npm - @wildo-ai/saas-models - Versions diffs - 1.1.9 → 1.1.10 - Mend

@wildo-ai/saas-models 1.1.9 → 1.1.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (936) hide show

package/dist/esm/organizations/organizations.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"organizations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAK1F,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;IACvB,qCAAe,CAAA;IACf,qDAA+B,CAAA;IAC/B,6CAAuB,CAAA;IACvB;;;;;;;OAOG;IACH,yCAAmB,CAAA;AACrB,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAoC,IAAI,GAAG,CAAC;IAC9F,kBAAkB,CAAC,OAAO;IAC1B,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAAsC;IAC5F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,uCAAuC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAID,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtH;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACb,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,WAAW,EAAE;SACb,QAAQ,CAAC,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,wBAAwB,EAAE,CAAC;SAC5F,cAAc,EAAE;SAChB,iBAAiB,EAAE;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAExH;;;;;;;;;;;;;;;;OAgBG;IACH,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAE5E,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6CAA6C;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;IACxG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAC3H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,6CAA6C,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAC5I;;;;;;;;OAQG;IACH,wCAAwC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAEvI;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;CACtG,CAAC,CAAC;AAKH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC","sourcesContent":["/*\n Core Organization Shared Schemas\n \n Lean organization schema optimized for frequent fetching.\n * Related data moved to separate relational models.\n /\n\nimport { z } from 'zod';\nimport '@wildo-ai/zod-decorators';\nimport { ApplicationConfigVocabulary } from '../i18n/application-config-vocabulary.shared';\nimport { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions';\nimport { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas';\n\n\n\n\nexport enum OrganizationStatus {\n ACTIVE = 'ACTIVE',\n SUSPENDED = 'SUSPENDED',\n TRIAL = 'TRIAL',\n TRIAL_EXPIRED = 'TRIAL_EXPIRED',\n CANCELLED = 'CANCELLED',\n /\n Marked for deletion and inside its retention window — NOT removed.\n \n Written by the `request_deletion` lifecycle operation, cleared by `restore`, and consumed by\n * the `organization-purge` batch once {@link Organization.purgeScheduledAt} has elapsed. A row\n * in this state is authorization-dead (see\n * {@link isAuthorityConferringOrganizationStatus}) and data-alive.\n /\n DELETED = 'DELETED'\n}\n\n/\n Organization statuses under which a membership STOPS conferring authority.\n \n ## Why this exists as a named authority\n \n Until 2026-08-01 `OrganizationStatus` had zero backend readers: the execution-context\n * creator built `initiatorRoles` straight from ACTIVE membership rows without ever looking at the\n * organization, so no status value affected anything. That made tenant soft-delete impossible to\n * express — a tenant marked for purge would have kept handing out `ORG_ADMIN` for its whole\n * retention window, which is the original hazard with a longer fuse rather than a fix.\n \n The set is declared here, beside the enum it partitions, rather than inline at the consumer, so\n * that adding a future non-operational status is one edit in the place a reader is already\n * looking. Consumers call {@link isAuthorityConferringOrganizationStatus}; they must not test\n * `status === DELETED` inline.\n \n ## Why these three\n \n - `DELETED` — marked for purge. The whole point of the soft-delete phase.\n * - `SUSPENDED` — an administratively halted tenant. Membership must not survive the halt.\n * - `CANCELLED` — a terminated subscription/tenant. Terminal, like `DELETED`.\n \n `TRIAL_EXPIRED` is deliberately NOT here: an expired trial still needs its administrators to\n * sign in and pay, so revoking their authority would make the tenant unrecoverable by its owner.\n * `ACTIVE` and `TRIAL` are the operational states.\n \n ⚠️ Fail-CLOSED direction: an unresolvable organization is treated as non-conferring by the\n * consumer, so a missing row can never widen authority.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — access rights are removed when the\n * scope granting them stops being operational, without waiting for the data to be destroyed.\n /\nexport const ORGANIZATION_STATUSES_WITHOUT_AUTHORITY: ReadonlySet<OrganizationStatus> = new Set([\n OrganizationStatus.DELETED,\n OrganizationStatus.SUSPENDED,\n OrganizationStatus.CANCELLED,\n]);\n\n/\n True when a membership in an organization of this status still confers its roles.\n \n The single authority behind the execution-context membership gate. See\n * {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} for the rationale and the deliberate\n * `TRIAL_EXPIRED` exclusion.\n /\nexport function isAuthorityConferringOrganizationStatus(status: OrganizationStatus \| undefined): boolean {\n if (status === undefined) return false;\n return !ORGANIZATION_STATUSES_WITHOUT_AUTHORITY.has(status);\n}\n\n\n\nexport const OrganizationSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n /\n Org type from config (for example `seller` or `corporate_buyer`) — REQUIRED, and it must name an entry in\n * the application's declared `organizationTypes`.\n \n The type selects role policy, membership-derived user-type grants, and\n * authentication overrides. A generic patch cannot migrate those dependent\n * invariants atomically, so the value is creation-time identity. A future\n * type transition must be a dedicated migration operation that reconciles\n * every dependent member and policy surface.\n \n ONE such operation exists: `organizations.promoteToOwnerOrganization` (#1054), the paired mutation\n * path for the one transition the framework needs — naming the organization that OPERATES the\n * application. It discharges the sentence above by REFUSING rather than reconciling: the target type\n * must already cover every user type the source grants, every role a membership holds must be\n * available in it, and a SCIM binding may not be lost. So no member's authority moves, which is what\n * makes a transition safe without a cross-resource reconciliation. Any future transition owes the\n * same bar — refuse, or reconcile in one transaction; a generic patch still may not write this.\n \n Required since #1032: the sign-in resolver refuses a member of an organization whose type resolves to no\n * declared entry, so an optional type was a way to create a tenant nobody could sign in to. Organizations stored\n * before it was required are typed by the engine at boot when the application declares a single type, and the\n * application refuses to start naming them when it declares several.\n \n `.systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE)`: the value is a key of the application's declared\n * `organizationTypes`, so it is shown as that type's word (`system_enums.OrganizationType.<type>`, planned from the\n * configuration), the missing word showing the key (#1851). It stays a string because the application, not this\n * schema, owns the values.\n /\n type: z.string().min(1).systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE).isSummaryField().excludeFromUpdate(),\n /\n The tenant's URL-safe identity.\n \n `.isUnique()` since 2026-08-01, and it closes a real hole rather than restating a known rule:\n * uniqueness was promised by the resource specification's 409 and enforced by NOTHING — no index\n * and no application guard — so two organizations could take the same slug. Because the field is\n * also `.excludeFromUpdate()` (creation-time identity, not an editable label), such a collision\n * could never be resolved through the API afterwards. It has to be refused at creation.\n \n Uniqueness is collection-wide, which IS per-application: an application's organizations live in\n * that application's own database, and the schema carries no `applicationId` to scope by.\n \n ⚠️ MongoDB-only today. The SQL planner records uniqueness as intent and leaves enforcement\n * migration-owned, so on a SQL adapter this is a declaration rather than a guarantee.\n /\n slug: z.string()\n .min(1)\n .max(50)\n .regex(/^[a-z0-9]+(?:-[a-z0-9]+)$/)\n .isDBIndexed()\n .isUnique({ conflictMessageReference: ErrorCustomMessageReference.ORGANIZATION_SLUG_EXISTS })\n .isSummaryField()\n .excludeFromUpdate(),\n /*\n Tenant lifecycle and access posture.\n \n `.excludeFromUpdate()` since 2026-08-01, and that exclusion is the whole point of the field.\n * Before it, generic UPDATE carried `status` and the DEFAULT variant of that operation is gated\n * to `ORG_ADMIN` — while SUSPEND / ACTIVATE are `APP_ADMIN_SUPER_ADMIN`-only and gated by an\n * `enabledCondition` on the current status. So the org admin of a SUSPENDED tenant could\n * `PUT /organizations/{id}` with `{\"status\":\"ACTIVE\"}` and lift the platform's suspension on\n * their own organization: the control was defeatable by exactly the party it exists to control.\n * The configuration had claimed otherwise for a long time — both UPDATE variants carried a\n * `// status manually excluded for this variant` comment that nothing implemented.\n \n Lifecycle transitions belong to the dedicated verbs, which own the state machine, the reason,\n * and the audit trail. This mirrors `OrganizationMemberSchema.status`, whose JSDoc has always\n * described the same rule for the same reason.\n \n KNOWN CONSEQUENCE, ACCEPTED: the platform apps-manager's `upsertEntity` re-asserts\n * `status: ACTIVE` on its update branch when reconciling an existing organization. That write is\n * now dropped. This is the intended outcome — a provisioning re-run silently returning a\n * suspended tenant to ACTIVE is the same defect from the other direction. A path that must set\n * the status goes through the transition operations or a trusted `updateAsSystem`, not a generic\n * field patch.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — a tenant may not lift a platform-imposed\n * restriction on itself.\n /\n status: z.enum(OrganizationStatus).default(OrganizationStatus.ACTIVE).isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n /\n Does a platform operator need THIS tenant's approval before an elevation becomes usable?\n \n The Customer Lockbox posture, and opt-in per tenant exactly as Microsoft and Google ship it. A\n * tenant that has not staffed an approver must not thereby become unable to receive support, so\n * the default is `false`: elevations still require a request, a justification, a 4-hour ceiling and\n * an audit trail — they simply do not wait for a human in the tenant.\n \n Turning it ON is the strongest available posture and is what regulated buyers ask for by name.\n \n ⚠️ It does NOT make the tenant unreachable when it has no administrator. A tenant with no\n * administratively usable owner cannot approve anything, and requiring approval from it would make\n * its own repair impossible — see `PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE`,\n * which is measured with the owner floor's own predicate rather than assumed.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — customer-approved operator access.\n /\n platformAccessApprovalRequired: z.boolean().default(false).isAuditEvidence(),\n\n // Basic timestamps (lifecycle audit is in separate collection)\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // Tenant teardown — soft-delete marks (WS-A)\n /\n When the tenant was MARKED for deletion — the start of its retention window.\n \n Written by the `request_deletion` lifecycle operation together with `status: DELETED`, and\n * cleared by `restore`. Both fields move together: `status` is the authorization-relevant half\n * (it is what {@link isAuthorityConferringOrganizationStatus} reads) and this is the evidence\n * half.\n \n ## Why this is not called `deletedAt`\n \n It replaced a field of that name on 2026-08-01, and the rename is not cosmetic in two separate\n * ways.\n \n First, `deletedAt` is RESERVED framework vocabulary: it appears in\n * `createOrUpdateMandatoryDiscardFields`, so the runtime strips it from every create and update\n * payload on every resource. A lifecycle operation could therefore never write it — the value\n * would be discarded and the operation would answer success having recorded nothing, which is\n * the exact silent-no-op class this workstream exists to remove. No `authoritativeFields`\n * declaration rescues it; the discard happens regardless.\n \n Second, the two names mean different things. `deletedAt` answers \"when was this row deleted\",\n * and the row is emphatically NOT deleted — it is fully present and restorable for the whole\n * retention window. Reusing the name would have made every reader who trusts the framework's\n * vocabulary wrong about the state of the tenant in front of them.\n \n The predecessor field had zero readers and zero writers in the entire repository, so nothing\n * observable was lost by replacing it.\n \n Never a user-facing value on a live organization — it only ever renders as an empty \"—\", so it\n * stays hidden from every auto-rendered display/edit surface via `.isHidden()`. An admin/audit\n * surface that needs to inspect marked rows must opt it back in explicitly.\n \n ⚠️ This is NOT the purge predicate. Purge eligibility is {@link purgeScheduledAt} — see the\n * reasoning there.\n \n ## Why `.nullish()` and not `.optional()`\n \n `restore` CLEARS this field, and clearing means writing `null` — `undefined` merely omits the\n * key and leaves the stale mark in place. `preserveServerInjectedFields` copies the authored\n * value verbatim past the strict re-parse (`hasOwnProperty` + assign), so the `null` genuinely\n * reaches persistence. With `.optional()` alone the row would then be UNREADABLE: the main schema\n * rejects `null` for a `z.date()`, so every subsequent read of a restored tenant would throw on\n * output projection. Verified by probing the real schema rather than assumed.\n /\n deletionRequestedAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden(),\n /\n Serialization token for the organization-owner floor. Never read for meaning — only WRITTEN, to\n * make concurrent owner-reducing operations conflict with each other.\n \n ## Why a stored field is the fix rather than a better check\n \n The floor is a check-then-act on a COUNT: it measures the usable-owner population, then the\n * caller writes. Under snapshot isolation that is textbook WRITE SKEW — two transactions each\n * remove a DIFFERENT owner, each observes the other still present, and both commit, producing a\n * tenant with zero owners that neither was individually permitted to create. No amount of\n * additional checking closes it, because each transaction's view is internally consistent; a\n * re-measure after the write cannot see the other transaction's uncommitted row either.\n \n The standard remedy is to give the two transactions something to collide ON. Every owner-reducing\n * operation bumps this token on the tenant's own row inside its transaction, so two of them touch\n * the same document and the storage engine aborts the loser. That holds only when the operation's\n * transaction reaches the floor, which every owner-reducing prefix now passes as `transaction`; until\n * 2026-09-15 none did, and the write autocommitted beside the removal. Observed on a live replica set\n * in `organization-owner-floor-concurrent-removal.mongo-replset.integration.test.ts`, which also\n * drives the unforwarded shape and watches it leave the tenant with no owner.\n \n Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a\n * modification of the organization, and it would corrupt every \"recently changed tenants\" surface);\n * a separate lock collection (a new resource, a new registration, and a second thing to keep\n * consistent with the floor); an application-level mutex (does not survive multiple processes,\n * which is exactly the deployment this must work in).\n \n `.nullish()` because existing tenants predate it and a tenant that has never had an\n * owner-reducing write legitimately has no token. Absent and zero mean the same thing.\n /\n ownerFloorSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n /\n Serializes every decision on this organization's service-provider relationships (#1597).\n \n Each relationship verb — either side's propose, accept, decline, suspend, resume, terminate, withdraw, expire,\n * amendScope, machine-client admission, assign and unassign — decides on state it READ: \"is a relationship already\n * live?\", \"is this one still SUSPENDED?\". Two decisions at the same moment can each read the state the other is\n * about to change: two proposals each see none live and both commit; a resume and a terminate each see SUSPENDED and\n * the later write turns a TERMINATED relationship back to ACTIVE with `endedAt` still set. So every verb bumps this\n * token on the CLIENT organization's row inside its own transaction BEFORE reading what it decides on. On MongoDB the\n * second writer hits a write conflict and is retried from a fresh read; on PostgreSQL (READ COMMITTED) it blocks on\n * the row lock until the first commits, and its next read sees the committed state. The same remedy, and the same\n * reasoning, as `ownerFloorSerializationToken` above.\n \n Its own FIELD rather than that token, so each token's meaning stays legible — but both are fields of this one row,\n * and both adapters conflict per row, so an owner-reducing write and a relationship decision on the same tenant DO\n * serialize against each other. That is accepted, not avoided: both are rare, and the loser is retried (MongoDB) or\n * waits (PostgreSQL). A separate lock document would avoid it at the cost of a second thing to keep consistent.\n \n The write also moves the organization's `updatedAt` and version — the repository stamps both on every update, as\n * it already did for the owner-floor token. Accepted as truthful: the row WAS written. A concurrent edit of the\n * organization that carries an If-Match gets the ordinary precondition failure and retries.\n \n Rejected alternatives: a unique index on (organizationId, providerOrganizationId) — it would forbid the pair's\n * HISTORY (terminated relationships stay as access evidence, and a firm may be re-engaged); a partial unique index\n * over the live statuses — not expressible through the field decorators on both adapters; a compare-and-swap on the\n * relationship's own status — it guards one row, while a decision also reads rows it does not write (another\n * relationship, the assignment, the membership); bumping `updatedAt` alone as the collision point — it names a\n * modification rather than a decision, though the write above moves it anyway.\n \n `.nullish()` because a tenant that has never received a proposal has no token. Nothing reads the value; only the\n * write matters.\n /\n serviceProviderRelationshipSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n /\n Serializes every change of which OAuth client runs which autonomous agent in this organization\n * (#1611). The `setAutonomousAgents` operation bumps it inside its own transaction BEFORE counting the\n * clients that already carry a ref, so two binds of the same ref at the same moment cannot both see\n * \"none\" and both commit: on MongoDB the second writer hits a write conflict on this row and is retried;\n * on PostgreSQL (READ COMMITTED) it waits for the row lock, and its count then sees the first binding.\n * The `ownerFloorSerializationToken` remedy, for the same write skew. Its own field so its meaning stays\n * legible. `.nullish()`: a tenant that has never bound an agent has no token. Nothing reads the value.\n /\n autonomousAgentBindingSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n\n /\n When the `organization-purge` batch becomes allowed to destroy this tenant.\n \n ## Why this is stored rather than derived from `deletionRequestedAt` + a configured window\n \n The retention window is a PROMISE made to the tenant at the moment of the mark (\"your data is\n * recoverable until <date>\"). Deriving eligibility as `deletionRequestedAt < now - window`\n * re-evaluates that promise against whatever the configuration says at PURGE time, so lowering\n * the window would retroactively shorten — or immediately expire — every tenant already inside\n * one. Pinning the deadline at mark time makes the commitment immutable, which is the property\n * a data-retention commitment has to have, and it makes a per-tenant legal hold expressible\n * later by moving one field rather than by special-casing the batch predicate.\n \n The `FILES` soft-delete precedent derives its cutoff instead. That is defensible there — an\n * orphaned upload is nobody's commitment — and is precisely why the two should not share one\n * mechanism.\n \n Server-owned: written only by the lifecycle operations that own the state machine, never by a\n * client patch.\n \n `.nullish()` for the same reason as {@link deletionRequestedAt} — `restore` clears it, and a\n * persisted `null` has to survive the next read.\n /\n purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()\n});\n\n\nexport type Organization = z.infer<typeof OrganizationSchema>;\n\n/\n An organization as the frontend holds it for a signed-in member: the organization row plus what\n * session restore fetches beside it.\n \n Every field here has a producer, and that is the rule for adding one. `UserOrgsContext` obtains\n * these with `doOperation<OrganizationContext>`, which is a CAST, not a parse — so a declared field\n * nothing produces compiles and reads `undefined` at runtime with no warning. Until #581 this schema\n * declared five such fields, two of them REQUIRED:\n \n \| removed \| why \|\n * \|---\|---\|\n * \| `planFeatures` (required) \| no producer, no consumer. Scope features have their own resource (`ORGANIZATION_FEATURES`) with its own cache invalidation; read that. \|\n * \| `members` (required) \| no producer, no consumer. It implied the tenant's FULL member list on every organization at session restore; the caller's own memberships already arrive on the USER_SELF context, and a people picker reads `ORGANIZATION_MEMBERS`. \|\n * \| `profile`, `notifications` \| no producer on the default READ session restore uses, no consumer. The ORGANIZATIONS context variant would populate the profile, and it was rejected for session restore (see `UserOrgsContext`). \|\n * \| `displayName`, `logoUrl` \| no producer, no consumer. `displayName` lives on `OrganizationProfileSchema`. \|\n \n `preferences` stays, optional: `loadOrganizations` fetches it from `ORGANIZATION_PREFERENCES` and\n * tolerates its absence (#563).\n */\nexport const OrganizationContextSchema = OrganizationSchema.extend({\n preferences: OrganizationPreferencesSchema.optional(),\n});\n\n\nexport type OrganizationContext = z.infer<typeof OrganizationContextSchema>;\n"]}
