@wildo-ai/saas-models 1.1.8 → 1.1.10

package/dist/esm/organizations/organization-members.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-members.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-members.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAC5J,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,6DAA6D,CAAC;AAIrE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,mDAAmD;AACnD,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,+BAA+B;AAC/B,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,oFAAoF;AACpF,oEAAoE;AACpE,4EAA4E;AAC5E,0EAA0E;AAC1E,EAAE;AACF,2FAA2F;AAC3F,2FAA2F;AAC3F,6FAA6F;AAC7F,uFAAuF;AACvF,6FAA6F;AAC7F,6FAA6F;AAC7F,6FAA6F;AAC7F,sEAAsE;AACtE,+FAA+F;AAC/F,uFAAuF;AACvF,6FAA6F;AAC7F,uCAAuC;AACvC,mEAAmE;AACnE,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,sEAAsE;AACtE,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,qDAAmB,CAAA;IACnB,2DAAyB,CAAA;IACzB,mDAAiB,CAAA;IACjB,mDAAiB,CAAA;IACjB,oEAAkC,CAAA;AACpC,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D,UAAU,EAAE;QACV,wBAAwB,CAAC,8BAA8B;KACxD;IACD,cAAc,EAAE,KAAK;CACU,CAAC;AAElC;;;;;GAKG;AACH,MAAM,qCAAqC,GAAG,CAAC,EAC7C,aAAa,GAGd,EAAW,EAAE,CACZ,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG,CAAC,EACpC,aAAa,GAGd,EAAW,EAAE,CACZ,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,6BAA6B,GAAG,CAAC,EAAE,aAAa,EAA8D,EAAY,EAAE,CAChI,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,gCAAgC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAEjE,MAAM,kCAAkC,GAAG;IACzC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,oGAAoG;IACpG,oGAAoG;IACpG,+FAA+F;IAC/F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CAC5E,CAAC;AAaF;;EAEE;AACF,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1K;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,0FAA0F;IAC1F,yFAAyF;IACzF,kFAAkF;IAClF,gEAAgE;IAChE,qFAAqF;IACrF,oFAAoF;IACpF,yFAAyF;IACzF,yFAAyF;IACzF,wEAAwE;IACxE,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,8BAA8B;IAE/C,uBAAuB,EAAE;QAEvB;;;;;;;;;;;;WAYG;QAEH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,iDAAiD;QACjD,gFAAgF;QAChF,uFAAuF;QACvF,yFAAyF;QACzF,wFAAwF;QACxF,2FAA2F;QAC3F,4FAA4F;QAC5F,mFAAmF;QACnF,+DAA+D;QAC/D,mFAAmF;QACnF,gFAAgF;QAChF,wEAAwE;QACxE,4EAA4E;QAC5E,6CAA6C;QAC7C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,4BAA4B,CAAC,EAAE,6DAA6D;oBAC7I,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,+DAA+D;oBAC/D,0EAA0E;oBAC1E,6DAA6D;oBAC7D,eAAe,EAAE;wBACf,SAAS,EAAE,wBAAwB,CAAC,8BAA8B;wBAClE,eAAe,EAAE,+BAA+B,CAAC,UAAU;wBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE;wBAChD,cAAc,EAAE,KAAK;wBACrB,aAAa,EAAE,aAAa;wBAC5B,gFAAgF;wBAChF,SAAS,EAAE,qCAAqC;qBACjD;iBACF;aACF;YACD,gEAAgE;YAChE,8EAA8E;YAC9E,8EAA8E;YAC9E,2EAA2E;YAC3E,+EAA+E;YAC/E,4BAA4B;YAC5B,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,mBAAmB,EAAE,WAAW;oBAChC,SAAS,EAAE,qCAAqC;iBACjD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4CAA4C;oBAChF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,2EAA2E;oBAC3E,0EAA0E;oBAC1E,wEAAwE;oBACxE,kEAAkE;oBAClE,sEAAsE;oBACtE,gBAAgB,EAAE;wBAChB,WAAW;wBACX;4BACE,UAAU,EAAE,QAAQ;4BACpB,eAAe,EAAE,gBAAgB,CAAC,aAAa;4BAC/C,gBAAgB,EAAE,QAAQ;4BAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;yBAClC;qBACF;oBACD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,kCAAkC;oBAChD,UAAU,EAAE,gCAAgC;oBAC5C,8BAA8B,EAAE,EAAE;iBACnC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,uCAAuC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,0CAA0C;oBAC1C,EAAE;oBACF,wFAAwF;oBACxF,mFAAmF;oBACnF,yFAAyF;oBACzF,wFAAwF;oBACxF,wFAAwF;oBACxF,EAAE;oBACF,2FAA2F;oBAC3F,yFAAyF;oBACzF,sFAAsF;oBACtF,2FAA2F;oBAC3F,yFAAyF;oBACzF,EAAE;oBACF,+FAA+F;oBAC/F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,yCAAyC,CAAC,EAAE,+GAA+G;oBAC5M,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,mEAAmE;oBACnE,+DAA+D;oBAC/D,uCAAuC;oBACvC,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO;iBAC5D;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2CG;QACH,CAAC,8BAA8B,CAAC,eAAe,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,yFAAyF;oBACzF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,kFAAkF;oBAClF,0FAA0F;oBAC1F,0BAA0B;oBAC1B,uCAAuC,EAAE,IAAI;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uKAAuK,CAAC;qBAC7N,CAAC;oBACF,2FAA2F;oBAC3F,yFAAyF;oBACzF,4FAA4F;oBAC5F,yFAAyF;oBACzF,oDAAoD;iBACrD;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,qFAAqF;oBACrF,0FAA0F;oBAC1F,4FAA4F;oBAC5F,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,OAAO,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,yCAAyC,CAAC,EAAE,+GAA+G;oBAC5M,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,kFAAkF,CAAC;wBACzI,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2GAA2G,CAAC;qBAC7J,CAAC;oBACF,oFAAoF;oBACpF,uFAAuF;oBACvF,uFAAuF;oBACvF,iEAAiE;oBACjE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM;iBAC3D;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,6FAA6F;oBAC7F,gFAAgF;oBAChF,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,6BAA6B;oBAC9C,aAAa,EAAE,IAAI;iBACpB;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,UAAU,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,+GAA+G;oBAC/G,+GAA+G;oBAC/G,+BAA+B;oBAC/B,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;6BACnC,QAAQ,CAAC,0FAA0F,CAAC;qBACxG,CAAC;oBACF,wFAAwF;oBACxF,yFAAyF;oBACzF,wFAAwF;oBACxF,wFAAwF;oBACxF,0EAA0E;oBAC1E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,SAAS;oBAC7D,0FAA0F;oBAC1F,uFAAuF;oBACvF,yFAAyF;oBACzF,sFAAsF;oBACtF,2FAA2F;oBAC3F,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,6FAA6F;oBAC7F,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,6BAA6B;oBAC9C,aAAa,EAAE,IAAI;oBACnB,SAAS,EAAE,4BAA4B;iBACxC;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,SAAS,EAAE,4BAA4B;iBACxC;aACF;SACF;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,4BAA4B,CAAC;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;6BACnC,QAAQ,CAAC,yIAAyI,CAAC;qBACvJ,CAAC;oBACF,eAAe,EACb,+CAA+C;oBACjD,uEAAuE;oBACvE,oEAAoE;oBACpE,mEAAmE;oBACnE,sEAAsE;oBACtE,iBAAiB,EAAE,2BAA2B;oBAC9C,2EAA2E;oBAC3E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,kFAAkF;oBAClF,0CAA0C;oBAC1C,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO;iBACnG;aACF;YACD,6EAA6E;YAC7E,uFAAuF;YACvF,qEAAqE;YACrE,6EAA6E;YAC7E,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,mBAAmB,EAAE,WAAW;oBAChC,qBAAqB,EAAE,SAAS;iBACjC;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qBAAqB,EAAE,OAAO;iBAC/B;aACF;SACF;QAED,iFAAiF;QACjF,gFAAgF;QAChF,2BAA2B;QAC3B,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,4BAA4B,CAAC;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,eAAe,EAAE;wBACf,SAAS,EAAE,wBAAwB,CAAC,8BAA8B;wBAClE,eAAe,EAAE,+BAA+B,CAAC,UAAU;wBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE;wBAChD,cAAc,EAAE,KAAK;wBACrB,4BAA4B,EAAE,IAAI;wBAClC,aAAa,EAAE,aAAa;wBAC5B,SAAS,EAAE,qCAAqC;qBACjD;oBACD,+EAA+E;oBAC/E,+EAA+E;oBAC/E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO;iBACnG;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,mBAAmB,EAAE,WAAW;oBAChC,SAAS,EAAE,qCAAqC;iBACjD;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Members Shared Resource Configuration\n *\n * Resource configuration for organization member management.\n * Comprehensive member lifecycle and role management.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationMemberSchema,\n  OrganizationMemberStatus,\n} from './organization-members.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship, DefaultDeleteResponseSchema } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport {\n  CoreConsumableTokenTypes,\n  ConsumableToken_ConsumptionMode,\n} from '../security/authentications/consumable-token.shared.schemas';\nimport type {\n  TokenRevocationConfig,\n} from '../security/authentications/consumable-token.shared.schemas';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// Custom operations enum for organization members.\n// NOTE: cross-organization member transfer is intentionally NOT a framework\n// capability — moving a member between organizations is a tenant-boundary\n// crossing the framework does not sanction. Re-invite the identity in the\n// target organization instead.\n//\n// A membership row IS the invitation (there is no separate invitation resource):\n//   - CREATE      = invite (creates an `INVITED` row + mints the accept token).\n//   - REVOKE      = inviter/admin cancels a still-`INVITED` membership.\n//   - RESEND      = re-mint + re-send the accept token for an `INVITED` membership.\n//   - SUSPEND/REACTIVATE = lifecycle of an ACTIVE/SUSPENDED member.\n// Invitee-side accept/reject is the tokenized `/auth/acceptInvitation` flow\n// (auth controller + `Auth_Invitation` screen), NOT a resource operation.\n//\n// ROLE CHANGES ARE `UPDATE`, NOT A DEDICATED VERB. `PROMOTE` / `DEMOTE` were declared here\n// as `ORG_ADMIN`-gated `riskLevel: HIGH` operations taking `{ newRole, reason }`, and were\n// removed on 2026-08-01: they were ROUTED but never implemented, so the request fell through\n// to the generic core UPDATE, which persists only fields the resource schema declares.\n// `newRole` is not one, so every call answered **HTTP 200 having changed nothing** — and the\n// dangerous direction is DEMOTE: an admin demotes a compromised account, is told 200 OK, and\n// the account keeps its privileges. Re-declaring an explicit role-change verb is legitimate,\n// but only WITH a custom implementation that writes `roles` and calls\n// `assertRequestedRolesWithinCallerCeiling` — a custom implementation is addressed by an EXACT\n// operation path, so it does NOT inherit the UPDATE variant's ceiling gate. Follow the\n// organization-units MOVE/ARCHIVE pattern (a `prefixCoreOperations` hook returning the field\n// patch the core UPDATE persists). See\n// the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n//\n// GRANT_OWNERSHIP is the ONE exception to \"role changes are UPDATE\", and it exists for a reason\n// UPDATE structurally cannot serve: it is the only operation on this resource a caller who is NOT a\n// member of the organization may perform. See its config entry below.\nexport enum OrganizationMembers_Operations {\n  SUSPEND = 'suspend',\n  REACTIVATE = 'reactivate',\n  REVOKE = 'revoke',\n  RESEND = 'resend',\n  GRANT_OWNERSHIP = 'grantOwnership',\n}\n\n/**\n * One semantic definition for invalidating an organization invitation.\n *\n * REVOKE attaches it declaratively, so HTTP and trusted service callers enter\n * the same transactional revocation pipeline. Ordinary DELETE is\n * intentionally excluded: it removes a non-INVITED membership, which has no\n * invitation token to revoke.\n */\nexport const ORGANIZATION_MEMBER_INVITATION_TOKEN_REVOCATION = {\n  tokenTypes: [\n    CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION,\n  ],\n  relatedIdField: '_id',\n} satisfies TokenRevocationConfig;\n\n/**\n * One predicate owns both invitation-token generation and invitation-email\n * dispatch. Keeping the two declarative side effects on the same named gate\n * prevents the polymorphic CREATE operation from drifting: an ACTIVE direct\n * add must produce neither an accept token nor an invitation email.\n */\nconst isPendingOrganizationMemberInvitation = ({\n  currentObject,\n}: {\n  currentObject: Record<string, unknown>;\n}): boolean =>\n  currentObject.status === OrganizationMemberStatus.INVITED;\n\n/**\n * REACTIVATE's notifications say the member \"can now access organization resources again\", which is true only when\n * the membership came back ACTIVE. A service-provider membership whose relationship has ended, or whose person is no\n * longer assigned, lands INACTIVE instead (#1597), and neither the person nor the organization's users may be told\n * otherwise. Evaluated against the row as written.\n */\nconst isRestoredToActiveMembership = ({\n  currentObject,\n}: {\n  currentObject: Record<string, unknown>;\n}): boolean =>\n  currentObject.status === OrganizationMemberStatus.ACTIVE;\n\n/**\n * The recipient of a membership's own status notice: the member whose membership was suspended or\n * reactivated (#1870).\n *\n * `USERS_CUSTOM` rather than `USER_SELF`, and the difference is the whole defect: `USER_SELF` is the\n * INITIATOR — the administrator who pressed the button — so \"your membership was suspended\" landed in\n * the administrator's inbox, and the scheduled reactivation sweep, which has no initiator, told nobody.\n * `ORGANIZATION_USERS` cannot reach the member either: it keeps only ACTIVE memberships, and a suspended\n * member is not one. The row the operation just wrote carries the member's `userId`, so that is the\n * recipient. Same shape as the `users` account-status notices (#1807).\n */\nconst selectMembershipStatusSubject = ({ currentObject }: { currentObject: { userId?: unknown } | null | undefined }): string[] =>\n  currentObject?.userId ? [String(currentObject.userId)] : [];\n\n/**\n * Sortable member fields.\n *\n * `role` and `joinedAt` were listed here and neither is a field (#1806): the membership carries\n * `roles`, an ARRAY — which has no meaningful sort order on either adapter, so it is not offered —\n * and it records when it was created, not a separate join instant. Both entries were passed to the\n * repository verbatim and silently ignored. The factory now refuses a sort field that is not a field.\n */\nconst ORGANIZATION_MEMBERS_SORT_FIELDS = ['status', 'createdAt'];\n\nconst ORGANIZATION_MEMBERS_FILTER_FIELDS = {\n  status: z.enum(OrganizationMemberStatus),\n  // `roles` is an array, and a scalar filter on it matches array MEMBERSHIP on both adapters: MongoDB\n  // does so natively and the PostgreSQL filter compiler emits a jsonb containment (`roles @> '\"x\"'`).\n  // It was declared as `role`, a field no row has, so `?role=ORG_ADMIN` matched nothing (#1806).\n  roles: z.string().min(1).describe('Only return members holding this role.'),\n};\n\ntype OrganizationMembersCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.COUNT\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\n/*\nOrganization Members Resource Configuration Factory\n*/\nexport const organizationMembersResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrganizationMembers_Operations,\n  OrganizationMembersCoreOperations,\n  typeof OrganizationMemberSchema\n>({\n  mainSchema: OrganizationMemberSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_MEMBERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_MEMBERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // create: invitation-accept was the historical opt-in; now the org-admin INVITE, SSO/SCIM\n  //   JIT, and org-auto-create-on-registration all create members in-process with explicit\n  //   `userId` + `organizationId` FKs on a request-context-less EC (stripped by the\n  //   client-shaped CREATE DTO, re-attached by `createAsSystem`).\n  // read/list: the invitee's own pending-invitation inbox reads INVITED rows cross-org\n  //   BEFORE the invitee is a scoped member — authorized by `userId`-ownership at the\n  //   entry point (`listMyPendingInvitations`/`loadOwnedPendingInvitation`), not org role.\n  // update: invitation ACCEPTANCE flips INVITED → ACTIVE in-process; the invitee is not an\n  //   org admin, so the status flip goes through the trusted system path.\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  /**\n   * Subject-export disclosure. The subject's OWN membership rows (org, roles, title) — not other members' data.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n  /**\n   * Subject erasure RETAINS this row and scrubs the person's contact and professional details.\n *\n * The membership survives because it is the tenant's record of who belonged to it and under what\n * authority; what does not survive is `userEmail` and `userTitle`, the denormalized copies of the\n * person held here so a row can be read without resolving the user.\n *\n * `roles` is deliberately NOT scrubbed. It is this application's authorization vocabulary rather than\n * personal data — the field's own comment says so — and emptying it could leave a tenant with no\n * administrator, which the administrative-continuity floors would refuse, making an erasure fail closed\n * on a tenant. Keeping it means that interaction never arises.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Erasing one of these rows revokes NO session. A membership is a record ABOUT a person's place in a\n *  tenant, not the person — their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    CoreResourceOperation.COUNT,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: OrganizationMembers_Operations,\n\n  operationsConfiguration: {\n\n    /*\n\n     * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n\n     * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n\n     * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n\n     * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n\n     * verb the impersonalize writer uses to stamp the retention markers.\n\n     */\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n\n      variants: [{\n\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n        isDefault: true,\n\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n        riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n      }],\n\n    },\n\n    [CoreResourceOperation.COUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    // CREATE is POLYMORPHIC — two intents on one op:\n    //  • INVITE (BRANCH B): the org admin supplies `userEmail` (the strict identity\n    //    anchor); the CREATE prefix find-or-creates the `User` by it (`PENDING_INVITATION`\n    //    if new) and FORCES `status: INVITED`. A single-use accept token is minted AFTER the\n    //    row is created (relatedId = the membership `_id`, STABLE across `INVITED → ACTIVE`\n    //    so the emailed link never orphans); the pipeline injects it into the invite email and\n    //    the dispatcher builds the accept link (`emailLinkPath → /invitation?token=…`, consumed\n    //    by `/auth/acceptInvitation`). No `grantedRoles`: the accept handler reads the\n    //    membership's own `roles` when it flips the row to ACTIVE.\n    //  • DIRECT-ADD (BRANCH A): the caller supplies `userId` (founder org-owner grant,\n    //    SSO-JIT, SCIM) and the row persists `ACTIVE` — there is nothing to accept.\n    // Token generation and notification dispatch share one named predicate.\n    // The INVITE branch mints one accept token and sends one post-commit email;\n    // the ACTIVE direct-add branch does neither.