@wildo-ai/saas-models 1.1.6 → 1.1.7

package/dist/esm/organizations/organization-members.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-members.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AAQjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAuNnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"organization-members.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AAQjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAuNnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/organizations/organization-members.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-members.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;OAcG;IACH,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,gGAAgG;IAChG,mDAAmD;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SAC5G,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,CAAC;IACjE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qGAAqG;IACrG,uGAAuG;IACvG,0FAA0F;IAC1F,EAAE;IACF,qGAAqG;IACrG,uGAAuG;IACvG,oGAAoG;IACpG,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE;SAChG,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EACvD,aAAa,CAAC,MAAM,CACrB;IACD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;;;;;OAQG;IACH,wFAAwF;IACxF,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,6EAA6E;IAC7E,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACpH;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;SACrC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;SACxC,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;QACpB,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,yFAAyF;QACzF,sEAAsE;QACtE,8FAA8F;QAC9F,uFAAuF;QACvF,qDAAqD;SACpD,eAAe,EAAE;IACpB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,+DAA+D;IAC/D,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,gGAAgG;IAChG,kGAAkG;IAClG,qGAAqG;IACrG,yEAAyE;IACzE,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAC5D,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpF;;;;;;;;;;;;;;OAcG;IACH,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SACvF,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC5D;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAChF,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC5D;;;;OAIG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACjH;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,QAAQ;QACpB,eAAe,EAAE,gBAAgB,CAAC,aAAa;QAC/C,gBAAgB,EAAE,QAAQ;QAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,aAAa,EAAE,WAAW;KAC3B,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC","sourcesContent":["\n/**\n * Organization Member Shared Schemas\n * \n * Junction entity between users and organizations with roles and permissions\n */\n\nimport { z } from 'zod';\n\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { forwardedLabel } from '../resources/resources.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\n\n/**\n * Organization member lifecycle status.\n *\n * A membership row IS the invitation — there is no separate invitation\n * collection. `INVITED` is the pending-membership state; acceptance flips it to\n * `ACTIVE` on the SAME row (stable `_id`, so the emailed accept-link token never\n * orphans). SSO JIT / SCIM provisioning find-or-activate an existing `INVITED`\n * row rather than blind-creating a second `ACTIVE` one.\n *\n * - `INVITED`  — membership extended, invitee has not yet accepted. Paired with a\n *   `User` in `PENDING_INVITATION` status when the invitee has no account yet.\n * - `ACTIVE`   — accepted / directly provisioned membership.\n * - `INACTIVE` — deactivated (e.g. SCIM deprovision).\n * - `SUSPENDED` — temporarily suspended (optionally time-boxed).\n *\n * Invite OUTCOMES (declined / revoked / expired) are NOT statuses — the row is\n * deleted and the event recorded in the audit trail (keeps this enum about\n * membership, not invitation bookkeeping).\n */\nexport enum OrganizationMemberStatus {\n  INVITED = 'INVITED',\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED'\n}\n\nexport const OrganizationMemberSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * FK to the member `User`. ALWAYS present on a persisted row (a membership with\n   * no member is meaningless) — even an `INVITED` invitee has an eagerly-created\n   * `User` in `PENDING_INVITATION` status, so this FK is never null.\n   *\n   * SERVER-INJECTED on create (`.excludeFromCreate()`), via one of two paths:\n   *   - Invite (org-admin CREATE): the admin supplies {@link userEmail} instead;\n   *     the CREATE prefix find-or-creates the user by normalized email and injects\n   *     the resolved `_id` here (email is the strict unique identity anchor — see\n   *     `User.email.isUnique()`).\n   *   - System provisioning (invite-acceptance / SSO JIT / SCIM): passes `userId`\n   *     directly through `createAsSystem`, which re-attaches this context FK past\n   *     the strict-DTO strip.\n   * `.excludeFromUpdate()` keeps the member↔user binding immutable.\n   */\n  // `labelFallbackField` names the readable copy this row already carries, for when the reference\n  // cannot be resolved. `userEmail` below is `.isHidden({ display: true })` on the stated grounds\n  // that \"the user-facing email is surfaced by resolving the `userId` reference\" — and for an\n  // INVITED person that resolution has nothing to build a label from, because there is no\n  // `USER_PROFILE` yet. Measured 2026-09-19 on the member directory: three of four rows rendered\n  // `6aaba6b3a2d3b6b0ad61f33e`, the fourth (a real user) rendered their name. The copy was on the\n  // row the whole time; nothing was reaching for it.\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate()\n    .foreignKeyUI({ display: { labelFallbackField: 'userEmail' } }),\n  /**\n   * The linked user's email — DUAL ROLE:\n   *\n   *   1. INVITE CREATE INPUT. On the org-admin invite CREATE the admin supplies\n   *      an email (not a `userId`); the CREATE prefix normalizes it, find-or-creates\n   *      the `User` by it (unique identity anchor), and derives {@link userId}. This\n   *      is why the field is client-writable on CREATE (no `.excludeFromCreate()`).\n   *   2. DENORMALIZED IMMUTABLE COPY. After creation it is the immutable mirror of\n   *      `USERS.email` (which is `.excludeFromUpdate()`, so this copy never drifts).\n   *      It feeds member SEARCH (`searchableFields: ['userEmail']` — no async hop)\n   *      and the {@link instanceLabel} fallback when the related profile/name is\n   *      unavailable (e.g. a `PENDING_INVITATION` invitee has no `USER_PROFILE` yet).\n   *\n   * For system creates (SSO/SCIM/acceptance) that pass `userId` instead of an\n   * email, the CREATE prefix DERIVES this value from the authoritative user record,\n   * so it is `.optional()` at the input boundary. `.excludeFromUpdate()` keeps it\n   * immutable post-creation. `.isHidden({ display: true })` keeps it out of\n   * auto-rendered display cards/columns (the user-facing email is surfaced by\n   * resolving the `userId` reference) — it still renders on the CREATE form.\n   */\n  // REMOVE on erasure. A denormalized copy of the person's email, held here so a membership row can be\n  // read without resolving the user — which is exactly what makes it personal data this row HOLDS rather\n  // than a link it carries. Clearable (`.optional()`), so REMOVE resolves to a removed key.\n  //\n  // `roles` beside it is deliberately NOT scrubbed: it is this application's authorization vocabulary,\n  // not personal data, and emptying it could strand a tenant with no administrator — the interaction the\n  // administrative-continuity floors exist to refuse. Keeping it means that interaction never arises.\n  userEmail: addImpersonalizeWith(\n    z.email().optional().isDBIndexed().isSummaryField().isHidden({ display: true }).excludeFromUpdate()\n      .dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.REMOVE,\n  ),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /*\n   * `organizationUnitsMembership` (an embedded `[{ organizationUnitId, role }]` array) was REMOVED\n   * here on 2026-07-31 and promoted to the `ORGANIZATION_UNIT_MEMBERS` junction resource\n   * (plan decision D-B5). The array could not be queried portably — a dot-path filter into an\n   * array field resolves to NULL on PostgreSQL and the LIST summary projection strips the field —\n   * so every \"who is assigned to this unit?\" question failed OPEN, it could not carry a registered\n   * relationship (no cascade), and it admitted two conflicting roles for the same unit. Read unit\n   * assignments through `ORGANIZATION_UNIT_MEMBERS` filtered by `organizationMemberId`.\n   */\n  // `.isAuditEvidence()` — this member's authority INSIDE the organization. Roles are the\n  // framework's single authorization axis, so a change here is an access-control decision and the\n  // before/after sets ARE the evidence: a trail that records only \"roles changed\" proves nothing\n  // about what authority resulted. Safe to record in full — a role name is vocabulary, not personal\n  // data, so it carries no erasure obligation into the immutable audit ledger.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  roles: z.array(OrgRolesSchema).default([CORE_ORG_ROLES.ORG_MEMBER]).isDBIndexed().isSummaryField().isAuditEvidence(),\n  /**\n   * Server-owned lifecycle state. Default `ACTIVE` covers direct/system\n   * provisioning (SSO JIT / SCIM / self-registration org-owner grant), while\n   * the org-admin invite CREATE prefix forces `INVITED`.\n   *\n   * Neither CREATE nor generic UPDATE may accept this field from a client:\n   * lifecycle transitions carry security side effects that a field update\n   * cannot reproduce. In particular, invitation acceptance must validate and\n   * consume the invitation token, grant the derived user type, and serialize\n   * against revocation; suspension/reactivation likewise have dedicated\n   * operations. Keeping status out of both DTOs makes those trusted transition\n   * operations the only way to change it.\n   */\n  status: z.enum(OrganizationMemberStatus)\n    .default(OrganizationMemberStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    // Lifecycle state gates access as surely as roles do — a SUSPENDED member is denied, an ACTIVE\n    // one is not — so a suspension or reactivation is an authorization event and its before/after\n    // values are the evidence. The enum's values are closed vocabulary, never personal data, so\n    // recording them carries no GDPR Art. 17 obligation into the immutable ledger — the same\n    // reasoning `UserSchema.status` records. Without this the framework's\n    // `RESOURCE_OPERATION_PERFORMED` event notes only that `status` was among the changed fields,\n    // never what it changed FROM or TO, which is the half an access review actually reads.\n    // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n    .isAuditEvidence(),\n  /**\n   * When an automated sweep must return this membership to `ACTIVE`.\n   *\n   * Set by SUSPEND when the caller time-boxes the suspension (`suspensionEndDate` in that verb's\n   * request contract), cleared by REACTIVATE. Absent means the suspension is indefinite and only a\n   * deliberate REACTIVATE lifts it — which is the default, since an unbounded suspension is the\n   * safer reading of \"suspend\".\n   *\n   * NAMED FOR THE EFFECT, NOT THE CAUSE. `scheduledReactivationAt` says what the system will do;\n   * a `suspensionEndsAt` would describe only the suspension branch while the identical field on\n   * `USERS` also serves self-service deactivation. One concept, one name across both resources,\n   * so the reactivation sweep reads the same field everywhere. The request contracts keep their\n   * own caller-facing vocabulary and the transition hook translates — the same split\n   * `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in, `parentUnitId` + `path` persisted).\n   *\n   * Server-owned on both sides (`.excludeFromCreate().excludeFromUpdate()`): only the transition\n   * operations write it, exactly as for {@link status} above. Indexed because the sweep's whole\n   * query is \"rows whose scheduled reactivation has passed\".\n   *\n   * ⚠️ A value here is a PROMISE the framework keeps: the reactivation batch is what makes it\n   * true. Persisting the date without that sweep would be the same defect as a verb that answers\n   * success and writes nothing — an authored intention nothing honors.\n   */\n  // Deliberately NOT `.isAuditEvidence()`. The rationale that briefly sat here — \"lifecycle state\n  // gates access as surely as roles do\" — is true of {@link status}, which is where it now lives.\n  // This field decides nothing about what the principal may do; it is a scheduling detail, and the\n  // transition's audit row already records the resulting status.\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  // The person's role in the customer's organization — their working life, not this application's\n  // authorization model (`roles` is that, and it is a closed vocabulary rather than personal data).\n  // REMOVE on erasure — the person's role in the customer's organization is a fact about their working\n  // life, which is why it carries PROFESSIONAL. Clearable (`.optional()`).\n  userTitle: addImpersonalizeWith(\n    z.string().max(100).optional().isDBIndexed().isSummaryField()\n    .dataCategories(PersonalDataCategory.PROFESSIONAL),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * The `User._id` of the org admin who issued the invite. Server-set by the invite\n   * CREATE prefix from the execution-context actor; absent on direct/system\n   * provisioning. Immutable. Feeds the audit trail and the user-facing \"invited by\"\n   * cue in the pending-invitations inbox.\n   *\n   * PROVENANCE STAMP, NOT a navigable FK — deliberately a plain indexed string (same\n   * idiom as `scim-tokens.createdByUserId`), NOT `.isForeignKey()`. The primary\n   * member↔user link is `userId` (registered M2M relationship); adding `.isForeignKey()`\n   * here would demand a SECOND `ORGANIZATION_MEMBERS → USERS` relationship (else the\n   * registry warns \"cannot be resolved to a resource type\") and would graft nested-route /\n   * parent-scope machinery onto a field that only records who clicked \"invite\". Resolve\n   * the inviter's display name with a bounded lookup at render time if the cue needs it.\n   */\n  invitedByUserId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * When the invite was issued. Server-set by the invite CREATE prefix; absent on\n   * direct/system provisioning. Immutable. Used by the inbox ordering and the\n   * expiry-reap CRON batch.\n   */\n  invitedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * Present ⇒ this is a PROVIDER membership: held by an expert of a service firm through the client\n   * organization's `SERVICE_PROVIDER_RELATIONSHIPS` row with this id, not by one of the organization's\n   * own members (#1597). Test it with `isServiceProviderMembership`, never by hand.\n   *\n   * It changes what the row means everywhere the framework reads memberships: it confers authority ONLY\n   * while the relationship passes the execution-context live filter; its `roles` are owned by the\n   * relationship (generic UPDATE refuses them); it never counts toward the owner floor and cannot receive\n   * ownership; it grants no user type; it is not part of the client's SCIM directory.\n   *\n   * System-written only — by the firm's assignment verb, which also re-points it when a row left by an\n   * earlier relationship is reactivated. Indexed: \"who serves under this relationship\" is a query by it.\n   * Not a foreign key edge on purpose: the live filter reads the relationship by id, and a navigable edge\n   * would add nested routes onto a membership nobody needs to reach that way.\n   */\n  serviceProviderRelationshipId: z.string().min(1).optional().isDBIndexed().isSummaryField()\n    .excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The firm whose expert holds this provider membership. A plain id: it names another tenant. The live\n   * filter requires the member to hold an ACTIVE, ordinary membership there, in an organization that\n   * still confers authority.\n   */\n  providerOrganizationId: z.string().min(1).optional().isDBIndexed().isSummaryField()\n    .excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The firm's name as its relationship recorded it — what a client's directory shows as \"via {Firm}\".\n   * A snapshot copied from the relationship at assignment, because a client can never read the firm's\n   * organization row (#1597).\n   */\n  providerOrganizationName: z.string().max(200).optional().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * Computed instance label — the linked user's name, forwarded live from\n   * `USER_PROFILES`. A junction row has no inherent name; its identity is the\n   * related party. {@link forwardedLabel} resolves it SERVER-SIDE at read time\n   * (joining `userId` → `USER_PROFILES.userId`, rendering `firstName lastName`)\n   * and projects it onto the summary/read DTO via the virtual-field pipeline, so\n   * the frontend label is a plain field ref (`getFrontendResourceLabel:\n   * ['instanceLabel']`). Never stale (read live), never denormalized, tenant-safe\n   * (a bounded system read over the userIds already on the org-scoped page). NOT\n   * persisted (virtual). When the profile/name is unavailable it falls back to the\n   * immutable {@link userEmail} (`fallbackField`) rather than a raw id.\n   */\n  instanceLabel: forwardedLabel({\n    localField: 'userId',\n    relatedResource: CoreResourceType.USER_PROFILES,\n    relatedJoinField: 'userId',\n    fields: ['firstName', 'lastName'],\n    fallbackField: 'userEmail',\n  }),\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'userId',\n  'organizationId',\n]);\nexport type OrganizationMember = z.infer<typeof OrganizationMemberSchema>;\n"]}