1	+ {"version":3,"file":"organizations.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/organizations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAK1F,MAAM,CAAN,IAAY,kBAeX;AAfD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,6CAAuB,CAAA;IACvB,qCAAe,CAAA;IACf,qDAA+B,CAAA;IAC/B,6CAAuB,CAAA;IACvB;;;;;;;OAOG;IACH,yCAAmB,CAAA;AACrB,CAAC,EAfW,kBAAkB,KAAlB,kBAAkB,QAe7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAoC,IAAI,GAAG,CAAC;IAC9F,kBAAkB,CAAC,OAAO;IAC1B,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAAsC;IAC5F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,uCAAuC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAID,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtH;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACb,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,4BAA4B,CAAC;SACnC,WAAW,EAAE;SACb,QAAQ,CAAC,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,wBAAwB,EAAE,CAAC;SAC5F,cAAc,EAAE;SAChB,iBAAiB,EAAE;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAExH;;;;;;;;;;;;;;;;OAgBG;IACH,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAE5E,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6CAA6C;IAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,mBAAmB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;IACxG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAC3H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,6CAA6C,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAC5I;;;;;;;;OAQG;IACH,wCAAwC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE;IAEvI;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;CACtG,CAAC,CAAC;AAKH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC","sourcesContent":["/*\n Core Organization Shared Schemas\n \n Lean organization schema optimized for frequent fetching.\n * Related data moved to separate relational models.\n /\n\nimport { z } from 'zod';\nimport '@wildo-ai/zod-decorators';\nimport { ApplicationConfigVocabulary } from '../i18n/application-config-vocabulary.shared';\nimport { ErrorCustomMessageReference } from '../errors/errors.custom-message-ref.shared.definitions';\nimport { OrganizationPreferencesSchema } from './organization-preferences.shared.schemas';\n\n\n\n\nexport enum OrganizationStatus {\n ACTIVE = 'ACTIVE',\n SUSPENDED = 'SUSPENDED',\n TRIAL = 'TRIAL',\n TRIAL_EXPIRED = 'TRIAL_EXPIRED',\n CANCELLED = 'CANCELLED',\n /\n Marked for deletion and inside its retention window — NOT removed.\n \n Written by the `request_deletion` lifecycle operation, cleared by `restore`, and consumed by\n * the `organization-purge` batch once {@link Organization.purgeScheduledAt} has elapsed. A row\n * in this state is authorization-dead (see\n * {@link isAuthorityConferringOrganizationStatus}) and data-alive.\n /\n DELETED = 'DELETED'\n}\n\n/\n Organization statuses under which a membership STOPS conferring authority.\n \n ## Why this exists as a named authority\n \n Until 2026-08-01 `OrganizationStatus` had zero backend readers: the execution-context\n * creator built `initiatorRoles` straight from ACTIVE membership rows without ever looking at the\n * organization, so no status value affected anything. That made tenant soft-delete impossible to\n * express — a tenant marked for purge would have kept handing out `ORG_ADMIN` for its whole\n * retention window, which is the original hazard with a longer fuse rather than a fix.\n \n The set is declared here, beside the enum it partitions, rather than inline at the consumer, so\n * that adding a future non-operational status is one edit in the place a reader is already\n * looking. Consumers call {@link isAuthorityConferringOrganizationStatus}; they must not test\n * `status === DELETED` inline.\n \n ## Why these three\n \n - `DELETED` — marked for purge. The whole point of the soft-delete phase.\n * - `SUSPENDED` — an administratively halted tenant. Membership must not survive the halt.\n * - `CANCELLED` — a terminated subscription/tenant. Terminal, like `DELETED`.\n \n `TRIAL_EXPIRED` is deliberately NOT here: an expired trial still needs its administrators to\n * sign in and pay, so revoking their authority would make the tenant unrecoverable by its owner.\n * `ACTIVE` and `TRIAL` are the operational states.\n \n ⚠️ Fail-CLOSED direction: an unresolvable organization is treated as non-conferring by the\n * consumer, so a missing row can never widen authority.\n \n assurance-control: WILDO.ACCESS.LIFECYCLE — access rights are removed when the\n * scope granting them stops being operational, without waiting for the data to be destroyed.\n /\nexport const ORGANIZATION_STATUSES_WITHOUT_AUTHORITY: ReadonlySet<OrganizationStatus> = new Set([\n OrganizationStatus.DELETED,\n OrganizationStatus.SUSPENDED,\n OrganizationStatus.CANCELLED,\n]);\n\n/\n True when a membership in an organization of this status still confers its roles.\n \n The single authority behind the execution-context membership gate. See\n * {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} for the rationale and the deliberate\n * `TRIAL_EXPIRED` exclusion.\n /\nexport function isAuthorityConferringOrganizationStatus(status: OrganizationStatus \| undefined): boolean {\n if (status === undefined) return false;\n return !ORGANIZATION_STATUSES_WITHOUT_AUTHORITY.has(status);\n}\n\n\n\nexport const OrganizationSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n /\n Org type from config (for example `seller` or `corporate_buyer`) — REQUIRED, and it must name an entry in\n * the application's declared `organizationTypes`.\n \n The type selects role policy, membership-derived user-type grants, and\n * authentication overrides. A generic patch cannot migrate those dependent\n * invariants atomically, so the value is creation-time identity. A future\n * type transition must be a dedicated migration operation that reconciles\n * every dependent member and policy surface.\n \n ONE such operation exists: `organizations.promoteToOwnerOrganization` (#1054), the paired mutation\n * path for the one transition the framework needs — naming the organization that OPERATES the\n * application. It discharges the sentence above by REFUSING rather than reconciling: the target type\n * must already cover every user type the source grants, every role a membership holds must be\n * available in it, and a SCIM binding may not be lost. So no member's authority moves, which is what\n * makes a transition safe without a cross-resource reconciliation. Any future transition owes the\n * same bar — refuse, or reconcile in one transaction; a generic patch still may not write this.\n \n Required since #1032: the sign-in resolver refuses a member of an organization whose type resolves to no\n * declared entry, so an optional type was a way to create a tenant nobody could sign in to. Organizations stored\n * before it was required are typed by the engine at boot when the application declares a single type, and the\n * application refuses to start naming them when it declares several.\n \n `.systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE)`: the value is a key of the application's declared\n * `organizationTypes`, so it is shown as that type's word (`system_enums.OrganizationType.<type>`, planned from the\n * configuration), the missing word showing the key (#1851). It stays a string because the application, not this\n * schema, owns the values.\n /\n type: z.string().min(1).systemEnum(ApplicationConfigVocabulary.ORGANIZATION_TYPE).isSummaryField().excludeFromUpdate(),\n /\n The tenant's URL-safe identity.\n \n `.isUnique()` since 2026-08-01, and it closes a real hole rather than restating a known rule:\n * uniqueness was promised by the resource specification's 409 and enforced by NOTHING — no index\n * and no application guard — so two organizations could take the same slug. Because the field is\n * also `.excludeFromUpdate()` (creation-time identity, not an editable label), such a collision\n * could never be resolved through the API afterwards. It has to be refused at creation.\n \n Uniqueness is collection-wide, which IS per-application: an application's organizations live in\n * that application's own database, and the schema carries no `applicationId` to scope by.\n \n ⚠️ MongoDB-only today. The SQL planner records uniqueness as intent and leaves enforcement\n * migration-owned, so on a SQL adapter this is a declaration rather than a guarantee.\n /\n slug: z.string()\n .min(1)\n .max(50)\n .regex(/^[a-z0-9]+(?:-[a-z0-9]+)$/)\n .isDBIndexed()\n .isUnique({ conflictMessageReference: ErrorCustomMessageReference.ORGANIZATION_SLUG_EXISTS })\n .isSummaryField()\n .excludeFromUpdate(),\n /*\n Tenant lifecycle and access posture.\n \n `.excludeFromUpdate()` since 2026-08-01, and that exclusion is the whole point of the field.\n * Before it, generic UPDATE carried `status` and the DEFAULT variant of that operation is gated\n * to `ORG_ADMIN` — while SUSPEND / ACTIVATE are `APP_ADMIN_SUPER_ADMIN`-only and gated by an\n * `enabledCondition` on the current status. So the org admin of a SUSPENDED tenant could\n * `PUT /organizations/{id}` with `{\"status\":\"ACTIVE\"}` and lift the platform's suspension on\n * their own organization: the control was defeatable by exactly the party it exists to control.\n * The configuration had claimed otherwise for a long time — both UPDATE variants carried a\n * `// status manually excluded for this variant` comment that nothing implemented.\n \n Lifecycle transitions belong to the dedicated verbs, which own the state machine, the reason,\n * and the audit trail. This mirrors `OrganizationMemberSchema.status`, whose JSDoc has always\n * described the same rule for the same reason.\n \n KNOWN CONSEQUENCE, ACCEPTED: the platform apps-manager's `upsertEntity` re-asserts\n * `status: ACTIVE` on its update branch when reconciling an existing organization. That write is\n * now dropped. This is the intended outcome — a provisioning re-run silently returning a\n * suspended tenant to ACTIVE is the same defect from the other direction. A path that must set\n * the status goes through the transition operations or a trusted `updateAsSystem`, not a generic\n * field patch.\n \n assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — a tenant may not lift a platform-imposed\n * restriction on itself.\n /\n status: z.enum(OrganizationStatus).default(OrganizationStatus.ACTIVE).isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n /\n Does a platform operator need THIS tenant's approval before an elevation becomes usable?\n \n The Customer Lockbox posture, and opt-in per tenant exactly as Microsoft and Google ship it. A\n * tenant that has not staffed an approver must not thereby become unable to receive support, so\n * the default is `false`: elevations still require a request, a justification, a 4-hour ceiling and\n * an audit trail — they simply do not wait for a human in the tenant.\n \n Turning it ON is the strongest available posture and is what regulated buyers ask for by name.\n \n ⚠️ It does NOT make the tenant unreachable when it has no administrator. A tenant with no\n * administratively usable owner cannot approve anything, and requiring approval from it would make\n * its own repair impossible — see `PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE`,\n * which is measured with the owner floor's own predicate rather than assumed.\n \n assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — customer-approved operator access.\n /\n platformAccessApprovalRequired: z.boolean().default(false).isAuditEvidence(),\n\n // Basic timestamps (lifecycle audit is in separate collection)\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // Tenant teardown — soft-delete marks (WS-A)\n /\n When the tenant was MARKED for deletion — the start of its retention window.\n \n Written by the `request_deletion` lifecycle operation together with `status: DELETED`, and\n * cleared by `restore`. Both fields move together: `status` is the authorization-relevant half\n * (it is what {@link isAuthorityConferringOrganizationStatus} reads) and this is the evidence\n * half.\n \n ## Why this is not called `deletedAt`\n \n It replaced a field of that name on 2026-08-01, and the rename is not cosmetic in two separate\n * ways.\n \n First, `deletedAt` is RESERVED framework vocabulary: it appears in\n * `createOrUpdateMandatoryDiscardFields`, so the runtime strips it from every create and update\n * payload on every resource. A lifecycle operation could therefore never write it — the value\n * would be discarded and the operation would answer success having recorded nothing, which is\n * the exact silent-no-op class this workstream exists to remove. No `authoritativeFields`\n * declaration rescues it; the discard happens regardless.\n \n Second, the two names mean different things. `deletedAt` answers \"when was this row deleted\",\n * and the row is emphatically NOT deleted — it is fully present and restorable for the whole\n * retention window. Reusing the name would have made every reader who trusts the framework's\n * vocabulary wrong about the state of the tenant in front of them.\n \n The predecessor field had zero readers and zero writers in the entire repository, so nothing\n * observable was lost by replacing it.\n \n Never a user-facing value on a live organization — it only ever renders as an empty \"—\", so it\n * stays hidden from every auto-rendered display/edit surface via `.isHidden()`. An admin/audit\n * surface that needs to inspect marked rows must opt it back in explicitly.\n \n ⚠️ This is NOT the purge predicate. Purge eligibility is {@link purgeScheduledAt} — see the\n * reasoning there.\n \n ## Why `.nullish()` and not `.optional()`\n \n `restore` CLEARS this field, and clearing means writing `null` — `undefined` merely omits the\n * key and leaves the stale mark in place. `preserveServerInjectedFields` copies the authored\n * value verbatim past the strict re-parse (`hasOwnProperty` + assign), so the `null` genuinely\n * reaches persistence. With `.optional()` alone the row would then be UNREADABLE: the main schema\n * rejects `null` for a `z.date()`, so every subsequent read of a restored tenant would throw on\n * output projection. Verified by probing the real schema rather than assumed.\n /\n deletionRequestedAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden(),\n /\n Serialization token for the organization-owner floor. Never read for meaning — only WRITTEN, to\n * make concurrent owner-reducing operations conflict with each other.\n \n ## Why a stored field is the fix rather than a better check\n \n The floor is a check-then-act on a COUNT: it measures the usable-owner population, then the\n * caller writes. Under snapshot isolation that is textbook WRITE SKEW — two transactions each\n * remove a DIFFERENT owner, each observes the other still present, and both commit, producing a\n * tenant with zero owners that neither was individually permitted to create. No amount of\n * additional checking closes it, because each transaction's view is internally consistent; a\n * re-measure after the write cannot see the other transaction's uncommitted row either.\n \n The standard remedy is to give the two transactions something to collide ON. Every owner-reducing\n * operation bumps this token on the tenant's own row inside its transaction, so two of them touch\n * the same document and the storage engine aborts the loser. That holds only when the operation's\n * transaction reaches the floor, which every owner-reducing prefix now passes as `transaction`; until\n * 2026-09-15 none did, and the write autocommitted beside the removal. Observed on a live replica set\n * in `organization-owner-floor-concurrent-removal.mongo-replset.integration.test.ts`, which also\n * drives the unforwarded shape and watches it leave the tenant with no owner.\n \n Rejected alternatives: bumping `updatedAt` (semantically wrong — a membership change is not a\n * modification of the organization, and it would corrupt every \"recently changed tenants\" surface);\n * a separate lock collection (a new resource, a new registration, and a second thing to keep\n * consistent with the floor); an application-level mutex (does not survive multiple processes,\n * which is exactly the deployment this must work in).\n \n `.nullish()` because existing tenants predate it and a tenant that has never had an\n * owner-reducing write legitimately has no token. Absent and zero mean the same thing.\n /\n ownerFloorSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n /\n Serializes every decision on this organization's service-provider relationships (#1597).\n \n Each relationship verb — either side's propose, accept, decline, suspend, resume, terminate, withdraw, expire,\n * amendScope, machine-client admission, assign and unassign — decides on state it READ: \"is a relationship already\n * live?\", \"is this one still SUSPENDED?\". Two decisions at the same moment can each read the state the other is\n * about to change: two proposals each see none live and both commit; a resume and a terminate each see SUSPENDED and\n * the later write turns a TERMINATED relationship back to ACTIVE with `endedAt` still set. So every verb bumps this\n * token on the CLIENT organization's row inside its own transaction BEFORE reading what it decides on. On MongoDB the\n * second writer hits a write conflict and is retried from a fresh read; on PostgreSQL (READ COMMITTED) it blocks on\n * the row lock until the first commits, and its next read sees the committed state. The same remedy, and the same\n * reasoning, as `ownerFloorSerializationToken` above.