@camunda/ccma-api 0.0.10 → 0.3.0

package/dist/services/accounts/users.service.js

@@ -113,19 +113,21 @@ class UsersService {
     return response.body;
   }
   static async getUserInfo(params) {
-    const cacheKey = params.basic === true ? `basic-${params.userId}` : params.userId;
+    const cacheKey = `${params.basic === true ? "basic-" : ""}${params.roles === true ? "roles-" : ""}${params.userId}`;
     if (!params.cacheControl?.ignoreCache) {
       const inCache = userCache.get(cacheKey);
       if (inCache) {
         return inCache;
       }
     }
-    let queryParams = "";
+    const searchParams = new URLSearchParams();
     if (params.basic === true) {
-      const searchParams = new URLSearchParams();
       searchParams.append("basic", "true");
-      queryParams = `?${searchParams.toString()}`;
     }
+    if (params.roles === true) {
+      searchParams.append("roles", "true");
+    }
+    const queryParams = searchParams.toString() ? `?${searchParams.toString()}` : "";
     const serviceContext = {
       method: {
         name: `UsersService.getUserInfo`,
@@ -191,6 +193,296 @@ class UsersService {
       );
     }
   }
+  static async changeEmail(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.changeEmail",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/email`,
+        normalizedUrl: "api/users/:userId/email",
+        type: "put"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: { email: params.params.email },
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  static async changeName(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.changeName",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/name`,
+        normalizedUrl: "api/users/:userId/name",
+        type: "put"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: {
+        firstname: params.params.firstname,
+        lastname: params.params.lastname
+      },
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /** Admin-activate a user without an email token (POST api/admin/activate). */
+  static async activateWithoutToken(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.activateWithoutToken",
+        url: "api/admin/activate",
+        normalizedUrl: "api/admin/activate",
+        type: "post"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: { userId: params.params.userId },
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /** Refresh the verification token and resend the welcome mail. */
+  static async resendWelcomeMail(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.resendWelcomeMail",
+        url: "api/admin/resend-welcome-mail",
+        normalizedUrl: "api/admin/resend-welcome-mail",
+        type: "post"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: { userId: params.params.userId },
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  static async deleteUser(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.deleteUser",
+        url: `api/users/${encodeURIComponent(params.params.userId)}`,
+        normalizedUrl: "api/users/:userId",
+        type: "delete"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /**
+   * Auth0 brute-force blocks for a user (`GET api/users/:userId/blocks`). The
+   * entries are Auth0's block records (identifier/IP), returned opaque for the
+   * caller to render.
+   */
+  static async getBlocks(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.getBlocks",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,
+        normalizedUrl: "api/users/:userId/blocks",
+        type: "get"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      ...params,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      responseType: "json"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+    return response.body ?? [];
+  }
+  /** Clear a user's Auth0 blocks (`DELETE api/users/:userId/blocks`). */
+  static async clearBlocks(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.clearBlocks",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,
+        normalizedUrl: "api/users/:userId/blocks",
+        type: "delete"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /** Replace a user's Auth0 `app_metadata` (god-gated raw JSON edit). */
+  static async updateAppMetadata(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.updateAppMetadata",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/appmetadata`,
+        normalizedUrl: "api/users/:userId/appmetadata",
+        type: "put"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: params.body,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /** Replace a user's Auth0 `user_metadata` (god-gated raw JSON edit). */
+  static async updateUserMetadata(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.updateUserMetadata",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/usermetadata`,
+        normalizedUrl: "api/users/:userId/usermetadata",
+        type: "put"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: params.body,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  static async setDefaultOrg(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.setDefaultOrg",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/organizations/${encodeURIComponent(params.params.orgId)}/default`,
+        normalizedUrl: "api/users/:userId/organizations/:orgId/default",
+        type: "patch"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
   static async removeUserFromOrganization(params) {
     const serviceContext = {
       method: {

