary: it appears in\n * `createOrUpdateMandatoryDiscardFields`, so the runtime strips it from every create and update\n * payload on every resource. A lifecycle operation could therefore never write it — the value\n * would be discarded and the operation would answer success having recorded nothing, which is\n * the exact silent-no-op class this workstream exists to remove. No `authoritativeFields`\n * declaration rescues it; the discard happens regardless.\n \n Second, the two names mean different things. `deletedAt` answers \"when was this row deleted\",\n * and the row is emphatically NOT deleted — it is fully present and restorable for the whole\n * retention window. Reusing the name would have made every reader who trusts the framework's\n * vocabulary wrong about the state of the tenant in front of them.\n \n The predecessor field had zero readers and zero writers in the entire repository, so nothing\n * observable was lost by replacing it.\n \n Never a user-facing value on a live organization — it only ever renders as an empty \"—\", so it\n * stays hidden from every auto-rendered display/edit surface via `.isHidden()`. An admin/audit\n * surface that needs to inspect marked rows must opt it back in explicitly.\n \n ⚠️ This is NOT the purge predicate. Purge eligibility is {@link purgeScheduledAt} — see the\n * reasoning there.\n \n ## Why `.nullish()` and not `.optional()`\n \n `restore` CLEARS this field, and clearing means writing `null` — `undefined` merely omits the\n * key and leaves the stale mark in place. `preserveServerInjectedFields` copies the authored\n * value verbatim past the strict re-parse (`hasOwnProperty` + assign), so the `null` genuinely\n * reaches persistence. With `.optional()` alone the row would then be UNREADABLE: the main schema\n * rejects `null` for a `z.date()`, so every subsequent read of a restored tenant would throw on\n * output projection. Verified by probing the real schema rather than assumed.\n /\n deletionRequestedAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden(),\n /\n Serialization token for the organization-owner floor. Never read for meaning — only WRITTEN, to\n * make concurrent owner-reducing operations conflict with each other.\n \n ## Why a stored field is the fix rather than a better check\n \n The floor is a check-then-act on a COUNT: it measures the usable-owner population, then the\n * caller writes. Under snapshot isolation that is textbook WRITE SKEW — two transactions each\n * remove a DIFFERENT owner, each observes the other still present, and both commit, producing a\n * tenant with zero owners that neither was individually permitted to create. No amount of\n * additional checking closes it, because each transaction's view is internally consistent; a\n * re-measure after the write cannot see the other transaction's uncommitted row either.\n \n The standard remedy is to give the two transactions something to collide ON. Every owner-reducing\n * operation bumps this token on the tenant's own row inside its transaction, so two of them touch\n * the same document and the storage engine aborts the loser. That holds only when the operation's\n * transaction reaches the floor, which every owner-reducing prefix now passes as `transaction`; until\n * 2026-09-15 none did, and the write autocommitted beside the removal. Observed on a live replica set\n * in `organization-owner-floor-concurrent-removal.mongo-replset.integration.test.ts`, which also\n * drives the unforwarded shape and watches it leave the tenant with no owner.\n \n Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a\n * modification of the organization, and it would corrupt every \"recently changed tenants\" surface);\n * a separate lock collection (a new resource, a new registration, and a second thing to keep\n * consistent with the floor); an application-level mutex (does not survive multiple processes,\n * which is exactly the deployment this must work in).\n \n `.nullish()` because existing tenants predate it and a tenant that has never had an\n * owner-reducing write legitimately has no token. Absent and zero mean the same thing.\n /\n ownerFloorSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n /\n Serializes every decision on this organization's service-provider relationships (#1597).\n \n Each relationship verb — either side's propose, accept, decline, suspend, resume, terminate, withdraw, expire,\n * amendScope, machine-client admission, assign and unassign — decides on state it READ: \"is a relationship already\n * live?\", \"is this one still SUSPENDED?\". Two decisions at the same moment can each read the state the other is\n * about to change: two proposals each see none live and both commit; a resume and a terminate each see SUSPENDED and\n * the later write turns a TERMINATED relationship back to ACTIVE with `endedAt` still set. So every verb bumps this\n * token on the CLIENT organization's row inside its own transaction BEFORE reading what it decides on. On MongoDB the\n * second writer hits a write conflict and is retried from a fresh read; on PostgreSQL (READ COMMITTED) it blocks on\n * the row lock until the first commits, and its next read sees the committed state. The same remedy, and the same\n * reasoning, as `ownerFloorSerializationToken` above.\n \n Its own FIELD rather than that token, so each token's meaning stays legible — but both are fields of this one row,\n * and both adapters conflict per row, so an owner-reducing write and a relationship decision on the same tenant DO\n * serialize against each other. That is accepted, not avoided: both are rare, and the loser is retried (MongoDB) or\n * waits (PostgreSQL). A separate lock document would avoid it at the cost of a second thing to keep consistent.