@anzusystems/common-admin 1.47.0-beta.dev-1789897769 → 1.47.0-beta.dev-1790102667

package/dist/labs.d.ts

@@ -8,12 +8,17 @@ import { DefineComponent } from 'vue';
 import { InjectionKey } from 'vue';
 import { MaybeRefOrGetter } from 'vue';
 import { Method } from 'axios';
+import { Promisify } from '@vueuse/shared';
 import { PublicProps } from 'vue';
 import { Ref } from 'vue';
 import { RouteLocationRaw } from 'vue-router';
+import { SetupStoreDefinition } from 'pinia';
 import { ShallowRef } from 'vue';
 import { ShallowUnwrapRef } from 'vue';
 import { UseDebounceFnReturn } from '@vueuse/shared';
+import { Validation } from '@vuelidate/core';
+import { ValidationRuleWithoutParams } from '@vuelidate/core';
+import { ValidationRuleWithParams } from '@vuelidate/core';
 import { VNode } from 'vue';
 
 declare const __VLS_base: DefineComponent<__VLS_PublicProps, {
@@ -23,12 +28,12 @@ declare const __VLS_base: DefineComponent<__VLS_PublicProps, {
     "update:datatableHiddenColumns": (value: string[] | undefined) => any;
     "update:showDetail": (value: boolean) => any;
 } & {
-    reset: () => any;
     submit: () => any;
+    reset: () => any;
     bookmarkLoadAfter: () => any;
 }, string, PublicProps, Readonly<__VLS_PublicProps> & Readonly<{
-    onReset?: (() => any) | undefined;
     onSubmit?: (() => any) | undefined;
+    onReset?: (() => any) | undefined;
     "onUpdate:datatableHiddenColumns"?: ((value: string[] | undefined) => any) | undefined;
     onBookmarkLoadAfter?: (() => any) | undefined;
     "onUpdate:showDetail"?: ((value: boolean) => any) | undefined;
@@ -43,6 +48,52 @@ declare const __VLS_base: DefineComponent<__VLS_PublicProps, {
     hideMore: boolean;
 }, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
 
+declare const __VLS_base_10: DefineComponent<__VLS_PublicProps_9, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:user": (value: AnzuUser) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_9> & Readonly<{
+    "onUpdate:user"?: ((value: AnzuUser) => any) | undefined;
+}>, {
+    readonly: boolean;
+    isEdit: boolean;
+    randomColor: boolean;
+    permissionGroupEndPoint: string;
+    idInput: boolean;
+    requiredMetadata: boolean;
+    enabledNote: string;
+    metadataNote: string;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_base_11: DefineComponent<__VLS_PublicProps_11, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:user": (value: AnzuUser) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_11> & Readonly<{
+    "onUpdate:user"?: ((value: AnzuUser) => any) | undefined;
+}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_base_12: DefineComponent<__VLS_PublicProps_12, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:modelValue": (value: boolean) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_12> & Readonly<{
+    "onUpdate:modelValue"?: ((value: boolean) => any) | undefined;
+}>, {
+    note: string;
+    readonly: boolean;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_base_13: DefineComponent<__VLS_PublicProps_14, {
+    refresh: () => void;
+}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:activeTab": (value: string) => any;
+} & {
+    created: (descriptor: AnyUserSystemDescriptor) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_14> & Readonly<{
+    onCreated?: ((descriptor: AnyUserSystemDescriptor) => any) | undefined;
+    "onUpdate:activeTab"?: ((value: string) => any) | undefined;
+}>, {
+    unsavedChanges: boolean;
+    readonly: boolean;
+    refreshHook: UserSystemRefreshHook;
+    tabQueryKey: string;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
 declare const __VLS_base_2: DefineComponent<__VLS_Props_2, {
     resetFilter: () => void;
 }, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
@@ -59,12 +110,12 @@ declare const __VLS_base_3: DefineComponent<__VLS_PublicProps_2, {
 }, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
     "update:datatableHiddenColumns": (value: string[] | undefined) => any;
 } & {
-    reset: () => any;
     submit: () => any;
+    reset: () => any;
     bookmarkLoadAfter: () => any;
 }, string, PublicProps, Readonly<__VLS_PublicProps_2> & Readonly<{
-    onReset?: (() => any) | undefined;
     onSubmit?: (() => any) | undefined;
+    onReset?: (() => any) | undefined;
     "onUpdate:datatableHiddenColumns"?: ((value: string[] | undefined) => any) | undefined;
     onBookmarkLoadAfter?: (() => any) | undefined;
 }>, {
@@ -108,9 +159,9 @@ declare const __VLS_base_5: DefineComponent<__VLS_PublicProps_4, {}, {}, {}, {},
     "onUpdate:loadingLocal"?: ((value: boolean) => any) | undefined;
     "onUpdate:fetchedItemsMinimal"?: ((value: Map<string | number, any>) => any) | undefined;
 }>, {
-    required: boolean;
-    label: string;
     loading: boolean;
+    label: string;
+    required: boolean;
     clearable: boolean;
     errorMessage: string;
     v: any;
@@ -127,6 +178,62 @@ declare const __VLS_base_5: DefineComponent<__VLS_PublicProps_4, {}, {}, {}, {},
     minSearchText: string;
 }, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
 
+declare const __VLS_base_6: DefineComponent<__VLS_Props_18, {
+    refresh: UseDebounceFnReturn<() => Promise<void>>;
+    resetFilter: () => void;
+    submitFilter: () => void;
+}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
+    rowClick: (permissionGroup: PermissionGroup) => any;
+}, string, PublicProps, Readonly<__VLS_Props_18> & Readonly<{
+    onRowClick?: ((permissionGroup: PermissionGroup) => any) | undefined;
+}>, {
+    entity: string;
+    endPoint: string;
+    canUpdate: boolean;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_base_7: DefineComponent<__VLS_Props_19, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, PublicProps, Readonly<__VLS_Props_19> & Readonly<{}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_base_8: DefineComponent<__VLS_Props_22, {
+    refresh: UseDebounceFnReturn<() => Promise<void>>;
+    resetFilter: () => void;
+    submitFilter: () => void;
+}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
+    rowClick: (user: AnzuUser) => any;
+}, string, PublicProps, Readonly<__VLS_Props_22> & Readonly<{
+    onRowClick?: ((user: AnzuUser) => any) | undefined;
+}>, {
+    entity: string;
+    endPoint: string;
+    canUpdate: boolean;
+    permissionGroupEndPoint: string;
+    systemColumns: Array<string | {
+        key: string;
+        title: string;
+    }>;
+    impersonate: (user: AnzuUser) => void;
+    canImpersonate: boolean;
+    filterFields: readonly MakeFilterOption[];
+    filterClient: () => AxiosInstance;
+    filterUserId: IntegerIdNullable;
+    filterStore: FilterStoreIdentifier;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_base_9: DefineComponent<__VLS_PublicProps_8, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:datatableHiddenColumns": (value: string[] | undefined) => any;
+} & {
+    submit: () => any;
+    reset: () => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_8> & Readonly<{
+    onSubmit?: (() => any) | undefined;
+    onReset?: (() => any) | undefined;
+    "onUpdate:datatableHiddenColumns"?: ((value: string[] | undefined) => any) | undefined;
+}>, {
+    userId: IntegerIdNullable;
+    client: () => AxiosInstance;
+    store: FilterStoreIdentifier;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
 declare const __VLS_export: __VLS_WithSlots<typeof __VLS_base, __VLS_Slots>;
 
 declare const __VLS_export_10: DefineComponent<__VLS_Props_8, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
@@ -458,10 +565,163 @@ declare const __VLS_export_22: DefineComponent<__VLS_Props_15, {}, {}, {}, {}, C
 
 declare const __VLS_export_23: DefineComponent<__VLS_Props_16, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, PublicProps, Readonly<__VLS_Props_16> & Readonly<{}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
 
+declare const __VLS_export_24: DefineComponent<__VLS_PublicProps_6, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:modelValue": (value: Permissions_2) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_6> & Readonly<{
+    "onUpdate:modelValue"?: ((value: Permissions_2) => any) | undefined;
+}>, {
+    roles: string[];
+    resolvedPermissions: Permissions_2;
+    entity: string;
+    readonly: boolean;
+    endPoint: string;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_25: __VLS_WithSlots_6<typeof __VLS_base_6, __VLS_Slots_6>;
+
+declare const __VLS_export_26: __VLS_WithSlots_7<typeof __VLS_base_7, __VLS_Slots_7>;
+
+declare const __VLS_export_27: DefineComponent<{}, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
+    submit: () => any;
+    reset: () => any;
+}, string, PublicProps, Readonly<{}> & Readonly<{
+    onSubmit?: (() => any) | undefined;
+    onReset?: (() => any) | undefined;
+}>, {}, {}, {}, {}, string, ComponentProvideOptions, true, {}, any>;
+
+declare const __VLS_export_28: DefineComponent<__VLS_Props_20, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, PublicProps, Readonly<__VLS_Props_20> & Readonly<{}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_29: DefineComponent<__VLS_PublicProps_7, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:modelValue": (value: number | number[] | null) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_7> & Readonly<{
+    "onUpdate:modelValue"?: ((value: number | number[] | null) => any) | undefined;
+}>, {
+    label: string;
+    required: boolean;
+    dataCy: string;
+    entity: string;
+    clearable: boolean;
+    readonly: boolean;
+    multiple: boolean;
+    endPoint: string;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
 declare const __VLS_export_3: __VLS_WithSlots_3<typeof __VLS_base_3, __VLS_Slots_3>;
 
+declare const __VLS_export_30: __VLS_WithSlots_8<typeof __VLS_base_8, __VLS_Slots_8>;
+
+declare const __VLS_export_31: __VLS_WithSlots_9<typeof __VLS_base_9, __VLS_Slots_9>;
+
+declare const __VLS_export_32: __VLS_WithSlots_10<typeof __VLS_base_10, __VLS_Slots_10>;
+
+declare const __VLS_export_33: DefineComponent<__VLS_PublicProps_10, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:modelValue": (value: string[]) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_10> & Readonly<{
+    "onUpdate:modelValue"?: ((value: string[]) => any) | undefined;
+}>, {
+    entity: string;
+    readonly: boolean;
+    endPoint: string;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_34: __VLS_WithSlots_11<typeof __VLS_base_11, __VLS_Slots_11>;
+
+declare const __VLS_export_35: __VLS_WithSlots_12<typeof __VLS_base_12, __VLS_Slots_12>;
+
+declare const __VLS_export_36: DefineComponent<__VLS_PublicProps_13, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:user": (value: BaseUser) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_13> & Readonly<{
+    "onUpdate:user"?: ((value: BaseUser) => any) | undefined;
+}>, {
+    note: string;
+    required: boolean;
+    readonly: boolean;
+    isEdit: boolean;
+    randomColor: boolean;
+    validationScope: string | false | symbol;
+    idInput: boolean;
+    scopeSystem: string;
+    scopeSubject: string;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_37: DefineComponent<__VLS_Props_29, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, PublicProps, Readonly<__VLS_Props_29> & Readonly<{}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_38: DefineComponent<__VLS_Props_30, {
+    refresh: () => Promise<void>;
+}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
+    create: (descriptor: AnyUserSystemDescriptor, user: BaseUser) => any;
+}, string, PublicProps, Readonly<__VLS_Props_30> & Readonly<{
+    onCreate?: ((descriptor: AnyUserSystemDescriptor, user: BaseUser) => any) | undefined;
+}>, {
+    source: BaseUser | null;
+    readonly: boolean;
+    createEnabled: boolean;
+    creating: boolean;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_39: DefineComponent<__VLS_Props_31, {
+    refresh: () => void;
+    refreshSystem: (system: string) => void;
+}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
+    create: (descriptor: AnyUserSystemDescriptor, user: BaseUser) => any;
+}, string, PublicProps, Readonly<__VLS_Props_31> & Readonly<{
+    onCreate?: ((descriptor: AnyUserSystemDescriptor, user: BaseUser) => any) | undefined;
+}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
 declare const __VLS_export_4: DefineComponent<{}, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, PublicProps, Readonly<{}> & Readonly<{}>, {}, {}, {}, {}, string, ComponentProvideOptions, true, {}, any>;
 
+declare const __VLS_export_40: __VLS_WithSlots_13<typeof __VLS_base_13, __VLS_Slots_13>;
+
+declare const __VLS_export_41: DefineComponent<__VLS_Props_33, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
+    confirm: (user: BaseUser) => any;
+}, string, PublicProps, Readonly<__VLS_Props_33> & Readonly<{
+    onConfirm?: ((user: BaseUser) => any) | undefined;
+}>, {
+    disabled: boolean;
+    userId: IntegerIdNullable;
+    willBeEnabled: boolean;
+    loading: boolean;
+    source: BaseUser | null;
+    requiredMetadata: boolean;
+    createNote: string;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_42: DefineComponent<__VLS_Props_34, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, PublicProps, Readonly<__VLS_Props_34> & Readonly<{}>, {
+    internalLabel: string;
+}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_43: DefineComponent<__VLS_Props_35, {
+    search: (value: string) => Promise<void>;
+}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
+    searched: (term: string) => any;
+}, string, PublicProps, Readonly<__VLS_Props_35> & Readonly<{
+    onSearched?: ((term: string) => any) | undefined;
+}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_44: DefineComponent<__VLS_PublicProps_15, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:open": (value: boolean) => any;
+} & {
+    run: (systems: string[]) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_15> & Readonly<{
+    onRun?: ((systems: string[]) => any) | undefined;
+    "onUpdate:open"?: ((value: boolean) => any) | undefined;
+}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
+declare const __VLS_export_45: DefineComponent<__VLS_PublicProps_16, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    "update:open": (value: boolean) => any;
+} & {
+    confirm: (payload: {
+        target: BaseUser;
+        systems: string[];
+    }) => any;
+}, string, PublicProps, Readonly<__VLS_PublicProps_16> & Readonly<{
+    onConfirm?: ((payload: {
+        target: BaseUser;
+        systems: string[];
+    }) => any) | undefined;
+    "onUpdate:open"?: ((value: boolean) => any) | undefined;
+}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+
 declare const __VLS_export_5: DefineComponent<__VLS_Props_4, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {} & {
     change: () => any;
 }, string, PublicProps, Readonly<__VLS_Props_4> & Readonly<{
@@ -535,6 +795,34 @@ declare type __VLS_ModelProps = {
     'showDetail'?: boolean;
 };
 