+{"version":3,"file":"organization-members.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;OAcG;IACH,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,gGAAgG;IAChG,mDAAmD;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SAC5G,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,CAAC;IACjE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qGAAqG;IACrG,uGAAuG;IACvG,0FAA0F;IAC1F,EAAE;IACF,qGAAqG;IACrG,uGAAuG;IACvG,oGAAoG;IACpG,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE;SAChG,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EACvD,aAAa,CAAC,MAAM,CACrB;IACD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;;;;;OAQG;IACH,wFAAwF;IACxF,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,6EAA6E;IAC7E,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACpH;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;SACrC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;SACxC,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;QACpB,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,yFAAyF;QACzF,sEAAsE;QACtE,8FAA8F;QAC9F,uFAAuF;QACvF,qDAAqD;SACpD,eAAe,EAAE;IACpB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,+DAA+D;IAC/D,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,gGAAgG;IAChG,kGAAkG;IAClG,qGAAqG;IACrG,yEAAyE;IACzE,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAC5D,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpF;;;;;;;;;;;;;;OAcG;IACH,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SACvF,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC5D;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAChF,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC5D;;;;OAIG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACjH;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,QAAQ;QACpB,eAAe,EAAE,gBAAgB,CAAC,aAAa;QAC/C,gBAAgB,EAAE,QAAQ;QAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,aAAa,EAAE,WAAW;KAC3B,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC","sourcesContent":["\n/**\n * Organization Member Shared Schemas\n * \n * Junction entity between users and organizations with roles and permissions\n */\n\nimport { z } from 'zod';\n\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { forwardedLabel } from '../resources/resources.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\n\n/**\n * Organization member lifecycle status.\n *\n * A membership row IS the invitation — there is no separate invitation\n * collection. `INVITED` is the pending-membership state; acceptance flips it to\n * `ACTIVE` on the SAME row (stable `_id`, so the emailed accept-link token never\n * orphans). SSO JIT / SCIM provisioning find-or-activate an existing `INVITED`\n * row rather than blind-creating a second `ACTIVE` one.\n *\n * - `INVITED`  — membership extended, invitee has not yet accepted. Paired with a\n *   `User` in `PENDING_INVITATION` status when the invitee has no account yet.\n * - `ACTIVE`   — accepted / directly provisioned membership.\n * - `INACTIVE` — deactivated (e.g. SCIM deprovision).\n * - `SUSPENDED` — temporarily suspended (optionally time-boxed).\n *\n * Invite OUTCOMES (declined / revoked / expired) are NOT statuses — the row is\n * deleted and the event recorded in the audit trail (keeps this enum about\n * membership, not invitation bookkeeping).\n */\nexport enum OrganizationMemberStatus {\n  INVITED = 'INVITED',\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED'\n}\n\nexport const OrganizationMemberSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * FK to the member `User`. ALWAYS present on a persisted row (a membership with\n   * no member is meaningless) — even an `INVITED` invitee has an eagerly-created\n   * `User` in `PENDING_INVITATION` status, so this FK is never null.\n   *\n   * SERVER-INJECTED on create (`.excludeFromCreate()`), via one of two paths:\n   *   - Invite (org-admin CREATE): the admin supplies {@link userEmail} instead;\n   *     the CREATE prefix find-or-creates the user by normalized email and injects\n   *     the resolved `_id` here (email is the strict unique identity anchor — see\n   *     `User.email.isUnique()`).\n   *   - System provisioning (invite-acceptance / SSO JIT / SCIM): passes `userId`\n   *     directly through `createAsSystem`, which re-attaches this context FK past\n   *     the strict-DTO strip.\n   * `.excludeFromUpdate()` keeps the member↔user binding immutable.\n   */\n  // `labelFallbackField` names the readable copy this row already carries, for when the reference\n  // cannot be resolved. `userEmail` below is `.isHidden({ display: true })` on the stated grounds\n  // that \"the user-facing email is surfaced by resolving the `userId` reference\" — and for an\n  // INVITED person that resolution has nothing to build a label from, because there is no\n  // `USER_PROFILE` yet. Measured 2026-09-19 on the member directory: three of four rows rendered\n  // `6aaba6b3a2d3b6b0ad61f33e`, the fourth (a real user) rendered their name. The copy was on the\n  // row the whole time; nothing was reaching for it.\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate()\n    .foreignKeyUI({ display: { labelFallbackField: 'userEmail' } }),\n  /**\n   * The linked user's email — DUAL ROLE:\n   *\n   *   1. INVITE CREATE INPUT. On the org-admin invite CREATE the admin supplies\n   *      an email (not a `userId`); the CREATE prefix normalizes it, find-or-creates\n   *      the `User` by it (unique identity anchor), and derives {@link userId}. This\n   *      is why the field is client-writable on CREATE (no `.excludeFromCreate()`).\n   *   2. DENORMALIZED IMMUTABLE COPY. After creation it is the immutable mirror of\n   *      `USERS.email` (which is `.excludeFromUpdate()`, so this copy never drifts).\n   *      It feeds member SEARCH (`searchableFields: ['userEmail']` — no async hop)\n   *      and the {@link instanceLabel} fallback when the related profile/name is\n   *      unavailable (e.g. a `PENDING_INVITATION` invitee has no `USER_PROFILE` yet).\n   *\n   * For system creates (SSO/SCIM/acceptance) that pass `userId` instead of an\n   * email, the CREATE prefix DERIVES this value from the authoritative user record,\n   * so it is `.optional()` at the input boundary. `.excludeFromUpdate()` keeps it\n   * immutable post-creation. `.isHidden({ display: true })` keeps it out of\n   * auto-rendered display cards/columns (the user-facing email is surfaced by\n   * resolving the `userId` reference) — it still renders on the CREATE form.\n   */\n  // REMOVE on erasure. A denormalized copy of the person's email, held here so a membership row can be\n  // read without resolving the user — which is exactly what makes it personal data this row HOLDS rather\n  // than a link it carries. Clearable (`.optional()`), so REMOVE resolves to a removed key.\n  //\n  // `roles` beside it is deliberately NOT scrubbed: it is this application's authorization vocabulary,\n  // not personal data, and emptying it could strand a tenant with no administrator — the interaction the\n  // administrative-continuity floors exist to refuse. Keeping it means that interaction never arises.\n  userEmail: addImpersonalizeWith(\n    z.email().optional().isDBIndexed().isSummaryField().isHidden({ display: true }).excludeFromUpdate()\n      .dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.REMOVE,\n  ),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /*\n   * `organizationUnitsMembership` (an embedded `[{ organizationUnitId, role }]` array) was REMOVED\n   * here on 2026-07-31 and promoted to the `ORGANIZATION_UNIT_MEMBERS` junction resource\n   * (plan decision D-B5). The array could not be queried portably — a dot-path filter into an\n   * array field resolves to NULL on PostgreSQL and the LIST summary projection strips the field —\n   * so every \"who is assigned to this unit?\" question failed OPEN, it could not carry a registered\n   * relationship (no cascade), and it admitted two conflicting roles for the same unit. Read unit\n   * assignments through `ORGANIZATION_UNIT_MEMBERS` filtered by `organizationMemberId`.\n   */\n  // `.isAuditEvidence()` — this member's authority INSIDE the organization. Roles are the\n  // framework's single authorization axis, so a change here is an access-control decision and the\n  // before/after sets ARE the evidence: a trail that records only \"roles changed\" proves nothing\n  // about what authority resulted. Safe to record in full — a role name is vocabulary, not personal\n  // data, so it carries no erasure obligation into the immutable audit ledger.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  roles: z.array(OrgRolesSchema).default([CORE_ORG_ROLES.ORG_MEMBER]).isDBIndexed().isSummaryField().isAuditEvidence(),\n  /**\n   * Server-owned lifecycle state. Default `ACTIVE` covers direct/system\n   * provisioning (SSO JIT / SCIM / self-registration org-owner grant), while\n   * the org-admin invite CREATE prefix forces `INVITED`.\n   *\n   * Neither CREATE nor generic UPDATE may accept this field from a client:\n   * lifecycle transitions carry security side effects that a field update\n   * cannot reproduce. In particular, invitation acceptance must validate and\n   * consume the invitation token, grant the derived user type, and serialize\n   * against revocation; suspension/reactivation likewise have dedicated\n   * operations. Keeping status out of both DTOs makes those trusted transition\n   * operations the only way to change it.\n   */\n  status: z.enum(OrganizationMemberStatus)\n    .default(OrganizationMemberStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    // Lifecycle state gates access as surely as roles do — a SUSPENDED member is denied, an ACTIVE\n    // one is not — so a suspension or reactivation is an authorization event and its before/after\n    // values are the evidence. The enum's values are closed vocabulary, never personal data, so\n    // recording them carries no GDPR Art. 17 obligation into the immutable ledger — the same\n    // reasoning `UserSchema.status` records. Without this the framework's\n    // `RESOURCE_OPERATION_PERFORMED` event notes only that `status` was among the changed fields,\n    // never what it changed FROM or TO, which is the half an access review actually reads.\n    // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n    .isAuditEvidence(),\n  /**\n   * When an automated sweep must return this membership to `ACTIVE`.\n   *\n   * Set by SUSPEND when the caller time-boxes the suspension (`suspensionEndDate` in that verb's\n   * request contract), cleared by REACTIVATE. Absent means the suspension is indefinite and only a\n   * deliberate REACTIVATE lifts it — which is the default, since an unbounded suspension is the\n   * safer reading of \"suspend\".\n   *\n   * NAMED FOR THE EFFECT, NOT THE CAUSE. `scheduledReactivationAt` says what the system will do;\n   * a `suspensionEndsAt` would describe only the suspension branch while the identical field on\n   * `USERS` also serves self-service deactivation. One concept, one name across both resources,\n   * so the reactivation sweep reads the same field everywhere. The request contracts keep their\n   * own caller-facing vocabulary and the transition hook translates — the same split\n   * `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in, `parentUnitId` + `path` persisted).\n   *\n   * Server-owned on both sides (`.excludeFromCreate().excludeFromUpdate()`): only the transition\n   * operations write it, exactly as for {@link status} above. Indexed because the sweep's whole\n   * query is \"rows whose scheduled reactivation has passed\".\n   *\n   * ⚠️ A value here is a PROMISE the framework keeps: the reactivation batch is what makes it\n   * true. Persisting the date without that sweep would be the same defect as a verb that answers\n   * success and writes nothing — an authored intention nothing honors.\n   */\n  // Deliberately NOT `.isAuditEvidence()`. The rationale that briefly sat here — \"lifecycle state\n  // gates access as surely as roles do\" — is true of {@link status}, which is where it now lives.\n  // This field decides nothing about what the principal may do; it is a scheduling detail, and the\n  // transition's audit row already records the resulting status.\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  // The person's role in the customer's organization — their working life, not this application's\n  // authorization model (`roles` is that, and it is a closed vocabulary rather than personal data).\n  // REMOVE on erasure — the person's role in the customer's organization is a fact about their working\n  // life, which is why it carries PROFESSIONAL. Clearable (`.optional()`).\n  userTitle: addImpersonalizeWith(\n    z.string().max(100).optional().isDBIndexed().isSummaryField()\n    .dataCategories(PersonalDataCategory.PROFESSIONAL),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * The `User._id` of the org admin who issued the invite. Server-set by the invite\n   * CREATE prefix from the execution-context actor; absent on direct/system\n   * provisioning. Immutable. Feeds the audit trail and the user-facing \"invited by\"\n   * cue in the pending-invitations inbox.\n   *\n   * PROVENANCE STAMP, NOT a navigable FK — deliberately a plain indexed string (same\n   * idiom as `scim-tokens.createdByUserId`), NOT `.isForeignKey()`. The primary\n   * member↔user link is `userId` (registered M2M relationship); adding `.isForeignKey()`\n   * here would demand a SECOND `ORGANIZATION_MEMBERS → USERS` relationship (else the\n   * registry warns \"cannot be resolved to a resource type\") and would graft nested-route /\n   * parent-scope machinery onto a field that only records who clicked \"invite\". Resolve\n   * the inviter's display name with a bounded lookup at render time if the cue needs it.\n   */\n  invitedByUserId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * When the invite was issued. Server-set by the invite CREATE prefix; absent on\n   * direct/system provisioning. Immutable. Used by the inbox ordering and the\n   * expiry-reap CRON batch.\n   */\n  invitedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * Present ⇒ this is a PROVIDER membership: held by an expert of a service firm through the client\n   * organization's `SERVICE_PROVIDER_RELATIONSHIPS` row with this id, not by one of the organization's\n   * own members (#1597). Test it with `isServiceProviderMembership`, never by hand.\n   *\n   * It changes what the row means everywhere the framework reads memberships: it confers authority ONLY\n   * while the relationship passes the execution-context live filter; its `roles` are owned by the\n   * relationship (generic UPDATE refuses them); it never counts toward the owner floor and cannot receive\n   * ownership; it grants no user type; it is not part of the client's SCIM directory.\n   *\n   * System-written only — by the firm's assignment verb, which also re-points it when a row left by an\n   * earlier relationship is reactivated. Indexed: \"who serves under this relationship\" is a query by it.\n   * Not a foreign key edge on purpose: the live filter reads the relationship by id, and a navigable edge\n   * would add nested routes onto a membership nobody needs to reach that way.\n   */\n  serviceProviderRelationshipId: z.string().min(1).optional().isDBIndexed().isSummaryField()\n    .excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The firm whose expert holds this provider membership. A plain id: it names another tenant. The live\n   * filter requires the member to hold an ACTIVE, ordinary membership there, in an organization that\n   * still confers authority.\n   */\n  providerOrganizationId: z.string().min(1).optional().isDBIndexed().isSummaryField()\n    .excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The firm's name as its relationship recorded it — what a client's directory shows as \"via {Firm}\".\n   * A snapshot copied from the relationship at assignment, because a client can never read the firm's\n   * organization row (#1597).\n   */\n  providerOrganizationName: z.string().max(200).optional().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * Computed instance label — the linked user's name, forwarded live from\n   * `USER_PROFILES`. A junction row has no inherent name; its identity is the\n   * related party. {@link forwardedLabel} resolves it SERVER-SIDE at read time\n   * (joining `userId` → `USER_PROFILES.userId`, rendering `firstName lastName`)\n   * and projects it onto the summary/read DTO via the virtual-field pipeline, so\n   * the frontend label is a plain field ref (`getFrontendResourceLabel:\n   * ['instanceLabel']`). Never stale (read live), never denormalized, tenant-safe\n   * (a bounded system read over the userIds already on the org-scoped page). NOT\n   * persisted (virtual). When the profile/name is unavailable it falls back to the\n   * immutable {@link userEmail} (`fallbackField`) rather than a raw id.\n   */\n  instanceLabel: forwardedLabel({\n    localField: 'userId',\n    relatedResource: CoreResourceType.USER_PROFILES,\n    relatedJoinField: 'userId',\n    fields: ['firstName', 'lastName'],\n    fallbackField: 'userEmail',\n  }),\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'userId',\n  'organizationId',\n]);\nexport type OrganizationMember = z.infer<typeof OrganizationMemberSchema>;\n"]}

