@wildo-ai/saas-models 1.1.7 → 1.1.8

package/dist/esm/organizations/service-provider-activity-feed.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-activity-feed.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-activity-feed.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,wIAAwI;AACxI;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,0DAAqB,CAAA;IACrB,gGAAgG;IAChG,wDAAmB,CAAA;AACrB,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,8BAKX;AALD,WAAY,8BAA8B;IACxC,4DAA4D;IAC5D,yDAAuB,CAAA;IACvB,yGAAyG;IACzG,qDAAmB,CAAA;AACrB,CAAC,EALW,8BAA8B,KAA9B,8BAA8B,QAKzC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,oGAAoG;IACpG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAChI,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAC9C,UAAU,CAAC,mCAAmC,CAAC;SAC/C,OAAO,CAAC,iCAAiC,CAAC,QAAQ,CAAC;SACnD,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IACpB,oDAAoD;IACpD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,yGAAyG;IACzG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACzG;;;;OAIG;IACH,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC1H,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1E,oEAAoE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,sGAAsG;IACtG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,iDAAiD;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,4DAA4D;IAC5D,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,8CAA8C;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACjG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE;IACnE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACrH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACpE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5I,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,+CAA+C;AAC/C,MAAM,CAAN,IAAY,8CAKX;AALD,WAAY,8CAA8C;IACxD,8GAA8G;IAC9G,mEAAiB,CAAA;IACjB,qGAAqG;IACrG,qEAAmB,CAAA;AACrB,CAAC,EALW,8CAA8C,KAA9C,8CAA8C,QAKzD;AACD,sFAAsF","sourcesContent":["/**\n * The firm's EXPERT-ACTIVITY FEED (#1632): an opt-in, metadata-only record, in the PROVIDER organization, of what its\n * own experts did inside client organizations.\n *\n * ## Why it exists, and why it is shaped this way\n *\n * Under #1597 an expert's actions are recorded in the CLIENT's audit trail, attributed to the relationship. The firm is\n * accountable for its staff and runs on operating metrics, and it cannot read that trail: it is another tenant's. The\n * field's answer is the shape Microsoft Partner Center gives a partner — an activity log of its own delegated actions\n * (date, affected customer, action, partner user) while the detailed in-tenant trail stays in the customer's tenant.\n *\n * Three constraints decide everything below:\n *\n * - **No client content, ever.** A firm acting for a client acts on the client's documented instructions (GDPR\n *   Art. 28(3)(a)); a firm-wide view of client content would make the firm decide purposes of its own over that data\n *   (Art. 28(10)). So an entry carries operation TYPES, resource TYPES, ids of the parties — never a record id, a\n *   field value, free text or a payload. {@link ServiceProviderActivityFeedEntryContentSchema} is STRICT so a new\n *   field is a deliberate schema change rather than a spread.\n * - **It is worker monitoring.** Collecting it is the FIRM's decision, recorded with who, when, and the fact that it\n *   was told consultation may be owed (BetrVG §87(1) no. 6; the CNIL's CSE consultation). The framework RECORDS the\n *   decision and does not judge its lawfulness. Off by default, with no row needed for \"off\".\n * - **The client can narrow or stop it** for its own tenant, per relationship\n *   (`ServiceProviderRelationship.activityFeedDisclosure`). An entry is written only when both sides allow it.\n *\n * Entries are written by the engine at AUDIT time, from the same attribution the audit writer already resolves for\n * the client's own row — never through a client-facing verb.\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\n\n/** @wildo_source:part:start saas.models.organizations.service-provider-activity-feed facet:layer:shared facet:audience:app-developer */\n/**\n * Whether the FIRM collects activity metadata about its own experts' work in client organizations (#1632).\n *\n * The absence of a settings row means {@link DISABLED}: switching the feed on is a recorded decision, and switching it\n * off again is one too.\n */\nexport enum ServiceProviderActivityFeedStatus {\n  /** No feed entry is written, whatever a client allows. The default. */\n  DISABLED = 'DISABLED',\n  /** Entries are written for every client whose relationship's disclosure level is not `NONE`. */\n  ENABLED = 'ENABLED',\n}\n\n/**\n * How an expert's operation in a client ended, as the firm's feed may say it (#1632).\n *\n * Its own vocabulary rather than the SIEM envelope's success/failure: this is what the FIRM is told about an act\n * performed elsewhere, and a client at `OPERATION_TYPE_ONLY` withholds it entirely.\n */\nexport enum ServiceProviderActivityOutcome {\n  /** The operation took effect in the client organization. */\n  SUCCEEDED = 'SUCCEEDED',\n  /** The client organization refused the operation (authorization, a policy gate). Nothing took effect. */\n  REFUSED = 'REFUSED',\n}\n\n/**\n * The firm's decision about its feed. One row per PROVIDER organization: a singleton the backend creates, DISABLED and\n * with no decision recorded, the first time the firm reads it or decides. An absent row still reads as\n * {@link ServiceProviderActivityFeedStatus.DISABLED}, which is what the feed writer relies on.\n */\nexport const ServiceProviderActivityFeedSettingsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /** The PROVIDER organization — the firm whose staff the feed is about. One row per organization. */\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n  status: z.enum(ServiceProviderActivityFeedStatus)\n    .systemEnum('ServiceProviderActivityFeedStatus')\n    .default(ServiceProviderActivityFeedStatus.DISABLED)\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n  /** The firm owner who made the current decision. */\n  decidedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /** When the current decision was made — for a firm's employee privacy information, \"collected since\". */\n  decidedAt: z.date().optional().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * Whether the person who ENABLED the feed was shown that works-council or CSE consultation and employee notice may\n   * be required before switching it on. Recorded, never judged: the framework states the notice and records that it\n   * was shown; whether consultation happened is the firm's to establish.\n   */\n  acknowledgedWorkerConsultationNotice: z.boolean().default(false).excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedSettings = z.infer<typeof ServiceProviderActivityFeedSettingsSchema>;\n\n/**\n * EVERYTHING a feed entry may say, and nothing else (#1632). Strict: an unknown key is refused, so widening what the\n * firm learns about client work is a deliberate change to this schema — never a spread of a richer object.\n *\n * Deliberately absent: the record id, field names or values, the request payload, free text, and anything the\n * client's own trail marks `.isAuditEvidence()`.\n */\nexport const ServiceProviderActivityFeedEntryContentSchema = z.strictObject({\n  /** The PROVIDER organization — the firm the entry is written to. */\n  organizationId: z.string().min(1),\n  /** The firm's expert who acted. */\n  expertUserId: z.string().min(1),\n  /** The CLIENT organization the expert acted in. A plain id: the firm cannot read the client's row. */\n  clientOrganizationId: z.string().min(1),\n  /** The relationship the expert acted through. */\n  relationshipId: z.string().min(1),\n  occurredAt: z.date(),\n  /** The operation TYPE (e.g. UPDATE), never which record. */\n  operationKind: z.enum(CoreResourceOperation),\n  /** The resource TYPE the operation was on. */\n  resourceType: z.string().min(1),\n  /** Present only when the client's disclosure level is `OPERATION_AND_OUTCOME`. */\n  outcome: z.enum(ServiceProviderActivityOutcome).optional(),\n});\nexport type ServiceProviderActivityFeedEntryContent = z.infer<typeof ServiceProviderActivityFeedEntryContentSchema>;\n\n/**\n * One feed entry as stored in the PROVIDER organization: the strict content plus the row's own identity. Written by\n * the engine only; no client-facing verb creates, changes or deletes one.\n */\nexport const ServiceProviderActivityFeedEntrySchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  expertUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  clientOrganizationId: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),\n  relationshipId: z.string().min(1).isDBIndexed().excludeFromUpdate(),\n  occurredAt: z.date().isDBIndexed().isSummaryField().excludeFromUpdate(),\n  operationKind: z.enum(CoreResourceOperation).systemEnum('CoreResourceOperation').isSummaryField().excludeFromUpdate(),\n  resourceType: z.string().min(1).isSummaryField().excludeFromUpdate(),\n  outcome: z.enum(ServiceProviderActivityOutcome).systemEnum('ServiceProviderActivityOutcome').optional().isSummaryField().excludeFromUpdate(),\n  createdAt: z.date().isDBIndexed().optional(),\n  updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedEntry = z.infer<typeof ServiceProviderActivityFeedEntrySchema>;\n\n/** The firm's two decisions about its feed. */\nexport enum ServiceProviderActivityFeedSettings_Operations {\n  /** Firm ORG_OWNER switches the feed on (step-up). Refused unless the consultation notice was acknowledged. */\n  ENABLE = 'enable',\n  /** Firm ORG_OWNER switches the feed off. Entries already written stay until their retention ends. */\n  DISABLE = 'disable',\n}\n/** @wildo_source:part:end saas.models.organizations.service-provider-activity-feed */\n"]}
+{"version":3,"file":"service-provider-activity-feed.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-activity-feed.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,wIAAwI;AACxI;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,0DAAqB,CAAA;IACrB,gGAAgG;IAChG,wDAAmB,CAAA;AACrB,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,8BAKX;AALD,WAAY,8BAA8B;IACxC,4DAA4D;IAC5D,yDAAuB,CAAA;IACvB,yGAAyG;IACzG,qDAAmB,CAAA;AACrB,CAAC,EALW,8BAA8B,KAA9B,8BAA8B,QAKzC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,oGAAoG;IACpG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAChI,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAC9C,UAAU,CAAC,mCAAmC,CAAC;SAC/C,OAAO,CAAC,iCAAiC,CAAC,QAAQ,CAAC;SACnD,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IACpB,oDAAoD;IACpD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,yGAAyG;IACzG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACzG;;;;OAIG;IACH,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC1H,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1E,oEAAoE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,sGAAsG;IACtG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,iDAAiD;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,4DAA4D;IAC5D,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,8CAA8C;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACjG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE;IACnE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACrH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACpE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5I,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,+CAA+C;AAC/C,MAAM,CAAN,IAAY,8CAKX;AALD,WAAY,8CAA8C;IACxD,8GAA8G;IAC9G,mEAAiB,CAAA;IACjB,qGAAqG;IACrG,qEAAmB,CAAA;AACrB,CAAC,EALW,8CAA8C,KAA9C,8CAA8C,QAKzD;AACD,sFAAsF","sourcesContent":["/**\n * The firm's EXPERT-ACTIVITY FEED (#1632): an opt-in, metadata-only record, in the PROVIDER organization, of what its\n * own experts did inside client organizations.\n *\n * ## Why it exists, and why it is shaped this way\n *\n * Under #1597 an expert's actions are recorded in the CLIENT's audit trail, attributed to the relationship. The firm is\n * accountable for its staff and runs on operating metrics, and it cannot read that trail: it is another tenant's. The\n * field's answer is the shape Microsoft Partner Center gives a partner — an activity log of its own delegated actions\n * (date, affected customer, action, partner user) while the detailed in-tenant trail stays in the customer's tenant.\n *\n * Three constraints decide everything below:\n *\n * - **No client content, ever.** A firm acting for a client acts on the client's documented instructions (GDPR\n *   Art. 28(3)(a)); a firm-wide view of client content would make the firm decide purposes of its own over that data\n *   (Art. 28(10)). So an entry carries operation TYPES, resource TYPES, ids of the parties — never a record id, a\n *   field value, free text or a payload. {@link ServiceProviderActivityFeedEntryContentSchema} is STRICT so a new\n *   field is a deliberate schema change rather than a spread.\n * - **It is worker monitoring.** Collecting it is the FIRM's decision, recorded with who, when, and the fact that it\n *   was told consultation may be owed (BetrVG §87(1) no. 6; the CNIL's CSE consultation). The framework RECORDS the\n *   decision and does not judge its lawfulness. Off by default, with no row needed for \"off\".\n * - **The client can narrow or stop it** for its own tenant, per relationship\n *   (`ServiceProviderRelationship.activityFeedDisclosure`). An entry is written only when both sides allow it.\n *\n * Entries are written by the engine at AUDIT time, from the same attribution the audit writer already resolves for\n * the client's own row — never through a client-facing verb.\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\n\n/** @wildo_source:part:start saas.models.organizations.service-provider-activity-feed facet:layer:shared facet:audience:app-developer */\n/**\n * Whether the FIRM collects activity metadata about its own experts' work in client organizations (#1632).\n *\n * The absence of a settings row means {@link DISABLED}: switching the feed on is a recorded decision, and switching it\n * off again is one too.\n */\nexport enum ServiceProviderActivityFeedStatus {\n  /** No feed entry is written, whatever a client allows. The default. */\n  DISABLED = 'DISABLED',\n  /** Entries are written for every client whose relationship's disclosure level is not `NONE`. */\n  ENABLED = 'ENABLED',\n}\n\n/**\n * How an expert's operation in a client ended, as the firm's feed may say it (#1632).\n *\n * Its own vocabulary rather than the SIEM envelope's success/failure: this is what the FIRM is told about an act\n * performed elsewhere, and a client at `OPERATION_TYPE_ONLY` withholds it entirely.\n */\nexport enum ServiceProviderActivityOutcome {\n  /** The operation took effect in the client organization. */\n  SUCCEEDED = 'SUCCEEDED',\n  /** The client organization refused the operation (authorization, a policy gate). Nothing took effect. */\n  REFUSED = 'REFUSED',\n}\n\n/**\n * The firm's decision about its feed. One row per PROVIDER organization: a singleton the backend creates, DISABLED and\n * with no decision recorded, the first time the firm reads it or decides. An absent row still reads as\n * {@link ServiceProviderActivityFeedStatus.DISABLED}, which is what the feed writer relies on.\n */\nexport const ServiceProviderActivityFeedSettingsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /** The PROVIDER organization — the firm whose staff the feed is about. One row per organization. */\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n  status: z.enum(ServiceProviderActivityFeedStatus)\n    .systemEnum('ServiceProviderActivityFeedStatus')\n    .default(ServiceProviderActivityFeedStatus.DISABLED)\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n  /** The firm owner who made the current decision. */\n  decidedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /** When the current decision was made — for a firm's employee privacy information, \"collected since\". */\n  decidedAt: z.date().optional().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * Whether the person who ENABLED the feed was shown that works-council or CSE consultation and employee notice may\n   * be required before switching it on. Recorded, never judged: the framework states the notice and records that it\n   * was shown; whether consultation happened is the firm's to establish.\n   */\n  acknowledgedWorkerConsultationNotice: z.boolean().default(false).excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedSettings = z.infer<typeof ServiceProviderActivityFeedSettingsSchema>;\n\n/**\n * EVERYTHING a feed entry may say, and nothing else (#1632). Strict: an unknown key is refused, so widening what the\n * firm learns about client work is a deliberate change to this schema — never a spread of a richer object.\n *\n * Deliberately absent: the record id, field names or values, the request payload, free text, and anything the\n * client's own trail marks `.isAuditEvidence()`.\n */\nexport const ServiceProviderActivityFeedEntryContentSchema = z.strictObject({\n  /** The PROVIDER organization — the firm the entry is written to. */\n  organizationId: z.string().min(1),\n  /** The firm's expert who acted. */\n  expertUserId: z.string().min(1),\n  /** The CLIENT organization the expert acted in. A plain id: the firm cannot read the client's row. */\n  clientOrganizationId: z.string().min(1),\n  /** The relationship the expert acted through. */\n  relationshipId: z.string().min(1),\n  occurredAt: z.date(),\n  /** The operation TYPE (e.g. UPDATE), never which record. */\n  operationKind: z.enum(CoreResourceOperation),\n  /** The resource TYPE the operation was on. */\n  resourceType: z.string().min(1),\n  /** Present only when the client's disclosure level is `OPERATION_AND_OUTCOME`. */\n  outcome: z.enum(ServiceProviderActivityOutcome).optional(),\n});\nexport type ServiceProviderActivityFeedEntryContent = z.infer<typeof ServiceProviderActivityFeedEntryContentSchema>;\n\n/**\n * One feed entry as stored in the PROVIDER organization: the strict content plus the row's own identity. Written by\n * the engine only; no client-facing verb creates, changes or deletes one.\n */\nexport const ServiceProviderActivityFeedEntrySchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  expertUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  clientOrganizationId: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),\n  relationshipId: z.string().min(1).isDBIndexed().excludeFromUpdate(),\n  occurredAt: z.date().isDBIndexed().isSummaryField().excludeFromUpdate(),\n  operationKind: z.enum(CoreResourceOperation).systemEnum('CoreResourceOperation').isSummaryField().excludeFromUpdate(),\n  resourceType: z.string().min(1).isSummaryField().excludeFromUpdate(),\n  outcome: z.enum(ServiceProviderActivityOutcome).systemEnum('ServiceProviderActivityOutcome').optional().isSummaryField().excludeFromUpdate(),\n  createdAt: z.date().isDBIndexed().optional(),\n  updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedEntry = z.infer<typeof ServiceProviderActivityFeedEntrySchema>;\n\n/** The firm's two decisions about its feed. */\nexport enum ServiceProviderActivityFeedSettings_Operations {\n  /** Firm ORG_OWNER switches the feed on (step-up). Refused unless the consultation notice was acknowledged. */\n  ENABLE = 'enable',\n  /** Firm ORG_OWNER switches the feed off. Entries already written stay until their retention ends. */\n  DISABLE = 'disable',\n}\n/** @wildo_source:part:end saas.models.organizations.service-provider-activity-feed */\n"]}