\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS], // Org admins, or a firm's expert lent INVITE_MEMBERS (#1631)\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // requestDto auto-derived from decorators (userEmail + roles +\n          // organizationUnitsMembership + userTitle; userId/status/invitedByUserId/\n          // invitedAt are server-injected via `.excludeFromCreate()`).\n          tokenGeneration: {\n            tokenType: CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION,\n            consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n            expiresIn: { value: 7, unit: DurationUnit.DAYS },\n            relatedIdField: '_id',\n            emailLinkPath: '/invitation',\n            // Mint the accept token for real invites only — never for an ACTIVE direct-add.\n            condition: isPendingOrganizationMemberInvitation,\n          },\n        }\n      ],\n      // Deliver the invite email to the INVITEE (`userEmail`) via the\n      // email-by-address path — the invitee may be a brand-new `PENDING_INVITATION`\n      // user with no session. Carries the `acceptUrl` (`/invitation?token=…`) built\n      // from the token minted above. `target: USER_SELF` is retained only so the\n      // derived template ref stays `…create.user-self` and the accept link routes to\n      // the main (non-admin) app.\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          recipientEmailField: 'userEmail',\n          condition: isPendingOrganizationMemberInvitation,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can read member info\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list organization members\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `userEmail` is a denormalized, immutable own-field (mirror of the linked\n          // user's email, captured at membership creation). First/last name are NOT\n          // denormalized onto the member row — they live on `USER_PROFILES` and are\n          // mutable there — so they are searched RELATIONALLY: the framework runs a\n          // secondary match on `USER_PROFILES` (its own searchable fields) and folds\n          // the matching `userId`s into an `$in` on this row's `userId`. The member\n          // query stays org-scoped, so this is tenant-safe; names are never stale\n          // because they are read live from the profile at search time. See\n          // SearchableRelationDescriptor in resources-config.shared.schemas.ts.\n          searchableFields: [\n            'userEmail',\n            {\n              localField: 'userId',\n              relatedResource: CoreResourceType.USER_PROFILES,\n              relatedJoinField: 'userId',\n              fields: ['firstName', 'lastName'],\n            },\n          ],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORGANIZATION_MEMBERS_FILTER_FIELDS,\n          sortFields: ORGANIZATION_MEMBERS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update member details\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // requestDto auto-derived from decorators\n          //\n          // Ordinary UPDATE remains audited below the HIGH/CRITICAL floor: editing member details\n          // is MEDIUM risk for the UI, but changing roles still requires privilege evidence.\n          // The registered UPDATE implementation also emits ORGANIZATION_MEMBER_ROLE_CHANGED after\n          // a durable role change, with previous, requested and resulting roles. That specialized\n          // event complements the automatic operation event; it is not an unimplemented producer.\n          //\n          // GRANT_OWNERSHIP is a separate named role-change path. Its UPDATE-like core behavior does\n          // not inherit UPDATE's custom hooks: registration resolves the exact operation identity.\n          // Its CRITICAL risk triggers RESOURCE_OPERATION_PERFORMED automatically, with changed\n          // role sets carried by the roles field's audit-evidence marker. Queries covering ownership\n          // repair must include that operation family, not only the specialized role-change event.\n          //\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n          auditableEvent: { auditBelowRiskFloor: true },\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS], // Org admins; a firm's expert lent MANAGE_RELATIONSHIP_EXPERTS, on its own relationship's experts only (#1631)\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Accepted/non-pending members use ordinary DELETE. A pending invite\n          // is cancelled through REVOKE, which atomically revokes its accept\n          // token. Keeping the vocabularies disjoint avoids making every\n          // active-member removal token-coupled.\n          enabledCondition: ({ currentObject }) =>\n            currentObject.status !== OrganizationMemberStatus.INVITED,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * The higher-tier repair door for the organization-owner floor — the second half of the\n     * industry pattern described in `.claude/rules/administrative-continuity-floors.md`.\n     *\n     * ## Why this cannot be UPDATE\n     *\n     * The floor refuses to let the last `ORG_OWNER` be removed, demoted or deactivated. That is the\n     * correct tenant-tier answer, but on its own it converts every mistake that DID strand a tenant\n     * — a direct database edit, a restore from a mid-erasure backup, an acknowledged erasure under\n     * GDPR Art. 17, a seed that authored no owner — into a permanent lockout, because\n     * `validateParentScopeAccess` denies a non-member on ORGANIZATIONS scope and there is no\n     * `APP_ADMIN_SUPER_ADMIN` bypass. Both denials are pinned in\n     * `cross-tenant-super-admin-reach.mongo.integration.test.ts`. So no tenant member can grant the\n     * role (they would need the authority they just lost) and no platform administrator can reach\n     * the row at all. GitHub solves this with an Enterprise owner one tier up; this is that tier.\n     *\n     * ## Why it is a distinct verb rather than a flag on UPDATE\n     *\n     * `admitsCrossTenantPlatformAdministration` relaxes the SCOPE check for the variant that carries\n     * it. Putting it on generic UPDATE would open every field of every membership row in every\n     * tenant to a cross-tenant caller. The whole safety argument is that the opened surface is\n     * exactly one field with one direction, so it is authored as its own operation whose custom\n     * implementation reads nothing from the payload but the justification — which it records, and\n     * never persists onto the row.\n     *\n     * ## Deliberate narrowness\n     *\n     * - **Promotes an EXISTING member** (Microsoft Loop's rule). It cannot mint a membership, so it\n     *   never creates an identity inside a tenant nobody owns.\n     * - **Additive only.** It adds the owner-conferring role; it cannot remove roles, so it can\n     *   never be used to demote and is not a second path through the floor.\n     * - **`justification` is required**, not optional. This is a break-glass action against a tenant\n     *   the operator is not a member of; the audit row is worth nothing without the why. `AC-2(7)`\n     *   asks for privileged assignment to be monitored — the trail IS the control here, since by\n     *   construction no authorization check downstream can second-guess the caller. It lands on the\n     *   `ORGANIZATION_MEMBER_ROLE_CHANGED` row the grant emits post-commit (`eventData.justification`),\n     *   beside the before/after role sets. `RESOURCE_OPERATION_PERFORMED`, which this CRITICAL verb\n     *   also emits, carries no request payload and so cannot hold it. Until #593 it was validated here\n     *   and discarded at the service boundary.\n     *\n     * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — restore administrability of a scope\n     * that has no usable administrator.\n     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant.\n     */\n    [OrganizationMembers_Operations.GRANT_OWNERSHIP]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Platform tier only. This is the role set the operation-roles gate checks INDEPENDENTLY\n          // of the scope admission below: a caller holding this key at ORGANIZATIONS scope resolves\n          // it against the organization role table, which does not contain it, and is denied there.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // THE cross-tenant admission. Without it the operation is unreachable by the only\n          // principal it exists for, because a platform administrator is by definition not a member\n          // of the stranded tenant.\n          admitsCrossTenantPlatformAdministration: true,\n          requestDto: z.object({\n            justification: z.string().min(1).max(1000).describe('Why a platform administrator is making this member an owner of an organization they do not belong to. Required, and recorded on the audit trail with the role change.'),\n          }),\n          // No `auditableEvent` declaration: CRITICAL is inside `AUTOMATIC_AUDIT_RISK_FLOOR`, so the\n          // event emits on the risk level alone and `auditBelowRiskFloor` would be inert here. The\n          // before/after role sets ride along because `roles` carries `.isAuditEvidence()` — which is\n          // what makes the trail answer the question that matters about this door: WHO was made an\n          // owner of a tenant, by a caller who was not in it.\n        },\n      ],\n      userNotifications: [\n        {\n          // The tenant learns that its ownership changed from outside. An operator repairing a\n          // stranded tenant is legitimate; an operator quietly granting themselves an ally inside a\n          // customer's tenant is not, and the difference is only visible to the tenant if it is told.\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n      ],\n    },\n\n    [OrganizationMembers_Operations.SUSPEND]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS], // Org admins; a firm's expert lent MANAGE_RELATIONSHIP_EXPERTS, on its own relationship's experts only (#1631)\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            suspensionReason: z.string().min(1).max(500).describe('Why the member is suspended. Recorded on the audit trail, not on the membership.'),\n            suspensionEndDate: z.date().optional().describe('When the suspension ends and the member is reactivated. Absent: suspended until someone reactivates them.'),\n          }),\n          // Implemented by the shared status-transition factory (ACTIVE → SUSPENDED, carrying\n          // `suspensionEndDate` onto the row's `scheduledReactivationAt`). SUSPEND is legal only\n          // from ACTIVE: an INVITED row has not accepted yet — cancel it with REVOKE, which also\n          // revokes the accept token — and an INACTIVE one is already out.\n          enabledCondition: ({ currentObject }) =>\n            currentObject.status === OrganizationMemberStatus.ACTIVE,\n        }\n      ],\n      userNotifications: [\n        {\n          // The suspended member. `alwaysDeliver`: a person who loses access to an organization has no\n          // other way to learn why, whatever they chose for ordinary email notifications.\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectMembershipStatusSubject,\n          alwaysDeliver: true,\n        },\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [OrganizationMembers_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Org admins only. NOT opened to MANAGE_RELATIONSHIP_EXPERTS (#1631): a suspension is the client's bar against\n          // one person, which the firm cannot lift (#1597) — a firm may suspend or remove its own expert, never undo the\n          // client's suspension of them.\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            reason: z.string().max(500).optional()\n              .describe('Why the member is being reactivated. Recorded with the audit event for the reactivation.')\n          }),\n          // Implemented by the shared status-transition factory (SUSPENDED → ACTIVE, clearing any\n          // pending `scheduledReactivationAt`). Legal only from SUSPENDED: reactivating an INVITED\n          // row would skip acceptance and grant a membership nobody agreed to. A service-provider\n          // membership lands INACTIVE instead when its relationship has ended or its person is no\n          // longer assigned (#1597, `resolveProviderMembershipReactivationStatus`).\n          enabledCondition: ({ currentObject }) =>\n            currentObject.status === OrganizationMemberStatus.SUSPENDED,\n          // MEDIUM sits below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this the RESTORE half of the\n          // pair would go untrailed while SUSPEND (CRITICAL) is recorded — a trail showing every\n          // suspension and none of the lifts, which reads as a member still suspended a year after\n          // they were reinstated. The risk level answers \"how alarming is the affordance\"; this\n          // answers \"is it evidence an auditor needs\", and for the inverse of a CRITICAL verb it is.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n        }\n      ],\n      userNotifications: [\n        {\n          // The reactivated member — reached on the scheduled sweep too, which runs with no initiator.\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectMembershipStatusSubject,\n          alwaysDeliver: true,\n          condition: isRestoredToActiveMembership,\n        },\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n          condition: isRestoredToActiveMembership,\n        }\n      ]\n    },\n\n    // REVOKE — inviter/admin cancels a still-`INVITED` membership. The exact\n    // custom implementation DELETES the row and atomically revokes its accept\n    // token. The paired PENDING_INVITATION user is retained here and reaped by\n    // deferred hygiene only after it is old and still has no memberships:\n    // point-operation cleanup cannot predicate-lock \"zero memberships\" against\n    // a concurrent invitation insert under Mongo snapshot isolation. `reason`\n    // is captured in the audit payload, not persisted on the deleted row.\n    [OrganizationMembers_Operations.REVOKE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.DELETE,\n          requestDto: z.object({\n            reason: z.string().max(500).optional()\n              .describe('Why the invitation is being revoked. Recorded with the audit event for the removal; it is not kept on the membership, which is deleted.')\n          }),\n          tokenRevocation:\n            ORGANIZATION_MEMBER_INVITATION_TOKEN_REVOCATION,\n          // REVOKE has an exact API custom registration; `resourceOperationLike`\n          // selects DELETE persistence/DTO semantics but does not inherit the\n          // core DELETE custom implementation. Its real return is the delete\n          // envelope, declared explicitly so output validation matches runtime.\n          customResponseDto: DefaultDeleteResponseSchema,\n          // Only a still-pending invite can be revoked — an ACTIVE member is removed\n          // via DELETE, not \"revoked\". Gates the roster action (paired with the preset's\n          // `WHEN_AVAILABLE`, the button shows only on INVITED rows) AND fail-closes the\n          // backend (`services-registry-handler` throws SERVICE_RESOURCE_OPERATION_DISABLED\n          // → 403 if invoked on a non-INVITED row).\n          enabledCondition: ({ currentObject }) => currentObject.status === OrganizationMemberStatus.INVITED,\n        },\n      ],\n      // Two emails (distinct templates, disambiguated by `customNotificationRef`):\n      //  • the INVITEE (`recipientEmailField: 'userEmail'`) — \"your invitation was revoked\";\n      //  • the ADMIN/initiator (`USER_SELF`) — confirmation of the action.\n      // Both USER_SELF+EMAIL, so each MUST carry a unique `customNotificationRef`.\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          recipientEmailField: 'userEmail',\n          customNotificationRef: 'invitee',\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          customNotificationRef: 'admin',\n        }\n      ]\n    },\n\n    // RESEND — re-mint the accept token (revoking any prior one for this membership)\n    // and re-send the invite email with the fresh accept link. Only valid while the\n    // membership is `INVITED`.\n    [OrganizationMembers_Operations.RESEND]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          tokenGeneration: {\n            tokenType: CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION,\n            consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n            expiresIn: { value: 7, unit: DurationUnit.DAYS },\n            relatedIdField: '_id',\n            revokeExistingForSameRelated: true,\n            emailLinkPath: '/invitation',\n            condition: isPendingOrganizationMemberInvitation,\n          },\n          // Resend is meaningful only while the invite is pending. Same dual enforcement\n          // as REVOKE: hides the roster action on non-INVITED rows and 403s server-side.\n          enabledCondition: ({ currentObject }) => currentObject.status === OrganizationMemberStatus.INVITED,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          recipientEmailField: 'userEmail',\n          condition: isPendingOrganizationMemberInvitation,\n        }\n      ]\n    }\n  },\n});\n"]}
