@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/config/configuration-validation.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"configuration-validation.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/configuration-validation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAN,IAAY,+BAGX;AAHD,WAAY,+BAA+B;IACzC,kDAAe,CAAA;IACf,sDAAmB,CAAA;AACrB,CAAC,EAHW,+BAA+B,KAA/B,+BAA+B,QAG1C;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,CAAN,IAAY,6BAoBX;AApBD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,8CAAa,CAAA;IACb,kDAAiB,CAAA;IACjB,wEAAuC,CAAA;IACvC,sDAAqB,CAAA;IACrB,oDAAmB,CAAA;IACnB,wDAAuB,CAAA;IACvB,8CAAa,CAAA;IACb;;;;;;;;;OASG;IACH,4CAAW,CAAA;AACb,CAAC,EApBW,6BAA6B,KAA7B,6BAA6B,QAoBxC;AAsBD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CAAC,MAAsC;IAC1E,OAAO;QACL,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,+BAA+B,CAAC,KAAK,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzF,CAAC","sourcesContent":["/**\n * Configuration Validation — shared contract for startup cross-checks.\n *\n * Used by both backend (ApplicationStartupConfigValidatorService) and\n * frontend (future AppShellConfigValidatorService) to produce structured\n * validation reports after registry initialization.\n *\n * Each validator returns ConfigurationValidationIssue[] and the runner\n * collects, logs, and optionally throws on errors.\n */\n\n// ---------------------------------------------------------------------------\n// Issue severity\n// ---------------------------------------------------------------------------\n\nexport enum ConfigurationValidationSeverity {\n  ERROR = 'ERROR',\n  WARNING = 'WARNING',\n}\n\n// ---------------------------------------------------------------------------\n// Validation domain — groups related cross-checks\n// ---------------------------------------------------------------------------\n\nexport enum ConfigurationValidationDomain {\n  STORAGE = 'STORAGE',\n  AUTH = 'AUTH',\n  AGENTS = 'AGENTS',\n  FRONTEND_SERVICES = 'FRONTEND_SERVICES',\n  FEATURES = 'FEATURES',\n  BILLING = 'BILLING',\n  LIFECYCLE = 'LIFECYCLE',\n  I18N = 'I18N',\n  /**\n   * RAG derived-data-tier capability checks: `.ragSource()` field declarations cross-referenced\n   * against the owning datastore's vector capability — pgvector on PostgreSQL, `mongot` (MongoDB\n   * Search / Vector Search, a process beside `mongod`) on MongoDB. Both are proven by EXECUTING a\n   * command on the live connection rather than by reading a version, because a server can report a\n   * capable version while lacking the extension or the sidecar that implements it.\n   *\n   * Fail-closed at boot because chunks already written into an unreachable store are an ERASURE\n   * dead-end, not merely a degraded feature.\n   */\n  RAG = 'RAG',\n}\n\n// ---------------------------------------------------------------------------\n// Issue shape\n// ---------------------------------------------------------------------------\n\nexport interface ConfigurationValidationIssue {\n  severity: ConfigurationValidationSeverity;\n  domain: ConfigurationValidationDomain;\n  message: string;\n  context?: Record<string, unknown>;\n}\n\n// ---------------------------------------------------------------------------\n// Aggregated result\n// ---------------------------------------------------------------------------\n\nexport interface ConfigurationValidationResult {\n  issues: ConfigurationValidationIssue[];\n  valid: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nexport function buildValidationResult(issues: ConfigurationValidationIssue[]): ConfigurationValidationResult {\n  return {\n    issues,\n    valid: issues.every((i) => i.severity !== ConfigurationValidationSeverity.ERROR),\n  };\n}\n\nexport function issueError(\n  domain: ConfigurationValidationDomain,\n  message: string,\n  context?: Record<string, unknown>,\n): ConfigurationValidationIssue {\n  return { severity: ConfigurationValidationSeverity.ERROR, domain, message, context };\n}\n\nexport function issueWarning(\n  domain: ConfigurationValidationDomain,\n  message: string,\n  context?: Record<string, unknown>,\n): ConfigurationValidationIssue {\n  return { severity: ConfigurationValidationSeverity.WARNING, domain, message, context };\n}\n"]}
