@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/organizations/service-provider-activity-feed.shared.resources-config.schemas.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The firm's expert-activity feed — resource configurations for its two resources (#1632).
+ *
+ * Both live in the PROVIDER organization. Neither has a client-facing write: the settings row changes only through
+ * the firm owner's `enable` / `disable`, and a feed entry is written by the engine at audit time. See
+ * `service-provider-activity-feed.shared.schemas.ts` for the model and why it is metadata only.
+ */
+import { z } from 'zod';
+import { ServiceProviderActivityFeedSettings_Operations } from './service-provider-activity-feed.shared.schemas';
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import { type ResourceRelationship } from '../resources/resources.shared.schemas';
+type ActivityFeedCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE;
+/**
+ * The settings row is a context-addressed SINGLETON (a 1:1 composition of the organization): its READ route is the
+ * collection path itself (`/organizations/{organizationId}/service-provider-activity-feed-setting`). A public LIST would
+ * be mounted on that SAME path and verb, so two handlers would compete for one route. Its LIST is therefore route-less
+ * (INTERNAL_CALL): it exists only because the retention policy's see-through read (`listRetainedAsSystem`) surfaces
+ * retained rows through LIST. There is no COUNT.
+ */
+type ActivityFeedSettingsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE;
+/**
+ * The firm's decision about its feed (#1632). One row per PROVIDER organization, created DISABLED by its first read or
+ * by the first decision.
+ *
+ * READ is open to every member of the firm, deliberately: the people the feed is about are entitled to know whether
+ * their employer collects it (GDPR Art. 13 / 88(2)), and the settings row says nothing about any client.
+ */
+export declare const serviceProviderActivityFeedSettingsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<typeof ServiceProviderActivityFeedSettings_Operations, ActivityFeedSettingsCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./service-provider-activity-feed.shared.schemas").ServiceProviderActivityFeedStatus>>>>>>>;
+    decidedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    decidedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>>;
+    acknowledgedWorkerConsultationNotice: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+/**
+ * The firm's feed entries (#1632). Read by the firm's administrators; written by the engine only.
+ *
+ * An ordinary organization-scoped resource, so the application's own authorization decides which of the firm's
+ * people see it — the framework adds no second rule, and models no ethical wall of its own.
+ */
+export declare const serviceProviderActivityFeedResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, ActivityFeedCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    expertUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    clientOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    relationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    occurredAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
+    operationKind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof CoreResourceOperation>>>>;
+    resourceType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./service-provider-activity-feed.shared.schemas").ServiceProviderActivityOutcome>>>>>;
+    createdAt: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+export {};
+//# sourceMappingURL=service-provider-activity-feed.shared.resources-config.schemas.d.ts.map

package/dist/esm/organizations/service-provider-activity-feed.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-activity-feed.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-activity-feed.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,8CAA8C,EAC/C,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAYjC;;;;;;GAMG;AACH,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAmBjC;;;;;;GAMG;AACH,eAAO,MAAM,8EAA8E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;kBAuFzI,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,sEAAsE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;kBA0DjI,CAAC"}

package/dist/esm/organizations/service-provider-activity-feed.shared.resources-config.schemas.js

@@ -0,0 +1,188 @@
+/**
+ * The firm's expert-activity feed — resource configurations for its two resources (#1632).
+ *
+ * Both live in the PROVIDER organization. Neither has a client-facing write: the settings row changes only through
+ * the firm owner's `enable` / `disable`, and a feed entry is written by the engine at audit time. See
+ * `service-provider-activity-feed.shared.schemas.ts` for the model and why it is metadata only.
+ */
+import { z } from 'zod';
+import { ServiceProviderActivityFeedEntrySchema, ServiceProviderActivityFeedSettingsSchema, ServiceProviderActivityFeedSettings_Operations, } from './service-provider-activity-feed.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
+import { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas.js';
+const CORE_OPERATIONS = [
+    CoreResourceOperation.READ,
+    CoreResourceOperation.LIST,
+    CoreResourceOperation.COUNT,
+    CoreResourceOperation.CREATE,
+    CoreResourceOperation.UPDATE,
+    CoreResourceOperation.UPDATE_MANY,
+    CoreResourceOperation.DELETE,
+];
+const SETTINGS_CORE_OPERATIONS = [
+    CoreResourceOperation.READ,
+    CoreResourceOperation.LIST,
+    CoreResourceOperation.CREATE,
+    CoreResourceOperation.UPDATE,
+    CoreResourceOperation.UPDATE_MANY,
+    CoreResourceOperation.DELETE,
+];
+/*
+ * Both resources carry the same route-less plumbing, INLINED in each configuration because contextual typing needs
+ * the literal in place (the relationship configurations record the same constraint): the SYSTEM door the engine
+ * writes through (`createAsSystem` / `updateAsSystem` resolve the default CREATE / UPDATE), the retention writer's
+ * UPDATE_MANY, and the DELETE the organization purge cascade and the retention sweep use. INTERNAL_CALL registers no
+ * route.
+ */
+/**
+ * The firm's decision about its feed (#1632). One row per PROVIDER organization, created DISABLED by its first read or
+ * by the first decision.