+{"version":3,"file":"organization-members.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-members.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAC5J,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,6DAA6D,CAAC;AAIrE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,mDAAmD;AACnD,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,+BAA+B;AAC/B,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,oFAAoF;AACpF,oEAAoE;AACpE,4EAA4E;AAC5E,0EAA0E;AAC1E,EAAE;AACF,2FAA2F;AAC3F,2FAA2F;AAC3F,6FAA6F;AAC7F,uFAAuF;AACvF,6FAA6F;AAC7F,6FAA6F;AAC7F,6FAA6F;AAC7F,sEAAsE;AACtE,+FAA+F;AAC/F,uFAAuF;AACvF,6FAA6F;AAC7F,uCAAuC;AACvC,mEAAmE;AACnE,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,sEAAsE;AACtE,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,qDAAmB,CAAA;IACnB,2DAAyB,CAAA;IACzB,mDAAiB,CAAA;IACjB,mDAAiB,CAAA;IACjB,oEAAkC,CAAA;AACpC,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D,UAAU,EAAE;QACV,wBAAwB,CAAC,8BAA8B;KACxD;IACD,cAAc,EAAE,KAAK;CACU,CAAC;AAElC;;;;;GAKG;AACH,MAAM,qCAAqC,GAAG,CAAC,EAC7C,aAAa,GAGd,EAAW,EAAE,CACZ,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG,CAAC,EACpC,aAAa,GAGd,EAAW,EAAE,CACZ,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,6BAA6B,GAAG,CAAC,EAAE,aAAa,EAA8D,EAAY,EAAE,CAChI,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,gCAAgC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAEjE,MAAM,kCAAkC,GAAG;IACzC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,oGAAoG;IACpG,oGAAoG;IACpG,+FAA+F;IAC/F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CAC5E,CAAC;AAaF;;EAEE;AACF,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1K;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,0FAA0F;IAC1F,yFAAyF;IACzF,kFAAkF;IAClF,gEAAgE;IAChE,qFAAqF;IACrF,oFAAoF;IACpF,yFAAyF;IACzF,yFAAyF;IACzF,wEAAwE;IACxE,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E;;;;;;;;;;;OAWG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,8BAA8B;IAE/C,uBAAuB,EAAE;QAEvB;;;;;;;;;;;;WAYG;QAEH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,iDAAiD;QACjD,gFAAgF;QAChF,uFAAuF;QACvF,yFAAyF;QACzF,wFAAwF;QACxF,2FAA2F;QAC3F,4FAA4F;QAC5F,mFAAmF;QACnF,+DAA+D;QAC/D,mFAAmF;QACnF,gFAAgF;QAChF,wEAAwE;QACxE,4EAA4E;QAC5E,6CAA6C;QAC7C,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,4BAA4B,CAAC,EAAE,6DAA6D;oBAC7I,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,+DAA+D;oBAC/D,0EAA0E;oBAC1E,6DAA6D;oBAC7D,eAAe,EAAE;wBACf,SAAS,EAAE,wBAAwB,CAAC,8BAA8B;wBAClE,eAAe,EAAE,+BAA+B,CAAC,UAAU;wBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE;wBAChD,cAAc,EAAE,KAAK;wBACrB,aAAa,EAAE,aAAa;wBAC5B,gFAAgF;wBAChF,SAAS,EAAE,qCAAqC;qBACjD;iBACF;aACF;YACD,gEAAgE;YAChE,8EAA8E;YAC9E,8EAA8E;YAC9E,2EAA2E;YAC3E,+EAA+E;YAC/E,4BAA4B;YAC5B,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,mBAAmB,EAAE,WAAW;oBAChC,SAAS,EAAE,qCAAqC;iBACjD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,4CAA4C;oBAChF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,2EAA2E;oBAC3E,0EAA0E;oBAC1E,wEAAwE;oBACxE,kEAAkE;oBAClE,sEAAsE;oBACtE,gBAAgB,EAAE;wBAChB,WAAW;wBACX;4BACE,UAAU,EAAE,QAAQ;4BACpB,eAAe,EAAE,gBAAgB,CAAC,aAAa;4BAC/C,gBAAgB,EAAE,QAAQ;4BAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;yBAClC;qBACF;oBACD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,kCAAkC;oBAChD,UAAU,EAAE,gCAAgC;oBAC5C,8BAA8B,EAAE,EAAE;iBACnC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,uCAAuC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,0CAA0C;oBAC1C,EAAE;oBACF,wFAAwF;oBACxF,mFAAmF;oBACnF,yFAAyF;oBACzF,wFAAwF;oBACxF,wFAAwF;oBACxF,EAAE;oBACF,2FAA2F;oBAC3F,yFAAyF;oBACzF,sFAAsF;oBACtF,2FAA2F;oBAC3F,yFAAyF;oBACzF,EAAE;oBACF,+FAA+F;oBAC/F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,yCAAyC,CAAC,EAAE,+GAA+G;oBAC5M,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,mEAAmE;oBACnE,+DAA+D;oBAC/D,uCAAuC;oBACvC,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO;iBAC5D;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2CG;QACH,CAAC,8BAA8B,CAAC,eAAe,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,yFAAyF;oBACzF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,kFAAkF;oBAClF,0FAA0F;oBAC1F,0BAA0B;oBAC1B,uCAAuC,EAAE,IAAI;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uKAAuK,CAAC;qBAC7N,CAAC;oBACF,2FAA2F;oBAC3F,yFAAyF;oBACzF,4FAA4F;oBAC5F,yFAAyF;oBACzF,oDAAoD;iBACrD;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,qFAAqF;oBACrF,0FAA0F;oBAC1F,4FAA4F;oBAC5F,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,OAAO,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,yCAAyC,CAAC,EAAE,+GAA+G;oBAC5M,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,kFAAkF,CAAC;wBACzI,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2GAA2G,CAAC;qBAC7J,CAAC;oBACF,oFAAoF;oBACpF,uFAAuF;oBACvF,uFAAuF;oBACvF,iEAAiE;oBACjE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM;iBAC3D;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,6FAA6F;oBAC7F,gFAAgF;oBAChF,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,6BAA6B;oBAC9C,aAAa,EAAE,IAAI;iBACpB;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,UAAU,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,+GAA+G;oBAC/G,+GAA+G;oBAC/G,+BAA+B;oBAC/B,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;6BACnC,QAAQ,CAAC,0FAA0F,CAAC;qBACxG,CAAC;oBACF,wFAAwF;oBACxF,yFAAyF;oBACzF,wFAAwF;oBACxF,wFAAwF;oBACxF,0EAA0E;oBAC1E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,SAAS;oBAC7D,0FAA0F;oBAC1F,uFAAuF;oBACvF,yFAAyF;oBACzF,sFAAsF;oBACtF,2FAA2F;oBAC3F,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;iBAC9C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,6FAA6F;oBAC7F,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,6BAA6B;oBAC9C,aAAa,EAAE,IAAI;oBACnB,SAAS,EAAE,4BAA4B;iBACxC;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,SAAS,EAAE,4BAA4B;iBACxC;aACF;SACF;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,4BAA4B,CAAC;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;6BACnC,QAAQ,CAAC,yIAAyI,CAAC;qBACvJ,CAAC;oBACF,eAAe,EACb,+CAA+C;oBACjD,uEAAuE;oBACvE,oEAAoE;oBACpE,mEAAmE;oBACnE,sEAAsE;oBACtE,iBAAiB,EAAE,2BAA2B;oBAC9C,2EAA2E;oBAC3E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,kFAAkF;oBAClF,0CAA0C;oBAC1C,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO;iBACnG;aACF;YACD,6EAA6E;YAC7E,uFAAuF;YACvF,qEAAqE;YACrE,6EAA6E;YAC7E,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,mBAAmB,EAAE,WAAW;oBAChC,qBAAqB,EAAE,SAAS;iBACjC;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qBAAqB,EAAE,OAAO;iBAC/B;aACF;SACF;QAED,iFAAiF;QACjF,gFAAgF;QAChF,2BAA2B;QAC3B,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,4BAA4B,CAAC;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,eAAe,EAAE;wBACf,SAAS,EAAE,wBAAwB,CAAC,8BAA8B;wBAClE,eAAe,EAAE,+BAA+B,CAAC,UAAU;wBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE;wBAChD,cAAc,EAAE,KAAK;wBACrB,4BAA4B,EAAE,IAAI;wBAClC,aAAa,EAAE,aAAa;wBAC5B,SAAS,EAAE,qCAAqC;qBACjD;oBACD,+EAA+E;oBAC/E,+EAA+E;oBAC/E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO;iBACnG;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,mBAAmB,EAAE,WAAW;oBAChC,SAAS,EAAE,qCAAqC;iBACjD;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Members Shared Resource Configuration\n *\n * Resource configuration for organization member management.\n * Comprehensive member lifecycle and role management.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationMemberSchema,\n  OrganizationMemberStatus,\n} from './organization-members.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship, DefaultDeleteResponseSchema } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport {\n  CoreConsumableTokenTypes,\n  ConsumableToken_ConsumptionMode,\n} from '../security/authentications/consumable-token.shared.schemas';\nimport type {\n  TokenRevocationConfig,\n} from '../security/authentications/consumable-token.shared.schemas';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\n// Custom operations enum for organization members.\n// NOTE: cross-organization member transfer is intentionally NOT a framework\n// capability — moving a member between organizations is a tenant-boundary\n// crossing the framework does not sanction. Re-invite the identity in the\n// target organization instead.\n//\n// A membership row IS the invitation (there is no separate invitation resource):\n//   - CREATE      = invite (creates an `INVITED` row + mints the accept token).\n//   - REVOKE      = inviter/admin cancels a still-`INVITED` membership.\n//   - RESEND      = re-mint + re-send the accept token for an `INVITED` membership.\n//   - SUSPEND/REACTIVATE = lifecycle of an ACTIVE/SUSPENDED member.\n// Invitee-side accept/reject is the tokenized `/auth/acceptInvitation` flow\n// (auth controller + `Auth_Invitation` screen), NOT a resource operation.\n//\n// ROLE CHANGES ARE `UPDATE`, NOT A DEDICATED VERB. `PROMOTE` / `DEMOTE` were declared here\n// as `ORG_ADMIN`-gated `riskLevel: HIGH` operations taking `{ newRole, reason }`, and were\n// removed on 2026-08-01: they were ROUTED but never implemented, so the request fell through\n// to the generic core UPDATE, which persists only fields the resource schema declares.\n// `newRole` is not one, so every call answered **HTTP 200 having changed nothing** — and the\n// dangerous direction is DEMOTE: an admin demotes a compromised account, is told 200 OK, and\n// the account keeps its privileges. Re-declaring an explicit role-change verb is legitimate,\n// but only WITH a custom implementation that writes `roles` and calls\n// `assertRequestedRolesWithinCallerCeiling` — a custom implementation is addressed by an EXACT\n// operation path, so it does NOT inherit the UPDATE variant's ceiling gate. Follow the\n// organization-units MOVE/ARCHIVE pattern (a `prefixCoreOperations` hook returning the field\n// patch the core UPDATE persists). See\n// the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n//\n// GRANT_OWNERSHIP is the ONE exception to \"role changes are UPDATE\", and it exists for a reason\n// UPDATE structurally cannot serve: it is the only operation on this resource a caller who is NOT a\n// member of the organization may perform. See its config entry below.\nexport enum OrganizationMembers_Operations {\n  SUSPEND = 'suspend',\n  REACTIVATE = 'reactivate',\n  REVOKE = 'revoke',\n  RESEND = 'resend',\n  GRANT_OWNERSHIP = 'grantOwnership',\n}\n\n/**\n * One semantic definition for invalidating an organization invitation.\n *\n * REVOKE attaches it declaratively, so HTTP and trusted service callers enter\n * the same transactional revocation pipeline. Ordinary DELETE is\n * intentionally excluded: it removes a non-INVITED membership, which has no\n * invitation token to revoke.\n */\nexport const ORGANIZATION_MEMBER_INVITATION_TOKEN_REVOCATION = {\n  tokenTypes: [\n    CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION,\n  ],\n  relatedIdField: '_id',\n} satisfies TokenRevocationConfig;\n\n/**\n * One predicate owns both invitation-token generation and invitation-email\n * dispatch. Keeping the two declarative side effects on the same named gate\n * prevents the polymorphic CREATE operation from drifting: an ACTIVE direct\n * add must produce neither an accept token nor an invitation email.\n */\nconst isPendingOrganizationMemberInvitation = ({\n  currentObject,\n}: {\n  currentObject: Record<string, unknown>;\n}): boolean =>\n  currentObject.status === OrganizationMemberStatus.INVITED;\n\n/**\n * REACTIVATE's notifications say the member \"can now access organization resources again\", which is true only when\n * the membership came back ACTIVE. A service-provider membership whose relationship has ended, or whose person is no\n * longer assigned, lands INACTIVE instead (#1597), and neither the person nor the organization's users may be told\n * otherwise. Evaluated against the row as written.\n */\nconst isRestoredToActiveMembership = ({\n  currentObject,\n}: {\n  currentObject: Record<string, unknown>;\n}): boolean =>\n  currentObject.status === OrganizationMemberStatus.ACTIVE;\n\n/**\n * The recipient of a membership's own status notice: the member whose membership was suspended or\n * reactivated (#1870).\n *\n * `USERS_CUSTOM` rather than `USER_SELF`, and the difference is the whole defect: `USER_SELF` is the\n * INITIATOR — the administrator who pressed the button — so \"your membership was suspended\" landed in\n * the administrator's inbox, and the scheduled reactivation sweep, which has no initiator, told nobody.\n * `ORGANIZATION_USERS` cannot reach the member either: it keeps only ACTIVE memberships, and a suspended\n * member is not one. The row the operation just wrote carries the member's `userId`, so that is the\n * recipient. Same shape as the `users` account-status notices (#1807).\n */\nconst selectMembershipStatusSubject = ({ currentObject }: { currentObject: { userId?: unknown } | null | undefined }): string[] =>\n  currentObject?.userId ? [String(currentObject.userId)] : [];\n\n/**\n * Sortable member fields.\n *\n * `role` and `joinedAt` were listed here and neither is a field (#1806): the membership carries\n * `roles`, an ARRAY — which has no meaningful sort order on either adapter, so it is not offered —\n * and it records when it was created, not a separate join instant. Both entries were passed to the\n * repository verbatim and silently ignored. The factory now refuses a sort field that is not a field.\n */\nconst ORGANIZATION_MEMBERS_SORT_FIELDS = ['status', 'createdAt'];\n\nconst ORGANIZATION_MEMBERS_FILTER_FIELDS = {\n  status: z.enum(OrganizationMemberStatus),\n  // `roles` is an array, and a scalar filter on it matches array MEMBERSHIP on both adapters: MongoDB\n  // does so natively and the PostgreSQL filter compiler emits a jsonb containment (`roles @> '\"x\"'`).\n  // It was declared as `role`, a field no row has, so `?role=ORG_ADMIN` matched nothing (#1806).\n  roles: z.string().min(1).describe('Only return members holding this role.'),\n};\n\ntype OrganizationMembersCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.COUNT\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\n/*\nOrganization Members Resource Configuration Factory\n*/\nexport const organizationMembersResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrganizationMembers_Operations,\n  OrganizationMembersCoreOperations,\n  typeof OrganizationMemberSchema\n>({\n  mainSchema: OrganizationMemberSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_MEMBERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_MEMBERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // create: invitation-accept was the historical opt-in; now the org-admin INVITE, SSO/SCIM\n  //   JIT, and org-auto-create-on-registration all create members in-process with explicit\n  //   `userId` + `organizationId` FKs on a request-context-less EC (stripped by the\n  //   client-shaped CREATE DTO, re-attached by `createAsSystem`).\n  // read/list: the invitee's own pending-invitation inbox reads INVITED rows cross-org\n  //   BEFORE the invitee is a scoped member — authorized by `userId`-ownership at the\n  //   entry point (`listMyPendingInvitations`/`loadOwnedPendingInvitation`), not org role.\n  // update: invitation ACCEPTANCE flips INVITED → ACTIVE in-process; the invitee is not an\n  //   org admin, so the status flip goes through the trusted system path.\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  /**\n   * Subject-export disclosure. The subject's OWN membership rows (org, roles, title) — not other members' data.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n  /**\n   * Subject erasure RETAINS this row and scrubs the person's contact and professional details.\n *\n * The membership survives because it is the tenant's record of who belonged to it and under what\n * authority; what does not survive is `userEmail` and `userTitle`, the denormalized copies of the\n * person held here so a row can be read without resolving the user.\n *\n * `roles` is deliberately NOT scrubbed. It is this application's authorization vocabulary rather than\n * personal data — the field's own comment says so — and emptying it could leave a tenant with no\n * administrator, which the administrative-continuity floors would refuse, making an erasure fail closed\n * on a tenant. Keeping it means that interaction never arises.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Erasing one of these rows revokes NO session. A membership is a record ABOUT a person's place in a\n *  tenant, not the person — their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    CoreResourceOperation.COUNT,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: OrganizationMembers_Operations,\n\n  operationsConfiguration: {\n\n    /*\n\n     * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n\n     * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n\n     * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n\n     * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n\n     * verb the impersonalize writer uses to stamp the retention markers.\n\n     */\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n\n      variants: [{\n\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n        isDefault: true,\n\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n        riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n      }],\n\n    },\n\n    [CoreResourceOperation.COUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    // CREATE is POLYMORPHIC — two intents on one op:\n    //  • INVITE (BRANCH B): the org admin supplies `userEmail` (the strict identity\n    //    anchor); the CREATE prefix find-or-creates the `User` by it (`PENDING_INVITATION`\n    //    if new) and FORCES `status: INVITED`. A single-use accept token is minted AFTER the\n    //    row is created (relatedId = the membership `_id`, STABLE across `INVITED → ACTIVE`\n    //    so the emailed link never orphans); the pipeline injects it into the invite email and\n    //    the dispatcher builds the accept link (`emailLinkPath → /invitation?token=…`, consumed\n    //    by `/auth/acceptInvitation`). No `grantedRoles`: the accept handler reads the\n    //    membership's own `roles` when it flips the row to ACTIVE.\n    //  • DIRECT-ADD (BRANCH A): the caller supplies `userId` (founder org-owner grant,\n    //    SSO-JIT, SCIM) and the row persists `ACTIVE` — there is nothing to accept.\n    // Token generation and notification dispatch share one named predicate.\n    // The INVITE branch mints one accept token and sends one post-commit email;\n    // the ACTIVE direct-add branch does neither.\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS], // Org admins, or a firm's expert lent INVITE_MEMBERS (#1631)\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // requestDto auto-derived from decorators (userEmail + roles +\n          // organizationUnitsMembership + userTitle; userId/status/invitedByUserId/\n          // invitedAt are server-injected via `.excludeFromCreate()`).\n          tokenGeneration: {\n            tokenType: CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION,\n            consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n            expiresIn: { value: 7, unit: DurationUnit.DAYS },\n            relatedIdField: '_id',\n            emailLinkPath: '/invitation',\n            // Mint the accept token for real invites only — never for an ACTIVE direct-add.\n            condition: isPendingOrganizationMemberInvitation,\n          },\n        }\n      ],\n      // Deliver the invite email to the INVITEE (`userEmail`) via the\n      // email-by-address path — the invitee may be a brand-new `PENDING_INVITATION`\n      // user with no session. Carries the `acceptUrl` (`/invitation?token=…`) built\n      // from the token minted above. `target: USER_SELF` is retained only so the\n      // derived template ref stays `…create.user-self` and the accept link routes to\n      // the main (non-admin) app.