package/dist/esm/organizations/organization-notifications.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS/H,KAAK,uCAAuC,GACxC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,oEAAoE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAmGjI,CAAC"}
+{"version":3,"file":"organization-notifications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS/H,KAAK,uCAAuC,GACxC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,oEAAoE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAmGjI,CAAC"}

package/dist/esm/organizations/organization-notifications.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF;;EAEE;AACF,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIhL;IACA,UAAU,EAAE,+BAA+B;IAC3C,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,iBAAiB;IACjB,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,0EAA0E;QAC1E,0EAA0E;QAC1E,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,qEAAqE;oBACrE,qEAAqE;oBACrE,yEAAyE;oBACzE,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;oBACrE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Notifications Shared Resource Configuration\n *\n * Resource configuration for organization notification preferences.\n * App-focused management for notification settings and preferences.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationNotificationsSchema\n} from './organization-notifications.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\ntype OrganizationNotificationsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Notifications Resource Configuration Factory\n*/\nexport const organizationNotificationsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  OrganizationNotificationsCoreOperations,\n  typeof OrganizationNotificationsSchema\n>({\n  mainSchema: OrganizationNotificationsSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_NOTIFICATIONS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_NOTIFICATIONS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_NOTIFICATIONS\n  // relationship declares `onParentCreate.enabled`, so a default notifications\n  // row (its `emailNotifications` block materialized to interior defaults) is\n  // written via `createAsSystem` on organization creation (fixes the latent\n  // missing-row gap — org notifications were never hand-seeded). Guard-1 is\n  // fail-closed by omission, so the system seed requires this explicit CREATE\n  // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the\n  // seed resolves.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a notifications row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls\n          // `createAsSystem`, which resolves the default CREATE op through the\n          // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts\n          // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE\n          // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is\n          // swallowed (silent missing row). INTERNAL_CALL is the service-layer\n          // internal transport (no HTTP route) — the correct tier for a system seed.\n          // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the\n          // repository tier, which is variant-agnostic. See composition-oncreate plan.)\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    }\n  },\n});\n"]}
+{"version":3,"file":"organization-notifications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF;;EAEE;AACF,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIhL;IACA,UAAU,EAAE,+BAA+B;IAC3C,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,iBAAiB;IACjB,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,0EAA0E;QAC1E,0EAA0E;QAC1E,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,qEAAqE;oBACrE,qEAAqE;oBACrE,yEAAyE;oBACzE,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;oBACrE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Notifications Shared Resource Configuration\n *\n * Resource configuration for organization notification preferences.\n * App-focused management for notification settings and preferences.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationNotificationsSchema\n} from './organization-notifications.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\ntype OrganizationNotificationsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Notifications Resource Configuration Factory\n*/\nexport const organizationNotificationsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  OrganizationNotificationsCoreOperations,\n  typeof OrganizationNotificationsSchema\n>({\n  mainSchema: OrganizationNotificationsSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_NOTIFICATIONS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_NOTIFICATIONS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_NOTIFICATIONS\n  // relationship declares `onParentCreate.enabled`, so a default notifications\n  // row (its `emailNotifications` block materialized to interior defaults) is\n  // written via `createAsSystem` on organization creation (fixes the latent\n  // missing-row gap — org notifications were never hand-seeded). Guard-1 is\n  // fail-closed by omission, so the system seed requires this explicit CREATE\n  // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the\n  // seed resolves.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a notifications row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls\n          // `createAsSystem`, which resolves the default CREATE op through the\n          // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts\n          // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE\n          // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is\n          // swallowed (silent missing row). INTERNAL_CALL is the service-layer\n          // internal transport (no HTTP route) — the correct tier for a system seed.\n          // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the\n          // repository tier, which is variant-agnostic. See composition-oncreate plan.)\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    }\n  },\n});\n"]}

package/dist/esm/organizations/organization-notifications.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAiC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;iBAoB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}
+{"version":3,"file":"organization-notifications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAiC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;iBAoB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/esm/organizations/organization-notifications.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,4WAA4W,CAAC;IACjb,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kQAAkQ,CAAC;IACjT,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gJAAgJ,CAAC;IAChM,qBAAqB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sJAAsJ,CAAC;IAC5M,sBAAsB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uJAAuJ,CAAC;IAE9M;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iMAAiM,CAAC;IAC9O,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,+MAA+M,CAAC;IACnQ,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mMAAmM,CAAC;IACjP,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iNAAiN,CAAC;CACvQ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,eAAe;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE9G,6FAA6F;IAC7F,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,kDAAkD;IAClD,kBAAkB,EAAE,oCAAoC;SACrD,OAAO,CAAC,oCAAoC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvD,cAAc,EAAE;IAEnB,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["/**\n * Organization Notifications Shared Schemas\n * \n * Notification preferences and settings.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\n\n/**\n * Per-category notification routing block for an organization.\n *\n * Every interior field is optional (the routing addresses) or carries a\n * `.default(...)` (the category opt-in booleans), so the object is fully\n * materializable from `{}`. Extracted as a named schema so\n * {@link OrganizationNotificationsSchema} can default it via the Zod-4-safe\n * `Schema.default(Schema.parse({}))` idiom — see the `emailNotifications` field.\n */\nexport const OrganizationEmailNotificationsSchema = z.object({\n  /**\n   * Where a tenant's organization-flavoured email goes, and whether it goes at all. READ by the\n   * notification dispatcher since 2026-09-08 (#410).\n   *\n   * It was read by NOTHING before that. The record was seeded by apps-manager at provisioning,\n   * rendered and edited through the organizations preset and audited, while organization-targeted\n   * notifications resolved to member user ids by role and went to each member's own address — so a\n   * tenant that filled this screen in changed nothing.\n   *\n   * The category a notification belongs to is DERIVED from its target: the notification-target\n   * vocabulary and these four categories line up one-for-one, so a per-notification declaration\n   * would only be a place for the two to disagree. `ORGANIZATION_USERS` is deliberately outside the\n   * mapping — it fans out to every member by design, and routing it to one address would change who\n   * the message is FOR rather than where it lands.\n   *\n   * An address REPLACES the member fan-out rather than adding to it: a tenant routing security mail\n   * to a SOC address is saying where it goes, not asking for a copy.\n   */\n  defaultEmailAddress: z.email().optional().isSummaryField().describe(\"Email address that receives the notification emails addressed to the organization itself, and those of a category (billing, security, administrative, user management) that has no address of its own. When set, these emails go to this address instead of to the members who would otherwise receive them. Emails meant for every member are always sent to each member.\"),\n  billingAddress: z.email().optional().describe(\"Email address that receives the organization's billing notification emails instead of its members; when unset, `defaultEmailAddress` is used. It is also given to the payment provider as the customer email when the organization's billing account is created.\"),\n  securityAddress: z.email().optional().describe(\"Email address that receives the organization's security notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n  administrativeAddress: z.email().optional().describe(\"Email address that receives the organization's administrative notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n  usersManagementAddress: z.email().optional().describe(\"Email address that receives the organization's user-management notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n\n  /**\n   * Category opt-ins. A `false` SUPPRESSES that category entirely — for the members too, not only\n   * for the routing address — because a tenant turning billing notifications off means it.\n   */\n  billing: z.boolean().default(true).describe(\"When false, the organization's billing notification emails are not sent at all, neither to `billingAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  administrative: z.boolean().default(true).describe(\"When false, the organization's administrative notification emails are not sent at all, neither to `administrativeAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  security: z.boolean().default(true).describe(\"When false, the organization's security notification emails are not sent at all, neither to `securityAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  usersManagement: z.boolean().default(true).describe(\"When false, the organization's user-management notification emails are not sent at all, neither to `usersManagementAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n});\nexport type OrganizationEmailNotifications = z.infer<typeof OrganizationEmailNotificationsSchema>;\n\nexport const OrganizationNotificationsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` = idempotency backstop for onParentCreate seeding: the eager\n  // `createAsSystem` seed on ORGANIZATIONS create writes one notifications row per\n  // org; the unique index makes a re-fire (retry / replay) fail-closed instead of\n  // duplicating.\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  // Email notification preferences. `.default(OrganizationEmailNotificationsSchema.parse({}))`\n  // makes the block materialize to its interior defaults when omitted, so the\n  // resource is default-seedable from its CREATE DTO + parent FK alone (required\n  // by the onParentCreate lifecycle guard). The output type keeps the block\n  // required, so downstream readers are unaffected.\n  emailNotifications: OrganizationEmailNotificationsSchema\n    .default(OrganizationEmailNotificationsSchema.parse({}))\n    .isSummaryField(),\n\n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationNotifications = z.infer<typeof OrganizationNotificationsSchema>;\n\n"]}
+{"version":3,"file":"organization-notifications.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,4WAA4W,CAAC;IACjb,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kQAAkQ,CAAC;IACjT,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gJAAgJ,CAAC;IAChM,qBAAqB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sJAAsJ,CAAC;IAC5M,sBAAsB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uJAAuJ,CAAC;IAE9M;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iMAAiM,CAAC;IAC9O,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,+MAA+M,CAAC;IACnQ,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mMAAmM,CAAC;IACjP,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iNAAiN,CAAC;CACvQ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,eAAe;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE9G,6FAA6F;IAC7F,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,kDAAkD;IAClD,kBAAkB,EAAE,oCAAoC;SACrD,OAAO,CAAC,oCAAoC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvD,cAAc,EAAE;IAEnB,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["/**\n * Organization Notifications Shared Schemas\n * \n * Notification preferences and settings.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\n\n/**\n * Per-category notification routing block for an organization.\n *\n * Every interior field is optional (the routing addresses) or carries a\n * `.default(...)` (the category opt-in booleans), so the object is fully\n * materializable from `{}`. Extracted as a named schema so\n * {@link OrganizationNotificationsSchema} can default it via the Zod-4-safe\n * `Schema.default(Schema.parse({}))` idiom — see the `emailNotifications` field.\n */\nexport const OrganizationEmailNotificationsSchema = z.object({\n  /**\n   * Where a tenant's organization-flavoured email goes, and whether it goes at all. READ by the\n   * notification dispatcher since 2026-09-08 (#410).\n   *\n   * It was read by NOTHING before that. The record was seeded by apps-manager at provisioning,\n   * rendered and edited through the organizations preset and audited, while organization-targeted\n   * notifications resolved to member user ids by role and went to each member's own address — so a\n   * tenant that filled this screen in changed nothing.\n   *\n   * The category a notification belongs to is DERIVED from its target: the notification-target\n   * vocabulary and these four categories line up one-for-one, so a per-notification declaration\n   * would only be a place for the two to disagree. `ORGANIZATION_USERS` is deliberately outside the\n   * mapping — it fans out to every member by design, and routing it to one address would change who\n   * the message is FOR rather than where it lands.\n   *\n   * An address REPLACES the member fan-out rather than adding to it: a tenant routing security mail\n   * to a SOC address is saying where it goes, not asking for a copy.\n   */\n  defaultEmailAddress: z.email().optional().isSummaryField().describe(\"Email address that receives the notification emails addressed to the organization itself, and those of a category (billing, security, administrative, user management) that has no address of its own. When set, these emails go to this address instead of to the members who would otherwise receive them. Emails meant for every member are always sent to each member.\"),\n  billingAddress: z.email().optional().describe(\"Email address that receives the organization's billing notification emails instead of its members; when unset, `defaultEmailAddress` is used. It is also given to the payment provider as the customer email when the organization's billing account is created.\"),\n  securityAddress: z.email().optional().describe(\"Email address that receives the organization's security notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n  administrativeAddress: z.email().optional().describe(\"Email address that receives the organization's administrative notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n  usersManagementAddress: z.email().optional().describe(\"Email address that receives the organization's user-management notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n\n  /**\n   * Category opt-ins. A `false` SUPPRESSES that category entirely — for the members too, not only\n   * for the routing address — because a tenant turning billing notifications off means it.\n   */\n  billing: z.boolean().default(true).describe(\"When false, the organization's billing notification emails are not sent at all, neither to `billingAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  administrative: z.boolean().default(true).describe(\"When false, the organization's administrative notification emails are not sent at all, neither to `administrativeAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  security: z.boolean().default(true).describe(\"When false, the organization's security notification emails are not sent at all, neither to `securityAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  usersManagement: z.boolean().default(true).describe(\"When false, the organization's user-management notification emails are not sent at all, neither to `usersManagementAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n});\nexport type OrganizationEmailNotifications = z.infer<typeof OrganizationEmailNotificationsSchema>;\n\nexport const OrganizationNotificationsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` = idempotency backstop for onParentCreate seeding: the eager\n  // `createAsSystem` seed on ORGANIZATIONS create writes one notifications row per\n  // org; the unique index makes a re-fire (retry / replay) fail-closed instead of\n  // duplicating.\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  // Email notification preferences. `.default(OrganizationEmailNotificationsSchema.parse({}))`\n  // makes the block materialize to its interior defaults when omitted, so the\n  // resource is default-seedable from its CREATE DTO + parent FK alone (required\n  // by the onParentCreate lifecycle guard). The output type keeps the block\n  // required, so downstream readers are unaffected.\n  emailNotifications: OrganizationEmailNotificationsSchema\n    .default(OrganizationEmailNotificationsSchema.parse({}))\n    .isSummaryField(),\n\n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationNotifications = z.infer<typeof OrganizationNotificationsSchema>;\n\n"]}