package/dist/esm/organizations/service-provider-capability-grants.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-capability-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-capability-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EAEjC,oCAAoC,EACpC,0CAA0C,EAC3C,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAUjC,eAAO,MAAM,0EAA0E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;kBAqIrI,CAAC"}
+{"version":3,"file":"service-provider-capability-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/service-provider-capability-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EAEjC,oCAAoC,EACpC,0CAA0C,EAC3C,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAUjC,eAAO,MAAM,0EAA0E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;kBAqIrI,CAAC"}

package/dist/esm/organizations/service-provider-capability-grants.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-capability-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-capability-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAWlH,oHAAoH;AACpH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IACrD,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0EAA0E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC3I,0CAA0C,CAIxC;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,kCAAkC;IACvE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,kCAAkC,CAAC;IAChH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB;;;;OAIG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;KAC7C;IACD,sHAAsH;IACtH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;;OAIG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;QAC7C,gBAAgB,EAAE,SAAS;KAC5B;IACD,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,KAAK,CAAC,EAAE;YAClD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,uBAAuB,CAAC,EAAE;YACpE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED,8GAA8G;QAC9G,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;iBAC9G,CAAC;SACH;QAED;;;WAGG;QACH,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * `SERVICE_PROVIDER_CAPABILITY_GRANTS` — the client's delegated administrative capabilities, one row per grant (#1631).\n *\n * Stored in the CLIENT organization, which lends them; the firm has no verb on this resource and reads what it holds on\n * its engagement mirror. There is no generic CREATE or UPDATE: the verbs author every field, which is what makes a row\n * evidence rather than a form.\n *\n * Two grant verbs rather than one with a role check inside: the ordinary `grant` is a client administrator's, the\n * security-critical `grantSecurityCritical` is the OWNER's with step-up. Declaring each as its own variant lets the\n * framework's role gate and step-up gate enforce the split, and the implementation refuses a capability sent to the\n * wrong verb (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`), so an administrator can never reach a security-critical\n * capability through the ordinary door.\n */\n\nimport { z } from 'zod';\nimport {\n  DelegatedAdministrativeCapability,\n  ServiceProviderCapabilityGrantSchema,\n  ServiceProviderCapabilityGrantStatus,\n  ServiceProviderCapabilityGrants_Operations,\n} from './service-provider-capability-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\n\ntype CapabilityGrantCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\n/** What a grant request carries: the relationship, the capability and when it ends. The rest is server-authored. */\nconst grantRequestDto = z.object({\n  relationshipId: z.string().min(1),\n  capability: z.enum(DelegatedAdministrativeCapability),\n  /** Required: a delegation always ends. At most two years, or the security-critical cap. */\n  endsAt: z.coerce.date(),\n});\n\nexport const serviceProviderCapabilityGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceProviderCapabilityGrants_Operations,\n    CapabilityGrantCoreOperations,\n    typeof ServiceProviderCapabilityGrantSchema\n  >({\n    mainSchema: ServiceProviderCapabilityGrantSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    /**\n     * `read` / `list` are ALLOWED because the execution-context live filter reads grants on a system context to decide a\n     * caller's authority — the caller is, by construction, not yet authorized. `update` is the verbs' system door for the\n     * mirror sync and the relationship-end revocation.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n      updateMany: ResourceSystemAccessMode.ALLOWED,\n    },\n    /** A grant holds ids, a capability, dates and a status — no personal text to scrub. Kept whole as access evidence. */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n    /**\n     * The AUDIT_LOGS class from the moment the grant ENDS (#1613): who from outside could administer what, and when, is\n     * what an access review asks years later. `endedAt` is set on revoke and on the sweep's relabel; while ACTIVE it is\n     * null and the row never expires.\n     */\n    retentionBinding: {\n      retentionClass: DataRetentionClass.AUDIT_LOGS,\n      startPoint: RetentionStartPoint.CLOSURE_EVENT,\n      closureFieldName: 'endedAt',\n    },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      // The retention writer's verb, and the purge cascade's DELETE — no client route.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The system door the verbs write through. INTERNAL_CALL registers no route.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /**\n       * A client administrator lends one ORDINARY capability to a live relationship, for at most two years. A\n       * security-critical capability sent here is refused (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`).\n       *\n       * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — delegated administration is named, time-bound and client-revocable.\n       */\n      [ServiceProviderCapabilityGrants_Operations.GRANT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: grantRequestDto,\n        }],\n      },\n\n      /**\n       * The client OWNER lends one SECURITY-CRITICAL capability, with step-up, for a task-sized window (30 days at most,\n       * or the application's lower cap). There is no renewal: a new window is a new grant by an owner.\n       *\n       * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a capability that decides who can sign in or act as the client is lent only by its owner, briefly.\n       */\n      [ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requiresStepUpAuthentication: true,\n          requestDto: grantRequestDto,\n        }],\n      },\n\n      /** A client administrator revokes a grant — any grant, at any time, without asking the firm. Next request. */\n      [ServiceProviderCapabilityGrants_Operations.REVOKE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderCapabilityGrantStatus.ACTIVE,\n        }],\n      },\n\n      /**\n       * ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. Bookkeeping: the grant already\n       * stopped conferring at `endsAt`, which is what admission reads.\n       */\n      [ServiceProviderCapabilityGrants_Operations.EXPIRE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n        }],\n      },\n    },\n  });\n"]}
+{"version":3,"file":"service-provider-capability-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-capability-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAWlH,oHAAoH;AACpH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IACrD,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0EAA0E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC3I,0CAA0C,CAIxC;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,kCAAkC;IACvE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,kCAAkC,CAAC;IAChH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB;;;;OAIG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;KAC7C;IACD,sHAAsH;IACtH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;;OAIG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;QAC7C,gBAAgB,EAAE,SAAS;KAC5B;IACD,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,KAAK,CAAC,EAAE;YAClD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,uBAAuB,CAAC,EAAE;YACpE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED,8GAA8G;QAC9G,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;iBAC9G,CAAC;SACH;QAED;;;WAGG;QACH,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * `SERVICE_PROVIDER_CAPABILITY_GRANTS` — the client's delegated administrative capabilities, one row per grant (#1631).\n *\n * Stored in the CLIENT organization, which lends them; the firm has no verb on this resource and reads what it holds on\n * its engagement mirror. There is no generic CREATE or UPDATE: the verbs author every field, which is what makes a row\n * evidence rather than a form.\n *\n * Two grant verbs rather than one with a role check inside: the ordinary `grant` is a client administrator's, the\n * security-critical `grantSecurityCritical` is the OWNER's with step-up. Declaring each as its own variant lets the\n * framework's role gate and step-up gate enforce the split, and the implementation refuses a capability sent to the\n * wrong verb (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`), so an administrator can never reach a security-critical\n * capability through the ordinary door.\n */\n\nimport { z } from 'zod';\nimport {\n  DelegatedAdministrativeCapability,\n  ServiceProviderCapabilityGrantSchema,\n  ServiceProviderCapabilityGrantStatus,\n  ServiceProviderCapabilityGrants_Operations,\n} from './service-provider-capability-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\n\ntype CapabilityGrantCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\n/** What a grant request carries: the relationship, the capability and when it ends. The rest is server-authored. */\nconst grantRequestDto = z.object({\n  relationshipId: z.string().min(1),\n  capability: z.enum(DelegatedAdministrativeCapability),\n  /** Required: a delegation always ends. At most two years, or the security-critical cap. */\n  endsAt: z.coerce.date(),\n});\n\nexport const serviceProviderCapabilityGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceProviderCapabilityGrants_Operations,\n    CapabilityGrantCoreOperations,\n    typeof ServiceProviderCapabilityGrantSchema\n  >({\n    mainSchema: ServiceProviderCapabilityGrantSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    /**\n     * `read` / `list` are ALLOWED because the execution-context live filter reads grants on a system context to decide a\n     * caller's authority — the caller is, by construction, not yet authorized. `update` is the verbs' system door for the\n     * mirror sync and the relationship-end revocation.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n      updateMany: ResourceSystemAccessMode.ALLOWED,\n    },\n    /** A grant holds ids, a capability, dates and a status — no personal text to scrub. Kept whole as access evidence. */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n    /**\n     * The AUDIT_LOGS class from the moment the grant ENDS (#1613): who from outside could administer what, and when, is\n     * what an access review asks years later. `endedAt` is set on revoke and on the sweep's relabel; while ACTIVE it is\n     * null and the row never expires.\n     */\n    retentionBinding: {\n      retentionClass: DataRetentionClass.AUDIT_LOGS,\n      startPoint: RetentionStartPoint.CLOSURE_EVENT,\n      closureFieldName: 'endedAt',\n    },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      // The retention writer's verb, and the purge cascade's DELETE — no client route.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The system door the verbs write through. INTERNAL_CALL registers no route.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /**\n       * A client administrator lends one ORDINARY capability to a live relationship, for at most two years. A\n       * security-critical capability sent here is refused (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`).\n       *\n       * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — delegated administration is named, time-bound and client-revocable.\n       */\n      [ServiceProviderCapabilityGrants_Operations.GRANT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: grantRequestDto,\n        }],\n      },\n\n      /**\n       * The client OWNER lends one SECURITY-CRITICAL capability, with step-up, for a task-sized window (30 days at most,\n       * or the application's lower cap). There is no renewal: a new window is a new grant by an owner.\n       *\n       * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a capability that decides who can sign in or act as the client is lent only by its owner, briefly.\n       */\n      [ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requiresStepUpAuthentication: true,\n          requestDto: grantRequestDto,\n        }],\n      },\n\n      /** A client administrator revokes a grant — any grant, at any time, without asking the firm. Next request. */\n      [ServiceProviderCapabilityGrants_Operations.REVOKE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderCapabilityGrantStatus.ACTIVE,\n        }],\n      },\n\n      /**\n       * ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. Bookkeeping: the grant already\n       * stopped conferring at `endsAt`, which is what admission reads.\n       */\n      [ServiceProviderCapabilityGrants_Operations.EXPIRE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n        }],\n      },\n    },\n  });\n"]}

package/dist/esm/organizations/service-provider-capability-grants.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-capability-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA4B,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,cAAc,mBAAmB;IACjC;;;OAGG;IACH,2BAA2B,gCAAgC;IAC3D,kDAAkD;IAClD,gBAAgB,qBAAqB;IACrC,sFAAsF;IACtF,eAAe,oBAAoB;IACnC,oEAAoE;IACpE,eAAe,oBAAoB;IACnC,6GAA6G;IAC7G,qBAAqB,0BAA0B;CAChD;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,iCAAiC,EAAE,cAAc,CAAC,CAOxG,CAAC;AAEH,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAA6D,CAAC;AAEzH,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,EAAE,SAAS,iCAAiC,EAI/F,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,iCAAiC,EAOhG,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAEhE,8BAA8B;AAC9B,oBAAY,oCAAoC;IAC9C,mFAAmF;IACnF,MAAM,WAAW;IACjB,8EAA8E;IAC9E,OAAO,YAAY;IACnB,uGAAuG;IACvG,OAAO,YAAY;CACpB;AAED,4GAA4G;AAC5G,oBAAY,sCAAsC;IAChD,yCAAyC;IACzC,iBAAiB,sBAAsB;IACvC,6FAA6F;IAC7F,kBAAkB,uBAAuB;IACzC,8FAA8F;IAC9F,qBAAqB,0BAA0B;CAChD;AAED,gGAAgG;AAChG,oBAAY,0CAA0C;IACpD,4EAA4E;IAC5E,KAAK,UAAU;IACf,oGAAoG;IACpG,uBAAuB,0BAA0B;IACjD,kHAAkH;IAClH,MAAM,WAAW;IACjB,sFAAsF;IACtF,MAAM,WAAW;CAClB;AAED,yHAAyH;AACzH,oBAAY,uCAAuC;IACjD,kHAAkH;IAClH,iDAAiD,sDAAsD;IACvG,gHAAgH;IAChH,4CAA4C,iDAAiD;IAC7F,yEAAyE;IACzE,4CAA4C,iDAAiD;IAC7F,yFAAyF;IACzF,mEAAmE,wEAAwE;IAC3I,0HAA0H;IAC1H,2CAA2C,gDAAgD;IAC3F,uGAAuG;IACvG,uDAAuD,4DAA4D;CACpH;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,wBAAgB,0CAA0C,CACxD,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAC/F,GAAG,EAAE,IAAI,GACR,OAAO,CAKT;AAID;;;;;GAKG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE;IAChE,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,0CAA0C,CAAC,KAAK,GAAG,0CAA0C,CAAC,uBAAuB,CAAC;IACrI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,yEAAyE;IACzE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACpE,2GAA2G;IAC3G,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;CACnD,GACG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAA;CAAE,CAiBtF;AAED;;;GAGG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;iBAwC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,0CAA0C;;;iBAIrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,sGAAsG;AACtG,oBAAY,oCAAoC;IAC9C,uHAAuH;IACvH,0BAA0B,+BAA+B;IACzD,gJAAgJ;IAChJ,sCAAsC,2CAA2C;IACjF;;;OAGG;IACH,yCAAyC,8CAA8C;CACxF;AAED;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,8GAA8G;IAC9G,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;IACxE,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,6GAA6G;IAC7G,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD,GAAG;IAAE,UAAU,EAAE,iCAAiC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,oCAAoC,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAmBtI"}