\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          recipientEmailField: 'userEmail',\n          condition: isPendingOrganizationMemberInvitation,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can read member info\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list organization members\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `userEmail` is a denormalized, immutable own-field (mirror of the linked\n          // user's email, captured at membership creation). First/last name are NOT\n          // denormalized onto the member row — they live on `USER_PROFILES` and are\n          // mutable there — so they are searched RELATIONALLY: the framework runs a\n          // secondary match on `USER_PROFILES` (its own searchable fields) and folds\n          // the matching `userId`s into an `$in` on this row's `userId`. The member\n          // query stays org-scoped, so this is tenant-safe; names are never stale\n          // because they are read live from the profile at search time. See\n          // SearchableRelationDescriptor in resources-config.shared.schemas.ts.\n          searchableFields: [\n            'userEmail',\n            {\n              localField: 'userId',\n              relatedResource: CoreResourceType.USER_PROFILES,\n              relatedJoinField: 'userId',\n              fields: ['firstName', 'lastName'],\n            },\n          ],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORGANIZATION_MEMBERS_FILTER_FIELDS,\n          sortFields: ORGANIZATION_MEMBERS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Org admins can update member details\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // requestDto auto-derived from decorators\n          //\n          // Ordinary UPDATE remains audited below the HIGH/CRITICAL floor: editing member details\n          // is MEDIUM risk for the UI, but changing roles still requires privilege evidence.\n          // The registered UPDATE implementation also emits ORGANIZATION_MEMBER_ROLE_CHANGED after\n          // a durable role change, with previous, requested and resulting roles. That specialized\n          // event complements the automatic operation event; it is not an unimplemented producer.\n          //\n          // GRANT_OWNERSHIP is a separate named role-change path. Its UPDATE-like core behavior does\n          // not inherit UPDATE's custom hooks: registration resolves the exact operation identity.\n          // Its CRITICAL risk triggers RESOURCE_OPERATION_PERFORMED automatically, with changed\n          // role sets carried by the roles field's audit-evidence marker. Queries covering ownership\n          // repair must include that operation family, not only the specialized role-change event.\n          //\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant/revocation.\n          auditableEvent: { auditBelowRiskFloor: true },\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS], // Org admins; a firm's expert lent MANAGE_RELATIONSHIP_EXPERTS, on its own relationship's experts only (#1631)\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Accepted/non-pending members use ordinary DELETE. A pending invite\n          // is cancelled through REVOKE, which atomically revokes its accept\n          // token. Keeping the vocabularies disjoint avoids making every\n          // active-member removal token-coupled.\n          enabledCondition: ({ currentObject }) =>\n            currentObject.status !== OrganizationMemberStatus.INVITED,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * The higher-tier repair door for the organization-owner floor — the second half of the\n     * industry pattern described in `.claude/rules/administrative-continuity-floors.md`.\n     *\n     * ## Why this cannot be UPDATE\n     *\n     * The floor refuses to let the last `ORG_OWNER` be removed, demoted or deactivated. That is the\n     * correct tenant-tier answer, but on its own it converts every mistake that DID strand a tenant\n     * — a direct database edit, a restore from a mid-erasure backup, an acknowledged erasure under\n     * GDPR Art. 17, a seed that authored no owner — into a permanent lockout, because\n     * `validateParentScopeAccess` denies a non-member on ORGANIZATIONS scope and there is no\n     * `APP_ADMIN_SUPER_ADMIN` bypass. Both denials are pinned in\n     * `cross-tenant-super-admin-reach.mongo.integration.test.ts`. So no tenant member can grant the\n     * role (they would need the authority they just lost) and no platform administrator can reach\n     * the row at all. GitHub solves this with an Enterprise owner one tier up; this is that tier.\n     *\n     * ## Why it is a distinct verb rather than a flag on UPDATE\n     *\n     * `admitsCrossTenantPlatformAdministration` relaxes the SCOPE check for the variant that carries\n     * it. Putting it on generic UPDATE would open every field of every membership row in every\n     * tenant to a cross-tenant caller. The whole safety argument is that the opened surface is\n     * exactly one field with one direction, so it is authored as its own operation whose custom\n     * implementation reads nothing from the payload but the justification — which it records, and\n     * never persists onto the row.\n     *\n     * ## Deliberate narrowness\n     *\n     * - **Promotes an EXISTING member** (Microsoft Loop's rule). It cannot mint a membership, so it\n     *   never creates an identity inside a tenant nobody owns.\n     * - **Additive only.** It adds the owner-conferring role; it cannot remove roles, so it can\n     *   never be used to demote and is not a second path through the floor.\n     * - **`justification` is required**, not optional. This is a break-glass action against a tenant\n     *   the operator is not a member of; the audit row is worth nothing without the why. `AC-2(7)`\n     *   asks for privileged assignment to be monitored — the trail IS the control here, since by\n     *   construction no authorization check downstream can second-guess the caller. It lands on the\n     *   `ORGANIZATION_MEMBER_ROLE_CHANGED` row the grant emits post-commit (`eventData.justification`),\n     *   beside the before/after role sets. `RESOURCE_OPERATION_PERFORMED`, which this CRITICAL verb\n     *   also emits, carries no request payload and so cannot hold it. Until #593 it was validated here\n     *   and discarded at the service boundary.\n     *\n     * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — restore administrability of a scope\n     * that has no usable administrator.\n     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of privilege grant.\n     */\n    [OrganizationMembers_Operations.GRANT_OWNERSHIP]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Platform tier only. This is the role set the operation-roles gate checks INDEPENDENTLY\n          // of the scope admission below: a caller holding this key at ORGANIZATIONS scope resolves\n          // it against the organization role table, which does not contain it, and is denied there.\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // THE cross-tenant admission. Without it the operation is unreachable by the only\n          // principal it exists for, because a platform administrator is by definition not a member\n          // of the stranded tenant.\n          admitsCrossTenantPlatformAdministration: true,\n          requestDto: z.object({\n            justification: z.string().min(1).max(1000).describe('Why a platform administrator is making this member an owner of an organization they do not belong to. Required, and recorded on the audit trail with the role change.'),\n          }),\n          // No `auditableEvent` declaration: CRITICAL is inside `AUTOMATIC_AUDIT_RISK_FLOOR`, so the\n          // event emits on the risk level alone and `auditBelowRiskFloor` would be inert here. The\n          // before/after role sets ride along because `roles` carries `.isAuditEvidence()` — which is\n          // what makes the trail answer the question that matters about this door: WHO was made an\n          // owner of a tenant, by a caller who was not in it.\n        },\n      ],\n      userNotifications: [\n        {\n          // The tenant learns that its ownership changed from outside. An operator repairing a\n          // stranded tenant is legitimate; an operator quietly granting themselves an ally inside a\n          // customer's tenant is not, and the difference is only visible to the tenant if it is told.\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n      ],\n    },\n\n    [OrganizationMembers_Operations.SUSPEND]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS], // Org admins; a firm's expert lent MANAGE_RELATIONSHIP_EXPERTS, on its own relationship's experts only (#1631)\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            suspensionReason: z.string().min(1).max(500).describe('Why the member is suspended. Recorded on the audit trail, not on the membership.'),\n            suspensionEndDate: z.date().optional().describe('When the suspension ends and the member is reactivated. Absent: suspended until someone reactivates them.'),\n          }),\n          // Implemented by the shared status-transition factory (ACTIVE → SUSPENDED, carrying\n          // `suspensionEndDate` onto the row's `scheduledReactivationAt`). SUSPEND is legal only\n          // from ACTIVE: an INVITED row has not accepted yet — cancel it with REVOKE, which also\n          // revokes the accept token — and an INACTIVE one is already out.\n          enabledCondition: ({ currentObject }) =>\n            currentObject.status === OrganizationMemberStatus.ACTIVE,\n        }\n      ],\n      userNotifications: [\n        {\n          // The suspended member. `alwaysDeliver`: a person who loses access to an organization has no\n          // other way to learn why, whatever they chose for ordinary email notifications.\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectMembershipStatusSubject,\n          alwaysDeliver: true,\n        },\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [OrganizationMembers_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Org admins only. NOT opened to MANAGE_RELATIONSHIP_EXPERTS (#1631): a suspension is the client's bar against\n          // one person, which the firm cannot lift (#1597) — a firm may suspend or remove its own expert, never undo the\n          // client's suspension of them.\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            reason: z.string().max(500).optional()\n              .describe('Why the member is being reactivated. Recorded with the audit event for the reactivation.')\n          }),\n          // Implemented by the shared status-transition factory (SUSPENDED → ACTIVE, clearing any\n          // pending `scheduledReactivationAt`). Legal only from SUSPENDED: reactivating an INVITED\n          // row would skip acceptance and grant a membership nobody agreed to. A service-provider\n          // membership lands INACTIVE instead when its relationship has ended or its person is no\n          // longer assigned (#1597, `resolveProviderMembershipReactivationStatus`).\n          enabledCondition: ({ currentObject }) =>\n            currentObject.status === OrganizationMemberStatus.SUSPENDED,\n          // MEDIUM sits below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this the RESTORE half of the\n          // pair would go untrailed while SUSPEND (CRITICAL) is recorded — a trail showing every\n          // suspension and none of the lifts, which reads as a member still suspended a year after\n          // they were reinstated. The risk level answers \"how alarming is the affordance\"; this\n          // answers \"is it evidence an auditor needs\", and for the inverse of a CRITICAL verb it is.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n        }\n      ],\n      userNotifications: [\n        {\n          // The reactivated member — reached on the scheduled sweep too, which runs with no initiator.\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectMembershipStatusSubject,\n          alwaysDeliver: true,\n          condition: isRestoredToActiveMembership,\n        },\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n          channel: CoreUserNotificationChannel.EMAIL,\n          condition: isRestoredToActiveMembership,\n        }\n      ]\n    },\n\n    // REVOKE — inviter/admin cancels a still-`INVITED` membership. The exact\n    // custom implementation DELETES the row and atomically revokes its accept\n    // token. The paired PENDING_INVITATION user is retained here and reaped by\n    // deferred hygiene only after it is old and still has no memberships:\n    // point-operation cleanup cannot predicate-lock \"zero memberships\" against\n    // a concurrent invitation insert under Mongo snapshot isolation. `reason`\n    // is captured in the audit payload, not persisted on the deleted row.\n    [OrganizationMembers_Operations.REVOKE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.DELETE,\n          requestDto: z.object({\n            reason: z.string().max(500).optional()\n              .describe('Why the invitation is being revoked. Recorded with the audit event for the removal; it is not kept on the membership, which is deleted.')\n          }),\n          tokenRevocation:\n            ORGANIZATION_MEMBER_INVITATION_TOKEN_REVOCATION,\n          // REVOKE has an exact API custom registration; `resourceOperationLike`\n          // selects DELETE persistence/DTO semantics but does not inherit the\n          // core DELETE custom implementation. Its real return is the delete\n          // envelope, declared explicitly so output validation matches runtime.\n          customResponseDto: DefaultDeleteResponseSchema,\n          // Only a still-pending invite can be revoked — an ACTIVE member is removed\n          // via DELETE, not \"revoked\". Gates the roster action (paired with the preset's\n          // `WHEN_AVAILABLE`, the button shows only on INVITED rows) AND fail-closes the\n          // backend (`services-registry-handler` throws SERVICE_RESOURCE_OPERATION_DISABLED\n          // → 403 if invoked on a non-INVITED row).\n          enabledCondition: ({ currentObject }) => currentObject.status === OrganizationMemberStatus.INVITED,\n        },\n      ],\n      // Two emails (distinct templates, disambiguated by `customNotificationRef`):\n      //  • the INVITEE (`recipientEmailField: 'userEmail'`) — \"your invitation was revoked\";\n      //  • the ADMIN/initiator (`USER_SELF`) — confirmation of the action.\n      // Both USER_SELF+EMAIL, so each MUST carry a unique `customNotificationRef`.\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          recipientEmailField: 'userEmail',\n          customNotificationRef: 'invitee',\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          customNotificationRef: 'admin',\n        }\n      ]\n    },\n\n    // RESEND — re-mint the accept token (revoking any prior one for this membership)\n    // and re-send the invite email with the fresh accept link. Only valid while the\n    // membership is `INVITED`.\n    [OrganizationMembers_Operations.RESEND]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          tokenGeneration: {\n            tokenType: CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION,\n            consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n            expiresIn: { value: 7, unit: DurationUnit.DAYS },\n            relatedIdField: '_id',\n            revokeExistingForSameRelated: true,\n            emailLinkPath: '/invitation',\n            condition: isPendingOrganizationMemberInvitation,\n          },\n          // Resend is meaningful only while the invite is pending. Same dual enforcement\n          // as REVOKE: hides the roster action on non-INVITED rows and 403s server-side.\n          enabledCondition: ({ currentObject }) => currentObject.status === OrganizationMemberStatus.INVITED,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          recipientEmailField: 'userEmail',\n          condition: isPendingOrganizationMemberInvitation,\n        }\n      ]\n    }\n  },\n});\n"]}