\n \n Its own FIELD rather than that token, so each token's meaning stays legible — but both are fields of this one row,\n * and both adapters conflict per row, so an owner-reducing write and a relationship decision on the same tenant DO\n * serialize against each other. That is accepted, not avoided: both are rare, and the loser is retried (MongoDB) or\n * waits (PostgreSQL). A separate lock document would avoid it at the cost of a second thing to keep consistent.\n \n The write also moves the organization's `updatedAt` and version — the repository stamps both on every update, as\n * it already did for the owner-floor token. Accepted as truthful: the row WAS written. A concurrent edit of the\n * organization that carries an If-Match gets the ordinary precondition failure and retries.\n \n Rejected alternatives: a unique index on (organizationId, providerOrganizationId) — it would forbid the pair's\n * HISTORY (terminated relationships stay as access evidence, and a firm may be re-engaged); a partial unique index\n * over the live statuses — not expressible through the field decorators on both adapters; a compare-and-swap on the\n * relationship's own status — it guards one row, while a decision also reads rows it does not write (another\n * relationship, the assignment, the membership); bumping `updatedAt` alone as the collision point — it names a\n * modification rather than a decision, though the write above moves it anyway.\n \n `.nullish()` because a tenant that has never received a proposal has no token. Nothing reads the value; only the\n * write matters.\n /\n serviceProviderRelationshipSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n /\n Serializes every change of which OAuth client runs which autonomous agent in this organization\n * (#1611). The `setAutonomousAgents` operation bumps it inside its own transaction BEFORE counting the\n * clients that already carry a ref, so two binds of the same ref at the same moment cannot both see\n * \"none\" and both commit: on MongoDB the second writer hits a write conflict on this row and is retried;\n * on PostgreSQL (READ COMMITTED) it waits for the row lock, and its count then sees the first binding.\n * The `ownerFloorSerializationToken` remedy, for the same write skew. Its own field so its meaning stays\n * legible. `.nullish()`: a tenant that has never bound an agent has no token. Nothing reads the value.\n /\n autonomousAgentBindingSerializationToken: z.number().int().nullish().excludeFromCreate().excludeFromUpdate().isBackendOnly().isHidden(),\n\n /\n When the `organization-purge` batch becomes allowed to destroy this tenant.\n \n ## Why this is stored rather than derived from `deletionRequestedAt` + a configured window\n \n The retention window is a PROMISE made to the tenant at the moment of the mark (\"your data is\n * recoverable until <date>\"). Deriving eligibility as `deletionRequestedAt < now - window`\n * re-evaluates that promise against whatever the configuration says at PURGE time, so lowering\n * the window would retroactively shorten — or immediately expire — every tenant already inside\n * one. Pinning the deadline at mark time makes the commitment immutable, which is the property\n * a data-retention commitment has to have, and it makes a per-tenant legal hold expressible\n * later by moving one field rather than by special-casing the batch predicate.\n \n The `FILES` soft-delete precedent derives its cutoff instead. That is defensible there — an\n * orphaned upload is nobody's commitment — and is precisely why the two should not share one\n * mechanism.\n \n Server-owned: written only by the lifecycle operations that own the state machine, never by a\n * client patch.\n \n `.nullish()` for the same reason as {@link deletionRequestedAt} — `restore` clears it, and a\n * persisted `null` has to survive the next read.\n /\n purgeScheduledAt: z.date().nullish().isDBIndexed().excludeFromCreate().excludeFromUpdate().isHidden()\n});\n\n\nexport type Organization = z.infer<typeof OrganizationSchema>;\n\n/\n An organization as the frontend holds it for a signed-in member: the organization row plus what\n * session restore fetches beside it.\n \n Every field here has a producer, and that is the rule for adding one. `UserOrgsContext` obtains\n * these with `doOperation<OrganizationContext>`, which is a CAST, not a parse — so a declared field\n * nothing produces compiles and reads `undefined` at runtime with no warning. Until #581 this schema\n * declared five such fields, two of them REQUIRED:\n \n \| removed \| why \|\n * \|---\|---\|\n * \| `planFeatures` (required) \| no producer, no consumer. Scope features have their own resource (`ORGANIZATION_FEATURES`) with its own cache invalidation; read that. \|\n * \| `members` (required) \| no producer, no consumer. It implied the tenant's FULL member list on every organization at session restore; the caller's own memberships already arrive on the USER_SELF context, and a people picker reads `ORGANIZATION_MEMBERS`. \|\n * \| `profile`, `notifications` \| no producer on the default READ session restore uses, no consumer. The ORGANIZATIONS context variant would populate the profile, and it was rejected for session restore (see `UserOrgsContext`). \|\n * \| `displayName`, `logoUrl` \| no producer, no consumer. `displayName` lives on `OrganizationProfileSchema`. \|\n \n `preferences` stays, optional: `loadOrganizations` fetches it from `ORGANIZATION_PREFERENCES` and\n * tolerates its absence (#563).\n */\nexport const OrganizationContextSchema = OrganizationSchema.extend({\n preferences: OrganizationPreferencesSchema.optional(),\n});\n\n\nexport type OrganizationContext = z.infer<typeof OrganizationContextSchema>;\n"]}

package/dist/esm/organizations/service-provider-activity-feed.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-activity-feed.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/organizations/service-provider-activity-feed.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,8CAA8C,EAC/C,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAYjC;;;;;;GAMG;AACH,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAmBjC;;;;;;GAMG;AACH,eAAO,MAAM,8EAA8E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;kBAuFzI,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,sEAAsE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;kBA0DjI,CAAC"}
1	+ {"version":3,"file":"service-provider-activity-feed.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-activity-feed.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,8CAA8C,EAC/C,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAYjC;;;;;;GAMG;AACH,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAmBjC;;;;;;GAMG;AACH,eAAO,MAAM,8EAA8E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;kBAuFzI,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,sEAAsE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;kBA0DjI,CAAC"}

package/dist/esm/organizations/service-provider-activity-feed.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-activity-feed.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-activity-feed.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sCAAsC,EACtC,yCAAyC,EACzC,8CAA8C,GAC/C,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAWlH,MAAM,eAAe,GAAiC;IACpD,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAiBF,MAAM,wBAAwB,GAAyC;IACrE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8EAA8E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC/I,0CAA0C,CAIxC;IACA,UAAU,EAAE,yCAAyC;IACrD,kBAAkB,EAAE,gBAAgB,CAAC,uCAAuC;IAC5E,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,uCAAuC,CAAC;IACrH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kHAAkH;IAClH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;KAC7C;IACD,uHAAuH;IACvH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;;;;OAMG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,wBAAwB;IACxC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnK;QAED;;;WAGG;QAEH;;;;WAIG;QACH,CAAC,8CAA8C,CAAC,MAAM,CAAC,EAAE;YACvD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE;6BAC9C,QAAQ,CAAC,4JAA4J,CAAC;qBAC1K,CAAC;iBACH,CAAC;SACH;QAED,oFAAoF;QACpF,CAAC,8CAA8C,CAAC,OAAO,CAAC,EAAE;YACxD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sEAAsE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACvI,0CAA0C,CAIxC;IACA,UAAU,EAAE,sCAAsC;IAClD,kBAAkB,EAAE,gBAAgB,CAAC,8BAA8B;IACnE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IAC5G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;QAC5C;;;;WAIG;QACH,aAAa,EAAE,wBAAwB,CAAC,OAAO;KAChD;IACD;;;OAGG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;OAGG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAClH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n The firm's expert-activity feed — resource configurations for its two resources (#1632).\n \n Both live in the PROVIDER organization. Neither has a client-facing write: the settings row changes only through\n * the firm owner's `enable` / `disable`, and a feed entry is written by the engine at audit time. See\n * `service-provider-activity-feed.shared.schemas.ts` for the model and why it is metadata only.\n /\n\nimport { z } from 'zod';\nimport {\n ServiceProviderActivityFeedEntrySchema,\n ServiceProviderActivityFeedSettingsSchema,\n ServiceProviderActivityFeedSettings_Operations,\n} from './service-provider-activity-feed.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\n\ntype ActivityFeedCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.COUNT\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.UPDATE_MANY\n \| CoreResourceOperation.DELETE;\n\nconst CORE_OPERATIONS: ActivityFeedCoreOperations[] = [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.COUNT,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n];\n\n/\n The settings row is a context-addressed SINGLETON (a 1:1 composition of the organization): its READ route is the\n * collection path itself (`/organizations/{organizationId}/service-provider-activity-feed-setting`). A public LIST would\n * be mounted on that SAME path and verb, so two handlers would compete for one route. Its LIST is therefore route-less\n * (INTERNAL_CALL): it exists only because the retention policy's see-through read (`listRetainedAsSystem`) surfaces\n * retained rows through LIST. There is no COUNT.\n /\ntype ActivityFeedSettingsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.UPDATE_MANY\n \| CoreResourceOperation.DELETE;\n\nconst SETTINGS_CORE_OPERATIONS: ActivityFeedSettingsCoreOperations[] = [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n];\n\n/\n * Both resources carry the same route-less plumbing, INLINED in each configuration because contextual typing needs\n * the literal in place (the relationship configurations record the same constraint): the SYSTEM door the engine\n * writes through (`createAsSystem` / `updateAsSystem` resolve the default CREATE / UPDATE), the retention writer's\n * UPDATE_MANY, and the DELETE the organization purge cascade and the retention sweep use. INTERNAL_CALL registers no\n * route.\n /\n\n/\n The firm's decision about its feed (#1632). One row per PROVIDER organization, created DISABLED by its first read or\n * by the first decision.\n \n READ is open to every member of the firm, deliberately: the people the feed is about are entitled to know whether\n * their employer collects it (GDPR Art. 13 / 88(2)), and the settings row says nothing about any client.\n /\nexport const serviceProviderActivityFeedSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<\n typeof ServiceProviderActivityFeedSettings_Operations,\n ActivityFeedSettingsCoreOperations,\n typeof ServiceProviderActivityFeedSettingsSchema\n >({\n mainSchema: ServiceProviderActivityFeedSettingsSchema,\n resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n /* The feed writer reads the firm's decision on a system context at audit time; the verbs upsert it as system. /\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n },\n /* The row holds ids, a status and timestamps — nothing an erasure could scrub. Kept as the record of the decision. /\n retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n /\n * NO retention binding, deliberately: this row is the firm's LIVE configuration, not a record, and it lives as long as\n * the organization (purged with it). A binding counted from its last change would delete an ENABLED decision nobody\n * changed for the audit-log period, and the feed would stop silently; its next read would then materialize DISABLED.\n * The evidence of each decision is the SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED audit event, which lives under the\n * audit trail's own retention. The startup gap report lists it as kept until erased, which is what it is.\n /\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n coreOperations: SETTINGS_CORE_OPERATIONS,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n\n /\n READ of a firm that never decided materializes its row, DISABLED and with no decision recorded (the backend's\n * READ postfix), so the settings page always has one row to show and to act on.\n /\n\n /\n Switch the feed on. The firm owner's verb, with step-up, and refused unless the person confirms they were\n * shown that works-council or CSE consultation and employee notice may be required first. Creates the row if the\n * firm never read it.\n /\n [ServiceProviderActivityFeedSettings_Operations.ENABLE]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_OWNER],\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requiresStepUpAuthentication: true,\n requestDto: z.object({\n acknowledgedWorkerConsultationNotice: z.boolean()\n .describe('Confirms you were told that switching on activity monitoring of your staff may require consulting your works council or CSE and informing employees first.'),\n }),\n }],\n },\n\n /* Switch the feed off. Entries already written stay until their retention ends. /\n [ServiceProviderActivityFeedSettings_Operations.DISABLE]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_OWNER],\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: z.object({}),\n }],\n },\n },\n });\n\n/\n The firm's feed entries (#1632). Read by the firm's administrators; written by the engine only.\n \n An ordinary organization-scoped resource, so the application's own authorization decides which of the firm's\n * people see it — the framework adds no second rule, and models no ethical wall of its own.\n /\nexport const serviceProviderActivityFeedResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<\n undefined,\n ActivityFeedCoreOperations,\n typeof ServiceProviderActivityFeedEntrySchema\n >({\n mainSchema: ServiceProviderActivityFeedEntrySchema,\n resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n /\n `expertUserId` is a foreign key to USERS, so these rows are on the expert's subject-export graph. ALLOWED: this\n * is monitoring data ABOUT that person, which is exactly what their right of access reaches (GDPR Art. 15), and\n * it names no client content.\n /\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n },\n /\n RETAIN_ONLY: an entry is ids, two types, a timestamp and an outcome — nothing an erasure could scrub. Frozen\n * and hidden on the expert's erasure, and gone when its retention ends.\n /\n retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n /\n OPERATIONAL_LOGS from creation: monitoring data is kept for the SHORTEST period the application declares. The\n * detailed evidence of what happened stays in the client's own audit trail, under the client's retention.\n */\n retentionBinding: { retentionClass: DataRetentionClass.OPERATIONAL_LOGS, startPoint: RetentionStartPoint.CREATED },\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n coreOperations: CORE_OPERATIONS,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.COUNT]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n },\n });\n"]}
1	+ {"version":3,"file":"service-provider-activity-feed.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-activity-feed.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sCAAsC,EACtC,yCAAyC,EACzC,8CAA8C,GAC/C,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAWlH,MAAM,eAAe,GAAiC;IACpD,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,KAAK;IAC3B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAiBF,MAAM,wBAAwB,GAAyC;IACrE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8EAA8E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC/I,0CAA0C,CAIxC;IACA,UAAU,EAAE,yCAAyC;IACrD,kBAAkB,EAAE,gBAAgB,CAAC,uCAAuC;IAC5E,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,uCAAuC,CAAC;IACrH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kHAAkH;IAClH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;KAC7C;IACD,uHAAuH;IACvH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;;;;OAMG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,wBAAwB;IACxC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SACnK;QAED;;;WAGG;QAEH;;;;WAIG;QACH,CAAC,8CAA8C,CAAC,MAAM,CAAC,EAAE;YACvD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE;6BAC9C,QAAQ,CAAC,4JAA4J,CAAC;qBAC1K,CAAC;iBACH,CAAC;SACH;QAED,oFAAoF;QACpF,CAAC,8CAA8C,CAAC,OAAO,CAAC,EAAE;YACxD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sEAAsE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACvI,0CAA0C,CAIxC;IACA,UAAU,EAAE,sCAAsC;IAClD,kBAAkB,EAAE,gBAAgB,CAAC,8BAA8B;IACnE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IAC5G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;QAC5C;;;;WAIG;QACH,aAAa,EAAE,wBAAwB,CAAC,OAAO;KAChD;IACD;;;OAGG;IACH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;OAGG;IACH,gBAAgB,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE;IAClH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,eAAe;IAC/B,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n The firm's expert-activity feed — resource configurations for its two resources (#1632).\n \n Both live in the PROVIDER organization. Neither has a client-facing write: the settings row changes only through\n * the firm owner's `enable` / `disable`, and a feed entry is written by the engine at audit time. See\n * `service-provider-activity-feed.shared.schemas.ts` for the model and why it is metadata only.\n /\n\nimport { z } from 'zod';\nimport {\n ServiceProviderActivityFeedEntrySchema,\n ServiceProviderActivityFeedSettingsSchema,\n ServiceProviderActivityFeedSettings_Operations,\n} from './service-provider-activity-feed.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\n\ntype ActivityFeedCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.COUNT\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.UPDATE_MANY\n \| CoreResourceOperation.DELETE;\n\nconst CORE_OPERATIONS: ActivityFeedCoreOperations[] = [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.COUNT,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n];\n\n/\n The settings row is a context-addressed SINGLETON (a 1:1 composition of the organization): its READ route is the\n * collection path itself (`/organizations/{organizationId}/service-provider-activity-feed-setting`). A public LIST would\n * be mounted on that SAME path and verb, so two handlers would compete for one route. Its LIST is therefore route-less\n * (INTERNAL_CALL): it exists only because the retention policy's see-through read (`listRetainedAsSystem`) surfaces\n * retained rows through LIST. There is no COUNT.\n /\ntype ActivityFeedSettingsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.UPDATE_MANY\n \| CoreResourceOperation.DELETE;\n\nconst SETTINGS_CORE_OPERATIONS: ActivityFeedSettingsCoreOperations[] = [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n];\n\n/\n * Both resources carry the same route-less plumbing, INLINED in each configuration because contextual typing needs\n * the literal in place (the relationship configurations record the same constraint): the SYSTEM door the engine\n * writes through (`createAsSystem` / `updateAsSystem` resolve the default CREATE / UPDATE), the retention writer's\n * UPDATE_MANY, and the DELETE the organization purge cascade and the retention sweep use. INTERNAL_CALL registers no\n * route.