+{"version":3,"file":"service-provider-capability-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA4B,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,cAAc,mBAAmB;IACjC;;;OAGG;IACH,2BAA2B,gCAAgC;IAC3D,kDAAkD;IAClD,gBAAgB,qBAAqB;IACrC,sFAAsF;IACtF,eAAe,oBAAoB;IACnC,oEAAoE;IACpE,eAAe,oBAAoB;IACnC,6GAA6G;IAC7G,qBAAqB,0BAA0B;CAChD;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,iCAAiC,EAAE,cAAc,CAAC,CAOxG,CAAC;AAEH,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAA6D,CAAC;AAEzH,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,EAAE,SAAS,iCAAiC,EAI/F,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,iCAAiC,EAOhG,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAEhE,8BAA8B;AAC9B,oBAAY,oCAAoC;IAC9C,mFAAmF;IACnF,MAAM,WAAW;IACjB,8EAA8E;IAC9E,OAAO,YAAY;IACnB,uGAAuG;IACvG,OAAO,YAAY;CACpB;AAED,4GAA4G;AAC5G,oBAAY,sCAAsC;IAChD,yCAAyC;IACzC,iBAAiB,sBAAsB;IACvC,6FAA6F;IAC7F,kBAAkB,uBAAuB;IACzC,8FAA8F;IAC9F,qBAAqB,0BAA0B;CAChD;AAED,gGAAgG;AAChG,oBAAY,0CAA0C;IACpD,4EAA4E;IAC5E,KAAK,UAAU;IACf,oGAAoG;IACpG,uBAAuB,0BAA0B;IACjD,kHAAkH;IAClH,MAAM,WAAW;IACjB,sFAAsF;IACtF,MAAM,WAAW;CAClB;AAED,yHAAyH;AACzH,oBAAY,uCAAuC;IACjD,kHAAkH;IAClH,iDAAiD,sDAAsD;IACvG,gHAAgH;IAChH,4CAA4C,iDAAiD;IAC7F,yEAAyE;IACzE,4CAA4C,iDAAiD;IAC7F,yFAAyF;IACzF,mEAAmE,wEAAwE;IAC3I,0HAA0H;IAC1H,2CAA2C,gDAAgD;IAC3F,uGAAuG;IACvG,uDAAuD,4DAA4D;CACpH;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,wBAAgB,0CAA0C,CACxD,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAC/F,GAAG,EAAE,IAAI,GACR,OAAO,CAKT;AAID;;;;;GAKG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE;IAChE,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,0CAA0C,CAAC,KAAK,GAAG,0CAA0C,CAAC,uBAAuB,CAAC;IACrI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,yEAAyE;IACzE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACpE,2GAA2G;IAC3G,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;CACnD,GACG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAA;CAAE,CAiBtF;AAED;;;GAGG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;iBAwC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,0CAA0C;;;iBAIrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,sGAAsG;AACtG,oBAAY,oCAAoC;IAC9C,uHAAuH;IACvH,0BAA0B,+BAA+B;IACzD,gJAAgJ;IAChJ,sCAAsC,2CAA2C;IACjF;;;OAGG;IACH,yCAAyC,8CAA8C;CACxF;AAED;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,8GAA8G;IAC9G,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;IACxE,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,6GAA6G;IAC7G,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD,GAAG;IAAE,UAAU,EAAE,iCAAiC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,oCAAoC,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAmBtI"}

package/dist/esm/organizations/service-provider-capability-grants.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-capability-grants.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,MAAM,CAAN,IAAY,iCAgBX;AAhBD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,sEAAiC,CAAA;IACjC;;;OAGG;IACH,gGAA2D,CAAA;IAC3D,kDAAkD;IAClD,0EAAqC,CAAA;IACrC,sFAAsF;IACtF,wEAAmC,CAAA;IACnC,oEAAoE;IACpE,wEAAmC,CAAA;IACnC,6GAA6G;IAC7G,oFAA+C,CAAA;AACjD,CAAC,EAhBW,iCAAiC,KAAjC,iCAAiC,QAgB5C;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwE,MAAM,CAAC,MAAM,CAAC;IAC1H,CAAC,iCAAiC,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,4BAA4B;IAC/F,CAAC,iCAAiC,CAAC,2BAA2B,CAAC,EAAE,cAAc,CAAC,yCAAyC;IACzH,CAAC,iCAAiC,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,8BAA8B;IACnG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC,mCAAmC;CAC9G,CAAC,CAAC;AAEH,6HAA6H;AAC7H,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAEzH,qEAAqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAiD,MAAM,CAAC,MAAM,CAAC;IAClH,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAiD,MAAM,CAAC,MAAM,CAAC;IACnH,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,2BAA2B;IAC7D,iCAAiC,CAAC,gBAAgB;IAClD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH,qGAAqG;AACrG,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AACjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,EAAE,CAAC;AAEhE,8BAA8B;AAC9B,MAAM,CAAN,IAAY,oCAOX;AAPD,WAAY,oCAAoC;IAC9C,mFAAmF;IACnF,yDAAiB,CAAA;IACjB,8EAA8E;IAC9E,2DAAmB,CAAA;IACnB,uGAAuG;IACvG,2DAAmB,CAAA;AACrB,CAAC,EAPW,oCAAoC,KAApC,oCAAoC,QAO/C;AAED,4GAA4G;AAC5G,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,yCAAyC;IACzC,iFAAuC,CAAA;IACvC,6FAA6F;IAC7F,mFAAyC,CAAA;IACzC,8FAA8F;IAC9F,yFAA+C,CAAA;AACjD,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED,gGAAgG;AAChG,MAAM,CAAN,IAAY,0CASX;AATD,WAAY,0CAA0C;IACpD,4EAA4E;IAC5E,6DAAe,CAAA;IACf,oGAAoG;IACpG,+FAAiD,CAAA;IACjD,kHAAkH;IAClH,+DAAiB,CAAA;IACjB,sFAAsF;IACtF,+DAAiB,CAAA;AACnB,CAAC,EATW,0CAA0C,KAA1C,0CAA0C,QASrD;AAED,yHAAyH;AACzH,MAAM,CAAN,IAAY,uCAaX;AAbD,WAAY,uCAAuC;IACjD,kHAAkH;IAClH,kJAAuG,CAAA;IACvG,gHAAgH;IAChH,wIAA6F,CAAA;IAC7F,yEAAyE;IACzE,wIAA6F,CAAA;IAC7F,yFAAyF;IACzF,sLAA2I,CAAA;IAC3I,0HAA0H;IAC1H,sIAA2F,CAAA;IAC3F,uGAAuG;IACvG,8JAAmH,CAAA;AACrH,CAAC,EAbW,uCAAuC,KAAvC,uCAAuC,QAalD;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,MAAM,UAAU,0CAA0C,CACxD,KAA+F,EAC/F,GAAS;IAET,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAS1D;IAGC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7F,MAAM,YAAY,GAAG,gBAAgB;QACnC,CAAC,CAAC,0CAA0C,CAAC,uBAAuB;QACpE,CAAC,CAAC,0CAA0C,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACvJ,IAAI,CAAC,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,yCAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACrI,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,mEAAmE,EAAE,CAAC;IAC/I,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,6CAA6C,EAAE,KAAK,CAAC,+BAA+B,IAAI,6CAA6C,CAAC;QACjJ,CAAC,CAAC,6BAA6B,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;QACvH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,sHAAsH;IACtH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzI,yHAAyH;IACzH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEjH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAClD,UAAU,CAAC,mCAAmC,CAAC;SAC/C,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,+HAA+H;IAC/H,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;SACjD,UAAU,CAAC,sCAAsC,CAAC;SAClD,OAAO,CAAC,oCAAoC,CAAC,MAAM,CAAC;SACpD,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,iHAAiH;IACjH,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,UAAU,CAAC,mCAAmC,CAAC;SAClG,QAAQ,CAAC,iFAAiF,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACvE,CAAC,CAAC;AAGH,sGAAsG;AACtG,MAAM,CAAN,IAAY,oCAUX;AAVD,WAAY,oCAAoC;IAC9C,uHAAuH;IACvH,iGAAyD,CAAA;IACzD,gJAAgJ;IAChJ,yHAAiF,CAAA;IACjF;;;OAGG;IACH,+HAAuF,CAAA;AACzF,CAAC,EAVW,oCAAoC,KAApC,oCAAoC,QAU/C;AAED;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CAAC,KAMxD;IACC,MAAM,UAAU,GAAwI,EAAE,CAAC;IAC3J,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,sCAAsC,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,yCAAyC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["/**\n * Delegated administrative capabilities (#1631) — a CLIENT organization lends one service firm's experts a NAMED,\n * narrow, time-bound administrative capability, without ever making the firm an administrator.\n *\n * ## The shape, and why capabilities are ROLES\n *\n * Paul (2026-09-25, #1597 Q2): never admin by default; narrow, time-limited, client-revocable delegation; a\n * security-critical capability needs the client's OWNER, is time-bound, and is never renewed automatically. Issue\n * #1631 records the practice this follows (Microsoft's granular delegated admin privileges for partners, with a\n * time-bound relationship that cannot be auto-extended for the highest role) with its sources; nothing here quotes\n * them.\n *\n * A capability is a NAMED ROLE in the organization role table, one per {@link DelegatedAdministrativeCapability},\n * inheriting from nothing, and listed EXPLICITLY — beside `ORG_ADMIN` — in the `roles` of exactly the core operations\n * it opens. The rejected alternative (review F7) was an operation-id allow-list per grant: a second authority beside\n * role resolution that the ~20 `initiatorRoles` readers and the role ceiling would not know about.\n *\n * ## Grants are rows, filtered live\n *\n * `SERVICE_PROVIDER_CAPABILITY_GRANTS` rows live in the CLIENT organization. The execution-context live filter that\n * decides whether a provider membership confers anything (#1597) reads the relationship's grants in the same pass and\n * adds a capability's role to the expert's entries only while {@link isServiceProviderCapabilityGrantConferring}\n * holds — ACTIVE and `endsAt` still in the future. `EXPIRED` is sweep bookkeeping: admission reads `endsAt`.\n *\n * ## What delegation never does\n *\n * No capability confers `ORG_ADMIN` or `ORG_OWNER`, accepts a relationship, amends its scope, delegates further, or\n * counts toward the owner floor (provider memberships never do). Startup refuses a capability role whose `inheritFrom`\n * chain reaches an administration anchor.\n */\n\nimport { z } from 'zod';\nimport { CORE_ORG_ROLES, isInboundHandlerOnlyRole } from '../security/authorizations/roles.shared.schemas';\n\n/** @wildo_source:part:start saas.models.organizations.service-provider-capability-grants facet:layer:shared facet:audience:app-developer */\n/**\n * The closed set of administrative capabilities a client may lend a service firm (#1631). Each is ONE role\n * ({@link DELEGATED_CAPABILITY_ROLE}); a grant names one capability.\n */\nexport enum DelegatedAdministrativeCapability {\n  /** Invite people into the client, resend an invitation, revoke one. */\n  INVITE_MEMBERS = 'INVITE_MEMBERS',\n  /**\n   * Suspend or remove the firm's OWN experts under this relationship — never an ordinary member, never another firm's.\n   * Deliberately not reactivate: lifting a suspension would let the firm undo the client's bar against one person (#1597).\n   */\n  MANAGE_RELATIONSHIP_EXPERTS = 'MANAGE_RELATIONSHIP_EXPERTS',\n  /** Read the client organization's audit trail. */\n  READ_AUDIT_TRAIL = 'READ_AUDIT_TRAIL',\n  /** Configure the client's single sign-on and SCIM provisioning. Security-critical. */\n  MANAGE_SSO_SCIM = 'MANAGE_SSO_SCIM',\n  /** Manage the client organization's API keys. Security-critical. */\n  MANAGE_API_KEYS = 'MANAGE_API_KEYS',\n  /** Approve or deny, as the tenant, a platform operator's request to access the client. Security-critical. */\n  APPROVE_ACCESS_GRANTS = 'APPROVE_ACCESS_GRANTS',\n}\n\n/**\n * The role each capability confers — the ONE mapping, total over the enum, so a capability added tomorrow is a compile\n * error here rather than a grant that confers nothing.\n */\nexport const DELEGATED_CAPABILITY_ROLE: Readonly<Record<DelegatedAdministrativeCapability, CORE_ORG_ROLES>> = Object.freeze({\n  [DelegatedAdministrativeCapability.INVITE_MEMBERS]: CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS,\n  [DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS,\n  [DelegatedAdministrativeCapability.READ_AUDIT_TRAIL]: CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL,\n  [DelegatedAdministrativeCapability.MANAGE_SSO_SCIM]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM,\n  [DelegatedAdministrativeCapability.MANAGE_API_KEYS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS,\n  [DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS]: CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS,\n});\n\n/** Every capability role — conferred ONLY by a live grant, never by a membership row (the member role doors refuse them). */\nexport const DELEGATED_CAPABILITY_ROLES: ReadonlySet<string> = new Set<string>(Object.values(DELEGATED_CAPABILITY_ROLE));\n\n/** Whether `role` is one only a live capability grant may confer. */\nexport function isDelegatedCapabilityRole(role: string): boolean {\n  return DELEGATED_CAPABILITY_ROLES.has(role);\n}\n\n/**\n * Whether an organization MEMBERSHIP may hold `role` at all, whatever its organization's type (#1921): not a\n * handler-only role (an engine inbound handler's alone, #1629) and not a delegated capability role (a live grant's alone,\n * #1631). The ONE statement of that rule for every surface that offers or names a role a person holds — the published\n * role table a picker offers, and a setting that names one role (`contentReaderRole`). The membership write door\n * (`validateOrgMemberRoles`) refuses each of the two kinds with its own reason; a kind added here must be refused there too.\n */\nexport function roleMayBeHeldByMembership(role: string): boolean {\n  return !isInboundHandlerOnlyRole(role) && !isDelegatedCapabilityRole(role);\n}\n\n/**\n * Capabilities that change who can authenticate into, or act as, the client: only the client's OWNER grants them,\n * with step-up, for a task-sized window ({@link SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS} at most), and a renewal is\n * a new grant — there is no `autoRenew`.\n */\nexport const SECURITY_CRITICAL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n  DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n  DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n  DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/**\n * Capabilities that need an ORGANIZATION-WIDE relationship: refused at grant time on a relationship confined to\n * organization units, because a unit-scoped relationship has no organization-wide entry (#1597 F5) to carry them.\n *\n * Every capability is here, and that is measured rather than assumed: each one opens operations on resources that do\n * not narrow by organization unit (members, audit logs, SSO / SCIM, API keys, platform access grants), and the role gate\n * on those counts only organization-wide entries. A capability granted on a unit-scoped relationship would therefore\n * be audited, mirrored to the firm as held, and confer nothing — a grant that lies. The list stays a list (rather than\n * a blanket rule) so a future capability that opens a unit-narrowable operation can be left off it deliberately.\n */\nexport const ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n  DelegatedAdministrativeCapability.INVITE_MEMBERS,\n  DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS,\n  DelegatedAdministrativeCapability.READ_AUDIT_TRAIL,\n  DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n  DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n  DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/** The longest an ordinary capability may be granted for: two years, GDAP's relationship maximum. */\nexport const DELEGATED_CAPABILITY_MAX_DAYS = 730;\n/**\n * The longest a security-critical capability may be granted for, unless the application declares a lower cap\n * (`acceptsServiceProviders.securityCriticalCapabilityMaxDays`). A reversible default chosen for #1631 — a task-sized\n * window, far below the relationship maximum — NOT a figure taken from GDAP.\n */\nexport const SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS = 30;\n\n/** Where one grant stands. */\nexport enum ServiceProviderCapabilityGrantStatus {\n  /** Granted and not revoked. Confers only while `endsAt` is still in the future. */\n  ACTIVE = 'ACTIVE',\n  /** A client administrator revoked it, or the relationship ended. Terminal. */\n  REVOKED = 'REVOKED',\n  /** The sweep relabelled it after `endsAt`. Terminal bookkeeping — admission never reads this label. */\n  EXPIRED = 'EXPIRED',\n}\n\n/** Why a grant stopped conferring before its term — what a REVOKED audit row records (#1631 review F10). */\nexport enum ServiceProviderCapabilityGrantEndCause {\n  /** A client administrator revoked it. */\n  REVOKED_BY_CLIENT = 'REVOKED_BY_CLIENT',\n  /** Its relationship ended (terminated, withdrawn, expired, declined, or a party removed). */\n  RELATIONSHIP_ENDED = 'RELATIONSHIP_ENDED',\n  /** Its relationship was narrowed to organization units, which cannot carry any capability. */\n  RELATIONSHIP_NARROWED = 'RELATIONSHIP_NARROWED',\n}\n\n/** The client's verbs on its grants. The firm has none: it can never grant, widen or extend. */\nexport enum ServiceProviderCapabilityGrants_Operations {\n  /** Client ORG_ADMIN lends an ORDINARY capability, for at most two years. */\n  GRANT = 'grant',\n  /** Client ORG_OWNER lends a SECURITY-CRITICAL capability, with step-up, for a task-sized window. */\n  GRANT_SECURITY_CRITICAL = 'grantSecurityCritical',\n  /** Client ORG_ADMIN revokes any grant, at any time, without asking the firm. Takes effect on the next request. */\n  REVOKE = 'revoke',\n  /** ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. */\n  EXPIRE = 'expire',\n}\n\n/** The client-branchable codes a refused grant carries (409: authorized caller, valid payload, the STATE forbids it). */\nexport enum ServiceProviderCapabilityGrantErrorCode {\n  /** The relationship is not ACTIVE (or SUSPENDED) — nothing can be lent to a relationship that confers nothing. */\n  SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE = 'SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE',\n  /** A security-critical capability through the ordinary `grant`, or an ordinary one through the owner's verb. */\n  SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB = 'SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB',\n  /** `endsAt` beyond the cap for this capability, or not in the future. */\n  SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED = 'SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED',\n  /** An organization-level capability on a relationship confined to organization units. */\n  SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP',\n  /** An ACTIVE grant of this capability already exists on this relationship; revoke it first (a renewal is a new grant). */\n  SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED = 'SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED',\n  /** MANAGE_RELATIONSHIP_EXPERTS used on a membership that is not an expert of the SAME relationship. */\n  SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP',\n}\n/** @wildo_source:part:end saas.models.organizations.service-provider-capability-grants */\n\n/**\n * Does this grant confer its capability RIGHT NOW? The ONE predicate the live filter uses: ACTIVE, and `endsAt` in the\n * future. `endsAt` is read here rather than trusting the EXPIRED label, so a grant stops working the moment its term\n * passes whether or not the sweep has run (invariant 1).