package/dist/esm/organizations/organization-members.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-members.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AAQjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAuNnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"organization-members.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AAQjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAuNnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/organizations/organization-members.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-members.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;OAcG;IACH,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,gGAAgG;IAChG,mDAAmD;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SAC5G,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,CAAC;IACjE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qGAAqG;IACrG,uGAAuG;IACvG,0FAA0F;IAC1F,EAAE;IACF,qGAAqG;IACrG,uGAAuG;IACvG,oGAAoG;IACpG,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE;SAChG,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EACvD,aAAa,CAAC,MAAM,CACrB;IACD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;;;;;OAQG;IACH,wFAAwF;IACxF,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,6EAA6E;IAC7E,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACpH;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;SACrC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;SACxC,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;QACpB,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,yFAAyF;QACzF,sEAAsE;QACtE,8FAA8F;QAC9F,uFAAuF;QACvF,qDAAqD;SACpD,eAAe,EAAE;IACpB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,+DAA+D;IAC/D,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,gGAAgG;IAChG,kGAAkG;IAClG,qGAAqG;IACrG,yEAAyE;IACzE,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAC5D,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpF;;;;;;;;;;;;;;OAcG;IACH,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SACvF,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC5D;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAChF,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC5D;;;;OAIG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACjH;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,QAAQ;QACpB,eAAe,EAAE,gBAAgB,CAAC,aAAa;QAC/C,gBAAgB,EAAE,QAAQ;QAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,aAAa,EAAE,WAAW;KAC3B,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC","sourcesContent":["\n/**\n * Organization Member Shared Schemas\n * \n * Junction entity between users and organizations with roles and permissions\n */\n\nimport { z } from 'zod';\n\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { forwardedLabel } from '../resources/resources.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\n\n/**\n * Organization member lifecycle status.\n *\n * A membership row IS the invitation — there is no separate invitation\n * collection. `INVITED` is the pending-membership state; acceptance flips it to\n * `ACTIVE` on the SAME row (stable `_id`, so the emailed accept-link token never\n * orphans). SSO JIT / SCIM provisioning find-or-activate an existing `INVITED`\n * row rather than blind-creating a second `ACTIVE` one.\n *\n * - `INVITED`  — membership extended, invitee has not yet accepted. Paired with a\n *   `User` in `PENDING_INVITATION` status when the invitee has no account yet.\n * - `ACTIVE`   — accepted / directly provisioned membership.\n * - `INACTIVE` — deactivated (e.g. SCIM deprovision).\n * - `SUSPENDED` — temporarily suspended (optionally time-boxed).\n *\n * Invite OUTCOMES (declined / revoked / expired) are NOT statuses — the row is\n * deleted and the event recorded in the audit trail (keeps this enum about\n * membership, not invitation bookkeeping).\n */\nexport enum OrganizationMemberStatus {\n  INVITED = 'INVITED',\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED'\n}\n\nexport const OrganizationMemberSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * FK to the member `User`. ALWAYS present on a persisted row (a membership with\n   * no member is meaningless) — even an `INVITED` invitee has an eagerly-created\n   * `User` in `PENDING_INVITATION` status, so this FK is never null.\n   *\n   * SERVER-INJECTED on create (`.excludeFromCreate()`), via one of two paths:\n   *   - Invite (org-admin CREATE): the admin supplies {@link userEmail} instead;\n   *     the CREATE prefix find-or-creates the user by normalized email and injects\n   *     the resolved `_id` here (email is the strict unique identity anchor — see\n   *     `User.email.isUnique()`).\n   *   - System provisioning (invite-acceptance / SSO JIT / SCIM): passes `userId`\n   *     directly through `createAsSystem`, which re-attaches this context FK past\n   *     the strict-DTO strip.\n   * `.excludeFromUpdate()` keeps the member↔user binding immutable.\n   */\n  // `labelFallbackField` names the readable copy this row already carries, for when the reference\n  // cannot be resolved. `userEmail` below is `.isHidden({ display: true })` on the stated grounds\n  // that \"the user-facing email is surfaced by resolving the `userId` reference\" — and for an\n  // INVITED person that resolution has nothing to build a label from, because there is no\n  // `USER_PROFILE` yet. Measured 2026-09-19 on the member directory: three of four rows rendered\n  // `6aaba6b3a2d3b6b0ad61f33e`, the fourth (a real user) rendered their name. The copy was on the\n  // row the whole time; nothing was reaching for it.\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate()\n    .foreignKeyUI({ display: { labelFallbackField: 'userEmail' } }),\n  /**\n   * The linked user's email — DUAL ROLE:\n   *\n   *   1. INVITE CREATE INPUT. On the org-admin invite CREATE the admin supplies\n   *      an email (not a `userId`); the CREATE prefix normalizes it, find-or-creates\n   *      the `User` by it (unique identity anchor), and derives {@link userId}. This\n   *      is why the field is client-writable on CREATE (no `.excludeFromCreate()`).\n   *   2. DENORMALIZED IMMUTABLE COPY. After creation it is the immutable mirror of\n   *      `USERS.email` (which is `.excludeFromUpdate()`, so this copy never drifts).\n   *      It feeds member SEARCH (`searchableFields: ['userEmail']` — no async hop)\n   *      and the {@link instanceLabel} fallback when the related profile/name is\n   *      unavailable (e.g. a `PENDING_INVITATION` invitee has no `USER_PROFILE` yet).\n   *\n   * For system creates (SSO/SCIM/acceptance) that pass `userId` instead of an\n   * email, the CREATE prefix DERIVES this value from the authoritative user record,\n   * so it is `.optional()` at the input boundary. `.excludeFromUpdate()` keeps it\n   * immutable post-creation. `.isHidden({ display: true })` keeps it out of\n   * auto-rendered display cards/columns (the user-facing email is surfaced by\n   * resolving the `userId` reference) — it still renders on the CREATE form.\n   */\n  // REMOVE on erasure. A denormalized copy of the person's email, held here so a membership row can be\n  // read without resolving the user — which is exactly what makes it personal data this row HOLDS rather\n  // than a link it carries. Clearable (`.optional()`), so REMOVE resolves to a removed key.\n  //\n  // `roles` beside it is deliberately NOT scrubbed: it is this application's authorization vocabulary,\n  // not personal data, and emptying it could strand a tenant with no administrator — the interaction the\n  // administrative-continuity floors exist to refuse. Keeping it means that interaction never arises.\n  userEmail: addImpersonalizeWith(\n    z.email().optional().isDBIndexed().isSummaryField().isHidden({ display: true }).excludeFromUpdate()\n      .dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.REMOVE,\n  ),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /*\n   * `organizationUnitsMembership` (an embedded `[{ organizationUnitId, role }]` array) was REMOVED\n   * here on 2026-07-31 and promoted to the `ORGANIZATION_UNIT_MEMBERS` junction resource\n   * (plan decision D-B5). The array could not be queried portably — a dot-path filter into an\n   * array field resolves to NULL on PostgreSQL and the LIST summary projection strips the field —\n   * so every \"who is assigned to this unit?\" question failed OPEN, it could not carry a registered\n   * relationship (no cascade), and it admitted two conflicting roles for the same unit. Read unit\n   * assignments through `ORGANIZATION_UNIT_MEMBERS` filtered by `organizationMemberId`.\n   */\n  // `.isAuditEvidence()` — this member's authority INSIDE the organization. Roles are the\n  // framework's single authorization axis, so a change here is an access-control decision and the\n  // before/after sets ARE the evidence: a trail that records only \"roles changed\" proves nothing\n  // about what authority resulted. Safe to record in full — a role name is vocabulary, not personal\n  // data, so it carries no erasure obligation into the immutable audit ledger.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  roles: z.array(OrgRolesSchema).default([CORE_ORG_ROLES.ORG_MEMBER]).isDBIndexed().isSummaryField().isAuditEvidence(),\n  /**\n   * Server-owned lifecycle state. Default `ACTIVE` covers direct/system\n   * provisioning (SSO JIT / SCIM / self-registration org-owner grant), while\n   * the org-admin invite CREATE prefix forces `INVITED`.\n   *\n   * Neither CREATE nor generic UPDATE may accept this field from a client:\n   * lifecycle transitions carry security side effects that a field update\n   * cannot reproduce. In particular, invitation acceptance must validate and\n   * consume the invitation token, grant the derived user type, and serialize\n   * against revocation; suspension/reactivation likewise have dedicated\n   * operations. Keeping status out of both DTOs makes those trusted transition\n   * operations the only way to change it.\n   */\n  status: z.enum(OrganizationMemberStatus)\n    .default(OrganizationMemberStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    // Lifecycle state gates access as surely as roles do — a SUSPENDED member is denied, an ACTIVE\n    // one is not — so a suspension or reactivation is an authorization event and its before/after\n    // values are the evidence. The enum's values are closed vocabulary, never personal data, so\n    // recording them carries no GDPR Art. 17 obligation into the immutable ledger — the same\n    // reasoning `UserSchema.status` records. Without this the framework's\n    // `RESOURCE_OPERATION_PERFORMED` event notes only that `status` was among the changed fields,\n    // never what it changed FROM or TO, which is the half an access review actually reads.\n    // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n    .isAuditEvidence(),\n  /**\n   * When an automated sweep must return this membership to `ACTIVE`.\n   *\n   * Set by SUSPEND when the caller time-boxes the suspension (`suspensionEndDate` in that verb's\n   * request contract), cleared by REACTIVATE. Absent means the suspension is indefinite and only a\n   * deliberate REACTIVATE lifts it — which is the default, since an unbounded suspension is the\n   * safer reading of \"suspend\".\n   *\n   * NAMED FOR THE EFFECT, NOT THE CAUSE. `scheduledReactivationAt` says what the system will do;\n   * a `suspensionEndsAt` would describe only the suspension branch while the identical field on\n   * `USERS` also serves self-service deactivation. One concept, one name across both resources,\n   * so the reactivation sweep reads the same field everywhere. The request contracts keep their\n   * own caller-facing vocabulary and the transition hook translates — the same split\n   * `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in, `parentUnitId` + `path` persisted).\n   *\n   * Server-owned on both sides (`.excludeFromCreate().excludeFromUpdate()`): only the transition\n   * operations write it, exactly as for {@link status} above. Indexed because the sweep's whole\n   * query is \"rows whose scheduled reactivation has passed\".\n   *\n   * ⚠️ A value here is a PROMISE the framework keeps: the reactivation batch is what makes it\n   * true. Persisting the date without that sweep would be the same defect as a verb that answers\n   * success and writes nothing — an authored intention nothing honors.\n   */\n  // Deliberately NOT `.isAuditEvidence()`. The rationale that briefly sat here — \"lifecycle state\n  // gates access as surely as roles do\" — is true of {@link status}, which is where it now lives.\n  // This field decides nothing about what the principal may do; it is a scheduling detail, and the\n  // transition's audit row already records the resulting status.\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  // The person's role in the customer's organization — their working life, not this application's\n  // authorization model (`roles` is that, and it is a closed vocabulary rather than personal data).\n  // REMOVE on erasure — the person's role in the customer's organization is a fact about their working\n  // life, which is why it carries PROFESSIONAL. Clearable (`.optional()`).\n  userTitle: addImpersonalizeWith(\n    z.string().max(100).optional().isDBIndexed().isSummaryField()\n    .dataCategories(PersonalDataCategory.PROFESSIONAL),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * The `User._id` of the org admin who issued the invite. Server-set by the invite\n   * CREATE prefix from the execution-context actor; absent on direct/system\n   * provisioning. Immutable. Feeds the audit trail and the user-facing \"invited by\"\n   * cue in the pending-invitations inbox.\n   *\n   * PROVENANCE STAMP, NOT a navigable FK — deliberately a plain indexed string (same\n   * idiom as `scim-tokens.createdByUserId`), NOT `.isForeignKey()`. The primary\n   * member↔user link is `userId` (registered M2M relationship); adding `.isForeignKey()`\n   * here would demand a SECOND `ORGANIZATION_MEMBERS → USERS` relationship (else the\n   * registry warns \"cannot be resolved to a resource type\") and would graft nested-route /\n   * parent-scope machinery onto a field that only records who clicked \"invite\". Resolve\n   * the inviter's display name with a bounded lookup at render time if the cue needs it.\n   */\n  invitedByUserId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * When the invite was issued. Server-set by the invite CREATE prefix; absent on\n   * direct/system provisioning. Immutable. Used by the inbox ordering and the\n   * expiry-reap CRON batch.\n   */\n  invitedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * Present ⇒ this is a PROVIDER membership: held by an expert of a service firm through the client\n   * organization's `SERVICE_PROVIDER_RELATIONSHIPS` row with this id, not by one of the organization's\n   * own members (#1597). Test it with `isServiceProviderMembership`, never by hand.\n   *\n   * It changes what the row means everywhere the framework reads memberships: it confers authority ONLY\n   * while the relationship passes the execution-context live filter; its `roles` are owned by the\n   * relationship (generic UPDATE refuses them); it never counts toward the owner floor and cannot receive\n   * ownership; it grants no user type; it is not part of the client's SCIM directory.\n   *\n   * System-written only — by the firm's assignment verb, which also re-points it when a row left by an\n   * earlier relationship is reactivated. Indexed: \"who serves under this relationship\" is a query by it.\n   * Not a foreign key edge on purpose: the live filter reads the relationship by id, and a navigable edge\n   * would add nested routes onto a membership nobody needs to reach that way.\n   */\n  serviceProviderRelationshipId: z.string().min(1).optional().isDBIndexed().isSummaryField()\n    .excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The firm whose expert holds this provider membership. A plain id: it names another tenant. The live\n   * filter requires the member to hold an ACTIVE, ordinary membership there, in an organization that\n   * still confers authority.\n   */\n  providerOrganizationId: z.string().min(1).optional().isDBIndexed().isSummaryField()\n    .excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The firm's name as its relationship recorded it — what a client's directory shows as \"via {Firm}\".\n   * A snapshot copied from the relationship at assignment, because a client can never read the firm's\n   * organization row (#1597).\n   */\n  providerOrganizationName: z.string().max(200).optional().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * Computed instance label — the linked user's name, forwarded live from\n   * `USER_PROFILES`. A junction row has no inherent name; its identity is the\n   * related party. {@link forwardedLabel} resolves it SERVER-SIDE at read time\n   * (joining `userId` → `USER_PROFILES.userId`, rendering `firstName lastName`)\n   * and projects it onto the summary/read DTO via the virtual-field pipeline, so\n   * the frontend label is a plain field ref (`getFrontendResourceLabel:\n   * ['instanceLabel']`). Never stale (read live), never denormalized, tenant-safe\n   * (a bounded system read over the userIds already on the org-scoped page). NOT\n   * persisted (virtual). When the profile/name is unavailable it falls back to the\n   * immutable {@link userEmail} (`fallbackField`) rather than a raw id.\n   */\n  instanceLabel: forwardedLabel({\n    localField: 'userId',\n    relatedResource: CoreResourceType.USER_PROFILES,\n    relatedJoinField: 'userId',\n    fields: ['firstName', 'lastName'],\n    fallbackField: 'userEmail',\n  }),\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'userId',\n  'organizationId',\n]);\nexport type OrganizationMember = z.infer<typeof OrganizationMemberSchema>;\n"]}
+{"version":3,"file":"organization-members.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-members.shared.schemas.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;OAcG;IACH,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,gGAAgG;IAChG,mDAAmD;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SAC5G,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,CAAC;IACjE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qGAAqG;IACrG,uGAAuG;IACvG,0FAA0F;IAC1F,EAAE;IACF,qGAAqG;IACrG,uGAAuG;IACvG,oGAAoG;IACpG,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE;SAChG,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC,EACvD,aAAa,CAAC,MAAM,CACrB;IACD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;;;;;OAQG;IACH,wFAAwF;IACxF,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,6EAA6E;IAC7E,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACpH;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;SACrC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;SACxC,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;QACpB,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,yFAAyF;QACzF,sEAAsE;QACtE,8FAA8F;QAC9F,uFAAuF;QACvF,qDAAqD;SACpD,eAAe,EAAE;IACpB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,+DAA+D;IAC/D,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,gGAAgG;IAChG,kGAAkG;IAClG,qGAAqG;IACrG,yEAAyE;IACzE,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAC5D,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpF;;;;;;;;;;;;;;OAcG;IACH,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SACvF,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC5D;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;SAChF,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC5D;;;;OAIG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACjH;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,cAAc,CAAC;QAC5B,UAAU,EAAE,QAAQ;QACpB,eAAe,EAAE,gBAAgB,CAAC,aAAa;QAC/C,gBAAgB,EAAE,QAAQ;QAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,aAAa,EAAE,WAAW;KAC3B,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC/G,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC","sourcesContent":["\n/**\n * Organization Member Shared Schemas\n * \n * Junction entity between users and organizations with roles and permissions\n */\n\nimport { z } from 'zod';\n\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { forwardedLabel } from '../resources/resources.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\n\n/**\n * Organization member lifecycle status.\n *\n * A membership row IS the invitation — there is no separate invitation\n * collection. `INVITED` is the pending-membership state; acceptance flips it to\n * `ACTIVE` on the SAME row (stable `_id`, so the emailed accept-link token never\n * orphans). SSO JIT / SCIM provisioning find-or-activate an existing `INVITED`\n * row rather than blind-creating a second `ACTIVE` one.