@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/organizations/service-provider-relationships.shared.resources-config.schemas.js

@@ -0,0 +1,572 @@
+/**
+ * Service-provider relationships — resource configurations for the three resources (#1597).
+ *
+ * The asymmetry is the design: the CLIENT's verbs are on the relationship (client scope), the FIRM's
+ * verbs are on its engagement mirror (firm scope), and each side's counterpart row is written by the
+ * system inside the same transaction. No verb here declares `admitsCrossTenantPlatformAdministration`:
+ * nobody reaches into the other tenant through a request.
+ *
+ * Every lifecycle verb is HIGH risk, and the two that CONFER — the client accepting a firm's proposal and
+ * the client widening a relationship's scope — demand the client ORG_OWNER plus step-up, because they
+ * hand people outside the organization a membership inside it.
+ *
+ * See `service-provider-relationships.shared.schemas.ts` for the model.
+ */
+import { z } from 'zod';
+import { ServiceEngagementAssignmentSchema, ServiceEngagementAssignmentSettleClientApprovalDtoSchema, ServiceEngagementAssignmentStatus, ServiceProviderExpertAdmissionPolicy, ServiceEngagementAssignments_Operations, ServiceEngagementSchema, ServiceEngagements_Operations, ServiceProviderRelationshipSchema, ServiceProviderRelationshipStatus, ServiceProviderRelationships_Operations, } from './service-provider-relationships.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
+import { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas.js';
+import { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../flows-actors/autonomous-agents.shared.schemas.js';
+import { ServiceProviderActivityFeedDisclosure, ServiceProviderMfaTrust } from './service-provider-client-controls.shared.schemas.js';
+/** A reason one side gives when refusing or ending. Optional everywhere; recorded, erasable. */
+const decisionReasonDto = z.object({ decisionReason: z.string().max(1000).optional() });
+/** The scope a relationship is proposed or amended with. The client decides it; the firm may only propose it. */
+const relationshipScopeDto = {
+    /** One of the provider type's `servesAsProvider.providerRoles`. Absent ⇒ its `defaultProviderRole`. */
+    role: z.string().min(1).optional(),
+    /** Client organization units. Absent or empty ⇒ organization-wide. */
+    organizationUnitIds: z.array(z.string().min(1)).max(100).optional(),
+    /**
+     * When the relationship stops conferring. `null` means "no term" — the framework's merge-patch UPDATE
+     * reading — and is what `amendScope` writes when it clears one.
+     *
+     * `.nullish()`, never `.optional()`: `z.coerce.date().optional()` does not reject `null`, it COERCES it,
+     * and `new Date(null)` is 1970-01-01. The operation's own prefix output is parsed by this DTO, so a
+     * cleared term was stored as a term that ended in 1970 — which the live filter reads as over, ending
+     * the relationship the client meant to make open-ended.
+     */
+    endsAt: z.coerce.date().nullish(),
+};
+/**
+ * The client's choice of how the firm's experts are admitted (#1612). Only ever part of a CLIENT verb's contract —
+ * the firm's verbs do not declare it, so a firm-supplied value is stripped before any implementation sees it.
+ */
+const expertAdmissionPolicyDto = {
+    expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy).optional()
+        .describe('Whether each expert the firm assigns must first be approved by your organization\'s administrators. Absent: your organization type\'s default, else every assigned expert is admitted.'),
+};
+const LIVE = (status) => status === ServiceProviderRelationshipStatus.PROPOSED
+    || status === ServiceProviderRelationshipStatus.ACTIVE
+    || status === ServiceProviderRelationshipStatus.SUSPENDED;
+/**
+ * Route-less plumbing shared by all three resources.
+ *
+ * - `UPDATE_MANY` — the retention writer's verb (`retentionPolicy` requires READ + LIST + UPDATE_MANY).
+ * - `DELETE` — the organization purge cascade's verb ONLY. No client can delete a relationship: the
+ *   terminal statuses are how one ends, and erasing the record would rewrite who could reach a tenant.
+ * - `CREATE` / `UPDATE` — the system door the verbs write COUNTERPART rows through (`createAsSystem` /
+ *   `updateAsSystem` resolve the resource's default CREATE / UPDATE). INTERNAL_CALL registers no route.