+ *
+ * READ is open to every member of the firm, deliberately: the people the feed is about are entitled to know whether
+ * their employer collects it (GDPR Art. 13 / 88(2)), and the settings row says nothing about any client.
+ */
+export const serviceProviderActivityFeedSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: ServiceProviderActivityFeedSettingsSchema,
+    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /** The feed writer reads the firm's decision on a system context at audit time; the verbs upsert it as system. */
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+        updateMany: ResourceSystemAccessMode.ALLOWED,
+    },
+    /** The row holds ids, a status and timestamps — nothing an erasure could scrub. Kept as the record of the decision. */
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },
+    /*
+     * NO retention binding, deliberately: this row is the firm's LIVE configuration, not a record, and it lives as long as
+     * the organization (purged with it). A binding counted from its last change would delete an ENABLED decision nobody
+     * changed for the audit-log period, and the feed would stop silently; its next read would then materialize DISABLED.
+     * The evidence of each decision is the SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED audit event, which lives under the
+     * audit trail's own retention. The startup gap report lists it as kept until erased, which is what it is.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: SETTINGS_CORE_OPERATIONS,
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        /**
+         * READ of a firm that never decided materializes its row, DISABLED and with no decision recorded (the backend's
+         * READ postfix), so the settings page always has one row to show and to act on.
+         */
+        /**
+         * Switch the feed on. The firm owner's verb, with step-up, and refused unless the person confirms they were
+         * shown that works-council or CSE consultation and employee notice may be required first. Creates the row if the
+         * firm never read it.
+         */
+        [ServiceProviderActivityFeedSettings_Operations.ENABLE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requiresStepUpAuthentication: true,
+                    requestDto: z.object({
+                        acknowledgedWorkerConsultationNotice: z.boolean()
+                            .describe('Confirms you were told that switching on activity monitoring of your staff may require consulting your works council or CSE and informing employees first.'),
+                    }),
+                }],
+        },
+        /** Switch the feed off. Entries already written stay until their retention ends. */
+        [ServiceProviderActivityFeedSettings_Operations.DISABLE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requestDto: z.object({}),
+                }],
+        },
+    },
+});
+/**
+ * The firm's feed entries (#1632). Read by the firm's administrators; written by the engine only.
+ *
+ * An ordinary organization-scoped resource, so the application's own authorization decides which of the firm's
+ * people see it — the framework adds no second rule, and models no ethical wall of its own.
+ */
+export const serviceProviderActivityFeedResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: ServiceProviderActivityFeedEntrySchema,
+    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+        updateMany: ResourceSystemAccessMode.ALLOWED,
+        /**
+         * `expertUserId` is a foreign key to USERS, so these rows are on the expert's subject-export graph. ALLOWED: this
+         * is monitoring data ABOUT that person, which is exactly what their right of access reaches (GDPR Art. 15), and
+         * it names no client content.
+         */
+        exportSubject: ResourceSystemAccessMode.ALLOWED,
+    },
+    /**
+     * RETAIN_ONLY: an entry is ids, two types, a timestamp and an outcome — nothing an erasure could scrub. Frozen
+     * and hidden on the expert's erasure, and gone when its retention ends.
+     */
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },
+    /**
+     * OPERATIONAL_LOGS from creation: monitoring data is kept for the SHORTEST period the application declares. The
+     * detailed evidence of what happened stays in the client's own audit trail, under the client's retention.
+     */
+    retentionBinding: { retentionClass: DataRetentionClass.OPERATIONAL_LOGS, startPoint: RetentionStartPoint.CREATED },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: CORE_OPERATIONS,
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.COUNT]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+    },
+});
+//# sourceMappingURL=service-provider-activity-feed.shared.resources-config.schemas.js.map

package/dist/esm/organizations/service-provider-activity-feed.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-activity-feed.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-activity-feed.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sCAAsC,EACtC,yCAAyC,EACzC,8CAA8C,GAC/C,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAWlH,MAAM,eAAe,GAAiC;IACpD,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAiBF,MAAM,wBAAwB,GAAyC;IACrE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8EAA8E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC/I,0CAA0C,CAIxC;IACA,UAAU,EAAE,yCAAyC;IACrD,kBAAkB,EAAE,gBAAgB,CAAC,uCAAuC;IAC5E,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,uCAAuC,CAAC;IACrH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kHAAkH;IAClH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;KAC7C;IACD,uHAAuH;IACvH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;;;;OAMG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,wBAAwB;IACxC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnK;QAED;;;WAGG;QAEH;;;;WAIG;QACH,CAAC,8CAA8C,CAAC,MAAM,CAAC,EAAE;YACvD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE;6BAC9C,QAAQ,CAAC,4JAA4J,CAAC;qBAC1K,CAAC;iBACH,CAAC;SACH;QAED,oFAAoF;QACpF,CAAC,8CAA8C,CAAC,OAAO,CAAC,EAAE;YACxD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sEAAsE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACvI,0CAA0C,CAIxC;IACA,UAAU,EAAE,sCAAsC;IAClD,kBAAkB,EAAE,gBAAgB,CAAC,8BAA8B;IACnE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IAC5G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;QAC5C;;;;WAIG;QACH,aAAa,EAAE,wBAAwB,CAAC,OAAO;KAChD;IACD;;;OAGG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;OAGG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAClH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * The firm's expert-activity feed — resource configurations for its two resources (#1632).\n *\n * Both live in the PROVIDER organization. Neither has a client-facing write: the settings row changes only through\n * the firm owner's `enable` / `disable`, and a feed entry is written by the engine at audit time. See\n * `service-provider-activity-feed.shared.schemas.ts` for the model and why it is metadata only.