\n *\n * - `INVITED`  — membership extended, invitee has not yet accepted. Paired with a\n *   `User` in `PENDING_INVITATION` status when the invitee has no account yet.\n * - `ACTIVE`   — accepted / directly provisioned membership.\n * - `INACTIVE` — deactivated (e.g. SCIM deprovision).\n * - `SUSPENDED` — temporarily suspended (optionally time-boxed).\n *\n * Invite OUTCOMES (declined / revoked / expired) are NOT statuses — the row is\n * deleted and the event recorded in the audit trail (keeps this enum about\n * membership, not invitation bookkeeping).\n */\nexport enum OrganizationMemberStatus {\n  INVITED = 'INVITED',\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED'\n}\n\nexport const OrganizationMemberSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * FK to the member `User`. ALWAYS present on a persisted row (a membership with\n   * no member is meaningless) — even an `INVITED` invitee has an eagerly-created\n   * `User` in `PENDING_INVITATION` status, so this FK is never null.\n   *\n   * SERVER-INJECTED on create (`.excludeFromCreate()`), via one of two paths:\n   *   - Invite (org-admin CREATE): the admin supplies {@link userEmail} instead;\n   *     the CREATE prefix find-or-creates the user by normalized email and injects\n   *     the resolved `_id` here (email is the strict unique identity anchor — see\n   *     `User.email.isUnique()`).\n   *   - System provisioning (invite-acceptance / SSO JIT / SCIM): passes `userId`\n   *     directly through `createAsSystem`, which re-attaches this context FK past\n   *     the strict-DTO strip.\n   * `.excludeFromUpdate()` keeps the member↔user binding immutable.\n   */\n  // `labelFallbackField` names the readable copy this row already carries, for when the reference\n  // cannot be resolved. `userEmail` below is `.isHidden({ display: true })` on the stated grounds\n  // that \"the user-facing email is surfaced by resolving the `userId` reference\" — and for an\n  // INVITED person that resolution has nothing to build a label from, because there is no\n  // `USER_PROFILE` yet. Measured 2026-09-19 on the member directory: three of four rows rendered\n  // `6aaba6b3a2d3b6b0ad61f33e`, the fourth (a real user) rendered their name. The copy was on the\n  // row the whole time; nothing was reaching for it.\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate()\n    .foreignKeyUI({ display: { labelFallbackField: 'userEmail' } }),\n  /**\n   * The linked user's email — DUAL ROLE:\n   *\n   *   1. INVITE CREATE INPUT. On the org-admin invite CREATE the admin supplies\n   *      an email (not a `userId`); the CREATE prefix normalizes it, find-or-creates\n   *      the `User` by it (unique identity anchor), and derives {@link userId}. This\n   *      is why the field is client-writable on CREATE (no `.excludeFromCreate()`).\n   *   2. DENORMALIZED IMMUTABLE COPY. After creation it is the immutable mirror of\n   *      `USERS.email` (which is `.excludeFromUpdate()`, so this copy never drifts).\n   *      It feeds member SEARCH (`searchableFields: ['userEmail']` — no async hop)\n   *      and the {@link instanceLabel} fallback when the related profile/name is\n   *      unavailable (e.g. a `PENDING_INVITATION` invitee has no `USER_PROFILE` yet).\n   *\n   * For system creates (SSO/SCIM/acceptance) that pass `userId` instead of an\n   * email, the CREATE prefix DERIVES this value from the authoritative user record,\n   * so it is `.optional()` at the input boundary. `.excludeFromUpdate()` keeps it\n   * immutable post-creation. `.isHidden({ display: true })` keeps it out of\n   * auto-rendered display cards/columns (the user-facing email is surfaced by\n   * resolving the `userId` reference) — it still renders on the CREATE form.\n   */\n  // REMOVE on erasure. A denormalized copy of the person's email, held here so a membership row can be\n  // read without resolving the user — which is exactly what makes it personal data this row HOLDS rather\n  // than a link it carries. Clearable (`.optional()`), so REMOVE resolves to a removed key.\n  //\n  // `roles` beside it is deliberately NOT scrubbed: it is this application's authorization vocabulary,\n  // not personal data, and emptying it could strand a tenant with no administrator — the interaction the\n  // administrative-continuity floors exist to refuse. Keeping it means that interaction never arises.\n  userEmail: addImpersonalizeWith(\n    z.email().optional().isDBIndexed().isSummaryField().isHidden({ display: true }).excludeFromUpdate()\n      .dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.REMOVE,\n  ),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  /*\n   * `organizationUnitsMembership` (an embedded `[{ organizationUnitId, role }]` array) was REMOVED\n   * here on 2026-07-31 and promoted to the `ORGANIZATION_UNIT_MEMBERS` junction resource\n   * (plan decision D-B5). The array could not be queried portably — a dot-path filter into an\n   * array field resolves to NULL on PostgreSQL and the LIST summary projection strips the field —\n   * so every \"who is assigned to this unit?\" question failed OPEN, it could not carry a registered\n   * relationship (no cascade), and it admitted two conflicting roles for the same unit. Read unit\n   * assignments through `ORGANIZATION_UNIT_MEMBERS` filtered by `organizationMemberId`.\n   */\n  // `.isAuditEvidence()` — this member's authority INSIDE the organization. Roles are the\n  // framework's single authorization axis, so a change here is an access-control decision and the\n  // before/after sets ARE the evidence: a trail that records only \"roles changed\" proves nothing\n  // about what authority resulted. Safe to record in full — a role name is vocabulary, not personal\n  // data, so it carries no erasure obligation into the immutable audit ledger.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  roles: z.array(OrgRolesSchema).default([CORE_ORG_ROLES.ORG_MEMBER]).isDBIndexed().isSummaryField().isAuditEvidence(),\n  /**\n   * Server-owned lifecycle state. Default `ACTIVE` covers direct/system\n   * provisioning (SSO JIT / SCIM / self-registration org-owner grant), while\n   * the org-admin invite CREATE prefix forces `INVITED`.\n   *\n   * Neither CREATE nor generic UPDATE may accept this field from a client:\n   * lifecycle transitions carry security side effects that a field update\n   * cannot reproduce. In particular, invitation acceptance must validate and\n   * consume the invitation token, grant the derived user type, and serialize\n   * against revocation; suspension/reactivation likewise have dedicated\n   * operations. Keeping status out of both DTOs makes those trusted transition\n   * operations the only way to change it.\n   */\n  status: z.enum(OrganizationMemberStatus)\n    .default(OrganizationMemberStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    // Lifecycle state gates access as surely as roles do — a SUSPENDED member is denied, an ACTIVE\n    // one is not — so a suspension or reactivation is an authorization event and its before/after\n    // values are the evidence. The enum's values are closed vocabulary, never personal data, so\n    // recording them carries no GDPR Art. 17 obligation into the immutable ledger — the same\n    // reasoning `UserSchema.status` records. Without this the framework's\n    // `RESOURCE_OPERATION_PERFORMED` event notes only that `status` was among the changed fields,\n    // never what it changed FROM or TO, which is the half an access review actually reads.\n    // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n    .isAuditEvidence(),\n  /**\n   * When an automated sweep must return this membership to `ACTIVE`.\n   *\n   * Set by SUSPEND when the caller time-boxes the suspension (`suspensionEndDate` in that verb's\n   * request contract), cleared by REACTIVATE. Absent means the suspension is indefinite and only a\n   * deliberate REACTIVATE lifts it — which is the default, since an unbounded suspension is the\n   * safer reading of \"suspend\".\n   *\n   * NAMED FOR THE EFFECT, NOT THE CAUSE. `scheduledReactivationAt` says what the system will do;\n   * a `suspensionEndsAt` would describe only the suspension branch while the identical field on\n   * `USERS` also serves self-service deactivation. One concept, one name across both resources,\n   * so the reactivation sweep reads the same field everywhere. The request contracts keep their\n   * own caller-facing vocabulary and the transition hook translates — the same split\n   * `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in, `parentUnitId` + `path` persisted).\n   *\n   * Server-owned on both sides (`.excludeFromCreate().excludeFromUpdate()`): only the transition\n   * operations write it, exactly as for {@link status} above. Indexed because the sweep's whole\n   * query is \"rows whose scheduled reactivation has passed\".\n   *\n   * ⚠️ A value here is a PROMISE the framework keeps: the reactivation batch is what makes it\n   * true. Persisting the date without that sweep would be the same defect as a verb that answers\n   * success and writes nothing — an authored intention nothing honors.\n   */\n  // Deliberately NOT `.isAuditEvidence()`. The rationale that briefly sat here — \"lifecycle state\n  // gates access as surely as roles do\" — is true of {@link status}, which is where it now lives.\n  // This field decides nothing about what the principal may do; it is a scheduling detail, and the\n  // transition's audit row already records the resulting status.\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  // The person's role in the customer's organization — their working life, not this application's\n  // authorization model (`roles` is that, and it is a closed vocabulary rather than personal data).\n  // REMOVE on erasure — the person's role in the customer's organization is a fact about their working\n  // life, which is why it carries PROFESSIONAL. Clearable (`.optional()`).\n  userTitle: addImpersonalizeWith(\n    z.string().max(100).optional().isDBIndexed().isSummaryField()\n    .dataCategories(PersonalDataCategory.PROFESSIONAL),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * The `User._id` of the org admin who issued the invite. Server-set by the invite\n   * CREATE prefix from the execution-context actor; absent on direct/system\n   * provisioning. Immutable. Feeds the audit trail and the user-facing \"invited by\"\n   * cue in the pending-invitations inbox.\n   *\n   * PROVENANCE STAMP, NOT a navigable FK — deliberately a plain indexed string (same\n   * idiom as `scim-tokens.createdByUserId`), NOT `.isForeignKey()`. The primary\n   * member↔user link is `userId` (registered M2M relationship); adding `.isForeignKey()`\n   * here would demand a SECOND `ORGANIZATION_MEMBERS → USERS` relationship (else the\n   * registry warns \"cannot be resolved to a resource type\") and would graft nested-route /\n   * parent-scope machinery onto a field that only records who clicked \"invite\". Resolve\n   * the inviter's display name with a bounded lookup at render time if the cue needs it.\n   */\n  invitedByUserId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * When the invite was issued. Server-set by the invite CREATE prefix; absent on\n   * direct/system provisioning. Immutable. Used by the inbox ordering and the\n   * expiry-reap CRON batch.\n   */\n  invitedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * Present ⇒ this is a PROVIDER membership: held by an expert of a service firm through the client\n   * organization's `SERVICE_PROVIDER_RELATIONSHIPS` row with this id, not by one of the organization's\n   * own members (#1597). Test it with `isServiceProviderMembership`, never by hand.\n   *\n   * It changes what the row means everywhere the framework reads memberships: it confers authority ONLY\n   * while the relationship passes the execution-context live filter; its `roles` are owned by the\n   * relationship (generic UPDATE refuses them); it never counts toward the owner floor and cannot receive\n   * ownership; it grants no user type; it is not part of the client's SCIM directory.\n   *\n   * System-written only — by the firm's assignment verb, which also re-points it when a row left by an\n   * earlier relationship is reactivated. Indexed: \"who serves under this relationship\" is a query by it.\n   * Not a foreign key edge on purpose: the live filter reads the relationship by id, and a navigable edge\n   * would add nested routes onto a membership nobody needs to reach that way.\n   */\n  serviceProviderRelationshipId: z.string().min(1).optional().isDBIndexed().isSummaryField()\n    .excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The firm whose expert holds this provider membership. A plain id: it names another tenant. The live\n   * filter requires the member to hold an ACTIVE, ordinary membership there, in an organization that\n   * still confers authority.\n   */\n  providerOrganizationId: z.string().min(1).optional().isDBIndexed().isSummaryField()\n    .excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The firm's name as its relationship recorded it — what a client's directory shows as \"via {Firm}\".\n   * A snapshot copied from the relationship at assignment, because a client can never read the firm's\n   * organization row (#1597).\n   */\n  providerOrganizationName: z.string().max(200).optional().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  /**\n   * Computed instance label — the linked user's name, forwarded live from\n   * `USER_PROFILES`. A junction row has no inherent name; its identity is the\n   * related party. {@link forwardedLabel} resolves it SERVER-SIDE at read time\n   * (joining `userId` → `USER_PROFILES.userId`, rendering `firstName lastName`)\n   * and projects it onto the summary/read DTO via the virtual-field pipeline, so\n   * the frontend label is a plain field ref (`getFrontendResourceLabel:\n   * ['instanceLabel']`). Never stale (read live), never denormalized, tenant-safe\n   * (a bounded system read over the userIds already on the org-scoped page). NOT\n   * persisted (virtual). When the profile/name is unavailable it falls back to the\n   * immutable {@link userEmail} (`fallbackField`) rather than a raw id.\n   */\n  instanceLabel: forwardedLabel({\n    localField: 'userId',\n    relatedResource: CoreResourceType.USER_PROFILES,\n    relatedJoinField: 'userId',\n    fields: ['firstName', 'lastName'],\n    fallbackField: 'userEmail',\n  }),\n  createdAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'userId',\n  'organizationId',\n]);\nexport type OrganizationMember = z.infer<typeof OrganizationMemberSchema>;\n"]}

package/dist/esm/organizations/organization-notifications.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS/H,KAAK,uCAAuC,GACxC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,oEAAoE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAmGjI,CAAC"}
+{"version":3,"file":"organization-notifications.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS/H,KAAK,uCAAuC,GACxC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,oEAAoE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAmGjI,CAAC"}

package/dist/esm/organizations/organization-notifications.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF;;EAEE;AACF,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIhL;IACA,UAAU,EAAE,+BAA+B;IAC3C,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,iBAAiB;IACjB,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,0EAA0E;QAC1E,0EAA0E;QAC1E,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,qEAAqE;oBACrE,qEAAqE;oBACrE,yEAAyE;oBACzE,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;oBACrE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Notifications Shared Resource Configuration\n *\n * Resource configuration for organization notification preferences.\n * App-focused management for notification settings and preferences.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationNotificationsSchema\n} from './organization-notifications.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\ntype OrganizationNotificationsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Notifications Resource Configuration Factory\n*/\nexport const organizationNotificationsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  OrganizationNotificationsCoreOperations,\n  typeof OrganizationNotificationsSchema\n>({\n  mainSchema: OrganizationNotificationsSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_NOTIFICATIONS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_NOTIFICATIONS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_NOTIFICATIONS\n  // relationship declares `onParentCreate.enabled`, so a default notifications\n  // row (its `emailNotifications` block materialized to interior defaults) is\n  // written via `createAsSystem` on organization creation (fixes the latent\n  // missing-row gap — org notifications were never hand-seeded). Guard-1 is\n  // fail-closed by omission, so the system seed requires this explicit CREATE\n  // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the\n  // seed resolves.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a notifications row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls\n          // `createAsSystem`, which resolves the default CREATE op through the\n          // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts\n          // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE\n          // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is\n          // swallowed (silent missing row). INTERNAL_CALL is the service-layer\n          // internal transport (no HTTP route) — the correct tier for a system seed.\n          // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the\n          // repository tier, which is variant-agnostic. See composition-oncreate plan.)\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    }\n  },\n});\n"]}
