@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/organizations/service-provider-capability-grants.shared.schemas.js

@@ -0,0 +1,290 @@
+/**
+ * Delegated administrative capabilities (#1631) — a CLIENT organization lends one service firm's experts a NAMED,
+ * narrow, time-bound administrative capability, without ever making the firm an administrator.
+ *
+ * ## The shape, and why capabilities are ROLES
+ *
+ * Paul (2026-09-25, #1597 Q2): never admin by default; narrow, time-limited, client-revocable delegation; a
+ * security-critical capability needs the client's OWNER, is time-bound, and is never renewed automatically. Issue
+ * #1631 records the practice this follows (Microsoft's granular delegated admin privileges for partners, with a
+ * time-bound relationship that cannot be auto-extended for the highest role) with its sources; nothing here quotes
+ * them.
+ *
+ * A capability is a NAMED ROLE in the organization role table, one per {@link DelegatedAdministrativeCapability},
+ * inheriting from nothing, and listed EXPLICITLY — beside `ORG_ADMIN` — in the `roles` of exactly the core operations
+ * it opens. The rejected alternative (review F7) was an operation-id allow-list per grant: a second authority beside
+ * role resolution that the ~20 `initiatorRoles` readers and the role ceiling would not know about.
+ *
+ * ## Grants are rows, filtered live
+ *
+ * `SERVICE_PROVIDER_CAPABILITY_GRANTS` rows live in the CLIENT organization. The execution-context live filter that
+ * decides whether a provider membership confers anything (#1597) reads the relationship's grants in the same pass and
+ * adds a capability's role to the expert's entries only while {@link isServiceProviderCapabilityGrantConferring}
+ * holds — ACTIVE and `endsAt` still in the future. `EXPIRED` is sweep bookkeeping: admission reads `endsAt`.
+ *
+ * ## What delegation never does
+ *
+ * No capability confers `ORG_ADMIN` or `ORG_OWNER`, accepts a relationship, amends its scope, delegates further, or
+ * counts toward the owner floor (provider memberships never do). Startup refuses a capability role whose `inheritFrom`
+ * chain reaches an administration anchor.
+ */
+import { z } from 'zod';
+import { CORE_ORG_ROLES, isInboundHandlerOnlyRole } from '../security/authorizations/roles.shared.schemas.js';
+/** @wildo_source:part:start saas.models.organizations.service-provider-capability-grants facet:layer:shared facet:audience:app-developer */
+/**
+ * The closed set of administrative capabilities a client may lend a service firm (#1631). Each is ONE role
+ * ({@link DELEGATED_CAPABILITY_ROLE}); a grant names one capability.
+ */
+export var DelegatedAdministrativeCapability;
+(function (DelegatedAdministrativeCapability) {
+    /** Invite people into the client, resend an invitation, revoke one. */
+    DelegatedAdministrativeCapability["INVITE_MEMBERS"] = "INVITE_MEMBERS";
+    /**
+     * Suspend or remove the firm's OWN experts under this relationship — never an ordinary member, never another firm's.
+     * Deliberately not reactivate: lifting a suspension would let the firm undo the client's bar against one person (#1597).
+     */
+    DelegatedAdministrativeCapability["MANAGE_RELATIONSHIP_EXPERTS"] = "MANAGE_RELATIONSHIP_EXPERTS";
+    /** Read the client organization's audit trail. */
+    DelegatedAdministrativeCapability["READ_AUDIT_TRAIL"] = "READ_AUDIT_TRAIL";
+    /** Configure the client's single sign-on and SCIM provisioning. Security-critical. */
+    DelegatedAdministrativeCapability["MANAGE_SSO_SCIM"] = "MANAGE_SSO_SCIM";
+    /** Manage the client organization's API keys. Security-critical. */
+    DelegatedAdministrativeCapability["MANAGE_API_KEYS"] = "MANAGE_API_KEYS";
+    /** Approve or deny, as the tenant, a platform operator's request to access the client. Security-critical. */
+    DelegatedAdministrativeCapability["APPROVE_ACCESS_GRANTS"] = "APPROVE_ACCESS_GRANTS";
+})(DelegatedAdministrativeCapability || (DelegatedAdministrativeCapability = {}));
+/**
+ * The role each capability confers — the ONE mapping, total over the enum, so a capability added tomorrow is a compile
+ * error here rather than a grant that confers nothing.
+ */
+export const DELEGATED_CAPABILITY_ROLE = Object.freeze({
+    [DelegatedAdministrativeCapability.INVITE_MEMBERS]: CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS,
+    [DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS,
+    [DelegatedAdministrativeCapability.READ_AUDIT_TRAIL]: CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL,
+    [DelegatedAdministrativeCapability.MANAGE_SSO_SCIM]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM,
+    [DelegatedAdministrativeCapability.MANAGE_API_KEYS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS,
+    [DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS]: CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS,
+});
+/** Every capability role — conferred ONLY by a live grant, never by a membership row (the member role doors refuse them). */
+export const DELEGATED_CAPABILITY_ROLES = new Set(Object.values(DELEGATED_CAPABILITY_ROLE));
+/** Whether `role` is one only a live capability grant may confer. */
+export function isDelegatedCapabilityRole(role) {
+    return DELEGATED_CAPABILITY_ROLES.has(role);
+}
+/**
+ * Whether an organization MEMBERSHIP may hold `role` at all, whatever its organization's type (#1921): not a
+ * handler-only role (an engine inbound handler's alone, #1629) and not a delegated capability role (a live grant's alone,
+ * #1631). The ONE statement of that rule for every surface that offers or names a role a person holds — the published
+ * role table a picker offers, and a setting that names one role (`contentReaderRole`). The membership write door
+ * (`validateOrgMemberRoles`) refuses each of the two kinds with its own reason; a kind added here must be refused there too.
+ */
+export function roleMayBeHeldByMembership(role) {
+    return !isInboundHandlerOnlyRole(role) && !isDelegatedCapabilityRole(role);
+}
+/**
+ * Capabilities that change who can authenticate into, or act as, the client: only the client's OWNER grants them,
+ * with step-up, for a task-sized window ({@link SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS} at most), and a renewal is
+ * a new grant — there is no `autoRenew`.
+ */
+export const SECURITY_CRITICAL_DELEGATED_CAPABILITIES = Object.freeze([
+    DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,
+    DelegatedAdministrativeCapability.MANAGE_API_KEYS,
+    DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,
+]);
+/**
+ * Capabilities that need an ORGANIZATION-WIDE relationship: refused at grant time on a relationship confined to
+ * organization units, because a unit-scoped relationship has no organization-wide entry (#1597 F5) to carry them.
+ *
+ * Every capability is here, and that is measured rather than assumed: each one opens operations on resources that do
+ * not narrow by organization unit (members, audit logs, SSO / SCIM, API keys, platform access grants), and the role gate
+ * on those counts only organization-wide entries. A capability granted on a unit-scoped relationship would therefore
+ * be audited, mirrored to the firm as held, and confer nothing — a grant that lies. The list stays a list (rather than
+ * a blanket rule) so a future capability that opens a unit-narrowable operation can be left off it deliberately.