\n */\nexport function isServiceProviderCapabilityGrantConferring(\n  grant: { readonly status?: unknown; readonly endsAt?: Date | string | null } | null | undefined,\n  now: Date,\n): boolean {\n  if (!grant || grant.status !== ServiceProviderCapabilityGrantStatus.ACTIVE) return false;\n  if (grant.endsAt === undefined || grant.endsAt === null) return false;\n  const endsAt = grant.endsAt instanceof Date ? grant.endsAt : new Date(grant.endsAt);\n  return Number.isFinite(endsAt.getTime()) && endsAt.getTime() > now.getTime();\n}\n\nconst DAY_MS = 24 * 60 * 60 * 1000;\n\n/**\n * May this capability be lent on this relationship, until `endsAt`, through this verb? (#1631 invariants 3 and 5)\n *\n * The one rule both grant verbs apply. Pure: the caller supplies the relationship's scope and the application's\n * declared cap. Fails closed on anything it cannot prove.\n */\nexport function resolveServiceProviderCapabilityGrantTerms(input: {\n  readonly capability: DelegatedAdministrativeCapability;\n  readonly verb: ServiceProviderCapabilityGrants_Operations.GRANT | ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL;\n  readonly endsAt: Date;\n  readonly now: Date;\n  /** The relationship's `organizationUnitIds`: non-empty ⇒ unit-scoped. */\n  readonly relationshipOrganizationUnitIds?: readonly string[] | null;\n  /** The client organization type's declared `acceptsServiceProviders.securityCriticalCapabilityMaxDays`. */\n  readonly declaredSecurityCriticalMaxDays?: number;\n}):\n  | { readonly allowed: true }\n  | { readonly allowed: false; readonly code: ServiceProviderCapabilityGrantErrorCode } {\n  const securityCritical = SECURITY_CRITICAL_DELEGATED_CAPABILITIES.includes(input.capability);\n  const expectedVerb = securityCritical\n    ? ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL\n    : ServiceProviderCapabilityGrants_Operations.GRANT;\n  if (input.verb !== expectedVerb) return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB };\n  if ((input.relationshipOrganizationUnitIds ?? []).length > 0 && ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES.includes(input.capability)) {\n    return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP };\n  }\n  const maxDays = securityCritical\n    ? Math.min(SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS, input.declaredSecurityCriticalMaxDays ?? SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS)\n    : DELEGATED_CAPABILITY_MAX_DAYS;\n  const endsAtMs = input.endsAt.getTime();\n  if (!Number.isFinite(endsAtMs) || endsAtMs <= input.now.getTime() || endsAtMs > input.now.getTime() + maxDays * DAY_MS) {\n    return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED };\n  }\n  return { allowed: true };\n}\n\n/**\n * One grant, stored in the CLIENT organization. Every field is server-authored: the verbs write them, and there is no\n * generic CREATE or UPDATE.\n */\nexport const ServiceProviderCapabilityGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** The CLIENT organization — the party lending the capability, and the scope anchor. */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /** The relationship the capability is lent through — same tenant, a real edge. The live filter reads grants by it. */\n  relationshipId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /** The firm, copied from the relationship so a row names both parties. A plain id, never an edge into another tenant. */\n  providerOrganizationId: z.string().min(1).isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  capability: z.enum(DelegatedAdministrativeCapability)\n    .systemEnum('DelegatedAdministrativeCapability')\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /** When the capability stops conferring. Required: a delegation always ends. Admission reads this, never the EXPIRED label. */\n  endsAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  status: z.enum(ServiceProviderCapabilityGrantStatus)\n    .systemEnum('ServiceProviderCapabilityGrantStatus')\n    .default(ServiceProviderCapabilityGrantStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  grantedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  grantedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  revokedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  revokedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  /** When the grant stopped — revoked, or relabelled after its term. The retention clock's start point (#1613). */\n  endedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\nexport type ServiceProviderCapabilityGrant = z.infer<typeof ServiceProviderCapabilityGrantSchema>;\n\n/** One capability the firm holds in a client, as its engagement mirror shows it. */\nexport const ServiceEngagementDelegatedCapabilitySchema = z.object({\n  capability: z.enum(DelegatedAdministrativeCapability).systemEnum('DelegatedAdministrativeCapability')\n    .describe('An administrative capability the client organization currently lends this firm.'),\n  endsAt: z.date().describe('When the lending of that capability ends.'),\n});\nexport type ServiceEngagementDelegatedCapability = z.infer<typeof ServiceEngagementDelegatedCapabilitySchema>;\n\n/** Why the organization role table was refused at startup for a delegated capability role (#1631). */\nexport enum DelegatedCapabilityRoleViolationKind {\n  /** The capability role is not in the organization role table at all — a grant of it would confer nothing, silently. */\n  CAPABILITY_ROLE_UNDECLARED = 'CAPABILITY_ROLE_UNDECLARED',\n  /** The role's `inheritFrom` chain reaches an administration anchor (ORG_ADMIN / ORG_OWNER): lending it would make the firm an administrator. */\n  CAPABILITY_ROLE_REACHES_ADMINISTRATION = 'CAPABILITY_ROLE_REACHES_ADMINISTRATION',\n  /**\n   * Another organization role inherits the capability role: every holder of that role would carry the capability\n   * standing, with no grant row, no term and no revocation. A capability is conferred only by a live grant.\n   */\n  CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE = 'CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE',\n}\n\n/**\n * Validate every delegated capability role against the LIVE organization role table (#1631 invariant 2). An application\n * may override the engine's role definitions, so the check runs on the table the authorizer actually uses: a capability\n * role redefined to inherit from `ORG_ADMIN` (or anything that leads there) is refused at boot, exactly as a provider\n * role that reaches `ORG_ADMIN` is.\n */\nexport function collectDelegatedCapabilityRoleViolations(input: {\n  /** The role's `inheritFrom` walk in the ORGANIZATIONS table, the role itself included; empty ⇒ undeclared. */\n  readonly organizationRoleHierarchy: (role: string) => readonly string[];\n  readonly administrationAnchorRoles: readonly string[];\n  /** Every key of the LIVE organization role table, so a role that inherits a capability role can be found. */\n  readonly organizationRoles?: readonly string[];\n}): { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] {\n  const violations: { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] = [];\n  for (const capability of Object.values(DelegatedAdministrativeCapability)) {\n    const role = DELEGATED_CAPABILITY_ROLE[capability];\n    const hierarchy = input.organizationRoleHierarchy(role);\n    if (hierarchy.length === 0) {\n      violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_UNDECLARED });\n      continue;\n    }\n    if (hierarchy.some((held) => input.administrationAnchorRoles.includes(held))) {\n      violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_REACHES_ADMINISTRATION });\n    }\n    for (const other of input.organizationRoles ?? []) {\n      if (other !== role && input.organizationRoleHierarchy(other).includes(role)) {\n        violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE, inheritedBy: other });\n      }\n    }\n  }\n  return violations;\n}\n"]}
+{"version":3,"file":"service-provider-capability-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,MAAM,CAAN,IAAY,iCAgBX;AAhBD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,sEAAiC,CAAA;IACjC;;;OAGG;IACH,gGAA2D,CAAA;IAC3D,kDAAkD;IAClD,0EAAqC,CAAA;IACrC,sFAAsF;IACtF,wEAAmC,CAAA;IACnC,oEAAoE;IACpE,wEAAmC,CAAA;IACnC,6GAA6G;IAC7G,oFAA+C,CAAA;AACjD,CAAC,EAhBW,iCAAiC,KAAjC,iCAAiC,QAgB5C;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwE,MAAM,CAAC,MAAM,CAAC;IAC1H,CAAC,iCAAiC,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,4BAA4B;IAC/F,CAAC,iCAAiC,CAAC,2BAA2B,CAAC,EAAE,cAAc,CAAC,yCAAyC;IACzH,CAAC,iCAAiC,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,8BAA8B;IACnG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC,mCAAmC;CAC9G,CAAC,CAAC;AAEH,6HAA6H;AAC7H,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAEzH,qEAAqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAiD,MAAM,CAAC,MAAM,CAAC;IAClH,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAiD,MAAM,CAAC,MAAM,CAAC;IACnH,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,2BAA2B;IAC7D,iCAAiC,CAAC,gBAAgB;IAClD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH,qGAAqG;AACrG,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AACjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,EAAE,CAAC;AAEhE,8BAA8B;AAC9B,MAAM,CAAN,IAAY,oCAOX;AAPD,WAAY,oCAAoC;IAC9C,mFAAmF;IACnF,yDAAiB,CAAA;IACjB,8EAA8E;IAC9E,2DAAmB,CAAA;IACnB,uGAAuG;IACvG,2DAAmB,CAAA;AACrB,CAAC,EAPW,oCAAoC,KAApC,oCAAoC,QAO/C;AAED,4GAA4G;AAC5G,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,yCAAyC;IACzC,iFAAuC,CAAA;IACvC,6FAA6F;IAC7F,mFAAyC,CAAA;IACzC,8FAA8F;IAC9F,yFAA+C,CAAA;AACjD,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED,gGAAgG;AAChG,MAAM,CAAN,IAAY,0CASX;AATD,WAAY,0CAA0C;IACpD,4EAA4E;IAC5E,6DAAe,CAAA;IACf,oGAAoG;IACpG,+FAAiD,CAAA;IACjD,kHAAkH;IAClH,+DAAiB,CAAA;IACjB,sFAAsF;IACtF,+DAAiB,CAAA;AACnB,CAAC,EATW,0CAA0C,KAA1C,0CAA0C,QASrD;AAED,yHAAyH;AACzH,MAAM,CAAN,IAAY,uCAaX;AAbD,WAAY,uCAAuC;IACjD,kHAAkH;IAClH,kJAAuG,CAAA;IACvG,gHAAgH;IAChH,wIAA6F,CAAA;IAC7F,yEAAyE;IACzE,wIAA6F,CAAA;IAC7F,yFAAyF;IACzF,sLAA2I,CAAA;IAC3I,0HAA0H;IAC1H,sIAA2F,CAAA;IAC3F,uGAAuG;IACvG,8JAAmH,CAAA;AACrH,CAAC,EAbW,uCAAuC,KAAvC,uCAAuC,QAalD;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,MAAM,UAAU,0CAA0C,CACxD,KAA+F,EAC/F,GAAS;IAET,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAS1D;IAGC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7F,MAAM,YAAY,GAAG,gBAAgB;QACnC,CAAC,CAAC,0CAA0C,CAAC,uBAAuB;QACpE,CAAC,CAAC,0CAA0C,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACvJ,IAAI,CAAC,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,yCAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACrI,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,mEAAmE,EAAE,CAAC;IAC/I,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,6CAA6C,EAAE,KAAK,CAAC,+BAA+B,IAAI,6CAA6C,CAAC;QACjJ,CAAC,CAAC,6BAA6B,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;QACvH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,sHAAsH;IACtH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzI,yHAAyH;IACzH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEjH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAClD,UAAU,CAAC,mCAAmC,CAAC;SAC/C,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,+HAA+H;IAC/H,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;SACjD,UAAU,CAAC,sCAAsC,CAAC;SAClD,OAAO,CAAC,oCAAoC,CAAC,MAAM,CAAC;SACpD,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,iHAAiH;IACjH,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,UAAU,CAAC,mCAAmC,CAAC;SAClG,QAAQ,CAAC,iFAAiF,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACvE,CAAC,CAAC;AAGH,sGAAsG;AACtG,MAAM,CAAN,IAAY,oCAUX;AAVD,WAAY,oCAAoC;IAC9C,uHAAuH;IACvH,iGAAyD,CAAA;IACzD,gJAAgJ;IAChJ,yHAAiF,CAAA;IACjF;;;OAGG;IACH,+HAAuF,CAAA;AACzF,CAAC,EAVW,oCAAoC,KAApC,oCAAoC,QAU/C;AAED;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CAAC,KAMxD;IACC,MAAM,UAAU,GAAwI,EAAE,CAAC;IAC3J,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,sCAAsC,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,yCAAyC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["/**\n * Delegated administrative capabilities (#1631) — a CLIENT organization lends one service firm's experts a NAMED,\n * narrow, time-bound administrative capability, without ever making the firm an administrator.\n *\n * ## The shape, and why capabilities are ROLES\n *\n * Paul (2026-09-25, #1597 Q2): never admin by default; narrow, time-limited, client-revocable delegation; a\n * security-critical capability needs the client's OWNER, is time-bound, and is never renewed automatically. Issue\n * #1631 records the practice this follows (Microsoft's granular delegated admin privileges for partners, with a\n * time-bound relationship that cannot be auto-extended for the highest role) with its sources; nothing here quotes\n * them.\n *\n * A capability is a NAMED ROLE in the organization role table, one per {@link DelegatedAdministrativeCapability},\n * inheriting from nothing, and listed EXPLICITLY — beside `ORG_ADMIN` — in the `roles` of exactly the core operations\n * it opens. The rejected alternative (review F7) was an operation-id allow-list per grant: a second authority beside\n * role resolution that the ~20 `initiatorRoles` readers and the role ceiling would not know about.\n *\n * ## Grants are rows, filtered live\n *\n * `SERVICE_PROVIDER_CAPABILITY_GRANTS` rows live in the CLIENT organization. The execution-context live filter that\n * decides whether a provider membership confers anything (#1597) reads the relationship's grants in the same pass and\n * adds a capability's role to the expert's entries only while {@link isServiceProviderCapabilityGrantConferring}\n * holds — ACTIVE and `endsAt` still in the future. `EXPIRED` is sweep bookkeeping: admission reads `endsAt`.\n *\n * ## What delegation never does\n *\n * No capability confers `ORG_ADMIN` or `ORG_OWNER`, accepts a relationship, amends its scope, delegates further, or\n * counts toward the owner floor (provider memberships never do). Startup refuses a capability role whose `inheritFrom`\n * chain reaches an administration anchor.\n */\n\nimport { z } from 'zod';\nimport { CORE_ORG_ROLES, isInboundHandlerOnlyRole } from '../security/authorizations/roles.shared.schemas';\n\n/** @wildo_source:part:start saas.models.organizations.service-provider-capability-grants facet:layer:shared facet:audience:app-developer */\n/**\n * The closed set of administrative capabilities a client may lend a service firm (#1631). Each is ONE role\n * ({@link DELEGATED_CAPABILITY_ROLE}); a grant names one capability.\n */\nexport enum DelegatedAdministrativeCapability {\n  /** Invite people into the client, resend an invitation, revoke one. */\n  INVITE_MEMBERS = 'INVITE_MEMBERS',\n  /**\n   * Suspend or remove the firm's OWN experts under this relationship — never an ordinary member, never another firm's.\n   * Deliberately not reactivate: lifting a suspension would let the firm undo the client's bar against one person (#1597).\n   */\n  MANAGE_RELATIONSHIP_EXPERTS = 'MANAGE_RELATIONSHIP_EXPERTS',\n  /** Read the client organization's audit trail. */\n  READ_AUDIT_TRAIL = 'READ_AUDIT_TRAIL',\n  /** Configure the client's single sign-on and SCIM provisioning. Security-critical. */\n  MANAGE_SSO_SCIM = 'MANAGE_SSO_SCIM',\n  /** Manage the client organization's API keys. Security-critical. */\n  MANAGE_API_KEYS = 'MANAGE_API_KEYS',\n  /** Approve or deny, as the tenant, a platform operator's request to access the client. Security-critical. */\n  APPROVE_ACCESS_GRANTS = 'APPROVE_ACCESS_GRANTS',\n}\n\n/**\n * The role each capability confers — the ONE mapping, total over the enum, so a capability added tomorrow is a compile\n * error here rather than a grant that confers nothing.\n */\nexport const DELEGATED_CAPABILITY_ROLE: Readonly<Record<DelegatedAdministrativeCapability, CORE_ORG_ROLES>> = Object.freeze({\n  [DelegatedAdministrativeCapability.INVITE_MEMBERS]: CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS,\n  [DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS,\n  [DelegatedAdministrativeCapability.READ_AUDIT_TRAIL]: CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL,\n  [DelegatedAdministrativeCapability.MANAGE_SSO_SCIM]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM,\n  [DelegatedAdministrativeCapability.MANAGE_API_KEYS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS,\n  [DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS]: CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS,\n});\n\n/** Every capability role — conferred ONLY by a live grant, never by a membership row (the member role doors refuse them). */\nexport const DELEGATED_CAPABILITY_ROLES: ReadonlySet<string> = new Set<string>(Object.values(DELEGATED_CAPABILITY_ROLE));\n\n/** Whether `role` is one only a live capability grant may confer. */\nexport function isDelegatedCapabilityRole(role: string): boolean {\n  return DELEGATED_CAPABILITY_ROLES.has(role);\n}\n\n/**\n * Whether an organization MEMBERSHIP may hold `role` at all, whatever its organization's type (#1921): not a\n * handler-only role (an engine inbound handler's alone, #1629) and not a delegated capability role (a live grant's alone,\n * #1631). The ONE statement of that rule for every surface that offers or names a role a person holds — the published\n * role table a picker offers, and a setting that names one role (`contentReaderRole`). The membership write door\n * (`validateOrgMemberRoles`) refuses each of the two kinds with its own reason; a kind added here must be refused there too.\n */\nexport function roleMayBeHeldByMembership(role: string): boolean {\n  return !isInboundHandlerOnlyRole(role) && !isDelegatedCapabilityRole(role);\n}\n\n/**\n * Capabilities that change who can authenticate into, or act as, the client: only the client's OWNER grants them,\n * with step-up, for a task-sized window ({@link SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS} at most), and a renewal is\n * a new grant — there is no `autoRenew`.