+declare type __VLS_ModelProps_10 = {
+    modelValue: string[];
+};
+
+declare type __VLS_ModelProps_11 = {
+    'user': AnzuUser;
+};
+
+declare type __VLS_ModelProps_12 = {
+    modelValue: boolean;
+};
+
+declare type __VLS_ModelProps_13 = {
+    'user': BaseUser;
+};
+
+declare type __VLS_ModelProps_14 = {
+    'activeTab'?: string;
+};
+
+declare type __VLS_ModelProps_15 = {
+    'open': boolean;
+};
+
+declare type __VLS_ModelProps_16 = {
+    'open': boolean;
+};
+
 declare type __VLS_ModelProps_2 = {
     'datatableHiddenColumns'?: string[] | undefined;
 };
@@ -553,6 +841,23 @@ declare type __VLS_ModelProps_5 = {
     modelValue: boolean;
 };
 
+declare type __VLS_ModelProps_6 = {
+    modelValue: Permissions_2;
+};
+
+declare type __VLS_ModelProps_7 = {
+    modelValue: IntegerId | IntegerId[] | null;
+};
+
+declare type __VLS_ModelProps_8 = {
+    /** The column set a bookmark restores along with the filter values. */
+    'datatableHiddenColumns'?: string[] | undefined;
+};
+
+declare type __VLS_ModelProps_9 = {
+    'user': AnzuUser;
+};
+
 declare type __VLS_PrettifyLocal<T> = (T extends any ? {
     [K in keyof T]: T[K];
 } : {
@@ -667,10 +972,235 @@ declare type __VLS_Props_16 = {
     logPaths: LogPaths;
 };
 
+declare type __VLS_Props_17 = {
+    client: AxiosClientFn;
+    /** Which backend's permission vocabulary to draw. Never a global -- see `permissionConfigActions`. */
+    system: string;
+    entity?: string | undefined;
+    endPoint?: string | undefined;
+    /**
+     * The grants the subject already has from roles and groups. Undefined means "this model is a
+     * group, not a user": the origin column then reads every explicit grant as coming from the
+     * group itself rather than from the user.
+     */
+    resolvedPermissions?: Permissions_2 | undefined;
+    roles?: string[];
+    /** One component for detail and edit (decision 27). Readonly drops the grant column. */
+    readonly?: boolean;
+};
+
+declare type __VLS_Props_18 = {
+    client: AxiosClientFn;
+    /** Backend identity: keys the filter store and the cache, and reaches every api call. */
+    system: string;
+    entity?: string | undefined;
+    endPoint?: string | undefined;
+    /** Where a row and the detail button go. The library cannot know an app's typed route names. */
+    detailRoute: (permissionGroup: PermissionGroup) => RouteLocationRaw;
+    editRoute: (permissionGroup: PermissionGroup) => RouteLocationRaw;
+    /** Already-evaluated ACL. A boolean, not an `AclValue`: see 5.1 of the plan. */
+    canUpdate?: boolean;
+};
+
+declare type __VLS_Props_19 = {
+    client: AxiosClientFn;
+    system: string;
+    entity?: string | undefined;
+    endPoint?: string | undefined;
+};
+
 declare type __VLS_Props_2 = {
     formName?: string;
 };
 
+declare type __VLS_Props_20 = {
+    client: AxiosClientFn;
+    /** Backend identity for the permission config fetch, not the i18n namespace below. */
+    system: string;
+    entity?: string | undefined;
+    endPoint?: string | undefined;
+};
+
+declare type __VLS_Props_21 = {
+    client: AxiosClientFn;
+    system: string;
+    entity?: string | undefined;
+    endPoint?: string | undefined;
+    label?: string | undefined;
+    required?: boolean | undefined;
+    multiple?: boolean;
+    clearable?: boolean;
+    readonly?: boolean;
+    dataCy?: string;
+};
+
+declare type __VLS_Props_22 = {
+    client: AxiosClientFn;
+    system: string;
+    entity?: string | undefined;
+    endPoint?: string | undefined;
+    detailRoute: (user: AnzuUser) => RouteLocationRaw;
+    editRoute: (user: AnzuUser) => RouteLocationRaw;
+    /** Already-evaluated ACL of the owning system. */
+    canUpdate?: boolean;
+    /** The permission-group endpoint, which is not the user one. */
+    permissionGroupEndPoint?: string;
+    /**
+     * Extra columns the app draws through `#systemColumns`, appended after the shared ones.
+     *
+     * A bare key takes its header from the library's own `common.anzuUser.model.*`, which holds
+     * eight keys and none of any system's -- so a system column passes its title already
+     * translated, out of the namespace that has it.
+     */
+    systemColumns?: Array<string | {
+        key: string;
+        title: string;
+    }>;
+    /**
+     * Signing in as somebody else, as a switchable feature.
+     *
+     * A callback rather than a path, because there is more than one mechanism: cms posts to
+     * `/adm/users/{id}/impersonate` and gets a JWT with an impersonation claim, blog opens the
+     * public site through `window.open`. Only the cms one reaches a shared component -- blog's
+     * hangs off its product user, which is a different view -- so one prop is enough for now.
+     * Left unset, nothing is drawn.
+     */
+    impersonate?: ((user: AnzuUser) => void) | undefined;
+    canImpersonate?: boolean;
+    /**
+     * Filter fields this system adds to the shared three.
+     *
+     * A parameter and not part of the shared list, because the same filter is not the same query
+     * everywhere: cms asks for permission groups with `memberOf`, dam with `custom`, and
+     * `allowedSites` exists only in cms. A plain field needs nothing more -- the generic renderer
+     * draws it -- while one that wants a remote autocomplete comes in through `#filter.<name>`.
+     */
+    filterFields?: readonly MakeFilterOption[];
+    /**
+     * Saved filters, which are stored per user, so both are needed for the button to appear. cms
+     * and dam have them on the list this replaces; the other three admins do not.
+     */
+    filterClient?: (() => AxiosInstance) | undefined;
+    filterUserId?: IntegerIdNullable | undefined;
+    /** Where saved bookmarks are filed; see `AAnzuUserFilter`. */
+    filterStore?: FilterStoreIdentifier | undefined;
+};
+
+declare type __VLS_Props_23 = {
+    /**
+     * Both are what switches the bookmark UI on in `AFilterWrapper`, and both have to be there for
+     * it to appear -- bookmarks are stored per user. Left unset, the filter is drawn without them,
+     * which is what admin-inhouse, blog and forum have.
+     */
+    client?: (() => AxiosInstance) | undefined;
+    userId?: IntegerIdNullable | undefined;
+    /**
+     * What the saved bookmarks are filed under on the server.
+     *
+     * Left unset it is the filter's own `common` / `anzuUser`. cms overrides it with the pair its
+     * old list used, so the bookmarks operators already have keep showing up -- the field names are
+     * the same, and a new key would simply orphan them.
+     */
+    store?: FilterStoreIdentifier | undefined;
+};
+
+declare type __VLS_Props_24 = {
+    client: AxiosClientFn;
+    system: string;
+    /**
+     * The permission-group endpoint, which is not the user one.
+     *
+     * There is deliberately no `entity` prop here. `entity` names a *resource*, not a system, and
+     * it is what a server validation failure is filed under -- so the group autocomplete, the role
+     * list and the permission editor each use their own, and passing the user's down would file a
+     * group's error under the user's labels.
+     */
+    permissionGroupEndPoint?: string;
+    /**
+     * One component for detail and edit (decision 27). Two parallel components drift: a field
+     * added to the editable one and forgotten in the other is a silent divergence with nothing to
+     * fail.
+     */
+    readonly?: boolean;
+    isEdit?: boolean;
+    /** From the system's descriptor. */
+    requiredMetadata?: boolean;
+    idInput?: boolean;
+    randomColor?: boolean;
+    enabledNote?: string | undefined;
+    metadataNote?: string | undefined;
+};
+
+declare type __VLS_Props_25 = {
+    client: AxiosClientFn;
+    /** Roles are per backend: they come from that system's `/adm/v1/permissions/config`. */
+    system: string;
+    entity?: string | undefined;
+    endPoint?: string | undefined;
+    readonly?: boolean;
+};
+
+declare type __VLS_Props_26 = {
+    /**
+     * Reads the source account from the server. It is a prop because the shape of a user differs per
+     * system -- cms answers `CmsUserDto`, dam `DamUserDto` -- and because the page already holds an
+     * api instance pointed at the right backend.
+     */
+    fetchSourceUser: (id: number) => Promise<AnzuUser>;
+    /**
+     * Copies whatever the system keeps beyond roles, groups and grants. cms has nineteen such
+     * fields; systems with none leave this out.
+     */
+    copySystemFields?: ((target: AnzuUser, source: AnzuUser) => void) | undefined;
+    /** i18n keys listed in the dialog, so the operator sees exactly what will be overwritten. */
+    copiedSettingKeys?: string[];
+};
+
+declare type __VLS_Props_27 = {
+    readonly?: boolean;
+    /**
+     * The system's `enabledNote`. A static string from the descriptor rather than a slot: a slot
+     * would have to be filled by every admin separately, could drift from the wording in the bulk
+     * dialog, and -- worst -- could be forgotten in admin-blog, which is the one place the sentence
+     * matters most. The slot below stays as an escape hatch for more than a line of text.
+     */
+    note?: string | undefined;
+};
+
+declare type __VLS_Props_28 = {
+    /**
+     * The system's validation profile (`requiredMetadata`). The cross-system repair form passes
+     * `true` outright: it writes to nine places at once, and a loose form could put an empty name
+     * into cms -- a record cms's own form would then refuse to save.
+     */
+    required?: boolean;
+    /**
+     * Whether the id is typed in at all. False only in cms, whose backend resolves it from SSO.
+     * With `isEdit` this makes three states, which one `readonly` could not express: not drawn,
+     * editable, or shown read-only.
+     */
+    idInput?: boolean;
+    isEdit?: boolean;
+    readonly?: boolean;
+    /**
+     * Random colour on an empty value, as all four admins do today. Deliberately not passed by the
+     * cross-system repair form: it is always strict, so it would invent a colour on open and mark
+     * it as a change in every system at once.
+     */
+    randomColor?: boolean;
+    /** The system's `metadataNote` -- the same sentence the cross-system dialog shows. */
+    note?: string | undefined;
+    /** i18n namespace for the field labels; the backend identity does not belong here. */
+    scopeSystem?: string;
+    scopeSubject?: string;
+    /** Vuelidate scope. Omitted means the page's own collector picks these rules up. */
+    validationScope?: string | symbol | false | undefined;
+};
+
+declare type __VLS_Props_29 = {
+    axes: UserSystemAxes;
+};
+
 declare type __VLS_Props_3 = {
     hideButtons?: boolean;
     formName?: string;
@@ -680,6 +1210,125 @@ declare type __VLS_Props_3 = {
     store?: FilterStoreIdentifier | boolean;
 };
 
+declare type __VLS_Props_30 = {
+    descriptor: AnyUserSystemDescriptor;
+    userId: IntegerId;
+    /**
+     * On a viewing page there is no Create. A write action on a read-only screen would be the first
+     * in the fleet; Manage stays, because it only leads somewhere.
+     */
+    readonly?: boolean;
+    /** Whether the account about to be created would be switched on. */
+    createEnabled?: boolean;
+    /** What the owning system holds, to prefill the create form. */
+    source?: BaseUser | null;
+    creating?: boolean;
+};
+
+declare type __VLS_Props_31 = {
+    descriptors: AnyUserSystemDescriptor[];
+    userId: IntegerId;
+    readonly?: boolean;
+    /** Whether an account created from here would be switched on -- the dialog says so out loud. */
+    createEnabled?: boolean;
+    /** What the owning system holds, to prefill the create form. */
+    source?: BaseUser | null;
+    /** The system a create is currently running for. */
+    creatingSystem?: string | null;
+};
+
+declare type __VLS_Props_32 = {
+    userId: IntegerId;
+    /** Which tab carries the owning form, i.e. gets the slot. */
+    owner: string;
+    /**
+     * The tabs, in the order they are drawn, plus "other systems" appended by this component.
+     *
+     * A prop and not something derived from the descriptor array, because the list depends on the
+     * route rather than on what the admin owns: admin-inhouse owns four systems and has two tabs,
+     * since the system is part of the path.
+     */
+    ownedTabs: string[];
+    /** Every system this admin can reach. The "other systems" tab lists the ones not in a tab. */
+    descriptors: AnyUserSystemDescriptor[];
+    /**
+     * "After a 401, refresh once and try again."
+     *
+     * The library cannot decide this for itself: the mechanism exists only in the apps, and each
+     * one does it differently -- inhouse `refreshSession`, cms and contentHub their own
+     * `refresh-token` call. Without it an expired token renders as "no account in this system",
+     * which is the one confusion decision 16 forbids. Every panel this shell draws gets it.
+     */
+    refreshHook?: UserSystemRefreshHook | undefined;
+    readonly?: boolean;
+    /**
+     * Whether the owning form holds edits that have not been saved.
+     *
+     * It drives two things. The dot on the owning tab, so the operator can see it from the other
+     * tabs -- the Save button itself is visible everywhere, by decision, because a button that
+     * disappeared would read as "this is read-only". And the guard below, which is the only thing
+     * standing between unsaved work and the button in a panel that leaves the page: switching a tab
+     * is not navigation, so nothing else ever asks.
+     */
+    unsavedChanges?: boolean;
+    /** Query key for the deep link. */
+    tabQueryKey?: string;
+};
+
+declare type __VLS_Props_33 = {
+    /** The system's name as the app translates it. */
+    systemLabel: string;
+    /** The system's `createNote` -- what is special about having an account there. */
+    createNote?: string | undefined;
+    /**
+     * Whether the account about to be created will be switched on.
+     *
+     * The sentence about a working public account is composed here rather than carried by the
+     * descriptor, because it depends on the value being sent: creating from a panel copies the
+     * source account's `enabled` -- usually true -- while creating after a search that found
+     * nobody sends false, since there is no source to copy from.
+     */
+    willBeEnabled?: boolean;
+    loading?: boolean;
+    disabled?: boolean;
+    /** The target system's `requiredMetadata`: the profile the form validates against. */
+    requiredMetadata?: boolean;
+    /** The person's id. Always drawn and never editable here -- this path is about somebody who exists. */
+    userId?: IntegerIdNullable;
+    /**
+     * What is already known about them, to prefill the form.
+     *
+     * Not the body that gets posted: the caller reads the source again immediately before the POST.
+     * This is what the operator sees and completes, and completing it is the point -- a person known
+     * only in blog usually has an empty `person`, while the target may require it, so a silent copy
+     * would create a record the target's own form then refuses to save.
+     */
+    source?: BaseUser | null;
+};
+
+declare type __VLS_Props_34 = {
+    target: UserSystemManageTarget;
+    /** The system's name as the app translates it. */
+    systemLabel: string;
+    /** "Edit" instead of "Manage in X" -- used where the operator is already in that admin. */
+    internalLabel?: string | undefined;
+};
+
+declare type __VLS_Props_35 = {
+    /** Order matters twice: the order of the rows, and the priority when pre-filling. */
+    descriptors: AnyUserSystemDescriptor[];
+    refreshHook?: UserSystemRefreshHook | undefined;
+};
+
+declare type __VLS_Props_36 = {
+    action: BulkActionType;
+    descriptors: AnyUserSystemDescriptor[];
+};
+
+declare type __VLS_Props_37 = {
+    descriptors: AnyUserSystemDescriptor[];
+};
+
 declare type __VLS_Props_4 = {
     name: string;
     allT?: string;
@@ -728,6 +1377,20 @@ declare type __VLS_Props_9 = {
 
 declare type __VLS_PublicProps = __VLS_Props & __VLS_ModelProps;
 