package/dist/esm/organizations/organization-preferences.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAU/H,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,kEAAkE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAmG/H,CAAC"}
+{"version":3,"file":"organization-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAU/H,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,kEAAkE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAmG/H,CAAC"}

package/dist/esm/organizations/organization-preferences.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-preferences.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF;;EAEE;AACF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI9K;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,0EAA0E;IAC1E,+EAA+E;IAC/E,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,iBAAiB;IACjB,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAGD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,qEAAqE;oBACrE,qEAAqE;oBACrE,yEAAyE;oBACzE,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;oBACrE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Preferences Shared Resource Configuration\n *\n * Resource configuration for organization preferences management.\n * App-focused management for localization and regional settings.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationPreferencesSchema,\n} from './organization-preferences.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\ntype OrganizationPreferencesCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Preferences Resource Configuration Factory\n*/\nexport const organizationPreferencesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  OrganizationPreferencesCoreOperations,\n  typeof OrganizationPreferencesSchema\n>({\n  mainSchema: OrganizationPreferencesSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_PREFERENCES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_PREFERENCES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_PREFERENCES\n  // relationship declares `onParentCreate.enabled`, so a default preferences row\n  // is written via `createAsSystem` on organization creation (fixes the latent\n  // missing-row gap — org preferences were never hand-seeded). Guard-1 is\n  // fail-closed by omission, so the system seed requires this explicit CREATE\n  // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the\n  // seed resolves.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded preferences row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a preferences row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls\n          // `createAsSystem`, which resolves the default CREATE op through the\n          // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts\n          // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE\n          // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is\n          // swallowed (silent missing row). INTERNAL_CALL is the service-layer\n          // internal transport (no HTTP route) — the correct tier for a system seed.\n          // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the\n          // repository tier, which is variant-agnostic. See composition-oncreate plan.)\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ]\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MANAGER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded preferences row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    }\n  },\n});\n"]}
+{"version":3,"file":"organization-preferences.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF;;EAEE;AACF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI9K;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,0EAA0E;IAC1E,+EAA+E;IAC/E,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,iBAAiB;IACjB,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAGD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,qEAAqE;oBACrE,qEAAqE;oBACrE,yEAAyE;oBACzE,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;oBACrE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Preferences Shared Resource Configuration\n *\n * Resource configuration for organization preferences management.\n * App-focused management for localization and regional settings.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationPreferencesSchema,\n} from './organization-preferences.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\ntype OrganizationPreferencesCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Preferences Resource Configuration Factory\n*/\nexport const organizationPreferencesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  OrganizationPreferencesCoreOperations,\n  typeof OrganizationPreferencesSchema\n>({\n  mainSchema: OrganizationPreferencesSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_PREFERENCES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_PREFERENCES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_PREFERENCES\n  // relationship declares `onParentCreate.enabled`, so a default preferences row\n  // is written via `createAsSystem` on organization creation (fixes the latent\n  // missing-row gap — org preferences were never hand-seeded). Guard-1 is\n  // fail-closed by omission, so the system seed requires this explicit CREATE\n  // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the\n  // seed resolves.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded preferences row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a preferences row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls\n          // `createAsSystem`, which resolves the default CREATE op through the\n          // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts\n          // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE\n          // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is\n          // swallowed (silent missing row). INTERNAL_CALL is the service-layer\n          // internal transport (no HTTP route) — the correct tier for a system seed.\n          // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the\n          // repository tier, which is variant-agnostic. See composition-oncreate plan.)\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ]\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MANAGER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded preferences row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    }\n  },\n});\n"]}

package/dist/esm/organizations/organization-preferences.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-preferences.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-preferences.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAkB,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEhH,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBA+BxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC"}
+{"version":3,"file":"organization-preferences.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-preferences.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAkB,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEhH,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBA+BxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC"}

package/dist/esm/organizations/organization-preferences.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-preferences.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-preferences.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEhH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,2UAA2U,CAAC;IAC/c,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,6QAA6Q,CAAC;IAC9Y,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,6IAA6I,CAAC;IACpM,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,6HAA6H,CAAC;CACzL,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,eAAe;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE9G,oBAAoB;IACpB,wEAAwE;IACxE,iEAAiE;IACjE,0EAA0E;IAC1E,gFAAgF;IAChF,iFAAiF;IACjF,sEAAsE;IACtE,2DAA2D;IAC3D,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACtE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC9H,gFAAgF;IAChF,4DAA4D;IAC5D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;IACxG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE;IAE1G,uBAAuB;IACvB,mBAAmB,EAAE,qCAAqC,CAAC,OAAO,CAAC,qCAAqC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAEpI,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;IAEjE,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,6BAA6B,CAAC,IAAI,CAAC;IACtF,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAC","sourcesContent":["/**\n * Organization Preferences Shared Schemas\n * \n * Localization, regional settings, and application preferences.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { AvailableLanguage, TimeFormat, TimezoneSchema, DateFormat } from '@wildo-ai/presets-components-models';\n\nexport const OrganizationLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField().describe(\"The organization's default interface language. Every member uses it when `enforceForAllMembers` is true or `allowUserOverride` is false, a member who opts into the organization default uses it, and otherwise it applies when a member's own language cannot be used. Ignored when the application does not offer it. Defaults to `en`.\"),\n  supportedLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]).describe(\"The interface languages this organization's members may use, limited to those the application offers; `primaryLanguage` is always included. When none of them is offered by the application, every language the application offers stays available. Defaults to `[\\\"en\\\"]`.\"),\n  allowUserOverride: z.boolean().default(true).describe(\"When false, members cannot use a language of their own choosing and the interface uses `primaryLanguage` for all of them. Defaults to true.\"),\n  enforceForAllMembers: z.boolean().default(false).describe(\"When true, every member's interface uses `primaryLanguage`, whatever language they chose for themselves. Defaults to false.\")\n});\nexport type OrganizationLanguagePreferences = z.infer<typeof OrganizationLanguagePreferencesSchema>;\n\nexport const OrganizationPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` = idempotency backstop for onParentCreate seeding: the eager\n  // `createAsSystem` seed on ORGANIZATIONS create writes one preferences row per\n  // org; the unique index makes a re-fire (retry / replay) fail-closed instead of\n  // duplicating.\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  \n  // Regional settings\n  // Default 'UTC' (a valid `CommonTimezone`), NOT 'US_SHORT' — that was a\n  // `DateFormat` value mistakenly used here. `TimezoneSchema` is a\n  // `union([enum(CommonTimezone), string])`, so Zod accepted the bad string\n  // (the onParentCreate boot-guard probe passed), but the Mongoose model enforces\n  // the enum and rejected 'US_SHORT' at seed time → the org preferences row failed\n  // to eager-seed. Mirrors the USER preferences `timezone` default. See\n  // composition-oncreate-lifecycle plan (W3 runtime-verify).\n  timezone: TimezoneSchema.default('UTC').isDBIndexed().isSummaryField(),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isDBIndexed().isSummaryField(),\n  // LOCALE_DEFAULT (not ISO_8601): mirrors the USER preferences default — see the\n  // rationale on `UserPreferences_RegionalSchema.dateFormat`.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.LOCALE_DEFAULT).isDBIndexed(),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').default(TimeFormat.TWENTY_FOUR_HOUR).isDBIndexed(),\n  \n  // Language preferences\n  languagePreferences: OrganizationLanguagePreferencesSchema.default(OrganizationLanguagePreferencesSchema.parse({})).isSummaryField(),\n  \n  allowMemberEmailOverride: z.boolean().default(true).isDBIndexed(),\n  \n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationPreferences = z.infer<typeof OrganizationPreferencesSchema>;\n\n/**\n * The tenant's regional answer, as the DEFAULT LAYER beneath a member's own (#410).\n *\n * These four fields sit at the top level of {@link OrganizationPreferencesSchema} because they are\n * the organization's own settings, not a sub-record; this is a derived VIEW of them, so the two can\n * never drift. It exists because the frontend needs to carry exactly this much of the tenant's\n * preferences record to `I18nContext` — sending the whole record would put `_id`, audit fields and\n * the member-email-override policy on an event that has no use for any of them.\n *\n * The resolution `I18nContext` performs is: the member's own value, then this, then the framework\n * fallback. A member's explicit choice always wins — that is why\n * {@link UserPreferences_RegionalSchema}'s four fields are optional, so \"the member expressed\n * nothing\" is representable at all.\n *\n * Unlike the member's block, these fields keep their defaults, and that is correct rather than an\n * oversight: the organization record is seeded at provisioning and always exists, so its values ARE\n * the tenant's answer. A tenant that has edited nothing answers with the same four values the\n * framework would have used, which makes the layer a no-op for it — exactly as it should be.\n */\nexport const OrganizationRegionalPreferencesSchema = OrganizationPreferencesSchema.pick({\n  timezone: true,\n  locale: true,\n  dateFormat: true,\n  timeFormat: true,\n});\nexport type OrganizationRegionalPreferences = z.infer<typeof OrganizationRegionalPreferencesSchema>;\n"]}
+{"version":3,"file":"organization-preferences.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-preferences.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEhH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,2UAA2U,CAAC;IAC/c,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,6QAA6Q,CAAC;IAC9Y,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,6IAA6I,CAAC;IACpM,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,6HAA6H,CAAC;CACzL,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,eAAe;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE9G,oBAAoB;IACpB,wEAAwE;IACxE,iEAAiE;IACjE,0EAA0E;IAC1E,gFAAgF;IAChF,iFAAiF;IACjF,sEAAsE;IACtE,2DAA2D;IAC3D,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACtE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC9H,gFAAgF;IAChF,4DAA4D;IAC5D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;IACxG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE;IAE1G,uBAAuB;IACvB,mBAAmB,EAAE,qCAAqC,CAAC,OAAO,CAAC,qCAAqC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAEpI,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;IAEjE,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,6BAA6B,CAAC,IAAI,CAAC;IACtF,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAC","sourcesContent":["/**\n * Organization Preferences Shared Schemas\n * \n * Localization, regional settings, and application preferences.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { AvailableLanguage, TimeFormat, TimezoneSchema, DateFormat } from '@wildo-ai/presets-components-models';\n\nexport const OrganizationLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField().describe(\"The organization's default interface language. Every member uses it when `enforceForAllMembers` is true or `allowUserOverride` is false, a member who opts into the organization default uses it, and otherwise it applies when a member's own language cannot be used. Ignored when the application does not offer it. Defaults to `en`.\"),\n  supportedLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]).describe(\"The interface languages this organization's members may use, limited to those the application offers; `primaryLanguage` is always included. When none of them is offered by the application, every language the application offers stays available. Defaults to `[\\\"en\\\"]`.\"),\n  allowUserOverride: z.boolean().default(true).describe(\"When false, members cannot use a language of their own choosing and the interface uses `primaryLanguage` for all of them. Defaults to true.\"),\n  enforceForAllMembers: z.boolean().default(false).describe(\"When true, every member's interface uses `primaryLanguage`, whatever language they chose for themselves. Defaults to false.\")\n});\nexport type OrganizationLanguagePreferences = z.infer<typeof OrganizationLanguagePreferencesSchema>;\n\nexport const OrganizationPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` = idempotency backstop for onParentCreate seeding: the eager\n  // `createAsSystem` seed on ORGANIZATIONS create writes one preferences row per\n  // org; the unique index makes a re-fire (retry / replay) fail-closed instead of\n  // duplicating.\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  \n  // Regional settings\n  // Default 'UTC' (a valid `CommonTimezone`), NOT 'US_SHORT' — that was a\n  // `DateFormat` value mistakenly used here. `TimezoneSchema` is a\n  // `union([enum(CommonTimezone), string])`, so Zod accepted the bad string\n  // (the onParentCreate boot-guard probe passed), but the Mongoose model enforces\n  // the enum and rejected 'US_SHORT' at seed time → the org preferences row failed\n  // to eager-seed. Mirrors the USER preferences `timezone` default. See\n  // composition-oncreate-lifecycle plan (W3 runtime-verify).\n  timezone: TimezoneSchema.default('UTC').isDBIndexed().isSummaryField(),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isDBIndexed().isSummaryField(),\n  // LOCALE_DEFAULT (not ISO_8601): mirrors the USER preferences default — see the\n  // rationale on `UserPreferences_RegionalSchema.dateFormat`.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.LOCALE_DEFAULT).isDBIndexed(),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').default(TimeFormat.TWENTY_FOUR_HOUR).isDBIndexed(),\n  \n  // Language preferences\n  languagePreferences: OrganizationLanguagePreferencesSchema.default(OrganizationLanguagePreferencesSchema.parse({})).isSummaryField(),\n  \n  allowMemberEmailOverride: z.boolean().default(true).isDBIndexed(),\n  \n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationPreferences = z.infer<typeof OrganizationPreferencesSchema>;\n\n/**\n * The tenant's regional answer, as the DEFAULT LAYER beneath a member's own (#410).\n *\n * These four fields sit at the top level of {@link OrganizationPreferencesSchema} because they are\n * the organization's own settings, not a sub-record; this is a derived VIEW of them, so the two can\n * never drift. It exists because the frontend needs to carry exactly this much of the tenant's\n * preferences record to `I18nContext` — sending the whole record would put `_id`, audit fields and\n * the member-email-override policy on an event that has no use for any of them.\n *\n * The resolution `I18nContext` performs is: the member's own value, then this, then the framework\n * fallback. A member's explicit choice always wins — that is why\n * {@link UserPreferences_RegionalSchema}'s four fields are optional, so \"the member expressed\n * nothing\" is representable at all.\n *\n * Unlike the member's block, these fields keep their defaults, and that is correct rather than an\n * oversight: the organization record is seeded at provisioning and always exists, so its values ARE\n * the tenant's answer. A tenant that has edited nothing answers with the same four values the\n * framework would have used, which makes the layer a no-op for it — exactly as it should be.\n */\nexport const OrganizationRegionalPreferencesSchema = OrganizationPreferencesSchema.pick({\n  timezone: true,\n  locale: true,\n  dateFormat: true,\n  timeFormat: true,\n});\nexport type OrganizationRegionalPreferences = z.infer<typeof OrganizationRegionalPreferencesSchema>;\n"]}