\n */\n\nimport { z } from 'zod';\nimport {\n  ServiceProviderActivityFeedEntrySchema,\n  ServiceProviderActivityFeedSettingsSchema,\n  ServiceProviderActivityFeedSettings_Operations,\n} from './service-provider-activity-feed.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\n\ntype ActivityFeedCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\nconst CORE_OPERATIONS: ActivityFeedCoreOperations[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.COUNT,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE,\n];\n\n/**\n * The settings row is a context-addressed SINGLETON (a 1:1 composition of the organization): its READ route is the\n * collection path itself (`/organizations/{organizationId}/service-provider-activity-feed-setting`). A public LIST would\n * be mounted on that SAME path and verb, so two handlers would compete for one route. Its LIST is therefore route-less\n * (INTERNAL_CALL): it exists only because the retention policy's see-through read (`listRetainedAsSystem`) surfaces\n * retained rows through LIST. There is no COUNT.\n */\ntype ActivityFeedSettingsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\nconst SETTINGS_CORE_OPERATIONS: ActivityFeedSettingsCoreOperations[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE,\n];\n\n/*\n * Both resources carry the same route-less plumbing, INLINED in each configuration because contextual typing needs\n * the literal in place (the relationship configurations record the same constraint): the SYSTEM door the engine\n * writes through (`createAsSystem` / `updateAsSystem` resolve the default CREATE / UPDATE), the retention writer's\n * UPDATE_MANY, and the DELETE the organization purge cascade and the retention sweep use. INTERNAL_CALL registers no\n * route.\n */\n\n/**\n * The firm's decision about its feed (#1632). One row per PROVIDER organization, created DISABLED by its first read or\n * by the first decision.\n *\n * READ is open to every member of the firm, deliberately: the people the feed is about are entitled to know whether\n * their employer collects it (GDPR Art. 13 / 88(2)), and the settings row says nothing about any client.\n */\nexport const serviceProviderActivityFeedSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceProviderActivityFeedSettings_Operations,\n    ActivityFeedSettingsCoreOperations,\n    typeof ServiceProviderActivityFeedSettingsSchema\n  >({\n    mainSchema: ServiceProviderActivityFeedSettingsSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    /** The feed writer reads the firm's decision on a system context at audit time; the verbs upsert it as system. */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n      updateMany: ResourceSystemAccessMode.ALLOWED,\n    },\n    /** The row holds ids, a status and timestamps — nothing an erasure could scrub. Kept as the record of the decision. */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n    /*\n     * NO retention binding, deliberately: this row is the firm's LIVE configuration, not a record, and it lives as long as\n     * the organization (purged with it). A binding counted from its last change would delete an ENABLED decision nobody\n     * changed for the audit-log period, and the feed would stop silently; its next read would then materialize DISABLED.\n     * The evidence of each decision is the SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED audit event, which lives under the\n     * audit trail's own retention. The startup gap report lists it as kept until erased, which is what it is.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: SETTINGS_CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /**\n       * READ of a firm that never decided materializes its row, DISABLED and with no decision recorded (the backend's\n       * READ postfix), so the settings page always has one row to show and to act on.\n       */\n\n      /**\n       * Switch the feed on. The firm owner's verb, with step-up, and refused unless the person confirms they were\n       * shown that works-council or CSE consultation and employee notice may be required first. Creates the row if the\n       * firm never read it.\n       */\n      [ServiceProviderActivityFeedSettings_Operations.ENABLE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requiresStepUpAuthentication: true,\n          requestDto: z.object({\n            acknowledgedWorkerConsultationNotice: z.boolean()\n              .describe('Confirms you were told that switching on activity monitoring of your staff may require consulting your works council or CSE and informing employees first.'),\n          }),\n        }],\n      },\n\n      /** Switch the feed off. Entries already written stay until their retention ends. */\n      [ServiceProviderActivityFeedSettings_Operations.DISABLE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: z.object({}),\n        }],\n      },\n    },\n  });\n\n/**\n * The firm's feed entries (#1632). Read by the firm's administrators; written by the engine only.\n *\n * An ordinary organization-scoped resource, so the application's own authorization decides which of the firm's\n * people see it — the framework adds no second rule, and models no ethical wall of its own.\n */\nexport const serviceProviderActivityFeedResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    undefined,\n    ActivityFeedCoreOperations,\n    typeof ServiceProviderActivityFeedEntrySchema\n  >({\n    mainSchema: ServiceProviderActivityFeedEntrySchema,\n    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      updateMany: ResourceSystemAccessMode.ALLOWED,\n      /**\n       * `expertUserId` is a foreign key to USERS, so these rows are on the expert's subject-export graph. ALLOWED: this\n       * is monitoring data ABOUT that person, which is exactly what their right of access reaches (GDPR Art. 15), and\n       * it names no client content.\n       */\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n    },\n    /**\n     * RETAIN_ONLY: an entry is ids, two types, a timestamp and an outcome — nothing an erasure could scrub. Frozen\n     * and hidden on the expert's erasure, and gone when its retention ends.\n     */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n    /**\n     * OPERATIONAL_LOGS from creation: monitoring data is kept for the SHORTEST period the application declares. The\n     * detailed evidence of what happened stays in the client's own audit trail, under the client's retention.\n     */\n    retentionBinding: { retentionClass: DataRetentionClass.OPERATIONAL_LOGS, startPoint: RetentionStartPoint.CREATED },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n    },\n  });\n"]}

package/dist/esm/organizations/service-provider-activity-feed.shared.schemas.d.ts

@@ -0,0 +1,122 @@
+/**
+ * The firm's EXPERT-ACTIVITY FEED (#1632): an opt-in, metadata-only record, in the PROVIDER organization, of what its
+ * own experts did inside client organizations.