+{"version":3,"file":"configuration-validation.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/configuration-validation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAN,IAAY,+BAGX;AAHD,WAAY,+BAA+B;IACzC,kDAAe,CAAA;IACf,sDAAmB,CAAA;AACrB,CAAC,EAHW,+BAA+B,KAA/B,+BAA+B,QAG1C;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,CAAN,IAAY,6BAoBX;AApBD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,8CAAa,CAAA;IACb,kDAAiB,CAAA;IACjB,wEAAuC,CAAA;IACvC,sDAAqB,CAAA;IACrB,oDAAmB,CAAA;IACnB,wDAAuB,CAAA;IACvB,8CAAa,CAAA;IACb;;;;;;;;;OASG;IACH,4CAAW,CAAA;AACb,CAAC,EApBW,6BAA6B,KAA7B,6BAA6B,QAoBxC;AAsBD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CAAC,MAAsC;IAC1E,OAAO;QACL,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,+BAA+B,CAAC,KAAK,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzF,CAAC","sourcesContent":["/**\n * Configuration Validation — shared contract for startup cross-checks.\n *\n * Used by both backend (ApplicationStartupConfigValidatorService) and\n * frontend (future AppShellConfigValidatorService) to produce structured\n * validation reports after registry initialization.\n *\n * Each validator returns ConfigurationValidationIssue[] and the runner\n * collects, logs, and optionally throws on errors.\n */\n\n// ---------------------------------------------------------------------------\n// Issue severity\n// ---------------------------------------------------------------------------\n\nexport enum ConfigurationValidationSeverity {\n  ERROR = 'ERROR',\n  WARNING = 'WARNING',\n}\n\n// ---------------------------------------------------------------------------\n// Validation domain — groups related cross-checks\n// ---------------------------------------------------------------------------\n\nexport enum ConfigurationValidationDomain {\n  STORAGE = 'STORAGE',\n  AUTH = 'AUTH',\n  AGENTS = 'AGENTS',\n  FRONTEND_SERVICES = 'FRONTEND_SERVICES',\n  FEATURES = 'FEATURES',\n  BILLING = 'BILLING',\n  LIFECYCLE = 'LIFECYCLE',\n  I18N = 'I18N',\n  /**\n   * RAG derived-data-tier capability checks: `.ragSource()` field declarations cross-referenced\n   * against the owning datastore's vector capability — pgvector on PostgreSQL, `mongot` (MongoDB\n   * Search / Vector Search, a process beside `mongod`) on MongoDB. Both are proven by EXECUTING a\n   * command on the live connection rather than by reading a version, because a server can report a\n   * capable version while lacking the extension or the sidecar that implements it.\n   *\n   * Fail-closed at boot because chunks already written into an unreachable store are an ERASURE\n   * dead-end, not merely a degraded feature.\n   */\n  RAG = 'RAG',\n}\n\n// ---------------------------------------------------------------------------\n// Issue shape\n// ---------------------------------------------------------------------------\n\nexport interface ConfigurationValidationIssue {\n  severity: ConfigurationValidationSeverity;\n  domain: ConfigurationValidationDomain;\n  message: string;\n  context?: Record<string, unknown>;\n}\n\n// ---------------------------------------------------------------------------\n// Aggregated result\n// ---------------------------------------------------------------------------\n\nexport interface ConfigurationValidationResult {\n  issues: ConfigurationValidationIssue[];\n  valid: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nexport function buildValidationResult(issues: ConfigurationValidationIssue[]): ConfigurationValidationResult {\n  return {\n    issues,\n    valid: issues.every((i) => i.severity !