\n /\n\n/\n The firm's decision about its feed (#1632). One row per PROVIDER organization, created DISABLED by its first read or\n * by the first decision.\n \n READ is open to every member of the firm, deliberately: the people the feed is about are entitled to know whether\n * their employer collects it (GDPR Art. 13 / 88(2)), and the settings row says nothing about any client.\n /\nexport const serviceProviderActivityFeedSettingsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<\n typeof ServiceProviderActivityFeedSettings_Operations,\n ActivityFeedSettingsCoreOperations,\n typeof ServiceProviderActivityFeedSettingsSchema\n >({\n mainSchema: ServiceProviderActivityFeedSettingsSchema,\n resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n /* The feed writer reads the firm's decision on a system context at audit time; the verbs upsert it as system. /\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n },\n /* The row holds ids, a status and timestamps — nothing an erasure could scrub. Kept as the record of the decision. /\n retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n /\n * NO retention binding, deliberately: this row is the firm's LIVE configuration, not a record, and it lives as long as\n * the organization (purged with it). A binding counted from its last change would delete an ENABLED decision nobody\n * changed for the audit-log period, and the feed would stop silently; its next read would then materialize DISABLED.\n * The evidence of each decision is the SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED audit event, which lives under the\n * audit trail's own retention. The startup gap report lists it as kept until erased, which is what it is.\n /\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n coreOperations: SETTINGS_CORE_OPERATIONS,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_MEMBER], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n\n /\n READ of a firm that never decided materializes its row, DISABLED and with no decision recorded (the backend's\n * READ postfix), so the settings page always has one row to show and to act on.\n /\n\n /\n Switch the feed on. The firm owner's verb, with step-up, and refused unless the person confirms they were\n * shown that works-council or CSE consultation and employee notice may be required first. Creates the row if the\n * firm never read it.\n /\n [ServiceProviderActivityFeedSettings_Operations.ENABLE]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_OWNER],\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requiresStepUpAuthentication: true,\n requestDto: z.object({\n acknowledgedWorkerConsultationNotice: z.boolean()\n .describe('Confirms you were told that switching on activity monitoring of your staff may require consulting your works council or CSE and informing employees first.'),\n }),\n }],\n },\n\n /* Switch the feed off. Entries already written stay until their retention ends. /\n [ServiceProviderActivityFeedSettings_Operations.DISABLE]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_OWNER],\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: z.object({}),\n }],\n },\n },\n });\n\n/\n The firm's feed entries (#1632). Read by the firm's administrators; written by the engine only.\n \n An ordinary organization-scoped resource, so the application's own authorization decides which of the firm's\n * people see it — the framework adds no second rule, and models no ethical wall of its own.\n /\nexport const serviceProviderActivityFeedResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<\n undefined,\n ActivityFeedCoreOperations,\n typeof ServiceProviderActivityFeedEntrySchema\n >({\n mainSchema: ServiceProviderActivityFeedEntrySchema,\n resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n /\n `expertUserId` is a foreign key to USERS, so these rows are on the expert's subject-export graph. ALLOWED: this\n * is monitoring data ABOUT that person, which is exactly what their right of access reaches (GDPR Art. 15), and\n * it names no client content.\n /\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n },\n /\n RETAIN_ONLY: an entry is ids, two types, a timestamp and an outcome — nothing an erasure could scrub. Frozen\n * and hidden on the expert's erasure, and gone when its retention ends.\n /\n retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n /\n OPERATIONAL_LOGS from creation: monitoring data is kept for the SHORTEST period the application declares. The\n * detailed evidence of what happened stays in the client's own audit trail, under the client's retention.\n */\n retentionBinding: { retentionClass: DataRetentionClass.OPERATIONAL_LOGS, startPoint: RetentionStartPoint.CREATED },\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n coreOperations: CORE_OPERATIONS,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.COUNT]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n },\n });\n"]}

package/dist/esm/organizations/service-provider-activity-feed.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-activity-feed.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/organizations/service-provider-activity-feed.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,wIAAwI;AACxI;;;;;GAKG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,QAAQ,aAAa;IACrB,gGAAgG;IAChG,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH,oBAAY,8BAA8B;IACxC,4DAA4D;IAC5D,SAAS,cAAc;IACvB,yGAAyG;IACzG,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yCAAyC;;;;;;;;;iBAuBpD,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;GAMG;AACH,eAAO,MAAM,6CAA6C;IACxD,oEAAoE;;IAEpE,mCAAmC;;IAEnC,sGAAsG;;IAEtG,iDAAiD;;;IAGjD,4DAA4D;;IAE5D,8CAA8C;;IAE9C,kFAAkF;;kBAElF,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AAEpH;;;GAGG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;iBAYjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,+CAA+C;AAC/C,oBAAY,8CAA8C;IACxD,8GAA8G;IAC9G,MAAM,WAAW;IACjB,qGAAqG;IACrG,OAAO,YAAY;CACpB;AACD,sFAAsF"}
1	+ {"version":3,"file":"service-provider-activity-feed.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-activity-feed.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,wIAAwI;AACxI;;;;;GAKG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,QAAQ,aAAa;IACrB,gGAAgG;IAChG,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH,oBAAY,8BAA8B;IACxC,4DAA4D;IAC5D,SAAS,cAAc;IACvB,yGAAyG;IACzG,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yCAAyC;;;;;;;;;iBAuBpD,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;GAMG;AACH,eAAO,MAAM,6CAA6C;IACxD,oEAAoE;;IAEpE,mCAAmC;;IAEnC,sGAAsG;;IAEtG,iDAAiD;;;IAGjD,4DAA4D;;IAE5D,8CAA8C;;IAE9C,kFAAkF;;kBAElF,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AAEpH;;;GAGG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;iBAYjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,+CAA+C;AAC/C,oBAAY,8CAA8C;IACxD,8GAA8G;IAC9G,MAAM,WAAW;IACjB,qGAAqG;IACrG,OAAO,YAAY;CACpB;AACD,sFAAsF"}

package/dist/esm/organizations/service-provider-activity-feed.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-activity-feed.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-activity-feed.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,wIAAwI;AACxI;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,0DAAqB,CAAA;IACrB,gGAAgG;IAChG,wDAAmB,CAAA;AACrB,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,8BAKX;AALD,WAAY,8BAA8B;IACxC,4DAA4D;IAC5D,yDAAuB,CAAA;IACvB,yGAAyG;IACzG,qDAAmB,CAAA;AACrB,CAAC,EALW,8BAA8B,KAA9B,8BAA8B,QAKzC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,oGAAoG;IACpG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAChI,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAC9C,UAAU,CAAC,mCAAmC,CAAC;SAC/C,OAAO,CAAC,iCAAiC,CAAC,QAAQ,CAAC;SACnD,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IACpB,oDAAoD;IACpD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,yGAAyG;IACzG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACzG;;;;OAIG;IACH,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC1H,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1E,oEAAoE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,sGAAsG;IACtG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,iDAAiD;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,4DAA4D;IAC5D,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,8CAA8C;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACjG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE;IACnE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACrH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACpE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5I,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,+CAA+C;AAC/C,MAAM,CAAN,IAAY,8CAKX;AALD,WAAY,8CAA8C;IACxD,8GAA8G;IAC9G,mEAAiB,CAAA;IACjB,qGAAqG;IACrG,qEAAmB,CAAA;AACrB,CAAC,EALW,8CAA8C,KAA9C,8CAA8C,QAKzD;AACD,sFAAsF","sourcesContent":["/*\n The firm's EXPERT-ACTIVITY FEED (#1632): an opt-in, metadata-only record, in the PROVIDER organization, of what its\n * own experts did inside client organizations.\n \n ## Why it exists, and why it is shaped this way\n \n Under #1597 an expert's actions are recorded in the CLIENT's audit trail, attributed to the relationship. The firm is\n * accountable for its staff and runs on operating metrics, and it cannot read that trail: it is another tenant's. The\n * field's answer is the shape Microsoft Partner Center gives a partner — an activity log of its own delegated actions\n * (date, affected customer, action, partner user) while the detailed in-tenant trail stays in the customer's tenant.\n \n Three constraints decide everything below:\n \n - No client content, ever. A firm acting for a client acts on the client's documented instructions (GDPR\n * Art. 28(3)(a)); a firm-wide view of client content would make the firm decide purposes of its own over that data\n * (Art. 28(10)). So an entry carries operation TYPES, resource TYPES, ids of the parties — never a record id, a\n * field value, free text or a payload. {@link ServiceProviderActivityFeedEntryContentSchema} is STRICT so a new\n * field is a deliberate schema change rather than a spread.\n * - It is worker monitoring. Collecting it is the FIRM's decision, recorded with who, when, and the fact that it\n * was told consultation may be owed (BetrVG §87(1) no. 6; the CNIL's CSE consultation). The framework RECORDS the\n * decision and does not judge its lawfulness. Off by default, with no row needed for \"off\".\n * - The client can narrow or stop it for its own tenant, per relationship\n * (`ServiceProviderRelationship.activityFeedDisclosure`). An entry is written only when both sides allow it.\n \n Entries are written by the engine at AUDIT time, from the same attribution the audit writer already resolves for\n * the client's own row — never through a client-facing verb.\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\n\n/* @wildo_source:part:start saas.models.organizations.service-provider-activity-feed facet:layer:shared facet:audience:app-developer /\n/\n Whether the FIRM collects activity metadata about its own experts' work in client organizations (#1632).\n \n The absence of a settings row means {@link DISABLED}: switching the feed on is a recorded decision, and switching it\n * off again is one too.\n /\nexport enum ServiceProviderActivityFeedStatus {\n /* No feed entry is written, whatever a client allows. The default. /\n DISABLED = 'DISABLED',\n /* Entries are written for every client whose relationship's disclosure level is not `NONE`. /\n ENABLED = 'ENABLED',\n}\n\n/\n How an expert's operation in a client ended, as the firm's feed may say it (#1632).\n \n Its own vocabulary rather than the SIEM envelope's success/failure: this is what the FIRM is told about an act\n * performed elsewhere, and a client at `OPERATION_TYPE_ONLY` withholds it entirely.\n /\nexport enum ServiceProviderActivityOutcome {\n /* The operation took effect in the client organization. /\n SUCCEEDED = 'SUCCEEDED',\n /* The client organization refused the operation (authorization, a policy gate). Nothing took effect. /\n REFUSED = 'REFUSED',\n}\n\n/\n The firm's decision about its feed. One row per PROVIDER organization: a singleton the backend creates, DISABLED and\n * with no decision recorded, the first time the firm reads it or decides. An absent row still reads as\n * {@link ServiceProviderActivityFeedStatus.DISABLED}, which is what the feed writer relies on.\n /\nexport const ServiceProviderActivityFeedSettingsSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n /* The PROVIDER organization — the firm whose staff the feed is about. One row per organization. /\n organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n status: z.enum(ServiceProviderActivityFeedStatus)\n .systemEnum('ServiceProviderActivityFeedStatus')\n .default(ServiceProviderActivityFeedStatus.DISABLED)\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n /* The firm owner who made the current decision. /\n decidedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n /* When the current decision was made — for a firm's employee privacy information, \"collected since\". /\n decidedAt: z.date().optional().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n /\n Whether the person who ENABLED the feed was shown that works-council or CSE consultation and employee notice may\n * be required before switching it on. Recorded, never judged: the framework states the notice and records that it\n * was shown; whether consultation happened is the firm's to establish.\n /\n acknowledgedWorkerConsultationNotice: z.boolean().default(false).excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n createdAt: z.date().optional(),\n updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedSettings = z.infer<typeof ServiceProviderActivityFeedSettingsSchema>;\n\n/\n EVERYTHING a feed entry may say, and nothing else (#1632). Strict: an unknown key is refused, so widening what the\n * firm learns about client work is a deliberate change to this schema — never a spread of a richer object.\n \n Deliberately absent: the record id, field names or values, the request payload, free text, and anything the\n * client's own trail marks `.isAuditEvidence()`.\n /\nexport const ServiceProviderActivityFeedEntryContentSchema = z.strictObject({\n /* The PROVIDER organization — the firm the entry is written to. /\n organizationId: z.string().min(1),\n /* The firm's expert who acted. /\n expertUserId: z.string().min(1),\n /* The CLIENT organization the expert acted in. A plain id: the firm cannot read the client's row. /\n clientOrganizationId: z.string().min(1),\n /* The relationship the expert acted through. /\n relationshipId: z.string().min(1),\n occurredAt: z.date(),\n /* The operation TYPE (e.g. UPDATE), never which record. /\n operationKind: z.enum(CoreResourceOperation),\n /* The resource TYPE the operation was on. /\n resourceType: z.string().min(1),\n /* Present only when the client's disclosure level is `OPERATION_AND_OUTCOME`. /\n outcome: z.enum(ServiceProviderActivityOutcome).optional(),\n});\nexport type ServiceProviderActivityFeedEntryContent = z.infer<typeof ServiceProviderActivityFeedEntryContentSchema>;\n\n/\n One feed entry as stored in the PROVIDER organization: the strict content plus the row's own identity. Written by\n * the engine only; no client-facing verb creates, changes or deletes one.\n /\nexport const ServiceProviderActivityFeedEntrySchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n expertUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n clientOrganizationId: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),\n relationshipId: z.string().min(1).isDBIndexed().excludeFromUpdate(),\n occurredAt: z.date().isDBIndexed().isSummaryField().excludeFromUpdate(),\n operationKind: z.enum(CoreResourceOperation).systemEnum('CoreResourceOperation').isSummaryField().excludeFromUpdate(),\n resourceType: z.string().min(1).isSummaryField().excludeFromUpdate(),\n outcome: z.enum(ServiceProviderActivityOutcome).systemEnum('ServiceProviderActivityOutcome').optional().isSummaryField().excludeFromUpdate(),\n createdAt: z.date().isDBIndexed().optional(),\n updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedEntry = z.infer<typeof ServiceProviderActivityFeedEntrySchema>;\n\n/* The firm's two decisions about its feed. /\nexport enum ServiceProviderActivityFeedSettings_Operations {\n /* Firm ORG_OWNER switches the feed on (step-up). Refused unless the consultation notice was acknowledged. /\n ENABLE = 'enable',\n /* Firm ORG_OWNER switches the feed off. Entries already written stay until their retention ends. /\n DISABLE = 'disable',\n}\n/* @wildo_source:part:end saas.models.organizations.service-provider-activity-feed */\n"]}
1	+ {"version":3,"file":"service-provider-activity-feed.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-activity-feed.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,wIAAwI;AACxI;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,0DAAqB,CAAA;IACrB,gGAAgG;IAChG,wDAAmB,CAAA;AACrB,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,8BAKX;AALD,WAAY,8BAA8B;IACxC,4DAA4D;IAC5D,yDAAuB,CAAA;IACvB,yGAAyG;IACzG,qDAAmB,CAAA;AACrB,CAAC,EALW,8BAA8B,KAA9B,8BAA8B,QAKzC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,oGAAoG;IACpG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAChI,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAC9C,UAAU,CAAC,mCAAmC,CAAC;SAC/C,OAAO,CAAC,iCAAiC,CAAC,QAAQ,CAAC;SACnD,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IACpB,oDAAoD;IACpD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,yGAAyG;IACzG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACzG;;;;OAIG;IACH,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC1H,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1E,oEAAoE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,sGAAsG;IACtG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,iDAAiD;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,4DAA4D;IAC5D,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,8CAA8C;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,kFAAkF;IAClF,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACjG,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE;IACnE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACrH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACpE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5I,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,+CAA+C;AAC/C,MAAM,CAAN,IAAY,8CAKX;AALD,WAAY,8CAA8C;IACxD,8GAA8G;IAC9G,mEAAiB,CAAA;IACjB,qGAAqG;IACrG,qEAAmB,CAAA;AACrB,CAAC,EALW,8CAA8C,KAA9C,8CAA8C,QAKzD;AACD,sFAAsF","sourcesContent":["/*\n The firm's EXPERT-ACTIVITY FEED (#1632): an opt-in, metadata-only record, in the PROVIDER organization, of what its\n * own experts did inside client organizations.\n \n ## Why it exists, and why it is shaped this way\n \n Under #1597 an expert's actions are recorded in the CLIENT's audit trail, attributed to the relationship. The firm is\n * accountable for its staff and runs on operating metrics, and it cannot read that trail: it is another tenant's. The\n * field's answer is the shape Microsoft Partner Center gives a partner — an activity log of its own delegated actions\n * (date, affected customer, action, partner user) while the detailed in-tenant trail stays in the customer's tenant.\n \n Three constraints decide everything below:\n \n - No client content, ever. A firm acting for a client acts on the client's documented instructions (GDPR\n * Art. 28(3)(a)); a firm-wide view of client content would make the firm decide purposes of its own over that data\n * (Art. 28(10)). So an entry carries operation TYPES, resource TYPES, ids of the parties — never a record id, a\n * field value, free text or a payload. {@link ServiceProviderActivityFeedEntryContentSchema} is STRICT so a new\n * field is a deliberate schema change rather than a spread.\n * - It is worker monitoring. Collecting it is the FIRM's decision, recorded with who, when, and the fact that it\n * was told consultation may be owed (BetrVG §87(1) no. 6; the CNIL's CSE consultation). The framework RECORDS the\n * decision and does not judge its lawfulness. Off by default, with no row needed for \"off\".\n * - The client can narrow or stop it for its own tenant, per relationship\n * (`ServiceProviderRelationship.activityFeedDisclosure`). An entry is written only when both sides allow it.