+ */
+export const ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES = Object.freeze([
+    DelegatedAdministrativeCapability.INVITE_MEMBERS,
+    DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS,
+    DelegatedAdministrativeCapability.READ_AUDIT_TRAIL,
+    DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,
+    DelegatedAdministrativeCapability.MANAGE_API_KEYS,
+    DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,
+]);
+/** The longest an ordinary capability may be granted for: two years, GDAP's relationship maximum. */
+export const DELEGATED_CAPABILITY_MAX_DAYS = 730;
+/**
+ * The longest a security-critical capability may be granted for, unless the application declares a lower cap
+ * (`acceptsServiceProviders.securityCriticalCapabilityMaxDays`). A reversible default chosen for #1631 — a task-sized
+ * window, far below the relationship maximum — NOT a figure taken from GDAP.
+ */
+export const SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS = 30;
+/** Where one grant stands. */
+export var ServiceProviderCapabilityGrantStatus;
+(function (ServiceProviderCapabilityGrantStatus) {
+    /** Granted and not revoked. Confers only while `endsAt` is still in the future. */
+    ServiceProviderCapabilityGrantStatus["ACTIVE"] = "ACTIVE";
+    /** A client administrator revoked it, or the relationship ended. Terminal. */
+    ServiceProviderCapabilityGrantStatus["REVOKED"] = "REVOKED";
+    /** The sweep relabelled it after `endsAt`. Terminal bookkeeping — admission never reads this label. */
+    ServiceProviderCapabilityGrantStatus["EXPIRED"] = "EXPIRED";
+})(ServiceProviderCapabilityGrantStatus || (ServiceProviderCapabilityGrantStatus = {}));
+/** Why a grant stopped conferring before its term — what a REVOKED audit row records (#1631 review F10). */
+export var ServiceProviderCapabilityGrantEndCause;
+(function (ServiceProviderCapabilityGrantEndCause) {
+    /** A client administrator revoked it. */
+    ServiceProviderCapabilityGrantEndCause["REVOKED_BY_CLIENT"] = "REVOKED_BY_CLIENT";
+    /** Its relationship ended (terminated, withdrawn, expired, declined, or a party removed). */
+    ServiceProviderCapabilityGrantEndCause["RELATIONSHIP_ENDED"] = "RELATIONSHIP_ENDED";
+    /** Its relationship was narrowed to organization units, which cannot carry any capability. */
+    ServiceProviderCapabilityGrantEndCause["RELATIONSHIP_NARROWED"] = "RELATIONSHIP_NARROWED";
+})(ServiceProviderCapabilityGrantEndCause || (ServiceProviderCapabilityGrantEndCause = {}));
+/** The client's verbs on its grants. The firm has none: it can never grant, widen or extend. */
+export var ServiceProviderCapabilityGrants_Operations;
+(function (ServiceProviderCapabilityGrants_Operations) {
+    /** Client ORG_ADMIN lends an ORDINARY capability, for at most two years. */
+    ServiceProviderCapabilityGrants_Operations["GRANT"] = "grant";
+    /** Client ORG_OWNER lends a SECURITY-CRITICAL capability, with step-up, for a task-sized window. */
+    ServiceProviderCapabilityGrants_Operations["GRANT_SECURITY_CRITICAL"] = "grantSecurityCritical";
+    /** Client ORG_ADMIN revokes any grant, at any time, without asking the firm. Takes effect on the next request. */
+    ServiceProviderCapabilityGrants_Operations["REVOKE"] = "revoke";
+    /** ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. */
+    ServiceProviderCapabilityGrants_Operations["EXPIRE"] = "expire";
+})(ServiceProviderCapabilityGrants_Operations || (ServiceProviderCapabilityGrants_Operations = {}));
+/** The client-branchable codes a refused grant carries (409: authorized caller, valid payload, the STATE forbids it). */
+export var ServiceProviderCapabilityGrantErrorCode;
+(function (ServiceProviderCapabilityGrantErrorCode) {
+    /** The relationship is not ACTIVE (or SUSPENDED) — nothing can be lent to a relationship that confers nothing. */
+    ServiceProviderCapabilityGrantErrorCode["SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE"] = "SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE";
+    /** A security-critical capability through the ordinary `grant`, or an ordinary one through the owner's verb. */
+    ServiceProviderCapabilityGrantErrorCode["SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB"] = "SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB";
+    /** `endsAt` beyond the cap for this capability, or not in the future. */
+    ServiceProviderCapabilityGrantErrorCode["SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED"] = "SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED";
+    /** An organization-level capability on a relationship confined to organization units. */
+    ServiceProviderCapabilityGrantErrorCode["SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP"] = "SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP";
+    /** An ACTIVE grant of this capability already exists on this relationship; revoke it first (a renewal is a new grant). */
+    ServiceProviderCapabilityGrantErrorCode["SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED"] = "SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED";
+    /** MANAGE_RELATIONSHIP_EXPERTS used on a membership that is not an expert of the SAME relationship. */
+    ServiceProviderCapabilityGrantErrorCode["SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP"] = "SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP";
+})(ServiceProviderCapabilityGrantErrorCode || (ServiceProviderCapabilityGrantErrorCode = {}));
+/** @wildo_source:part:end saas.models.organizations.service-provider-capability-grants */
+/**
+ * Does this grant confer its capability RIGHT NOW? The ONE predicate the live filter uses: ACTIVE, and `endsAt` in the
+ * future. `endsAt` is read here rather than trusting the EXPIRED label, so a grant stops working the moment its term
+ * passes whether or not the sweep has run (invariant 1).
+ */
+export function isServiceProviderCapabilityGrantConferring(grant, now) {
+    if (!grant || grant.status !== ServiceProviderCapabilityGrantStatus.ACTIVE)
+        return false;
+    if (grant.endsAt === undefined || grant.endsAt === null)
+        return false;
+    const endsAt = grant.endsAt instanceof Date ? grant.endsAt : new Date(grant.endsAt);
+    return Number.isFinite(endsAt.getTime()) && endsAt.getTime() > now.getTime();
+}
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * May this capability be lent on this relationship, until `endsAt`, through this verb? (#1631 invariants 3 and 5)
+ *
+ * The one rule both grant verbs apply. Pure: the caller supplies the relationship's scope and the application's
+ * declared cap. Fails closed on anything it cannot prove.
+ */
+export function resolveServiceProviderCapabilityGrantTerms(input) {
+    const securityCritical = SECURITY_CRITICAL_DELEGATED_CAPABILITIES.includes(input.capability);
+    const expectedVerb = securityCritical
+        ? ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL
+        : ServiceProviderCapabilityGrants_Operations.GRANT;
+    if (input.verb !== expectedVerb)
+        return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB };
+    if ((input.relationshipOrganizationUnitIds ?? []).length > 0 && ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES.includes(input.capability)) {
+        return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP };
+    }
+    const maxDays = securityCritical
+        ? Math.min(SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS, input.declaredSecurityCriticalMaxDays ?? SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS)
+        : DELEGATED_CAPABILITY_MAX_DAYS;
+    const endsAtMs = input.endsAt.getTime();
+    if (!Number.isFinite(endsAtMs) || endsAtMs <= input.now.getTime() || endsAtMs > input.now.getTime() + maxDays * DAY_MS) {
+        return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED };
+    }
+    return { allowed: true };
+}
+/**
+ * One grant, stored in the CLIENT organization. Every field is server-authored: the verbs write them, and there is no
+ * generic CREATE or UPDATE.