+{"version":3,"file":"organization-notifications.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACxH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF;;EAEE;AACF,MAAM,CAAC,MAAM,oEAAoE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIhL;IACA,UAAU,EAAE,+BAA+B;IAC3C,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,iBAAiB;IACjB,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,6EAA6E;QAC7E,0EAA0E;QAC1E,0EAA0E;QAC1E,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,qEAAqE;oBACrE,qEAAqE;oBACrE,yEAAyE;oBACzE,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;oBACrE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Notifications Shared Resource Configuration\n *\n * Resource configuration for organization notification preferences.\n * App-focused management for notification settings and preferences.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationNotificationsSchema\n} from './organization-notifications.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\ntype OrganizationNotificationsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Notifications Resource Configuration Factory\n*/\nexport const organizationNotificationsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  OrganizationNotificationsCoreOperations,\n  typeof OrganizationNotificationsSchema\n>({\n  mainSchema: OrganizationNotificationsSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_NOTIFICATIONS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_NOTIFICATIONS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_NOTIFICATIONS\n  // relationship declares `onParentCreate.enabled`, so a default notifications\n  // row (its `emailNotifications` block materialized to interior defaults) is\n  // written via `createAsSystem` on organization creation (fixes the latent\n  // missing-row gap — org notifications were never hand-seeded). Guard-1 is\n  // fail-closed by omission, so the system seed requires this explicit CREATE\n  // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the\n  // seed resolves.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a notifications row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls\n          // `createAsSystem`, which resolves the default CREATE op through the\n          // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts\n          // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE\n          // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is\n          // swallowed (silent missing row). INTERNAL_CALL is the service-layer\n          // internal transport (no HTTP route) — the correct tier for a system seed.\n          // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the\n          // repository tier, which is variant-agnostic. See composition-oncreate plan.)\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded notifications row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    }\n  },\n});\n"]}

package/dist/esm/organizations/organization-notifications.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAiC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;iBAoB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}
+{"version":3,"file":"organization-notifications.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAiC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;iBAoB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/esm/organizations/organization-notifications.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-notifications.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,4WAA4W,CAAC;IACjb,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kQAAkQ,CAAC;IACjT,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gJAAgJ,CAAC;IAChM,qBAAqB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sJAAsJ,CAAC;IAC5M,sBAAsB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uJAAuJ,CAAC;IAE9M;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iMAAiM,CAAC;IAC9O,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,+MAA+M,CAAC;IACnQ,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mMAAmM,CAAC;IACjP,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iNAAiN,CAAC;CACvQ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,eAAe;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE9G,6FAA6F;IAC7F,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,kDAAkD;IAClD,kBAAkB,EAAE,oCAAoC;SACrD,OAAO,CAAC,oCAAoC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvD,cAAc,EAAE;IAEnB,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["/**\n * Organization Notifications Shared Schemas\n * \n * Notification preferences and settings.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\n\n/**\n * Per-category notification routing block for an organization.\n *\n * Every interior field is optional (the routing addresses) or carries a\n * `.default(...)` (the category opt-in booleans), so the object is fully\n * materializable from `{}`. Extracted as a named schema so\n * {@link OrganizationNotificationsSchema} can default it via the Zod-4-safe\n * `Schema.default(Schema.parse({}))` idiom — see the `emailNotifications` field.\n */\nexport const OrganizationEmailNotificationsSchema = z.object({\n  /**\n   * Where a tenant's organization-flavoured email goes, and whether it goes at all. READ by the\n   * notification dispatcher since 2026-09-08 (#410).\n   *\n   * It was read by NOTHING before that. The record was seeded by apps-manager at provisioning,\n   * rendered and edited through the organizations preset and audited, while organization-targeted\n   * notifications resolved to member user ids by role and went to each member's own address — so a\n   * tenant that filled this screen in changed nothing.\n   *\n   * The category a notification belongs to is DERIVED from its target: the notification-target\n   * vocabulary and these four categories line up one-for-one, so a per-notification declaration\n   * would only be a place for the two to disagree. `ORGANIZATION_USERS` is deliberately outside the\n   * mapping — it fans out to every member by design, and routing it to one address would change who\n   * the message is FOR rather than where it lands.\n   *\n   * An address REPLACES the member fan-out rather than adding to it: a tenant routing security mail\n   * to a SOC address is saying where it goes, not asking for a copy.\n   */\n  defaultEmailAddress: z.email().optional().isSummaryField().describe(\"Email address that receives the notification emails addressed to the organization itself, and those of a category (billing, security, administrative, user management) that has no address of its own. When set, these emails go to this address instead of to the members who would otherwise receive them. Emails meant for every member are always sent to each member.\"),\n  billingAddress: z.email().optional().describe(\"Email address that receives the organization's billing notification emails instead of its members; when unset, `defaultEmailAddress` is used. It is also given to the payment provider as the customer email when the organization's billing account is created.\"),\n  securityAddress: z.email().optional().describe(\"Email address that receives the organization's security notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n  administrativeAddress: z.email().optional().describe(\"Email address that receives the organization's administrative notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n  usersManagementAddress: z.email().optional().describe(\"Email address that receives the organization's user-management notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n\n  /**\n   * Category opt-ins. A `false` SUPPRESSES that category entirely — for the members too, not only\n   * for the routing address — because a tenant turning billing notifications off means it.\n   */\n  billing: z.boolean().default(true).describe(\"When false, the organization's billing notification emails are not sent at all, neither to `billingAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  administrative: z.boolean().default(true).describe(\"When false, the organization's administrative notification emails are not sent at all, neither to `administrativeAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  security: z.boolean().default(true).describe(\"When false, the organization's security notification emails are not sent at all, neither to `securityAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  usersManagement: z.boolean().default(true).describe(\"When false, the organization's user-management notification emails are not sent at all, neither to `usersManagementAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n});\nexport type OrganizationEmailNotifications = z.infer<typeof OrganizationEmailNotificationsSchema>;\n\nexport const OrganizationNotificationsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` = idempotency backstop for onParentCreate seeding: the eager\n  // `createAsSystem` seed on ORGANIZATIONS create writes one notifications row per\n  // org; the unique index makes a re-fire (retry / replay) fail-closed instead of\n  // duplicating.\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  // Email notification preferences. `.default(OrganizationEmailNotificationsSchema.parse({}))`\n  // makes the block materialize to its interior defaults when omitted, so the\n  // resource is default-seedable from its CREATE DTO + parent FK alone (required\n  // by the onParentCreate lifecycle guard). The output type keeps the block\n  // required, so downstream readers are unaffected.\n  emailNotifications: OrganizationEmailNotificationsSchema\n    .default(OrganizationEmailNotificationsSchema.parse({}))\n    .isSummaryField(),\n\n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationNotifications = z.infer<typeof OrganizationNotificationsSchema>;\n\n"]}
+{"version":3,"file":"organization-notifications.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-notifications.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,4WAA4W,CAAC;IACjb,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kQAAkQ,CAAC;IACjT,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gJAAgJ,CAAC;IAChM,qBAAqB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sJAAsJ,CAAC;IAC5M,sBAAsB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uJAAuJ,CAAC;IAE9M;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iMAAiM,CAAC;IAC9O,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,+MAA+M,CAAC;IACnQ,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mMAAmM,CAAC;IACjP,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iNAAiN,CAAC;CACvQ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,iFAAiF;IACjF,gFAAgF;IAChF,eAAe;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE9G,6FAA6F;IAC7F,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,kDAAkD;IAClD,kBAAkB,EAAE,oCAAoC;SACrD,OAAO,CAAC,oCAAoC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvD,cAAc,EAAE;IAEnB,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["/**\n * Organization Notifications Shared Schemas\n * \n * Notification preferences and settings.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\n\n/**\n * Per-category notification routing block for an organization.\n *\n * Every interior field is optional (the routing addresses) or carries a\n * `.default(...)` (the category opt-in booleans), so the object is fully\n * materializable from `{}`. Extracted as a named schema so\n * {@link OrganizationNotificationsSchema} can default it via the Zod-4-safe\n * `Schema.default(Schema.parse({}))` idiom — see the `emailNotifications` field.\n */\nexport const OrganizationEmailNotificationsSchema = z.object({\n  /**\n   * Where a tenant's organization-flavoured email goes, and whether it goes at all. READ by the\n   * notification dispatcher since 2026-09-08 (#410).\n   *\n   * It was read by NOTHING before that. The record was seeded by apps-manager at provisioning,\n   * rendered and edited through the organizations preset and audited, while organization-targeted\n   * notifications resolved to member user ids by role and went to each member's own address — so a\n   * tenant that filled this screen in changed nothing.\n   *\n   * The category a notification belongs to is DERIVED from its target: the notification-target\n   * vocabulary and these four categories line up one-for-one, so a per-notification declaration\n   * would only be a place for the two to disagree. `ORGANIZATION_USERS` is deliberately outside the\n   * mapping — it fans out to every member by design, and routing it to one address would change who\n   * the message is FOR rather than where it lands.\n   *\n   * An address REPLACES the member fan-out rather than adding to it: a tenant routing security mail\n   * to a SOC address is saying where it goes, not asking for a copy.\n   */\n  defaultEmailAddress: z.email().optional().isSummaryField().describe(\"Email address that receives the notification emails addressed to the organization itself, and those of a category (billing, security, administrative, user management) that has no address of its own. When set, these emails go to this address instead of to the members who would otherwise receive them. Emails meant for every member are always sent to each member.\"),\n  billingAddress: z.email().optional().describe(\"Email address that receives the organization's billing notification emails instead of its members; when unset, `defaultEmailAddress` is used. It is also given to the payment provider as the customer email when the organization's billing account is created.\"),\n  securityAddress: z.email().optional().describe(\"Email address that receives the organization's security notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n  administrativeAddress: z.email().optional().describe(\"Email address that receives the organization's administrative notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n  usersManagementAddress: z.email().optional().describe(\"Email address that receives the organization's user-management notification emails instead of its members; when unset, `defaultEmailAddress` is used.\"),\n\n  /**\n   * Category opt-ins. A `false` SUPPRESSES that category entirely — for the members too, not only\n   * for the routing address — because a tenant turning billing notifications off means it.\n   */\n  billing: z.boolean().default(true).describe(\"When false, the organization's billing notification emails are not sent at all, neither to `billingAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  administrative: z.boolean().default(true).describe(\"When false, the organization's administrative notification emails are not sent at all, neither to `administrativeAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  security: z.boolean().default(true).describe(\"When false, the organization's security notification emails are not sent at all, neither to `securityAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n  usersManagement: z.boolean().default(true).describe(\"When false, the organization's user-management notification emails are not sent at all, neither to `usersManagementAddress` nor to members. Emails only; in-app notifications are unaffected. Defaults to true.\"),\n});\nexport type OrganizationEmailNotifications = z.infer<typeof OrganizationEmailNotificationsSchema>;\n\nexport const OrganizationNotificationsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` = idempotency backstop for onParentCreate seeding: the eager\n  // `createAsSystem` seed on ORGANIZATIONS create writes one notifications row per\n  // org; the unique index makes a re-fire (retry / replay) fail-closed instead of\n  // duplicating.\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  // Email notification preferences. `.default(OrganizationEmailNotificationsSchema.parse({}))`\n  // makes the block materialize to its interior defaults when omitted, so the\n  // resource is default-seedable from its CREATE DTO + parent FK alone (required\n  // by the onParentCreate lifecycle guard). The output type keeps the block\n  // required, so downstream readers are unaffected.\n  emailNotifications: OrganizationEmailNotificationsSchema\n    .default(OrganizationEmailNotificationsSchema.parse({}))\n    .isSummaryField(),\n\n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationNotifications = z.infer<typeof OrganizationNotificationsSchema>;\n\n"]}

package/dist/esm/organizations/organization-preferences.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAU/H,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,kEAAkE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAmG/H,CAAC"}
+{"version":3,"file":"organization-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAU/H,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,kEAAkE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAmG/H,CAAC"}

package/dist/esm/organizations/organization-preferences.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-preferences.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF;;EAEE;AACF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI9K;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,0EAA0E;IAC1E,+EAA+E;IAC/E,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,iBAAiB;IACjB,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAGD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,qEAAqE;oBACrE,qEAAqE;oBACrE,yEAAyE;oBACzE,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;oBACrE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Preferences Shared Resource Configuration\n *\n * Resource configuration for organization preferences management.\n * App-focused management for localization and regional settings.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationPreferencesSchema,\n} from './organization-preferences.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\ntype OrganizationPreferencesCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Preferences Resource Configuration Factory\n*/\nexport const organizationPreferencesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  OrganizationPreferencesCoreOperations,\n  typeof OrganizationPreferencesSchema\n>({\n  mainSchema: OrganizationPreferencesSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_PREFERENCES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_PREFERENCES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_PREFERENCES\n  // relationship declares `onParentCreate.enabled`, so a default preferences row\n  // is written via `createAsSystem` on organization creation (fixes the latent\n  // missing-row gap — org preferences were never hand-seeded). Guard-1 is\n  // fail-closed by omission, so the system seed requires this explicit CREATE\n  // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the\n  // seed resolves.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded preferences row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a preferences row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls\n          // `createAsSystem`, which resolves the default CREATE op through the\n          // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts\n          // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE\n          // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is\n          // swallowed (silent missing row). INTERNAL_CALL is the service-layer\n          // internal transport (no HTTP route) — the correct tier for a system seed.\n          // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the\n          // repository tier, which is variant-agnostic. See composition-oncreate plan.)\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ]\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MANAGER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded preferences row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    }\n  },\n});\n"]}