== ConfigurationValidationSeverity.ERROR),\n  };\n}\n\nexport function issueError(\n  domain: ConfigurationValidationDomain,\n  message: string,\n  context?: Record<string, unknown>,\n): ConfigurationValidationIssue {\n  return { severity: ConfigurationValidationSeverity.ERROR, domain, message, context };\n}\n\nexport function issueWarning(\n  domain: ConfigurationValidationDomain,\n  message: string,\n  context?: Record<string, unknown>,\n): ConfigurationValidationIssue {\n  return { severity: ConfigurationValidationSeverity.WARNING, domain, message, context };\n}\n"]}

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts

@@ -17,6 +17,7 @@ import { AuthMethod } from '../security/authentications/authentication.shared.sc
 import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';
 import { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';
 import { AppFrontendType } from './app-frontend-type.shared.schemas';
+import { ServiceProviderExpertAdmissionPolicy } from '../organizations/service-provider-relationships.shared.schemas';
 /** Canonical registration-policy discriminant. */
 export declare enum RegistrationMode {
     OPEN = "open",
@@ -640,6 +641,37 @@ export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
         defaultOwnerRole: z.ZodDefault<z.ZodString>;
     }, z.core.$strip>>;
     ownsApplication: z.ZodOptional<z.ZodLiteral<true>>;
+    servesAsProvider: z.ZodOptional<z.ZodObject<{
+        clientOrganizationTypes: z.ZodArray<z.ZodString>;
+        providerRoles: z.ZodArray<z.ZodString>;
+        defaultProviderRole: z.ZodString;
+    }, z.core.$strip>>;
+    acceptsServiceProviders: z.ZodOptional<z.ZodObject<{
+        defaultExpertAdmissionPolicy: z.ZodOptional<z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>>;
+        securityCriticalCapabilityMaxDays: z.ZodOptional<z.ZodNumber>;
+        expertApprovalDeadlines: z.ZodOptional<z.ZodObject<{
+            lapseAfter: z.ZodOptional<z.ZodString>;
+            claim: z.ZodOptional<z.ZodObject<{
+                at: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                    fractionOfLapse: z.ZodNumber;
+                }, z.core.$strip>]>;
+                basis: z.ZodOptional<z.ZodEnum<typeof import("..").ReviewClockBasis>>;
+                warnBefore: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            decision: z.ZodOptional<z.ZodObject<{
+                at: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                    fractionOfLapse: z.ZodNumber;
+                }, z.core.$strip>]>;
+                basis: z.ZodOptional<z.ZodEnum<typeof import("..").ReviewClockBasis>>;
+                warnBefore: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                stage: z.ZodEnum<typeof import("..").ReviewDeadlineStage>;
+                action: z.ZodEnum<typeof import("..").ReviewEscalationActionKind>;
+            }, z.core.$strip>>>;
+            pauseStates: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;
 /** @wildo_source:part:end saas.models.config.organization-types */
@@ -788,6 +820,12 @@ export type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema
  *
  * Authored in `wildo.saas.config.ts` (not the backend config) so the platform, which seeds the first
  * organization, can read it.
+ *
+ * A type key is letters, digits, `_` and `-` only (#1851): it is also the last segment of its label key,
+ * `system_enums.OrganizationType.<type>`, and the label tree is addressed by dotted path. A dotted key would name a
+ * label nobody could resolve, so the type would show its raw key for ever with nothing reporting why, and a key
+ * `acme.eu` beside `acme` would need `acme` to be both a word and a branch. The reviewers' reason codes refuse a dot
+ * for the same reason (`AgentWorkReasonCodeSchema`); both test it with `isLabelKeySegment`.