+ */
+export const ServiceProviderCapabilityGrantSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The CLIENT organization — the party lending the capability, and the scope anchor. */
+    organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),
+    /** The relationship the capability is lent through — same tenant, a real edge. The live filter reads grants by it. */
+    relationshipId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    /** The firm, copied from the relationship so a row names both parties. A plain id, never an edge into another tenant. */
+    providerOrganizationId: z.string().min(1).isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    capability: z.enum(DelegatedAdministrativeCapability)
+        .systemEnum('DelegatedAdministrativeCapability')
+        .isSummaryField()
+        .excludeFromCreate()
+        .excludeFromUpdate()
+        .isAuditEvidence(),
+    /** When the capability stops conferring. Required: a delegation always ends. Admission reads this, never the EXPIRED label. */
+    endsAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    status: z.enum(ServiceProviderCapabilityGrantStatus)
+        .systemEnum('ServiceProviderCapabilityGrantStatus')
+        .default(ServiceProviderCapabilityGrantStatus.ACTIVE)
+        .isDBIndexed()
+        .isSummaryField()
+        .excludeFromCreate()
+        .excludeFromUpdate()
+        .isAuditEvidence(),
+    grantedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    grantedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),
+    revokedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    revokedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),
+    /** When the grant stopped — revoked, or relabelled after its term. The retention clock's start point (#1613). */
+    endedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+    createdAt: z.date().optional(),
+    updatedAt: z.date().optional(),
+});
+/** One capability the firm holds in a client, as its engagement mirror shows it. */
+export const ServiceEngagementDelegatedCapabilitySchema = z.object({
+    capability: z.enum(DelegatedAdministrativeCapability).systemEnum('DelegatedAdministrativeCapability')
+        .describe('An administrative capability the client organization currently lends this firm.'),
+    endsAt: z.date().describe('When the lending of that capability ends.'),
+});
+/** Why the organization role table was refused at startup for a delegated capability role (#1631). */
+export var DelegatedCapabilityRoleViolationKind;
+(function (DelegatedCapabilityRoleViolationKind) {
+    /** The capability role is not in the organization role table at all — a grant of it would confer nothing, silently. */
+    DelegatedCapabilityRoleViolationKind["CAPABILITY_ROLE_UNDECLARED"] = "CAPABILITY_ROLE_UNDECLARED";
+    /** The role's `inheritFrom` chain reaches an administration anchor (ORG_ADMIN / ORG_OWNER): lending it would make the firm an administrator. */
+    DelegatedCapabilityRoleViolationKind["CAPABILITY_ROLE_REACHES_ADMINISTRATION"] = "CAPABILITY_ROLE_REACHES_ADMINISTRATION";
+    /**
+     * Another organization role inherits the capability role: every holder of that role would carry the capability
+     * standing, with no grant row, no term and no revocation. A capability is conferred only by a live grant.
+     */
+    DelegatedCapabilityRoleViolationKind["CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE"] = "CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE";
+})(DelegatedCapabilityRoleViolationKind || (DelegatedCapabilityRoleViolationKind = {}));
+/**
+ * Validate every delegated capability role against the LIVE organization role table (#1631 invariant 2). An application
+ * may override the engine's role definitions, so the check runs on the table the authorizer actually uses: a capability
+ * role redefined to inherit from `ORG_ADMIN` (or anything that leads there) is refused at boot, exactly as a provider
+ * role that reaches `ORG_ADMIN` is.
+ */
+export function collectDelegatedCapabilityRoleViolations(input) {
+    const violations = [];
+    for (const capability of Object.values(DelegatedAdministrativeCapability)) {
+        const role = DELEGATED_CAPABILITY_ROLE[capability];
+        const hierarchy = input.organizationRoleHierarchy(role);
+        if (hierarchy.length === 0) {
+            violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_UNDECLARED });
+            continue;
+        }
+        if (hierarchy.some((held) => input.administrationAnchorRoles.includes(held))) {
+            violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_REACHES_ADMINISTRATION });
+        }
+        for (const other of input.organizationRoles ?? []) {
+            if (other !== role && input.organizationRoleHierarchy(other).includes(role)) {
+                violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE, inheritedBy: other });
+            }
+        }
+    }
+    return violations;
+}
+//# sourceMappingURL=service-provider-capability-grants.shared.schemas.js.map

package/dist/esm/organizations/service-provider-capability-grants.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-capability-grants.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,MAAM,CAAN,IAAY,iCAgBX;AAhBD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,sEAAiC,CAAA;IACjC;;;OAGG;IACH,gGAA2D,CAAA;IAC3D,kDAAkD;IAClD,0EAAqC,CAAA;IACrC,sFAAsF;IACtF,wEAAmC,CAAA;IACnC,oEAAoE;IACpE,wEAAmC,CAAA;IACnC,6GAA6G;IAC7G,oFAA+C,CAAA;AACjD,CAAC,EAhBW,iCAAiC,KAAjC,iCAAiC,QAgB5C;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwE,MAAM,CAAC,MAAM,CAAC;IAC1H,CAAC,iCAAiC,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,4BAA4B;IAC/F,CAAC,iCAAiC,CAAC,2BAA2B,CAAC,EAAE,cAAc,CAAC,yCAAyC;IACzH,CAAC,iCAAiC,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,8BAA8B;IACnG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC,mCAAmC;CAC9G,CAAC,CAAC;AAEH,6HAA6H;AAC7H,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAEzH,qEAAqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAiD,MAAM,CAAC,MAAM,CAAC;IAClH,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAiD,MAAM,CAAC,MAAM,CAAC;IACnH,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,2BAA2B;IAC7D,iCAAiC,CAAC,gBAAgB;IAClD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH,qGAAqG;AACrG,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AACjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,EAAE,CAAC;AAEhE,8BAA8B;AAC9B,MAAM,CAAN,IAAY,oCAOX;AAPD,WAAY,oCAAoC;IAC9C,mFAAmF;IACnF,yDAAiB,CAAA;IACjB,8EAA8E;IAC9E,2DAAmB,CAAA;IACnB,uGAAuG;IACvG,2DAAmB,CAAA;AACrB,CAAC,EAPW,oCAAoC,KAApC,oCAAoC,QAO/C;AAED,4GAA4G;AAC5G,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,yCAAyC;IACzC,iFAAuC,CAAA;IACvC,6FAA6F;IAC7F,mFAAyC,CAAA;IACzC,8FAA8F;IAC9F,yFAA+C,CAAA;AACjD,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED,gGAAgG;AAChG,MAAM,CAAN,IAAY,0CASX;AATD,WAAY,0CAA0C;IACpD,4EAA4E;IAC5E,6DAAe,CAAA;IACf,oGAAoG;IACpG,+FAAiD,CAAA;IACjD,kHAAkH;IAClH,+DAAiB,CAAA;IACjB,sFAAsF;IACtF,+DAAiB,CAAA;AACnB,CAAC,EATW,0CAA0C,KAA1C,0CAA0C,QASrD;AAED,yHAAyH;AACzH,MAAM,CAAN,IAAY,uCAaX;AAbD,WAAY,uCAAuC;IACjD,kHAAkH;IAClH,kJAAuG,CAAA;IACvG,gHAAgH;IAChH,wIAA6F,CAAA;IAC7F,yEAAyE;IACzE,wIAA6F,CAAA;IAC7F,yFAAyF;IACzF,sLAA2I,CAAA;IAC3I,0HAA0H;IAC1H,sIAA2F,CAAA;IAC3F,uGAAuG;IACvG,8JAAmH,CAAA;AACrH,CAAC,EAbW,uCAAuC,KAAvC,uCAAuC,QAalD;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