package/dist/services/accounts/users.service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/services/accounts/users.service.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  MINUTE,\n  type OrganizationRole,\n  type User,\n} from '@camunda/ccma-shared-types'\nimport type {\n  RequestBaseParams,\n  RequestBaseServiceContext,\n} from '../../types/general.types.js'\nimport { request } from '../../utils/api.js'\nimport { Cache } from '../../utils/cache.js'\nimport { HttpError } from '../../utils/errors.js'\nimport type { HibobSearchResponse } from '../hibob/hibob.service.js'\n\nconst userCache = new Cache<string, User>(5 * MINUTE)\nconst REGEX_EMAIL =\n  // eslint-disable-next-line prefer-named-capture-group, no-useless-escape\n  /^(([^<>()[\\]\\\\.,;:\\s@\"]+(\\.[^<>()[\\]\\\\.,;:\\s@\"]+)*)|(\".+\"))@((\\[[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\])|(([a-zA-Z\\-0-9]+\\.)+[a-zA-Z]{2,}))$/u\n\nexport interface SearchParams extends RequestBaseParams {\n  params: {\n    q: {\n      organization?: {\n        uuid: string\n        member: boolean\n      }\n      name?: string\n      userId?: string\n      roleId?: string\n      email?: string\n      signUpStatus?: {\n        verified: boolean\n        tokenExpired?: boolean\n      }\n      created?: {\n        after?: Date\n        before?: Date\n      }\n    }\n    onBehalfOf?: string\n  }\n}\n\nexport interface SimpleSearchParams extends RequestBaseParams {\n  params: {\n    query: string\n    type: 'by-email' | 'by-id' | 'fuzzy' | 'lucene'\n  }\n}\n\nexport interface AddUserToOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n    orgRoles: OrganizationRole[]\n    byEmail?: boolean\n  }\n}\n\nexport interface RemoveUserFromOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n    byEmail?: boolean\n  }\n}\n\nexport interface UpdateUserRoleRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    roleToAdd?: string\n    roleToRemove?: string\n  }\n  headers?: {\n    'x-camunda-email'?: string\n  }\n}\n\nexport class UsersService {\n  public static async search(params: SearchParams): Promise<User[]> {\n    const queryParams = new URLSearchParams()\n    const urlParts: string[] = []\n    if (params.params.q.roleId) {\n      // API route different if roleId is present\n      // eslint-disable-next-line id-length\n      const q = {\n        roleId: params.params.q.roleId,\n        name: params.params.q.name || '',\n        email: params.params.q.email || '',\n      }\n      queryParams.append('q', JSON.stringify(q))\n      urlParts.push(...['api', 'users', `?${queryParams.toString()}`])\n    } else {\n      if (params.params.onBehalfOf) {\n        queryParams.append(\n          'onBehalfOf',\n          encodeURI(JSON.stringify(params.params.onBehalfOf)),\n        )\n      }\n      queryParams.append('q', encodeURI(JSON.stringify(params.params.q)))\n      urlParts.push(...['api', 'users', 'search', `?${queryParams.toString()}`])\n    }\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.search`,\n        url: urlParts.join(`/`),\n        normalizedUrl: `api/users/search`,\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    if (params.params.q.userId) {\n      UsersService.validateUserId(serviceContext, params.params.q.userId)\n    }\n\n    const response = await request<User[]>({\n      config: params.config,\n      base: {\n        id: 'accounts',\n      },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body!\n  }\n\n  public static async simpleSearch(\n    params: SimpleSearchParams,\n  ): Promise<{ users: User[] }> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.simpleSearch`,\n        url: `api/users/search`,\n        normalizedUrl: `api/users/search`,\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    switch (params.params.type) {\n      case 'by-email':\n        UsersService.validateEmail(serviceContext, params.params.query)\n        break\n      case 'by-id':\n        UsersService.validateUserId(serviceContext, params.params.query)\n        break\n      case 'lucene':\n        UsersService.validateLuceneQuery(serviceContext, params.params.query)\n        break\n    }\n\n    const response = await request<{ users: User[] }>({\n      config: params.config,\n      base: {\n        id: 'accounts',\n      },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      body: {\n        query: params.params.query,\n        type: params.params.type,\n      },\n      metricsDetails: serviceContext,\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body!\n  }\n\n  public static async getUserInfo(\n    params: { userId: string; basic?: boolean } & RequestBaseParams,\n  ): Promise<User | undefined> {\n    const cacheKey =\n      params.basic === true ? `basic-${params.userId}` : params.userId\n    if (!params.cacheControl?.ignoreCache) {\n      const inCache = userCache.get(cacheKey)\n      if (inCache) {\n        return inCache\n      }\n    }\n\n    let queryParams: string = ''\n    if (params.basic === true) {\n      const searchParams = new URLSearchParams()\n      searchParams.append('basic', 'true')\n      queryParams = `?${searchParams.toString()}`\n    }\n\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.getUserInfo`,\n        url: `api/users/${params.userId}${queryParams}`,\n        normalizedUrl: `api/users/:userId`,\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    UsersService.validateUserId(serviceContext, params.userId)\n\n    const response = await request<User>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    userCache.set(cacheKey, response.body!)\n    return response.body\n  }\n\n  public static async addUserToOrganization(\n    params: AddUserToOrganizationRequest,\n  ) {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.addUserToOrganization`,\n        url: `api/users/${params.params.userId}/organization/${params.params.orgId}`,\n        normalizedUrl: `api/users/:userId/organization/:orgId`,\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        orgRoles: params.params.orgRoles,\n        byEmail: params.params.byEmail,\n      },\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async removeUserFromOrganization(\n    params: RemoveUserFromOrganizationRequest,\n  ) {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.removeUserFromOrganization`,\n        url: `api/users/${params.params.userId}/organization/${params.params.orgId}`,\n        normalizedUrl: `api/users/:userId/organization/:orgId`,\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        byEmail: params.params.byEmail,\n      },\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Update a user's role by adding or removing a single role.\n   * This uses the PATCH /api/users/:userId/roles endpoint.\n   * Supports email-based auth middleware via the x-camunda-email header.