+ */
+/* (inlined into each configuration below — contextual typing needs the literal in place) */
+/**
+ * The counterpart write door is a system door, so the policy says so — and says nothing else.
+ *
+ * `read`/`list` are ALLOWED because the execution-context builder reads relationships and assignments on
+ * a system context to decide a caller's authority (the caller is, by construction, not yet authorized).
+ */
+const systemWrites = {
+    read: ResourceSystemAccessMode.ALLOWED,
+    list: ResourceSystemAccessMode.ALLOWED,
+    create: ResourceSystemAccessMode.ALLOWED,
+    update: ResourceSystemAccessMode.ALLOWED,
+    updateMany: ResourceSystemAccessMode.ALLOWED,
+};
+const CORE_OPERATIONS = [
+    CoreResourceOperation.READ,
+    CoreResourceOperation.LIST,
+    CoreResourceOperation.COUNT,
+    CoreResourceOperation.CREATE,
+    CoreResourceOperation.UPDATE,
+    CoreResourceOperation.UPDATE_MANY,
+    CoreResourceOperation.DELETE,
+];
+/** Retained on erasure: who could reach which tenant, when and under what scope is the record; the prose is scrubbed. */
+const RETAIN = { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE };
+/**
+ * How long each of the three records lives (#1613): the AUDIT_LOGS class, from the moment the record ENDS.
+ *
+ * They are the evidence of who from outside could reach a tenant, and when — the question an access
+ * review or an incident asks years later — so they are kept for the audit trail's own period rather than
+ * the ordinary resource-data one. While a relationship or an assignment is live its `endedAt` is null and
+ * the row never expires; the clock starts only when it ends.
+ */
+const KEPT_AS_ACCESS_EVIDENCE = {
+    retentionClass: DataRetentionClass.AUDIT_LOGS,
+    startPoint: RetentionStartPoint.CLOSURE_EVENT,
+    closureFieldName: 'endedAt',
+};
+export const serviceProviderRelationshipsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: ServiceProviderRelationshipSchema,
+    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: systemWrites,
+    retentionPolicy: RETAIN,
+    retentionBinding: KEPT_AS_ACCESS_EVIDENCE,
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: CORE_OPERATIONS,
+    operationsConfiguration: {
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.COUNT]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        /**
+         * The client proposes a relationship to a firm. The proposal IS the client owner's consent, so the
+         * firm's acceptance activates it — ORG_OWNER plus step-up, like the acceptance of a firm's proposal.
+         *
+         * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING — a third party's access to the tenant
+         * begins only with the tenant owner's declared consent.
+         */
+        [ServiceProviderRelationships_Operations.PROPOSE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requiresStepUpAuthentication: true,
+                    requestDto: z.object({
+                        providerOrganizationId: z.string().min(1),
+                        purpose: z.string().min(1).max(1000),
+                        ...relationshipScopeDto,
+                        ...expertAdmissionPolicyDto,
+                    }),
+                }],
+        },
+        /**
+         * The client owner accepts a FIRM's proposal. The implementation refuses a relationship the client itself proposed.
+         * The owner may choose here whether each expert must be approved (#1612); absent keeps the proposal's default.