\n */\nexport const SECURITY_CRITICAL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n  DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n  DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n  DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/**\n * Capabilities that need an ORGANIZATION-WIDE relationship: refused at grant time on a relationship confined to\n * organization units, because a unit-scoped relationship has no organization-wide entry (#1597 F5) to carry them.\n *\n * Every capability is here, and that is measured rather than assumed: each one opens operations on resources that do\n * not narrow by organization unit (members, audit logs, SSO / SCIM, API keys, platform access grants), and the role gate\n * on those counts only organization-wide entries. A capability granted on a unit-scoped relationship would therefore\n * be audited, mirrored to the firm as held, and confer nothing — a grant that lies. The list stays a list (rather than\n * a blanket rule) so a future capability that opens a unit-narrowable operation can be left off it deliberately.\n */\nexport const ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n  DelegatedAdministrativeCapability.INVITE_MEMBERS,\n  DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS,\n  DelegatedAdministrativeCapability.READ_AUDIT_TRAIL,\n  DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n  DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n  DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/** The longest an ordinary capability may be granted for: two years, GDAP's relationship maximum. */\nexport const DELEGATED_CAPABILITY_MAX_DAYS = 730;\n/**\n * The longest a security-critical capability may be granted for, unless the application declares a lower cap\n * (`acceptsServiceProviders.securityCriticalCapabilityMaxDays`). A reversible default chosen for #1631 — a task-sized\n * window, far below the relationship maximum — NOT a figure taken from GDAP.\n */\nexport const SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS = 30;\n\n/** Where one grant stands. */\nexport enum ServiceProviderCapabilityGrantStatus {\n  /** Granted and not revoked. Confers only while `endsAt` is still in the future. */\n  ACTIVE = 'ACTIVE',\n  /** A client administrator revoked it, or the relationship ended. Terminal. */\n  REVOKED = 'REVOKED',\n  /** The sweep relabelled it after `endsAt`. Terminal bookkeeping — admission never reads this label. */\n  EXPIRED = 'EXPIRED',\n}\n\n/** Why a grant stopped conferring before its term — what a REVOKED audit row records (#1631 review F10). */\nexport enum ServiceProviderCapabilityGrantEndCause {\n  /** A client administrator revoked it. */\n  REVOKED_BY_CLIENT = 'REVOKED_BY_CLIENT',\n  /** Its relationship ended (terminated, withdrawn, expired, declined, or a party removed). */\n  RELATIONSHIP_ENDED = 'RELATIONSHIP_ENDED',\n  /** Its relationship was narrowed to organization units, which cannot carry any capability. */\n  RELATIONSHIP_NARROWED = 'RELATIONSHIP_NARROWED',\n}\n\n/** The client's verbs on its grants. The firm has none: it can never grant, widen or extend. */\nexport enum ServiceProviderCapabilityGrants_Operations {\n  /** Client ORG_ADMIN lends an ORDINARY capability, for at most two years. */\n  GRANT = 'grant',\n  /** Client ORG_OWNER lends a SECURITY-CRITICAL capability, with step-up, for a task-sized window. */\n  GRANT_SECURITY_CRITICAL = 'grantSecurityCritical',\n  /** Client ORG_ADMIN revokes any grant, at any time, without asking the firm. Takes effect on the next request. */\n  REVOKE = 'revoke',\n  /** ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. */\n  EXPIRE = 'expire',\n}\n\n/** The client-branchable codes a refused grant carries (409: authorized caller, valid payload, the STATE forbids it). */\nexport enum ServiceProviderCapabilityGrantErrorCode {\n  /** The relationship is not ACTIVE (or SUSPENDED) — nothing can be lent to a relationship that confers nothing. */\n  SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE = 'SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE',\n  /** A security-critical capability through the ordinary `grant`, or an ordinary one through the owner's verb. */\n  SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB = 'SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB',\n  /** `endsAt` beyond the cap for this capability, or not in the future. */\n  SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED = 'SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED',\n  /** An organization-level capability on a relationship confined to organization units. */\n  SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP',\n  /** An ACTIVE grant of this capability already exists on this relationship; revoke it first (a renewal is a new grant). */\n  SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED = 'SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED',\n  /** MANAGE_RELATIONSHIP_EXPERTS used on a membership that is not an expert of the SAME relationship. */\n  SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP',\n}\n/** @wildo_source:part:end saas.models.organizations.service-provider-capability-grants */\n\n/**\n * Does this grant confer its capability RIGHT NOW? The ONE predicate the live filter uses: ACTIVE, and `endsAt` in the\n * future. `endsAt` is read here rather than trusting the EXPIRED label, so a grant stops working the moment its term\n * passes whether or not the sweep has run (invariant 1).\n */\nexport function isServiceProviderCapabilityGrantConferring(\n  grant: { readonly status?: unknown; readonly endsAt?: Date | string | null } | null | undefined,\n  now: Date,\n): boolean {\n  if (!grant || grant.status !== ServiceProviderCapabilityGrantStatus.ACTIVE) return false;\n  if (grant.endsAt === undefined || grant.endsAt === null) return false;\n  const endsAt = grant.endsAt instanceof Date ? grant.endsAt : new Date(grant.endsAt);\n  return Number.isFinite(endsAt.getTime()) && endsAt.getTime() > now.getTime();\n}\n\nconst DAY_MS = 24 * 60 * 60 * 1000;\n\n/**\n * May this capability be lent on this relationship, until `endsAt`, through this verb? (#1631 invariants 3 and 5)\n *\n * The one rule both grant verbs apply. Pure: the caller supplies the relationship's scope and the application's\n * declared cap. Fails closed on anything it cannot prove.\n */\nexport function resolveServiceProviderCapabilityGrantTerms(input: {\n  readonly capability: DelegatedAdministrativeCapability;\n  readonly verb: ServiceProviderCapabilityGrants_Operations.GRANT | ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL;\n  readonly endsAt: Date;\n  readonly now: Date;\n  /** The relationship's `organizationUnitIds`: non-empty ⇒ unit-scoped. */\n  readonly relationshipOrganizationUnitIds?: readonly string[] | null;\n  /** The client organization type's declared `acceptsServiceProviders.securityCriticalCapabilityMaxDays`. */\n  readonly declaredSecurityCriticalMaxDays?: number;\n}):\n  | { readonly allowed: true }\n  | { readonly allowed: false; readonly code: ServiceProviderCapabilityGrantErrorCode } {\n  const securityCritical = SECURITY_CRITICAL_DELEGATED_CAPABILITIES.includes(input.capability);\n  const expectedVerb = securityCritical\n    ? ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL\n    : ServiceProviderCapabilityGrants_Operations.GRANT;\n  if (input.verb !== expectedVerb) return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB };\n  if ((input.relationshipOrganizationUnitIds ?? []).length > 0 && ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES.includes(input.capability)) {\n    return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP };\n  }\n  const maxDays = securityCritical\n    ? Math.min(SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS, input.declaredSecurityCriticalMaxDays ?? SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS)\n    : DELEGATED_CAPABILITY_MAX_DAYS;\n  const endsAtMs = input.endsAt.getTime();\n  if (!Number.isFinite(endsAtMs) || endsAtMs <= input.now.getTime() || endsAtMs > input.now.getTime() + maxDays * DAY_MS) {\n    return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED };\n  }\n  return { allowed: true };\n}\n\n/**\n * One grant, stored in the CLIENT organization. Every field is server-authored: the verbs write them, and there is no\n * generic CREATE or UPDATE.\n */\nexport const ServiceProviderCapabilityGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** The CLIENT organization — the party lending the capability, and the scope anchor. */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /** The relationship the capability is lent through — same tenant, a real edge. The live filter reads grants by it. */\n  relationshipId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /** The firm, copied from the relationship so a row names both parties. A plain id, never an edge into another tenant. */\n  providerOrganizationId: z.string().min(1).isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  capability: z.enum(DelegatedAdministrativeCapability)\n    .systemEnum('DelegatedAdministrativeCapability')\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /** When the capability stops conferring. Required: a delegation always ends. Admission reads this, never the EXPIRED label. */\n  endsAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  status: z.enum(ServiceProviderCapabilityGrantStatus)\n    .systemEnum('ServiceProviderCapabilityGrantStatus')\n    .default(ServiceProviderCapabilityGrantStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  grantedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  grantedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  revokedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  revokedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  /** When the grant stopped — revoked, or relabelled after its term. The retention clock's start point (#1613). */\n  endedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\nexport type ServiceProviderCapabilityGrant = z.infer<typeof ServiceProviderCapabilityGrantSchema>;\n\n/** One capability the firm holds in a client, as its engagement mirror shows it. */\nexport const ServiceEngagementDelegatedCapabilitySchema = z.object({\n  capability: z.enum(DelegatedAdministrativeCapability).systemEnum('DelegatedAdministrativeCapability')\n    .describe('An administrative capability the client organization currently lends this firm.'),\n  endsAt: z.date().describe('When the lending of that capability ends.'),\n});\nexport type ServiceEngagementDelegatedCapability = z.infer<typeof ServiceEngagementDelegatedCapabilitySchema>;\n\n/** Why the organization role table was refused at startup for a delegated capability role (#1631). */\nexport enum DelegatedCapabilityRoleViolationKind {\n  /** The capability role is not in the organization role table at all — a grant of it would confer nothing, silently. */\n  CAPABILITY_ROLE_UNDECLARED = 'CAPABILITY_ROLE_UNDECLARED',\n  /** The role's `inheritFrom` chain reaches an administration anchor (ORG_ADMIN / ORG_OWNER): lending it would make the firm an administrator. */\n  CAPABILITY_ROLE_REACHES_ADMINISTRATION = 'CAPABILITY_ROLE_REACHES_ADMINISTRATION',\n  /**\n   * Another organization role inherits the capability role: every holder of that role would carry the capability\n   * standing, with no grant row, no term and no revocation. A capability is conferred only by a live grant.\n   */\n  CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE = 'CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE',\n}\n\n/**\n * Validate every delegated capability role against the LIVE organization role table (#1631 invariant 2). An application\n * may override the engine's role definitions, so the check runs on the table the authorizer actually uses: a capability\n * role redefined to inherit from `ORG_ADMIN` (or anything that leads there) is refused at boot, exactly as a provider\n * role that reaches `ORG_ADMIN` is.\n */\nexport function collectDelegatedCapabilityRoleViolations(input: {\n  /** The role's `inheritFrom` walk in the ORGANIZATIONS table, the role itself included; empty ⇒ undeclared. */\n  readonly organizationRoleHierarchy: (role: string) => readonly string[];\n  readonly administrationAnchorRoles: readonly string[];\n  /** Every key of the LIVE organization role table, so a role that inherits a capability role can be found. */\n  readonly organizationRoles?: readonly string[];\n}): { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] {\n  const violations: { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] = [];\n  for (const capability of Object.values(DelegatedAdministrativeCapability)) {\n    const role = DELEGATED_CAPABILITY_ROLE[capability];\n    const hierarchy = input.organizationRoleHierarchy(role);\n    if (hierarchy.length === 0) {\n      violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_UNDECLARED });\n      continue;\n    }\n    if (hierarchy.some((held) => input.administrationAnchorRoles.includes(held))) {\n      violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_REACHES_ADMINISTRATION });\n    }\n    for (const other of input.organizationRoles ?? []) {\n      if (other !== role && input.organizationRoleHierarchy(other).includes(role)) {\n        violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE, inheritedBy: other });\n      }\n    }\n  }\n  return violations;\n}\n"]}

package/dist/esm/organizations/service-provider-client-controls.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-client-controls.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,oBAAY,uBAAuB;IACjC,oFAAoF;IACpF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;GAMG;AACH,oBAAY,qCAAqC;IAC/C,iEAAiE;IACjE,IAAI,SAAS;IACb,0HAA0H;IAC1H,mBAAmB,wBAAwB;IAC3C,oEAAoE;IACpE,qBAAqB,0BAA0B;CAChD;AACD,wFAAwF"}
+{"version":3,"file":"service-provider-client-controls.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,oBAAY,uBAAuB;IACjC,oFAAoF;IACpF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;GAMG;AACH,oBAAY,qCAAqC;IAC/C,iEAAiE;IACjE,IAAI,SAAS;IACb,0HAA0H;IAC1H,mBAAmB,wBAAwB;IAC3C,oEAAoE;IACpE,qBAAqB,0BAA0B;CAChD;AACD,wFAAwF"}

package/dist/esm/organizations/service-provider-client-controls.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-client-controls.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,oFAAoF;IACpF,sDAA2B,CAAA;IAC3B;;;;OAIG;IACH,4EAAiD,CAAA;AACnD,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,qCAOX;AAPD,WAAY,qCAAqC;IAC/C,iEAAiE;IACjE,sDAAa,CAAA;IACb,0HAA0H;IAC1H,oFAA2C,CAAA;IAC3C,oEAAoE;IACpE,wFAA+C,CAAA;AACjD,CAAC,EAPW,qCAAqC,KAArC,qCAAqC,QAOhD;AACD,wFAAwF","sourcesContent":["/**\n * What a CLIENT organization decides, per service-provider relationship, about the firm whose experts work inside it\n * (#1633, #1632).\n *\n * Both settings live on `SERVICE_PROVIDER_RELATIONSHIPS`, the row the client owns, and each is changed only by the\n * client's own verb. The firm has no verb that writes either, and neither widens what the relationship confers: one\n * decides how strongly an expert must have proven who they are before acting here, the other how much the firm may\n * learn afterwards about what its own staff did here.\n */\n\n/** @wildo_source:part:start saas.models.organizations.service-provider-client-controls facet:layer:shared facet:audience:app-developer */\n/**\n * Whether the client accepts the multi-factor proof the FIRM's own identity provider made (#1633).\n *\n * The client organization type's authentication policy governs an expert whenever they act in the client, whatever\n * the firm's policy is. When that policy asks for a second factor, the expert proves it to THIS application for THIS\n * client, and nothing proven elsewhere counts — unless the client trusts the firm's identity provider here.\n *\n * Off by default, as Microsoft Entra's cross-tenant inbound trust is: trusting another organization's MFA is the\n * RESOURCE tenant's decision, made per partner. Even when on, the client's minimum strength still applies, and an\n * operation that demands a fresh step-up still demands one.\n */\nexport enum ServiceProviderMfaTrust {\n  /** Only a factor proven to this application for this client counts. The default. */\n  NOT_TRUSTED = 'NOT_TRUSTED',\n  /**\n   * A factor the firm's own enterprise identity provider reported in the expert's sign-in (`amr`) counts too, when\n   * the expert signed in through THAT provider and the reported method meets the client's minimum strength. The\n   * accepted claim is recorded as coming from the firm's provider; it is never re-emitted as this application's own.\n   */\n  TRUST_PROVIDER_IDP_MFA = 'TRUST_PROVIDER_IDP_MFA',\n}\n\n/**\n * How much the firm's expert-activity feed may say about work done in THIS client (#1632).\n *\n * The client's side of the feed: the firm decides whether it collects activity metadata about its staff at all\n * (`SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS`), and the client can switch it off or narrow it for its own tenant. A\n * feed entry is written only when both allow it, and it never carries the client's content at any level.\n */\nexport enum ServiceProviderActivityFeedDisclosure {\n  /** Nothing about work in this client reaches the firm's feed. */\n  NONE = 'NONE',\n  /** The firm learns that an operation of a given type ran on a resource type, when, by whom — not whether it succeeded. */\n  OPERATION_TYPE_ONLY = 'OPERATION_TYPE_ONLY',\n  /** As above, plus the outcome. Still metadata only. The default. */\n  OPERATION_AND_OUTCOME = 'OPERATION_AND_OUTCOME',\n}\n/** @wildo_source:part:end saas.models.organizations.service-provider-client-controls */\n"]}