+declare type __VLS_PublicProps_10 = __VLS_Props_25 & __VLS_ModelProps_10;
+
+declare type __VLS_PublicProps_11 = __VLS_Props_26 & __VLS_ModelProps_11;
+
+declare type __VLS_PublicProps_12 = __VLS_Props_27 & __VLS_ModelProps_12;
+
+declare type __VLS_PublicProps_13 = __VLS_Props_28 & __VLS_ModelProps_13;
+
+declare type __VLS_PublicProps_14 = __VLS_Props_32 & __VLS_ModelProps_14;
+
+declare type __VLS_PublicProps_15 = __VLS_Props_36 & __VLS_ModelProps_15;
+
+declare type __VLS_PublicProps_16 = __VLS_Props_37 & __VLS_ModelProps_16;
+
 declare type __VLS_PublicProps_2 = __VLS_Props_3 & __VLS_ModelProps_2;
 
 declare type __VLS_PublicProps_3 = __VLS_Props_11 & __VLS_ModelProps_3;
@@ -736,6 +1399,14 @@ declare type __VLS_PublicProps_4 = __VLS_Props_13 & __VLS_ModelProps_4;
 
 declare type __VLS_PublicProps_5 = __VLS_Props_14 & __VLS_ModelProps_5;
 
+declare type __VLS_PublicProps_6 = __VLS_Props_17 & __VLS_ModelProps_6;
+
+declare type __VLS_PublicProps_7 = __VLS_Props_21 & __VLS_ModelProps_7;
+
+declare type __VLS_PublicProps_8 = __VLS_Props_23 & __VLS_ModelProps_8;
+
+declare type __VLS_PublicProps_9 = __VLS_Props_24 & __VLS_ModelProps_9;
+
 declare type __VLS_Slots = {} & {
     [K in NonNullable<typeof __VLS_123>]?: (props: typeof __VLS_124) => any;
 } & {
@@ -750,6 +1421,26 @@ declare type __VLS_Slots = {} & {
     detail?: (props: typeof __VLS_108) => any;
 };
 
+declare type __VLS_Slots_10 = {} & {
+    copyPermissions?: (props: typeof __VLS_42) => any;
+} & {
+    systemFields?: (props: typeof __VLS_50) => any;
+} & {
+    actions?: (props: typeof __VLS_80) => any;
+};
+
+declare type __VLS_Slots_11 = {} & {
+    sourcePicker?: (props: typeof __VLS_35) => any;
+};
+
+declare type __VLS_Slots_12 = {} & {
+    note?: (props: typeof __VLS_17) => any;
+};
+
+declare type __VLS_Slots_13 = {} & {
+    default?: (props: typeof __VLS_30) => any;
+};
+
 declare type __VLS_Slots_2 = {} & {
     default?: (props: typeof __VLS_11) => any;
 };
@@ -772,12 +1463,64 @@ declare type __VLS_Slots_5 = {} & {
     'append-item'?: (props: typeof __VLS_14) => any;
 };
 
+declare type __VLS_Slots_6 = {} & {
+    createdBy?: (props: typeof __VLS_47) => any;
+} & {
+    modifiedBy?: (props: typeof __VLS_55) => any;
+};
+
+declare type __VLS_Slots_7 = {} & {
+    tracking?: (props: typeof __VLS_82) => any;
+};
+
+declare type __VLS_Slots_8 = {} & {
+    [K in NonNullable<typeof __VLS_12>]?: (props: typeof __VLS_13) => any;
+} & {
+    permissionGroups?: (props: typeof __VLS_54) => any;
+} & {
+    systemColumns?: (props: typeof __VLS_70) => any;
+} & {
+    createdBy?: (props: typeof __VLS_78) => any;
+} & {
+    modifiedBy?: (props: typeof __VLS_86) => any;
+} & {
+    rowActions?: (props: typeof __VLS_111) => any;
+};
+
+declare type __VLS_Slots_9 = {} & {
+    [K in NonNullable<typeof __VLS_20>]?: (props: typeof __VLS_21) => any;
+};
+
 declare type __VLS_WithSlots<T, S> = T & {
     new (): {
         $slots: S;
     };
 };
 
+declare type __VLS_WithSlots_10<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};
+
+declare type __VLS_WithSlots_11<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};
+
+declare type __VLS_WithSlots_12<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};
+
+declare type __VLS_WithSlots_13<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};
+
 declare type __VLS_WithSlots_2<T, S> = T & {
     new (): {
         $slots: S;
@@ -802,6 +1545,40 @@ declare type __VLS_WithSlots_5<T, S> = T & {
     };
 };
 
+declare type __VLS_WithSlots_6<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};
+
+declare type __VLS_WithSlots_7<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};
+
+declare type __VLS_WithSlots_8<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};
+
+declare type __VLS_WithSlots_9<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};
+
+export declare const AAnzuUserDatatable: typeof __VLS_export_30;
+
+export declare const AAnzuUserFilter: typeof __VLS_export_31;
+
+export declare const AAnzuUserForm: typeof __VLS_export_32;
+
+export declare const AAnzuUserRoleAutocomplete: typeof __VLS_export_33;
+
+declare type AclValue = `${string}_${string}_${string}`;
+
 export declare const ADatatableOrdering: typeof __VLS_export_13;
 
 export declare const ADatatablePagination: typeof __VLS_export_14;
@@ -839,6 +1616,8 @@ declare interface AddButtonSlotProps_3 {
     };
 }
 
+declare type AddToCachedArgs<T extends DocId | IntegerId> = Array<T | null | undefined> | Array<Array<T | null | undefined> | T | null | undefined>;
+
 export declare const AFilterBooleanSelect: typeof __VLS_export_5;
 
 export declare const AFilterDatetimePicker: typeof __VLS_export_6;
@@ -875,16 +1654,123 @@ export declare const ALogListView: typeof __VLS_export_22;
 
 export declare const ANestedSortableListEditor: typeof __VLS_export_20;
 
+/**
+ * The erasure boundary for a heterogeneous array.
+ *
+ * Descriptors differ in `TUser` -- blog's `extraState` reaches for `status`, forum's for
+ * `settings.banned` -- so an array of them cannot keep each one's type. Without a single place to
+ * erase it, `strict: true` would demand a cast in every admin, at every call site. This does it
+ * once, where the array is built.
+ */
+export declare type AnyUserSystemDescriptor = UserSystemDescriptor<string, AnzuUser>;
+
+export declare const ANZU_USER_ENDPOINT = "/adm/v1/anzu-user";
+
+export declare const ANZU_USER_ENTITY = "anzuUser";
+
+declare interface AnzuUser extends AnzuUserAndTimeTrackingAware, BaseUser {
+    enabled: boolean;
+    locale: LanguageCode | null;
+    roles: string[];
+    permissionGroups: IntegerId[];
+    permissions: Permissions_2;
+    resolvedPermissions: Permissions_2;
+    _resourceName: string;
+    _system: string;
+}
+
+export declare interface AnzuUserActionsParams {
+    client: AxiosClientFn;
+    system: string;
+    entity?: string;
+    /**
+     * i18n scope for a server-side validation failure, which is a different question from which
+     * backend answered. `AnzuApiValidationError` builds `<system>.<entity>.model.<field>` keys, so
+     * the pair has to name the namespace the *labels* live under. It defaults to `common` +
+     * `anzuUser`, which is where the shared form's own fields are; an admin whose form carries
+     * system fields as well passes its own pair, and keeps the base keys beside them.
+     */
+    validationSystem?: string;
+    validationEntity?: string;
+    endPoint?: string;
+    /** Vuelidate scope, when the page collects its fields under one of its own. */
+    validationScope?: string | symbol;
+}
+
 declare interface AnzuUserAndTimeTrackingAware extends CreatedByAware {
     createdAt: DatetimeUTC;
     modifiedAt: DatetimeUTC;
     modifiedBy: IntegerIdNullable;
 }
 
+export declare interface AnzuUserApiParams {
+    client: AxiosClientFn;
+    /**
+     * Both reach every `useApiRequest` built here. The admins' copies declared `system = 'common'`
+     * and `entity = 'anzuUser'` as file constants, which is why a shared version has to take them:
+     * the same file now serves nine backends, and the error context has to name the right one.
+     */
+    system: string;
+    entity?: string;
+    /**
+     * i18n scope for a server-side validation failure, which is a different question from which
+     * backend answered. `AnzuApiValidationError` builds `<system>.<entity>.model.<field>` keys, and
+     * for a component shared by nine backends the labels are always the library's own `common.*` --
+     * `weather.anzuUser.model.email` exists nowhere. Defaults to `common` plus the entity;
+     * contentHub passes its own pair to keep the keys it already has.
+     */
+    validationSystem?: string;
+    validationEntity?: string;
+    endPoint?: string;
+}
+
+/** `/adm/v1/anzu-user`. Absent in contentHub, which has only `/adm/users`. */
+export declare interface AnzuUserEndpointPair {
+    get: string;
+    put: string;
+    post: string;
+}
+
+export declare const anzuUserFilterStorageKey: (system: string) => string;
+
+declare const anzuUserListFields: ({
+    name: "id";
+    default: null;
+    type: "integer";
+    variant?: undefined;
+    render?: undefined;
+} | {
+    name: "email";
+    variant: "startsWith";
+    default: null;
+    type: "string";
+    render: {
+        skip: true;
+    };
+} | {
+    name: "enabled";
+    default: null;
+    type: "boolean";
+    variant?: undefined;
+    render?: undefined;
+})[];
+
 declare interface AnzuUserMinimal extends BaseUser {
     id: IntegerId;
 }
 
+export declare const APermissionEditor: typeof __VLS_export_24;
+
+export declare const APermissionGroupDatatable: typeof __VLS_export_25;
+
+export declare const APermissionGroupDetail: typeof __VLS_export_26;
+
+export declare const APermissionGroupFilter: typeof __VLS_export_27;
+
+export declare const APermissionGroupManage: typeof __VLS_export_28;
+
+export declare const APermissionGroupRemoteAutocomplete: typeof __VLS_export_29;
+
 export declare type ApiErrorContext = {
     system: string;
     entity: string;
@@ -905,6 +1791,18 @@ export declare type ApiErrorContext = {
      * reaches the logger and is filtered here, on this field.
      */
     status?: number;
+    /**
+     * The i18n scope a field-level validation failure is reported under, when it is not the same as
+     * the backend above.
+     *
+     * `AnzuApiValidationError` turns the server's field names into `<system>.<entity>.model.<field>`
+     * translation keys. For a component shared by nine backends those two are different questions:
+     * *which* backend failed -- which is what the report needs -- and *whose labels* name its fields,
+     * which for a shared form is always the library's own `common.*`. Left unset, the two stay one
+     * value, exactly as before.
+     */
+    validationSystem?: string;
+    validationEntity?: string;
 };
 
 export declare type ApiErrorLogger = (error: Error, context: ApiErrorContext) => void;
@@ -927,6 +1825,30 @@ export declare const ASubjectSelect: typeof __VLS_export_17;
 
 export declare const AUnsavedConfirmDialog: typeof __VLS_export_21;
 
+export declare const AUserBulkActionDialog: typeof __VLS_export_44;
+
+export declare const AUserCopyPermissionsDialog: typeof __VLS_export_34;
+
+export declare const AUserCreateInSystemButton: typeof __VLS_export_41;
+
+export declare const AUserEnabledSwitch: typeof __VLS_export_35;
+
+export declare const AUserManageButton: typeof __VLS_export_42;
+
+export declare const AUserMetadataForm: typeof __VLS_export_36;
+
+export declare const AUserMetadataRepairDialog: typeof __VLS_export_45;
+
+export declare const AUserOtherSystemsTable: typeof __VLS_export_39;
+
+export declare const AUserSystemOverview: typeof __VLS_export_43;
+
+export declare const AUserSystemPanel: typeof __VLS_export_38;
+
+export declare const AUserSystemStatusChip: typeof __VLS_export_37;
+
+export declare const AUserTabsShell: typeof __VLS_export_40;
+
 export declare type AxiosClientFn = () => AxiosInstance;
 
 declare interface BaseUser {
@@ -943,6 +1865,11 @@ declare interface BaseUser {
     };
 }
 
+/** `/adm/users`. Only cms, dam and contentHub have it; it is the only path with a `PATCH`. */
+export declare interface BaseUserEndpointPair extends AnzuUserEndpointPair {
+    patch: string;
+}
+
 /**
  * Hash for a filter link, with values equal to their default left out.
  *
@@ -954,6 +1881,44 @@ declare interface BaseUser {
  */
 export declare function buildFilterHash<F extends readonly MakeFilterOption<string>[]>(filterConfig: FilterConfig<F>, filters: Partial<Record<keyof FilterData<F> & string, AllowedFilterValues>>, sortBy?: DatatableSortBy): string;
 