,MAAM,UAAU,0CAA0C,CACxD,KAA+F,EAC/F,GAAS;IAET,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAS1D;IAGC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7F,MAAM,YAAY,GAAG,gBAAgB;QACnC,CAAC,CAAC,0CAA0C,CAAC,uBAAuB;QACpE,CAAC,CAAC,0CAA0C,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACvJ,IAAI,CAAC,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,yCAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACrI,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,mEAAmE,EAAE,CAAC;IAC/I,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,6CAA6C,EAAE,KAAK,CAAC,+BAA+B,IAAI,6CAA6C,CAAC;QACjJ,CAAC,CAAC,6BAA6B,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;QACvH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,sHAAsH;IACtH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzI,yHAAyH;IACzH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEjH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAClD,UAAU,CAAC,mCAAmC,CAAC;SAC/C,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,+HAA+H;IAC/H,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;SACjD,UAAU,CAAC,sCAAsC,CAAC;SAClD,OAAO,CAAC,oCAAoC,CAAC,MAAM,CAAC;SACpD,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,iHAAiH;IACjH,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,UAAU,CAAC,mCAAmC,CAAC;SAClG,QAAQ,CAAC,iFAAiF,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACvE,CAAC,CAAC;AAGH,sGAAsG;AACtG,MAAM,CAAN,IAAY,oCAUX;AAVD,WAAY,oCAAoC;IAC9C,uHAAuH;IACvH,iGAAyD,CAAA;IACzD,gJAAgJ;IAChJ,yHAAiF,CAAA;IACjF;;;OAGG;IACH,+HAAuF,CAAA;AACzF,CAAC,EAVW,oCAAoC,KAApC,oCAAoC,QAU/C;AAED;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CAAC,KAMxD;IACC,MAAM,UAAU,GAAwI,EAAE,CAAC;IAC3J,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,sCAAsC,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,yCAAyC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["/**\n * Delegated administrative capabilities (#1631) — a CLIENT organization lends one service firm's experts a NAMED,\n * narrow, time-bound administrative capability, without ever making the firm an administrator.\n *\n * ## The shape, and why capabilities are ROLES\n *\n * Paul (2026-09-25, #1597 Q2): never admin by default; narrow, time-limited, client-revocable delegation; a\n * security-critical capability needs the client's OWNER, is time-bound, and is never renewed automatically. Issue\n * #1631 records the practice this follows (Microsoft's granular delegated admin privileges for partners, with a\n * time-bound relationship that cannot be auto-extended for the highest role) with its sources; nothing here quotes\n * them.\n *\n * A capability is a NAMED ROLE in the organization role table, one per {@link DelegatedAdministrativeCapability},\n * inheriting from nothing, and listed EXPLICITLY — beside `ORG_ADMIN` — in the `roles` of exactly the core operations\n * it opens. The rejected alternative (review F7) was an operation-id allow-list per grant: a second authority beside\n * role resolution that the ~20 `initiatorRoles` readers and the role ceiling would not know about.\n *\n * ## Grants are rows, filtered live\n *\n * `SERVICE_PROVIDER_CAPABILITY_GRANTS` rows live in the CLIENT organization. The execution-context live filter that\n * decides whether a provider membership confers anything (#1597) reads the relationship's grants in the same pass and\n * adds a capability's role to the expert's entries only while {@link isServiceProviderCapabilityGrantConferring}\n * holds — ACTIVE and `endsAt` still in the future. `EXPIRED` is sweep bookkeeping: admission reads `endsAt`.\n *\n * ## What delegation never does\n *\n * No capability confers `ORG_ADMIN` or `ORG_OWNER`, accepts a relationship, amends its scope, delegates further, or\n * counts toward the owner floor (provider memberships never do). Startup refuses a capability role whose `inheritFrom`\n * chain reaches an administration anchor.\n */\n\nimport { z } from 'zod';\nimport { CORE_ORG_ROLES, isInboundHandlerOnlyRole } from '../security/authorizations/roles.shared.schemas';\n\n/** @wildo_source:part:start saas.models.organizations.service-provider-capability-grants facet:layer:shared facet:audience:app-developer */\n/**\n * The closed set of administrative capabilities a client may lend a service firm (#1631). Each is ONE role\n * ({@link DELEGATED_CAPABILITY_ROLE}); a grant names one capability.\n */\nexport enum DelegatedAdministrativeCapability {\n  /** Invite people into the client, resend an invitation, revoke one. */\n  INVITE_MEMBERS = 'INVITE_MEMBERS',\n  /**\n   * Suspend or remove the firm's OWN experts under this relationship — never an ordinary member, never another firm's.\n   * Deliberately not reactivate: lifting a suspension would let the firm undo the client's bar against one person (#1597).\n   */\n  MANAGE_RELATIONSHIP_EXPERTS = 'MANAGE_RELATIONSHIP_EXPERTS',\n  /** Read the client organization's audit trail. */\n  READ_AUDIT_TRAIL = 'READ_AUDIT_TRAIL',\n  /** Configure the client's single sign-on and SCIM provisioning. Security-critical. */\n  MANAGE_SSO_SCIM = 'MANAGE_SSO_SCIM',\n  /** Manage the client organization's API keys. Security-critical. */\n  MANAGE_API_KEYS = 'MANAGE_API_KEYS',\n  /** Approve or deny, as the tenant, a platform operator's request to access the client. Security-critical. */\n  APPROVE_ACCESS_GRANTS = 'APPROVE_ACCESS_GRANTS',\n}\n\n/**\n * The role each capability confers — the ONE mapping, total over the enum, so a capability added tomorrow is a compile\n * error here rather than a grant that confers nothing.\n */\nexport const DELEGATED_CAPABILITY_ROLE: Readonly<Record<DelegatedAdministrativeCapability, CORE_ORG_ROLES>> = Object.freeze({\n  [DelegatedAdministrativeCapability.INVITE_MEMBERS]: CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS,\n  [DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS,\n  [DelegatedAdministrativeCapability.READ_AUDIT_TRAIL]: CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL,\n  [DelegatedAdministrativeCapability.MANAGE_SSO_SCIM]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM,\n  [DelegatedAdministrativeCapability.MANAGE_API_KEYS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS,\n  [DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS]: CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS,\n});\n\n/** Every capability role — conferred ONLY by a live grant, never by a membership row (the member role doors refuse them). */\nexport const DELEGATED_CAPABILITY_ROLES: ReadonlySet<string> = new Set<string>(Object.values(DELEGATED_CAPABILITY_ROLE));\n\n/** Whether `role` is one only a live capability grant may confer. */\nexport function isDelegatedCapabilityRole(role: string): boolean {\n  return DELEGATED_CAPABILITY_ROLES.has(role);\n}\n\n/**\n * Whether an organization MEMBERSHIP may hold `role` at all, whatever its organization's type (#1921): not a\n * handler-only role (an engine inbound handler's alone, #1629) and not a delegated capability role (a live grant's alone,\n * #1631). The ONE statement of that rule for every surface that offers or names a role a person holds — the published\n * role table a picker offers, and a setting that names one role (`contentReaderRole`). The membership write door\n * (`validateOrgMemberRoles`) refuses each of the two kinds with its own reason; a kind added here must be refused there too.