\n   */\n  public static async updateUserRole(\n    params: UpdateUserRoleRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.updateUserRole`,\n        url: `api/users/${encodeURIComponent(params.params.userId)}/roles`,\n        normalizedUrl: `api/users/:userId/roles`,\n        type: 'patch',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    UsersService.validateUserId(serviceContext, params.params.userId)\n\n    if (!params.params.roleToAdd && !params.params.roleToRemove) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - either roleToAdd or roleToRemove must be specified`,\n        400,\n        `Validation Error in API Package - either roleToAdd or roleToRemove must be specified`,\n      )\n    }\n\n    const body: { roleToAdd?: string; roleToRemove?: string } = {}\n    if (params.params.roleToAdd) {\n      body.roleToAdd = params.params.roleToAdd\n    }\n    if (params.params.roleToRemove) {\n      body.roleToRemove = params.params.roleToRemove\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body,\n      headers: params.headers,\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Get all Hibob users (for bulk ghost account checks).\n   * This fetches all active Hibob employees in a single request.\n   */\n  public static async getAllHibobUsers(\n    params: RequestBaseParams,\n  ): Promise<HibobSearchResponse> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getAllHibobUsers',\n        url: 'api/users/hibob/all',\n        normalizedUrl: 'api/users/hibob/all',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request<HibobSearchResponse>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n\n    return response.body!\n  }\n\n  /**\n   * Get Hibob details for a specific user by their Auth0 user ID.\n   */\n  public static async getUserHibobDetails(\n    params: { userId: string } & RequestBaseParams,\n  ): Promise<HibobSearchResponse> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getUserHibobDetails',\n        url: `api/users/${encodeURIComponent(params.userId)}/hibob`,\n        normalizedUrl: 'api/users/:userId/hibob',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request<HibobSearchResponse>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n\n    return response.body!\n  }\n\n  private static validateUserId(\n    serviceContext: RequestBaseServiceContext,\n    userId: string,\n  ) {\n    if (!userId || !userId.includes('|')) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - missing pipe '|'`,\n        400,\n        `Validation Error in API Package - missing pipe '|'`,\n      )\n    }\n  }\n\n  private static validateEmail(\n    serviceContext: RequestBaseServiceContext,\n    email: string,\n  ) {\n    if (!email || !REGEX_EMAIL.test(email)) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - invalid email format`,\n        400,\n        `Validation Error in API Package - invalid email format`,\n      )\n    }\n  }\n\n  /**\n   * Validates a Lucene query string for Auth0 user search.\n   * Auth0 supports Lucene query syntax including:\n   * - Field queries: field:value (e.g., email:john@example.com)\n   * - Wildcards: field:*value*, field:value*\n   * - Boolean operators: AND, OR, NOT\n   * - Grouping: (field:value OR field:value)\n   * - Range queries: field:[min TO max]\n   * - Exact phrase: field:\"exact phrase\"\n   *\n   * @see https://auth0.com/docs/manage-users/user-search/user-search-query-syntax\n   */\n  private static validateLuceneQuery(\n    serviceContext: RequestBaseServiceContext,\n    query: string,\n  ) {\n    if (!query || query.trim().length === 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - empty Lucene query`,\n        400,\n        `Validation Error in API Package - empty Lucene query`,\n      )\n    }\n\n    // Basic validation: query should contain at least a field:value pattern or be a valid search term\n    // Auth0 Lucene syntax requires queries to have field:value format for structured searches\n    const trimmedQuery = query.trim()\n\n    // Check for unbalanced parentheses\n    let parenCount = 0\n    for (const char of trimmedQuery) {\n      if (char === '(') parenCount++\n      if (char === ')') parenCount--\n      if (parenCount < 0) {\n        throw new HttpError(\n          `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced parentheses in Lucene query`,\n          400,\n          `Validation Error in API Package - unbalanced parentheses in Lucene query`,\n        )\n      }\n    }\n    if (parenCount !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced parentheses in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced parentheses in Lucene query`,\n      )\n    }\n\n    // Check for unbalanced square brackets (range queries)\n    let bracketCount = 0\n    for (const char of trimmedQuery) {\n      if (char === '[') bracketCount++\n      if (char === ']') bracketCount--\n      if (bracketCount < 0) {\n        throw new HttpError(\n          `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced brackets in Lucene query`,\n          400,\n          `Validation Error in API Package - unbalanced brackets in Lucene query`,\n        )\n      }\n    }\n    if (bracketCount !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced brackets in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced brackets in Lucene query`,\n      )\n    }\n\n    // Check for unbalanced quotes\n    const quoteCount = (trimmedQuery.match(/\"/gu) || []).length\n    if (quoteCount % 2 !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced quotes in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced quotes in Lucene query`,\n      )\n    }\n\n    // Validate that query contains at least one valid field:value pattern or search term\n    // A valid Lucene query for Auth0 should have field:value syntax\n    // Use word boundary to match field:value patterns anywhere in the query\n    const hasFieldValue = /\\b\\w+:/u.test(trimmedQuery)\n    if (!hasFieldValue) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - Lucene query must contain field:value syntax (e.g., email:john@example.com)`,\n        400,\n        `Validation Error in API Package - Lucene query must contain field:value syntax (e.g., email:john@example.com)`,\n      )\n    }\n  }\n}\n"],