+export declare const BulkAction: {
+    readonly Enable: "enable";
+    readonly Disable: "disable";
+    readonly Metadata: "metadata";
+};
+
+export declare type BulkActionType = (typeof BulkAction)[keyof typeof BulkAction];
+
+export declare interface BulkLogEntry {
+    system: string;
+    outcome: BulkOutcomeType;
+    /**
+     * Which run the line belongs to.
+     *
+     * The log survives a run so that a retry does not erase the systems that succeeded a minute ago,
+     * and the retry button acts on whatever the log calls failed. Without these two fields a failed
+     * metadata write would be retried as a disable, and a previous person's failures would be retried
+     * against the id currently on screen -- neither `setEnabled` nor `writeMetadata` can tell it is
+     * being asked about a different action or a different account.
+     */
+    action: BulkActionType;
+    subjectId: IntegerIdNullable;
+    detail?: string;
+}
+
+export declare const BulkOutcome: {
+    readonly Pending: "pending";
+    readonly Running: "running";
+    readonly Done: "done";
+    readonly Forbidden: "forbidden";
+    readonly Unauthenticated: "unauthenticated";
+    readonly NotFound: "notFound";
+    readonly Invalid: "invalid";
+    readonly Unavailable: "unavailable";
+};
+
+export declare type BulkOutcomeType = (typeof BulkOutcome)[keyof typeof BulkOutcome];
+
 /**
  * `_unresolved` is terminal: the fetch settled without resolving the item, either because
  * it failed or because the server did not return it.
@@ -963,6 +1928,37 @@ declare type CachedItem<T extends object> = T & {
     _unresolved?: boolean;
 };
 
+export declare interface CachedPermissionGroupsParams {
+    client: AxiosClientFn;
+    system: string;
+    entity?: string;
+    endPoint?: string;
+}
+
+/**
+ * How a probe response becomes axes.
+ *
+ * 401 is its own case and it is not a detail. A first 401 is ambiguous -- an expired session looks
+ * exactly like "no account here" -- and since the buttons are gated by this answer alone, showing
+ * an expired token as "no account here" is the one confusion decision 16 forbids. The caller is
+ * expected to have retried through its refresh hook before classifying; what arrives here is the
+ * verdict after that retry.
+ *
+ * 422 deliberately has no case. A detail GET loads the record and returns it; it does not validate
+ * a body. A 422 belongs to the log of writes.
+ */
+export declare const classifyProbeStatus: (status: number | null) => Pick<UserSystemAxes, "presence" | "access">;
+
+/**
+ * What the operator is told about a failed write.
+ *
+ * 422 and 400 are their own line and not a generic failure: a PUT validates the whole body, and an
+ * account carrying a colour or an e-mail that no longer passes validation will fail even on a plain
+ * "disable". With legacy data that is an ordinary outcome, and "could not be saved" would send
+ * somebody looking for a bug that is not there.
+ */
+export declare const classifyWriteStatus: (status: number | null) => BulkOutcomeType;
+
 declare type CollabCachedUsersMap = Map<IntegerId, CachedItem<AnzuUserMinimal>>;
 
 declare type CollabComponentConfig = undefined | {
@@ -1014,6 +2010,22 @@ export declare function createFilterStore<F extends readonly MakeFilterOption<st
  */
 export declare function createListEditorStateScope(): ListEditorStateScope;
 
+export declare const CrossSystemPhase: {
+    readonly Idle: "idle";
+    /** First round of an e-mail search: find the person and their id. */
+    readonly MatchingEmail: "matchingEmail";
+    /** Second round: ask every system by that id, to catch the ones holding a different e-mail. */
+    readonly VerifyingById: "verifyingById";
+    readonly Done: "done";
+};
+
+export declare type CrossSystemPhaseType = (typeof CrossSystemPhase)[keyof typeof CrossSystemPhase];
+
+export declare interface CrossSystemSearchParams {
+    descriptors: AnyUserSystemDescriptor[];
+    refreshHook?: UserSystemRefreshHook | undefined;
+}
+
 declare interface DatatableColumnsConfigMoreOptions {
     storeColumnsLocalStorage: string | boolean;
     disableActions: boolean;
@@ -1083,6 +2095,8 @@ export declare const DEFAULT_LOG_PATHS: LogPaths;
 /** What reporting does until an application says otherwise; exported so a test can put it back. */
 export declare const defaultApiErrorLogger: ApiErrorLogger;
 
+export declare const defineUserSystemDescriptor: <TSystem extends string, TUser extends AnzuUser>(descriptor: UserSystemDescriptor<TSystem, TUser>) => AnyUserSystemDescriptor;
+
 /**
  * UUID v4 as string.
  */
@@ -1112,6 +2126,8 @@ declare interface EmptySlotProps_3 {
     };
 }
 
+export declare const emptyUserSystemAxes: () => UserSystemAxes;
+
 export declare type ExecuteRequestParams<B> = {
     urlTemplate?: string;
     urlParams?: UrlParams;
@@ -1156,9 +2172,11 @@ declare type FetchItemsMinimalType = (pagination: Ref<Pagination>, filterData: F
 
 declare type FetchItemsMinimalType_2 = (pagination: Ref<Pagination>, filterData: FilterData, filterConfig: FilterConfig) => Promise<any[]>;
 
-export declare type FetchItemsParams = {
+export declare type FetchItemsParams<B = never> = {
     urlTemplate?: string;
     urlParams?: UrlParams;
+    /** `null` omits the body, as everywhere in this family. */
+    body?: B;
     /** Stops this one call, leaving the instance's other calls alone. */
     signal?: AbortSignal;
 };
@@ -1241,7 +2259,7 @@ export declare type FilterStore<T extends readonly {
     [K in T[number]['name']]: AllowedFilterValues;
 };
 
-declare type FilterStoreIdentifier = {
+export declare type FilterStoreIdentifier = {
     system: string;
     subject: string;
 };
@@ -1252,6 +2270,17 @@ declare type FilterVariant = 'search' | 'lt' | 'in' | 'notIn' | 'endsWith' | 'st
 
 declare type FilterVariant_2 = 'search' | 'lt' | 'in' | 'notIn' | 'endsWith' | 'startsWith' | 'memberOf' | 'contains' | 'neq' | 'gte' | 'gt' | 'eq' | 'lte' | 'custom';
 
+/**
+ * Which of the six fields the systems disagree about.
+ *
+ * Blog is compared on `person.*` like everything else, and its own root `firstName`/`lastName`
+ * columns are deliberately left out of this: those are the byline under an article, the blog's slug
+ * and the public API, not back-office metadata. That blog's `person` is empty for most bloggers and
+ * will therefore read as different is correct -- the back-office identity really is unset there,
+ * and the first repair fills it in.
+ */
+export declare const findMetadataDifferences: (records: Map<string, BaseUser>) => MetadataDifference[];
+
 /**
  * Pretty-prints a JSON string, and hands back whatever it was given when that is not what it is.
  * Log context carries request and response bodies that are usually but not always JSON.
@@ -1269,6 +2298,14 @@ export declare const generateListQuery: (pagination: Ref<Pagination>, filterData
 
 export declare type GetKey<TItem> = keyof TItem | ((item: TItem) => ListEditorKey);
 
+declare const Grant: {
+    readonly Deny: 0;
+    readonly AllowOwner: 1;
+    readonly Allow: 2;
+};
+
+declare type GrantType = (typeof Grant)[keyof typeof Grant];
+
 declare interface HeaderSlotProps {
     title: string | null;
 }
@@ -1291,11 +2328,28 @@ declare type IntegerId = number;
  */
 declare type IntegerIdNullable = number | null;
 
+/** A system a bulk action may act on: it answered, the account is there, and access was granted. */
+export declare const isActionable: (axes: UserSystemAxes) => boolean;
+
+/**
+ * Whether the probe answered authoritatively that nobody is there.
+ *
+ * Creating an account is offered only when every relevant system said so. A record that could not
+ * be read is not a record that does not exist, and since no admin can delete an AnzuUser, a
+ * duplicate identity created on a guess cannot be taken back.
+ */
+export declare const isAuthoritativelyAbsent: (axes: UserSystemAxes) => boolean;
+
+export declare const isEmailTerm: (term: string) => boolean;
+
 export declare const isLogType: (value: unknown) => value is LogTypeType;
 
 /** Whether `router.push({ hash })` would leave the hash intact — see `buildFilterHash`. */
 export declare const isRouterSafeHash: (hash: string) => boolean;
 
+/** Which of the two shapes a list arrives in. */
+export declare type ItemsShape = 'envelope' | 'array';
+
 declare const JOB_RESOURCE_USER_DATA_DELETE = "jobUserDataDelete";
 
 declare interface JobBase<T extends JobBaseResource = JobBaseResource> extends AnzuUserAndTimeTrackingAware {
@@ -1324,6 +2378,8 @@ declare const JobStatus: {
 
 declare type JobStatusType = (typeof JobStatus)[keyof typeof JobStatus];
 
+declare type LanguageCode = 'en' | 'sk' | 'cs' | 'xx';
+
 export declare interface ListEditorApi<TItem> {
     viewItems: ComputedRef<ListViewItem<TItem>[]>;
     addItem: (data: TItem, positionHint?: PositionHint) => TItem[];
@@ -1451,6 +2507,10 @@ declare type ListEditorValidationScope = string | number | boolean | symbol;
 
 export declare type ListEditorValidationState = 'valid' | 'invalid' | 'warning' | null;
 
+declare type ListFields = typeof permissionGroupListFields;
+
+declare type ListFields_2 = typeof anzuUserListFields;
+
 export declare interface ListViewItem<TItem> {
     key: ListEditorKey;
     index: number;
@@ -1686,6 +2746,12 @@ export declare interface MakeFilterOption<TName extends string = string> {
     render?: Partial<FilerRenderOptions>;
 }
 
+export declare interface MetadataDifference {
+    field: UserMetadataField;
+    /** System to the value it holds, for every system that answered with a record. */
+    values: Map<string, string>;
+}
+
 export declare interface NestedListEditorApi<TItem extends Record<string, any>> {
     viewItems: ComputedRef<NestedViewItem<TItem>[]>;
     findNode: (id: ListEditorKey) => {
@@ -1841,6 +2907,14 @@ export declare interface NestedViewItem<TItem> extends ListViewItem<TItem> {
  */
 export declare const nextListEditorTempId: () => number;
 
+/**
+ * The one tab that is not a system.
+ *
+ * A module of its own because `<script setup>` cannot export, and both the shell and the pages that
+ * read `?tab=` need to name it.
+ */
+export declare const OTHER_SYSTEMS_TAB = "__otherSystems";
+
 export declare interface Pagination {
     sortBy: DatatableSortBy;
     page: number;
@@ -1855,6 +2929,181 @@ declare interface PaginationOptions {
     rowsPerPage: number;
 }
 
+export declare const PERMISSION_CONFIG_ENDPOINT = "/adm/v1/permissions/config";
+
+export declare const PERMISSION_CONFIG_ENTITY = "permissionConfig";
+
+export declare const PERMISSION_GROUP_ENDPOINT = "/adm/v1/permission-group";
+
+export declare const PERMISSION_GROUP_ENTITY = "permissionGroup";
+
+export declare interface PermissionActionsParams {
+    client: AxiosClientFn;
+    system: string;
+    entity?: string;
+    endPoint?: string;
+}
+
+declare interface PermissionConfig {
+    roles: string[];
+    defaultGrants: GrantType[];
+    config: {
+        [subject: string]: {
+            [action: string]: {
+                grants?: GrantType[];
+            };
+        };
+    };
+    translation: {
+        subjects: {
+            [subject: string]: {
+                [lang: string]: string;
+            };
+        };
+        actions: {
+            [action: string]: {
+                [lang: string]: string;
+            };
+        };
+        roles: {
+            [role: string]: {
+                [lang: string]: string;
+            };
+        };
+    };
+}
+
+export declare interface PermissionConfigActionsParams {
+    client: AxiosClientFn;
+    /**
+     * The system this config belongs to. It is a parameter and not a global -- admin-inhouse used to
+     * read it from a `curSystem` ref, which made the whole module impossible to use from a page that
+     * shows two systems at once and impossible to move here at all.
+     */
+    system: string;
+    entity?: string;
+    endPoint?: string;
+    /**
+     * Fetch as soon as the composable is built, the way every admin does today. Turn it off where
+     * the caller wants to decide when (a dialog that may never open, a test).
+     */
+    autoFetch?: boolean;
+}
+
+export declare interface PermissionConfigApiParams {
+    client: AxiosClientFn;
+    /**
+     * Which backend this instance talks to. It reaches `useApiRequest` for error context and is the
+     * key everything downstream is stored under, so two systems can be loaded side by side.
+     */
+    system: string;
+    /** Goes into every `useApiRequest` call; see the per-system entity note in `permissionGroupApi`. */
+    entity?: string;
+    endPoint?: string;
+}
+
+/**
+ * One entry per system. The admins this replaces kept `loading` and `initialized` as two module
+ * booleans shared by every system they fetched, which is wrong the moment the fetches run in
+ * parallel: the first one to finish cleared the flag for all of them, and the first one to fail
+ * left it set forever because there was no `finally`.
+ */
+export declare interface PermissionConfigEntry {
+    config: PermissionConfig;
+    loading: boolean;
+    initialized: boolean;
+}
+
+declare interface PermissionGroup extends PermissionGroupMinimal, AnzuUserAndTimeTrackingAware {
+    description: string;
+    _system: string;
+    _resourceName: 'permissionGroup';
+}
+
+export declare interface PermissionGroupActionsParams {
+    client: AxiosClientFn;
+    system: string;
+    entity?: string;
+    /**
+     * i18n scope for a server-side validation failure, which is a different question from which
+     * backend answered. `AnzuApiValidationError` builds `<system>.<entity>.model.<field>` keys, so
+     * the pair has to name the namespace the *labels* live under. It defaults to `common` +
+     * `permissionGroup`, which is where the shared form's own fields are; an admin whose form carries
+     * system fields as well passes its own pair, and keeps the base keys beside them.
+     */
+    validationSystem?: string;
+    validationEntity?: string;
+    endPoint?: string;
+}
+
+export declare interface PermissionGroupApiParams {
+    client: AxiosClientFn;
+    /**
+     * Both of these reach every `useApiRequest` this builds, and both have to be taken rather than
+     * assumed. admin-cms is the proof: its `permissionGroupApi.ts` declared `SYSTEM_COMMON` at the
+     * top and then sent `SYSTEM_CMS` on one of its four calls, so the same file reported two
+     * different systems for the same endpoint. A copy of that file per system multiplies the bug;
+     * one file that is told which system it is cannot have it.
+     */
+    system: string;
+    entity?: string;
+    /**
+     * i18n scope for a server-side validation failure, which is a different question from which
+     * backend answered. `AnzuApiValidationError` builds `<system>.<entity>.model.<field>` keys, and
+     * for a component shared by nine backends the labels are always the library's own `common.*` --
+     * `weather.anzuUser.model.email` exists nowhere. Defaults to `common` plus the entity;
+     * contentHub passes its own pair to keep the keys it already has.
+     */
+    validationSystem?: string;
+    validationEntity?: string;
+    endPoint?: string;
+}
+
+/**
+ * Local-storage key for the list filter. Named rather than derived so it cannot collide with the
+ * per-admin views this replaces, which store under `tableFilter_common_permissionGroup`; while
+ * both versions are on screen they must not share remembered filters (rule 8.0).
+ */
+export declare const permissionGroupFilterStorageKey: (system: string) => string;
+
+declare const permissionGroupListFields: ({
+    name: "id";
+    default: null;
+    type: "integer";
+    variant?: undefined;
+    render?: undefined;
+} | {
+    name: "title";
+    variant: "startsWith";
+    default: null;
+    type: "string";
+    render: {
+        skip: true;
+    };
+})[];
+
+declare interface PermissionGroupMinimal {
+    id: IntegerId;
+    title: string;
+    permissions: Permissions_2;
+}
+
+declare type Permissions_2 = {
+    [key in AclValue]?: GrantType;
+};
+
+declare type PermissionTranslationGroup = 'subjects' | 'actions' | 'roles';
+
+/**
+ * Which record the repair form is pre-filled from: the first system in the configured order that
+ * has one.
+ *
+ * Never "whichever answered first" -- the fan-out is parallel, so that would be a different answer
+ * on every run. The order is a default rather than a hidden rule: the dialog names the source and
+ * lets it be changed.
+ */
+export declare const pickPrefillSource: (order: string[], records: Map<string, BaseUser>) => string | null;
+
 /** Which mutation is asking for positions to be (re)assigned. */
 export declare type PositionAction = 'add' | 'update' | 'remove' | 'move' | 'payload';
 