\n */\nexport function roleMayBeHeldByMembership(role: string): boolean {\n  return !isInboundHandlerOnlyRole(role) && !isDelegatedCapabilityRole(role);\n}\n\n/**\n * Capabilities that change who can authenticate into, or act as, the client: only the client's OWNER grants them,\n * with step-up, for a task-sized window ({@link SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS} at most), and a renewal is\n * a new grant — there is no `autoRenew`.\n */\nexport const SECURITY_CRITICAL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n  DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n  DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n  DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/**\n * Capabilities that need an ORGANIZATION-WIDE relationship: refused at grant time on a relationship confined to\n * organization units, because a unit-scoped relationship has no organization-wide entry (#1597 F5) to carry them.\n *\n * Every capability is here, and that is measured rather than assumed: each one opens operations on resources that do\n * not narrow by organization unit (members, audit logs, SSO / SCIM, API keys, platform access grants), and the role gate\n * on those counts only organization-wide entries. A capability granted on a unit-scoped relationship would therefore\n * be audited, mirrored to the firm as held, and confer nothing — a grant that lies. The list stays a list (rather than\n * a blanket rule) so a future capability that opens a unit-narrowable operation can be left off it deliberately.\n */\nexport const ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n  DelegatedAdministrativeCapability.INVITE_MEMBERS,\n  DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS,\n  DelegatedAdministrativeCapability.READ_AUDIT_TRAIL,\n  DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n  DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n  DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/** The longest an ordinary capability may be granted for: two years, GDAP's relationship maximum. */\nexport const DELEGATED_CAPABILITY_MAX_DAYS = 730;\n/**\n * The longest a security-critical capability may be granted for, unless the application declares a lower cap\n * (`acceptsServiceProviders.securityCriticalCapabilityMaxDays`). A reversible default chosen for #1631 — a task-sized\n * window, far below the relationship maximum — NOT a figure taken from GDAP.\n */\nexport const SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS = 30;\n\n/** Where one grant stands. */\nexport enum ServiceProviderCapabilityGrantStatus {\n  /** Granted and not revoked. Confers only while `endsAt` is still in the future. */\n  ACTIVE = 'ACTIVE',\n  /** A client administrator revoked it, or the relationship ended. Terminal. */\n  REVOKED = 'REVOKED',\n  /** The sweep relabelled it after `endsAt`. Terminal bookkeeping — admission never reads this label. */\n  EXPIRED = 'EXPIRED',\n}\n\n/** Why a grant stopped conferring before its term — what a REVOKED audit row records (#1631 review F10). */\nexport enum ServiceProviderCapabilityGrantEndCause {\n  /** A client administrator revoked it. */\n  REVOKED_BY_CLIENT = 'REVOKED_BY_CLIENT',\n  /** Its relationship ended (terminated, withdrawn, expired, declined, or a party removed). */\n  RELATIONSHIP_ENDED = 'RELATIONSHIP_ENDED',\n  /** Its relationship was narrowed to organization units, which cannot carry any capability. */\n  RELATIONSHIP_NARROWED = 'RELATIONSHIP_NARROWED',\n}\n\n/** The client's verbs on its grants. The firm has none: it can never grant, widen or extend. */\nexport enum ServiceProviderCapabilityGrants_Operations {\n  /** Client ORG_ADMIN lends an ORDINARY capability, for at most two years. */\n  GRANT = 'grant',\n  /** Client ORG_OWNER lends a SECURITY-CRITICAL capability, with step-up, for a task-sized window. */\n  GRANT_SECURITY_CRITICAL = 'grantSecurityCritical',\n  /** Client ORG_ADMIN revokes any grant, at any time, without asking the firm. Takes effect on the next request. */\n  REVOKE = 'revoke',\n  /** ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. */\n  EXPIRE = 'expire',\n}\n\n/** The client-branchable codes a refused grant carries (409: authorized caller, valid payload, the STATE forbids it). */\nexport enum ServiceProviderCapabilityGrantErrorCode {\n  /** The relationship is not ACTIVE (or SUSPENDED) — nothing can be lent to a relationship that confers nothing. */\n  SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE = 'SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE',\n  /** A security-critical capability through the ordinary `grant`, or an ordinary one through the owner's verb. */\n  SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB = 'SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB',\n  /** `endsAt` beyond the cap for this capability, or not in the future. */\n  SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED = 'SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED',\n  /** An organization-level capability on a relationship confined to organization units. */\n  SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP',\n  /** An ACTIVE grant of this capability already exists on this relationship; revoke it first (a renewal is a new grant). */\n  SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED = 'SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED',\n  /** MANAGE_RELATIONSHIP_EXPERTS used on a membership that is not an expert of the SAME relationship. */\n  SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP',\n}\n/** @wildo_source:part:end saas.models.organizations.service-provider-capability-grants */\n\n/**\n * Does this grant confer its capability RIGHT NOW? The ONE predicate the live filter uses: ACTIVE, and `endsAt` in the\n * future. `endsAt` is read here rather than trusting the EXPIRED label, so a grant stops working the moment its term\n * passes whether or not the sweep has run (invariant 1).\n */\nexport function isServiceProviderCapabilityGrantConferring(\n  grant: { readonly status?: unknown; readonly endsAt?: Date | string | null } | null | undefined,\n  now: Date,\n): boolean {\n  if (!grant || grant.status !== ServiceProviderCapabilityGrantStatus.ACTIVE) return false;\n  if (grant.endsAt === undefined || grant.endsAt === null) return false;\n  const endsAt = grant.endsAt instanceof Date ? grant.endsAt : new Date(grant.endsAt);\n  return Number.isFinite(endsAt.getTime()) && endsAt.getTime() > now.getTime();\n}\n\nconst DAY_MS = 24 * 60 * 60 * 1000;\n\n/**\n * May this capability be lent on this relationship, until `endsAt`, through this verb? (#1631 invariants 3 and 5)\n *\n * The one rule both grant verbs apply. Pure: the caller supplies the relationship's scope and the application's\n * declared cap. Fails closed on anything it cannot prove.\n */\nexport function resolveServiceProviderCapabilityGrantTerms(input: {\n  readonly capability: DelegatedAdministrativeCapability;\n  readonly verb: ServiceProviderCapabilityGrants_Operations.GRANT | ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL;\n  readonly endsAt: Date;\n  readonly now: Date;\n  /** The relationship's `organizationUnitIds`: non-empty ⇒ unit-scoped. */\n  readonly relationshipOrganizationUnitIds?: readonly string[] | null;\n  /** The client organization type's declared `acceptsServiceProviders.securityCriticalCapabilityMaxDays`. */\n  readonly declaredSecurityCriticalMaxDays?: number;\n}):\n  | { readonly allowed: true }\n  | { readonly allowed: false; readonly code: ServiceProviderCapabilityGrantErrorCode } {\n  const securityCritical = SECURITY_CRITICAL_DELEGATED_CAPABILITIES.includes(input.capability);\n  const expectedVerb = securityCritical\n    ? ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL\n    : ServiceProviderCapabilityGrants_Operations.GRANT;\n  if (input.verb !== expectedVerb) return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB };\n  if ((input.relationshipOrganizationUnitIds ?? []).length > 0 && ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES.includes(input.capability)) {\n    return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP };\n  }\n  const maxDays = securityCritical\n    ? Math.min(SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS, input.declaredSecurityCriticalMaxDays ?? SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS)\n    : DELEGATED_CAPABILITY_MAX_DAYS;\n  const endsAtMs = input.endsAt.getTime();\n  if (!Number.isFinite(endsAtMs) || endsAtMs <= input.now.getTime() || endsAtMs > input.now.getTime() + maxDays * DAY_MS) {\n    return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED };\n  }\n  return { allowed: true };\n}\n\n/**\n * One grant, stored in the CLIENT organization. Every field is server-authored: the verbs write them, and there is no\n * generic CREATE or UPDATE.\n */\nexport const ServiceProviderCapabilityGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** The CLIENT organization — the party lending the capability, and the scope anchor. */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /** The relationship the capability is lent through — same tenant, a real edge. The live filter reads grants by it. */\n  relationshipId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /** The firm, copied from the relationship so a row names both parties. A plain id, never an edge into another tenant. */\n  providerOrganizationId: z.string().min(1).isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  capability: z.enum(DelegatedAdministrativeCapability)\n    .systemEnum('DelegatedAdministrativeCapability')\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /** When the capability stops conferring. Required: a delegation always ends. Admission reads this, never the EXPIRED label. */\n  endsAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  status: z.enum(ServiceProviderCapabilityGrantStatus)\n    .systemEnum('ServiceProviderCapabilityGrantStatus')\n    .default(ServiceProviderCapabilityGrantStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  grantedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  grantedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  revokedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  revokedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  /** When the grant stopped — revoked, or relabelled after its term. The retention clock's start point (#1613). */\n  endedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\nexport type ServiceProviderCapabilityGrant = z.infer<typeof ServiceProviderCapabilityGrantSchema>;\n\n/** One capability the firm holds in a client, as its engagement mirror shows it. */\nexport const ServiceEngagementDelegatedCapabilitySchema = z.object({\n  capability: z.enum(DelegatedAdministrativeCapability).systemEnum('DelegatedAdministrativeCapability')\n    .describe('An administrative capability the client organization currently lends this firm.'),\n  endsAt: z.date().describe('When the lending of that capability ends.'),\n});\nexport type ServiceEngagementDelegatedCapability = z.infer<typeof ServiceEngagementDelegatedCapabilitySchema>;\n\n/** Why the organization role table was refused at startup for a delegated capability role (#1631). */\nexport enum DelegatedCapabilityRoleViolationKind {\n  /** The capability role is not in the organization role table at all — a grant of it would confer nothing, silently. */\n  CAPABILITY_ROLE_UNDECLARED = 'CAPABILITY_ROLE_UNDECLARED',\n  /** The role's `inheritFrom` chain reaches an administration anchor (ORG_ADMIN / ORG_OWNER): lending it would make the firm an administrator. */\n  CAPABILITY_ROLE_REACHES_ADMINISTRATION = 'CAPABILITY_ROLE_REACHES_ADMINISTRATION',\n  /**\n   * Another organization role inherits the capability role: every holder of that role would carry the capability\n   * standing, with no grant row, no term and no revocation. A capability is conferred only by a live grant.\n   */\n  CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE = 'CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE',\n}\n\n/**\n * Validate every delegated capability role against the LIVE organization role table (#1631 invariant 2). An application\n * may override the engine's role definitions, so the check runs on the table the authorizer actually uses: a capability\n * role redefined to inherit from `ORG_ADMIN` (or anything that leads there) is refused at boot, exactly as a provider\n * role that reaches `ORG_ADMIN` is.\n */\nexport function collectDelegatedCapabilityRoleViolations(input: {\n  /** The role's `inheritFrom` walk in the ORGANIZATIONS table, the role itself included; empty ⇒ undeclared. */\n  readonly organizationRoleHierarchy: (role: string) => readonly string[];\n  readonly administrationAnchorRoles: readonly string[];\n  /** Every key of the LIVE organization role table, so a role that inherits a capability role can be found. */\n  readonly organizationRoles?: readonly string[];\n}): { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] {\n  const violations: { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] = [];\n  for (const capability of Object.values(DelegatedAdministrativeCapability)) {\n    const role = DELEGATED_CAPABILITY_ROLE[capability];\n    const hierarchy = input.organizationRoleHierarchy(role);\n    if (hierarchy.length === 0) {\n      violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_UNDECLARED });\n      continue;\n    }\n    if (hierarchy.some((held) => input.administrationAnchorRoles.includes(held))) {\n      violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_REACHES_ADMINISTRATION });\n    }\n    for (const other of input.organizationRoles ?? []) {\n      if (other !== role && input.organizationRoleHierarchy(other).includes(role)) {\n        violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE, inheritedBy: other });\n      }\n    }\n  }\n  return violations;\n}\n"]}

package/dist/esm/organizations/service-provider-client-controls.shared.schemas.d.ts

@@ -0,0 +1,48 @@
+/**
+ * What a CLIENT organization decides, per service-provider relationship, about the firm whose experts work inside it
+ * (#1633, #1632).
+ *
+ * Both settings live on `SERVICE_PROVIDER_RELATIONSHIPS`, the row the client owns, and each is changed only by the
+ * client's own verb. The firm has no verb that writes either, and neither widens what the relationship confers: one
+ * decides how strongly an expert must have proven who they are before acting here, the other how much the firm may
+ * learn afterwards about what its own staff did here.
+ */
+/** @wildo_source:part:start saas.models.organizations.service-provider-client-controls facet:layer:shared facet:audience:app-developer */
+/**
+ * Whether the client accepts the multi-factor proof the FIRM's own identity provider made (#1633).