\n \n The write also moves the organization's `updatedAt` and version — the repository stamps both on every update, as\n * it already did for the owner-floor token. Accepted as truthful: the row WAS written. A concurrent edit of the\n * organization that carries an If-Match gets the ordinary precondition failure and retries.\n \n Rejected alternatives: a unique index on (organizationId, providerOrganizationId) — it would forbid the pair's\n * HISTORY (terminated relationships stay as access evidence, and a firm may be re-engaged); a partial unique index\n * over the live statuses — not expressible through the field decorators on both adapters; a compare-and-swap on the\n * relationship's own status — it guards one row, while a decision also reads rows it does not write (another\n * relationship, the assignment, the membership); bumping `updatedAt` alone as the collision point — it names a\n * modification rather than a decision, though the write above moves it anyway.\n \n `.nullish()` because a tenant that has never received a proposal has no token. Nothing reads the value; only the\n * write matters.\n /\n serviceProviderRelationshipSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n /\n Serializes every change of which OAuth client runs which autonomous agent in this organization\n * (#1611). The `setAutonomousAgents` operation bumps it inside its own transaction BEFORE counting the\n * clients that already carry a ref, so two binds of the same ref at the same moment cannot both see\n * \"none\" and both commit: on MongoDB the second writer hits a write conflict on this row and is retried;\n * on PostgreSQL (READ COMMITTED) it waits for the row lock, and its count then sees the first binding.\n * The `ownerFloorSerializationToken` remedy, for the same write skew. Its own field so its meaning stays\n * legible. `.nullish()`: a tenant that has never bound an agent has no token. Nothing reads the value.\n /\n autonomousAgentBindingSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n\n /\n When the `organization-purge` batch becomes allowed to destroy this tenant.\n \n ## Why this is stored rather than derived from `deletionRequestedAt` + a configured window\n \n The retention window is a PROMISE made to the tenant at the moment of the mark (\"your data is\n * recoverable until <date>\"). Deriving eligibility as `deletionRequestedAt < now - window`\n * re-evaluates that promise against whatever the configuration says at PURGE time, so lowering\n * the window would retroactively shorten — or immediately expire — every tenant already inside\n * one. Pinning the deadline at mark time makes the commitment immutable, which is the property\n * a data-retention commitment has to have, and it makes a per-tenant legal hold expressible\n * later by moving one field rather than by special-casing the batch predicate.\n \n The `FILES` soft-delete precedent derives its cutoff instead. That is defensible there — an\n * orphaned upload is nobody's commitment — and is precisely why the two should not share one\n * mechanism.\n \n Server-owned: written only by the lifecycle operations that own the state machine, never by a\n * client patch.\n \n `.nullish()` for the same reason as {@link deletionRequestedAt} — `restore` clears it, and a\n * persisted `null` has to survive the next read.\n /\n purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()\n});\n\n\nexport type Organization = z.infer<typeof OrganizationSchema>;\n\n/\n An organization as the frontend holds it for a signed-in member: the organization row plus what\n * session restore fetches beside it.\n \n Every field here has a producer, and that is the rule for adding one. `UserOrgsContext` obtains\n * these with `doOperation<OrganizationContext>`, which is a CAST, not a parse — so a declared field\n * nothing produces compiles and reads `undefined` at runtime with no warning. Until #581 this schema\n * declared five such fields, two of them REQUIRED:\n \n \| removed \| why \|\n * \|---\|---\|\n * \| `planFeatures` (required) \| no producer, no consumer. Scope features have their own resource (`ORGANIZATION_FEATURES`) with its own cache invalidation; read that. \|\n * \| `members` (required) \| no producer, no consumer. It implied the tenant's FULL member list on every organization at session restore; the caller's own memberships already arrive on the USER_SELF context, and a people picker reads `ORGANIZATION_MEMBERS`. \|\n * \| `profile`, `notifications` \| no producer on the default READ session restore uses, no consumer. The ORGANIZATIONS context variant would populate the profile, and it was rejected for session restore (see `UserOrgsContext`). \|\n * \| `displayName`, `logoUrl` \| no producer, no consumer. `displayName` lives on `OrganizationProfileSchema`. \|\n \n `preferences` stays, optional: `loadOrganizations` fetches it from `ORGANIZATION_PREFERENCES` and\n * tolerates its absence (#563).\n */\nexport const OrganizationContextSchema = OrganizationSchema.extend({\n preferences: OrganizationPreferencesSchema.optional(),\n});\n\n\nexport type OrganizationContext = z.infer<typeof OrganizationContextSchema>;\n"]}

package/dist/esm/organizations/service-provider-activity-feed.shared.resources-config.schemas.d.ts ADDED Viewed

@@ -0,0 +1,58 @@
+/**
+ * The firm's expert-activity feed — resource configurations for its two resources (#1632).