+ *
+ * ## Why it exists, and why it is shaped this way
+ *
+ * Under #1597 an expert's actions are recorded in the CLIENT's audit trail, attributed to the relationship. The firm is
+ * accountable for its staff and runs on operating metrics, and it cannot read that trail: it is another tenant's. The
+ * field's answer is the shape Microsoft Partner Center gives a partner — an activity log of its own delegated actions
+ * (date, affected customer, action, partner user) while the detailed in-tenant trail stays in the customer's tenant.
+ *
+ * Three constraints decide everything below:
+ *
+ * - **No client content, ever.** A firm acting for a client acts on the client's documented instructions (GDPR
+ *   Art. 28(3)(a)); a firm-wide view of client content would make the firm decide purposes of its own over that data
+ *   (Art. 28(10)). So an entry carries operation TYPES, resource TYPES, ids of the parties — never a record id, a
+ *   field value, free text or a payload. {@link ServiceProviderActivityFeedEntryContentSchema} is STRICT so a new
+ *   field is a deliberate schema change rather than a spread.
+ * - **It is worker monitoring.** Collecting it is the FIRM's decision, recorded with who, when, and the fact that it
+ *   was told consultation may be owed (BetrVG §87(1) no. 6; the CNIL's CSE consultation). The framework RECORDS the
+ *   decision and does not judge its lawfulness. Off by default, with no row needed for "off".
+ * - **The client can narrow or stop it** for its own tenant, per relationship
+ *   (`ServiceProviderRelationship.activityFeedDisclosure`). An entry is written only when both sides allow it.
+ *
+ * Entries are written by the engine at AUDIT time, from the same attribution the audit writer already resolves for
+ * the client's own row — never through a client-facing verb.
+ */
+import { z } from 'zod';
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+/** @wildo_source:part:start saas.models.organizations.service-provider-activity-feed facet:layer:shared facet:audience:app-developer */
+/**
+ * Whether the FIRM collects activity metadata about its own experts' work in client organizations (#1632).
+ *
+ * The absence of a settings row means {@link DISABLED}: switching the feed on is a recorded decision, and switching it
+ * off again is one too.
+ */
+export declare enum ServiceProviderActivityFeedStatus {
+    /** No feed entry is written, whatever a client allows. The default. */
+    DISABLED = "DISABLED",
+    /** Entries are written for every client whose relationship's disclosure level is not `NONE`. */
+    ENABLED = "ENABLED"
+}
+/**
+ * How an expert's operation in a client ended, as the firm's feed may say it (#1632).
+ *
+ * Its own vocabulary rather than the SIEM envelope's success/failure: this is what the FIRM is told about an act
+ * performed elsewhere, and a client at `OPERATION_TYPE_ONLY` withholds it entirely.
+ */
+export declare enum ServiceProviderActivityOutcome {
+    /** The operation took effect in the client organization. */
+    SUCCEEDED = "SUCCEEDED",
+    /** The client organization refused the operation (authorization, a policy gate). Nothing took effect. */
+    REFUSED = "REFUSED"
+}
+/**
+ * The firm's decision about its feed. One row per PROVIDER organization: a singleton the backend creates, DISABLED and
+ * with no decision recorded, the first time the firm reads it or decides. An absent row still reads as
+ * {@link ServiceProviderActivityFeedStatus.DISABLED}, which is what the feed writer relies on.
+ */
+export declare const ServiceProviderActivityFeedSettingsSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceProviderActivityFeedStatus>>>>>>>;
+    decidedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    decidedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>>;
+    acknowledgedWorkerConsultationNotice: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>;
+export type ServiceProviderActivityFeedSettings = z.infer<typeof ServiceProviderActivityFeedSettingsSchema>;
+/**
+ * EVERYTHING a feed entry may say, and nothing else (#1632). Strict: an unknown key is refused, so widening what the
+ * firm learns about client work is a deliberate change to this schema — never a spread of a richer object.
+ *
+ * Deliberately absent: the record id, field names or values, the request payload, free text, and anything the
+ * client's own trail marks `.isAuditEvidence()`.