@@ -1892,6 +3141,19 @@ export declare type PositionOption<TItem> = false | keyof TItem | {
  */
 export declare type PositionStrategy = 'renumber' | 'preserve-values';
 
+/**
+ * The status the backend answered with, or null when nothing ever answered.
+ *
+ * Read off the axios failure the mapped error kept as its cause, not off the class. Going by class
+ * alone misses exactly the answers that exist *because* the backend replied with a body: a
+ * validation failure is `AnzuApiValidationError`, a dependency conflict is
+ * `AnzuApiDependencyExistsError`, and both are 422s that have to be reported as such. Reported as
+ * "the system did not answer" they would send the operator looking for an outage instead of at the
+ * account whose stored data no longer validates -- which, with legacy rows, is the failure that
+ * happens most.
+ */
+export declare const probeStatusFromError: (error: unknown) => number | null;
+
 declare interface Props<TItem extends Record<string, any>> {
     /**
      * New-row factory. Add / "add after" insert `factory()` through the controller
@@ -2251,6 +3513,8 @@ declare interface Props_4 {
  */
 export declare function provideListEditorStateScope(inherited: ListEditorStateScope | null): ListEditorStateScope;
 
+export declare const readMetadataField: (user: BaseUser, field: UserMetadataField) => string;
+
 /**
  * Non-mutating renumber to sequential positions matching array order — the same
  * renumbering the editors apply on commit. Unchanged items stay reference-equal.
@@ -2290,6 +3554,48 @@ declare interface ReorderToggleSlotProps_2 {
     };
 }
 
+/** Creating an account goes the same way a write does. */
+export declare const resolveCreateEndpoint: (descriptor: AnyUserSystemDescriptor) => string;
+
+/**
+ * `enabled` has no `PATCH` anywhere: the only method that calls `setEnabled` is the full update.
+ * So it goes GET + PUT, on the same path, with the whole DTO the GET returned.
+ */
+export declare const resolveEnabledWrite: (descriptor: AnyUserSystemDescriptor) => {
+    get: string;
+    url: string;
+};
+
+/**
+ * Metadata is written through `PATCH /adm/users/{id}` wherever that path exists: the method behind
+ * it can only write e-mail, locale, avatar and person -- it has no setter for roles, permissions,
+ * groups or `enabled`. That is a stronger guarantee than being careful about what goes in the body.
+ */
+export declare const resolveMetadataWrite: (descriptor: AnyUserSystemDescriptor) => {
+    method: "PATCH";
+    get: string;
+    url: string;
+} | {
+    method: "PUT";
+    get: string;
+    url: string;
+};
+
+/**
+ * The pair the probe reads through, with the one invariant the type cannot state: both branches of
+ * `endpoints` are nullable, so nothing stops a descriptor naming `probe: 'base'` on a system that
+ * has no `/adm/users`. Every admin's descriptor test asserts this resolves for each of its
+ * systems.
+ */
+export declare const resolveProbeEndpoint: (descriptor: AnyUserSystemDescriptor) => AnzuUserEndpointPair;
+
+/**
+ * The single closed function from axes to what is drawn. Order matters: a system switched off in
+ * configuration is reported as such whatever else is known about it, and access is decided before
+ * presence because a forbidden record is not an absent one.
+ */
+export declare const resolveUserSystemState: (axes: UserSystemAxes) => UserSystemStateType;
+
 declare interface RowActions<TItem> {
     edit: () => void;
     save: () => Promise<void> | void;
@@ -2498,6 +3804,9 @@ declare const SortOrder: {
 
 declare type SortOrderType = (typeof SortOrder)[keyof typeof SortOrder];
 
+/** Systems whose stored value differs from the one about to be written. Nothing else is touched. */
+export declare const systemsNeedingWrite: (target: BaseUser, records: Map<string, BaseUser>, fields?: readonly UserMetadataField[]) => string[];
+
 export declare const TimeIntervalSpecialOptions: {
     readonly CurrentMonth: "cm";
     readonly LastMonth: "lm";
@@ -2533,26 +3842,261 @@ declare interface ToolbarSlotProps_2 {
 }
 
 /**
- * One named, savable section the unsaved-changes confirm dialog can name back
- * to the user. `dirty` is evaluated reactively inside the section's getter.
+ * One named, savable section the unsaved-changes confirm dialog can name back
+ * to the user. `dirty` is evaluated reactively inside the section's getter.
+ */
+export declare interface UnsavedSectionDescriptor {
+    label: string;
+    dirty: boolean;
+}
+
+/**
+ * Getter returning a single descriptor, or an array of them for a component
+ * that owns several sub-sections (e.g. page positions in one PageContentsManage).
+ */
+export declare type UnsavedSectionSource = () => UnsavedSectionDescriptor | UnsavedSectionDescriptor[];
+
+declare type UnsavedSource = Ref<boolean | Set<unknown> | unknown[] | null | undefined>;
+
+declare type UrlParams = {
+    [key: string]: number | string;
+};
+
+/**
+ * Per instance, like every other actions composable here. The admins' versions kept their loading
+ * flags at module scope.
+ */
+export declare const useAnzuUserActions: (params: AnzuUserActionsParams) => {
+    isDirty: ComputedRef<boolean>;
+    /** Takes the record as it stands as the new baseline; the page calls it after it seeds one. */
+    markPristine: () => void;
+    anzuUserList: Ref<{
+        enabled: boolean;
+        locale: LanguageCode | null;
+        roles: string[];
+        permissionGroups: IntegerId[];
+        permissions: Permissions_2;
+        resolvedPermissions: Permissions_2;
+        _resourceName: string;
+        _system: string;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+        id?: IntegerIdNullable | undefined;
+        email: string;
+        person: {
+            firstName: string;
+            lastName: string;
+            fullName: string;
+        };
+        avatar: {
+            color: string;
+            text: string;
+        };
+    }[], AnzuUser[] | {
+        enabled: boolean;
+        locale: LanguageCode | null;
+        roles: string[];
+        permissionGroups: IntegerId[];
+        permissions: Permissions_2;
+        resolvedPermissions: Permissions_2;
+        _resourceName: string;
+        _system: string;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+        id?: IntegerIdNullable | undefined;
+        email: string;
+        person: {
+            firstName: string;
+            lastName: string;
+            fullName: string;
+        };
+        avatar: {
+            color: string;
+            text: string;
+        };
+    }[]>;
+    loadingAnzuUserList: Ref<boolean, boolean>;
+    datatableHiddenColumns: Ref<string[], string[]>;
+    fetchAnzuUserList: (pagination: Ref<Pagination>, filterData: FilterData<any>, filterConfig: FilterConfig<any>) => Promise<void>;
+    cancelAnzuUserList: () => void;
+    anzuUser: Ref<{
+        enabled: boolean;
+        locale: LanguageCode | null;
+        roles: string[];
+        permissionGroups: IntegerId[];
+        permissions: Permissions_2;
+        resolvedPermissions: Permissions_2;
+        _resourceName: string;
+        _system: string;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+        id?: IntegerIdNullable | undefined;
+        email: string;
+        person: {
+            firstName: string;
+            lastName: string;
+            fullName: string;
+        };
+        avatar: {
+            color: string;
+            text: string;
+        };
+    }, AnzuUser | {
+        enabled: boolean;
+        locale: LanguageCode | null;
+        roles: string[];
+        permissionGroups: IntegerId[];
+        permissions: Permissions_2;
+        resolvedPermissions: Permissions_2;
+        _resourceName: string;
+        _system: string;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+        id?: IntegerIdNullable | undefined;
+        email: string;
+        person: {
+            firstName: string;
+            lastName: string;
+            fullName: string;
+        };
+        avatar: {
+            color: string;
+            text: string;
+        };
+    }>;
+    loadingAnzuUser: Ref<boolean, boolean>;
+    fetchAnzuUser: (id: IntegerId) => Promise<void>;
+    createAnzuUser: () => Promise<AnzuUser | null>;
+    updateAnzuUser: () => Promise<boolean>;
+    loadingCreateAnzuUser: Ref<boolean, boolean>;
+    loadingUpdateAnzuUser: Ref<boolean, boolean>;
+    resetAnzuUserStore: (system?: string, resourceName?: string) => void;
+};
+
+/**
+ * Generic in the user type, because the three systems that answer on `/adm/users` return a DTO of
+ * their own -- `CmsUserDto`, `DamUserDto`, `ContentHubUserDto` -- each extending `UserDto` with
+ * system fields. Losing those in the round trip is exactly what the write invariant forbids: the
+ * body of a write is the whole object the preceding GET returned.
  */
-export declare interface UnsavedSectionDescriptor {
-    label: string;
-    dirty: boolean;
-}
+export declare const useAnzuUserApi: <T extends AnzuUser = AnzuUser>({ client, system, entity, validationSystem, validationEntity, endPoint, }: AnzuUserApiParams) => {
+    useFetchAnzuUserListByIds: () => UseApiFetchByIdsReturnType<T>;
+    useFetchAnzuUserList: () => UseApiFetchListReturnType<T>;
+    useFetchAnzuUser: () => UseApiRequestReturnType<T, null>;
+    useCreateAnzuUser: () => UseApiRequestReturnType<T, T>;
+    useUpdateAnzuUser: () => UseApiRequestReturnType<T, T>;
+    usePatchBaseUser: (patchEndPoint: string) => UseApiRequestReturnType<T, T>;
+};
 
 /**
- * Getter returning a single descriptor, or an array of them for a component
- * that owns several sub-sections (e.g. page positions in one PageContentsManage).
+ * Exact match on e-mail, for the cross-system search.
+ *
+ * `startsWith` -- what the list filter uses and what admin-inhouse's search used -- cannot answer
+ * the question that search asks. "Is this person here under this address" has to be `eq`, or
+ * `jozko@sme.sk` matches `jozko.mrkvicka@sme.sk` and the fan-out reports the wrong identity.
  */
-export declare type UnsavedSectionSource = () => UnsavedSectionDescriptor | UnsavedSectionDescriptor[];
-
-declare type UnsavedSource = Ref<boolean | Set<unknown> | unknown[] | null | undefined>;
+export declare function useAnzuUserEmailLookupFilter(): {
+    filterConfig: FilterConfig<{
+        name: "email";
+        variant: "eq";
+        default: null;
+        type: "string";
+    }[]>;
+    filterData: FilterData<{
+        name: "email";
+        variant: "eq";
+        default: null;
+        type: "string";
+    }[]>;
+};
 
-declare type UrlParams = {
-    [key: string]: number | string;
+/**
+ * The three fields every system has, plus whatever that system adds.
+ *
+ * The extras are a parameter rather than fields in the list above because the same filter is not
+ * the same query everywhere: cms asks for permission groups with `memberOf` and dam with `custom`,
+ * and cms has `allowedSites`, which exists nowhere else. Hard-coding either variant would send the
+ * wrong query to the other backend, and leaving them out costs those two lists filters they have
+ * today.
+ *
+ * `AFilterWrapper` draws any field that is not `render.skip` by itself, so a plain extra field
+ * needs nothing else; one that wants its own widget -- a remote autocomplete -- is passed through
+ * the matching slot.
+ */
+export declare function useAnzuUserListFilter<E extends readonly MakeFilterOption[] = []>(system: string, extraFields?: E): {
+    filterConfig: FilterConfig<readonly [...ListFields_2, ...E]>;
+    filterData: FilterData<readonly [...ListFields_2, ...E]>;
 };
 