+ *
+ * The client organization type's authentication policy governs an expert whenever they act in the client, whatever
+ * the firm's policy is. When that policy asks for a second factor, the expert proves it to THIS application for THIS
+ * client, and nothing proven elsewhere counts — unless the client trusts the firm's identity provider here.
+ *
+ * Off by default, as Microsoft Entra's cross-tenant inbound trust is: trusting another organization's MFA is the
+ * RESOURCE tenant's decision, made per partner. Even when on, the client's minimum strength still applies, and an
+ * operation that demands a fresh step-up still demands one.
+ */
+export declare enum ServiceProviderMfaTrust {
+    /** Only a factor proven to this application for this client counts. The default. */
+    NOT_TRUSTED = "NOT_TRUSTED",
+    /**
+     * A factor the firm's own enterprise identity provider reported in the expert's sign-in (`amr`) counts too, when
+     * the expert signed in through THAT provider and the reported method meets the client's minimum strength. The
+     * accepted claim is recorded as coming from the firm's provider; it is never re-emitted as this application's own.
+     */
+    TRUST_PROVIDER_IDP_MFA = "TRUST_PROVIDER_IDP_MFA"
+}
+/**
+ * How much the firm's expert-activity feed may say about work done in THIS client (#1632).
+ *
+ * The client's side of the feed: the firm decides whether it collects activity metadata about its staff at all
+ * (`SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS`), and the client can switch it off or narrow it for its own tenant. A
+ * feed entry is written only when both allow it, and it never carries the client's content at any level.
+ */
+export declare enum ServiceProviderActivityFeedDisclosure {
+    /** Nothing about work in this client reaches the firm's feed. */
+    NONE = "NONE",
+    /** The firm learns that an operation of a given type ran on a resource type, when, by whom — not whether it succeeded. */
+    OPERATION_TYPE_ONLY = "OPERATION_TYPE_ONLY",
+    /** As above, plus the outcome. Still metadata only. The default. */
+    OPERATION_AND_OUTCOME = "OPERATION_AND_OUTCOME"
+}
+/** @wildo_source:part:end saas.models.organizations.service-provider-client-controls */
+//# sourceMappingURL=service-provider-client-controls.shared.schemas.d.ts.map

package/dist/esm/organizations/service-provider-client-controls.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-client-controls.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,oBAAY,uBAAuB;IACjC,oFAAoF;IACpF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;GAMG;AACH,oBAAY,qCAAqC;IAC/C,iEAAiE;IACjE,IAAI,SAAS;IACb,0HAA0H;IAC1H,mBAAmB,wBAAwB;IAC3C,oEAAoE;IACpE,qBAAqB,0BAA0B;CAChD;AACD,wFAAwF"}

package/dist/esm/organizations/service-provider-client-controls.shared.schemas.js

@@ -0,0 +1,50 @@
+/**
+ * What a CLIENT organization decides, per service-provider relationship, about the firm whose experts work inside it
+ * (#1633, #1632).
+ *
+ * Both settings live on `SERVICE_PROVIDER_RELATIONSHIPS`, the row the client owns, and each is changed only by the
+ * client's own verb. The firm has no verb that writes either, and neither widens what the relationship confers: one
+ * decides how strongly an expert must have proven who they are before acting here, the other how much the firm may
+ * learn afterwards about what its own staff did here.
+ */
+/** @wildo_source:part:start saas.models.organizations.service-provider-client-controls facet:layer:shared facet:audience:app-developer */
+/**
+ * Whether the client accepts the multi-factor proof the FIRM's own identity provider made (#1633).
+ *
+ * The client organization type's authentication policy governs an expert whenever they act in the client, whatever
+ * the firm's policy is. When that policy asks for a second factor, the expert proves it to THIS application for THIS
+ * client, and nothing proven elsewhere counts — unless the client trusts the firm's identity provider here.
+ *
+ * Off by default, as Microsoft Entra's cross-tenant inbound trust is: trusting another organization's MFA is the
+ * RESOURCE tenant's decision, made per partner. Even when on, the client's minimum strength still applies, and an
+ * operation that demands a fresh step-up still demands one.
+ */
+export var ServiceProviderMfaTrust;
+(function (ServiceProviderMfaTrust) {
+    /** Only a factor proven to this application for this client counts. The default. */
+    ServiceProviderMfaTrust["NOT_TRUSTED"] = "NOT_TRUSTED";
+    /**
+     * A factor the firm's own enterprise identity provider reported in the expert's sign-in (`amr`) counts too, when
+     * the expert signed in through THAT provider and the reported method meets the client's minimum strength. The
+     * accepted claim is recorded as coming from the firm's provider; it is never re-emitted as this application's own.
+     */
+    ServiceProviderMfaTrust["TRUST_PROVIDER_IDP_MFA"] = "TRUST_PROVIDER_IDP_MFA";
+})(ServiceProviderMfaTrust || (ServiceProviderMfaTrust = {}));
+/**
+ * How much the firm's expert-activity feed may say about work done in THIS client (#1632).
+ *
+ * The client's side of the feed: the firm decides whether it collects activity metadata about its staff at all
+ * (`SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS`), and the client can switch it off or narrow it for its own tenant. A
+ * feed entry is written only when both allow it, and it never carries the client's content at any level.