\n \n Entries are written by the engine at AUDIT time, from the same attribution the audit writer already resolves for\n * the client's own row — never through a client-facing verb.\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\n\n/* @wildo_source:part:start saas.models.organizations.service-provider-activity-feed facet:layer:shared facet:audience:app-developer /\n/\n Whether the FIRM collects activity metadata about its own experts' work in client organizations (#1632).\n \n The absence of a settings row means {@link DISABLED}: switching the feed on is a recorded decision, and switching it\n * off again is one too.\n /\nexport enum ServiceProviderActivityFeedStatus {\n /* No feed entry is written, whatever a client allows. The default. /\n DISABLED = 'DISABLED',\n /* Entries are written for every client whose relationship's disclosure level is not `NONE`. /\n ENABLED = 'ENABLED',\n}\n\n/\n How an expert's operation in a client ended, as the firm's feed may say it (#1632).\n \n Its own vocabulary rather than the SIEM envelope's success/failure: this is what the FIRM is told about an act\n * performed elsewhere, and a client at `OPERATION_TYPE_ONLY` withholds it entirely.\n /\nexport enum ServiceProviderActivityOutcome {\n /* The operation took effect in the client organization. /\n SUCCEEDED = 'SUCCEEDED',\n /* The client organization refused the operation (authorization, a policy gate). Nothing took effect. /\n REFUSED = 'REFUSED',\n}\n\n/\n The firm's decision about its feed. One row per PROVIDER organization: a singleton the backend creates, DISABLED and\n * with no decision recorded, the first time the firm reads it or decides. An absent row still reads as\n * {@link ServiceProviderActivityFeedStatus.DISABLED}, which is what the feed writer relies on.\n /\nexport const ServiceProviderActivityFeedSettingsSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n /* The PROVIDER organization — the firm whose staff the feed is about. One row per organization. /\n organizationId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n status: z.enum(ServiceProviderActivityFeedStatus)\n .systemEnum('ServiceProviderActivityFeedStatus')\n .default(ServiceProviderActivityFeedStatus.DISABLED)\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n /* The firm owner who made the current decision. /\n decidedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n /* When the current decision was made — for a firm's employee privacy information, \"collected since\". /\n decidedAt: z.date().optional().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n /\n Whether the person who ENABLED the feed was shown that works-council or CSE consultation and employee notice may\n * be required before switching it on. Recorded, never judged: the framework states the notice and records that it\n * was shown; whether consultation happened is the firm's to establish.\n /\n acknowledgedWorkerConsultationNotice: z.boolean().default(false).excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n createdAt: z.date().optional(),\n updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedSettings = z.infer<typeof ServiceProviderActivityFeedSettingsSchema>;\n\n/\n EVERYTHING a feed entry may say, and nothing else (#1632). Strict: an unknown key is refused, so widening what the\n * firm learns about client work is a deliberate change to this schema — never a spread of a richer object.\n \n Deliberately absent: the record id, field names or values, the request payload, free text, and anything the\n * client's own trail marks `.isAuditEvidence()`.\n /\nexport const ServiceProviderActivityFeedEntryContentSchema = z.strictObject({\n /* The PROVIDER organization — the firm the entry is written to. /\n organizationId: z.string().min(1),\n /* The firm's expert who acted. /\n expertUserId: z.string().min(1),\n /* The CLIENT organization the expert acted in. A plain id: the firm cannot read the client's row. /\n clientOrganizationId: z.string().min(1),\n /* The relationship the expert acted through. /\n relationshipId: z.string().min(1),\n occurredAt: z.date(),\n /* The operation TYPE (e.g. UPDATE), never which record. /\n operationKind: z.enum(CoreResourceOperation),\n /* The resource TYPE the operation was on. /\n resourceType: z.string().min(1),\n /* Present only when the client's disclosure level is `OPERATION_AND_OUTCOME`. /\n outcome: z.enum(ServiceProviderActivityOutcome).optional(),\n});\nexport type ServiceProviderActivityFeedEntryContent = z.infer<typeof ServiceProviderActivityFeedEntryContentSchema>;\n\n/\n One feed entry as stored in the PROVIDER organization: the strict content plus the row's own identity. Written by\n * the engine only; no client-facing verb creates, changes or deletes one.\n /\nexport const ServiceProviderActivityFeedEntrySchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n expertUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n clientOrganizationId: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),\n relationshipId: z.string().min(1).isDBIndexed().excludeFromUpdate(),\n occurredAt: z.date().isDBIndexed().isSummaryField().excludeFromUpdate(),\n operationKind: z.enum(CoreResourceOperation).systemEnum('CoreResourceOperation').isSummaryField().excludeFromUpdate(),\n resourceType: z.string().min(1).isSummaryField().excludeFromUpdate(),\n outcome: z.enum(ServiceProviderActivityOutcome).systemEnum('ServiceProviderActivityOutcome').optional().isSummaryField().excludeFromUpdate(),\n createdAt: z.date().isDBIndexed().optional(),\n updatedAt: z.date().optional(),\n});\nexport type ServiceProviderActivityFeedEntry = z.infer<typeof ServiceProviderActivityFeedEntrySchema>;\n\n/* The firm's two decisions about its feed. /\nexport enum ServiceProviderActivityFeedSettings_Operations {\n /* Firm ORG_OWNER switches the feed on (step-up). Refused unless the consultation notice was acknowledged. /\n ENABLE = 'enable',\n /* Firm ORG_OWNER switches the feed off. Entries already written stay until their retention ends. /\n DISABLE = 'disable',\n}\n/* @wildo_source:part:end saas.models.organizations.service-provider-activity-feed */\n"]}

package/dist/esm/organizations/service-provider-capability-grants.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-capability-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/organizations/service-provider-capability-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EAEjC,oCAAoC,EACpC,0CAA0C,EAC3C,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAUjC,eAAO,MAAM,0EAA0E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;kBAqIrI,CAAC"}
1	+ {"version":3,"file":"service-provider-capability-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-capability-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EAEjC,oCAAoC,EACpC,0CAA0C,EAC3C,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAUjC,eAAO,MAAM,0EAA0E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;kBAqIrI,CAAC"}

package/dist/esm/organizations/service-provider-capability-grants.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-capability-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-capability-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAWlH,oHAAoH;AACpH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IACrD,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0EAA0E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC3I,0CAA0C,CAIxC;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,kCAAkC;IACvE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,kCAAkC,CAAC;IAChH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB;;;;OAIG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;KAC7C;IACD,sHAAsH;IACtH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;;OAIG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;QAC7C,gBAAgB,EAAE,SAAS;KAC5B;IACD,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,KAAK,CAAC,EAAE;YAClD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,uBAAuB,CAAC,EAAE;YACpE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED,8GAA8G;QAC9G,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;iBAC9G,CAAC;SACH;QAED;;;WAGG;QACH,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n `SERVICE_PROVIDER_CAPABILITY_GRANTS` — the client's delegated administrative capabilities, one row per grant (#1631).\n \n Stored in the CLIENT organization, which lends them; the firm has no verb on this resource and reads what it holds on\n * its engagement mirror. There is no generic CREATE or UPDATE: the verbs author every field, which is what makes a row\n * evidence rather than a form.\n \n Two grant verbs rather than one with a role check inside: the ordinary `grant` is a client administrator's, the\n * security-critical `grantSecurityCritical` is the OWNER's with step-up. Declaring each as its own variant lets the\n * framework's role gate and step-up gate enforce the split, and the implementation refuses a capability sent to the\n * wrong verb (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`), so an administrator can never reach a security-critical\n * capability through the ordinary door.\n /\n\nimport { z } from 'zod';\nimport {\n DelegatedAdministrativeCapability,\n ServiceProviderCapabilityGrantSchema,\n ServiceProviderCapabilityGrantStatus,\n ServiceProviderCapabilityGrants_Operations,\n} from './service-provider-capability-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\n\ntype CapabilityGrantCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.COUNT\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.UPDATE_MANY\n \| CoreResourceOperation.DELETE;\n\n/* What a grant request carries: the relationship, the capability and when it ends. The rest is server-authored. /\nconst grantRequestDto = z.object({\n relationshipId: z.string().min(1),\n capability: z.enum(DelegatedAdministrativeCapability),\n /* Required: a delegation always ends. At most two years, or the security-critical cap. /\n endsAt: z.coerce.date(),\n});\n\nexport const serviceProviderCapabilityGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<\n typeof ServiceProviderCapabilityGrants_Operations,\n CapabilityGrantCoreOperations,\n typeof ServiceProviderCapabilityGrantSchema\n >({\n mainSchema: ServiceProviderCapabilityGrantSchema,\n resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n /\n `read` / `list` are ALLOWED because the execution-context live filter reads grants on a system context to decide a\n * caller's authority — the caller is, by construction, not yet authorized. `update` is the verbs' system door for the\n * mirror sync and the relationship-end revocation.\n /\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n },\n /* A grant holds ids, a capability, dates and a status — no personal text to scrub. Kept whole as access evidence. /\n retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n /\n The AUDIT_LOGS class from the moment the grant ENDS (#1613): who from outside could administer what, and when, is\n * what an access review asks years later. `endedAt` is set on revoke and on the sweep's relabel; while ACTIVE it is\n * null and the row never expires.\n /\n retentionBinding: {\n retentionClass: DataRetentionClass.AUDIT_LOGS,\n startPoint: RetentionStartPoint.CLOSURE_EVENT,\n closureFieldName: 'endedAt',\n },\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.COUNT,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n // The retention writer's verb, and the purge cascade's DELETE — no client route.\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n // The system door the verbs write through. INTERNAL_CALL registers no route.\n [CoreResourceOperation.CREATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.COUNT]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n\n /\n A client administrator lends one ORDINARY capability to a live relationship, for at most two years. A\n * security-critical capability sent here is refused (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`).\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — delegated administration is named, time-bound and client-revocable.\n /\n [ServiceProviderCapabilityGrants_Operations.GRANT]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: grantRequestDto,\n }],\n },\n\n /\n The client OWNER lends one SECURITY-CRITICAL capability, with step-up, for a task-sized window (30 days at most,\n * or the application's lower cap). There is no renewal: a new window is a new grant by an owner.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a capability that decides who can sign in or act as the client is lent only by its owner, briefly.\n /\n [ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_OWNER],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requiresStepUpAuthentication: true,\n requestDto: grantRequestDto,\n }],\n },\n\n /* A client administrator revokes a grant — any grant, at any time, without asking the firm. Next request. /\n [ServiceProviderCapabilityGrants_Operations.REVOKE]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderCapabilityGrantStatus.ACTIVE,\n }],\n },\n\n /\n ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. Bookkeeping: the grant already\n * stopped conferring at `endsAt`, which is what admission reads.\n */\n [ServiceProviderCapabilityGrants_Operations.EXPIRE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({}),\n }],\n },\n },\n });\n"]}
1	+ {"version":3,"file":"service-provider-capability-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-capability-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAWlH,oHAAoH;AACpH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IACrD,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0EAA0E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC3I,0CAA0C,CAIxC;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,kCAAkC;IACvE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,kCAAkC,CAAC;IAChH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB;;;;OAIG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;KAC7C;IACD,sHAAsH;IACtH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;;OAIG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;QAC7C,gBAAgB,EAAE,SAAS;KAC5B;IACD,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,KAAK,CAAC,EAAE;YAClD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,uBAAuB,CAAC,EAAE;YACpE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED,8GAA8G;QAC9G,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;iBAC9G,CAAC;SACH;QAED;;;WAGG;QACH,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n `SERVICE_PROVIDER_CAPABILITY_GRANTS` — the client's delegated administrative capabilities, one row per grant (#1631).\n \n Stored in the CLIENT organization, which lends them; the firm has no verb on this resource and reads what it holds on\n * its engagement mirror. There is no generic CREATE or UPDATE: the verbs author every field, which is what makes a row\n * evidence rather than a form.\n \n Two grant verbs rather than one with a role check inside: the ordinary `grant` is a client administrator's, the\n * security-critical `grantSecurityCritical` is the OWNER's with step-up. Declaring each as its own variant lets the\n * framework's role gate and step-up gate enforce the split, and the implementation refuses a capability sent to the\n * wrong verb (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`), so an administrator can never reach a security-critical\n * capability through the ordinary door.\n /\n\nimport { z } from 'zod';\nimport {\n DelegatedAdministrativeCapability,\n ServiceProviderCapabilityGrantSchema,\n ServiceProviderCapabilityGrantStatus,\n ServiceProviderCapabilityGrants_Operations,\n} from './service-provider-capability-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\n\ntype CapabilityGrantCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.COUNT\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.UPDATE_MANY\n \| CoreResourceOperation.DELETE;\n\n/* What a grant request carries: the relationship, the capability and when it ends. The rest is server-authored. /\nconst grantRequestDto = z.object({\n relationshipId: z.string().min(1),\n capability: z.enum(DelegatedAdministrativeCapability),\n /* Required: a delegation always ends. At most two years, or the security-critical cap. /\n endsAt: z.coerce.date(),\n});\n\nexport const serviceProviderCapabilityGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<\n typeof ServiceProviderCapabilityGrants_Operations,\n CapabilityGrantCoreOperations,\n typeof ServiceProviderCapabilityGrantSchema\n >({\n mainSchema: ServiceProviderCapabilityGrantSchema,\n resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n /\n `read` / `list` are ALLOWED because the execution-context live filter reads grants on a system context to decide a\n * caller's authority — the caller is, by construction, not yet authorized. `update` is the verbs' system door for the\n * mirror sync and the relationship-end revocation.\n /\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n },\n /* A grant holds ids, a capability, dates and a status — no personal text to scrub. Kept whole as access evidence. /\n retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n /\n The AUDIT_LOGS class from the moment the grant ENDS (#1613): who from outside could administer what, and when, is\n * what an access review asks years later. `endedAt` is set on revoke and on the sweep's relabel; while ACTIVE it is\n * null and the row never expires.\n /\n retentionBinding: {\n retentionClass: DataRetentionClass.AUDIT_LOGS,\n startPoint: RetentionStartPoint.CLOSURE_EVENT,\n closureFieldName: 'endedAt',\n },\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.COUNT,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n // The retention writer's verb, and the purge cascade's DELETE — no client route.\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n },\n // The system door the verbs write through. INTERNAL_CALL registers no route.\n [CoreResourceOperation.CREATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n },\n [CoreResourceOperation.READ]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n [CoreResourceOperation.COUNT]: {\n variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n },\n\n /\n A client administrator lends one ORDINARY capability to a live relationship, for at most two years. A\n * security-critical capability sent here is refused (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`).\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — delegated administration is named, time-bound and client-revocable.\n /\n [ServiceProviderCapabilityGrants_Operations.GRANT]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: grantRequestDto,\n }],\n },\n\n /\n The client OWNER lends one SECURITY-CRITICAL capability, with step-up, for a task-sized window (30 days at most,\n * or the application's lower cap). There is no renewal: a new window is a new grant by an owner.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a capability that decides who can sign in or act as the client is lent only by its owner, briefly.\n /\n [ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_OWNER],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requiresStepUpAuthentication: true,\n requestDto: grantRequestDto,\n }],\n },\n\n /* A client administrator revokes a grant — any grant, at any time, without asking the firm. Next request. /\n [ServiceProviderCapabilityGrants_Operations.REVOKE]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderCapabilityGrantStatus.ACTIVE,\n }],\n },\n\n /\n ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. Bookkeeping: the grant already\n * stopped conferring at `endsAt`, which is what admission reads.\n */\n [ServiceProviderCapabilityGrants_Operations.EXPIRE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({}),\n }],\n },\n },\n });\n"]}