+/**
+ * The one user the owning form is editing. Cross-system pages do not use this -- they hold a
+ * result per system and never a single "current" user -- so it stays a single record, the way the
+ * admins have it.
+ */
+export declare const useAnzuUserOneStore: SetupStoreDefinition<"labsAnzuUserOneStore", {
+    anzuUser: Ref<{
+        enabled: boolean;
+        locale: LanguageCode | null;
+        roles: string[];
+        permissionGroups: IntegerId[];
+        permissions: Permissions_2;
+        resolvedPermissions: Permissions_2;
+        _resourceName: string;
+        _system: string;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+        id?: IntegerIdNullable | undefined;
+        email: string;
+        person: {
+            firstName: string;
+            lastName: string;
+            fullName: string;
+        };
+        avatar: {
+            color: string;
+            text: string;
+        };
+    }, AnzuUser | {
+        enabled: boolean;
+        locale: LanguageCode | null;
+        roles: string[];
+        permissionGroups: IntegerId[];
+        permissions: Permissions_2;
+        resolvedPermissions: Permissions_2;
+        _resourceName: string;
+        _system: string;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+        id?: IntegerIdNullable | undefined;
+        email: string;
+        person: {
+            firstName: string;
+            lastName: string;
+            fullName: string;
+        };
+        avatar: {
+            color: string;
+            text: string;
+        };
+    }>;
+    loadingAnzuUser: Ref<boolean, boolean>;
+    setAnzuUser: (newAnzuUser: AnzuUser) => void;
+    setLoadingAnzuUser: (loading: boolean) => void;
+    reset: (system?: string, resourceName?: string) => void;
+}>;
+
 /**
  * A request that asks the backend to do something and reads nothing back -- a delete, or a call that
  * only starts work and answers 202. Any successful status resolves; a body, if one arrives, is
@@ -2566,6 +4110,9 @@ export declare type UseApiFetchByIdsParams = {
     client: AxiosClientFn;
     system: string;
     entity: string;
+    /** i18n scope for field-level validation failures; defaults to `system` / `entity`. */
+    validationSystem?: string;
+    validationEntity?: string;
     urlTemplate?: string;
     urlParams?: UrlParams;
     /** Anything axios takes except what this helper decides: the method, the url, the body and the signal. */
@@ -2581,16 +4128,28 @@ export declare type UseApiFetchByIdsReturnType<T> = {
     /**
      * True while this instance has a request in flight, false once the last one settles.
      *
-     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared
-     * in a `finally`, and that `finally` belongs to whichever call ended -- including one that
+     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared in
+     * a `finally`, and that `finally` belongs to whichever call ended -- including one that
      * `cancelPrevious` just superseded, which turns the spinner off while the call the user is waiting
      * for is still running. This one never dips between a superseded call and the one that replaced it.
+     *
+     * Two things to know before replacing a hand-rolled flag with it.
+     *
+     * It covers what this helper does and nothing the caller does afterwards. A flag that also spans a
+     * follow-up cached fetch, a mapping pass or a second endpoint is not the same flag, and swapping it
+     * for this one turns the spinner off too early. Keep your own where it means more than "this helper
+     * is working".
+     *
+     * It belongs to the instance, so it is only reachable if you hold the instance. A factory that
+     * builds one per call and hands back the promise alone -- `const { execute } = useX()` inside the
+     * function that calls it -- cannot expose `loading`, `abort` or `cancelPrevious` at all. Hoist the
+     * instance to where the caller lives first.
      */
     loading: Ref<boolean>;
 };
 
 /**
- * A list read from an endpoint the caller has already written the query for, with no pagination.
+ * A list from an endpoint the caller has already written the query for, with no pagination.
  *
  * It exists because the fleet kept doing this through `useApiRequest<ApiResponseList<T[]>>`: build a
  * query by hand -- an order, a limit, a fixed filter -- bake it into the url, and read `.data` off
@@ -2603,15 +4162,26 @@ export declare type UseApiFetchByIdsReturnType<T> = {
  * not the user's to change. So this is that helper with the pagination taken out: same core, same
  * error mapping, same list-body check, and it answers with the items rather than the envelope.
  *
+ * Read is the usual case, not the only one: a filter too big for a url goes out as a POST, and a
+ * mutation can answer with the list it just changed. The helper is about what comes back.
+ *
+ * Which shape it comes back in is declared, not guessed. `shape` picks the reader and the reader
+ * refuses the other shape, the way `optionalBody` makes a caller declare a body instead of leaving
+ * the helper to accept whatever turns up. A wrong declaration therefore fails loudly on the first
+ * run, which is what makes having a default safe at all.
+ *
  * It writes no metadata. An endpoint whose paging the user drives is `useApiFetchList`; a list read
  * page by page to the end is `useApiFetchListBatch`.
  */
-export declare const useApiFetchItems: <T>(params: UseApiFetchItemsParams) => UseApiFetchItemsReturnType<T>;
+export declare const useApiFetchItems: <T, B = never>(params: UseApiFetchItemsParams) => UseApiFetchItemsReturnType<T, B>;
 
 export declare type UseApiFetchItemsParams = {
     client: AxiosClientFn;
     system: string;
     entity: string;
+    /** i18n scope for field-level validation failures; defaults to `system` / `entity`. */
+    validationSystem?: string;
+    validationEntity?: string;
     /**
      * The url, query and all: whatever built the query has already run by the time it gets here.
      *
@@ -2625,18 +4195,45 @@ export declare type UseApiFetchItemsParams = {
     /** Anything axios takes except what this helper decides: the method, the url, the body and the signal. */
     options?: Omit<AxiosRequestConfig, 'method' | 'url' | 'data' | 'signal'>;
     cancelPrevious?: boolean;
+    /**
+     * Default `GET`, which is what 17 of the fleet's list reads and every existing caller here use.
+     *
+     * The others are here because a list is not only ever the answer to a read: a filter too big for a
+     * url goes out as a POST, and a mutation can answer with the list it just changed -- a swap, a
+     * shift, an upsert-all. What this helper is about is the answer, not the verb.
+     */
+    method?: 'GET' | 'POST' | 'PUT' | 'PATCH';
+    /**
+     * Default `'envelope'`, because that is the fleet's norm and the exception is what gets declared.
+     *
+     * Leaving it out cannot go wrong quietly: the reader refuses the shape that was not declared, so a
+     * forgotten `'array'` fails on the first run rather than handing back something that is not a list.
+     */
+    shape?: ItemsShape;
 };
 
-export declare type UseApiFetchItemsReturnType<T> = {
-    execute: (params?: FetchItemsParams) => Promise<T[]>;
+export declare type UseApiFetchItemsReturnType<T, B = never> = {
+    execute: (params?: FetchItemsParams<B>) => Promise<T[]>;
     abort: () => void;
     /**
      * True while this instance has a request in flight, false once the last one settles.
      *
-     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared
-     * in a `finally`, and that `finally` belongs to whichever call ended -- including one that
+     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared in
+     * a `finally`, and that `finally` belongs to whichever call ended -- including one that
      * `cancelPrevious` just superseded, which turns the spinner off while the call the user is waiting
      * for is still running. This one never dips between a superseded call and the one that replaced it.
+     *
+     * Two things to know before replacing a hand-rolled flag with it.
+     *
+     * It covers what this helper does and nothing the caller does afterwards. A flag that also spans a
+     * follow-up cached fetch, a mapping pass or a second endpoint is not the same flag, and swapping it
+     * for this one turns the spinner off too early. Keep your own where it means more than "this helper
+     * is working".
+     *
+     * It belongs to the instance, so it is only reachable if you hold the instance. A factory that
+     * builds one per call and hands back the promise alone -- `const { execute } = useX()` inside the
+     * function that calls it -- cannot expose `loading`, `abort` or `cancelPrevious` at all. Hoist the
+     * instance to where the caller lives first.
      */
     loading: Ref<boolean>;
 };
@@ -2649,6 +4246,9 @@ export declare type UseApiFetchListBatchParams = {
     client: AxiosClientFn;
     system: string;
     entity: string;
+    /** i18n scope for field-level validation failures; defaults to `system` / `entity`. */
+    validationSystem?: string;
+    validationEntity?: string;
     urlTemplate?: string;
     urlParams?: UrlParams;
     /** Anything axios takes except what this helper decides: the method, the url, the body and the signal. */
@@ -2660,12 +4260,27 @@ export declare type UseApiFetchListBatchReturnType<T> = {
     execute: (filterData: FilterData<any>, filterConfig: FilterConfig<any>, params?: FetchListBatchParams) => Promise<T[]>;
     abort: () => void;
     /**
-     * True while this instance has a request in flight, false once the last one settles.
+     * True while this instance is working, false once it stops.
+     *
+     * Here that is the whole walk, not one request: a batch reads every page, and the flag stays up
+     * across the gaps between them and across the reading of each answer.
      *
-     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared
-     * in a `finally`, and that `finally` belongs to whichever call ended -- including one that
+     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared in
+     * a `finally`, and that `finally` belongs to whichever call ended -- including one that
      * `cancelPrevious` just superseded, which turns the spinner off while the call the user is waiting
      * for is still running. This one never dips between a superseded call and the one that replaced it.
+     *
+     * Two things to know before replacing a hand-rolled flag with it.
+     *
+     * It covers what this helper does and nothing the caller does afterwards. A flag that also spans a
+     * follow-up cached fetch, a mapping pass or a second endpoint is not the same flag, and swapping it
+     * for this one turns the spinner off too early. Keep your own where it means more than "this helper
+     * is working".
+     *
+     * It belongs to the instance, so it is only reachable if you hold the instance. A factory that
+     * builds one per call and hands back the promise alone -- `const { execute } = useX()` inside the
+     * function that calls it -- cannot expose `loading`, `abort` or `cancelPrevious` at all. Hoist the
+     * instance to where the caller lives first.
      */
     loading: Ref<boolean>;
 };
@@ -2674,6 +4289,9 @@ export declare type UseApiFetchListParams = {
     client: AxiosClientFn;
     system: string;
     entity: string;
+    /** i18n scope for field-level validation failures; defaults to `system` / `entity`. */
+    validationSystem?: string;
+    validationEntity?: string;
     urlTemplate?: string;
     urlParams?: UrlParams;
     /** Anything axios takes except what this helper decides: the method, the url, the body and the signal. */
@@ -2687,10 +4305,22 @@ export declare type UseApiFetchListReturnType<T> = {
     /**
      * True while this instance has a request in flight, false once the last one settles.
      *
-     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared
-     * in a `finally`, and that `finally` belongs to whichever call ended -- including one that
+     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared in
+     * a `finally`, and that `finally` belongs to whichever call ended -- including one that
      * `cancelPrevious` just superseded, which turns the spinner off while the call the user is waiting
      * for is still running. This one never dips between a superseded call and the one that replaced it.
+     *
+     * Two things to know before replacing a hand-rolled flag with it.
+     *
+     * It covers what this helper does and nothing the caller does afterwards. A flag that also spans a
+     * follow-up cached fetch, a mapping pass or a second endpoint is not the same flag, and swapping it
+     * for this one turns the spinner off too early. Keep your own where it means more than "this helper
+     * is working".
+     *
+     * It belongs to the instance, so it is only reachable if you hold the instance. A factory that
+     * builds one per call and hands back the promise alone -- `const { execute } = useX()` inside the
+     * function that calls it -- cannot expose `loading`, `abort` or `cancelPrevious` at all. Hoist the
+     * instance to where the caller lives first.
      */
     loading: Ref<boolean>;
 };
@@ -2741,6 +4371,9 @@ export declare type UseApiRequestParams = {
     method: Method;
     system: string;
     entity: string;
+    /** i18n scope for field-level validation failures; defaults to `system` / `entity`. */
+    validationSystem?: string;
+    validationEntity?: string;
     urlTemplate?: string;
     urlParams?: UrlParams;
     /** Anything axios takes except what this helper decides: the method, the url, the body and the signal. */
@@ -2755,14 +4388,40 @@ export declare type UseApiRequestReturnType<R, B> = {
     /**
      * True while this instance has a request in flight, false once the last one settles.
      *
-     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared
-     * in a `finally`, and that `finally` belongs to whichever call ended -- including one that
+     * It is here so a caller does not have to keep its own: the hand-rolled version is a ref cleared in
+     * a `finally`, and that `finally` belongs to whichever call ended -- including one that
      * `cancelPrevious` just superseded, which turns the spinner off while the call the user is waiting
      * for is still running. This one never dips between a superseded call and the one that replaced it.
+     *
+     * Two things to know before replacing a hand-rolled flag with it.
+     *
+     * It covers what this helper does and nothing the caller does afterwards. A flag that also spans a
+     * follow-up cached fetch, a mapping pass or a second endpoint is not the same flag, and swapping it
+     * for this one turns the spinner off too early. Keep your own where it means more than "this helper
+     * is working".
+     *
+     * It belongs to the instance, so it is only reachable if you hold the instance. A factory that
+     * builds one per call and hands back the promise alone -- `const { execute } = useX()` inside the
+     * function that calls it -- cannot expose `loading`, `abort` or `cancelPrevious` at all. Hoist the
+     * instance to where the caller lives first.
      */
     loading: Ref<boolean>;
 };
 
+export declare const useCachedPermissionGroups: (params: CachedPermissionGroupsParams) => {
+    cachedPermissionGroups: Ref<Map<number, CachedItem<PermissionGroupMinimal>>, Map<number, CachedItem<PermissionGroupMinimal>>>;
+    toFetchCachedPermissionGroups: Ref<Set<number>, Set<number>>;
+    fetchCachedPermissionGroups: () => Promisify<Promise<PermissionGroup[]>>;
+    immediateFetchCachedPermissionGroups: () => Promise<PermissionGroup[]>;
+    addToCachedPermissionGroups: (...args: AddToCachedArgs<number>) => void;
+    addManualToCachedPermissionGroups: (data: PermissionGroup) => void;
+    addManualMinimalToCachedPermissionGroups: (data: PermissionGroupMinimal) => void;
+    hasCachedPermissionGroup: (id: number | null | undefined) => boolean;
+    getCachedPermissionGroup: (id: number | null | undefined) => CachedItem<PermissionGroupMinimal> | undefined;
+    isLoadedCachedPermissionGroup: (id: number | null | undefined) => boolean;
+    clearCachedPermissionGroups: () => void;
+};
+
 declare type UseCachedType = () => {
     fetch: any;
     add: any;
@@ -3137,6 +4796,306 @@ declare interface UsePaginationReturnType {
     incrementPage: () => number;
 }
 