+{"version":3,"file":"service-provider-client-controls.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,oFAAoF;IACpF,sDAA2B,CAAA;IAC3B;;;;OAIG;IACH,4EAAiD,CAAA;AACnD,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,qCAOX;AAPD,WAAY,qCAAqC;IAC/C,iEAAiE;IACjE,sDAAa,CAAA;IACb,0HAA0H;IAC1H,oFAA2C,CAAA;IAC3C,oEAAoE;IACpE,wFAA+C,CAAA;AACjD,CAAC,EAPW,qCAAqC,KAArC,qCAAqC,QAOhD;AACD,wFAAwF","sourcesContent":["/**\n * What a CLIENT organization decides, per service-provider relationship, about the firm whose experts work inside it\n * (#1633, #1632).\n *\n * Both settings live on `SERVICE_PROVIDER_RELATIONSHIPS`, the row the client owns, and each is changed only by the\n * client's own verb. The firm has no verb that writes either, and neither widens what the relationship confers: one\n * decides how strongly an expert must have proven who they are before acting here, the other how much the firm may\n * learn afterwards about what its own staff did here.\n */\n\n/** @wildo_source:part:start saas.models.organizations.service-provider-client-controls facet:layer:shared facet:audience:app-developer */\n/**\n * Whether the client accepts the multi-factor proof the FIRM's own identity provider made (#1633).\n *\n * The client organization type's authentication policy governs an expert whenever they act in the client, whatever\n * the firm's policy is. When that policy asks for a second factor, the expert proves it to THIS application for THIS\n * client, and nothing proven elsewhere counts — unless the client trusts the firm's identity provider here.\n *\n * Off by default, as Microsoft Entra's cross-tenant inbound trust is: trusting another organization's MFA is the\n * RESOURCE tenant's decision, made per partner. Even when on, the client's minimum strength still applies, and an\n * operation that demands a fresh step-up still demands one.\n */\nexport enum ServiceProviderMfaTrust {\n  /** Only a factor proven to this application for this client counts. The default. */\n  NOT_TRUSTED = 'NOT_TRUSTED',\n  /**\n   * A factor the firm's own enterprise identity provider reported in the expert's sign-in (`amr`) counts too, when\n   * the expert signed in through THAT provider and the reported method meets the client's minimum strength. The\n   * accepted claim is recorded as coming from the firm's provider; it is never re-emitted as this application's own.\n   */\n  TRUST_PROVIDER_IDP_MFA = 'TRUST_PROVIDER_IDP_MFA',\n}\n\n/**\n * How much the firm's expert-activity feed may say about work done in THIS client (#1632).\n *\n * The client's side of the feed: the firm decides whether it collects activity metadata about its staff at all\n * (`SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS`), and the client can switch it off or narrow it for its own tenant. A\n * feed entry is written only when both allow it, and it never carries the client's content at any level.\n */\nexport enum ServiceProviderActivityFeedDisclosure {\n  /** Nothing about work in this client reaches the firm's feed. */\n  NONE = 'NONE',\n  /** The firm learns that an operation of a given type ran on a resource type, when, by whom — not whether it succeeded. */\n  OPERATION_TYPE_ONLY = 'OPERATION_TYPE_ONLY',\n  /** As above, plus the outcome. Still metadata only. The default. */\n  OPERATION_AND_OUTCOME = 'OPERATION_AND_OUTCOME',\n}\n/** @wildo_source:part:end saas.models.organizations.service-provider-client-controls */\n"]}

package/dist/esm/organizations/service-provider-relationships.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-relationships.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-relationships.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iCAAiC,EACjC,oCAAoC,EACpC,uCAAuC,EAEvC,6BAA6B,EAE7B,iCAAiC,EACjC,uCAAuC,EACxC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AA+DnI,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AA6BjC,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsRlI,CAAC;AAIL,eAAO,MAAM,6DAA6D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;kBA0GxH,CAAC;AAIL,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;kBAqHlI,CAAC"}
+{"version":3,"file":"service-provider-relationships.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/service-provider-relationships.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iCAAiC,EACjC,oCAAoC,EACpC,uCAAuC,EAEvC,6BAA6B,EAE7B,iCAAiC,EACjC,uCAAuC,EACxC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AA+DnI,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AA6BjC,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsRlI,CAAC;AAIL,eAAO,MAAM,6DAA6D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;kBA0GxH,CAAC;AAIL,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;kBAqHlI,CAAC"}

package/dist/esm/organizations/service-provider-relationships.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-relationships.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-relationships.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,wDAAwD,EACxD,iCAAiC,EACjC,oCAAoC,EACpC,uCAAuC,EACvC,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,uCAAuC,GACxC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAClH,OAAO,EAAE,oCAAoC,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAClI,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAEnI,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAExF,iHAAiH;AACjH,MAAM,oBAAoB,GAAG;IAC3B,uGAAuG;IACvG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,sEAAsE;IACtE,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACnE;;;;;;;;OAQG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,wBAAwB,GAAG;IAC/B,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;SAC3E,QAAQ,CAAC,wLAAwL,CAAC;CACtM,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,MAAe,EAAE,EAAE,CAC/B,MAAM,KAAK,iCAAiC,CAAC,QAAQ;OAClD,MAAM,KAAK,iCAAiC,CAAC,MAAM;OACnD,MAAM,KAAK,iCAAiC,CAAC,SAAS,CAAC;AAE5D;;;;;;;;GAQG;AACH,4FAA4F;AAG5F;;;;;GAKG;AACH,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,wBAAwB,CAAC,OAAO;IACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;IACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;IACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;IACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;CAC7C,CAAC;AAWF,MAAM,eAAe,GAAiC;IACpD,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF,yHAAyH;AACzH,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG;IAC9B,cAAc,EAAE,kBAAkB,CAAC,UAAU;IAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;IAC7C,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,uEAAuE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACxI,0CAA0C,CAIxC;IACA,UAAU,EAAE,iCAAiC;IAC7C,kBAAkB,EAAE,gBAAgB,CAAC,8BAA8B;IACnE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IAC5G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,YAAY;IAChC,eAAe,EAAE,MAAM;IACvB,gBAAgB,EAAE,uBAAuB;IACzC,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED;;;;;;WAMG;QACH,CAAC,uCAAuC,CAAC,OAAO,CAAC,EAAE;YACjD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBACpC,GAAG,oBAAoB;wBACvB,GAAG,wBAAwB;qBAC5B,CAAC;iBACH,CAAC;SACH;QAED;;;WAGG;QACH,CAAC,uCAAuC,CAAC,MAAM,CAAC,EAAE;YAChD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,iBAAiB,CAAC,MAAM,CAAC,wBAAwB,CAAC;oBAC9D,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,QAAQ;iBAC7G,CAAC;SACH;QAED,CAAC,uCAAuC,CAAC,OAAO,CAAC,EAAE;YACjD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,QAAQ;iBAC7G,CAAC;SACH;QAED,CAAC,uCAAuC,CAAC,OAAO,CAAC,EAAE;YACjD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,MAAM;iBAC3G,CAAC;SACH;QAED,CAAC,uCAAuC,CAAC,MAAM,CAAC,EAAE;YAChD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,SAAS;iBAC9G,CAAC;SACH;QAED,yGAAyG;QACzG,CAAC,uCAAuC,CAAC,SAAS,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED,wHAAwH;QACxH,CAAC,uCAAuC,CAAC,WAAW,CAAC,EAAE;YACrD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,GAAG,oBAAoB;wBACvB,+GAA+G;wBAC/G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;6BAChC,QAAQ,CAAC,2LAA2L,CAAC;wBACxM,2FAA2F;wBAC3F,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;6BAC7C,QAAQ,CAAC,gLAAgL,CAAC;qBAC9L,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,MAAM;2BAC9D,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,SAAS;iBAC1E,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,oBAAoB,CAAC,EAAE;YAC9D,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;6BAC7B,QAAQ,CAAC,6HAA6H,CAAC;wBAC1I,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;6BACxG,QAAQ,CAAC,8LAA8L,CAAC;qBAC5M,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED,CAAC,uCAAuC,CAAC,qBAAqB,CAAC,EAAE;YAC/D,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;6BAC7B,QAAQ,CAAC,uIAAuI,CAAC;qBACrJ,CAAC;iBACH,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,2BAA2B,CAAC,EAAE;YACrE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,EAAE,CAAC;oBAC7F,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,sBAAsB,CAAC,EAAE;YAChE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAC3E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,4BAA4B,CAAC,EAAE;YACtE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,EAAE,CAAC;oBAC/F,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED;;;;;WAKG;QACH,CAAC,uCAAuC,CAAC,MAAM,CAAC,EAAE;YAChD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC9H,0CAA0C,CAIxC;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,mBAAmB;IACxD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;IACjG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,YAAY;IAChC,eAAe,EAAE,MAAM;IACvB,gBAAgB,EAAE,uBAAuB;IACzC,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED,yGAAyG;QACzG,CAAC,6BAA6B,CAAC,OAAO,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBACpC,GAAG,oBAAoB;wBACvB,gGAAgG;wBAChG,6FAA6F;wBAC7F,iGAAiG;wBACjG,mBAAmB,EAAE,oBAAoB,CAAC,mBAAmB;6BAC1D,QAAQ,CAAC,8NAA8N,CAAC;qBAC5O,CAAC;iBACH,CAAC;SACH;QAED,gGAAgG;QAChG,CAAC,6BAA6B,CAAC,MAAM,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,QAAQ;iBAC7G,CAAC;SACH;QAED,wEAAwE;QACxE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE;YACxC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;KACF;CACF,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,uEAAuE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACxI,0CAA0C,CAIxC;IACA,UAAU,EAAE,iCAAiC;IAC7C,kBAAkB,EAAE,gBAAgB,CAAC,8BAA8B;IACnE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IAC5G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,GAAG,YAAY;QACf;;;;WAIG;QACH,aAAa,EAAE,wBAAwB,CAAC,OAAO;KAChD;IACD;;;;OAIG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D,gBAAgB,EAAE,uBAAuB;IACzC,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED,mFAAmF;QACnF,CAAC,uCAAuC,CAAC,MAAM,CAAC,EAAE;YAChD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBAC1B,CAAC;iBACH,CAAC;SACH;QAED,mGAAmG;QACnG,CAAC,uCAAuC,CAAC,QAAQ,CAAC,EAAE;YAClD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,MAAM;2BACrG,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,uBAAuB;iBACxF,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,sBAAsB,CAAC,EAAE;YAChE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,wDAAwD;iBACrE,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Service-provider relationships — resource configurations for the three resources (#1597).\n *\n * The asymmetry is the design: the CLIENT's verbs are on the relationship (client scope), the FIRM's\n * verbs are on its engagement mirror (firm scope), and each side's counterpart row is written by the\n * system inside the same transaction. No verb here declares `admitsCrossTenantPlatformAdministration`:\n * nobody reaches into the other tenant through a request.\n *\n * Every lifecycle verb is HIGH risk, and the two that CONFER — the client accepting a firm's proposal and\n * the client widening a relationship's scope — demand the client ORG_OWNER plus step-up, because they\n * hand people outside the organization a membership inside it.\n *\n * See `service-provider-relationships.shared.schemas.ts` for the model.\n */\n\nimport { z } from 'zod';\nimport {\n  ServiceEngagementAssignmentSchema,\n  ServiceEngagementAssignmentSettleClientApprovalDtoSchema,\n  ServiceEngagementAssignmentStatus,\n  ServiceProviderExpertAdmissionPolicy,\n  ServiceEngagementAssignments_Operations,\n  ServiceEngagementSchema,\n  ServiceEngagements_Operations,\n  ServiceProviderRelationshipSchema,\n  ServiceProviderRelationshipStatus,\n  ServiceProviderRelationships_Operations,\n} from './service-provider-relationships.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../flows-actors/autonomous-agents.shared.schemas';\nimport { ServiceProviderActivityFeedDisclosure, ServiceProviderMfaTrust } from './service-provider-client-controls.shared.schemas';\n\n/** A reason one side gives when refusing or ending. Optional everywhere; recorded, erasable. */\nconst decisionReasonDto = z.object({ decisionReason: z.string().max(1000).optional() });\n\n/** The scope a relationship is proposed or amended with. The client decides it; the firm may only propose it. */\nconst relationshipScopeDto = {\n  /** One of the provider type's `servesAsProvider.providerRoles`. Absent ⇒ its `defaultProviderRole`. */\n  role: z.string().min(1).optional(),\n  /** Client organization units. Absent or empty ⇒ organization-wide. */\n  organizationUnitIds: z.array(z.string().min(1)).max(100).optional(),\n  /**\n   * When the relationship stops conferring. `null` means \"no term\" — the framework's merge-patch UPDATE\n   * reading — and is what `amendScope` writes when it clears one.\n   *\n   * `.nullish()`, never `.optional()`: `z.coerce.date().optional()` does not reject `null`, it COERCES it,\n   * and `new Date(null)` is 1970-01-01. The operation's own prefix output is parsed by this DTO, so a\n   * cleared term was stored as a term that ended in 1970 — which the live filter reads as over, ending\n   * the relationship the client meant to make open-ended.\n   */\n  endsAt: z.coerce.date().nullish(),\n};\n\n/**\n * The client's choice of how the firm's experts are admitted (#1612). Only ever part of a CLIENT verb's contract —\n * the firm's verbs do not declare it, so a firm-supplied value is stripped before any implementation sees it.\n */\nconst expertAdmissionPolicyDto = {\n  expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy).optional()\n    .describe('Whether each expert the firm assigns must first be approved by your organization\\'s administrators. Absent: your organization type\\'s default, else every assigned expert is admitted.'),\n};\n\nconst LIVE = (status: unknown) =>\n  status === ServiceProviderRelationshipStatus.PROPOSED\n  || status === ServiceProviderRelationshipStatus.ACTIVE\n  || status === ServiceProviderRelationshipStatus.SUSPENDED;\n\n/**\n * Route-less plumbing shared by all three resources.\n *\n * - `UPDATE_MANY` — the retention writer's verb (`retentionPolicy` requires READ + LIST + UPDATE_MANY).\n * - `DELETE` — the organization purge cascade's verb ONLY. No client can delete a relationship: the\n *   terminal statuses are how one ends, and erasing the record would rewrite who could reach a tenant.\n * - `CREATE` / `UPDATE` — the system door the verbs write COUNTERPART rows through (`createAsSystem` /\n *   `updateAsSystem` resolve the resource's default CREATE / UPDATE). INTERNAL_CALL registers no route.\n */\n/* (inlined into each configuration below — contextual typing needs the literal in place) */\n\n\n/**\n * The counterpart write door is a system door, so the policy says so — and says nothing else.\n *\n * `read`/`list` are ALLOWED because the execution-context builder reads relationships and assignments on\n * a system context to decide a caller's authority (the caller is, by construction, not yet authorized).\n */\nconst systemWrites = {\n  read: ResourceSystemAccessMode.ALLOWED,\n  list: ResourceSystemAccessMode.ALLOWED,\n  create: ResourceSystemAccessMode.ALLOWED,\n  update: ResourceSystemAccessMode.ALLOWED,\n  updateMany: ResourceSystemAccessMode.ALLOWED,\n};\n\ntype RelationshipCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\nconst CORE_OPERATIONS: RelationshipCoreOperations[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.COUNT,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE,\n];\n\n/** Retained on erasure: who could reach which tenant, when and under what scope is the record; the prose is scrubbed. */\nconst RETAIN = { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE };\n\n/**\n * How long each of the three records lives (#1613): the AUDIT_LOGS class, from the moment the record ENDS.\n *\n * They are the evidence of who from outside could reach a tenant, and when — the question an access\n * review or an incident asks years later — so they are kept for the audit trail's own period rather than\n * the ordinary resource-data one. While a relationship or an assignment is live its `endedAt` is null and\n * the row never expires; the clock starts only when it ends.\n */\nconst KEPT_AS_ACCESS_EVIDENCE = {\n  retentionClass: DataRetentionClass.AUDIT_LOGS,\n  startPoint: RetentionStartPoint.CLOSURE_EVENT,\n  closureFieldName: 'endedAt',\n};\n\nexport const serviceProviderRelationshipsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceProviderRelationships_Operations,\n    RelationshipCoreOperations,\n    typeof ServiceProviderRelationshipSchema\n  >({\n    mainSchema: ServiceProviderRelationshipSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: systemWrites,\n    retentionPolicy: RETAIN,\n    retentionBinding: KEPT_AS_ACCESS_EVIDENCE,\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /**\n       * The client proposes a relationship to a firm. The proposal IS the client owner's consent, so the\n       * firm's acceptance activates it — ORG_OWNER plus step-up, like the acceptance of a firm's proposal.\n       *\n       * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING — a third party's access to the tenant\n       * begins only with the tenant owner's declared consent.