-  "mappings": "AAMA;AAAA,EACE;AAAA,OAGK;AAKP,SAAS,eAAe;AACxB,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAG1B,MAAM,YAAY,IAAI,MAAoB,IAAI,MAAM;AACpD,MAAM;AAAA;AAAA,EAEJ;AAAA;AA6DK,MAAM,aAAa;AAAA,EACxB,aAAoB,OAAO,QAAuC;AAChE,UAAM,cAAc,IAAI,gBAAgB;AACxC,UAAM,WAAqB,CAAC;AAC5B,QAAI,OAAO,OAAO,EAAE,QAAQ;AAG1B,YAAM,IAAI;AAAA,QACR,QAAQ,OAAO,OAAO,EAAE;AAAA,QACxB,MAAM,OAAO,OAAO,EAAE,QAAQ;AAAA,QAC9B,OAAO,OAAO,OAAO,EAAE,SAAS;AAAA,MAClC;AACA,kBAAY,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC;AACzC,eAAS,KAAK,GAAG,CAAC,OAAO,SAAS,IAAI,YAAY,SAAS,CAAC,EAAE,CAAC;AAAA,IACjE,OAAO;AACL,UAAI,OAAO,OAAO,YAAY;AAC5B,oBAAY;AAAA,UACV;AAAA,UACA,UAAU,KAAK,UAAU,OAAO,OAAO,UAAU,CAAC;AAAA,QACpD;AAAA,MACF;AACA,kBAAY,OAAO,KAAK,UAAU,KAAK,UAAU,OAAO,OAAO,CAAC,CAAC,CAAC;AAClE,eAAS,KAAK,GAAG,CAAC,OAAO,SAAS,UAAU,IAAI,YAAY,SAAS,CAAC,EAAE,CAAC;AAAA,IAC3E;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,SAAS,KAAK,GAAG;AAAA,QACtB,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,OAAO,OAAO,EAAE,QAAQ;AAC1B,mBAAa,eAAe,gBAAgB,OAAO,OAAO,EAAE,MAAM;AAAA,IACpE;AAEA,UAAM,WAAW,MAAM,QAAgB;AAAA,MACrC,QAAQ,OAAO;AAAA,MACf,MAAM;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,MACA,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,aAClB,QAC4B;AAC5B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,YAAQ,OAAO,OAAO,MAAM;AAAA,MAC1B,KAAK;AACH,qBAAa,cAAc,gBAAgB,OAAO,OAAO,KAAK;AAC9D;AAAA,MACF,KAAK;AACH,qBAAa,eAAe,gBAAgB,OAAO,OAAO,KAAK;AAC/D;AAAA,MACF,KAAK;AACH,qBAAa,oBAAoB,gBAAgB,OAAO,OAAO,KAAK;AACpE;AAAA,IACJ;AAEA,UAAM,WAAW,MAAM,QAA2B;AAAA,MAChD,QAAQ,OAAO;AAAA,MACf,MAAM;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,MACA,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,MAAM;AAAA,QACJ,OAAO,OAAO,OAAO;AAAA,QACrB,MAAM,OAAO,OAAO;AAAA,MACtB;AAAA,MACA,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,YAClB,QAC2B;AAC3B,UAAM,WACJ,OAAO,UAAU,OAAO,SAAS,OAAO,MAAM,KAAK,OAAO;AAC5D,QAAI,CAAC,OAAO,cAAc,aAAa;AACrC,YAAM,UAAU,UAAU,IAAI,QAAQ;AACtC,UAAI,SAAS;AACX,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,cAAsB;AAC1B,QAAI,OAAO,UAAU,MAAM;AACzB,YAAM,eAAe,IAAI,gBAAgB;AACzC,mBAAa,OAAO,SAAS,MAAM;AACnC,oBAAc,IAAI,aAAa,SAAS,CAAC;AAAA,IAC3C;AAEA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,MAAM,GAAG,WAAW;AAAA,QAC7C,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,iBAAa,eAAe,gBAAgB,OAAO,MAAM;AAEzD,UAAM,WAAW,MAAM,QAAc;AAAA,MACnC,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,cAAU,IAAI,UAAU,SAAS,IAAK;AACtC,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,sBAClB,QACA;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,OAAO,MAAM,iBAAiB,OAAO,OAAO,KAAK;AAAA,QAC1E,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,UAAU,OAAO,OAAO;AAAA,QACxB,SAAS,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,2BAClB,QACA;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,OAAO,MAAM,iBAAiB,OAAO,OAAO,KAAK;AAAA,QAC1E,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,SAAS,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAoB,eAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,iBAAa,eAAe,gBAAgB,OAAO,OAAO,MAAM;AAEhE,QAAI,CAAC,OAAO,OAAO,aAAa,CAAC,OAAO,OAAO,cAAc;AAC3D,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAsD,CAAC;AAC7D,QAAI,OAAO,OAAO,WAAW;AAC3B,WAAK,YAAY,OAAO,OAAO;AAAA,IACjC;AACA,QAAI,OAAO,OAAO,cAAc;AAC9B,WAAK,eAAe,OAAO,OAAO;AAAA,IACpC;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB;AAAA,MACA,SAAS,OAAO;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAoB,iBAClB,QAC8B;AAC9B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAA6B;AAAA,MAClD,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAoB,oBAClB,QAC8B;AAC9B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,MAAM,CAAC;AAAA,QACnD,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAA6B;AAAA,MAClD,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,OAAe,eACb,gBACA,QACA;AACA,QAAI,CAAC,UAAU,CAAC,OAAO,SAAS,GAAG,GAAG;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,cACb,gBACA,OACA;AACA,QAAI,CAAC,SAAS,CAAC,YAAY,KAAK,KAAK,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,OAAe,oBACb,gBACA,OACA;AACA,QAAI,CAAC,SAAS,MAAM,KAAK,EAAE,WAAW,GAAG;AACvC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAIA,UAAM,eAAe,MAAM,KAAK;AAGhC,QAAI,aAAa;AACjB,eAAW,QAAQ,cAAc;AAC/B,UAAI,SAAS,IAAK;AAClB,UAAI,SAAS,IAAK;AAClB,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,OAAO,IAAI;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,eAAe,GAAG;AACpB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,QAAI,eAAe;AACnB,eAAW,QAAQ,cAAc;AAC/B,UAAI,SAAS,IAAK;AAClB,UAAI,SAAS,IAAK;AAClB,UAAI,eAAe,GAAG;AACpB,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,OAAO,IAAI;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,iBAAiB,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG;AACrD,QAAI,aAAa,MAAM,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAKA,UAAM,gBAAgB,UAAU,KAAK,YAAY;AACjD,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  MINUTE,\n  type OrganizationRole,\n  type User,\n} from '@camunda/ccma-shared-types'\nimport type {\n  RequestBaseParams,\n  RequestBaseServiceContext,\n} from '../../types/general.types.js'\nimport { request } from '../../utils/api.js'\nimport { Cache } from '../../utils/cache.js'\nimport { HttpError } from '../../utils/errors.js'\nimport type { HibobSearchResponse } from '../hibob/hibob.service.js'\n\nconst userCache = new Cache<string, User>(5 * MINUTE)\nconst REGEX_EMAIL =\n  // eslint-disable-next-line prefer-named-capture-group, no-useless-escape\n  /^(([^<>()[\\]\\\\.,;:\\s@\"]+(\\.[^<>()[\\]\\\\.,;:\\s@\"]+)*)|(\".+\"))@((\\[[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\])|(([a-zA-Z\\-0-9]+\\.)