+ */
+export declare const ServiceProviderActivityFeedEntryContentSchema: z.ZodObject<{
+    /** The PROVIDER organization — the firm the entry is written to. */
+    organizationId: z.ZodString;
+    /** The firm's expert who acted. */
+    expertUserId: z.ZodString;
+    /** The CLIENT organization the expert acted in. A plain id: the firm cannot read the client's row. */
+    clientOrganizationId: z.ZodString;
+    /** The relationship the expert acted through. */
+    relationshipId: z.ZodString;
+    occurredAt: z.ZodDate;
+    /** The operation TYPE (e.g. UPDATE), never which record. */
+    operationKind: z.ZodEnum<typeof CoreResourceOperation>;
+    /** The resource TYPE the operation was on. */
+    resourceType: z.ZodString;
+    /** Present only when the client's disclosure level is `OPERATION_AND_OUTCOME`. */
+    outcome: z.ZodOptional<z.ZodEnum<typeof ServiceProviderActivityOutcome>>;
+}, z.core.$strict>;
+export type ServiceProviderActivityFeedEntryContent = z.infer<typeof ServiceProviderActivityFeedEntryContentSchema>;
+/**
+ * One feed entry as stored in the PROVIDER organization: the strict content plus the row's own identity. Written by
+ * the engine only; no client-facing verb creates, changes or deletes one.
+ */
+export declare const ServiceProviderActivityFeedEntrySchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    expertUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    clientOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    relationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    occurredAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>;
+    operationKind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof CoreResourceOperation>>>>;
+    resourceType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceProviderActivityOutcome>>>>>;
+    createdAt: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>;
+export type ServiceProviderActivityFeedEntry = z.infer<typeof ServiceProviderActivityFeedEntrySchema>;
+/** The firm's two decisions about its feed. */
+export declare enum ServiceProviderActivityFeedSettings_Operations {
+    /** Firm ORG_OWNER switches the feed on (step-up). Refused unless the consultation notice was acknowledged. */
+    ENABLE = "enable",
+    /** Firm ORG_OWNER switches the feed off. Entries already written stay until their retention ends. */
+    DISABLE = "disable"
+}
+/** @wildo_source:part:end saas.models.organizations.service-provider-activity-feed */
+//# sourceMappingURL=service-provider-activity-feed.shared.schemas.d.ts.map

package/dist/esm/organizations/service-provider-activity-feed.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-activity-feed.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-activity-feed.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,wIAAwI;AACxI;;;;;GAKG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,QAAQ,aAAa;IACrB,gGAAgG;IAChG,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH,oBAAY,8BAA8B;IACxC,4DAA4D;IAC5D,SAAS,cAAc;IACvB,yGAAyG;IACzG,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yCAAyC;;;;;;;;;iBAuBpD,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;GAMG;AACH,eAAO,MAAM,6CAA6C;IACxD,oEAAoE;;IAEpE,mCAAmC;;IAEnC,sGAAsG;;IAEtG,iDAAiD;;;IAGjD,4DAA4D;;IAE5D,8CAA8C;;IAE9C,kFAAkF;;kBAElF,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AAEpH;;;GAGG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;iBAYjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,+CAA+C;AAC/C,oBAAY,8CAA8C;IACxD,8GAA8G;IAC9G,MAAM,WAAW;IACjB,qGAAqG;IACrG,OAAO,YAAY;CACpB;AACD,sFAAsF"}

package/dist/esm/organizations/service-provider-activity-feed.shared.schemas.js

@@ -0,0 +1,136 @@
+/**
+ * The firm's EXPERT-ACTIVITY FEED (#1632): an opt-in, metadata-only record, in the PROVIDER organization, of what its
+ * own experts did inside client organizations.
+ *
+ * ## Why it exists, and why it is shaped this way
+ *
+ * Under #1597 an expert's actions are recorded in the CLIENT's audit trail, attributed to the relationship. The firm is
+ * accountable for its staff and runs on operating metrics, and it cannot read that trail: it is another tenant's. The
+ * field's answer is the shape Microsoft Partner Center gives a partner — an activity log of its own delegated actions
+ * (date, affected customer, action, partner user) while the detailed in-tenant trail stays in the customer's tenant.
+ *
+ * Three constraints decide everything below:
+ *
+ * - **No client content, ever.** A firm acting for a client acts on the client's documented instructions (GDPR
+ *   Art. 28(3)(a)); a firm-wide view of client content would make the firm decide purposes of its own over that data
+ *   (Art. 28(10)). So an entry carries operation TYPES, resource TYPES, ids of the parties — never a record id, a
+ *   field value, free text or a payload. {@link ServiceProviderActivityFeedEntryContentSchema} is STRICT so a new
+ *   field is a deliberate schema change rather than a spread.
+ * - **It is worker monitoring.** Collecting it is the FIRM's decision, recorded with who, when, and the fact that it
+ *   was told consultation may be owed (BetrVG §87(1) no. 6; the CNIL's CSE consultation). The framework RECORDS the
+ *   decision and does not judge its lawfulness. Off by default, with no row needed for "off".
+ * - **The client can narrow or stop it** for its own tenant, per relationship
+ *   (`ServiceProviderRelationship.activityFeedDisclosure`). An entry is written only when both sides allow it.