package/dist/esm/organizations/service-provider-capability-grants.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-capability-grants.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA4B,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,cAAc,mBAAmB;IACjC;;;OAGG;IACH,2BAA2B,gCAAgC;IAC3D,kDAAkD;IAClD,gBAAgB,qBAAqB;IACrC,sFAAsF;IACtF,eAAe,oBAAoB;IACnC,oEAAoE;IACpE,eAAe,oBAAoB;IACnC,6GAA6G;IAC7G,qBAAqB,0BAA0B;CAChD;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,iCAAiC,EAAE,cAAc,CAAC,CAOxG,CAAC;AAEH,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAA6D,CAAC;AAEzH,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,EAAE,SAAS,iCAAiC,EAI/F,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,iCAAiC,EAOhG,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAEhE,8BAA8B;AAC9B,oBAAY,oCAAoC;IAC9C,mFAAmF;IACnF,MAAM,WAAW;IACjB,8EAA8E;IAC9E,OAAO,YAAY;IACnB,uGAAuG;IACvG,OAAO,YAAY;CACpB;AAED,4GAA4G;AAC5G,oBAAY,sCAAsC;IAChD,yCAAyC;IACzC,iBAAiB,sBAAsB;IACvC,6FAA6F;IAC7F,kBAAkB,uBAAuB;IACzC,8FAA8F;IAC9F,qBAAqB,0BAA0B;CAChD;AAED,gGAAgG;AAChG,oBAAY,0CAA0C;IACpD,4EAA4E;IAC5E,KAAK,UAAU;IACf,oGAAoG;IACpG,uBAAuB,0BAA0B;IACjD,kHAAkH;IAClH,MAAM,WAAW;IACjB,sFAAsF;IACtF,MAAM,WAAW;CAClB;AAED,yHAAyH;AACzH,oBAAY,uCAAuC;IACjD,kHAAkH;IAClH,iDAAiD,sDAAsD;IACvG,gHAAgH;IAChH,4CAA4C,iDAAiD;IAC7F,yEAAyE;IACzE,4CAA4C,iDAAiD;IAC7F,yFAAyF;IACzF,mEAAmE,wEAAwE;IAC3I,0HAA0H;IAC1H,2CAA2C,gDAAgD;IAC3F,uGAAuG;IACvG,uDAAuD,4DAA4D;CACpH;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,wBAAgB,0CAA0C,CACxD,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAC/F,GAAG,EAAE,IAAI,GACR,OAAO,CAKT;AAID;;;;;GAKG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE;IAChE,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,0CAA0C,CAAC,KAAK,GAAG,0CAA0C,CAAC,uBAAuB,CAAC;IACrI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,yEAAyE;IACzE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACpE,2GAA2G;IAC3G,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;CACnD,GACG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAA;CAAE,CAiBtF;AAED;;;GAGG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;iBAwC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,0CAA0C;;;iBAIrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,sGAAsG;AACtG,oBAAY,oCAAoC;IAC9C,uHAAuH;IACvH,0BAA0B,+BAA+B;IACzD,gJAAgJ;IAChJ,sCAAsC,2CAA2C;IACjF;;;OAGG;IACH,yCAAyC,8CAA8C;CACxF;AAED;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,8GAA8G;IAC9G,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;IACxE,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,6GAA6G;IAC7G,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD,GAAG;IAAE,UAAU,EAAE,iCAAiC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,oCAAoC,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAmBtI"}
1	+ {"version":3,"file":"service-provider-capability-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA4B,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,cAAc,mBAAmB;IACjC;;;OAGG;IACH,2BAA2B,gCAAgC;IAC3D,kDAAkD;IAClD,gBAAgB,qBAAqB;IACrC,sFAAsF;IACtF,eAAe,oBAAoB;IACnC,oEAAoE;IACpE,eAAe,oBAAoB;IACnC,6GAA6G;IAC7G,qBAAqB,0BAA0B;CAChD;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,iCAAiC,EAAE,cAAc,CAAC,CAOxG,CAAC;AAEH,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAA6D,CAAC;AAEzH,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,EAAE,SAAS,iCAAiC,EAI/F,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,iCAAiC,EAOhG,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAEhE,8BAA8B;AAC9B,oBAAY,oCAAoC;IAC9C,mFAAmF;IACnF,MAAM,WAAW;IACjB,8EAA8E;IAC9E,OAAO,YAAY;IACnB,uGAAuG;IACvG,OAAO,YAAY;CACpB;AAED,4GAA4G;AAC5G,oBAAY,sCAAsC;IAChD,yCAAyC;IACzC,iBAAiB,sBAAsB;IACvC,6FAA6F;IAC7F,kBAAkB,uBAAuB;IACzC,8FAA8F;IAC9F,qBAAqB,0BAA0B;CAChD;AAED,gGAAgG;AAChG,oBAAY,0CAA0C;IACpD,4EAA4E;IAC5E,KAAK,UAAU;IACf,oGAAoG;IACpG,uBAAuB,0BAA0B;IACjD,kHAAkH;IAClH,MAAM,WAAW;IACjB,sFAAsF;IACtF,MAAM,WAAW;CAClB;AAED,yHAAyH;AACzH,oBAAY,uCAAuC;IACjD,kHAAkH;IAClH,iDAAiD,sDAAsD;IACvG,gHAAgH;IAChH,4CAA4C,iDAAiD;IAC7F,yEAAyE;IACzE,4CAA4C,iDAAiD;IAC7F,yFAAyF;IACzF,mEAAmE,wEAAwE;IAC3I,0HAA0H;IAC1H,2CAA2C,gDAAgD;IAC3F,uGAAuG;IACvG,uDAAuD,4DAA4D;CACpH;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,wBAAgB,0CAA0C,CACxD,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAC/F,GAAG,EAAE,IAAI,GACR,OAAO,CAKT;AAID;;;;;GAKG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE;IAChE,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,0CAA0C,CAAC,KAAK,GAAG,0CAA0C,CAAC,uBAAuB,CAAC;IACrI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,yEAAyE;IACzE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACpE,2GAA2G;IAC3G,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;CACnD,GACG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAA;CAAE,CAiBtF;AAED;;;GAGG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;iBAwC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,0CAA0C;;;iBAIrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,sGAAsG;AACtG,oBAAY,oCAAoC;IAC9C,uHAAuH;IACvH,0BAA0B,+BAA+B;IACzD,gJAAgJ;IAChJ,sCAAsC,2CAA2C;IACjF;;;OAGG;IACH,yCAAyC,8CAA8C;CACxF;AAED;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,8GAA8G;IAC9G,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;IACxE,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,6GAA6G;IAC7G,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD,GAAG;IAAE,UAAU,EAAE,iCAAiC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,oCAAoC,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAmBtI"}

package/dist/esm/organizations/service-provider-capability-grants.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-capability-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,MAAM,CAAN,IAAY,iCAgBX;AAhBD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,sEAAiC,CAAA;IACjC;;;OAGG;IACH,gGAA2D,CAAA;IAC3D,kDAAkD;IAClD,0EAAqC,CAAA;IACrC,sFAAsF;IACtF,wEAAmC,CAAA;IACnC,oEAAoE;IACpE,wEAAmC,CAAA;IACnC,6GAA6G;IAC7G,oFAA+C,CAAA;AACjD,CAAC,EAhBW,iCAAiC,KAAjC,iCAAiC,QAgB5C;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwE,MAAM,CAAC,MAAM,CAAC;IAC1H,CAAC,iCAAiC,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,4BAA4B;IAC/F,CAAC,iCAAiC,CAAC,2BAA2B,CAAC,EAAE,cAAc,CAAC,yCAAyC;IACzH,CAAC,iCAAiC,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,8BAA8B;IACnG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC,mCAAmC;CAC9G,CAAC,CAAC;AAEH,6HAA6H;AAC7H,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAEzH,qEAAqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAiD,MAAM,CAAC,MAAM,CAAC;IAClH,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAiD,MAAM,CAAC,MAAM,CAAC;IACnH,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,2BAA2B;IAC7D,iCAAiC,CAAC,gBAAgB;IAClD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH,qGAAqG;AACrG,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AACjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,EAAE,CAAC;AAEhE,8BAA8B;AAC9B,MAAM,CAAN,IAAY,oCAOX;AAPD,WAAY,oCAAoC;IAC9C,mFAAmF;IACnF,yDAAiB,CAAA;IACjB,8EAA8E;IAC9E,2DAAmB,CAAA;IACnB,uGAAuG;IACvG,2DAAmB,CAAA;AACrB,CAAC,EAPW,oCAAoC,KAApC,oCAAoC,QAO/C;AAED,4GAA4G;AAC5G,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,yCAAyC;IACzC,iFAAuC,CAAA;IACvC,6FAA6F;IAC7F,mFAAyC,CAAA;IACzC,8FAA8F;IAC9F,yFAA+C,CAAA;AACjD,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED,gGAAgG;AAChG,MAAM,CAAN,IAAY,0CASX;AATD,WAAY,0CAA0C;IACpD,4EAA4E;IAC5E,6DAAe,CAAA;IACf,oGAAoG;IACpG,+FAAiD,CAAA;IACjD,kHAAkH;IAClH,+DAAiB,CAAA;IACjB,sFAAsF;IACtF,+DAAiB,CAAA;AACnB,CAAC,EATW,0CAA0C,KAA1C,0CAA0C,QASrD;AAED,yHAAyH;AACzH,MAAM,CAAN,IAAY,uCAaX;AAbD,WAAY,uCAAuC;IACjD,kHAAkH;IAClH,kJAAuG,CAAA;IACvG,gHAAgH;IAChH,wIAA6F,CAAA;IAC7F,yEAAyE;IACzE,wIAA6F,CAAA;IAC7F,yFAAyF;IACzF,sLAA2I,CAAA;IAC3I,0HAA0H;IAC1H,sIAA2F,CAAA;IAC3F,uGAAuG;IACvG,8JAAmH,CAAA;AACrH,CAAC,EAbW,uCAAuC,KAAvC,uCAAuC,QAalD;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,MAAM,UAAU,0CAA0C,CACxD,KAA+F,EAC/F,GAAS;IAET,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAS1D;IAGC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7F,MAAM,YAAY,GAAG,gBAAgB;QACnC,CAAC,CAAC,0CAA0C,CAAC,uBAAuB;QACpE,CAAC,CAAC,0CAA0C,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACvJ,IAAI,CAAC,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,yCAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACrI,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,mEAAmE,EAAE,CAAC;IAC/I,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,6CAA6C,EAAE,KAAK,CAAC,+BAA+B,IAAI,6CAA6C,CAAC;QACjJ,CAAC,CAAC,6BAA6B,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;QACvH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,sHAAsH;IACtH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzI,yHAAyH;IACzH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEjH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAClD,UAAU,CAAC,mCAAmC,CAAC;SAC/C,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,+HAA+H;IAC/H,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;SACjD,UAAU,CAAC,sCAAsC,CAAC;SAClD,OAAO,CAAC,oCAAoC,CAAC,MAAM,CAAC;SACpD,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,iHAAiH;IACjH,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,UAAU,CAAC,mCAAmC,CAAC;SAClG,QAAQ,CAAC,iFAAiF,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACvE,CAAC,CAAC;AAGH,sGAAsG;AACtG,MAAM,CAAN,IAAY,oCAUX;AAVD,WAAY,oCAAoC;IAC9C,uHAAuH;IACvH,iGAAyD,CAAA;IACzD,gJAAgJ;IAChJ,yHAAiF,CAAA;IACjF;;;OAGG;IACH,+HAAuF,CAAA;AACzF,CAAC,EAVW,oCAAoC,KAApC,oCAAoC,QAU/C;AAED;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CAAC,KAMxD;IACC,MAAM,UAAU,GAAwI,EAAE,CAAC;IAC3J,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,sCAAsC,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,yCAAyC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["/*\n Delegated administrative capabilities (#1631) — a CLIENT organization lends one service firm's experts a NAMED,\n * narrow, time-bound administrative capability, without ever making the firm an administrator.\n \n ## The shape, and why capabilities are ROLES\n \n Paul (2026-09-25, #1597 Q2): never admin by default; narrow, time-limited, client-revocable delegation; a\n * security-critical capability needs the client's OWNER, is time-bound, and is never renewed automatically. Issue\n * #1631 records the practice this follows (Microsoft's granular delegated admin privileges for partners, with a\n * time-bound relationship that cannot be auto-extended for the highest role) with its sources; nothing here quotes\n * them.\n \n A capability is a NAMED ROLE in the organization role table, one per {@link DelegatedAdministrativeCapability},\n * inheriting from nothing, and listed EXPLICITLY — beside `ORG_ADMIN` — in the `roles` of exactly the core operations\n * it opens. The rejected alternative (review F7) was an operation-id allow-list per grant: a second authority beside\n * role resolution that the ~20 `initiatorRoles` readers and the role ceiling would not know about.\n \n ## Grants are rows, filtered live\n \n `SERVICE_PROVIDER_CAPABILITY_GRANTS` rows live in the CLIENT organization. The execution-context live filter that\n * decides whether a provider membership confers anything (#1597) reads the relationship's grants in the same pass and\n * adds a capability's role to the expert's entries only while {@link isServiceProviderCapabilityGrantConferring}\n * holds — ACTIVE and `endsAt` still in the future. `EXPIRED` is sweep bookkeeping: admission reads `endsAt`.\n \n ## What delegation never does\n \n No capability confers `ORG_ADMIN` or `ORG_OWNER`, accepts a relationship, amends its scope, delegates further, or\n * counts toward the owner floor (provider memberships never do). Startup refuses a capability role whose `inheritFrom`\n * chain reaches an administration anchor.\n /\n\nimport { z } from 'zod';\nimport { CORE_ORG_ROLES, isInboundHandlerOnlyRole } from '../security/authorizations/roles.shared.schemas';\n\n/* @wildo_source:part:start saas.models.organizations.service-provider-capability-grants facet:layer:shared facet:audience:app-developer /\n/\n The closed set of administrative capabilities a client may lend a service firm (#1631). Each is ONE role\n * ({@link DELEGATED_CAPABILITY_ROLE}); a grant names one capability.\n /\nexport enum DelegatedAdministrativeCapability {\n /* Invite people into the client, resend an invitation, revoke one. /\n INVITE_MEMBERS = 'INVITE_MEMBERS',\n /\n Suspend or remove the firm's OWN experts under this relationship — never an ordinary member, never another firm's.\n * Deliberately not reactivate: lifting a suspension would let the firm undo the client's bar against one person (#1597).\n /\n MANAGE_RELATIONSHIP_EXPERTS = 'MANAGE_RELATIONSHIP_EXPERTS',\n /* Read the client organization's audit trail. /\n READ_AUDIT_TRAIL = 'READ_AUDIT_TRAIL',\n /* Configure the client's single sign-on and SCIM provisioning. Security-critical. /\n MANAGE_SSO_SCIM = 'MANAGE_SSO_SCIM',\n /* Manage the client organization's API keys. Security-critical. /\n MANAGE_API_KEYS = 'MANAGE_API_KEYS',\n /* Approve or deny, as the tenant, a platform operator's request to access the client. Security-critical. /\n APPROVE_ACCESS_GRANTS = 'APPROVE_ACCESS_GRANTS',\n}\n\n/\n The role each capability confers — the ONE mapping, total over the enum, so a capability added tomorrow is a compile\n * error here rather than a grant that confers nothing.\n /\nexport const DELEGATED_CAPABILITY_ROLE: Readonly<Record<DelegatedAdministrativeCapability, CORE_ORG_ROLES>> = Object.freeze({\n [DelegatedAdministrativeCapability.INVITE_MEMBERS]: CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS,\n [DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS,\n [DelegatedAdministrativeCapability.READ_AUDIT_TRAIL]: CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL,\n [DelegatedAdministrativeCapability.MANAGE_SSO_SCIM]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM,\n [DelegatedAdministrativeCapability.MANAGE_API_KEYS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS,\n [DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS]: CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS,\n});\n\n/* Every capability role — conferred ONLY by a live grant, never by a membership row (the member role doors refuse them). /\nexport const DELEGATED_CAPABILITY_ROLES: ReadonlySet<string> = new Set<string>(Object.values(DELEGATED_CAPABILITY_ROLE));\n\n/* Whether `role` is one only a live capability grant may confer. /\nexport function isDelegatedCapabilityRole(role: string): boolean {\n return DELEGATED_CAPABILITY_ROLES.has(role);\n}\n\n/\n Whether an organization MEMBERSHIP may hold `role` at all, whatever its organization's type (#1921): not a\n * handler-only role (an engine inbound handler's alone, #1629) and not a delegated capability role (a live grant's alone,\n * #1631). The ONE statement of that rule for every surface that offers or names a role a person holds — the published\n * role table a picker offers, and a setting that names one role (`contentReaderRole`). The membership write door\n * (`validateOrgMemberRoles`) refuses each of the two kinds with its own reason; a kind added here must be refused there too.\n /\nexport function roleMayBeHeldByMembership(role: string): boolean {\n return !isInboundHandlerOnlyRole(role) && !isDelegatedCapabilityRole(role);\n}\n\n/\n Capabilities that change who can authenticate into, or act as, the client: only the client's OWNER grants them,\n * with step-up, for a task-sized window ({@link SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS} at most), and a renewal is\n * a new grant — there is no `autoRenew`.\n /\nexport const SECURITY_CRITICAL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/\n Capabilities that need an ORGANIZATION-WIDE relationship: refused at grant time on a relationship confined to\n * organization units, because a unit-scoped relationship has no organization-wide entry (#1597 F5) to carry them.\n \n Every capability is here, and that is measured rather than assumed: each one opens operations on resources that do\n * not narrow by organization unit (members, audit logs, SSO / SCIM, API keys, platform access grants), and the role gate\n * on those counts only organization-wide entries. A capability granted on a unit-scoped relationship would therefore\n * be audited, mirrored to the firm as held, and confer nothing — a grant that lies. The list stays a list (rather than\n * a blanket rule) so a future capability that opens a unit-narrowable operation can be left off it deliberately.\n /\nexport const ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n DelegatedAdministrativeCapability.INVITE_MEMBERS,\n DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS,\n DelegatedAdministrativeCapability.READ_AUDIT_TRAIL,\n DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/* The longest an ordinary capability may be granted for: two years, GDAP's relationship maximum. /\nexport const DELEGATED_CAPABILITY_MAX_DAYS = 730;\n/\n The longest a security-critical capability may be granted for, unless the application declares a lower cap\n * (`acceptsServiceProviders.securityCriticalCapabilityMaxDays`). A reversible default chosen for #1631 — a task-sized\n * window, far below the relationship maximum — NOT a figure taken from GDAP.\n /\nexport const SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS = 30;\n\n/* Where one grant stands. /\nexport enum ServiceProviderCapabilityGrantStatus {\n /* Granted and not revoked. Confers only while `endsAt` is still in the future. /\n ACTIVE = 'ACTIVE',\n /* A client administrator revoked it, or the relationship ended. Terminal. /\n REVOKED = 'REVOKED',\n /* The sweep relabelled it after `endsAt`. Terminal bookkeeping — admission never reads this label. /\n EXPIRED = 'EXPIRED',\n}\n\n/* Why a grant stopped conferring before its term — what a REVOKED audit row records (#1631 review F10). /\nexport enum ServiceProviderCapabilityGrantEndCause {\n /* A client administrator revoked it. /\n REVOKED_BY_CLIENT = 'REVOKED_BY_CLIENT',\n /* Its relationship ended (terminated, withdrawn, expired, declined, or a party removed). /\n RELATIONSHIP_ENDED = 'RELATIONSHIP_ENDED',\n /* Its relationship was narrowed to organization units, which cannot carry any capability. /\n RELATIONSHIP_NARROWED = 'RELATIONSHIP_NARROWED',\n}\n\n/* The client's verbs on its grants. The firm has none: it can never grant, widen or extend. /\nexport enum ServiceProviderCapabilityGrants_Operations {\n /* Client ORG_ADMIN lends an ORDINARY capability, for at most two years. /\n GRANT = 'grant',\n /* Client ORG_OWNER lends a SECURITY-CRITICAL capability, with step-up, for a task-sized window. /\n GRANT_SECURITY_CRITICAL = 'grantSecurityCritical',\n /* Client ORG_ADMIN revokes any grant, at any time, without asking the firm. Takes effect on the next request. /\n REVOKE = 'revoke',\n /* ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. /\n EXPIRE = 'expire',\n}\n\n/* The client-branchable codes a refused grant carries (409: authorized caller, valid payload, the STATE forbids it). /\nexport enum ServiceProviderCapabilityGrantErrorCode {\n /* The relationship is not ACTIVE (or SUSPENDED) — nothing can be lent to a relationship that confers nothing. /\n SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE = 'SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE',\n /* A security-critical capability through the ordinary `grant`, or an ordinary one through the owner's verb. /\n SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB = 'SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB',\n /* `endsAt` beyond the cap for this capability, or not in the future. /\n SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED = 'SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED',\n /* An organization-level capability on a relationship confined to organization units. /\n SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP',\n /* An ACTIVE grant of this capability already exists on this relationship; revoke it first (a renewal is a new grant). /\n SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED = 'SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED',\n /* MANAGE_RELATIONSHIP_EXPERTS used on a membership that is not an expert of the SAME relationship. /\n SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP',\n}\n/* @wildo_source:part:end saas.models.organizations.service-provider-capability-grants /\n\n/\n Does this grant confer its capability RIGHT NOW? The ONE predicate the live filter uses: ACTIVE, and `endsAt` in the\n * future. `endsAt` is read here rather than trusting the EXPIRED label, so a grant stops working the moment its term\n * passes whether or not the sweep has run (invariant 1).\n /\nexport function isServiceProviderCapabilityGrantConferring(\n grant: { readonly status?: unknown; readonly endsAt?: Date \| string \| null } \| null \| undefined,\n now: Date,\n): boolean {\n if (!grant \|\| grant.status !