+ *
+ * Both live in the PROVIDER organization. Neither has a client-facing write: the settings row changes only through
+ * the firm owner's `enable` / `disable`, and a feed entry is written by the engine at audit time. See
+ * `service-provider-activity-feed.shared.schemas.ts` for the model and why it is metadata only.
+ */
+import { z } from 'zod';
+import { ServiceProviderActivityFeedSettings_Operations } from './service-provider-activity-feed.shared.schemas';
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import { type ResourceRelationship } from '../resources/resources.shared.schemas';
+type ActivityFeedCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE;
+/**
+ * The settings row is a context-addressed SINGLETON (a 1:1 composition of the organization): its READ route is the
+ * collection path itself (`/organizations/{organizationId}/service-provider-activity-feed-setting`). A public LIST would
+ * be mounted on that SAME path and verb, so two handlers would compete for one route. Its LIST is therefore route-less
+ * (INTERNAL_CALL): it exists only because the retention policy's see-through read (`listRetainedAsSystem`) surfaces
+ * retained rows through LIST. There is no COUNT.
+ */
+type ActivityFeedSettingsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE;
+/**
+ * The firm's decision about its feed (#1632). One row per PROVIDER organization, created DISABLED by its first read or
+ * by the first decision.
+ *
+ * READ is open to every member of the firm, deliberately: the people the feed is about are entitled to know whether
+ * their employer collects it (GDPR Art. 13 / 88(2)), and the settings row says nothing about any client.
+ */
+export declare const serviceProviderActivityFeedSettingsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<typeof ServiceProviderActivityFeedSettings_Operations, ActivityFeedSettingsCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./service-provider-activity-feed.shared.schemas").ServiceProviderActivityFeedStatus>>>>>>>;
+    decidedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    decidedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>>;
+    acknowledgedWorkerConsultationNotice: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+/**
+ * The firm's feed entries (#1632). Read by the firm's administrators; written by the engine only.
+ *
+ * An ordinary organization-scoped resource, so the application's own authorization decides which of the firm's
+ * people see it — the framework adds no second rule, and models no ethical wall of its own.
+ */
+export declare const serviceProviderActivityFeedResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, ActivityFeedCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    expertUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    clientOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    relationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    occurredAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
+    operationKind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof CoreResourceOperation>>>>;
+    resourceType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./service-provider-activity-feed.shared.schemas").ServiceProviderActivityOutcome>>>>>;
+    createdAt: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+export {};
+//# sourceMappingURL=service-provider-activity-feed.shared.resources-config.schemas.d.ts.map

package/dist/esm/organizations/service-provider-activity-feed.shared.resources-config.schemas.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"service-provider-activity-feed.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/service-provider-activity-feed.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,8CAA8C,EAC/C,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAYjC;;;;;;GAMG;AACH,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAmBjC;;;;;;GAMG;AACH,eAAO,MAAM,8EAA8E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;kBAuFzI,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,sEAAsE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;kBA0DjI,CAAC"}