+ *
+ * Entries are written by the engine at AUDIT time, from the same attribution the audit writer already resolves for
+ * the client's own row — never through a client-facing verb.
+ */
+import { z } from 'zod';
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions.js';
+/** @wildo_source:part:start saas.models.organizations.service-provider-activity-feed facet:layer:shared facet:audience:app-developer */
+/**
+ * Whether the FIRM collects activity metadata about its own experts' work in client organizations (#1632).
+ *
+ * The absence of a settings row means {@link DISABLED}: switching the feed on is a recorded decision, and switching it
+ * off again is one too.
+ */
+export var ServiceProviderActivityFeedStatus;
+(function (ServiceProviderActivityFeedStatus) {
+    /** No feed entry is written, whatever a client allows. The default. */
+    ServiceProviderActivityFeedStatus["DISABLED"] = "DISABLED";
+    /** Entries are written for every client whose relationship's disclosure level is not `NONE`. */
+    ServiceProviderActivityFeedStatus["ENABLED"] = "ENABLED";
+})(ServiceProviderActivityFeedStatus || (ServiceProviderActivityFeedStatus = {}));
+/**
+ * How an expert's operation in a client ended, as the firm's feed may say it (#1632).
+ *
+ * Its own vocabulary rather than the SIEM envelope's success/failure: this is what the FIRM is told about an act
+ * performed elsewhere, and a client at `OPERATION_TYPE_ONLY` withholds it entirely.
+ */
+export var ServiceProviderActivityOutcome;
+(function (ServiceProviderActivityOutcome) {
+    /** The operation took effect in the client organization. */
+    ServiceProviderActivityOutcome["SUCCEEDED"] = "SUCCEEDED";
+    /** The client organization refused the operation (authorization, a policy gate). Nothing took effect. */
+    ServiceProviderActivityOutcome["REFUSED"] = "REFUSED";
+})(ServiceProviderActivityOutcome || (ServiceProviderActivityOutcome = {}));
+/**
+ * The firm's decision about its feed. One row per PROVIDER organization: a singleton the backend creates, DISABLED and
+ * with no decision recorded, the first time the firm reads it or decides. An absent row still reads as
+ * {@link ServiceProviderActivityFeedStatus.DISABLED}, which is what the feed writer relies on.
+ */
+export const ServiceProviderActivityFeedSettingsSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The PROVIDER organization — the firm whose staff the feed is about. One row per organization. */
+    organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),
+    status: z.enum(ServiceProviderActivityFeedStatus)
+        .systemEnum('ServiceProviderActivityFeedStatus')
+        .default(ServiceProviderActivityFeedStatus.DISABLED)
+        .isSummaryField()
+        .excludeFromCreate()
+        .excludeFromUpdate()
+        .isAuditEvidence(),
+    /** The firm owner who made the current decision. */
+    decidedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    /** When the current decision was made — for a firm's employee privacy information, "collected since". */
+    decidedAt: z.date().optional().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    /**
+     * Whether the person who ENABLED the feed was shown that works-council or CSE consultation and employee notice may
+     * be required before switching it on. Recorded, never judged: the framework states the notice and records that it
+     * was shown; whether consultation happened is the firm's to establish.
+     */
+    acknowledgedWorkerConsultationNotice: z.boolean().default(false).excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    createdAt: z.date().optional(),
+    updatedAt: z.date().optional(),
+});
+/**
+ * EVERYTHING a feed entry may say, and nothing else (#1632). Strict: an unknown key is refused, so widening what the
+ * firm learns about client work is a deliberate change to this schema — never a spread of a richer object.
+ *
+ * Deliberately absent: the record id, field names or values, the request payload, free text, and anything the
+ * client's own trail marks `.isAuditEvidence()`.
+ */
+export const ServiceProviderActivityFeedEntryContentSchema = z.strictObject({
+    /** The PROVIDER organization — the firm the entry is written to. */
+    organizationId: z.string().min(1),
+    /** The firm's expert who acted. */
+    expertUserId: z.string().min(1),
+    /** The CLIENT organization the expert acted in. A plain id: the firm cannot read the client's row. */
+    clientOrganizationId: z.string().min(1),
+    /** The relationship the expert acted through. */
+    relationshipId: z.string().min(1),
+    occurredAt: z.date(),
+    /** The operation TYPE (e.g. UPDATE), never which record. */
+    operationKind: z.enum(CoreResourceOperation),
+    /** The resource TYPE the operation was on. */
+    resourceType: z.string().min(1),
+    /** Present only when the client's disclosure level is `OPERATION_AND_OUTCOME`. */
+    outcome: z.enum(ServiceProviderActivityOutcome).optional(),
+});
+/**
+ * One feed entry as stored in the PROVIDER organization: the strict content plus the row's own identity. Written by
+ * the engine only; no client-facing verb creates, changes or deletes one.