\n       */\n      [ServiceProviderRelationships_Operations.PROPOSE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requiresStepUpAuthentication: true,\n          requestDto: z.object({\n            providerOrganizationId: z.string().min(1),\n            purpose: z.string().min(1).max(1000),\n            ...relationshipScopeDto,\n            ...expertAdmissionPolicyDto,\n          }),\n        }],\n      },\n\n      /**\n       * The client owner accepts a FIRM's proposal. The implementation refuses a relationship the client itself proposed.\n       * The owner may choose here whether each expert must be approved (#1612); absent keeps the proposal's default.\n       */\n      [ServiceProviderRelationships_Operations.ACCEPT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requiresStepUpAuthentication: true,\n          requestDto: decisionReasonDto.extend(expertAdmissionPolicyDto),\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.PROPOSED,\n        }],\n      },\n\n      [ServiceProviderRelationships_Operations.DECLINE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.PROPOSED,\n        }],\n      },\n\n      [ServiceProviderRelationships_Operations.SUSPEND]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.ACTIVE,\n        }],\n      },\n\n      [ServiceProviderRelationships_Operations.RESUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.SUSPENDED,\n        }],\n      },\n\n      /** The client ends a live relationship — its own proposal included. Takes effect on the next request. */\n      [ServiceProviderRelationships_Operations.TERMINATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      /** Role, units, term. Only the client, only its owner, with step-up — the firm cannot widen what the client granted. */\n      [ServiceProviderRelationships_Operations.AMEND_SCOPE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requiresStepUpAuthentication: true,\n          requestDto: z.object({\n            ...relationshipScopeDto,\n            /** Explicitly clear a term (open-ended) — distinct from \"leave it as it is\". `endsAt: null` means the same. */\n            clearEndsAt: z.boolean().optional()\n              .describe('`true` removes the end date, so the relationship runs until someone ends it. Sending `endsAt: null` does the same. Omitted or `false`: the end date is set by `endsAt`, or left as it is.'),\n            /** Explicitly widen to organization-wide — distinct from \"leave the units as they are\". */\n            clearOrganizationUnitIds: z.boolean().optional()\n              .describe('`true` removes the unit restriction, so the firm\\'s experts reach the whole organization. Omitted or `false`: the units are set by `organizationUnitIds`, or left as they are.'),\n          }),\n          enabledCondition: ({ currentObject }) =>\n            currentObject.status === ServiceProviderRelationshipStatus.ACTIVE\n            || currentObject.status === ServiceProviderRelationshipStatus.SUSPENDED,\n        }],\n      },\n\n      /**\n       * Admit a firm's client, or change what an admitted one may do. `autonomousAgentRefs` is the client's\n       * choice of the firm's autonomous agents that may run here (#1611) and REPLACES the client's previous\n       * choice; omitted means none. Re-admitting an admitted client with a new list is how that choice changes.\n       */\n      [ServiceProviderRelationships_Operations.ADMIT_MACHINE_CLIENT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oauthClientId: z.string().min(1)\n              .describe('The firm\\'s machine client to admit: an active OAuth client owned by the firm\\'s organization. Any other client is refused.'),\n            autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX).optional()\n              .describe(\"The firm's autonomous agents this client may run in your organization, under this relationship's role and on your organization's budget. Replaces any earlier choice; omit it to allow none.\"),\n          }),\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      [ServiceProviderRelationships_Operations.REMOVE_MACHINE_CLIENT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oauthClientId: z.string().min(1)\n              .describe('The firm\\'s machine client to remove. It can no longer act in your organization, and your choice of its autonomous agents is dropped.'),\n          }),\n        }],\n      },\n\n      /**\n       * Change whether each assigned expert waits for this organization's approval (#1612). A client administrator's\n       * verb, on a live relationship; not retroactive — experts already admitted keep their membership, and pending\n       * approvals stay pending. The firm has no counterpart verb.\n       */\n      [ServiceProviderRelationships_Operations.SET_EXPERT_ADMISSION_POLICY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({ expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy) }),\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      /**\n       * Decide whether the firm's own identity provider's MFA counts in this organization (#1633). The owner's verb,\n       * with step-up: trusting it lets a proof made elsewhere satisfy this organization's authentication policy for\n       * the firm's experts. The organization type's minimum strength still applies either way.\n       */\n      [ServiceProviderRelationships_Operations.SET_PROVIDER_MFA_TRUST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requiresStepUpAuthentication: true,\n          requestDto: z.object({ providerMfaTrust: z.enum(ServiceProviderMfaTrust) }),\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      /**\n       * Decide how much the firm's expert-activity feed may say about work done here (#1632). A client administrator's\n       * verb; it takes effect on the expert's next action. It can only narrow what the firm learns — at every level the\n       * feed carries metadata, never this organization's content.\n       */\n      [ServiceProviderRelationships_Operations.SET_ACTIVITY_FEED_DISCLOSURE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({ activityFeedDisclosure: z.enum(ServiceProviderActivityFeedDisclosure) }),\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      /**\n       * ACTIVE or SUSPENDED → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only.\n       * Bookkeeping: admission already stopped at `endsAt`. Empty request contract by design — the\n       * implementation owns the transition, and an operation without a `requestDto` would advertise the\n       * resource's whole update contract.\n       */\n      [ServiceProviderRelationships_Operations.EXPIRE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n        }],\n      },\n    },\n  });\n\ntype EngagementCoreOperations = RelationshipCoreOperations;\n\nexport const serviceEngagementsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceEngagements_Operations,\n    EngagementCoreOperations,\n    typeof ServiceEngagementSchema\n  >({\n    mainSchema: ServiceEngagementSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_ENGAGEMENTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_ENGAGEMENTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: systemWrites,\n    retentionPolicy: RETAIN,\n    retentionBinding: KEPT_AS_ACCESS_EVIDENCE,\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /** The firm proposes a relationship to a client. Nothing is conferred until the client owner accepts. */\n      [ServiceEngagements_Operations.PROPOSE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: z.object({\n            clientOrganizationId: z.string().min(1),\n            purpose: z.string().min(1).max(1000),\n            ...relationshipScopeDto,\n            // Described HERE rather than on `relationshipScopeDto`: the relationship's own verbs take their\n            // description from the relationship's field specification, and a `.describe()` on the shared\n            // DTO would override it. The engagement has no such field, so its proposal needed its own words.\n            organizationUnitIds: relationshipScopeDto.organizationUnitIds\n              .describe('The client organization\\'s units your experts would be confined to, by their ids in the client\\'s tenant. Absent or empty: the whole client organization. The client sees this scope when deciding, and may change it later.'),\n          }),\n        }],\n      },\n\n      /** The firm accepts a CLIENT's proposal — the client owner's consent is the proposal itself. */\n      [ServiceEngagements_Operations.ACCEPT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.PROPOSED,\n        }],\n      },\n\n      /** The firm ends a live relationship, or withdraws its own proposal. */\n      [ServiceEngagements_Operations.WITHDRAW]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n    },\n  });\n\ntype AssignmentCoreOperations = RelationshipCoreOperations;\n\nexport const serviceEngagementAssignmentsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceEngagementAssignments_Operations,\n    AssignmentCoreOperations,\n    typeof ServiceEngagementAssignmentSchema\n  >({\n    mainSchema: ServiceEngagementAssignmentSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: {\n      ...systemWrites,\n      /**\n       * `userId` is a foreign key to USERS, so these rows are on a person's subject-export graph. ALLOWED:\n       * which clients a person was assigned to serve is a fact about their own work, not a monitoring\n       * record about them, and it names nobody else.\n       */\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n    },\n    /**\n     * RETAIN_ONLY: an assignment holds no personal text of its own — ids, a status and timestamps — so\n     * there is nothing an erasure could scrub, and claiming RETAIN_AND_IMPERSONALIZE would describe a\n     * scrub that never happens. Kept whole as evidence of who served which client, when.\n     */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n    retentionBinding: KEPT_AS_ACCESS_EVIDENCE,\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /** The firm designates one of its ACTIVE members to serve an ACTIVE engagement. */\n      [ServiceEngagementAssignments_Operations.ASSIGN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: z.object({\n            serviceEngagementId: z.string().min(1),\n            userId: z.string().min(1),\n          }),\n        }],\n      },\n\n      /** Ends an ACTIVE assignment, or withdraws one still waiting for the client's approval (#1612). */\n      [ServiceEngagementAssignments_Operations.UNASSIGN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceEngagementAssignmentStatus.ACTIVE\n            || currentObject.status === ServiceEngagementAssignmentStatus.PENDING_CLIENT_APPROVAL,\n        }],\n      },\n\n      /**\n       * Apply the client's answer to a per-expert approval (#1612). INTERNAL_CALL: it registers no route, and is\n       * reached only from the human-decision answer path after that path authorized the answerer as one of the\n       * client's administrators. The input names the decision it settles; the write matches on it.\n       */\n      [ServiceEngagementAssignments_Operations.SETTLE_CLIENT_APPROVAL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ServiceEngagementAssignmentSettleClientApprovalDtoSchema,\n        }],\n      },\n    },\n  });\n"]}
+{"version":3,"file":"service-provider-relationships.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-relationships.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,wDAAwD,EACxD,iCAAiC,EACjC,oCAAoC,EACpC,uCAAuC,EACvC,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,uCAAuC,GACxC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAClH,OAAO,EAAE,oCAAoC,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAClI,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAEnI,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAExF,iHAAiH;AACjH,MAAM,oBAAoB,GAAG;IAC3B,uGAAuG;IACvG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,sEAAsE;IACtE,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACnE;;;;;;;;OAQG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,wBAAwB,GAAG;IAC/B,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;SAC3E,QAAQ,CAAC,wLAAwL,CAAC;CACtM,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,MAAe,EAAE,EAAE,CAC/B,MAAM,KAAK,iCAAiC,CAAC,QAAQ;OAClD,MAAM,KAAK,iCAAiC,CAAC,MAAM;OACnD,MAAM,KAAK,iCAAiC,CAAC,SAAS,CAAC;AAE5D;;;;;;;;GAQG;AACH,4FAA4F;AAG5F;;;;;GAKG;AACH,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,wBAAwB,CAAC,OAAO;IACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;IACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;IACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;IACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;CAC7C,CAAC;AAWF,MAAM,eAAe,GAAiC;IACpD,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF,yHAAyH;AACzH,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,wBAAwB,EAAE,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG;IAC9B,cAAc,EAAE,kBAAkB,CAAC,UAAU;IAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;IAC7C,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,uEAAuE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACxI,0CAA0C,CAIxC;IACA,UAAU,EAAE,iCAAiC;IAC7C,kBAAkB,EAAE,gBAAgB,CAAC,8BAA8B;IACnE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IAC5G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,YAAY;IAChC,eAAe,EAAE,MAAM;IACvB,gBAAgB,EAAE,uBAAuB;IACzC,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED;;;;;;WAMG;QACH,CAAC,uCAAuC,CAAC,OAAO,CAAC,EAAE;YACjD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBACpC,GAAG,oBAAoB;wBACvB,GAAG,wBAAwB;qBAC5B,CAAC;iBACH,CAAC;SACH;QAED;;;WAGG;QACH,CAAC,uCAAuC,CAAC,MAAM,CAAC,EAAE;YAChD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,iBAAiB,CAAC,MAAM,CAAC,wBAAwB,CAAC;oBAC9D,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,QAAQ;iBAC7G,CAAC;SACH;QAED,CAAC,uCAAuC,CAAC,OAAO,CAAC,EAAE;YACjD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,QAAQ;iBAC7G,CAAC;SACH;QAED,CAAC,uCAAuC,CAAC,OAAO,CAAC,EAAE;YACjD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,MAAM;iBAC3G,CAAC;SACH;QAED,CAAC,uCAAuC,CAAC,MAAM,CAAC,EAAE;YAChD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,SAAS;iBAC9G,CAAC;SACH;QAED,yGAAyG;QACzG,CAAC,uCAAuC,CAAC,SAAS,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED,wHAAwH;QACxH,CAAC,uCAAuC,CAAC,WAAW,CAAC,EAAE;YACrD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,GAAG,oBAAoB;wBACvB,+GAA+G;wBAC/G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;6BAChC,QAAQ,CAAC,2LAA2L,CAAC;wBACxM,2FAA2F;wBAC3F,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;6BAC7C,QAAQ,CAAC,gLAAgL,CAAC;qBAC9L,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,MAAM;2BAC9D,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,SAAS;iBAC1E,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,oBAAoB,CAAC,EAAE;YAC9D,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;6BAC7B,QAAQ,CAAC,6HAA6H,CAAC;wBAC1I,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;6BACxG,QAAQ,CAAC,8LAA8L,CAAC;qBAC5M,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED,CAAC,uCAAuC,CAAC,qBAAqB,CAAC,EAAE;YAC/D,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;6BAC7B,QAAQ,CAAC,uIAAuI,CAAC;qBACrJ,CAAC;iBACH,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,2BAA2B,CAAC,EAAE;YACrE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,EAAE,CAAC;oBAC7F,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,sBAAsB,CAAC,EAAE;YAChE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAC3E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,4BAA4B,CAAC,EAAE;YACtE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,EAAE,CAAC;oBAC/F,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;QAED;;;;;WAKG;QACH,CAAC,uCAAuC,CAAC,MAAM,CAAC,EAAE;YAChD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC9H,0CAA0C,CAIxC;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,mBAAmB;IACxD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;IACjG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,YAAY;IAChC,eAAe,EAAE,MAAM;IACvB,gBAAgB,EAAE,uBAAuB;IACzC,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED,yGAAyG;QACzG,CAAC,6BAA6B,CAAC,OAAO,CAAC,EAAE;YACvC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBACpC,GAAG,oBAAoB;wBACvB,gGAAgG;wBAChG,6FAA6F;wBAC7F,iGAAiG;wBACjG,mBAAmB,EAAE,oBAAoB,CAAC,mBAAmB;6BAC1D,QAAQ,CAAC,8NAA8N,CAAC;qBAC5O,CAAC;iBACH,CAAC;SACH;QAED,gGAAgG;QAChG,CAAC,6BAA6B,CAAC,MAAM,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,QAAQ;iBAC7G,CAAC;SACH;QAED,wEAAwE;QACxE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE;YACxC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,iBAAiB;oBAC7B,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;iBACpE,CAAC;SACH;KACF;CACF,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,uEAAuE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACxI,0CAA0C,CAIxC;IACA,UAAU,EAAE,iCAAiC;IAC7C,kBAAkB,EAAE,gBAAgB,CAAC,8BAA8B;IACnE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IAC5G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,GAAG,YAAY;QACf;;;;WAIG;QACH,aAAa,EAAE,wBAAwB,CAAC,OAAO;KAChD;IACD;;;;OAIG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D,gBAAgB,EAAE,uBAAuB;IACzC,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED,mFAAmF;QACnF,CAAC,uCAAuC,CAAC,MAAM,CAAC,EAAE;YAChD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBAC1B,CAAC;iBACH,CAAC;SACH;QAED,mGAAmG;QACnG,CAAC,uCAAuC,CAAC,QAAQ,CAAC,EAAE;YAClD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,MAAM;2BACrG,aAAa,CAAC,MAAM,KAAK,iCAAiC,CAAC,uBAAuB;iBACxF,CAAC;SACH;QAED;;;;WAIG;QACH,CAAC,uCAAuC,CAAC,sBAAsB,CAAC,EAAE;YAChE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,wDAAwD;iBACrE,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Service-provider relationships — resource configurations for the three resources (#1597).\n *\n * The asymmetry is the design: the CLIENT's verbs are on the relationship (client scope), the FIRM's\n * verbs are on its engagement mirror (firm scope), and each side's counterpart row is written by the\n * system inside the same transaction. No verb here declares `admitsCrossTenantPlatformAdministration`:\n * nobody reaches into the other tenant through a request.