  */
 export declare const OrganizationTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     userTypes: z.ZodArray<z.ZodString>;
@@ -829,6 +867,37 @@ export declare const OrganizationTypesConfigSchema: z.ZodRecord<z.ZodString, z.Z
         defaultOwnerRole: z.ZodDefault<z.ZodString>;
     }, z.core.$strip>>;
     ownsApplication: z.ZodOptional<z.ZodLiteral<true>>;
+    servesAsProvider: z.ZodOptional<z.ZodObject<{
+        clientOrganizationTypes: z.ZodArray<z.ZodString>;
+        providerRoles: z.ZodArray<z.ZodString>;
+        defaultProviderRole: z.ZodString;
+    }, z.core.$strip>>;
+    acceptsServiceProviders: z.ZodOptional<z.ZodObject<{
+        defaultExpertAdmissionPolicy: z.ZodOptional<z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>>;
+        securityCriticalCapabilityMaxDays: z.ZodOptional<z.ZodNumber>;
+        expertApprovalDeadlines: z.ZodOptional<z.ZodObject<{
+            lapseAfter: z.ZodOptional<z.ZodString>;
+            claim: z.ZodOptional<z.ZodObject<{
+                at: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                    fractionOfLapse: z.ZodNumber;
+                }, z.core.$strip>]>;
+                basis: z.ZodOptional<z.ZodEnum<typeof import("..").ReviewClockBasis>>;
+                warnBefore: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            decision: z.ZodOptional<z.ZodObject<{
+                at: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                    fractionOfLapse: z.ZodNumber;
+                }, z.core.$strip>]>;
+                basis: z.ZodOptional<z.ZodEnum<typeof import("..").ReviewClockBasis>>;
+                warnBefore: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                stage: z.ZodEnum<typeof import("..").ReviewDeadlineStage>;
+                action: z.ZodEnum<typeof import("..").ReviewEscalationActionKind>;
+            }, z.core.$strip>>>;
+            pauseStates: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>>;
 export type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;
 export interface OrganizationTypeRegistrationCreationMatch<TDefinition extends {

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAQrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,2BAA2B;IAC3B,YAAY,iBAAiB;IAC7B,6EAA6E;IAC7E,UAAU,eAAe;CAC1B;AACD,6DAA6D;AAE7D,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AActF,eAAO,MAAM,qBAAqB;;;;;;;iBAYhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;IAEzF;;;;;;;;;;;;;;;;;;;OAmBG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;;;;;;;;;;IAEH,yGAAyG;;kBA0FzG,CAAC;AACH,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,GAAG,IAAI,GAAG,SAAS,GACnF,4BAA4B,CAE9B;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAwCrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAiBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;QAlQnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;QAEzF;;;;;;;;;;;;;;;;;;;WAmBG;;QAEH;;;;;;;;;;;;;;;;WAgBG;;;;;;;;;;;QAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsRzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;YApVnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkTzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgF3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;YAzkBhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAghBxB,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6EtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE;AAED;;;GAGG;AACH,oBAAY,sCAAsC;IAChD,0HAA0H;IAC1H,sBAAsB,2BAA2B;IACjD,kHAAkH;IAClH,yBAAyB,8BAA8B;IACvD,mIAAmI;IACnI,4BAA4B,iCAAiC;CAC9D;AAED;;;;;;;;GAQG;AACH,oBAAY,iCAAiC;IAC3C,gEAAgE;IAChE,OAAO,YAAY;IACnB,6BAA6B;IAC7B,IAAI,SAAS;IACb,qFAAqF;IACrF,SAAS,cAAc;CACxB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,IAAI,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAW9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,wCAAwC,CACtD,iBAAiB,EACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GACpG,SAAS,EACb,2BAA2B,EAAE,SAAS,MAAM,EAAE,GAC7C,0BAA0B,CAU5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oCAAoC,CAClD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAC7H,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,CAGR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,GAC3F,0BAA0B,CAM5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GAC/D,0BAA0B,CAE5B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yCAAyC,CACvD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAClG,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,0BAA0B,CAS5B"}