+         */
+        [ServiceProviderRelationships_Operations.ACCEPT]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requiresStepUpAuthentication: true,
+                    requestDto: decisionReasonDto.extend(expertAdmissionPolicyDto),
+                    enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.PROPOSED,
+                }],
+        },
+        [ServiceProviderRelationships_Operations.DECLINE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: decisionReasonDto,
+                    enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.PROPOSED,
+                }],
+        },
+        [ServiceProviderRelationships_Operations.SUSPEND]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: decisionReasonDto,
+                    enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.ACTIVE,
+                }],
+        },
+        [ServiceProviderRelationships_Operations.RESUME]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: decisionReasonDto,
+                    enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.SUSPENDED,
+                }],
+        },
+        /** The client ends a live relationship — its own proposal included. Takes effect on the next request. */
+        [ServiceProviderRelationships_Operations.TERMINATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: decisionReasonDto,
+                    enabledCondition: ({ currentObject }) => LIVE(currentObject.status),
+                }],
+        },
+        /** Role, units, term. Only the client, only its owner, with step-up — the firm cannot widen what the client granted. */
+        [ServiceProviderRelationships_Operations.AMEND_SCOPE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requiresStepUpAuthentication: true,
+                    requestDto: z.object({
+                        ...relationshipScopeDto,
+                        /** Explicitly clear a term (open-ended) — distinct from "leave it as it is". `endsAt: null` means the same. */
+                        clearEndsAt: z.boolean().optional()
+                            .describe('`true` removes the end date, so the relationship runs until someone ends it. Sending `endsAt: null` does the same. Omitted or `false`: the end date is set by `endsAt`, or left as it is.'),
+                        /** Explicitly widen to organization-wide — distinct from "leave the units as they are". */
+                        clearOrganizationUnitIds: z.boolean().optional()
+                            .describe('`true` removes the unit restriction, so the firm\'s experts reach the whole organization. Omitted or `false`: the units are set by `organizationUnitIds`, or left as they are.'),
+                    }),
+                    enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.ACTIVE
+                        || currentObject.status === ServiceProviderRelationshipStatus.SUSPENDED,
+                }],
+        },
+        /**
+         * Admit a firm's client, or change what an admitted one may do. `autonomousAgentRefs` is the client's
+         * choice of the firm's autonomous agents that may run here (#1611) and REPLACES the client's previous
+         * choice; omitted means none. Re-admitting an admitted client with a new list is how that choice changes.
+         */
+        [ServiceProviderRelationships_Operations.ADMIT_MACHINE_CLIENT]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        oauthClientId: z.string().min(1)
+                            .describe('The firm\'s machine client to admit: an active OAuth client owned by the firm\'s organization. Any other client is refused.'),
+                        autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX).optional()
+                            .describe("The firm's autonomous agents this client may run in your organization, under this relationship's role and on your organization's budget. Replaces any earlier choice; omit it to allow none."),
+                    }),
+                    enabledCondition: ({ currentObject }) => LIVE(currentObject.status),
+                }],
+        },
+        [ServiceProviderRelationships_Operations.REMOVE_MACHINE_CLIENT]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        oauthClientId: z.string().min(1)
+                            .describe('The firm\'s machine client to remove. It can no longer act in your organization, and your choice of its autonomous agents is dropped.'),
+                    }),
+                }],
+        },
+        /**
+         * Change whether each assigned expert waits for this organization's approval (#1612). A client administrator's
+         * verb, on a live relationship; not retroactive — experts already admitted keep their membership, and pending
+         * approvals stay pending. The firm has no counterpart verb.
+         */
+        [ServiceProviderRelationships_Operations.SET_EXPERT_ADMISSION_POLICY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({ expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy) }),
+                    enabledCondition: ({ currentObject }) => LIVE(currentObject.status),
+                }],
+        },
+        /**
+         * Decide whether the firm's own identity provider's MFA counts in this organization (#1633). The owner's verb,
+         * with step-up: trusting it lets a proof made elsewhere satisfy this organization's authentication policy for
+         * the firm's experts. The organization type's minimum strength still applies either way.
+         */
+        [ServiceProviderRelationships_Operations.SET_PROVIDER_MFA_TRUST]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requiresStepUpAuthentication: true,
+                    requestDto: z.object({ providerMfaTrust: z.enum(ServiceProviderMfaTrust) }),
+                    enabledCondition: ({ currentObject }) => LIVE(currentObject.status),
+                }],
+        },
+        /**
+         * Decide how much the firm's expert-activity feed may say about work done here (#1632). A client administrator's
+         * verb; it takes effect on the expert's next action. It can only narrow what the firm learns — at every level the
+         * feed carries metadata, never this organization's content.
+         */
+        [ServiceProviderRelationships_Operations.SET_ACTIVITY_FEED_DISCLOSURE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({ activityFeedDisclosure: z.enum(ServiceProviderActivityFeedDisclosure) }),
+                    enabledCondition: ({ currentObject }) => LIVE(currentObject.status),
+                }],
+        },
+        /**
+         * ACTIVE or SUSPENDED → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only.
+         * Bookkeeping: admission already stopped at `endsAt`. Empty request contract by design — the
+         * implementation owns the transition, and an operation without a `requestDto` would advertise the
+         * resource's whole update contract.