+[a-zA-Z]{2,}))$/u\n\nexport interface SearchParams extends RequestBaseParams {\n  params: {\n    q: {\n      organization?: {\n        uuid: string\n        member: boolean\n      }\n      name?: string\n      userId?: string\n      roleId?: string\n      email?: string\n      signUpStatus?: {\n        verified: boolean\n        tokenExpired?: boolean\n      }\n      created?: {\n        after?: Date\n        before?: Date\n      }\n    }\n    onBehalfOf?: string\n  }\n}\n\nexport interface SimpleSearchParams extends RequestBaseParams {\n  params: {\n    query: string\n    type: 'by-email' | 'by-id' | 'fuzzy' | 'lucene'\n  }\n}\n\nexport interface AddUserToOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n    orgRoles: OrganizationRole[]\n    byEmail?: boolean\n  }\n}\n\nexport interface RemoveUserFromOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n    byEmail?: boolean\n  }\n}\n\nexport interface UpdateUserRoleRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    roleToAdd?: string\n    roleToRemove?: string\n  }\n  headers?: {\n    'x-camunda-email'?: string\n  }\n}\n\nexport interface ChangeUserEmailRequest extends RequestBaseParams {\n  params: { userId: string; email: string }\n}\n\nexport interface ChangeUserNameRequest extends RequestBaseParams {\n  params: { userId: string; firstname: string; lastname: string }\n}\n\nexport interface UserIdRequest extends RequestBaseParams {\n  params: { userId: string }\n}\n\nexport interface SetDefaultOrgRequest extends RequestBaseParams {\n  params: { userId: string; orgId: string }\n}\n\nexport class UsersService {\n  public static async search(params: SearchParams): Promise<User[]> {\n    const queryParams = new URLSearchParams()\n    const urlParts: string[] = []\n    if (params.params.q.roleId) {\n      // API route different if roleId is present\n      // eslint-disable-next-line id-length\n      const q = {\n        roleId: params.params.q.roleId,\n        name: params.params.q.name || '',\n        email: params.params.q.email || '',\n      }\n      queryParams.append('q', JSON.stringify(q))\n      urlParts.push(...['api', 'users', `?${queryParams.toString()}`])\n    } else {\n      if (params.params.onBehalfOf) {\n        queryParams.append(\n          'onBehalfOf',\n          encodeURI(JSON.stringify(params.params.onBehalfOf)),\n        )\n      }\n      queryParams.append('q', encodeURI(JSON.stringify(params.params.q)))\n      urlParts.push(...['api', 'users', 'search', `?${queryParams.toString()}`])\n    }\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.search`,\n        url: urlParts.join(`/`),\n        normalizedUrl: `api/users/search`,\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    if (params.params.q.userId) {\n      UsersService.validateUserId(serviceContext, params.params.q.userId)\n    }\n\n    const response = await request<User[]>({\n      config: params.config,\n      base: {\n        id: 'accounts',\n      },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body!\n  }\n\n  public static async simpleSearch(\n    params: SimpleSearchParams,\n  ): Promise<{ users: User[] }> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.simpleSearch`,\n        url: `api/users/search`,\n        normalizedUrl: `api/users/search`,\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    switch (params.params.type) {\n      case 'by-email':\n        UsersService.validateEmail(serviceContext, params.params.query)\n        break\n      case 'by-id':\n        UsersService.validateUserId(serviceContext, params.params.query)\n        break\n      case 'lucene':\n        UsersService.validateLuceneQuery(serviceContext, params.params.query)\n        break\n    }\n\n    const response = await request<{ users: User[] }>({\n      config: params.config,\n      base: {\n        id: 'accounts',\n      },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      body: {\n        query: params.params.query,\n        type: params.params.type,\n      },\n      metricsDetails: serviceContext,\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body!\n  }\n\n  public static async getUserInfo(\n    params: {\n      userId: string\n      basic?: boolean\n      roles?: boolean\n    } & RequestBaseParams,\n  ): Promise<User | undefined> {\n    // `roles=true` asks the backend to enrich the user with its Auth0\n    // platform (account-level) roles, which are omitted by default.\n    const cacheKey = `${params.basic === true ? 'basic-' : ''}${\n      params.roles === true ? 'roles-' : ''\n    }${params.userId}`\n    if (!params.cacheControl?.ignoreCache) {\n      const inCache = userCache.get(cacheKey)\n      if (inCache) {\n        return inCache\n      }\n    }\n\n    const searchParams = new URLSearchParams()\n    if (params.basic === true) {\n      searchParams.append('basic', 'true')\n    }\n    if (params.roles === true) {\n      searchParams.append('roles', 'true')\n    }\n    const queryParams = searchParams.toString()\n      ? `?${searchParams.toString()}`\n      : ''\n\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.getUserInfo`,\n        url: `api/users/${params.userId}${queryParams}`,\n        normalizedUrl: `api/users/:userId`,\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    UsersService.validateUserId(serviceContext, params.userId)\n\n    const response = await request<User>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    userCache.set(cacheKey, response.body!)\n    return response.body\n  }\n\n  public static async addUserToOrganization(\n    params: AddUserToOrganizationRequest,\n  ) {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.addUserToOrganization`,\n        url: `api/users/${params.params.userId}/organization/${params.params.orgId}`,\n        normalizedUrl: `api/users/:userId/organization/:orgId`,\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        orgRoles: params.params.orgRoles,\n        byEmail: params.params.byEmail,\n      },\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async changeEmail(\n    params: ChangeUserEmailRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.changeEmail',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/email`,\n        normalizedUrl: 'api/users/:userId/email',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: { email: params.params.email },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async changeName(params: ChangeUserNameRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.changeName',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/name`,\n        normalizedUrl: 'api/users/:userId/name',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        firstname: params.params.firstname,\n        lastname: params.params.lastname,\n      },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Admin-activate a user without an email token (POST api/admin/activate). */\n  public static async activateWithoutToken(\n    params: UserIdRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.activateWithoutToken',\n        