+ */
+export const ServiceProviderActivityFeedEntrySchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
+    expertUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
+    clientOrganizationId: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),
+    relationshipId: z.string().min(1).isDBIndexed().excludeFromUpdate(),
+    occurredAt: z.date().isDBIndexed().isSummaryField().excludeFromUpdate(),
+    operationKind: z.enum(CoreResourceOperation).systemEnum('CoreResourceOperation').isSummaryField().excludeFromUpdate(),
+    resourceType: z.string().min(1).isSummaryField().excludeFromUpdate(),
+    outcome: z.enum(ServiceProviderActivityOutcome).systemEnum('ServiceProviderActivityOutcome').optional().isSummaryField().excludeFromUpdate(),
+    createdAt: z.date().isDBIndexed().optional(),
+    updatedAt: z.date().optional(),
+});
+/** The firm's two decisions about its feed. */
+export var ServiceProviderActivityFeedSettings_Operations;
+(function (ServiceProviderActivityFeedSettings_Operations) {
+    /** Firm ORG_OWNER switches the feed on (step-up). Refused unless the consultation notice was acknowledged. */
+    ServiceProviderActivityFeedSettings_Operations["ENABLE"] = "enable";
+    /** Firm ORG_OWNER switches the feed off. Entries already written stay until their retention ends. */
+    ServiceProviderActivityFeedSettings_Operations["DISABLE"] = "disable";
+})(ServiceProviderActivityFeedSettings_Operations || (ServiceProviderActivityFeedSettings_Operations = {}));
+/** @wildo_source:part:end saas.models.organizations.service-provider-activity-feed */
+//# sourceMappingURL=service-provider-activity-feed.shared.schemas.js.map

package/dist/esm/organizations/service-provider-activity-feed.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-activity-feed.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-activity-feed.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,wIAAwI;AACxI;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,0DAAqB,CAAA;IACrB,gGAAgG;IAChG,wDAAmB,CAAA;AACrB,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,8BAKX;AALD,WAAY,8BAA8B;IACxC,4DAA4D;IAC5D,yDAAuB,CAAA;IACvB,yGAAyG;IACzG,qDAAmB,CAAA;AACrB,CAAC,EALW,8BAA8B,KAA9B,8BAA8B,QAKzC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,oGAAoG;IACpG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAChI,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAC9C,UAAU,CAAC,mCAAmC,CAAC;SAC/C,OAAO,CAAC,iCAAiC,CAAC,QAAQ,CAAC;SACnD,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IACpB,oDAAoD;IACpD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,yGAAyG;IACzG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACzG;;;;OAIG;IACH,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC1H,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1E,oEAAoE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,sGAAsG;IACtG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,iDAAiD;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,4DAA4D;IAC5D,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,8CAA8C;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACjG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE;IACnE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACrH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACpE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5I,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,+CAA+C;AAC/C,MAAM,CAAN,IAAY,8CAKX;AALD,WAAY,8CAA8C;IACxD,8GAA8G;IAC9G,mEAAiB,CAAA;IACjB,qGAAqG;IACrG,qEAAmB,CAAA;AACrB,CAAC,EALW,8CAA8C,KAA9C,8CAA8C,QAKzD;AACD,sFAAsF","sourcesContent":["/**\n * The firm's EXPERT-ACTIVITY FEED (#1632): an opt-in, metadata-only record, in the PROVIDER organization, of what its\n * own experts did inside client organizations.\n *\n * ## Why it exists, and why it is shaped this way\n *\n * Under #1597 an expert's actions are recorded in the CLIENT's audit trail, attributed to the relationship. The firm is\n * accountable for its staff and runs on operating metrics, and it cannot read that trail: it is another tenant's. The\n * field's answer is the shape Microsoft Partner Center gives a partner — an activity log of its own delegated actions\n * (date, affected customer, action, partner user) while the detailed in-tenant trail stays in the customer's tenant.\n *\n * Three constraints decide everything below:\n *\n * - **No client content, ever.** A firm acting for a client acts on the client's documented instructions (GDPR\n *   Art. 28(3)(a)); a firm-wide view of client content would make the firm decide purposes of its own over that data\n *   (Art. 28(10)). So an entry carries operation TYPES, resource TYPES, ids of the parties — never a record id, a\n *   field value, free text or a payload. {@link ServiceProviderActivityFeedEntryContentSchema} is STRICT so a new\n *   field is a deliberate schema change rather than a spread.\n * - **It is worker monitoring.** Collecting it is the FIRM's decision, recorded with who, when, and the fact that it\n *   was told consultation may be owed (BetrVG §87(1) no. 6; the CNIL's CSE consultation). The framework RECORDS the\n *   decision and does not judge its lawfulness. Off by default, with no row needed for \"off\".\n * - **The client can narrow or stop it** for its own tenant, per relationship\n *   (`ServiceProviderRelationship.activityFeedDisclosure`). An entry is written only when both sides allow it.\n *\n * Entries are written by the engine at AUDIT time, from the same attribution the audit writer already resolves for\n * the client's own row — never through a client-facing verb.\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\n\n/** @wildo_source:part:start saas.models.organizations.service-provider-activity-feed facet:layer:shared facet:audience:app-developer */\n/**\n * Whether the FIRM collects activity metadata about its own experts' work in client organizations (#1632).