+{"version":3,"file":"organization-preferences.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAQjF;;EAEE;AACF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI9K;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,0EAA0E;IAC1E,+EAA+E;IAC/E,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,iBAAiB;IACjB,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAGD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,qEAAqE;oBACrE,qEAAqE;oBACrE,yEAAyE;oBACzE,2EAA2E;oBAC3E,yEAAyE;oBACzE,qEAAqE;oBACrE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Preferences Shared Resource Configuration\n *\n * Resource configuration for organization preferences management.\n * App-focused management for localization and regional settings.\n */\n\nimport { z } from 'zod';\nimport {\n  OrganizationPreferencesSchema,\n} from './organization-preferences.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\n\nimport { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\n\ntype OrganizationPreferencesCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\n/*\nOrganization Preferences Resource Configuration Factory\n*/\nexport const organizationPreferencesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  undefined,\n  OrganizationPreferencesCoreOperations,\n  typeof OrganizationPreferencesSchema\n>({\n  mainSchema: OrganizationPreferencesSchema,\n  resourceIdentifier: CoreResourceType.ORGANIZATION_PREFERENCES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_PREFERENCES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // Eager composition seeding: the ORGANIZATIONS → ORGANIZATION_PREFERENCES\n  // relationship declares `onParentCreate.enabled`, so a default preferences row\n  // is written via `createAsSystem` on organization creation (fixes the latent\n  // missing-row gap — org preferences were never hand-seeded). Guard-1 is\n  // fail-closed by omission, so the system seed requires this explicit CREATE\n  // opt-in; the INTERNAL_CALL CREATE variant below is the isDefault path the\n  // seed resolves.\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so the eager-seeded preferences row is physically\n    // removed when its owning organization is deleted. Without it the cascade\n    // throws ErrorType.CONFIGURATION on any org that has a preferences row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          // INTERNAL_CALL (NOT REPOSITORY_ONLY): the onParentCreate seed calls\n          // `createAsSystem`, which resolves the default CREATE op through the\n          // SERVICE tier (`getServiceOperationPathDefault`). That resolver accepts\n          // only INTERNAL_CALL / API_CALL(_WITH_CALLBACK) — a REPOSITORY_ONLY CREATE\n          // is invisible to it, so the seed throws OPERATION_PATH_NOT_FOUND and is\n          // swallowed (silent missing row). INTERNAL_CALL is the service-layer\n          // internal transport (no HTTP route) — the correct tier for a system seed.\n          // (DELETE stays REPOSITORY_ONLY: the onParentDelete cascade deletes via the\n          // repository tier, which is variant-agnostic. See composition-oncreate plan.)\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ]\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MANAGER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so this eager-seeded preferences row is physically\n    // removed when its owning organization is deleted. Without a DELETE op the\n    // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION — the row\n    // is seeded on org create, so every org has one. ORG_ADMIN/HIGH: the org-scope\n    // admin tier for a privileged teardown. See composition-oncreate-lifecycle plan.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    }\n  },\n});\n"]}

package/dist/esm/organizations/organization-preferences.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-preferences.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-preferences.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAkB,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEhH,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBA+BxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC"}
+{"version":3,"file":"organization-preferences.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-preferences.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAkB,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEhH,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBA+BxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC"}

package/dist/esm/organizations/organization-preferences.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-preferences.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organization-preferences.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEhH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,2UAA2U,CAAC;IAC/c,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,6QAA6Q,CAAC;IAC9Y,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,6IAA6I,CAAC;IACpM,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,6HAA6H,CAAC;CACzL,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,eAAe;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE9G,oBAAoB;IACpB,wEAAwE;IACxE,iEAAiE;IACjE,0EAA0E;IAC1E,gFAAgF;IAChF,iFAAiF;IACjF,sEAAsE;IACtE,2DAA2D;IAC3D,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACtE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC9H,gFAAgF;IAChF,4DAA4D;IAC5D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;IACxG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE;IAE1G,uBAAuB;IACvB,mBAAmB,EAAE,qCAAqC,CAAC,OAAO,CAAC,qCAAqC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAEpI,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;IAEjE,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,6BAA6B,CAAC,IAAI,CAAC;IACtF,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAC","sourcesContent":["/**\n * Organization Preferences Shared Schemas\n * \n * Localization, regional settings, and application preferences.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { AvailableLanguage, TimeFormat, TimezoneSchema, DateFormat } from '@wildo-ai/presets-components-models';\n\nexport const OrganizationLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField().describe(\"The organization's default interface language. Every member uses it when `enforceForAllMembers` is true or `allowUserOverride` is false, a member who opts into the organization default uses it, and otherwise it applies when a member's own language cannot be used. Ignored when the application does not offer it. Defaults to `en`.\"),\n  supportedLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]).describe(\"The interface languages this organization's members may use, limited to those the application offers; `primaryLanguage` is always included. When none of them is offered by the application, every language the application offers stays available. Defaults to `[\\\"en\\\"]`.\"),\n  allowUserOverride: z.boolean().default(true).describe(\"When false, members cannot use a language of their own choosing and the interface uses `primaryLanguage` for all of them. Defaults to true.\"),\n  enforceForAllMembers: z.boolean().default(false).describe(\"When true, every member's interface uses `primaryLanguage`, whatever language they chose for themselves. Defaults to false.\")\n});\nexport type OrganizationLanguagePreferences = z.infer<typeof OrganizationLanguagePreferencesSchema>;\n\nexport const OrganizationPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` = idempotency backstop for onParentCreate seeding: the eager\n  // `createAsSystem` seed on ORGANIZATIONS create writes one preferences row per\n  // org; the unique index makes a re-fire (retry / replay) fail-closed instead of\n  // duplicating.\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  \n  // Regional settings\n  // Default 'UTC' (a valid `CommonTimezone`), NOT 'US_SHORT' — that was a\n  // `DateFormat` value mistakenly used here. `TimezoneSchema` is a\n  // `union([enum(CommonTimezone), string])`, so Zod accepted the bad string\n  // (the onParentCreate boot-guard probe passed), but the Mongoose model enforces\n  // the enum and rejected 'US_SHORT' at seed time → the org preferences row failed\n  // to eager-seed. Mirrors the USER preferences `timezone` default. See\n  // composition-oncreate-lifecycle plan (W3 runtime-verify).\n  timezone: TimezoneSchema.default('UTC').isDBIndexed().isSummaryField(),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isDBIndexed().isSummaryField(),\n  // LOCALE_DEFAULT (not ISO_8601): mirrors the USER preferences default — see the\n  // rationale on `UserPreferences_RegionalSchema.dateFormat`.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.LOCALE_DEFAULT).isDBIndexed(),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').default(TimeFormat.TWENTY_FOUR_HOUR).isDBIndexed(),\n  \n  // Language preferences\n  languagePreferences: OrganizationLanguagePreferencesSchema.default(OrganizationLanguagePreferencesSchema.parse({})).isSummaryField(),\n  \n  allowMemberEmailOverride: z.boolean().default(true).isDBIndexed(),\n  \n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationPreferences = z.infer<typeof OrganizationPreferencesSchema>;\n\n/**\n * The tenant's regional answer, as the DEFAULT LAYER beneath a member's own (#410).\n *\n * These four fields sit at the top level of {@link OrganizationPreferencesSchema} because they are\n * the organization's own settings, not a sub-record; this is a derived VIEW of them, so the two can\n * never drift. It exists because the frontend needs to carry exactly this much of the tenant's\n * preferences record to `I18nContext` — sending the whole record would put `_id`, audit fields and\n * the member-email-override policy on an event that has no use for any of them.\n *\n * The resolution `I18nContext` performs is: the member's own value, then this, then the framework\n * fallback. A member's explicit choice always wins — that is why\n * {@link UserPreferences_RegionalSchema}'s four fields are optional, so \"the member expressed\n * nothing\" is representable at all.\n *\n * Unlike the member's block, these fields keep their defaults, and that is correct rather than an\n * oversight: the organization record is seeded at provisioning and always exists, so its values ARE\n * the tenant's answer. A tenant that has edited nothing answers with the same four values the\n * framework would have used, which makes the layer a no-op for it — exactly as it should be.\n */\nexport const OrganizationRegionalPreferencesSchema = OrganizationPreferencesSchema.pick({\n  timezone: true,\n  locale: true,\n  dateFormat: true,\n  timeFormat: true,\n});\nexport type OrganizationRegionalPreferences = z.infer<typeof OrganizationRegionalPreferencesSchema>;\n"]}
+{"version":3,"file":"organization-preferences.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organization-preferences.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEhH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,2UAA2U,CAAC;IAC/c,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,6QAA6Q,CAAC;IAC9Y,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,6IAA6I,CAAC;IACpM,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,6HAA6H,CAAC;CACzL,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,eAAe;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE9G,oBAAoB;IACpB,wEAAwE;IACxE,iEAAiE;IACjE,0EAA0E;IAC1E,gFAAgF;IAChF,iFAAiF;IACjF,sEAAsE;IACtE,2DAA2D;IAC3D,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACtE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC9H,gFAAgF;IAChF,4DAA4D;IAC5D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;IACxG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE;IAE1G,uBAAuB;IACvB,mBAAmB,EAAE,qCAAqC,CAAC,OAAO,CAAC,qCAAqC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAEpI,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;IAEjE,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,6BAA6B,CAAC,IAAI,CAAC;IACtF,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAC","sourcesContent":["/**\n * Organization Preferences Shared Schemas\n * \n * Localization, regional settings, and application preferences.\n * Separated from core organization for performance optimization.\n */\n\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { AvailableLanguage, TimeFormat, TimezoneSchema, DateFormat } from '@wildo-ai/presets-components-models';\n\nexport const OrganizationLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField().describe(\"The organization's default interface language. Every member uses it when `enforceForAllMembers` is true or `allowUserOverride` is false, a member who opts into the organization default uses it, and otherwise it applies when a member's own language cannot be used. Ignored when the application does not offer it. Defaults to `en`.\"),\n  supportedLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]).describe(\"The interface languages this organization's members may use, limited to those the application offers; `primaryLanguage` is always included. When none of them is offered by the application, every language the application offers stays available. Defaults to `[\\\"en\\\"]`.\"),\n  allowUserOverride: z.boolean().default(true).describe(\"When false, members cannot use a language of their own choosing and the interface uses `primaryLanguage` for all of them. Defaults to true.\"),\n  enforceForAllMembers: z.boolean().default(false).describe(\"When true, every member's interface uses `primaryLanguage`, whatever language they chose for themselves. Defaults to false.\")\n});\nexport type OrganizationLanguagePreferences = z.infer<typeof OrganizationLanguagePreferencesSchema>;\n\nexport const OrganizationPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` = idempotency backstop for onParentCreate seeding: the eager\n  // `createAsSystem` seed on ORGANIZATIONS create writes one preferences row per\n  // org; the unique index makes a re-fire (retry / replay) fail-closed instead of\n  // duplicating.\n  organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  \n  // Regional settings\n  // Default 'UTC' (a valid `CommonTimezone`), NOT 'US_SHORT' — that was a\n  // `DateFormat` value mistakenly used here. `TimezoneSchema` is a\n  // `union([enum(CommonTimezone), string])`, so Zod accepted the bad string\n  // (the onParentCreate boot-guard probe passed), but the Mongoose model enforces\n  // the enum and rejected 'US_SHORT' at seed time → the org preferences row failed\n  // to eager-seed. Mirrors the USER preferences `timezone` default. See\n  // composition-oncreate-lifecycle plan (W3 runtime-verify).\n  timezone: TimezoneSchema.default('UTC').isDBIndexed().isSummaryField(),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isDBIndexed().isSummaryField(),\n  // LOCALE_DEFAULT (not ISO_8601): mirrors the USER preferences default — see the\n  // rationale on `UserPreferences_RegionalSchema.dateFormat`.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.LOCALE_DEFAULT).isDBIndexed(),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').default(TimeFormat.TWENTY_FOUR_HOUR).isDBIndexed(),\n  \n  // Language preferences\n  languagePreferences: OrganizationLanguagePreferencesSchema.default(OrganizationLanguagePreferencesSchema.parse({})).isSummaryField(),\n  \n  allowMemberEmailOverride: z.boolean().default(true).isDBIndexed(),\n  \n  // Audit fields\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type OrganizationPreferences = z.infer<typeof OrganizationPreferencesSchema>;\n\n/**\n * The tenant's regional answer, as the DEFAULT LAYER beneath a member's own (#410).\n *\n * These four fields sit at the top level of {@link OrganizationPreferencesSchema} because they are\n * the organization's own settings, not a sub-record; this is a derived VIEW of them, so the two can\n * never drift. It exists because the frontend needs to carry exactly this much of the tenant's\n * preferences record to `I18nContext` — sending the whole record would put `_id`, audit fields and\n * the member-email-override policy on an event that has no use for any of them.\n *\n * The resolution `I18nContext` performs is: the member's own value, then this, then the framework\n * fallback. A member's explicit choice always wins — that is why\n * {@link UserPreferences_RegionalSchema}'s four fields are optional, so \"the member expressed\n * nothing\" is representable at all.\n *\n * Unlike the member's block, these fields keep their defaults, and that is correct rather than an\n * oversight: the organization record is seeded at provisioning and always exists, so its values ARE\n * the tenant's answer. A tenant that has edited nothing answers with the same four values the\n * framework would have used, which makes the layer a no-op for it — exactly as it should be.\n */\nexport const OrganizationRegionalPreferencesSchema = OrganizationPreferencesSchema.pick({\n  timezone: true,\n  locale: true,\n  dateFormat: true,\n  timeFormat: true,\n});\nexport type OrganizationRegionalPreferences = z.infer<typeof OrganizationRegionalPreferencesSchema>;\n"]}

package/dist/esm/organizations/organization-profile.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-profile.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/organization-profile.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAW/H,oBAAY,8BAA8B;IACxC,eAAe,oBAAoB;CACpC;AAED,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgH3H,CAAC"}
+{"version":3,"file":"organization-profile.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/organization-profile.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAW/H,oBAAY,8BAA8B;IACxC,eAAe,oBAAoB;CACpC;AAED,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgH3H,CAAC"}