url: 'api/admin/activate',\n        normalizedUrl: 'api/admin/activate',\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: { userId: params.params.userId },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Refresh the verification token and resend the welcome mail. */\n  public static async resendWelcomeMail(params: UserIdRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.resendWelcomeMail',\n        url: 'api/admin/resend-welcome-mail',\n        normalizedUrl: 'api/admin/resend-welcome-mail',\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: { userId: params.params.userId },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async deleteUser(params: UserIdRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.deleteUser',\n        url: `api/users/${encodeURIComponent(params.params.userId)}`,\n        normalizedUrl: 'api/users/:userId',\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Auth0 brute-force blocks for a user (`GET api/users/:userId/blocks`). The\n   * entries are Auth0's block records (identifier/IP), returned opaque for the\n   * caller to render.\n   */\n  public static async getBlocks(params: UserIdRequest): Promise<unknown[]> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getBlocks',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,\n        normalizedUrl: 'api/users/:userId/blocks',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request<unknown[]>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'json',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body ?? []\n  }\n\n  /** Clear a user's Auth0 blocks (`DELETE api/users/:userId/blocks`). */\n  public static async clearBlocks(params: UserIdRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.clearBlocks',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,\n        normalizedUrl: 'api/users/:userId/blocks',\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Replace a user's Auth0 `app_metadata` (god-gated raw JSON edit). */\n  public static async updateAppMetadata(\n    params: {\n      params: { userId: string }\n      body: { appMetadata: object }\n    } & RequestBaseParams,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.updateAppMetadata',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/appmetadata`,\n        normalizedUrl: 'api/users/:userId/appmetadata',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: params.body,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Replace a user's Auth0 `user_metadata` (god-gated raw JSON edit). */\n  public static async updateUserMetadata(\n    params: {\n      params: { userId: string }\n      body: { userMetadata: object }\n    } & RequestBaseParams,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.updateUserMetadata',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/usermetadata`,\n        normalizedUrl: 'api/users/:userId/usermetadata',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: params.body,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async setDefaultOrg(\n    params: SetDefaultOrgRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.setDefaultOrg',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/organizations/${encodeURIComponent(params.params.orgId)}/default`,\n        normalizedUrl: 'api/users/:userId/organizations/:orgId/default',\n        type: 'patch',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async removeUserFromOrganization(\n    params: RemoveUserFromOrganizationRequest,\n  ) {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.removeUserFromOrganization`,\n        url: `api/users/${params.params.userId}/organization/${params.params.orgId}`,\n        normalizedUrl: `api/users/:userId/organization/:orgId`,\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        byEmail: params.params.byEmail,\n      },\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Update a user's role by adding or removing a single role.\n   * This uses the PATCH /api/users/:userId/roles endpoint.\n   * Supports email-based auth middleware via the x-camunda-email header.\n   */\n  public static async updateUserRole(\n    params: UpdateUserRoleRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.updateUserRole`,\n        url: `api/users/${encodeURIComponent(params.params.userId)}/roles`,\n        normalizedUrl: `api/users/:userId/roles`,\n        type: 'patch',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    UsersService.validateUserId(serviceContext, params.params.userId)\n\n    if (!params.params.roleToAdd && !params.params.roleToRemove) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - either roleToAdd or roleToRemove must be specified`,\n        400,\n        `Validation Error in API Package - either roleToAdd or roleToRemove must be specified`,\n      )\n    }\n\n    const body: { roleToAdd?: string; roleToRemove?: string } = {}\n    if (params.params.roleToAdd) {\n      body.roleToAdd = params.params.roleToAdd\n    }\n    if (params.params.roleToRemove) {\n      body.roleToRemove = params.params.roleToRemove\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body,\n      headers: params.headers,\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Get all Hibob users (for bulk ghost account checks).\n   * This fetches all active Hibob employees in a single request.\n   */\n  public static async getAllHibobUsers(\n    params: RequestBaseParams,\n  ): Promise<HibobSearchResponse> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getAllHibobUsers',\n        url: 'api/users/hibob/all',\n        normalizedUrl: 'api/users/hibob/all',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request<HibobSearchResponse>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n\n    return response.body!\n  }\n\n  /**\n   * Get Hibob details for a specific user by their Auth0 user ID.\n   */\n  public static async getUserHibobDetails(\n    params: { userId: string } & RequestBaseParams,\n  ): Promise<HibobSearchResponse> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getUserHibobDetails',\n        url: `api/users/${encodeURIComponent(params.userId)}/hibob`,\n        normalizedUrl: 'api/users/:userId/hibob',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request<HibobSearchResponse>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n\n    return response.body!