\n *\n * The absence of a settings row means {@link DISABLED}: switching the feed on is a recorded decision, and switching it\n * off again is one too.\n */\nexport enum ServiceProviderActivityFeedStatus {\n  /** No feed entry is written, whatever a client allows. The default. */\n  DISABLED = 'DISABLED',\n  /** Entries are written for every client whose relationship's disclosure level is not `NONE`. */\n  ENABLED = 'ENABLED',\n}\n\n/**\n * How an expert's operation in a client ended, as the firm's feed may say it (#1632).\n *\n * Its own vocabulary rather than the SIEM envelope's success/failure: this is what the FIRM is told about an act\n * performed elsewhere, and a client at `OPERATION_TYPE_ONLY` withholds it entirely.\n */\nexport enum ServiceProviderActivityOutcome {\n  /** The operation took effect in the client organization. */\n  SUCCEEDED = 'SUCCEEDED',\n  /** The client organization refused the operation (authorization, a policy gate). Nothing took effect. */\n  REFUSED = 'REFUSED',\n}\n\n/**\n * The firm's decision about its feed. One row per PROVIDER organization: a singleton the backend creates, DISABLED and\n * with no decision recorded, the first time the firm reads it or decides. An absent row still reads as\n * {@link ServiceProviderActivityFeedStatus.DISABLED}, which is what the feed writer relies on.\n */\nexport const ServiceProviderActivityFeedSettingsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /** The PROVIDER organization — the firm whose staff the feed is about. One row per organization. */\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n  status: z.enum(ServiceProviderActivityFeedStatus)\n    .systemEnum('ServiceProviderActivityFeedStatus')\n    .default(ServiceProviderActivityFeedStatus.DISABLED)\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n  /** The firm owner who made the current decision. */\n  decidedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /** When the current decision was made — for a firm's employee privacy information, \"collected since\". */\n  decidedAt: z.date().optional().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * Whether the person who ENABLED the feed was shown that works-council or CSE consultation and employee notice may\n   * be required before switching it on. Recorded, never judged: the framework states the notice and records that it\n   * was shown; whether consultation happened is the firm's to establish.\n   */\n  acknowledgedWorkerConsultationNotice: z.boolean().default(false).excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedSettings = z.infer<typeof ServiceProviderActivityFeedSettingsSchema>;\n\n/**\n * EVERYTHING a feed entry may say, and nothing else (#1632). Strict: an unknown key is refused, so widening what the\n * firm learns about client work is a deliberate change to this schema — never a spread of a richer object.\n *\n * Deliberately absent: the record id, field names or values, the request payload, free text, and anything the\n * client's own trail marks `.isAuditEvidence()`.\n */\nexport const ServiceProviderActivityFeedEntryContentSchema = z.strictObject({\n  /** The PROVIDER organization — the firm the entry is written to. */\n  organizationId: z.string().min(1),\n  /** The firm's expert who acted. */\n  expertUserId: z.string().min(1),\n  /** The CLIENT organization the expert acted in. A plain id: the firm cannot read the client's row. */\n  clientOrganizationId: z.string().min(1),\n  /** The relationship the expert acted through. */\n  relationshipId: z.string().min(1),\n  occurredAt: z.date(),\n  /** The operation TYPE (e.g. UPDATE), never which record. */\n  operationKind: z.enum(CoreResourceOperation),\n  /** The resource TYPE the operation was on. */\n  resourceType: z.string().min(1),\n  /** Present only when the client's disclosure level is `OPERATION_AND_OUTCOME`. */\n  outcome: z.enum(ServiceProviderActivityOutcome).optional(),\n});\nexport type ServiceProviderActivityFeedEntryContent = z.infer<typeof ServiceProviderActivityFeedEntryContentSchema>;\n\n/**\n * One feed entry as stored in the PROVIDER organization: the strict content plus the row's own identity. Written by\n * the engine only; no client-facing verb creates, changes or deletes one.\n */\nexport const ServiceProviderActivityFeedEntrySchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  expertUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  clientOrganizationId: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),\n  relationshipId: z.string().min(1).isDBIndexed().excludeFromUpdate(),\n  occurredAt: z.date().isDBIndexed().isSummaryField().excludeFromUpdate(),\n  operationKind: z.enum(CoreResourceOperation).systemEnum('CoreResourceOperation').isSummaryField().excludeFromUpdate(),\n  resourceType: z.string().min(1).isSummaryField().excludeFromUpdate(),\n  outcome: z.enum(ServiceProviderActivityOutcome).systemEnum('ServiceProviderActivityOutcome').optional().isSummaryField().excludeFromUpdate(),\n  createdAt: z.date().isDBIndexed().optional(),\n  updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedEntry = z.infer<typeof ServiceProviderActivityFeedEntrySchema>;\n\n/** The firm's two decisions about its feed. */\nexport enum ServiceProviderActivityFeedSettings_Operations {\n  /** Firm ORG_OWNER switches the feed on (step-up). Refused unless the consultation notice was acknowledged. */\n  ENABLE = 'enable',\n  /** Firm ORG_OWNER switches the feed off. Entries already written stay until their retention ends. */\n  DISABLE = 'disable',\n}\n/** @wildo_source:part:end saas.models.organizations.service-provider-activity-feed */\n"]}