+/**
+ * Builds the grant map a user would end up with, for the editor's "resolved" column, out of what
+ * the page already holds: the groups the user is in plus the grants set on the user directly.
+ *
+ * It is not the backend's `resolvedPermissions`. That one arrives with the record and includes
+ * roles; this one is what the screen would send if saved now, so the editor can show the effect of
+ * a group the operator has just ticked without a round trip.
+ */
+export declare const usePermissionActions: (params: PermissionActionsParams) => {
+    resolvePermissions: (user: AnzuUser) => Permissions_2;
+    resolveGroupPermissions: (permissionGroupIds: IntegerId[]) => Permissions_2;
+};
+
+export declare const usePermissionConfigActions: (params: PermissionConfigActionsParams) => {
+    permissionConfig: ComputedRef<PermissionConfig>;
+    loadingPermissionConfig: ComputedRef<boolean>;
+    isPermissionConfigInitialized: ComputedRef<boolean>;
+    fetchPermissionConfig: (force?: boolean) => Promise<void>;
+    translatePermission: (group: PermissionTranslationGroup, key: string) => string;
+    resetPermissionConfig: () => void;
+};
+
+export declare const usePermissionConfigApi: ({ client, system, entity, endPoint, }: PermissionConfigApiParams) => {
+    useFetchPermissionConfig: () => UseApiRequestReturnType<PermissionConfig, null>;
+};
+
+export declare const usePermissionConfigStore: SetupStoreDefinition<"labsPermissionConfigStore", {
+    entries: Ref<Map<string, {
+        config: {
+            roles: string[];
+            defaultGrants: GrantType[];
+            config: {
+                [subject: string]: {
+                    [action: string]: {
+                        grants?: GrantType[];
+                    };
+                };
+            };
+            translation: {
+                subjects: {
+                    [subject: string]: {
+                        [lang: string]: string;
+                    };
+                };
+                actions: {
+                    [action: string]: {
+                        [lang: string]: string;
+                    };
+                };
+                roles: {
+                    [role: string]: {
+                        [lang: string]: string;
+                    };
+                };
+            };
+        };
+        loading: boolean;
+        initialized: boolean;
+    }> & Omit<Map<string, PermissionConfigEntry>, keyof Map<any, any>>, Map<string, PermissionConfigEntry> | (Map<string, {
+        config: {
+            roles: string[];
+            defaultGrants: GrantType[];
+            config: {
+                [subject: string]: {
+                    [action: string]: {
+                        grants?: GrantType[];
+                    };
+                };
+            };
+            translation: {
+                subjects: {
+                    [subject: string]: {
+                        [lang: string]: string;
+                    };
+                };
+                actions: {
+                    [action: string]: {
+                        [lang: string]: string;
+                    };
+                };
+                roles: {
+                    [role: string]: {
+                        [lang: string]: string;
+                    };
+                };
+            };
+        };
+        loading: boolean;
+        initialized: boolean;
+    }> & Omit<Map<string, PermissionConfigEntry>, keyof Map<any, any>>)>;
+    getEntry: (system: string) => PermissionConfigEntry;
+    setLoading: (system: string, loading: boolean) => void;
+    setConfig: (system: string, config: PermissionConfig) => void;
+    resetSystem: (system: string) => void;
+    reset: () => void;
+}>;
+
+/**
+ * Everything below is per instance. The admins kept `listLoading`, `detailLoading` and
+ * `datatableHiddenColumns` at module scope, which is a single set of flags shared by every caller
+ * -- fine for one list on one backend, wrong for a library a page may instantiate twice.
+ */
+export declare const usePermissionGroupActions: (params: PermissionGroupActionsParams) => {
+    datatableHiddenColumns: Ref<string[], string[]>;
+    permissionGroupList: Ref<{
+        description: string;
+        _system: string;
+        _resourceName: "permissionGroup";
+        id: IntegerId;
+        title: string;
+        permissions: Permissions_2;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+    }[], PermissionGroup[] | {
+        description: string;
+        _system: string;
+        _resourceName: "permissionGroup";
+        id: IntegerId;
+        title: string;
+        permissions: Permissions_2;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+    }[]>;
+    loadingPermissionGroupList: Ref<boolean, boolean>;
+    fetchPermissionGroupList: (pagination: Ref<Pagination>, filterData: FilterData<any>, filterConfig: FilterConfig<any>) => Promise<void>;
+    cancelPermissionGroupList: () => void;
+    permissionGroup: Ref<{
+        description: string;
+        _system: string;
+        _resourceName: "permissionGroup";
+        id: IntegerId;
+        title: string;
+        permissions: Permissions_2;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+    }, PermissionGroup | {
+        description: string;
+        _system: string;
+        _resourceName: "permissionGroup";
+        id: IntegerId;
+        title: string;
+        permissions: Permissions_2;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+    }>;
+    loadingPermissionGroup: Ref<boolean, boolean>;
+    fetchPermissionGroup: (id: IntegerId) => Promise<void>;
+    createPermissionGroup: () => Promise<PermissionGroup | null>;
+    updatePermissionGroup: () => Promise<boolean>;
+    deletePermissionGroup: (id: IntegerId) => Promise<boolean>;
+    loadingCreatePermissionGroup: Ref<boolean, boolean>;
+    loadingUpdatePermissionGroup: Ref<boolean, boolean>;
+    loadingDeletePermissionGroup: Ref<boolean, boolean>;
+    fetchPermissionGroupOptions: (pagination: Ref<Pagination>, filterData: FilterData<any>, filterConfig: FilterConfig<any>) => Promise<ValueObjectOption<IntegerId>[]>;
+    fetchPermissionGroupOptionsByIds: (ids: IntegerId[]) => Promise<ValueObjectOption<IntegerId>[]>;
+    resetPermissionGroupStore: () => void;
+};
+
+export declare const usePermissionGroupApi: ({ client, system, entity, validationSystem, validationEntity, endPoint, }: PermissionGroupApiParams) => {
+    useFetchPermissionGroupListByIds: () => UseApiFetchByIdsReturnType<PermissionGroup>;
+    useFetchPermissionGroupList: () => UseApiFetchListReturnType<PermissionGroup>;
+    useFetchPermissionGroup: () => UseApiRequestReturnType<PermissionGroup, null>;
+    useCreatePermissionGroup: () => UseApiRequestReturnType<PermissionGroup, PermissionGroup>;
+    useUpdatePermissionGroup: () => UseApiRequestReturnType<PermissionGroup, PermissionGroup>;
+    useDeletePermissionGroup: () => UseApiRequestReturnType<void, null>;
+};
+
+export declare function usePermissionGroupInnerFilter(): {
+    filterConfig: FilterConfig<{
+        name: "title";
+        variant: "startsWith";
+        default: null;
+        type: "string";
+    }[]>;
+    filterData: FilterData<{
+        name: "title";
+        variant: "startsWith";
+        default: null;
+        type: "string";
+    }[]>;
+};
+
+export declare function usePermissionGroupListFilter(system: string): {
+    filterConfig: FilterConfig<ListFields>;
+    filterData: FilterData<ListFields>;
+};
+
+/**
+ * A single open group, not a map keyed by system.
+ *
+ * Decision 9 of the plan: one system is one route and one view, and there is no cross-system view
+ * of permission groups at all. Only one group is ever open, so a per-system map would be state
+ * nothing reads -- unlike the config store next door, which really is asked about several systems
+ * at once by the cross-system user pages.
+ */
+export declare const usePermissionGroupOneStore: SetupStoreDefinition<"labsPermissionGroupOneStore", {
+    permissionGroup: Ref<{
+        description: string;
+        _system: string;
+        _resourceName: "permissionGroup";
+        id: IntegerId;
+        title: string;
+        permissions: Permissions_2;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+    }, PermissionGroup | {
+        description: string;
+        _system: string;
+        _resourceName: "permissionGroup";
+        id: IntegerId;
+        title: string;
+        permissions: Permissions_2;
+        createdAt: DatetimeUTC;
+        modifiedAt: DatetimeUTC;
+        modifiedBy: IntegerIdNullable;
+        createdBy: IntegerIdNullable;
+    }>;
+    loadingPermissionGroup: Ref<boolean, boolean>;
+    setPermissionGroup: (newPermissionGroup: PermissionGroup) => void;
+    setLoadingPermissionGroup: (loading: boolean) => void;
+    reset: () => void;
+}>;
+
+/**
+ * The same three rules all five admins carry today, verbatim. They are not derived from the
+ * backend: `PermissionGroupDto` only requires a title, and the lengths here are the front-end's
+ * own stricter profile.
+ */
+export declare function usePermissionGroupValidation(permissionGroup: Ref<PermissionGroup>): {
+    v$: Ref< Validation<{
+        permissionGroup: {
+            title: {
+                required: ValidationRuleWithoutParams<any>;
+                minLength: ValidationRuleWithParams<{
+                    min: number;
+                }, any>;
+                maxLength: ValidationRuleWithParams<{
+                    max: number;
+                }, any>;
+            };
+            description: {
+                maxLength: ValidationRuleWithParams<{
+                    max: number;
+                }, any>;
+            };
+        };
+    }, {
+        permissionGroup: Ref<PermissionGroup, PermissionGroup>;
+    }>, Validation<{
+        permissionGroup: {
+            title: {
+                required: ValidationRuleWithoutParams<any>;
+                minLength: ValidationRuleWithParams<{
+                    min: number;
+                }, any>;
+                maxLength: ValidationRuleWithParams<{
+                    max: number;
+                }, any>;
+            };
+            description: {
+                maxLength: ValidationRuleWithParams<{
+                    max: number;
+                }, any>;
+            };
+        };
+    }, {
+        permissionGroup: Ref<PermissionGroup, PermissionGroup>;
+    }>>;
+};
+
+/**
+ * The six fields the cross-system view compares.
+ *
+ * `email` is in the list and is also the reason the e-mail search runs twice: if a person is
+ * `jozko@sme.sk` in weather and `j.mrkvicka@sme.sk` in blog, a search by e-mail finds weather and
+ * blog answers nothing -- which looks exactly like "no account here". The second round, by the id
+ * the first round found, is what turns that silence into the inconsistency it actually is.
+ */
+export declare const USER_METADATA_FIELDS: readonly ["email", "person.firstName", "person.lastName", "person.fullName", "avatar.color", "avatar.text"];
+
+/**
+ * What the probe calls itself in the error context.
+ *
+ * A 404 here is an answer, not a failure -- it is how a system says "no account of yours". It still
+ * reaches the api error logger like any other, so an app filters on this together with the status
+ * rather than on the url, which would also silence a real detail read of the same path. The
+ * validation scope stays the user's, so a field error would still name a real label.
+ */
+export declare const USER_PROBE_ENTITY = "anzuUserProbe";
+
 export declare interface UserAdminConfig<TData = UserAdminConfigDataFilterBookmark | UserAdminConfigDataPinnedWidgets> extends AnzuUserAndTimeTrackingAware, SortableItemDataAware {
     id: IntegerId;
     user: IntegerId;
@@ -3180,6 +5139,215 @@ export declare const UserAdminConfigTypeDefault: "pinnedWidgets";
 
 export declare type UserAdminConfigTypeType = (typeof UserAdminConfigType)[keyof typeof UserAdminConfigType];
 