== ServiceProviderCapabilityGrantStatus.ACTIVE) return false;\n if (grant.endsAt === undefined \|\| grant.endsAt === null) return false;\n const endsAt = grant.endsAt instanceof Date ? grant.endsAt : new Date(grant.endsAt);\n return Number.isFinite(endsAt.getTime()) && endsAt.getTime() > now.getTime();\n}\n\nconst DAY_MS = 24 60 * 60 * 1000;\n\n/*\n May this capability be lent on this relationship, until `endsAt`, through this verb? (#1631 invariants 3 and 5)\n \n The one rule both grant verbs apply. Pure: the caller supplies the relationship's scope and the application's\n * declared cap. Fails closed on anything it cannot prove.\n /\nexport function resolveServiceProviderCapabilityGrantTerms(input: {\n readonly capability: DelegatedAdministrativeCapability;\n readonly verb: ServiceProviderCapabilityGrants_Operations.GRANT \| ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL;\n readonly endsAt: Date;\n readonly now: Date;\n /* The relationship's `organizationUnitIds`: non-empty ⇒ unit-scoped. /\n readonly relationshipOrganizationUnitIds?: readonly string[] \| null;\n /* The client organization type's declared `acceptsServiceProviders.securityCriticalCapabilityMaxDays`. /\n readonly declaredSecurityCriticalMaxDays?: number;\n}):\n \| { readonly allowed: true }\n \| { readonly allowed: false; readonly code: ServiceProviderCapabilityGrantErrorCode } {\n const securityCritical = SECURITY_CRITICAL_DELEGATED_CAPABILITIES.includes(input.capability);\n const expectedVerb = securityCritical\n ? ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL\n : ServiceProviderCapabilityGrants_Operations.GRANT;\n if (input.verb !== expectedVerb) return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB };\n if ((input.relationshipOrganizationUnitIds ?? []).length > 0 && ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES.includes(input.capability)) {\n return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP };\n }\n const maxDays = securityCritical\n ? Math.min(SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS, input.declaredSecurityCriticalMaxDays ?? SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS)\n : DELEGATED_CAPABILITY_MAX_DAYS;\n const endsAtMs = input.endsAt.getTime();\n if (!Number.isFinite(endsAtMs) \|\| endsAtMs <= input.now.getTime() \|\| endsAtMs > input.now.getTime() + maxDays DAY_MS) {\n return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED };\n }\n return { allowed: true };\n}\n\n/*\n One grant, stored in the CLIENT organization. Every field is server-authored: the verbs write them, and there is no\n * generic CREATE or UPDATE.\n /\nexport const ServiceProviderCapabilityGrantSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* The CLIENT organization — the party lending the capability, and the scope anchor. /\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n /* The relationship the capability is lent through — same tenant, a real edge. The live filter reads grants by it. /\n relationshipId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n /* The firm, copied from the relationship so a row names both parties. A plain id, never an edge into another tenant. /\n providerOrganizationId: z.string().min(1).isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n capability: z.enum(DelegatedAdministrativeCapability)\n .systemEnum('DelegatedAdministrativeCapability')\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n\n /* When the capability stops conferring. Required: a delegation always ends. Admission reads this, never the EXPIRED label. /\n endsAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n status: z.enum(ServiceProviderCapabilityGrantStatus)\n .systemEnum('ServiceProviderCapabilityGrantStatus')\n .default(ServiceProviderCapabilityGrantStatus.ACTIVE)\n .isDBIndexed()\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n\n grantedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n grantedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n revokedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n revokedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n /* When the grant stopped — revoked, or relabelled after its term. The retention clock's start point (#1613). /\n endedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n createdAt: z.date().optional(),\n updatedAt: z.date().optional(),\n});\nexport type ServiceProviderCapabilityGrant = z.infer<typeof ServiceProviderCapabilityGrantSchema>;\n\n/* One capability the firm holds in a client, as its engagement mirror shows it. /\nexport const ServiceEngagementDelegatedCapabilitySchema = z.object({\n capability: z.enum(DelegatedAdministrativeCapability).systemEnum('DelegatedAdministrativeCapability')\n .describe('An administrative capability the client organization currently lends this firm.'),\n endsAt: z.date().describe('When the lending of that capability ends.'),\n});\nexport type ServiceEngagementDelegatedCapability = z.infer<typeof ServiceEngagementDelegatedCapabilitySchema>;\n\n/* Why the organization role table was refused at startup for a delegated capability role (#1631). /\nexport enum DelegatedCapabilityRoleViolationKind {\n /* The capability role is not in the organization role table at all — a grant of it would confer nothing, silently. /\n CAPABILITY_ROLE_UNDECLARED = 'CAPABILITY_ROLE_UNDECLARED',\n /* The role's `inheritFrom` chain reaches an administration anchor (ORG_ADMIN / ORG_OWNER): lending it would make the firm an administrator. /\n CAPABILITY_ROLE_REACHES_ADMINISTRATION = 'CAPABILITY_ROLE_REACHES_ADMINISTRATION',\n /\n Another organization role inherits the capability role: every holder of that role would carry the capability\n * standing, with no grant row, no term and no revocation. A capability is conferred only by a live grant.\n /\n CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE = 'CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE',\n}\n\n/\n Validate every delegated capability role against the LIVE organization role table (#1631 invariant 2). An application\n * may override the engine's role definitions, so the check runs on the table the authorizer actually uses: a capability\n * role redefined to inherit from `ORG_ADMIN` (or anything that leads there) is refused at boot, exactly as a provider\n * role that reaches `ORG_ADMIN` is.\n /\nexport function collectDelegatedCapabilityRoleViolations(input: {\n /* The role's `inheritFrom` walk in the ORGANIZATIONS table, the role itself included; empty ⇒ undeclared. /\n readonly organizationRoleHierarchy: (role: string) => readonly string[];\n readonly administrationAnchorRoles: readonly string[];\n /* Every key of the LIVE organization role table, so a role that inherits a capability role can be found. */\n readonly organizationRoles?: readonly string[];\n}): { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] {\n const violations: { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] = [];\n for (const capability of Object.values(DelegatedAdministrativeCapability)) {\n const role = DELEGATED_CAPABILITY_ROLE[capability];\n const hierarchy = input.organizationRoleHierarchy(role);\n if (hierarchy.length === 0) {\n violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_UNDECLARED });\n continue;\n }\n if (hierarchy.some((held) => input.administrationAnchorRoles.includes(held))) {\n violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_REACHES_ADMINISTRATION });\n }\n for (const other of input.organizationRoles ?? []) {\n if (other !== role && input.organizationRoleHierarchy(other).includes(role)) {\n violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE, inheritedBy: other });\n }\n }\n }\n return violations;\n}\n"]}
1	+ {"version":3,"file":"service-provider-capability-grants.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,MAAM,CAAN,IAAY,iCAgBX;AAhBD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,sEAAiC,CAAA;IACjC;;;OAGG;IACH,gGAA2D,CAAA;IAC3D,kDAAkD;IAClD,0EAAqC,CAAA;IACrC,sFAAsF;IACtF,wEAAmC,CAAA;IACnC,oEAAoE;IACpE,wEAAmC,CAAA;IACnC,6GAA6G;IAC7G,oFAA+C,CAAA;AACjD,CAAC,EAhBW,iCAAiC,KAAjC,iCAAiC,QAgB5C;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwE,MAAM,CAAC,MAAM,CAAC;IAC1H,CAAC,iCAAiC,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,4BAA4B;IAC/F,CAAC,iCAAiC,CAAC,2BAA2B,CAAC,EAAE,cAAc,CAAC,yCAAyC;IACzH,CAAC,iCAAiC,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,8BAA8B;IACnG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,6BAA6B;IACjG,CAAC,iCAAiC,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC,mCAAmC;CAC9G,CAAC,CAAC;AAEH,6HAA6H;AAC7H,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAEzH,qEAAqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAiD,MAAM,CAAC,MAAM,CAAC;IAClH,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAiD,MAAM,CAAC,MAAM,CAAC;IACnH,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,2BAA2B;IAC7D,iCAAiC,CAAC,gBAAgB;IAClD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,eAAe;IACjD,iCAAiC,CAAC,qBAAqB;CACxD,CAAC,CAAC;AAEH,qGAAqG;AACrG,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AACjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,EAAE,CAAC;AAEhE,8BAA8B;AAC9B,MAAM,CAAN,IAAY,oCAOX;AAPD,WAAY,oCAAoC;IAC9C,mFAAmF;IACnF,yDAAiB,CAAA;IACjB,8EAA8E;IAC9E,2DAAmB,CAAA;IACnB,uGAAuG;IACvG,2DAAmB,CAAA;AACrB,CAAC,EAPW,oCAAoC,KAApC,oCAAoC,QAO/C;AAED,4GAA4G;AAC5G,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,yCAAyC;IACzC,iFAAuC,CAAA;IACvC,6FAA6F;IAC7F,mFAAyC,CAAA;IACzC,8FAA8F;IAC9F,yFAA+C,CAAA;AACjD,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED,gGAAgG;AAChG,MAAM,CAAN,IAAY,0CASX;AATD,WAAY,0CAA0C;IACpD,4EAA4E;IAC5E,6DAAe,CAAA;IACf,oGAAoG;IACpG,+FAAiD,CAAA;IACjD,kHAAkH;IAClH,+DAAiB,CAAA;IACjB,sFAAsF;IACtF,+DAAiB,CAAA;AACnB,CAAC,EATW,0CAA0C,KAA1C,0CAA0C,QASrD;AAED,yHAAyH;AACzH,MAAM,CAAN,IAAY,uCAaX;AAbD,WAAY,uCAAuC;IACjD,kHAAkH;IAClH,kJAAuG,CAAA;IACvG,gHAAgH;IAChH,wIAA6F,CAAA;IAC7F,yEAAyE;IACzE,wIAA6F,CAAA;IAC7F,yFAAyF;IACzF,sLAA2I,CAAA;IAC3I,0HAA0H;IAC1H,sIAA2F,CAAA;IAC3F,uGAAuG;IACvG,8JAAmH,CAAA;AACrH,CAAC,EAbW,uCAAuC,KAAvC,uCAAuC,QAalD;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,MAAM,UAAU,0CAA0C,CACxD,KAA+F,EAC/F,GAAS;IAET,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,0CAA0C,CAAC,KAS1D;IAGC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7F,MAAM,YAAY,GAAG,gBAAgB;QACnC,CAAC,CAAC,0CAA0C,CAAC,uBAAuB;QACpE,CAAC,CAAC,0CAA0C,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACvJ,IAAI,CAAC,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,yCAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACrI,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,mEAAmE,EAAE,CAAC;IAC/I,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB;QAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,6CAA6C,EAAE,KAAK,CAAC,+BAA+B,IAAI,6CAA6C,CAAC;QACjJ,CAAC,CAAC,6BAA6B,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;QACvH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,CAAC,4CAA4C,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,sHAAsH;IACtH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzI,yHAAyH;IACzH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEjH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;SAClD,UAAU,CAAC,mCAAmC,CAAC;SAC/C,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,+HAA+H;IAC/H,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;SACjD,UAAU,CAAC,sCAAsC,CAAC;SAClD,OAAO,CAAC,oCAAoC,CAAC,MAAM,CAAC;SACpD,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtE,iHAAiH;IACjH,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,UAAU,CAAC,mCAAmC,CAAC;SAClG,QAAQ,CAAC,iFAAiF,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACvE,CAAC,CAAC;AAGH,sGAAsG;AACtG,MAAM,CAAN,IAAY,oCAUX;AAVD,WAAY,oCAAoC;IAC9C,uHAAuH;IACvH,iGAAyD,CAAA;IACzD,gJAAgJ;IAChJ,yHAAiF,CAAA;IACjF;;;OAGG;IACH,+HAAuF,CAAA;AACzF,CAAC,EAVW,oCAAoC,KAApC,oCAAoC,QAU/C;AAED;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CAAC,KAMxD;IACC,MAAM,UAAU,GAAwI,EAAE,CAAC;IAC3J,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,sCAAsC,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,yCAAyC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["/*\n Delegated administrative capabilities (#1631) — a CLIENT organization lends one service firm's experts a NAMED,\n * narrow, time-bound administrative capability, without ever making the firm an administrator.\n \n ## The shape, and why capabilities are ROLES\n \n Paul (2026-09-25, #1597 Q2): never admin by default; narrow, time-limited, client-revocable delegation; a\n * security-critical capability needs the client's OWNER, is time-bound, and is never renewed automatically. Issue\n * #1631 records the practice this follows (Microsoft's granular delegated admin privileges for partners, with a\n * time-bound relationship that cannot be auto-extended for the highest role) with its sources; nothing here quotes\n * them.\n \n A capability is a NAMED ROLE in the organization role table, one per {@link DelegatedAdministrativeCapability},\n * inheriting from nothing, and listed EXPLICITLY — beside `ORG_ADMIN` — in the `roles` of exactly the core operations\n * it opens. The rejected alternative (review F7) was an operation-id allow-list per grant: a second authority beside\n * role resolution that the ~20 `initiatorRoles` readers and the role ceiling would not know about.\n \n ## Grants are rows, filtered live\n \n `SERVICE_PROVIDER_CAPABILITY_GRANTS` rows live in the CLIENT organization. The execution-context live filter that\n * decides whether a provider membership confers anything (#1597) reads the relationship's grants in the same pass and\n * adds a capability's role to the expert's entries only while {@link isServiceProviderCapabilityGrantConferring}\n * holds — ACTIVE and `endsAt` still in the future. `EXPIRED` is sweep bookkeeping: admission reads `endsAt`.\n \n ## What delegation never does\n \n No capability confers `ORG_ADMIN` or `ORG_OWNER`, accepts a relationship, amends its scope, delegates further, or\n * counts toward the owner floor (provider memberships never do). Startup refuses a capability role whose `inheritFrom`\n * chain reaches an administration anchor.\n /\n\nimport { z } from 'zod';\nimport { CORE_ORG_ROLES, isInboundHandlerOnlyRole } from '../security/authorizations/roles.shared.schemas';\n\n/* @wildo_source:part:start saas.models.organizations.service-provider-capability-grants facet:layer:shared facet:audience:app-developer /\n/\n The closed set of administrative capabilities a client may lend a service firm (#1631). Each is ONE role\n * ({@link DELEGATED_CAPABILITY_ROLE}); a grant names one capability.\n /\nexport enum DelegatedAdministrativeCapability {\n /* Invite people into the client, resend an invitation, revoke one. /\n INVITE_MEMBERS = 'INVITE_MEMBERS',\n /\n Suspend or remove the firm's OWN experts under this relationship — never an ordinary member, never another firm's.\n * Deliberately not reactivate: lifting a suspension would let the firm undo the client's bar against one person (#1597).\n /\n MANAGE_RELATIONSHIP_EXPERTS = 'MANAGE_RELATIONSHIP_EXPERTS',\n /* Read the client organization's audit trail. /\n READ_AUDIT_TRAIL = 'READ_AUDIT_TRAIL',\n /* Configure the client's single sign-on and SCIM provisioning. Security-critical. /\n MANAGE_SSO_SCIM = 'MANAGE_SSO_SCIM',\n /* Manage the client organization's API keys. Security-critical. /\n MANAGE_API_KEYS = 'MANAGE_API_KEYS',\n /* Approve or deny, as the tenant, a platform operator's request to access the client. Security-critical. /\n APPROVE_ACCESS_GRANTS = 'APPROVE_ACCESS_GRANTS',\n}\n\n/\n The role each capability confers — the ONE mapping, total over the enum, so a capability added tomorrow is a compile\n * error here rather than a grant that confers nothing.\n /\nexport const DELEGATED_CAPABILITY_ROLE: Readonly<Record<DelegatedAdministrativeCapability, CORE_ORG_ROLES>> = Object.freeze({\n [DelegatedAdministrativeCapability.INVITE_MEMBERS]: CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS,\n [DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS,\n [DelegatedAdministrativeCapability.READ_AUDIT_TRAIL]: CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL,\n [DelegatedAdministrativeCapability.MANAGE_SSO_SCIM]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM,\n [DelegatedAdministrativeCapability.MANAGE_API_KEYS]: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS,\n [DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS]: CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS,\n});\n\n/* Every capability role — conferred ONLY by a live grant, never by a membership row (the member role doors refuse them). /\nexport const DELEGATED_CAPABILITY_ROLES: ReadonlySet<string> = new Set<string>(Object.values(DELEGATED_CAPABILITY_ROLE));\n\n/* Whether `role` is one only a live capability grant may confer. /\nexport function isDelegatedCapabilityRole(role: string): boolean {\n return DELEGATED_CAPABILITY_ROLES.has(role);\n}\n\n/\n Whether an organization MEMBERSHIP may hold `role` at all, whatever its organization's type (#1921): not a\n * handler-only role (an engine inbound handler's alone, #1629) and not a delegated capability role (a live grant's alone,\n * #1631). The ONE statement of that rule for every surface that offers or names a role a person holds — the published\n * role table a picker offers, and a setting that names one role (`contentReaderRole`). The membership write door\n * (`validateOrgMemberRoles`) refuses each of the two kinds with its own reason; a kind added here must be refused there too.\n /\nexport function roleMayBeHeldByMembership(role: string): boolean {\n return !isInboundHandlerOnlyRole(role) && !isDelegatedCapabilityRole(role);\n}\n\n/\n Capabilities that change who can authenticate into, or act as, the client: only the client's OWNER grants them,\n * with step-up, for a task-sized window ({@link SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS} at most), and a renewal is\n * a new grant — there is no `autoRenew`.\n /\nexport const SECURITY_CRITICAL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/\n Capabilities that need an ORGANIZATION-WIDE relationship: refused at grant time on a relationship confined to\n * organization units, because a unit-scoped relationship has no organization-wide entry (#1597 F5) to carry them.\n \n Every capability is here, and that is measured rather than assumed: each one opens operations on resources that do\n * not narrow by organization unit (members, audit logs, SSO / SCIM, API keys, platform access grants), and the role gate\n * on those counts only organization-wide entries. A capability granted on a unit-scoped relationship would therefore\n * be audited, mirrored to the firm as held, and confer nothing — a grant that lies. The list stays a list (rather than\n * a blanket rule) so a future capability that opens a unit-narrowable operation can be left off it deliberately.\n /\nexport const ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[] = Object.freeze([\n DelegatedAdministrativeCapability.INVITE_MEMBERS,\n DelegatedAdministrativeCapability.MANAGE_RELATIONSHIP_EXPERTS,\n DelegatedAdministrativeCapability.READ_AUDIT_TRAIL,\n DelegatedAdministrativeCapability.MANAGE_SSO_SCIM,\n DelegatedAdministrativeCapability.MANAGE_API_KEYS,\n DelegatedAdministrativeCapability.APPROVE_ACCESS_GRANTS,\n]);\n\n/* The longest an ordinary capability may be granted for: two years, GDAP's relationship maximum. /\nexport const DELEGATED_CAPABILITY_MAX_DAYS = 730;\n/\n The longest a security-critical capability may be granted for, unless the application declares a lower cap\n * (`acceptsServiceProviders.securityCriticalCapabilityMaxDays`). A reversible default chosen for #1631 — a task-sized\n * window, far below the relationship maximum — NOT a figure taken from GDAP.