\n *\n * Every lifecycle verb is HIGH risk, and the two that CONFER — the client accepting a firm's proposal and\n * the client widening a relationship's scope — demand the client ORG_OWNER plus step-up, because they\n * hand people outside the organization a membership inside it.\n *\n * See `service-provider-relationships.shared.schemas.ts` for the model.\n */\n\nimport { z } from 'zod';\nimport {\n  ServiceEngagementAssignmentSchema,\n  ServiceEngagementAssignmentSettleClientApprovalDtoSchema,\n  ServiceEngagementAssignmentStatus,\n  ServiceProviderExpertAdmissionPolicy,\n  ServiceEngagementAssignments_Operations,\n  ServiceEngagementSchema,\n  ServiceEngagements_Operations,\n  ServiceProviderRelationshipSchema,\n  ServiceProviderRelationshipStatus,\n  ServiceProviderRelationships_Operations,\n} from './service-provider-relationships.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../flows-actors/autonomous-agents.shared.schemas';\nimport { ServiceProviderActivityFeedDisclosure, ServiceProviderMfaTrust } from './service-provider-client-controls.shared.schemas';\n\n/** A reason one side gives when refusing or ending. Optional everywhere; recorded, erasable. */\nconst decisionReasonDto = z.object({ decisionReason: z.string().max(1000).optional() });\n\n/** The scope a relationship is proposed or amended with. The client decides it; the firm may only propose it. */\nconst relationshipScopeDto = {\n  /** One of the provider type's `servesAsProvider.providerRoles`. Absent ⇒ its `defaultProviderRole`. */\n  role: z.string().min(1).optional(),\n  /** Client organization units. Absent or empty ⇒ organization-wide. */\n  organizationUnitIds: z.array(z.string().min(1)).max(100).optional(),\n  /**\n   * When the relationship stops conferring. `null` means \"no term\" — the framework's merge-patch UPDATE\n   * reading — and is what `amendScope` writes when it clears one.\n   *\n   * `.nullish()`, never `.optional()`: `z.coerce.date().optional()` does not reject `null`, it COERCES it,\n   * and `new Date(null)` is 1970-01-01. The operation's own prefix output is parsed by this DTO, so a\n   * cleared term was stored as a term that ended in 1970 — which the live filter reads as over, ending\n   * the relationship the client meant to make open-ended.\n   */\n  endsAt: z.coerce.date().nullish(),\n};\n\n/**\n * The client's choice of how the firm's experts are admitted (#1612). Only ever part of a CLIENT verb's contract —\n * the firm's verbs do not declare it, so a firm-supplied value is stripped before any implementation sees it.\n */\nconst expertAdmissionPolicyDto = {\n  expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy).optional()\n    .describe('Whether each expert the firm assigns must first be approved by your organization\\'s administrators. Absent: your organization type\\'s default, else every assigned expert is admitted.'),\n};\n\nconst LIVE = (status: unknown) =>\n  status === ServiceProviderRelationshipStatus.PROPOSED\n  || status === ServiceProviderRelationshipStatus.ACTIVE\n  || status === ServiceProviderRelationshipStatus.SUSPENDED;\n\n/**\n * Route-less plumbing shared by all three resources.\n *\n * - `UPDATE_MANY` — the retention writer's verb (`retentionPolicy` requires READ + LIST + UPDATE_MANY).\n * - `DELETE` — the organization purge cascade's verb ONLY. No client can delete a relationship: the\n *   terminal statuses are how one ends, and erasing the record would rewrite who could reach a tenant.\n * - `CREATE` / `UPDATE` — the system door the verbs write COUNTERPART rows through (`createAsSystem` /\n *   `updateAsSystem` resolve the resource's default CREATE / UPDATE). INTERNAL_CALL registers no route.\n */\n/* (inlined into each configuration below — contextual typing needs the literal in place) */\n\n\n/**\n * The counterpart write door is a system door, so the policy says so — and says nothing else.\n *\n * `read`/`list` are ALLOWED because the execution-context builder reads relationships and assignments on\n * a system context to decide a caller's authority (the caller is, by construction, not yet authorized).\n */\nconst systemWrites = {\n  read: ResourceSystemAccessMode.ALLOWED,\n  list: ResourceSystemAccessMode.ALLOWED,\n  create: ResourceSystemAccessMode.ALLOWED,\n  update: ResourceSystemAccessMode.ALLOWED,\n  updateMany: ResourceSystemAccessMode.ALLOWED,\n};\n\ntype RelationshipCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\nconst CORE_OPERATIONS: RelationshipCoreOperations[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.COUNT,\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.UPDATE_MANY,\n  CoreResourceOperation.DELETE,\n];\n\n/** Retained on erasure: who could reach which tenant, when and under what scope is the record; the prose is scrubbed. */\nconst RETAIN = { mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE };\n\n/**\n * How long each of the three records lives (#1613): the AUDIT_LOGS class, from the moment the record ENDS.\n *\n * They are the evidence of who from outside could reach a tenant, and when — the question an access\n * review or an incident asks years later — so they are kept for the audit trail's own period rather than\n * the ordinary resource-data one. While a relationship or an assignment is live its `endedAt` is null and\n * the row never expires; the clock starts only when it ends.\n */\nconst KEPT_AS_ACCESS_EVIDENCE = {\n  retentionClass: DataRetentionClass.AUDIT_LOGS,\n  startPoint: RetentionStartPoint.CLOSURE_EVENT,\n  closureFieldName: 'endedAt',\n};\n\nexport const serviceProviderRelationshipsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceProviderRelationships_Operations,\n    RelationshipCoreOperations,\n    typeof ServiceProviderRelationshipSchema\n  >({\n    mainSchema: ServiceProviderRelationshipSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: systemWrites,\n    retentionPolicy: RETAIN,\n    retentionBinding: KEPT_AS_ACCESS_EVIDENCE,\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /**\n       * The client proposes a relationship to a firm. The proposal IS the client owner's consent, so the\n       * firm's acceptance activates it — ORG_OWNER plus step-up, like the acceptance of a firm's proposal.\n       *\n       * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING — a third party's access to the tenant\n       * begins only with the tenant owner's declared consent.\n       */\n      [ServiceProviderRelationships_Operations.PROPOSE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requiresStepUpAuthentication: true,\n          requestDto: z.object({\n            providerOrganizationId: z.string().min(1),\n            purpose: z.string().min(1).max(1000),\n            ...relationshipScopeDto,\n            ...expertAdmissionPolicyDto,\n          }),\n        }],\n      },\n\n      /**\n       * The client owner accepts a FIRM's proposal. The implementation refuses a relationship the client itself proposed.\n       * The owner may choose here whether each expert must be approved (#1612); absent keeps the proposal's default.\n       */\n      [ServiceProviderRelationships_Operations.ACCEPT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requiresStepUpAuthentication: true,\n          requestDto: decisionReasonDto.extend(expertAdmissionPolicyDto),\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.PROPOSED,\n        }],\n      },\n\n      [ServiceProviderRelationships_Operations.DECLINE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.PROPOSED,\n        }],\n      },\n\n      [ServiceProviderRelationships_Operations.SUSPEND]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.ACTIVE,\n        }],\n      },\n\n      [ServiceProviderRelationships_Operations.RESUME]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.SUSPENDED,\n        }],\n      },\n\n      /** The client ends a live relationship — its own proposal included. Takes effect on the next request. */\n      [ServiceProviderRelationships_Operations.TERMINATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      /** Role, units, term. Only the client, only its owner, with step-up — the firm cannot widen what the client granted. */\n      [ServiceProviderRelationships_Operations.AMEND_SCOPE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requiresStepUpAuthentication: true,\n          requestDto: z.object({\n            ...relationshipScopeDto,\n            /** Explicitly clear a term (open-ended) — distinct from \"leave it as it is\". `endsAt: null` means the same. */\n            clearEndsAt: z.boolean().optional()\n              .describe('`true` removes the end date, so the relationship runs until someone ends it. Sending `endsAt: null` does the same. Omitted or `false`: the end date is set by `endsAt`, or left as it is.'),\n            /** Explicitly widen to organization-wide — distinct from \"leave the units as they are\". */\n            clearOrganizationUnitIds: z.boolean().optional()\n              .describe('`true` removes the unit restriction, so the firm\\'s experts reach the whole organization. Omitted or `false`: the units are set by `organizationUnitIds`, or left as they are.'),\n          }),\n          enabledCondition: ({ currentObject }) =>\n            currentObject.status === ServiceProviderRelationshipStatus.ACTIVE\n            || currentObject.status === ServiceProviderRelationshipStatus.SUSPENDED,\n        }],\n      },\n\n      /**\n       * Admit a firm's client, or change what an admitted one may do. `autonomousAgentRefs` is the client's\n       * choice of the firm's autonomous agents that may run here (#1611) and REPLACES the client's previous\n       * choice; omitted means none. Re-admitting an admitted client with a new list is how that choice changes.\n       */\n      [ServiceProviderRelationships_Operations.ADMIT_MACHINE_CLIENT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oauthClientId: z.string().min(1)\n              .describe('The firm\\'s machine client to admit: an active OAuth client owned by the firm\\'s organization. Any other client is refused.'),\n            autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX).optional()\n              .describe(\"The firm's autonomous agents this client may run in your organization, under this relationship's role and on your organization's budget. Replaces any earlier choice; omit it to allow none.\"),\n          }),\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      [ServiceProviderRelationships_Operations.REMOVE_MACHINE_CLIENT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oauthClientId: z.string().min(1)\n              .describe('The firm\\'s machine client to remove. It can no longer act in your organization, and your choice of its autonomous agents is dropped.'),\n          }),\n        }],\n      },\n\n      /**\n       * Change whether each assigned expert waits for this organization's approval (#1612). A client administrator's\n       * verb, on a live relationship; not retroactive — experts already admitted keep their membership, and pending\n       * approvals stay pending. The firm has no counterpart verb.\n       */\n      [ServiceProviderRelationships_Operations.SET_EXPERT_ADMISSION_POLICY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({ expertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy) }),\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      /**\n       * Decide whether the firm's own identity provider's MFA counts in this organization (#1633). The owner's verb,\n       * with step-up: trusting it lets a proof made elsewhere satisfy this organization's authentication policy for\n       * the firm's experts. The organization type's minimum strength still applies either way.\n       */\n      [ServiceProviderRelationships_Operations.SET_PROVIDER_MFA_TRUST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requiresStepUpAuthentication: true,\n          requestDto: z.object({ providerMfaTrust: z.enum(ServiceProviderMfaTrust) }),\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      /**\n       * Decide how much the firm's expert-activity feed may say about work done here (#1632). A client administrator's\n       * verb; it takes effect on the expert's next action. It can only narrow what the firm learns — at every level the\n       * feed carries metadata, never this organization's content.\n       */\n      [ServiceProviderRelationships_Operations.SET_ACTIVITY_FEED_DISCLOSURE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({ activityFeedDisclosure: z.enum(ServiceProviderActivityFeedDisclosure) }),\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n\n      /**\n       * ACTIVE or SUSPENDED → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only.\n       * Bookkeeping: admission already stopped at `endsAt`. Empty request contract by design — the\n       * implementation owns the transition, and an operation without a `requestDto` would advertise the\n       * resource's whole update contract.\n       */\n      [ServiceProviderRelationships_Operations.EXPIRE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n        }],\n      },\n    },\n  });\n\ntype EngagementCoreOperations = RelationshipCoreOperations;\n\nexport const serviceEngagementsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceEngagements_Operations,\n    EngagementCoreOperations,\n    typeof ServiceEngagementSchema\n  >({\n    mainSchema: ServiceEngagementSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_ENGAGEMENTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_ENGAGEMENTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: systemWrites,\n    retentionPolicy: RETAIN,\n    retentionBinding: KEPT_AS_ACCESS_EVIDENCE,\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /** The firm proposes a relationship to a client. Nothing is conferred until the client owner accepts. */\n      [ServiceEngagements_Operations.PROPOSE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: z.object({\n            clientOrganizationId: z.string().min(1),\n            purpose: z.string().min(1).max(1000),\n            ...relationshipScopeDto,\n            // Described HERE rather than on `relationshipScopeDto`: the relationship's own verbs take their\n            // description from the relationship's field specification, and a `.describe()` on the shared\n            // DTO would override it. The engagement has no such field, so its proposal needed its own words.\n            organizationUnitIds: relationshipScopeDto.organizationUnitIds\n              .describe('The client organization\\'s units your experts would be confined to, by their ids in the client\\'s tenant. Absent or empty: the whole client organization. The client sees this scope when deciding, and may change it later.'),\n          }),\n        }],\n      },\n\n      /** The firm accepts a CLIENT's proposal — the client owner's consent is the proposal itself. */\n      [ServiceEngagements_Operations.ACCEPT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderRelationshipStatus.PROPOSED,\n        }],\n      },\n\n      /** The firm ends a live relationship, or withdraws its own proposal. */\n      [ServiceEngagements_Operations.WITHDRAW]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: decisionReasonDto,\n          enabledCondition: ({ currentObject }) => LIVE(currentObject.status),\n        }],\n      },\n    },\n  });\n\ntype AssignmentCoreOperations = RelationshipCoreOperations;\n\nexport const serviceEngagementAssignmentsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceEngagementAssignments_Operations,\n    AssignmentCoreOperations,\n    typeof ServiceEngagementAssignmentSchema\n  >({\n    mainSchema: ServiceEngagementAssignmentSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    systemAccessPolicy: {\n      ...systemWrites,\n      /**\n       * `userId` is a foreign key to USERS, so these rows are on a person's subject-export graph. ALLOWED:\n       * which clients a person was assigned to serve is a fact about their own work, not a monitoring\n       * record about them, and it names nobody else.\n       */\n      exportSubject: ResourceSystemAccessMode.ALLOWED,\n    },\n    /**\n     * RETAIN_ONLY: an assignment holds no personal text of its own — ids, a status and timestamps — so\n     * there is nothing an erasure could scrub, and claiming RETAIN_AND_IMPERSONALIZE would describe a\n     * scrub that never happens. Kept whole as evidence of who served which client, when.\n     */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n    retentionBinding: KEPT_AS_ACCESS_EVIDENCE,\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: CORE_OPERATIONS,\n    operationsConfiguration: {\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /** The firm designates one of its ACTIVE members to serve an ACTIVE engagement. */\n      [ServiceEngagementAssignments_Operations.ASSIGN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: z.object({\n            serviceEngagementId: z.string().min(1),\n            userId: z.string().min(1),\n          }),\n        }],\n      },\n\n      /** Ends an ACTIVE assignment, or withdraws one still waiting for the client's approval (#1612). */\n      [ServiceEngagementAssignments_Operations.UNASSIGN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceEngagementAssignmentStatus.ACTIVE\n            || currentObject.status === ServiceEngagementAssignmentStatus.PENDING_CLIENT_APPROVAL,\n        }],\n      },\n\n      /**\n       * Apply the client's answer to a per-expert approval (#1612). INTERNAL_CALL: it registers no route, and is\n       * reached only from the human-decision answer path after that path authorized the answerer as one of the\n       * client's administrators. The input names the decision it settles; the write matches on it.\n       */\n      [ServiceEngagementAssignments_Operations.SETTLE_CLIENT_APPROVAL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ServiceEngagementAssignmentSettleClientApprovalDtoSchema,\n        }],\n      },\n    },\n  });\n"]}