+export declare type UserMetadataField = (typeof USER_METADATA_FIELDS)[number];
+
+export declare interface UserMetadataValidationOptions {
+    /**
+     * The system's profile (`requiredMetadata` on its descriptor). `false` requires only the
+     * e-mail; `true` also requires first name, last name, full name, avatar text and avatar colour.
+     * It applies the same way to creating and to editing -- within a system it is one rule.
+     */
+    required: boolean;
+    /** Whether the id is a field at all. When it is, and this is a create, it is required. */
+    idInput: boolean;
+    isEdit: boolean;
+    /** Scope key, so an owning form can validate its own fields alongside the app's system fields. */
+    scope?: string | symbol | false;
+}
+
+export declare const UserSystemAccess: {
+    readonly Ok: "ok";
+    readonly Forbidden: "forbidden";
+    readonly Unauthenticated: "unauthenticated";
+    readonly Unavailable: "unavailable";
+    readonly ConfigDisabled: "configDisabled";
+};
+
+export declare type UserSystemAccessType = (typeof UserSystemAccess)[keyof typeof UserSystemAccess];
+
+/**
+ * `enabled` is one of the axes and not a detail: without it the two states the cross-system view
+ * shows most often -- "the account is here and on" versus "here and off" -- cannot be told apart.
+ *
+ * Ownership is deliberately *not* an axis. None of the six visual states below distinguishes it;
+ * it decides which button is drawn, and that is the descriptor's `manage` union.
+ */
+export declare interface UserSystemAxes {
+    load: UserSystemLoadType;
+    presence: UserSystemPresenceType;
+    access: UserSystemAccessType;
+    enabled: boolean | 'unknown';
+}
+
+export declare interface UserSystemDescriptor<TSystem extends string = string, TUser extends AnzuUser = AnzuUser> {
+    system: TSystem;
+    client: AxiosClientFn;
+    /** Reaches every `useApiRequest` built for this system; see `permissionGroupApi`. */
+    entity: string;
+    /**
+     * Whether the system is switched on in this admin's configuration. Mandatory, not optional: the
+     * "disabled in configuration" state has to be *shown*, so leaving the system out of the array is
+     * not the same thing. The value is app-specific (`envConfig[system].enabled`) and the library has
+     * no way to read it.
+     */
+    isEnabled: () => boolean;
+    /**
+     * Which validation profile this system's form uses. `false` means only the e-mail is required;
+     * `true` adds first name, last name, full name, avatar text and avatar colour. It is a property
+     * of the system, and it is the same for creating and for editing.
+     */
+    requiredMetadata: boolean;
+    /**
+     * Whether the id is typed in. False only in cms, where the backend looks it up in SSO from the
+     * e-mail. On an edit the field is read-only regardless.
+     */
+    idInput: boolean;
+    extraState?: (user: TUser) => UserSystemExtraState | null;
+    /** Above the `enabled` switch and in the row of a bulk action. */
+    enabledNote?: string;
+    /** In the metadata repair dialog and in the owning form. */
+    metadataNote?: string;
+    /** In the confirmation dialog when an account is created here. */
+    createNote?: string;
+    endpoints: UserSystemEndpoints;
+    /** Added in task 2: the system's name as the app translates it. */
+    label?: string;
+    /** Added in task 2. */
+    manage?: (user: TUser) => UserSystemManageTarget;
+}
+
+/**
+ * Paired GET + write paths, never loose urls.
+ *
+ * This is what makes the write invariant expressible: a write body is always the whole object the
+ * preceding GET on the *same path* returned. The two paths return different DTOs -- `/adm/users`
+ * in cms answers `CmsUserDto` and its PUT runs `updateRelations()` over seven scalars and twelve
+ * collections -- so a GET from one path and a PUT to the other silently drops whatever the other
+ * DTO carries.
+ */
+export declare interface UserSystemEndpoints {
+    anzuUser: AnzuUserEndpointPair | null;
+    base: BaseUserEndpointPair | null;
+    permissionGroup: string;
+    /**
+     * Per system, not one constant. contentHub's is `/adm/users/current`, and the admins had this
+     * hard-coded as a single path shared by every backend.
+     */
+    currentUser: string;
+    list: string;
+    /**
+     * Which pair the probe reads through. A field rather than something derived, because in dam the
+     * choice is visible to the operator: `GET /adm/v1/anzu-user/{id}` has no gating at all while
+     * `GET /adm/users/{id}` sits behind `DAM_USER_READ`, so only the second can ever render "you
+     * have no access". The rule is "the probe goes the way the write goes".
+     */
+    probe: 'anzuUser' | 'base';
+}
+
+/**
+ * A state a system has on top of `enabled`, shown next to it. Today only two systems have one:
+ * blog's `status` (guest / waiting_approval / active / ban / gdpr_deleted) and forum's
+ * `settings.banned`. Both arrive with the record -- they are `#[Serialize]` on the entity -- so
+ * rendering one costs no extra call.
+ */
+export declare interface UserSystemExtraState {
+    /** "blogger", "commenter" -- the app translates it; the library only prints it. */
+    label: string;
+    /** "active", "banned". */
+    value: string;
+    tone: 'ok' | 'warn' | 'error';
+}
+
+/**
+ * Four independent axes inside, one derived state outside.
+ *
+ * The axes are kept apart because they answer different questions and can move independently: a
+ * system can be loaded and forbidden, or absent and still enabled in configuration. Collapsing
+ * them into one enum early is what made the per-admin prototypes conflate "no access" with "no
+ * account here" -- admin-cms's panel leaves `userExists` at null on any non-404 and offers
+ * "Create" in a system the operator cannot even read.
+ */
+export declare const UserSystemLoad: {
+    readonly Idle: "idle";
+    readonly Loading: "loading";
+    readonly Loaded: "loaded";
+    readonly Error: "error";
+};
+
+export declare type UserSystemLoadType = (typeof UserSystemLoad)[keyof typeof UserSystemLoad];
+
+/**
+ * Where "manage in X" leads. A callback over the user rather than a static value: a global
+ * descriptor does not know which row is being drawn.
+ *
+ * The return type is a discriminated union so the two cannot be confused in code either -- an
+ * internal target is pushed through the router, an external one is an `<a href>` opened in a new
+ * tab, and `href: null` is a configured-but-missing url, which renders disabled with a reason
+ * rather than as a dead button.
+ */
+export declare type UserSystemManageTarget = {
+    kind: 'internal';
+    to: RouteLocationRaw;
+} | {
+    kind: 'external';
+    href: string | null;
+};
+
+export declare const UserSystemPresence: {
+    readonly Present: "present";
+    readonly Absent: "absent";
+    readonly Unknown: "unknown";
+};
+
+export declare type UserSystemPresenceType = (typeof UserSystemPresence)[keyof typeof UserSystemPresence];
+
+export declare interface UserSystemProbeParams {
+    descriptor: AnyUserSystemDescriptor;
+    /** Usually injected once per page; passing it explicitly is for tests and one-off panels. */
+    refreshHook?: UserSystemRefreshHook | undefined;
+}
+
+export declare interface UserSystemProbeResult {
+    axes: Ref<UserSystemAxes>;
+    user: Ref<AnzuUser | null>;
+    probe: (id: IntegerId) => Promise<void>;
+    reset: () => void;
+    cancel: () => void;
+}
+
+/**
+ * How an app refreshes a session for one system, and retries.
+ *
+ * The library cannot do this itself: a first 401 is ambiguous -- expired session or no account --
+ * and the only way to tell them apart is to refresh and ask again. Every admin has its own
+ * mechanism (`refreshSession.ts` in inhouse, an interceptor in cms, `requestRefreshToken.ts` in
+ * blog) and none of them lives in `common-admin`. Without this hook a panel would show an expired
+ * token as "no account here", which is exactly the confusion decision 16 forbids.
+ *
+ * Returns true when the refresh succeeded and the call is worth repeating.
+ */
+export declare type UserSystemRefreshHook = (system: string) => Promise<boolean>;
+
+export declare const UserSystemRefreshHookKey: InjectionKey<UserSystemRefreshHook>;
+
+export declare interface UserSystemResult {
+    axes: UserSystemAxes;
+    user: AnzuUser | null;
+}
+
+export declare const UserSystemState: {
+    /** Nothing has been asked yet, or the answer is still on its way. */
+    readonly Loading: "loading";
+    readonly Enabled: "enabled";
+    readonly Disabled: "disabled";
+    readonly Absent: "absent";
+    readonly Forbidden: "forbidden";
+    readonly Unavailable: "unavailable";
+    readonly ConfigDisabled: "configDisabled";
+};
+
+export declare type UserSystemStateType = (typeof UserSystemState)[keyof typeof UserSystemState];
+
 export declare function useSubjectSelect<TItem>(datatableConfig: any, datatableHiddenColumns: any, system: string, subject: string, execute: (pagination: Ref<Pagination>, filterData: FilterData<any>, filterConfig: FilterConfig<any>, params?: FetchListParams) => Promise<TItem[]>, filterData: FilterData<any>, filterConfig: FilterConfig<any>, filterSortBy?: DatatableSortBy | null, fetchParams?: FetchListParams | undefined, enableActions?: boolean): {
     items: Ref<TItem[], TItem[]>;
     selected: Ref<TItem[], TItem[]>;
@@ -3308,6 +5476,352 @@ export declare function useUserAdminConfigFactory(): {
     createDefaultUserAdminConfig: (system: string) => UserAdminConfig;
 };
 
+/**
+ * The cross-system fan-out.
+ *
+ * No calls to the current-user endpoints go out at all: the buttons in a row are decided by the
+ * probe's answer rather than by `<Acl>`, so there is nothing to load nine current users for. The
+ * budget is nine calls when searching by id, eighteen when searching by e-mail.
+ */
+export declare const useUserCrossSystemSearch: (params: CrossSystemSearchParams) => {
+    search: (term: string) => Promise<boolean>;
+    searchById: (id: IntegerId) => Promise<void>;
+    searchByEmail: (email: string) => Promise<void>;
+    refreshSystem: (system: string) => Promise<void>;
+    resultFor: (system: string) => UserSystemResult | undefined;
+    unresolvedSystems: ComputedRef<string[]>;
+    cancel: () => void;
+};
+
+/**
+ * Search results and the bulk run live here, not inside the dialog's component.
+ *
+ * The dialog can be closed while the calls are still going -- one dead backend running into its
+ * timeout must not lock the screen -- and state owned by the component would be thrown away with
+ * it. The results stay on the page either way.
+ */
+export declare const useUserCrossSystemStore: SetupStoreDefinition<"labsUserCrossSystemStore", {
+    searchTerm: Ref<string, string>;
+    resolvedId: Ref<IntegerIdNullable, IntegerIdNullable>;
+    phase: Ref<CrossSystemPhaseType, CrossSystemPhaseType>;
+    results: Ref<Map<string, {
+        axes: {
+            load: UserSystemLoadType;
+            presence: UserSystemPresenceType;
+            access: UserSystemAccessType;
+            enabled: boolean | "unknown";
+        };
+        user: {
+            enabled: boolean;
+            locale: LanguageCode | null;
+            roles: string[];
+            permissionGroups: IntegerId[];
+            permissions: Permissions_2;
+            resolvedPermissions: Permissions_2;
+            _resourceName: string;
+            _system: string;
+            createdAt: DatetimeUTC;
+            modifiedAt: DatetimeUTC;
+            modifiedBy: IntegerIdNullable;
+            createdBy: IntegerIdNullable;
+            id?: IntegerIdNullable | undefined;
+            email: string;
+            person: {
+                firstName: string;
+                lastName: string;
+                fullName: string;
+            };
+            avatar: {
+                color: string;
+                text: string;
+            };
+        } | null;
+    }> & Omit<Map<string, UserSystemResult>, keyof Map<any, any>>, Map<string, UserSystemResult> | (Map<string, {
+        axes: {
+            load: UserSystemLoadType;
+            presence: UserSystemPresenceType;
+            access: UserSystemAccessType;
+            enabled: boolean | "unknown";
+        };
+        user: {
+            enabled: boolean;
+            locale: LanguageCode | null;
+            roles: string[];
+            permissionGroups: IntegerId[];
+            permissions: Permissions_2;
+            resolvedPermissions: Permissions_2;
+            _resourceName: string;
+            _system: string;
+            createdAt: DatetimeUTC;
+            modifiedAt: DatetimeUTC;
+            modifiedBy: IntegerIdNullable;
+            createdBy: IntegerIdNullable;
+            id?: IntegerIdNullable | undefined;
+            email: string;
+            person: {
+                firstName: string;
+                lastName: string;
+                fullName: string;
+            };
+            avatar: {
+                color: string;
+                text: string;
+            };
+        } | null;
+    }> & Omit<Map<string, UserSystemResult>, keyof Map<any, any>>)>;
+    identityConflict: Ref<(Map<string, number> & Omit<Map<string, number>, keyof Map<any, any>>) | null, Map<string, number> | (Map<string, number> & Omit<Map<string, number>, keyof Map<any, any>>) | null>;
+    bulkRunning: Ref<boolean, boolean>;
+    bulkAction: Ref<BulkActionType | null, BulkActionType | null>;
+    bulkSubjectId: Ref<IntegerIdNullable, IntegerIdNullable>;
+    bulkLog: Ref<{
+        system: string;
+        outcome: BulkOutcomeType;
+        action: BulkActionType;
+        subjectId: IntegerIdNullable;
+        detail?: string | undefined;
+    }[], BulkLogEntry[] | {
+        system: string;
+        outcome: BulkOutcomeType;
+        action: BulkActionType;
+        subjectId: IntegerIdNullable;
+        detail?: string | undefined;
+    }[]>;
+    termRejected: Ref<boolean, boolean>;
+    resetResults: () => void;
+    setResult: (system: string, result: UserSystemResult) => void;
+    patchAxes: (system: string, axes: UserSystemAxes) => void;
+    setUser: (system: string, user: AnzuUser | null) => void;
+    startBulk: (action: BulkActionType, systems: string[], subjectId: IntegerIdNullable) => void;
+    setBulkEntry: (system: string, outcome: BulkOutcomeType, detail?: string) => void;
+    finishBulk: () => void;
+    reset: () => void;
+}>;
+
+export declare const useUserCrossSystemWrites: () => {
+    setEnabled: (descriptor: AnyUserSystemDescriptor, id: IntegerId, enabled: boolean) => Promise<WriteResult>;
+    writeMetadata: (descriptor: AnyUserSystemDescriptor, id: IntegerId, target: BaseUser, fields?: readonly UserMetadataField[], seen?: BaseUser | null) => Promise<WriteResult & {
+        changed: boolean;
+    }>;
+    createInSystem: (descriptor: AnyUserSystemDescriptor, body: AnzuUser) => Promise<WriteResult>;
+    readSourceUser: (descriptor: AnyUserSystemDescriptor, id: IntegerId) => Promise<AnzuUser | null>;
+};
+
+/**
+ * The `BaseUserDto` rules, per profile.
+ *
+ * The lengths come from the backend constraints (`email` 256, first/last 120, full 242, avatar
+ * text 2-3). The backend requires only the e-mail; the front end is deliberately stricter, and
+ * `requiredMetadata` is what says by how much.
+ */
+export declare function useUserMetadataValidation(user: Ref<BaseUser>, options: UserMetadataValidationOptions): {
+    v$: Ref< Validation<{
+        user: {
+            id: {
+                required: ValidationRuleWithoutParams<any>;
+            } | {
+                required?: undefined;
+            };
+            email: {
+                required: ValidationRuleWithoutParams<any>;
+                email: ValidationRuleWithoutParams<any>;
+                maxLength: ValidationRuleWithParams<{
+                    max: number;
+                }, any>;
+            };
+            person: {
+                firstName: {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required?: undefined;
+                };
+                lastName: {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required?: undefined;
+                };
+                fullName: {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required?: undefined;
+                };
+            };
+            avatar: {
+                color: {
+                    hexColor: any;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    hexColor: any;
+                    required?: undefined;
+                };
+                text: {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required?: undefined;
+                };
+            };
+        };
+    }, {
+        user: Ref<BaseUser, BaseUser>;
+    }>, Validation<{
+        user: {
+            id: {
+                required: ValidationRuleWithoutParams<any>;
+            } | {
+                required?: undefined;
+            };
+            email: {
+                required: ValidationRuleWithoutParams<any>;
+                email: ValidationRuleWithoutParams<any>;
+                maxLength: ValidationRuleWithParams<{
+                    max: number;
+                }, any>;
+            };
+            person: {
+                firstName: {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required?: undefined;
+                };
+                lastName: {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required?: undefined;
+                };
+                fullName: {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required?: undefined;
+                };
+            };
+            avatar: {
+                color: {
+                    hexColor: any;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    hexColor: any;
+                    required?: undefined;
+                };
+                text: {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required: ValidationRuleWithoutParams<any>;
+                } | {
+                    minLength: ValidationRuleWithParams<{
+                        min: number;
+                    }, any>;
+                    maxLength: ValidationRuleWithParams<{
+                        max: number;
+                    }, any>;
+                    required?: undefined;
+                };
+            };
+        };
+    }, {
+        user: Ref<BaseUser, BaseUser>;
+    }>>;
+};
+
+/**
+ * One system's answer about one user.
+ *
+ * Reads through `endpoints[probe].get`, never a hard-coded path: in dam the choice is visible to
+ * the operator, because `/adm/v1/anzu-user/{id}` has no gating there while `/adm/users/{id}` sits
+ * behind `DAM_USER_READ` -- only the second can ever render "you have no access".
+ *
+ * Note for the app: a probe answering 404 is an expected result here, not a failure, but it still
+ * reaches the api error logger. Filter on `status === 404 && entity === USER_PROBE_ENTITY`, or
+ * every absent account writes a line into the log.
+ */
+export declare const useUserSystemProbe: (params: UserSystemProbeParams) => UserSystemProbeResult;
+
 declare interface ValueObjectOption<T> {
     value: T;
     title: string;
@@ -3324,6 +5838,22 @@ declare interface ViewBodySlotProps<TItem extends Record<string, any>> {
     };
 }
 
+export declare const writeMetadataField: (user: BaseUser, field: UserMetadataField, value: string) => void;
+
+export declare interface WriteResult {
+    outcome: BulkOutcomeType;
+    /** What the server holds afterwards, when it answered with the record. */
+    user?: AnzuUser;
+    /**
+     * Fields whose stored value had moved away from both the target and what the search saw.
+     *
+     * The write still goes through -- decision 24 says the operator's value wins -- but somebody
+     * edited the record in between, and the log line says so rather than letting it pass unnoticed.
+     */
+    concurrentFields?: UserMetadataField[];
+    detail?: string;
+}
+
 export { }