\n  }\n\n  private static validateUserId(\n    serviceContext: RequestBaseServiceContext,\n    userId: string,\n  ) {\n    if (!userId || !userId.includes('|')) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - missing pipe '|'`,\n        400,\n        `Validation Error in API Package - missing pipe '|'`,\n      )\n    }\n  }\n\n  private static validateEmail(\n    serviceContext: RequestBaseServiceContext,\n    email: string,\n  ) {\n    if (!email || !REGEX_EMAIL.test(email)) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - invalid email format`,\n        400,\n        `Validation Error in API Package - invalid email format`,\n      )\n    }\n  }\n\n  /**\n   * Validates a Lucene query string for Auth0 user search.\n   * Auth0 supports Lucene query syntax including:\n   * - Field queries: field:value (e.g., email:john@example.com)\n   * - Wildcards: field:*value*, field:value*\n   * - Boolean operators: AND, OR, NOT\n   * - Grouping: (field:value OR field:value)\n   * - Range queries: field:[min TO max]\n   * - Exact phrase: field:\"exact phrase\"\n   *\n   * @see https://auth0.com/docs/manage-users/user-search/user-search-query-syntax\n   */\n  private static validateLuceneQuery(\n    serviceContext: RequestBaseServiceContext,\n    query: string,\n  ) {\n    if (!query || query.trim().length === 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - empty Lucene query`,\n        400,\n        `Validation Error in API Package - empty Lucene query`,\n      )\n    }\n\n    // Basic validation: query should contain at least a field:value pattern or be a valid search term\n    // Auth0 Lucene syntax requires queries to have field:value format for structured searches\n    const trimmedQuery = query.trim()\n\n    // Check for unbalanced parentheses\n    let parenCount = 0\n    for (const char of trimmedQuery) {\n      if (char === '(') parenCount++\n      if (char === ')') parenCount--\n      if (parenCount < 0) {\n        throw new HttpError(\n          `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced parentheses in Lucene query`,\n          400,\n          `Validation Error in API Package - unbalanced parentheses in Lucene query`,\n        )\n      }\n    }\n    if (parenCount !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced parentheses in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced parentheses in Lucene query`,\n      )\n    }\n\n    // Check for unbalanced square brackets (range queries)\n    let bracketCount = 0\n    for (const char of trimmedQuery) {\n      if (char === '[') bracketCount++\n      if (char === ']') bracketCount--\n      if (bracketCount < 0) {\n        throw new HttpError(\n          `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced brackets in Lucene query`,\n          400,\n          `Validation Error in API Package - unbalanced brackets in Lucene query`,\n        )\n      }\n    }\n    if (bracketCount !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced brackets in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced brackets in Lucene query`,\n      )\n    }\n\n    // Check for unbalanced quotes\n    const quoteCount = (trimmedQuery.match(/\"/gu) || []).length\n    if (quoteCount % 2 !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced quotes in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced quotes in Lucene query`,\n      )\n    }\n\n    // Validate that query contains at least one valid field:value pattern or search term\n    // A valid Lucene query for Auth0 should have field:value syntax\n    // Use word boundary to match field:value patterns anywhere in the query\n    const hasFieldValue = /\\b\\w+:/u.test(trimmedQuery)\n    if (!hasFieldValue) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - Lucene query must contain field:value syntax (e.g., email:john@example.com)`,\n        400,\n        `Validation Error in API Package - Lucene query must contain field:value syntax (e.g., email:john@example.com)`,\n      )\n    }\n  }\n}\n"],
+  "mappings": "AAMA;AAAA,EACE;AAAA,OAGK;AAKP,SAAS,eAAe;AACxB,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAG1B,MAAM,YAAY,IAAI,MAAoB,IAAI,MAAM;AACpD,MAAM;AAAA;AAAA,EAEJ;AAAA;AA6EK,MAAM,aAAa;AAAA,EACxB,aAAoB,OAAO,QAAuC;AAChE,UAAM,cAAc,IAAI,gBAAgB;AACxC,UAAM,WAAqB,CAAC;AAC5B,QAAI,OAAO,OAAO,EAAE,QAAQ;AAG1B,YAAM,IAAI;AAAA,QACR,QAAQ,OAAO,OAAO,EAAE;AAAA,QACxB,MAAM,OAAO,OAAO,EAAE,QAAQ;AAAA,QAC9B,OAAO,OAAO,OAAO,EAAE,SAAS;AAAA,MAClC;AACA,kBAAY,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC;AACzC,eAAS,KAAK,GAAG,CAAC,OAAO,SAAS,IAAI,YAAY,SAAS,CAAC,EAAE,CAAC;AAAA,IACjE,OAAO;AACL,UAAI,OAAO,OAAO,YAAY;AAC5B,oBAAY;AAAA,UACV;AAAA,UACA,UAAU,KAAK,UAAU,OAAO,OAAO,UAAU,CAAC;AAAA,QACpD;AAAA,MACF;AACA,kBAAY,OAAO,KAAK,UAAU,KAAK,UAAU,OAAO,OAAO,CAAC,CAAC,CAAC;AAClE,eAAS,KAAK,GAAG,CAAC,OAAO,SAAS,UAAU,IAAI,YAAY,SAAS,CAAC,EAAE,CAAC;AAAA,IAC3E;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,SAAS,KAAK,GAAG;AAAA,QACtB,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,OAAO,OAAO,EAAE,QAAQ;AAC1B,mBAAa,eAAe,gBAAgB,OAAO,OAAO,EAAE,MAAM;AAAA,IACpE;AAEA,UAAM,WAAW,MAAM,QAAgB;AAAA,MACrC,QAAQ,OAAO;AAAA,MACf,MAAM;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,MACA,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,aAClB,QAC4B;AAC5B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,YAAQ,OAAO,OAAO,MAAM;AAAA,MAC1B,KAAK;AACH,qBAAa,cAAc,gBAAgB,OAAO,OAAO,KAAK;AAC9D;AAAA,MACF,KAAK;AACH,qBAAa,eAAe,gBAAgB,OAAO,OAAO,KAAK;AAC/D;AAAA,MACF,KAAK;AACH,qBAAa,oBAAoB,gBAAgB,OAAO,OAAO,KAAK;AACpE;AAAA,IACJ;AAEA,UAAM,WAAW,MAAM,QAA2B;AAAA,MAChD,QAAQ,OAAO;AAAA,MACf,MAAM;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,MACA,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,MAAM;AAAA,QACJ,OAAO,OAAO,OAAO;AAAA,QACrB,MAAM,OAAO,OAAO;AAAA,MACtB;AAAA,MACA,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,YAClB,QAK2B;AAG3B,UAAM,WAAW,GAAG,OAAO,UAAU,OAAO,WAAW,EAAE,GACvD,OAAO,UAAU,OAAO,WAAW,EACrC,GAAG,OAAO,MAAM;AAChB,QAAI,CAAC,OAAO,cAAc,aAAa;AACrC,YAAM,UAAU,UAAU,IAAI,QAAQ;AACtC,UAAI,SAAS;AACX,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,gBAAgB;AACzC,QAAI,OAAO,UAAU,MAAM;AACzB,mBAAa,OAAO,SAAS,MAAM;AAAA,IACrC;AACA,QAAI,OAAO,UAAU,MAAM;AACzB,mBAAa,OAAO,SAAS,MAAM;AAAA,IACrC;AACA,UAAM,cAAc,aAAa,SAAS,IACtC,IAAI,aAAa,SAAS,CAAC,KAC3B;AAEJ,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,MAAM,GAAG,WAAW;AAAA,QAC7C,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,iBAAa,eAAe,gBAAgB,OAAO,MAAM;AAEzD,UAAM,WAAW,MAAM,QAAc;AAAA,MACnC,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,cAAU,IAAI,UAAU,SAAS,IAAK;AACtC,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,sBAClB,QACA;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,OAAO,MAAM,iBAAiB,OAAO,OAAO,KAAK;AAAA,QAC1E,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,UAAU,OAAO,OAAO;AAAA,QACxB,SAAS,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,YAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,EAAE,OAAO,OAAO,OAAO,MAAM;AAAA,MACnC,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,WAAW,QAA8C;AAC3E,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,WAAW,OAAO,OAAO;AAAA,QACzB,UAAU,OAAO,OAAO;AAAA,MAC1B;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,qBAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,EAAE,QAAQ,OAAO,OAAO,OAAO;AAAA,MACrC,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,kBAAkB,QAAsC;AAC1E,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,EAAE,QAAQ,OAAO,OAAO,OAAO;AAAA,MACrC,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,WAAW,QAAsC;AACnE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAoB,UAAU,QAA2C;AACvE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAmB;AAAA,MACxC,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS,QAAQ,CAAC;AAAA,EAC3B;AAAA;AAAA,EAGA,aAAoB,YAAY,QAAsC;AACpE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,kBAClB,QAIe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,mBAClB,QAIe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,cAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC,kBAAkB,mBAAmB,OAAO,OAAO,KAAK,CAAC;AAAA,QACnH,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,2BAClB,QACA;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,OAAO,MAAM,iBAAiB,OAAO,OAAO,KAAK;AAAA,QAC1E,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,SAAS,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAoB,eAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,iBAAa,eAAe,gBAAgB,OAAO,OAAO,MAAM;AAEhE,QAAI,CAAC,OAAO,OAAO,aAAa,CAAC,OAAO,OAAO,cAAc;AAC3D,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAsD,CAAC;AAC7D,QAAI,OAAO,OAAO,WAAW;AAC3B,WAAK,YAAY,OAAO,OAAO;AAAA,IACjC;AACA,QAAI,OAAO,OAAO,cAAc;AAC9B,WAAK,eAAe,OAAO,OAAO;AAAA,IACpC;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB;AAAA,MACA,SAAS,OAAO;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAoB,iBAClB,QAC8B;AAC9B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAA6B;AAAA,MAClD,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAoB,oBAClB,QAC8B;AAC9B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,MAAM,CAAC;AAAA,QACnD,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAA6B;AAAA,MAClD,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,OAAe,eACb,gBACA,QACA;AACA,QAAI,CAAC,UAAU,CAAC,OAAO,SAAS,GAAG,GAAG;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,cACb,gBACA,OACA;AACA,QAAI,CAAC,SAAS,CAAC,YAAY,KAAK,KAAK,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,OAAe,oBACb,gBACA,OACA;AACA,QAAI,CAAC,SAAS,MAAM,KAAK,EAAE,WAAW,GAAG;AACvC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAIA,UAAM,eAAe,MAAM,KAAK;AAGhC,QAAI,aAAa;AACjB,eAAW,QAAQ,cAAc;AAC/B,UAAI,SAAS,IAAK;AAClB,UAAI,SAAS,IAAK;AAClB,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,OAAO,IAAI;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,eAAe,GAAG;AACpB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,QAAI,eAAe;AACnB,eAAW,QAAQ,cAAc;AAC/B,UAAI,SAAS,IAAK;AAClB,UAAI,SAAS,IAAK;AAClB,UAAI,eAAe,GAAG;AACpB,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,OAAO,IAAI;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,iBAAiB,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG;AACrD,QAAI,aAAa,MAAM,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAKA,UAAM,gBAAgB,UAAU,KAAK,YAAY;AACjD,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/services/console/console.admin.service.d.ts

@@ -86,6 +86,11 @@ export interface GetSpecExplainerRequest extends RequestBaseParams {
         clusterId: string;
     };
 }
+export interface GetClusterCrdStateRequest extends RequestBaseParams {
+    params: {
+        clusterId: string;
+    };
+}
 export interface GetAllClustersRequest extends RequestBaseParams {
     params: {
         headers: {
@@ -392,6 +397,12 @@ export declare class ConsoleAdminService {
     }>;
     static createLiteLLMSecretsForOrg(params: CreateLiteLLMSecretsForOrgRequest): Promise<void>;
     static getSpecExplainer(params: GetSpecExplainerRequest): Promise<SpecExplainerResponse>;
+    /**
+     * Raw Kubernetes CRD state for a cluster (Console Admin debugging). The
+     * payload is the opaque live CRD object, so it is returned as `unknown` and
+     * rendered verbatim by the caller.
+     */
+    static getCrdState(params: GetClusterCrdStateRequest): Promise<unknown>;
     static getOpenIncidents(params: RequestBaseParams): Promise<{
         incidents: OpenIncident[];
     }>;

package/dist/services/console/console.admin.service.js

@@ -1669,6 +1669,43 @@ class ConsoleAdminService {
     }
     return response.body;
   }
+  /**
+   * Raw Kubernetes CRD state for a cluster (Console Admin debugging). The
+   * payload is the opaque live CRD object, so it is returned as `unknown` and
+   * rendered verbatim by the caller.
+   */
+  static async getCrdState(params) {
+    const serviceContext = {
+      method: {
+        name: `ConsoleAdminService.getCrdState`,
+        url: `api/admin/clusters/${params.params.clusterId}/crd-state`,
+        normalizedUrl: `api/admin/clusters/:clusterId/crd-state`,
+        type: "get"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: {
+        name: "console",
+        type: "internal"
+      }
+    };
+    const response = await request({
+      ...params,
+      base: {
+        id: "console"
+      },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+    return response.body;
+  }
   static async getOpenIncidents(params) {
     const serviceContext = {
       method: {