package/dist/esm/organizations/organization-profile.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-profile.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-profile.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAW/H,oBAAY,8BAA8B;IACxC,eAAe,oBAAoB;CACpC;AAED,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgH3H,CAAC"}
+{"version":3,"file":"organization-profile.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-profile.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAW/H,oBAAY,8BAA8B;IACxC,eAAe,oBAAoB;CACpC;AAED,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgH3H,CAAC"}

package/dist/esm/organizations/organization-profile.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-profile.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-profile.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,yBAAyB,EAG1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,kDAAkD;AAClD,MAAM,CAAN,IAAY,8BAEX;AAFD,WAAY,8BAA8B;IACxC,qEAAmC,CAAA;AACrC,CAAC,EAFW,8BAA8B,KAA9B,8BAA8B,QAEzC;AAQD;;EAEE;AACF,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1K;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,qBAAqB;IAC1D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;IACnG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,8BAA8B;IAE/C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,+DAA+D;oBAC/D,sEAAsE;oBACtE,2EAA2E;oBAC3E,sDAAsD;oBACtD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,eAAe,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,QAAQ,EAAE,yBAAyB,CAAC,KAAK,CAAC,QAAQ;qBACnD,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Profile Shared Resource Configuration\n *\n * Resource configuration for organization profile management.\n * App-focused management for company information and branding.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationProfileSchema,\n  OrganizationIndustry,\n  OrganizationSize\n} from './organization-profile.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for organization profile\nexport enum OrganizationProfile_Operations {\n  UPDATE_BRANDING = 'update_branding', // Update only branding information\n}\n\ntype OrganizationProfileCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Profile Resource Configuration Factory\n*/\nexport const organizationProfileResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrganizationProfile_Operations,\n  OrganizationProfileCoreOperations,\n  typeof OrganizationProfileSchema\n>({\n  mainSchema: OrganizationProfileSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_PROFILES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_PROFILES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded 1:1 profile row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a profile row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: OrganizationProfile_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (not REPOSITORY_ONLY): the onParentCreate seed's\n          // `createAsSystem` resolves the CREATE op via the service tier\n          // (`getServiceOperationPathDefault`), which rejects REPOSITORY_ONLY →\n          // OPERATION_PATH_NOT_FOUND, silent no-seed. See the org-preferences config\n          // + composition-oncreate plan for the full rationale.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MANAGER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded 1:1 profile row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [OrganizationProfile_Operations.UPDATE_BRANDING]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            branding: OrganizationProfileSchema.shape.branding\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    }\n  },\n});\n"]}
+{"version":3,"file":"organization-profile.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-profile.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,yBAAyB,EAG1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,kDAAkD;AAClD,MAAM,CAAN,IAAY,8BAEX;AAFD,WAAY,8BAA8B;IACxC,qEAAmC,CAAA;AACrC,CAAC,EAFW,8BAA8B,KAA9B,8BAA8B,QAEzC;AAQD;;EAEE;AACF,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1K;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,qBAAqB;IAC1D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;IACnG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,4EAA4E;IAC5E,yEAAyE;IACzE,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,oEAAoE;QACpE,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,8BAA8B;IAE/C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,+DAA+D;oBAC/D,sEAAsE;oBACtE,2EAA2E;oBAC3E,sDAAsD;oBACtD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,eAAe,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,QAAQ,EAAE,yBAAyB,CAAC,KAAK,CAAC,QAAQ;qBACnD,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Profile Shared Resource Configuration\n *\n * Resource configuration for organization profile management.\n * App-focused management for company information and branding.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationProfileSchema,\n  OrganizationIndustry,\n  OrganizationSize\n} from './organization-profile.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\n// Custom operations enum for organization profile\nexport enum OrganizationProfile_Operations {\n  UPDATE_BRANDING = 'update_branding', // Update only branding information\n}\n\ntype OrganizationProfileCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Profile Resource Configuration Factory\n*/\nexport const organizationProfileResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrganizationProfile_Operations,\n  OrganizationProfileCoreOperations,\n  typeof OrganizationProfileSchema\n>({\n  mainSchema: OrganizationProfileSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_PROFILES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_PROFILES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  // onParentCreate eager-seeding writes through createAsSystem → opt into the\n  // fail-closed system-write policy (composition-oncreate-lifecycle plan).\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded 1:1 profile row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a profile row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: OrganizationProfile_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (not REPOSITORY_ONLY): the onParentCreate seed's\n          // `createAsSystem` resolves the CREATE op via the service tier\n          // (`getServiceOperationPathDefault`), which rejects REPOSITORY_ONLY →\n          // OPERATION_PATH_NOT_FOUND, silent no-seed. See the org-preferences config\n          // + composition-oncreate plan for the full rationale.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MANAGER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded 1:1 profile row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [OrganizationProfile_Operations.UPDATE_BRANDING]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            branding: OrganizationProfileSchema.shape.branding\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    }\n  },\n});\n"]}