\n /\nexport const SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS = 30;\n\n/* Where one grant stands. /\nexport enum ServiceProviderCapabilityGrantStatus {\n /* Granted and not revoked. Confers only while `endsAt` is still in the future. /\n ACTIVE = 'ACTIVE',\n /* A client administrator revoked it, or the relationship ended. Terminal. /\n REVOKED = 'REVOKED',\n /* The sweep relabelled it after `endsAt`. Terminal bookkeeping — admission never reads this label. /\n EXPIRED = 'EXPIRED',\n}\n\n/* Why a grant stopped conferring before its term — what a REVOKED audit row records (#1631 review F10). /\nexport enum ServiceProviderCapabilityGrantEndCause {\n /* A client administrator revoked it. /\n REVOKED_BY_CLIENT = 'REVOKED_BY_CLIENT',\n /* Its relationship ended (terminated, withdrawn, expired, declined, or a party removed). /\n RELATIONSHIP_ENDED = 'RELATIONSHIP_ENDED',\n /* Its relationship was narrowed to organization units, which cannot carry any capability. /\n RELATIONSHIP_NARROWED = 'RELATIONSHIP_NARROWED',\n}\n\n/* The client's verbs on its grants. The firm has none: it can never grant, widen or extend. /\nexport enum ServiceProviderCapabilityGrants_Operations {\n /* Client ORG_ADMIN lends an ORDINARY capability, for at most two years. /\n GRANT = 'grant',\n /* Client ORG_OWNER lends a SECURITY-CRITICAL capability, with step-up, for a task-sized window. /\n GRANT_SECURITY_CRITICAL = 'grantSecurityCritical',\n /* Client ORG_ADMIN revokes any grant, at any time, without asking the firm. Takes effect on the next request. /\n REVOKE = 'revoke',\n /* ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. /\n EXPIRE = 'expire',\n}\n\n/* The client-branchable codes a refused grant carries (409: authorized caller, valid payload, the STATE forbids it). /\nexport enum ServiceProviderCapabilityGrantErrorCode {\n /* The relationship is not ACTIVE (or SUSPENDED) — nothing can be lent to a relationship that confers nothing. /\n SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE = 'SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE',\n /* A security-critical capability through the ordinary `grant`, or an ordinary one through the owner's verb. /\n SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB = 'SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB',\n /* `endsAt` beyond the cap for this capability, or not in the future. /\n SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED = 'SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED',\n /* An organization-level capability on a relationship confined to organization units. /\n SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP',\n /* An ACTIVE grant of this capability already exists on this relationship; revoke it first (a renewal is a new grant). /\n SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED = 'SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED',\n /* MANAGE_RELATIONSHIP_EXPERTS used on a membership that is not an expert of the SAME relationship. /\n SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP = 'SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP',\n}\n/* @wildo_source:part:end saas.models.organizations.service-provider-capability-grants /\n\n/\n Does this grant confer its capability RIGHT NOW? The ONE predicate the live filter uses: ACTIVE, and `endsAt` in the\n * future. `endsAt` is read here rather than trusting the EXPIRED label, so a grant stops working the moment its term\n * passes whether or not the sweep has run (invariant 1).\n /\nexport function isServiceProviderCapabilityGrantConferring(\n grant: { readonly status?: unknown; readonly endsAt?: Date \| string \| null } \| null \| undefined,\n now: Date,\n): boolean {\n if (!grant \|\| grant.status !== ServiceProviderCapabilityGrantStatus.ACTIVE) return false;\n if (grant.endsAt === undefined \|\| grant.endsAt === null) return false;\n const endsAt = grant.endsAt instanceof Date ? grant.endsAt : new Date(grant.endsAt);\n return Number.isFinite(endsAt.getTime()) && endsAt.getTime() > now.getTime();\n}\n\nconst DAY_MS = 24 60 * 60 * 1000;\n\n/*\n May this capability be lent on this relationship, until `endsAt`, through this verb? (#1631 invariants 3 and 5)\n \n The one rule both grant verbs apply. Pure: the caller supplies the relationship's scope and the application's\n * declared cap. Fails closed on anything it cannot prove.\n /\nexport function resolveServiceProviderCapabilityGrantTerms(input: {\n readonly capability: DelegatedAdministrativeCapability;\n readonly verb: ServiceProviderCapabilityGrants_Operations.GRANT \| ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL;\n readonly endsAt: Date;\n readonly now: Date;\n /* The relationship's `organizationUnitIds`: non-empty ⇒ unit-scoped. /\n readonly relationshipOrganizationUnitIds?: readonly string[] \| null;\n /* The client organization type's declared `acceptsServiceProviders.securityCriticalCapabilityMaxDays`. /\n readonly declaredSecurityCriticalMaxDays?: number;\n}):\n \| { readonly allowed: true }\n \| { readonly allowed: false; readonly code: ServiceProviderCapabilityGrantErrorCode } {\n const securityCritical = SECURITY_CRITICAL_DELEGATED_CAPABILITIES.includes(input.capability);\n const expectedVerb = securityCritical\n ? ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL\n : ServiceProviderCapabilityGrants_Operations.GRANT;\n if (input.verb !== expectedVerb) return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB };\n if ((input.relationshipOrganizationUnitIds ?? []).length > 0 && ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES.includes(input.capability)) {\n return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP };\n }\n const maxDays = securityCritical\n ? Math.min(SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS, input.declaredSecurityCriticalMaxDays ?? SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS)\n : DELEGATED_CAPABILITY_MAX_DAYS;\n const endsAtMs = input.endsAt.getTime();\n if (!Number.isFinite(endsAtMs) \|\| endsAtMs <= input.now.getTime() \|\| endsAtMs > input.now.getTime() + maxDays DAY_MS) {\n return { allowed: false, code: ServiceProviderCapabilityGrantErrorCode.SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED };\n }\n return { allowed: true };\n}\n\n/*\n One grant, stored in the CLIENT organization. Every field is server-authored: the verbs write them, and there is no\n * generic CREATE or UPDATE.\n /\nexport const ServiceProviderCapabilityGrantSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* The CLIENT organization — the party lending the capability, and the scope anchor. /\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n /* The relationship the capability is lent through — same tenant, a real edge. The live filter reads grants by it. /\n relationshipId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n /* The firm, copied from the relationship so a row names both parties. A plain id, never an edge into another tenant. /\n providerOrganizationId: z.string().min(1).isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n capability: z.enum(DelegatedAdministrativeCapability)\n .systemEnum('DelegatedAdministrativeCapability')\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n\n /* When the capability stops conferring. Required: a delegation always ends. Admission reads this, never the EXPIRED label. /\n endsAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n status: z.enum(ServiceProviderCapabilityGrantStatus)\n .systemEnum('ServiceProviderCapabilityGrantStatus')\n .default(ServiceProviderCapabilityGrantStatus.ACTIVE)\n .isDBIndexed()\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n\n grantedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n grantedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n revokedByUserId: z.string().min(1).optional().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n revokedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n /* When the grant stopped — revoked, or relabelled after its term. The retention clock's start point (#1613). /\n endedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n createdAt: z.date().optional(),\n updatedAt: z.date().optional(),\n});\nexport type ServiceProviderCapabilityGrant = z.infer<typeof ServiceProviderCapabilityGrantSchema>;\n\n/* One capability the firm holds in a client, as its engagement mirror shows it. /\nexport const ServiceEngagementDelegatedCapabilitySchema = z.object({\n capability: z.enum(DelegatedAdministrativeCapability).systemEnum('DelegatedAdministrativeCapability')\n .describe('An administrative capability the client organization currently lends this firm.'),\n endsAt: z.date().describe('When the lending of that capability ends.'),\n});\nexport type ServiceEngagementDelegatedCapability = z.infer<typeof ServiceEngagementDelegatedCapabilitySchema>;\n\n/* Why the organization role table was refused at startup for a delegated capability role (#1631). /\nexport enum DelegatedCapabilityRoleViolationKind {\n /* The capability role is not in the organization role table at all — a grant of it would confer nothing, silently. /\n CAPABILITY_ROLE_UNDECLARED = 'CAPABILITY_ROLE_UNDECLARED',\n /* The role's `inheritFrom` chain reaches an administration anchor (ORG_ADMIN / ORG_OWNER): lending it would make the firm an administrator. /\n CAPABILITY_ROLE_REACHES_ADMINISTRATION = 'CAPABILITY_ROLE_REACHES_ADMINISTRATION',\n /\n Another organization role inherits the capability role: every holder of that role would carry the capability\n * standing, with no grant row, no term and no revocation. A capability is conferred only by a live grant.\n /\n CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE = 'CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE',\n}\n\n/\n Validate every delegated capability role against the LIVE organization role table (#1631 invariant 2). An application\n * may override the engine's role definitions, so the check runs on the table the authorizer actually uses: a capability\n * role redefined to inherit from `ORG_ADMIN` (or anything that leads there) is refused at boot, exactly as a provider\n * role that reaches `ORG_ADMIN` is.\n /\nexport function collectDelegatedCapabilityRoleViolations(input: {\n /* The role's `inheritFrom` walk in the ORGANIZATIONS table, the role itself included; empty ⇒ undeclared. /\n readonly organizationRoleHierarchy: (role: string) => readonly string[];\n readonly administrationAnchorRoles: readonly string[];\n /* Every key of the LIVE organization role table, so a role that inherits a capability role can be found. */\n readonly organizationRoles?: readonly string[];\n}): { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] {\n const violations: { capability: DelegatedAdministrativeCapability; role: string; kind: DelegatedCapabilityRoleViolationKind; inheritedBy?: string }[] = [];\n for (const capability of Object.values(DelegatedAdministrativeCapability)) {\n const role = DELEGATED_CAPABILITY_ROLE[capability];\n const hierarchy = input.organizationRoleHierarchy(role);\n if (hierarchy.length === 0) {\n violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_UNDECLARED });\n continue;\n }\n if (hierarchy.some((held) => input.administrationAnchorRoles.includes(held))) {\n violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_REACHES_ADMINISTRATION });\n }\n for (const other of input.organizationRoles ?? []) {\n if (other !== role && input.organizationRoleHierarchy(other).includes(role)) {\n violations.push({ capability, role, kind: DelegatedCapabilityRoleViolationKind.CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE, inheritedBy: other });\n }\n }\n }\n return violations;\n}\n"]}

package/dist/esm/organizations/service-provider-client-controls.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-client-controls.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,oBAAY,uBAAuB;IACjC,oFAAoF;IACpF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;GAMG;AACH,oBAAY,qCAAqC;IAC/C,iEAAiE;IACjE,IAAI,SAAS;IACb,0HAA0H;IAC1H,mBAAmB,wBAAwB;IAC3C,oEAAoE;IACpE,qBAAqB,0BAA0B;CAChD;AACD,wFAAwF"}
1	+ {"version":3,"file":"service-provider-client-controls.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,oBAAY,uBAAuB;IACjC,oFAAoF;IACpF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;GAMG;AACH,oBAAY,qCAAqC;IAC/C,iEAAiE;IACjE,IAAI,SAAS;IACb,0HAA0H;IAC1H,mBAAmB,wBAAwB;IAC3C,oEAAoE;IACpE,qBAAqB,0BAA0B;CAChD;AACD,wFAAwF"}

package/dist/esm/organizations/service-provider-client-controls.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-client-controls.shared.schemas.js","sourceRoot":"","sources":["~~../../../../~~src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,oFAAoF;IACpF,sDAA2B,CAAA;IAC3B;;;;OAIG;IACH,4EAAiD,CAAA;AACnD,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,qCAOX;AAPD,WAAY,qCAAqC;IAC/C,iEAAiE;IACjE,sDAAa,CAAA;IACb,0HAA0H;IAC1H,oFAA2C,CAAA;IAC3C,oEAAoE;IACpE,wFAA+C,CAAA;AACjD,CAAC,EAPW,qCAAqC,KAArC,qCAAqC,QAOhD;AACD,wFAAwF","sourcesContent":["/*\n What a CLIENT organization decides, per service-provider relationship, about the firm whose experts work inside it\n * (#1633, #1632).\n \n Both settings live on `SERVICE_PROVIDER_RELATIONSHIPS`, the row the client owns, and each is changed only by the\n * client's own verb. The firm has no verb that writes either, and neither widens what the relationship confers: one\n * decides how strongly an expert must have proven who they are before acting here, the other how much the firm may\n * learn afterwards about what its own staff did here.\n /\n\n/* @wildo_source:part:start saas.models.organizations.service-provider-client-controls facet:layer:shared facet:audience:app-developer /\n/\n Whether the client accepts the multi-factor proof the FIRM's own identity provider made (#1633).\n \n The client organization type's authentication policy governs an expert whenever they act in the client, whatever\n * the firm's policy is. When that policy asks for a second factor, the expert proves it to THIS application for THIS\n * client, and nothing proven elsewhere counts — unless the client trusts the firm's identity provider here.\n \n Off by default, as Microsoft Entra's cross-tenant inbound trust is: trusting another organization's MFA is the\n * RESOURCE tenant's decision, made per partner. Even when on, the client's minimum strength still applies, and an\n * operation that demands a fresh step-up still demands one.\n /\nexport enum ServiceProviderMfaTrust {\n /* Only a factor proven to this application for this client counts. The default. /\n NOT_TRUSTED = 'NOT_TRUSTED',\n /\n A factor the firm's own enterprise identity provider reported in the expert's sign-in (`amr`) counts too, when\n * the expert signed in through THAT provider and the reported method meets the client's minimum strength. The\n * accepted claim is recorded as coming from the firm's provider; it is never re-emitted as this application's own.\n /\n TRUST_PROVIDER_IDP_MFA = 'TRUST_PROVIDER_IDP_MFA',\n}\n\n/\n How much the firm's expert-activity feed may say about work done in THIS client (#1632).\n \n The client's side of the feed: the firm decides whether it collects activity metadata about its staff at all\n * (`SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS`), and the client can switch it off or narrow it for its own tenant. A\n * feed entry is written only when both allow it, and it never carries the client's content at any level.\n /\nexport enum ServiceProviderActivityFeedDisclosure {\n /* Nothing about work in this client reaches the firm's feed. /\n NONE = 'NONE',\n /* The firm learns that an operation of a given type ran on a resource type, when, by whom — not whether it succeeded. /\n OPERATION_TYPE_ONLY = 'OPERATION_TYPE_ONLY',\n /* As above, plus the outcome. Still metadata only. The default. /\n OPERATION_AND_OUTCOME = 'OPERATION_AND_OUTCOME',\n}\n/* @wildo_source:part:end saas.models.organizations.service-provider-client-controls */\n"]}
1	+ {"version":3,"file":"service-provider-client-controls.shared.schemas.js","sourceRoot":"","sources":["../../../src/organizations/service-provider-client-controls.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0IAA0I;AAC1I;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,oFAAoF;IACpF,sDAA2B,CAAA;IAC3B;;;;OAIG;IACH,4EAAiD,CAAA;AACnD,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,qCAOX;AAPD,WAAY,qCAAqC;IAC/C,iEAAiE;IACjE,sDAAa,CAAA;IACb,0HAA0H;IAC1H,oFAA2C,CAAA;IAC3C,oEAAoE;IACpE,wFAA+C,CAAA;AACjD,CAAC,EAPW,qCAAqC,KAArC,qCAAqC,QAOhD;AACD,wFAAwF","sourcesContent":["/*\n What a CLIENT organization decides, per service-provider relationship, about the firm whose experts work inside it\n * (#1633, #1632).\n \n Both settings live on `SERVICE_PROVIDER_RELATIONSHIPS`, the row the client owns, and each is changed only by the\n * client's own verb. The firm has no verb that writes either, and neither widens what the relationship confers: one\n * decides how strongly an expert must have proven who they are before acting here, the other how much the firm may\n * learn afterwards about what its own staff did here.\n /\n\n/* @wildo_source:part:start saas.models.organizations.service-provider-client-controls facet:layer:shared facet:audience:app-developer /\n/\n Whether the client accepts the multi-factor proof the FIRM's own identity provider made (#1633).\n \n The client organization type's authentication policy governs an expert whenever they act in the client, whatever\n * the firm's policy is. When that policy asks for a second factor, the expert proves it to THIS application for THIS\n * client, and nothing proven elsewhere counts — unless the client trusts the firm's identity provider here.\n \n Off by default, as Microsoft Entra's cross-tenant inbound trust is: trusting another organization's MFA is the\n * RESOURCE tenant's decision, made per partner. Even when on, the client's minimum strength still applies, and an\n * operation that demands a fresh step-up still demands one.\n /\nexport enum ServiceProviderMfaTrust {\n /* Only a factor proven to this application for this client counts. The default. /\n NOT_TRUSTED = 'NOT_TRUSTED',\n /\n A factor the firm's own enterprise identity provider reported in the expert's sign-in (`amr`) counts too, when\n * the expert signed in through THAT provider and the reported method meets the client's minimum strength. The\n * accepted claim is recorded as coming from the firm's provider; it is never re-emitted as this application's own.\n /\n TRUST_PROVIDER_IDP_MFA = 'TRUST_PROVIDER_IDP_MFA',\n}\n\n/\n How much the firm's expert-activity feed may say about work done in THIS client (#1632).\n \n The client's side of the feed: the firm decides whether it collects activity metadata about its staff at all\n * (`SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS`), and the client can switch it off or narrow it for its own tenant. A\n * feed entry is written only when both allow it, and it never carries the client's content at any level.\n /\nexport enum ServiceProviderActivityFeedDisclosure {\n /* Nothing about work in this client reaches the firm's feed. /\n NONE = 'NONE',\n /* The firm learns that an operation of a given type ran on a resource type, when, by whom — not whether it succeeded. /\n OPERATION_TYPE_ONLY = 'OPERATION_TYPE_ONLY',\n /* As above, plus the outcome. Still metadata only. The default. /\n OPERATION_AND_OUTCOME = 'OPERATION_AND_OUTCOME',\n}\n/* @wildo_source:part:end saas.models.organizations.service-provider-client-controls */\n"]}

package/dist/esm/organizations/service-provider-relationships.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-relationships.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/organizations/service-provider-relationships.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iCAAiC,EACjC,oCAAoC,EACpC,uCAAuC,EAEvC,6BAA6B,EAE7B,iCAAiC,EACjC,uCAAuC,EACxC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AA+DnI,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AA6BjC,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsRlI,CAAC;AAIL,eAAO,MAAM,6DAA6D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;kBA0GxH,CAAC;AAIL,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;kBAqHlI,CAAC"}
1	+ {"version":3,"file":"service-provider-relationships.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/organizations/service-provider-relationships.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iCAAiC,EACjC,oCAAoC,EACpC,uCAAuC,EAEvC,6BAA6B,EAE7B,iCAAiC,EACjC,uCAAuC,EACxC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,KAAK,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO5I,OAAO,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AA+DnI,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AA6BjC,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsRlI,CAAC;AAIL,eAAO,MAAM,6DAA6D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;kBA0GxH,CAAC;AAIL,eAAO,MAAM,uEAAuE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;kBAqHlI,CAAC"}