+ */
+export var ServiceProviderActivityFeedDisclosure;
+(function (ServiceProviderActivityFeedDisclosure) {
+    /** Nothing about work in this client reaches the firm's feed. */
+    ServiceProviderActivityFeedDisclosure["NONE"] = "NONE";
+    /** The firm learns that an operation of a given type ran on a resource type, when, by whom — not whether it succeeded. */
+    ServiceProviderActivityFeedDisclosure["OPERATION_TYPE_ONLY"] = "OPERATION_TYPE_ONLY";
+    /** As above, plus the outcome. Still metadata only. The default. */
+    ServiceProviderActivityFeedDisclosure["OPERATION_AND_OUTCOME"] = "OPERATION_AND_OUTCOME";
+})(ServiceProviderActivityFeedDisclosure || (ServiceProviderActivityFeedDisclosure = {}));
+/** @wildo_source:part:end saas.models.organizations.service-provider-client-controls */
+//# sourceMappingURL=service-provider-client-controls.shared.schemas.js.map

package/dist/esm/organizations/service-provider-client-controls.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-client-controls.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,oFAAoF;IACpF,sDAA2B,CAAA;IAC3B;;;;OAIG;IACH,4EAAiD,CAAA;AACnD,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,qCAOX;AAPD,WAAY,qCAAqC;IAC/C,iEAAiE;IACjE,sDAAa,CAAA;IACb,0HAA0H;IAC1H,oFAA2C,CAAA;IAC3C,oEAAoE;IACpE,wFAA+C,CAAA;AACjD,CAAC,EAPW,qCAAqC,KAArC,qCAAqC,QAOhD;AACD,wFAAwF","sourcesContent":["/**\n * What a CLIENT organization decides, per service-provider relationship, about the firm whose experts work inside it\n * (#1633, #1632).\n *\n * Both settings live on `SERVICE_PROVIDER_RELATIONSHIPS`, the row the client owns, and each is changed only by the\n * client's own verb. The firm has no verb that writes either, and neither widens what the relationship confers: one\n * decides how strongly an expert must have proven who they are before acting here, the other how much the firm may\n * learn afterwards about what its own staff did here.\n */\n\n/** @wildo_source:part:start saas.models.organizations.service-provider-client-controls facet:layer:shared facet:audience:app-developer */\n/**\n * Whether the client accepts the multi-factor proof the FIRM's own identity provider made (#1633).\n *\n * The client organization type's authentication policy governs an expert whenever they act in the client, whatever\n * the firm's policy is. When that policy asks for a second factor, the expert proves it to THIS application for THIS\n * client, and nothing proven elsewhere counts — unless the client trusts the firm's identity provider here.\n *\n * Off by default, as Microsoft Entra's cross-tenant inbound trust is: trusting another organization's MFA is the\n * RESOURCE tenant's decision, made per partner. Even when on, the client's minimum strength still applies, and an\n * operation that demands a fresh step-up still demands one.\n */\nexport enum ServiceProviderMfaTrust {\n  /** Only a factor proven to this application for this client counts. The default. */\n  NOT_TRUSTED = 'NOT_TRUSTED',\n  /**\n   * A factor the firm's own enterprise identity provider reported in the expert's sign-in (`amr`) counts too, when\n   * the expert signed in through THAT provider and the reported method meets the client's minimum strength. The\n   * accepted claim is recorded as coming from the firm's provider; it is never re-emitted as this application's own.\n   */\n  TRUST_PROVIDER_IDP_MFA = 'TRUST_PROVIDER_IDP_MFA',\n}\n\n/**\n * How much the firm's expert-activity feed may say about work done in THIS client (#1632).\n *\n * The client's side of the feed: the firm decides whether it collects activity metadata about its staff at all\n * (`SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS`), and the client can switch it off or narrow it for its own tenant. A\n * feed entry is written only when both allow it, and it never carries the client's content at any level.\n */\nexport enum ServiceProviderActivityFeedDisclosure {\n  /** Nothing about work in this client reaches the firm's feed. */\n  NONE = 'NONE',\n  /** The firm learns that an operation of a given type ran on a resource type, when, by whom — not whether it succeeded. */\n  OPERATION_TYPE_ONLY = 'OPERATION_TYPE_ONLY',\n  /** As above, plus the outcome. Still metadata only. The default. */\n  OPERATION_AND_OUTCOME = 'OPERATION_AND_OUTCOME',\n}\n/** @wildo_source:part:end saas.models.organizations.service-provider-client-controls */\n"]}

package/dist/esm/organizations/service-provider-relationships.shared.resources-config.schemas.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Service-provider relationships — resource configurations for the three resources (#1597).
+ *
+ * The asymmetry is the design: the CLIENT's verbs are on the relationship (client scope), the FIRM's
+ * verbs are on its engagement mirror (firm scope), and each side's counterpart row is written by the
+ * system inside the same transaction. No verb here declares `admitsCrossTenantPlatformAdministration`:
+ * nobody reaches into the other tenant through a request.
+ *
+ * Every lifecycle verb is HIGH risk, and the two that CONFER — the client accepting a firm's proposal and
+ * the client widening a relationship's scope — demand the client ORG_OWNER plus step-up, because they
+ * hand people outside the organization a membership inside it.
+ *
+ * See `service-provider-relationships.shared.schemas.ts` for the model.
+ */
+import { z } from 'zod';
+import { ServiceEngagementAssignmentStatus, ServiceProviderExpertAdmissionPolicy, ServiceEngagementAssignments_Operations, ServiceEngagements_Operations, ServiceProviderRelationshipStatus, ServiceProviderRelationships_Operations } from './service-provider-relationships.shared.schemas';
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import { type ResourceRelationship } from '../resources/resources.shared.schemas';
+import { ServiceProviderActivityFeedDisclosure, ServiceProviderMfaTrust } from './service-provider-client-controls.shared.schemas';
+type RelationshipCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY | CoreResourceOperation.DELETE;
+export declare const serviceProviderRelationshipsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<typeof ServiceProviderRelationships_Operations, RelationshipCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    providerOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    providerOrganizationName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceProviderRelationshipStatus>>>>>>>>;
+    role: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    organizationUnitIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>>>;
+    endsAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>>>;
+    purpose: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    admittedMachineClientIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>>>;
+    admittedAutonomousAgents: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        oauthClientId: z.ZodString;
+        autonomousAgentRefs: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>>>>;
+    expertAdmissionPolicy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>>>>>>>;
+    providerMfaTrust: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceProviderMfaTrust>>>>>>>;
+    activityFeedDisclosure: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceProviderActivityFeedDisclosure>>>>>>>;
+    proposedByOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    proposedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    acceptedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    acceptedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    endedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    endedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>>;
+    decisionReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+export declare const serviceEngagementsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<typeof ServiceEngagements_Operations, RelationshipCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    clientOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    serviceProviderRelationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceProviderRelationshipStatus>>>>>>>;
+    role: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    scopedToOrganizationUnits: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>>;
+    endsAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>;
+    purpose: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    proposedByOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    clientOrganizationName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    expertAdmissionPolicy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>>>>>>;
+    delegatedCapabilities: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        capability: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./service-provider-capability-grants.shared.schemas").DelegatedAdministrativeCapability>>;
+        endsAt: z.ZodDate;
+    }, z.core.$strip>>>>>;
+    endedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+    decisionReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+export declare const serviceEngagementAssignmentsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<typeof ServiceEngagementAssignments_Operations, RelationshipCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    serviceEngagementId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    serviceProviderRelationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    clientOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceEngagementAssignmentStatus>>>>>>>>;
+    assignedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    assignedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    approvalDecisionId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    approvalResolvedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    approvalDenialReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./service-provider-relationships.shared.schemas").ServiceProviderExpertApprovalDenialReason>>>>>;
+    approvalLapseAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>;
+    approvalDecisionDeadlineAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>;
+    approvalDecisionWarningAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>;
+    approvalDecisionClockBasis: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").ReviewClockBasis>>>>>>;
+    approvalDecisionWarningFiredAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>;
+    approvalDecisionMissedFiredAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>;
+    approvalNextDueAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNullable<z.ZodDate>>>>>>;
+    endedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    endedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+export {};
+//# sourceMappingURL=service-provider-relationships.shared.resources-config.schemas.d.ts.map

package/dist/esm/organizations/service-provider-relationships.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-relationships.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-relationships.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iCAAiC,EACjC,oCAAoC,EACpC,uCAAuC,EAEvC,6BAA6B,EAE7B,iCAAiC,EACjC,uCAAuC,EACxC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AA+DnI,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AA6BjC,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsRlI,CAAC;AAIL,eAAO,MAAM,6DAA6D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;kBA0GxH,CAAC;AAIL,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;kBAqHlI,CAAC"}