package/dist/esm/organizations/organization-profile.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-profile.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,oBAAY,gBAAgB;IAC1B,OAAO,YAAY,CAAY,iBAAiB;IAChD,KAAK,UAAU,CAAgB,kBAAkB;IACjD,MAAM,WAAW,CAAc,mBAAmB;IAClD,KAAK,UAAU,CAAgB,qBAAqB;IACpD,UAAU,eAAe;CAC1B;AAED,oBAAY,oBAAoB;IAC9B,UAAU,eAAe;IACzB,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,KAAK,UAAU;IACf,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,KAAK,UAAU;CAChB;AAID,eAAO,MAAM,0BAA0B;;;;;iBAkCrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACjD,gBAAgB,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAMlE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoCpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"organization-profile.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,oBAAY,gBAAgB;IAC1B,OAAO,YAAY,CAAY,iBAAiB;IAChD,KAAK,UAAU,CAAgB,kBAAkB;IACjD,MAAM,WAAW,CAAc,mBAAmB;IAClD,KAAK,UAAU,CAAgB,qBAAqB;IACpD,UAAU,eAAe;CAC1B;AAED,oBAAY,oBAAoB;IAC9B,UAAU,eAAe;IACzB,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,KAAK,UAAU;IACf,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,KAAK,UAAU;CAChB;AAID,eAAO,MAAM,0BAA0B;;;;;iBAkCrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACjD,gBAAgB,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAMlE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoCpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/esm/organizations/organization-profile.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-profile.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAkB,MAAM,qCAAqC,CAAC;AAErF,oCAAoC;AACpC,MAAM,CAAN,IAAY,gBAMX;AAND,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,mCAAe,CAAA;IACf,qCAAiB,CAAA;IACjB,mCAAe,CAAA;IACf,6CAAyB,CAAA,CAAM,kBAAkB;AACnD,CAAC,EANW,gBAAgB,KAAhB,gBAAgB,QAM3B;AAED,MAAM,CAAN,IAAY,oBAYX;AAZD,WAAY,oBAAoB;IAC9B,iDAAyB,CAAA;IACzB,2CAAmB,CAAA;IACnB,iDAAyB,CAAA;IACzB,+CAAuB,CAAA;IACvB,yCAAiB,CAAA;IACjB,uDAA+B,CAAA;IAC/B,iDAAyB,CAAA;IACzB,uCAAe,CAAA;IACf,iDAAyB,CAAA;IACzB,+CAAuB,CAAA;IACvB,uCAAe,CAAA;AACjB,CAAC,EAZW,oBAAoB,KAApB,oBAAoB,QAY/B;AAED,iBAAiB;AAEjB,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wLAAwL,CAAC;IAC3N,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2NAA2N,CAAC;IACjQ,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAC3C,kGAAkG;IAClG,qGAAqG;IACrG,sGAAsG;IACtG,oDAAoD;CACrD,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAiD,EACjD,gBAA6D;IAE7D,OAAO;QACL,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,gBAAgB,CAAC,OAAO;QACnD,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,gBAAgB,CAAC,YAAY;QACrE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAEnG,sBAAsB;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAE3C,iBAAiB;IACjB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC/D,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACvD,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE5B,WAAW;IACX,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;IAE9D,WAAW;IACX,mFAAmF;IACnF,kFAAkF;IAClF,QAAQ,EAAE,0BAA0B,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElF,eAAe;IACf,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QACjF,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QACtF,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QACjF,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;KACjF,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["/**\n * Organization Profile Shared Schemas\n * \n * Company information, branding, and public profile data.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\nimport { AddressSchema } from '@wildo-ai/presets-components-models';\nimport { ZodTypeForColors } from '@wildo-ai/zod-decorators';\nimport { CommonTimezone, TimezoneSchema } from '@wildo-ai/presets-components-models';\n\n// Organization classification enums\nexport enum OrganizationSize {\n  STARTUP = 'STARTUP',           // 1-10 employees\n  SMALL = 'SMALL',               // 11-50 employees\n  MEDIUM = 'MEDIUM',             // 51-200 employees\n  LARGE = 'LARGE',               // 201-1000 employees\n  ENTERPRISE = 'ENTERPRISE'      // 1000+ employees\n}\n\nexport enum OrganizationIndustry {\n  TECHNOLOGY = 'TECHNOLOGY',\n  FINANCE = 'FINANCE',\n  HEALTHCARE = 'HEALTHCARE',\n  EDUCATION = 'EDUCATION',\n  RETAIL = 'RETAIL',\n  MANUFACTURING = 'MANUFACTURING',\n  CONSULTING = 'CONSULTING',\n  MEDIA = 'MEDIA',\n  GOVERNMENT = 'GOVERNMENT',\n  NONPROFIT = 'NONPROFIT',\n  OTHER = 'OTHER'\n}\n\n// Address Schema\n\nexport const OrganizationBrandingSchema = z.object({\n  /**\n   * Per-org logo (user-authored, absolute URL), resolved into identification by #410 and consumed by the standard login card in #651.\n   *\n   * A tenant that uploads a logo now sees it on its own sign-in page: the identification response\n   * resolves this first and falls back to the application's own brand assets. See\n   * {@link resolveTenantBrandPresentation}, which owns the precedence.\n   *\n   * **The audit note this replaces was accurate and its conclusion was wrong**, and the way it went\n   * wrong is worth keeping. It read: *\"the one place that surfaces an organization's branding logo\n   * to a DTO is the auth login response, and it ALREADY applies the app-level default: at\n   * identification time only a domain was matched (the org profile is not loaded) … Because the only\n   * surfacing seam is already handled, no additional backend fallback seam is introduced here\n   * (invented seams are avoided by design).\"*\n   *\n   * Every factual clause held. But \"the org profile is not loaded\" described what the code DID, not\n   * what it could do — the domain lookup resolves `scopeId`, which is the organization id, so the\n   * profile was always one read away. Reasoning from the current call graph to \"no seam is needed\"\n   * turned an unfinished implementation into a documented design decision, and it then justified\n   * leaving the field inert for as long as anyone read the note. Avoiding invented seams is right;\n   * this seam was not invented, it was the one the field exists for.\n   *\n   * Kept `z.url()` (absolute) because this is direct user input, unlike the\n   * backend-populated `logoUrl` output fields (auth-response / email context)\n   * that accept app-relative brand-asset paths.\n   */\n  logo: z.url().optional().describe(\"Absolute URL of the organization's logo. On the sign-in page, people whose email domain signs in through this organization's single sign-on see it in place of the application's logo.\"),\n  favicon: z.url().optional().describe(\"Absolute URL of the organization's browser-tab icon. On the sign-in page, people whose email domain signs in through this organization's single sign-on see it in the tab while the organization's sign-in card is shown.\"),\n  primaryColor: ZodTypeForColors.optional(),\n  secondaryColor: ZodTypeForColors.optional(),\n  // `customDomain` was removed (#1799). Nothing resolved an organization from a request's host, and\n  // serving an application on a tenant's own domain needs host routing, certificates, CORS, cookie and\n  // redirect-URI handling and domain verification — a feature, not a field. An administrator who set it\n  // believed a domain was configured and nothing was.\n});\nexport type OrganizationBranding = z.infer<typeof OrganizationBrandingSchema>;\n\n/**\n * What a tenant's own sign-in screen should show: the ORGANIZATION's branding when it declared any,\n * otherwise the application's (#410).\n *\n * Per field, not per record — a tenant that uploaded a logo and never picked a colour keeps the\n * caller's colour fallback, if one exists. Authentication identification supplies no application colour;\n * its standard login consumer keeps application theme tokens and uses a supplied tenant colour only as\n * a decorative identity accent. Resolving the record as a unit would make one\n * expressed field silence the others, which is the same trap the regional-preferences layer had to\n * avoid.\n *\n * A pure function taking the application's ALREADY-RESOLVED values, so it can live beside the schema\n * it resolves without this module knowing anything about brand assets, configuration services or\n * how the application's own logo is chosen. The caller keeps that; this owns only the precedence,\n * which is the part worth having one copy of.\n *\n * `faviconUrl` is the tenant's or nothing: the application's own icon is already the page's, so the\n * sign-in page swaps it only for a tenant that set one (#1799). `secondaryColor` is deliberately\n * absent: the DTO that carries this to a login screen has no field for it, so resolving it would\n * produce a value nothing transports. Adding it is a DTO decision first.\n */\nexport function resolveTenantBrandPresentation(\n  branding: OrganizationBranding | null | undefined,\n  applicationBrand: { logoUrl?: string; primaryColor?: string },\n): { logoUrl?: string; primaryColor?: string; faviconUrl?: string } {\n  return {\n    logoUrl: branding?.logo ?? applicationBrand.logoUrl,\n    primaryColor: branding?.primaryColor ?? applicationBrand.primaryColor,\n    ...(branding?.favicon ? { faviconUrl: branding.favicon } : {}),\n  };\n}\n\nexport const OrganizationProfileSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  \n  // Company information\n  displayName: z.string().max(100).optional().isDBIndexed().isSummaryField(),\n  domain: z.string().min(1).max(100).optional().isDBIndexed(),\n  phone: z.string().max(20).optional(),\n  website: z.url().optional(),\n  description: z.string().max(500).optional(),\n  \n  // Classification\n  industry: z.enum(OrganizationIndustry).optional().isDBIndexed(),\n  size: z.enum(OrganizationSize).optional().isDBIndexed(),\n  founded: z.date().optional(),\n  \n  // Location\n  address: AddressSchema.optional(),\n  timezone: z.string().default(CommonTimezone.UTC).isDBIndexed(),\n  \n  // Branding\n  // `.default(...)` (interior fully optional/defaulted) so the row is eager-seedable\n  // via onParentCreate — root-cause fix, consistent with sibling defaulted objects.\n  branding: OrganizationBrandingSchema.default(OrganizationBrandingSchema.parse({})),\n  \n  // Social links\n  socialLinks: z.object({\n    linkedin: z.url().optional().describe(\"URL of the organization's LinkedIn page.\"),\n    twitter: z.url().optional().describe(\"URL of the organization's X (Twitter) profile.\"),\n    facebook: z.url().optional().describe(\"URL of the organization's Facebook page.\"),\n    github: z.url().optional().describe(\"URL of the organization's GitHub profile.\")\n  }).optional(),\n  \n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationProfile = z.infer<typeof OrganizationProfileSchema>; "]}
+{"version":3,"file":"organization-profile.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAkB,MAAM,qCAAqC,CAAC;AAErF,oCAAoC;AACpC,MAAM,CAAN,IAAY,gBAMX;AAND,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,mCAAe,CAAA;IACf,qCAAiB,CAAA;IACjB,mCAAe,CAAA;IACf,6CAAyB,CAAA,CAAM,kBAAkB;AACnD,CAAC,EANW,gBAAgB,KAAhB,gBAAgB,QAM3B;AAED,MAAM,CAAN,IAAY,oBAYX;AAZD,WAAY,oBAAoB;IAC9B,iDAAyB,CAAA;IACzB,2CAAmB,CAAA;IACnB,iDAAyB,CAAA;IACzB,+CAAuB,CAAA;IACvB,yCAAiB,CAAA;IACjB,uDAA+B,CAAA;IAC/B,iDAAyB,CAAA;IACzB,uCAAe,CAAA;IACf,iDAAyB,CAAA;IACzB,+CAAuB,CAAA;IACvB,uCAAe,CAAA;AACjB,CAAC,EAZW,oBAAoB,KAApB,oBAAoB,QAY/B;AAED,iBAAiB;AAEjB,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wLAAwL,CAAC;IAC3N,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2NAA2N,CAAC;IACjQ,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAC3C,kGAAkG;IAClG,qGAAqG;IACrG,sGAAsG;IACtG,oDAAoD;CACrD,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAiD,EACjD,gBAA6D;IAE7D,OAAO;QACL,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,gBAAgB,CAAC,OAAO;QACnD,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,gBAAgB,CAAC,YAAY;QACrE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAEnG,sBAAsB;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAE3C,iBAAiB;IACjB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAC/D,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IACvD,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE5B,WAAW;IACX,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;IAE9D,WAAW;IACX,mFAAmF;IACnF,kFAAkF;IAClF,QAAQ,EAAE,0BAA0B,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElF,eAAe;IACf,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QACjF,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QACtF,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QACjF,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;KACjF,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["/**\n * Organization Profile Shared Schemas\n * \n * Company information, branding, and public profile data.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\nimport { AddressSchema } from '@wildo-ai/presets-components-models';\nimport { ZodTypeForColors } from '@wildo-ai/zod-decorators';\nimport { CommonTimezone, TimezoneSchema } from '@wildo-ai/presets-components-models';\n\n// Organization classification enums\nexport enum OrganizationSize {\n  STARTUP = 'STARTUP',           // 1-10 employees\n  SMALL = 'SMALL',               // 11-50 employees\n  MEDIUM = 'MEDIUM',             // 51-200 employees\n  LARGE = 'LARGE',               // 201-1000 employees\n  ENTERPRISE = 'ENTERPRISE'      // 1000+ employees\n}\n\nexport enum OrganizationIndustry {\n  TECHNOLOGY = 'TECHNOLOGY',\n  FINANCE = 'FINANCE',\n  HEALTHCARE = 'HEALTHCARE',\n  EDUCATION = 'EDUCATION',\n  RETAIL = 'RETAIL',\n  MANUFACTURING = 'MANUFACTURING',\n  CONSULTING = 'CONSULTING',\n  MEDIA = 'MEDIA',\n  GOVERNMENT = 'GOVERNMENT',\n  NONPROFIT = 'NONPROFIT',\n  OTHER = 'OTHER'\n}\n\n// Address Schema\n\nexport const OrganizationBrandingSchema = z.object({\n  /**\n   * Per-org logo (user-authored, absolute URL), resolved into identification by #410 and consumed by the standard login card in #651.\n   *\n   * A tenant that uploads a logo now sees it on its own sign-in page: the identification response\n   * resolves this first and falls back to the application's own brand assets. See\n   * {@link resolveTenantBrandPresentation}, which owns the precedence.\n   *\n   * **The audit note this replaces was accurate and its conclusion was wrong**, and the way it went\n   * wrong is worth keeping. It read: *\"the one place that surfaces an organization's branding logo\n   * to a DTO is the auth login response, and it ALREADY applies the app-level default: at\n   * identification time only a domain was matched (the org profile is not loaded) … Because the only\n   * surfacing seam is already handled, no additional backend fallback seam is introduced here\n   * (invented seams are avoided by design).\"*\n   *\n   * Every factual clause held. But \"the org profile is not loaded\" described what the code DID, not\n   * what it could do — the domain lookup resolves `scopeId`, which is the organization id, so the\n   * profile was always one read away. Reasoning from the current call graph to \"no seam is needed\"\n   * turned an unfinished implementation into a documented design decision, and it then justified\n   * leaving the field inert for as long as anyone read the note. Avoiding invented seams is right;\n   * this seam was not invented, it was the one the field exists for.\n   *\n   * Kept `z.url()` (absolute) because this is direct user input, unlike the\n   * backend-populated `logoUrl` output fields (auth-response / email context)\n   * that accept app-relative brand-asset paths.\n   */\n  logo: z.url().optional().describe(\"Absolute URL of the organization's logo. On the sign-in page, people whose email domain signs in through this organization's single sign-on see it in place of the application's logo.\"),\n  favicon: z.url().optional().describe(\"Absolute URL of the organization's browser-tab icon. On the sign-in page, people whose email domain signs in through this organization's single sign-on see it in the tab while the organization's sign-in card is shown.\"),\n  primaryColor: ZodTypeForColors.optional(),\n  secondaryColor: ZodTypeForColors.optional(),\n  // `customDomain` was removed (#1799). Nothing resolved an organization from a request's host, and\n  // serving an application on a tenant's own domain needs host routing, certificates, CORS, cookie and\n  // redirect-URI handling and domain verification — a feature, not a field. An administrator who set it\n  // believed a domain was configured and nothing was.\n});\nexport type OrganizationBranding = z.infer<typeof OrganizationBrandingSchema>;\n\n/**\n * What a tenant's own sign-in screen should show: the ORGANIZATION's branding when it declared any,\n * otherwise the application's (#410).\n *\n * Per field, not per record — a tenant that uploaded a logo and never picked a colour keeps the\n * caller's colour fallback, if one exists. Authentication identification supplies no application colour;\n * its standard login consumer keeps application theme tokens and uses a supplied tenant colour only as\n * a decorative identity accent. Resolving the record as a unit would make one\n * expressed field silence the others, which is the same trap the regional-preferences layer had to\n * avoid.\n *\n * A pure function taking the application's ALREADY-RESOLVED values, so it can live beside the schema\n * it resolves without this module knowing anything about brand assets, configuration services or\n * how the application's own logo is chosen. The caller keeps that; this owns only the precedence,\n * which is the part worth having one copy of.\n *\n * `faviconUrl` is the tenant's or nothing: the application's own icon is already the page's, so the\n * sign-in page swaps it only for a tenant that set one (#1799). `secondaryColor` is deliberately\n * absent: the DTO that carries this to a login screen has no field for it, so resolving it would\n * produce a value nothing transports. Adding it is a DTO decision first.\n */\nexport function resolveTenantBrandPresentation(\n  branding: OrganizationBranding | null | undefined,\n  applicationBrand: { logoUrl?: string; primaryColor?: string },\n): { logoUrl?: string; primaryColor?: string; faviconUrl?: string } {\n  return {\n    logoUrl: branding?.logo ?? applicationBrand.logoUrl,\n    primaryColor: branding?.primaryColor ?? applicationBrand.primaryColor,\n    ...(branding?.favicon ? { faviconUrl: branding.favicon } : {}),\n  };\n}\n\nexport const OrganizationProfileSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  \n  // Company information\n  displayName: z.string().max(100).optional().isDBIndexed().isSummaryField(),\n  domain: z.string().min(1).max(100).optional().isDBIndexed(),\n  phone: z.string().max(20).optional(),\n  website: z.url().optional(),\n  description: z.string().max(500).optional(),\n  \n  // Classification\n  industry: z.enum(OrganizationIndustry).optional().isDBIndexed(),\n  size: z.enum(OrganizationSize).optional().isDBIndexed(),\n  founded: z.date().optional(),\n  \n  // Location\n  address: AddressSchema.optional(),\n  timezone: z.string().default(CommonTimezone.UTC).isDBIndexed(),\n  \n  // Branding\n  // `.default(...)` (interior fully optional/defaulted) so the row is eager-seedable\n  // via onParentCreate — root-cause fix, consistent with sibling defaulted objects.\n  branding: OrganizationBrandingSchema.default(OrganizationBrandingSchema.parse({})),\n  \n  // Social links\n  socialLinks: z.object({\n    linkedin: z.url().optional().describe(\"URL of the organization's LinkedIn page.\"),\n    twitter: z.url().optional().describe(\"URL of the organization's X (Twitter) profile.\"),\n    facebook: z.url().optional().describe(\"URL of the organization's Facebook page.\"),\n    github: z.url().optional().describe(\"URL of the organization's GitHub profile.\")\n  }).optional(),\n  \n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationProfile = z.infer<typeof OrganizationProfileSchema>; "]}

package/dist/esm/organizations/organization-unit-inheritance.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-unit-inheritance.shared.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-unit-inheritance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,0CAA0C,EAAE,MAAM,qCAAqC,CAAC;AAGjG;;;;;;;GAOG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,0CAA0C,GAAG,IAAI,CAAC;CAC9E,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,wFAAwF;IACxF,QAAQ,CAAC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IAChD,yFAAyF;IACzF,QAAQ,CAAC,4BAA4B,EAAE,MAAM,EAAE,CAAC;CACjD,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CAAC,IAAI,EAAE,+BAA+B,GAAG,OAAO,CAEtG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,6CAA6C,CAC3D,YAAY,EAAE,SAAS,+BAA+B,EAAE,EACxD,iBAAiB,EAAE,SAAS,+BAA+B,EAAE,GAC5D,8BAA8B,CAyBhC;AAED;;;;;GAKG;AACH,wBAAgB,wCAAwC,CACtD,YAAY,EAAE,SAAS,+BAA+B,EAAE,GACvD,OAAO,CAET"}
+{"version":3,"file":"organization-unit-inheritance.shared.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-unit-inheritance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,0CAA0C,EAAE,MAAM,qCAAqC,CAAC;AAGjG;;;;;;;GAOG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,0CAA0C,GAAG,IAAI,CAAC;CAC9E,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,wFAAwF;IACxF,QAAQ,CAAC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IAChD,yFAAyF;IACzF,QAAQ,CAAC,4BAA4B,EAAE,MAAM,EAAE,CAAC;CACjD,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CAAC,IAAI,EAAE,+BAA+B,GAAG,OAAO,CAEtG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,6CAA6C,CAC3D,YAAY,EAAE,SAAS,+BAA+B,EAAE,EACxD,iBAAiB,EAAE,SAAS,+BAA+B,EAAE,GAC5D,8BAA8B,CAyBhC;AAED;;;;;GAKG;AACH,wBAAgB,wCAAwC,CACtD,YAAY,EAAE,SAAS,+BAA+B,EAAE,GACvD,OAAO,CAET"}