+         */
+        [ServiceProviderRelationships_Operations.EXPIRE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                }],
+        },
+    },
+});
+export const serviceEngagementsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: ServiceEngagementSchema,
+    resourceIdentifier: CoreResourceType.SERVICE_ENGAGEMENTS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_ENGAGEMENTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: systemWrites,
+    retentionPolicy: RETAIN,
+    retentionBinding: KEPT_AS_ACCESS_EVIDENCE,
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: CORE_OPERATIONS,
+    operationsConfiguration: {
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.COUNT]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        /** The firm proposes a relationship to a client. Nothing is conferred until the client owner accepts. */
+        [ServiceEngagements_Operations.PROPOSE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requestDto: z.object({
+                        clientOrganizationId: z.string().min(1),
+                        purpose: z.string().min(1).max(1000),
+                        ...relationshipScopeDto,
+                        // Described HERE rather than on `relationshipScopeDto`: the relationship's own verbs take their
+                        // description from the relationship's field specification, and a `.describe()` on the shared
+                        // DTO would override it. The engagement has no such field, so its proposal needed its own words.
+                        organizationUnitIds: relationshipScopeDto.organizationUnitIds
+                            .describe('The client organization\'s units your experts would be confined to, by their ids in the client\'s tenant. Absent or empty: the whole client organization. The client sees this scope when deciding, and may change it later.'),
+                    }),
+                }],
+        },
+        /** The firm accepts a CLIENT's proposal — the client owner's consent is the proposal itself. */
+        [ServiceEngagements_Operations.ACCEPT]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: decisionReasonDto,
+                    enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.PROPOSED,
+                }],
+        },
+        /** The firm ends a live relationship, or withdraws its own proposal. */
+        [ServiceEngagements_Operations.WITHDRAW]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: decisionReasonDto,
+                    enabledCondition: ({ currentObject }) => LIVE(currentObject.status),
+                }],
+        },
+    },
+});
+export const serviceEngagementAssignmentsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: ServiceEngagementAssignmentSchema,
+    resourceIdentifier: CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: {
+        ...systemWrites,
+        /**
+         * `userId` is a foreign key to USERS, so these rows are on a person's subject-export graph. ALLOWED:
+         * which clients a person was assigned to serve is a fact about their own work, not a monitoring
+         * record about them, and it names nobody else.
+         */
+        exportSubject: ResourceSystemAccessMode.ALLOWED,
+    },
+    /**
+     * RETAIN_ONLY: an assignment holds no personal text of its own — ids, a status and timestamps — so
+     * there is nothing an erasure could scrub, and claiming RETAIN_AND_IMPERSONALIZE would describe a
+     * scrub that never happens. Kept whole as evidence of who served which client, when.
+     */
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },
+    retentionBinding: KEPT_AS_ACCESS_EVIDENCE,
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: CORE_OPERATIONS,
+    operationsConfiguration: {
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.COUNT]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        /** The firm designates one of its ACTIVE members to serve an ACTIVE engagement. */
+        [ServiceEngagementAssignments_Operations.ASSIGN]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requestDto: z.object({
+                        serviceEngagementId: z.string().min(1),
+                        userId: z.string().min(1),
+                    }),
+                }],
+        },
+        /** Ends an ACTIVE assignment, or withdraws one still waiting for the client's approval (#1612). */
+        [ServiceEngagementAssignments_Operations.UNASSIGN]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                    enabledCondition: ({ currentObject }) => currentObject.status === ServiceEngagementAssignmentStatus.ACTIVE
+                        || currentObject.status === ServiceEngagementAssignmentStatus.PENDING_CLIENT_APPROVAL,
+                }],
+        },
+        /**
+         * Apply the client's answer to a per-expert approval (#1612). INTERNAL_CALL: it registers no route, and is
+         * reached only from the human-decision answer path after that path authorized the answerer as one of the
+         * client's administrators. The input names the decision it settles; the write matches on it.
+         */
+        [ServiceEngagementAssignments_Operations.SETTLE_CLIENT_APPROVAL]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: ServiceEngagementAssignmentSettleClientApprovalDtoSchema,
+                }],
+        },
+    },
+});
+//# sourceMappingURL=service-provider-relationships.shared.resources-config.schemas.js.map