+{"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gEAAgE,CAAC;AAUtH,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,2BAA2B;IAC3B,YAAY,iBAAiB;IAC7B,6EAA6E;IAC7E,UAAU,eAAe;CAC1B;AACD,6DAA6D;AAE7D,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AActF,eAAO,MAAM,qBAAqB;;;;;;;iBAYhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;IAEzF;;;;;;;;;;;;;;;;;;;OAmBG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;;;;;;;;;;IAEH,yGAAyG;;kBA0FzG,CAAC;AACH,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,GAAG,IAAI,GAAG,SAAS,GACnF,4BAA4B,CAE9B;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAwCrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAiBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;QAlQnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;QAEzF;;;;;;;;;;;;;;;;;;;WAmBG;;QAEH;;;;;;;;;;;;;;;;WAgBG;;;;;;;;;;;QAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsRzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;YApVnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkTzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0J3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;YAnpBhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0lBxB,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwFtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE;AAED;;;GAGG;AACH,oBAAY,sCAAsC;IAChD,0HAA0H;IAC1H,sBAAsB,2BAA2B;IACjD,kHAAkH;IAClH,yBAAyB,8BAA8B;IACvD,mIAAmI;IACnI,4BAA4B,iCAAiC;CAC9D;AAED;;;;;;;;GAQG;AACH,oBAAY,iCAAiC;IAC3C,gEAAgE;IAChE,OAAO,YAAY;IACnB,6BAA6B;IAC7B,IAAI,SAAS;IACb,qFAAqF;IACrF,SAAS,cAAc;CACxB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,IAAI,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAW9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,wCAAwC,CACtD,iBAAiB,EACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GACpG,SAAS,EACb,2BAA2B,EAAE,SAAS,MAAM,EAAE,GAC7C,0BAA0B,CAU5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oCAAoC,CAClD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAC7H,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,CAGR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,GAC3F,0BAA0B,CAM5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GAC/D,0BAA0B,CAE5B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yCAAyC,CACvD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAClG,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,0BAA0B,CAS5B"}

package/dist/esm/config/entity-identity-config.shared.schemas.js

@@ -17,6 +17,10 @@ import { AuthMethod } from '../security/authentications/authentication.shared.sc
 import { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
 import { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas.js';
 import { AppFrontendType } from './app-frontend-type.shared.schemas.js';
+import { isLabelKeySegment } from '../i18n/application-config-vocabulary.shared.js';
+import { ServiceProviderExpertAdmissionPolicy } from '../organizations/service-provider-relationships.shared.schemas.js';
+import { ReviewDeadlinesDeclarationSchema } from '../flows-actors/review-deadlines.shared.schemas.js';
+import { SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS } from '../organizations/service-provider-capability-grants.shared.schemas.js';
 import { OnboardingSurveyQuestionSchema, SURVEY_QUESTION_TYPES_WHOSE_ANSWER_IS_A_VALUE, } from './frontend/onboarding.shared.schemas.js';
 // ─── Enums ──────────────────────────────────────────────────────────────────
 /** Canonical registration-policy discriminant. */
@@ -647,6 +651,78 @@ export const OrganizationTypeDefinitionSchema = z.object({
      * statement is how a declaration comes to disagree with itself.
      */
     ownsApplication: z.literal(true).optional(),
+    /**
+     * This type's organizations are SERVICE FIRMS whose experts work inside client organizations (#1597).
+     *
+     * Declaring it lets an organization of this type enter service-provider relationships with
+     * organizations of the listed client types. A relationship is always the client's to accept, scope and
+     * end; the firm assigns which of its members serve it, and each assigned expert receives a membership
+     * in the client carrying the relationship's role — re-checked on every request.
+     *
+     * ```ts
+     * organizationTypes: {
+     *   workspace: {
+     *     userTypes: ['member'],
+     *     availableOrgRoles: ['ORG_OWNER', 'ORG_ADMIN', 'ORG_MEMBER', 'ORG_SERVICE_PROVIDER'],
+     *     servesAsProvider: {
+     *       clientOrganizationTypes: ['workspace'],
+     *       providerRoles: ['ORG_SERVICE_PROVIDER'],
+     *       defaultProviderRole: 'ORG_SERVICE_PROVIDER',
+     *     },
+     *   },
+     * }
+     * ```
+     *
+     * Startup refuses:
+     * - a provider role that leads up to `ORG_ADMIN` — a relationship never confers administration of the
+     *   client (a narrow, time-bound delegation is a separate mechanism);
+     * - a provider role that a client type does not list in its `availableOrgRoles`;
+     * - a `defaultProviderRole` that is not one of `providerRoles`, and a client type that is not declared.
+     *
+     * The core `ORG_SERVICE_PROVIDER` role (inherits `ORG_MEMBER`) is the usual choice.
+     */
+    servesAsProvider: z.object({
+        clientOrganizationTypes: z.array(z.string().min(1)).min(1),
+        providerRoles: z.array(z.string().min(1)).min(1),
+        defaultProviderRole: z.string().min(1),
+    }).optional(),
+    /**
+     * How organizations of this type, as CLIENTS of a service firm, admit the firm's experts by default (#1612).
+     *
+     * Each relationship carries its own `expertAdmissionPolicy`, chosen by the client when it proposes or accepts and
+     * changed later by a client administrator; this is only where that choice STARTS when the client makes none —
+     * for instance a firm's proposal the client has not accepted yet. The relationship's value always wins. It sits
+     * on the CLIENT type because the client owns the choice: a firm's type never decides who enters another tenant.
+     *
+     * ```ts
+     * organizationTypes: {
+     *   lawClient: {
+     *     // …
+     *     acceptsServiceProviders: { defaultExpertAdmissionPolicy: ServiceProviderExpertAdmissionPolicy.CLIENT_APPROVES_EACH_EXPERT },
+     *   },
+     * }
+     * ```
+     *
+     * Absent: every expert a firm assigns is admitted (`RELATIONSHIP_APPROVES_ASSIGNED_EXPERTS`), the #1597 behaviour.
+     */
+    acceptsServiceProviders: z.object({
+        defaultExpertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy).optional(),
+        /**
+         * The longest, in days, an organization of this type may lend a service firm a SECURITY-CRITICAL administrative
+         * capability (SSO/SCIM, API keys, access-grant approval — #1631). Lowers the framework's 30-day cap; it can never
+         * raise it. Ordinary capabilities keep their two-year maximum.
+         */
+        securityCriticalCapabilityMaxDays: z.number().int().min(1).max(SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS).optional(),
+        /**
+         * When a client's pending approval of one of a firm's experts lapses, and who is reminded before it does (#1909) —
+         * #1628's deadline declaration, on this plane: `lapseAfter` (ISO-8601, e.g. `'P14D'`), a `decision` target with
+         * an optional `warnBefore`, and NOTIFY `rules`. There is no `claim`, no REASSIGN and no `pauseStates`: the
+         * approval is routed to the client's administrators as a group, offers only an answer, and startup refuses a
+         * declaration asking for more. Absent: the framework defaults every human decision gets (a 24-hour lapse, a
+         * reminder to the administrators at three quarters of it). A lapsed approval admits nobody; the firm assigns again.
+         */
+        expertApprovalDeadlines: ReviewDeadlinesDeclarationSchema.optional(),
+    }).optional(),
 });
 /** @wildo_source:part:end saas.models.config.organization-types */
 // ─── Top-Level Config Sections ──────────────────────────────────────────────
@@ -667,10 +743,27 @@ export const FrontendServicesConfigSchema = z.record(z.string(), FrontendService
  *
  * Authored in `wildo.saas.config.ts` (not the backend config) so the platform, which seeds the first
  * organization, can read it.
+ *
+ * A type key is letters, digits, `_` and `-` only (#1851): it is also the last segment of its label key,
+ * `system_enums.OrganizationType.<type>`, and the label tree is addressed by dotted path. A dotted key would name a
+ * label nobody could resolve, so the type would show its raw key for ever with nothing reporting why, and a key
+ * `acme.eu` beside `acme` would need `acme` to be both a word and a branch. The reviewers' reason codes refuse a dot
+ * for the same reason (`AgentWorkReasonCodeSchema`); both test it with `isLabelKeySegment`.
  */
 export const OrganizationTypesConfigSchema = z
     .record(z.string(), OrganizationTypeDefinitionSchema)
     .superRefine((organizationTypes, ctx) => {
+    // Checked here rather than as a record-key schema, whose failure Zod reports only as "Invalid key in record".
+    for (const typeKey of Object.keys(organizationTypes)) {
+        if (!isLabelKeySegment(typeKey)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: [typeKey],
+                message: `Organization type key "${typeKey}" may contain only letters, digits, "_" and "-": it is also the last `
+                    + 'segment of its label key, system_enums.OrganizationType.<type>, which is addressed by dotted path.',
+            });
+        }
+    }
     if (Object.keys(organizationTypes).length === 0) {
         ctx.addIssue({
             code: 'custom',