package/dist/esm/organizations/organization-unit-inheritance.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-unit-inheritance.shared.js","sourceRoot":"","sources":["../../../../src/organizations/organization-unit-inheritance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,0CAA0C,EAAE,MAAM,qCAAqC,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AA+B/E;;;;;;;;GAQG;AACH,MAAM,UAAU,uCAAuC,CAAC,IAAqC;IAC3F,OAAO,IAAI,CAAC,eAAe,KAAK,0CAA0C,CAAC,YAAY,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,6CAA6C,CAC3D,YAAwD,EACxD,iBAA6D;IAE7D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,WAAW,CAAC,GAAG;YAAE,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,uCAAuC,CAAC,WAAW,CAAC;YAAE,SAAS;QAExF,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAC3E,KAAK,MAAM,aAAa,IAAI,iBAAiB,EAAE,CAAC;YAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5E,IAAI,2BAA2B,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;gBACjF,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACxC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,4BAA4B,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACnD,4BAA4B,EAAE,CAAC,GAAG,gBAAgB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CACtD,YAAwD;IAExD,OAAO,YAAY,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["/**\n * Downward inheritance of a unit-scoped grant across the organization tree (plan decision D-C2).\n *\n * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — expands a unit grant to exactly the subtree its\n * `inheritanceType` declares, and to nothing else.\n *\n * ## What this expresses\n *\n * A role held at unit U reaches U's DESCENDANTS when U declares\n * {@link OrganizationUnit_PermissionInheritanceType.INHERIT_DOWN}, and reaches U alone when it\n * declares `NO_INHERITANCE`. There is no third direction: upward propagation was removed from the\n * vocabulary (D-C2) because a role held at a leaf conferring authority over its ancestors is\n * privilege escalation along the org chart.\n *\n * ## Prefix, never recursion\n *\n * The expansion is a PREFIX TEST over the materialized `path`, not a tree walk. That is the whole\n * reason `path` is materialized: `descendants(U)` is `row.path.startsWith(subtreePrefix(U))`, an O(1)\n * test per candidate with no per-level query. A recursive walk would reintroduce the N+1 the\n * materialized path exists to remove, and would do it on the authorization hot path.\n *\n * ## Why this is pure, and where the I/O lives\n *\n * Reading the unit rows is the caller's job (the authorization gate, which holds the repositories).\n * Keeping the rule itself pure means the traversal can be pinned exhaustively without a database, and\n * means one function answers \"which units does this grant actually reach\" for every caller that ever\n * needs it — the row filter, the write guard, and the audit record all consume the same answer.\n */\n\nimport { OrganizationUnit_PermissionInheritanceType } from './organization-units.shared.schemas';\nimport { isOrganizationUnitInSubtree } from './organization-units.shared.path';\n\n/**\n * The unit fields inheritance depends on, read structurally so callers can pass whatever row shape\n * they already hold without projecting it first.\n *\n * `path` and `inheritanceType` are optional because a row can reach this function without them — a\n * projection that dropped them, or a row written before the field existed. Both cases resolve to the\n * conservative answer; see {@link resolveOrganizationUnitInheritsDownward}.\n */\nexport type OrganizationUnitInheritanceNode = {\n  readonly _id: string;\n  readonly path?: string | null;\n  readonly inheritanceType?: OrganizationUnit_PermissionInheritanceType | null;\n};\n\n/**\n * The result of expanding a grant: what it reaches, and which part of that came from inheritance.\n *\n * The split is not cosmetic. A grant at a ROOT unit with downward inheritance reaches the entire\n * organization chart, which is functionally organization-wide access assembled from one narrow grant\n * (plan decision D-C4, watch item 4). That must be LEGIBLE in the access record rather than looking\n * like a narrow grant, so the two sets are reported separately and the audit surface keeps both.\n */\nexport type OrganizationUnitGrantExpansion = {\n  /** Every unit the grant reaches — the set the row predicate and the write guard use. */\n  readonly effectiveOrganizationUnitIds: string[];\n  /** The units reached ONLY through downward inheritance. Empty when nothing inherited. */\n  readonly inheritedOrganizationUnitIds: string[];\n};\n\n/**\n * Does a role held at this unit propagate to its descendants?\n *\n * ⚠️ An ABSENT value resolves to `false`, which deliberately DIFFERS from the schema's write-time\n * default of `INHERIT_DOWN`. A row that reaches an authorization decision without the field has\n * bypassed the schema that would have supplied that default, and an authorization primitive must not\n * widen a grant on data it cannot vouch for. The divergence is one-directional and fail-closed: the\n * worst case is a grant that reaches fewer units than intended, never more.\n */\nexport function resolveOrganizationUnitInheritsDownward(unit: OrganizationUnitInheritanceNode): boolean {\n  return unit.inheritanceType === OrganizationUnit_PermissionInheritanceType.INHERIT_DOWN;\n}\n\n/**\n * Expand directly-held unit grants across the tree.\n *\n * `grantedUnits` are the units whose role actually satisfied the operation — NOT every unit the\n * principal belongs to. `organizationUnits` is the candidate set to test against; the caller scopes it\n * (in practice, to the units of the organization the grants belong to), and this function never widens\n * beyond what it is given.\n *\n * Units are matched by PREFIX, so a grant with downward inheritance reaches the whole subtree at any\n * depth in one pass — a grandchild is found by the same test as a child, with no recursion.\n *\n * ## Status is deliberately NOT filtered\n *\n * An ARCHIVED or SUSPENDED descendant stays inside the grant. Archiving a branch records that it is no\n * longer operationally active; it is not a revocation of access to the records that branch owns. Making\n * it one would mean archiving silently removes rows from their manager's view — a data-visibility\n * change disguised as a lifecycle change, and one that surfaces as missing data rather than as a\n * refusal. If unit status should ever gate access, it belongs in an explicit, separately-audited rule.\n */\nexport function expandOrganizationUnitGrantThroughInheritance(\n  grantedUnits: readonly OrganizationUnitInheritanceNode[],\n  organizationUnits: readonly OrganizationUnitInheritanceNode[],\n): OrganizationUnitGrantExpansion {\n  const effectiveUnitIds = new Set<string>();\n  const inheritedUnitIds = new Set<string>();\n\n  for (const grantedUnit of grantedUnits) {\n    if (grantedUnit._id) effectiveUnitIds.add(grantedUnit._id);\n  }\n\n  for (const grantedUnit of grantedUnits) {\n    if (!grantedUnit._id || !resolveOrganizationUnitInheritsDownward(grantedUnit)) continue;\n\n    const subtreeRoot = { _id: grantedUnit._id, path: grantedUnit.path ?? '' };\n    for (const candidateUnit of organizationUnits) {\n      if (!candidateUnit._id || effectiveUnitIds.has(candidateUnit._id)) continue;\n      if (isOrganizationUnitInSubtree({ path: candidateUnit.path ?? '' }, subtreeRoot)) {\n        effectiveUnitIds.add(candidateUnit._id);\n        inheritedUnitIds.add(candidateUnit._id);\n      }\n    }\n  }\n\n  return {\n    effectiveOrganizationUnitIds: [...effectiveUnitIds],\n    inheritedOrganizationUnitIds: [...inheritedUnitIds],\n  };\n}\n\n/**\n * Does any of these grants propagate downward?\n *\n * The caller's cheap pre-check: when nothing inherits, the candidate set never has to be loaded at\n * all, so a `NO_INHERITANCE` organization pays one lookup instead of two.\n */\nexport function anyOrganizationUnitGrantInheritsDownward(\n  grantedUnits: readonly OrganizationUnitInheritanceNode[],\n): boolean {\n  return grantedUnits.some(resolveOrganizationUnitInheritsDownward);\n}\n"]}
+{"version":3,"file":"organization-unit-inheritance.shared.js","sourceRoot":"","sources":["../../../src/organizations/organization-unit-inheritance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,0CAA0C,EAAE,MAAM,qCAAqC,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AA+B/E;;;;;;;;GAQG;AACH,MAAM,UAAU,uCAAuC,CAAC,IAAqC;IAC3F,OAAO,IAAI,CAAC,eAAe,KAAK,0CAA0C,CAAC,YAAY,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,6CAA6C,CAC3D,YAAwD,EACxD,iBAA6D;IAE7D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,WAAW,CAAC,GAAG;YAAE,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,uCAAuC,CAAC,WAAW,CAAC;YAAE,SAAS;QAExF,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAC3E,KAAK,MAAM,aAAa,IAAI,iBAAiB,EAAE,CAAC;YAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5E,IAAI,2BAA2B,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;gBACjF,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACxC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,4BAA4B,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACnD,4BAA4B,EAAE,CAAC,GAAG,gBAAgB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CACtD,YAAwD;IAExD,OAAO,YAAY,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["/**\n * Downward inheritance of a unit-scoped grant across the organization tree (plan decision D-C2).\n *\n * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — expands a unit grant to exactly the subtree its\n * `inheritanceType` declares, and to nothing else.\n *\n * ## What this expresses\n *\n * A role held at unit U reaches U's DESCENDANTS when U declares\n * {@link OrganizationUnit_PermissionInheritanceType.INHERIT_DOWN}, and reaches U alone when it\n * declares `NO_INHERITANCE`. There is no third direction: upward propagation was removed from the\n * vocabulary (D-C2) because a role held at a leaf conferring authority over its ancestors is\n * privilege escalation along the org chart.\n *\n * ## Prefix, never recursion\n *\n * The expansion is a PREFIX TEST over the materialized `path`, not a tree walk. That is the whole\n * reason `path` is materialized: `descendants(U)` is `row.path.startsWith(subtreePrefix(U))`, an O(1)\n * test per candidate with no per-level query. A recursive walk would reintroduce the N+1 the\n * materialized path exists to remove, and would do it on the authorization hot path.\n *\n * ## Why this is pure, and where the I/O lives\n *\n * Reading the unit rows is the caller's job (the authorization gate, which holds the repositories).\n * Keeping the rule itself pure means the traversal can be pinned exhaustively without a database, and\n * means one function answers \"which units does this grant actually reach\" for every caller that ever\n * needs it — the row filter, the write guard, and the audit record all consume the same answer.\n */\n\nimport { OrganizationUnit_PermissionInheritanceType } from './organization-units.shared.schemas';\nimport { isOrganizationUnitInSubtree } from './organization-units.shared.path';\n\n/**\n * The unit fields inheritance depends on, read structurally so callers can pass whatever row shape\n * they already hold without projecting it first.\n *\n * `path` and `inheritanceType` are optional because a row can reach this function without them — a\n * projection that dropped them, or a row written before the field existed. Both cases resolve to the\n * conservative answer; see {@link resolveOrganizationUnitInheritsDownward}.\n */\nexport type OrganizationUnitInheritanceNode = {\n  readonly _id: string;\n  readonly path?: string | null;\n  readonly inheritanceType?: OrganizationUnit_PermissionInheritanceType | null;\n};\n\n/**\n * The result of expanding a grant: what it reaches, and which part of that came from inheritance.\n *\n * The split is not cosmetic. A grant at a ROOT unit with downward inheritance reaches the entire\n * organization chart, which is functionally organization-wide access assembled from one narrow grant\n * (plan decision D-C4, watch item 4). That must be LEGIBLE in the access record rather than looking\n * like a narrow grant, so the two sets are reported separately and the audit surface keeps both.\n */\nexport type OrganizationUnitGrantExpansion = {\n  /** Every unit the grant reaches — the set the row predicate and the write guard use. */\n  readonly effectiveOrganizationUnitIds: string[];\n  /** The units reached ONLY through downward inheritance. Empty when nothing inherited. */\n  readonly inheritedOrganizationUnitIds: string[];\n};\n\n/**\n * Does a role held at this unit propagate to its descendants?\n *\n * ⚠️ An ABSENT value resolves to `false`, which deliberately DIFFERS from the schema's write-time\n * default of `INHERIT_DOWN`. A row that reaches an authorization decision without the field has\n * bypassed the schema that would have supplied that default, and an authorization primitive must not\n * widen a grant on data it cannot vouch for. The divergence is one-directional and fail-closed: the\n * worst case is a grant that reaches fewer units than intended, never more.\n */\nexport function resolveOrganizationUnitInheritsDownward(unit: OrganizationUnitInheritanceNode): boolean {\n  return unit.inheritanceType === OrganizationUnit_PermissionInheritanceType.INHERIT_DOWN;\n}\n\n/**\n * Expand directly-held unit grants across the tree.\n *\n * `grantedUnits` are the units whose role actually satisfied the operation — NOT every unit the\n * principal belongs to. `organizationUnits` is the candidate set to test against; the caller scopes it\n * (in practice, to the units of the organization the grants belong to), and this function never widens\n * beyond what it is given.\n *\n * Units are matched by PREFIX, so a grant with downward inheritance reaches the whole subtree at any\n * depth in one pass — a grandchild is found by the same test as a child, with no recursion.\n *\n * ## Status is deliberately NOT filtered\n *\n * An ARCHIVED or SUSPENDED descendant stays inside the grant. Archiving a branch records that it is no\n * longer operationally active; it is not a revocation of access to the records that branch owns. Making\n * it one would mean archiving silently removes rows from their manager's view — a data-visibility\n * change disguised as a lifecycle change, and one that surfaces as missing data rather than as a\n * refusal. If unit status should ever gate access, it belongs in an explicit, separately-audited rule.\n */\nexport function expandOrganizationUnitGrantThroughInheritance(\n  grantedUnits: readonly OrganizationUnitInheritanceNode[],\n  organizationUnits: readonly OrganizationUnitInheritanceNode[],\n): OrganizationUnitGrantExpansion {\n  const effectiveUnitIds = new Set<string>();\n  const inheritedUnitIds = new Set<string>();\n\n  for (const grantedUnit of grantedUnits) {\n    if (grantedUnit._id) effectiveUnitIds.add(grantedUnit._id);\n  }\n\n  for (const grantedUnit of grantedUnits) {\n    if (!grantedUnit._id || !resolveOrganizationUnitInheritsDownward(grantedUnit)) continue;\n\n    const subtreeRoot = { _id: grantedUnit._id, path: grantedUnit.path ?? '' };\n    for (const candidateUnit of organizationUnits) {\n      if (!candidateUnit._id || effectiveUnitIds.has(candidateUnit._id)) continue;\n      if (isOrganizationUnitInSubtree({ path: candidateUnit.path ?? '' }, subtreeRoot)) {\n        effectiveUnitIds.add(candidateUnit._id);\n        inheritedUnitIds.add(candidateUnit._id);\n      }\n    }\n  }\n\n  return {\n    effectiveOrganizationUnitIds: [...effectiveUnitIds],\n    inheritedOrganizationUnitIds: [...inheritedUnitIds],\n  };\n}\n\n/**\n * Does any of these grants propagate downward?\n *\n * The caller's cheap pre-check: when nothing inherits, the candidate set never has to be loaded at\n * all, so a `NO_INHERITANCE` organization pays one lookup instead of two.\n */\nexport function anyOrganizationUnitGrantInheritsDownward(\n  grantedUnits: readonly OrganizationUnitInheritanceNode[],\n): boolean {\n  return grantedUnits.some(resolveOrganizationUnitInheritsDownward);\n}\n"]}

package/dist/esm/organizations/organization-unit-members.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-unit-members.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-unit-members.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAMzG,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF,KAAK,oCAAoC,GACrC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,iEAAiE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;mBA8E9H,CAAC"}
+{"version":3,"file":"organization-unit-members.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-unit-members.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAMzG,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF,KAAK,oCAAoC,GACrC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,iEAAiE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;mBA8E9H,CAAC"}

package/dist/esm/organizations/organization-unit-members.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-unit-members.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-unit-members.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,sCAAsC,GAAG;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;CACpG,CAAC;AASF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI7K;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,0FAA0F;oBAC1F,2BAA2B;oBAC3B,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;iBACrD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Unit Member Shared Resource Configuration\n *\n * The junction resource that replaced `OrganizationMember.organizationUnitsMembership` (plan\n * decision D-B5). See {@link OrganizationUnitMemberSchema} for why the embedded array could not\n * carry these semantics.\n */\n\nimport { z } from 'zod';\nimport { OrganizationUnitMemberSchema } from './organization-unit-members.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nconst ORGANIZATION_UNIT_MEMBER_FILTER_FIELDS = {\n  organizationUnitId: z.string(),\n  organizationMemberId: z.string(),\n  role: z.string().describe('Only return assignments that hold exactly this role inside their unit.'),\n};\n\ntype OrganizationUnitMemberCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/**\n * Organization Unit Member Resource Configuration Factory.\n *\n * Read access is ORG_MEMBER (the org chart and who sits where is ordinary directory information\n * inside a tenant); every WRITE is ORG_ADMIN, because a unit assignment is a role grant and becomes\n * live authority once WS-C wires units into authorization.\n */\nexport const organizationUnitMemberResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  OrganizationUnitMemberCoreOperations,\n  typeof OrganizationUnitMemberSchema\n>({\n  mainSchema: OrganizationUnitMemberSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_UNIT_MEMBERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_UNIT_MEMBERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // A unit assignment is a role grant; the role-ceiling gate additionally bounds WHICH role\n          // an admin may grant here.\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: ORGANIZATION_UNIT_MEMBER_FILTER_FIELDS,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"organization-unit-members.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-unit-members.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,sCAAsC,GAAG;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;CACpG,CAAC;AASF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI7K;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,0FAA0F;oBAC1F,2BAA2B;oBAC3B,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;iBACrD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Unit Member Shared Resource Configuration\n *\n * The junction resource that replaced `OrganizationMember.organizationUnitsMembership` (plan\n * decision D-B5). See {@link OrganizationUnitMemberSchema} for why the embedded array could not\n * carry these semantics.\n */\n\nimport { z } from 'zod';\nimport { OrganizationUnitMemberSchema } from './organization-unit-members.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nconst ORGANIZATION_UNIT_MEMBER_FILTER_FIELDS = {\n  organizationUnitId: z.string(),\n  organizationMemberId: z.string(),\n  role: z.string().describe('Only return assignments that hold exactly this role inside their unit.'),\n};\n\ntype OrganizationUnitMemberCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/**\n * Organization Unit Member Resource Configuration Factory.\n *\n * Read access is ORG_MEMBER (the org chart and who sits where is ordinary directory information\n * inside a tenant); every WRITE is ORG_ADMIN, because a unit assignment is a role grant and becomes\n * live authority once WS-C wires units into authorization.\n */\nexport const organizationUnitMemberResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  OrganizationUnitMemberCoreOperations,\n  typeof OrganizationUnitMemberSchema\n>({\n  mainSchema: OrganizationUnitMemberSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_UNIT_MEMBERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_UNIT_MEMBERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // A unit assignment is a role grant; the role-ceiling gate additionally bounds WHICH role\n          // an admin may grant here.\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: ORGANIZATION_UNIT_MEMBER_FILTER_FIELDS,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/organizations/organization-unit-members.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-unit-members.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-unit-members.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,4BAA4B;;;;;;;;kBA6CvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"organization-unit-members.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-unit-members.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,4BAA4B;;;;;;;;kBA6CvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/esm/organizations/organization-unit-members.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-unit-members.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-unit-members.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,yDAAyD;IACzD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvG;;;;;;;;;;;;OAYG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACzG;;;;;;;;;;;;;OAaG;IACH,IAAI,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAChD,QAAQ,CAAC,4JAA4J,CAAC;IACzK,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,sBAAsB;IACtB,oBAAoB;CACrB,CAAC,CAAC","sourcesContent":["/**\n * Organization Unit Member Shared Schemas\n *\n * The junction between an organization MEMBERSHIP and an organization UNIT: \"this member holds this\n * role inside this unit of the org chart\".\n *\n * ## Why this is a resource and not an embedded array (plan decision D-B5)\n *\n * This started life as `OrganizationMember.organizationUnitsMembership` — an embedded\n * `[{ organizationUnitId, role }]` array. That shape could not carry the semantics it claimed:\n *\n *  - **It was not portably queryable.** A dot-path filter into an array-valued field works on Mongo\n *    and resolves to `NULL` on PostgreSQL (matching nothing), there is no first-class containment\n *    operator, and the application-side fallback is stripped by the LIST summary projection. BOTH\n *    available routes fail **OPEN**. Anything that had to ask \"who is assigned to this unit?\" —\n *    the unit DELETE dependents guard, and any future authorization read — would have silently\n *    passed on one adapter.\n *  - **It could not be a relationship.** With no registered edge there was no cascade, so unit\n *    assignments outlived both the unit and the membership that justified them.\n *  - **It admitted duplicates.** An array has no uniqueness; a member could carry two different\n *    roles for the same unit with no defined winner.\n *\n * As a first-class junction all three close: the assignment is queryable on every adapter, the\n * `ORGANIZATION_UNITS → ORGANIZATION_UNIT_MEMBERS` edge lets the unit DELETE guard finally cover\n * assigned members, and {@link OrganizationUnitMemberSchema}'s business key makes \"one role per\n * member per unit\" a persisted invariant instead of a convention.\n *\n * ## An authorization axis — live since WS-C phase 2\n *\n * ⚠️ `role` here IS read by the authorization path. `appendUnitScopedRoles` emits one\n * `initiatorRoles` entry per assignment, carrying `organizationUnitId` as a NARROWING discriminator\n * beside the organization-wide entry; every consumer that unions `initiatorRoles` partitions on that\n * field first (`isOrganizationWideRoleInfo`). So a unit role is live authority — bounded to one unit,\n * never tenant-wide. Two consequences for anything touching this field:\n *\n *  - The role-ceiling gate governs who may ASSIGN it (both write paths carry it explicitly, see\n *    {@link OrganizationUnitMemberSchema.shape.role}).\n *  - Every change to it is an access-control decision and emits\n *    `ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED`, the narrowed twin of the organization-wide\n *    `ORGANIZATION_MEMBER_ROLE_CHANGED`.\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE · WILDO.ACCESS.PRIVILEGE_EVIDENCE — least-privilege and evidence on unit-scoped\n * role assignment.\n */\n\nimport { z } from 'zod';\n\nimport { OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\n\nexport const OrganizationUnitMemberSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * Tenant anchor. Denormalized from the parent membership so tenant scoping and the contextual\n   * filter resolve on this row alone — an authorization-adjacent read must never depend on a join\n   * to establish which tenant a row belongs to.\n   */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /** The unit of the org chart this assignment targets. */\n  organizationUnitId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /**\n   * The organization MEMBERSHIP being assigned — deliberately the membership, not the user.\n   *\n   * A unit assignment presupposes membership of the owning organization, so the membership row is\n   * the true semantic parent: it carries the tenant binding and its deletion is exactly when the\n   * assignment stops meaning anything (hence the cascade on that edge). Pointing at `userId`\n   * instead would model a user as assignable to a unit of an organization they may not belong to.\n   *\n   * A denormalized `userId` copy was considered for a one-hop \"unit roles for this user\" read and\n   * REJECTED: the execution-context builder already holds the member rows (and therefore their\n   * `_id`s) at the point it would need this, so the copy would buy nothing and add a field that can\n   * drift.\n   */\n  organizationMemberId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /**\n   * The role this member holds WITHIN this unit.\n   *\n   * The only mutable field on the row, and deliberately so: re-grading an assignment through UPDATE\n   * keeps the row's identity (and its `createdAt` provenance) intact, where a delete-plus-create\n   * would silently reset both. The two coordinates that IDENTIFY the assignment\n   * (`organizationMemberId`, `organizationUnitId`) are `.excludeFromUpdate()`, so an edit can change\n   * what the assignment GRANTS but never what it is ABOUT.\n   *\n   * Both write paths — CREATE and UPDATE — are governed by the role-ceiling gate\n   * (`assertRequestedRolesWithinCallerCeiling`): a principal cannot grant a unit role it does not\n   * itself hold. Because a custom implementation resolves by an exact operation-path key, each path\n   * carries the gate explicitly; neither inherits it from the other.\n   */\n  role: OrgRolesSchema.isDBIndexed().isSummaryField()\n    .describe('The role the member holds inside this unit: a core organization role or one the application defines. A caller cannot grant a role it does not hold itself.'),\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'organizationMemberId',\n  'organizationUnitId',\n]);\n\nexport type OrganizationUnitMember = z.infer<typeof OrganizationUnitMemberSchema>;\n"]}
+{"version":3,"file":"organization-unit-members.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-unit-members.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,yDAAyD;IACzD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvG;;;;;;;;;;;;OAYG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACzG;;;;;;;;;;;;;OAaG;IACH,IAAI,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAChD,QAAQ,CAAC,4JAA4J,CAAC;IACzK,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,sBAAsB;IACtB,oBAAoB;CACrB,CAAC,CAAC","sourcesContent":["/**\n * Organization Unit Member Shared Schemas\n *\n * The junction between an organization MEMBERSHIP and an organization UNIT: \"this member holds this\n * role inside this unit of the org chart\".\n *\n * ## Why this is a resource and not an embedded array (plan decision D-B5)\n *\n * This started life as `OrganizationMember.organizationUnitsMembership` — an embedded\n * `[{ organizationUnitId, role }]` array. That shape could not carry the semantics it claimed:\n *\n *  - **It was not portably queryable.** A dot-path filter into an array-valued field works on Mongo\n *    and resolves to `NULL` on PostgreSQL (matching nothing), there is no first-class containment\n *    operator, and the application-side fallback is stripped by the LIST summary projection. BOTH\n *    available routes fail **OPEN**. Anything that had to ask \"who is assigned to this unit?\" —\n *    the unit DELETE dependents guard, and any future authorization read — would have silently\n *    passed on one adapter.\n *  - **It could not be a relationship.** With no registered edge there was no cascade, so unit\n *    assignments outlived both the unit and the membership that justified them.\n *  - **It admitted duplicates.** An array has no uniqueness; a member could carry two different\n *    roles for the same unit with no defined winner.\n *\n * As a first-class junction all three close: the assignment is queryable on every adapter, the\n * `ORGANIZATION_UNITS → ORGANIZATION_UNIT_MEMBERS` edge lets the unit DELETE guard finally cover\n * assigned members, and {@link OrganizationUnitMemberSchema}'s business key makes \"one role per\n * member per unit\" a persisted invariant instead of a convention.\n *\n * ## An authorization axis — live since WS-C phase 2\n *\n * ⚠️ `role` here IS read by the authorization path. `appendUnitScopedRoles` emits one\n * `initiatorRoles` entry per assignment, carrying `organizationUnitId` as a NARROWING discriminator\n * beside the organization-wide entry; every consumer that unions `initiatorRoles` partitions on that\n * field first (`isOrganizationWideRoleInfo`). So a unit role is live authority — bounded to one unit,\n * never tenant-wide. Two consequences for anything touching this field:\n *\n *  - The role-ceiling gate governs who may ASSIGN it (both write paths carry it explicitly, see\n *    {@link OrganizationUnitMemberSchema.shape.role}).\n *  - Every change to it is an access-control decision and emits\n *    `ORGANIZATION_UNIT_MEMBER_ROLE_CHANGED`, the narrowed twin of the organization-wide\n *    `ORGANIZATION_MEMBER_ROLE_CHANGED`.\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE · WILDO.ACCESS.PRIVILEGE_EVIDENCE — least-privilege and evidence on unit-scoped\n * role assignment.\n */\n\nimport { z } from 'zod';\n\nimport { OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\n\nexport const OrganizationUnitMemberSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * Tenant anchor. Denormalized from the parent membership so tenant scoping and the contextual\n   * filter resolve on this row alone — an authorization-adjacent read must never depend on a join\n   * to establish which tenant a row belongs to.\n   */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /** The unit of the org chart this assignment targets. */\n  organizationUnitId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /**\n   * The organization MEMBERSHIP being assigned — deliberately the membership, not the user.\n   *\n   * A unit assignment presupposes membership of the owning organization, so the membership row is\n   * the true semantic parent: it carries the tenant binding and its deletion is exactly when the\n   * assignment stops meaning anything (hence the cascade on that edge). Pointing at `userId`\n   * instead would model a user as assignable to a unit of an organization they may not belong to.\n   *\n   * A denormalized `userId` copy was considered for a one-hop \"unit roles for this user\" read and\n   * REJECTED: the execution-context builder already holds the member rows (and therefore their\n   * `_id`s) at the point it would need this, so the copy would buy nothing and add a field that can\n   * drift.\n   */\n  organizationMemberId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /**\n   * The role this member holds WITHIN this unit.\n   *\n   * The only mutable field on the row, and deliberately so: re-grading an assignment through UPDATE\n   * keeps the row's identity (and its `createdAt` provenance) intact, where a delete-plus-create\n   * would silently reset both. The two coordinates that IDENTIFY the assignment\n   * (`organizationMemberId`, `organizationUnitId`) are `.excludeFromUpdate()`, so an edit can change\n   * what the assignment GRANTS but never what it is ABOUT.\n   *\n   * Both write paths — CREATE and UPDATE — are governed by the role-ceiling gate\n   * (`assertRequestedRolesWithinCallerCeiling`): a principal cannot grant a unit role it does not\n   * itself hold. Because a custom implementation resolves by an exact operation-path key, each path\n   * carries the gate explicitly; neither inherits it from the other.\n   */\n  role: OrgRolesSchema.isDBIndexed().isSummaryField()\n    .describe('The role the member holds inside this unit: a core organization role or one the application defines. A caller cannot grant a role it does not hold itself.'),\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'organizationMemberId',\n  'organizationUnitId',\n]);\n\nexport type OrganizationUnitMember = z.infer<typeof OrganizationUnitMemberSchema>;\n"]}