@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/dist/user/handlers/list.query.js

@@ -0,0 +1,95 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { access, defineEntityListHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+// kumiko-lint-ignore cross-feature-import SystemAdmin user-list joins memberships for tenants column
+import { tenantMembershipsTable, tenantTable } from "../../tenant/index.js";
+import { userEntity } from "../schema/user.js";
+const baseList = defineEntityListHandler("user", userEntity, {
+    access: { roles: access.systemAdmin },
+    description: "Lists identity records across every tenant for a SystemAdmin roster, each row carrying a derived `tenants` label naming the tenants the user belongs to and their roles there.",
+});
+async function loadMemberships(db, userIds) {
+    // Membership tables ship with the tenant feature; user:list is SystemAdmin
+    // roster code that always mounts both. Do not swallow missing-relation
+    // errors here — that hid real schema bugs behind a permanent "—" column.
+    return await selectMany(db, tenantMembershipsTable, {
+        userId: { in: [...userIds] },
+    });
+}
+function tenantLabelById(tenants) {
+    const map = new Map();
+    for (const t of tenants) {
+        const id = String(t.id ?? "");
+        if (id === "")
+            continue;
+        map.set(id, String(t.name ?? t.key ?? id));
+    }
+    return map;
+}
+/** "Offlot Demo (TenantAdmin)" — membership roles live here, not on user.roles. */
+function membershipLabel(tenantLabel, membershipRoles) {
+    if (membershipRoles.length === 0)
+        return tenantLabel;
+    return `${tenantLabel} (${membershipRoles.join("+")})`;
+}
+function labelsByUserId(memberships, labelByTenantId) {
+    const map = new Map();
+    for (const m of memberships) {
+        const userId = String(m.userId ?? "");
+        const tenantId = String(m.tenantId ?? "");
+        if (userId === "" || tenantId === "")
+            continue;
+        const tenantLabel = labelByTenantId.get(tenantId) ?? tenantId;
+        const label = membershipLabel(tenantLabel, parseRoles(m.roles ?? null));
+        const list = map.get(userId) ?? [];
+        list.push(label);
+        map.set(userId, list);
+    }
+    return map;
+}
+export async function attachTenantLabels(rows, db) {
+    if (rows.length === 0)
+        return [];
+    const userIds = rows.map((r) => String(r["id"] ?? "")).filter((id) => id !== "");
+    if (userIds.length === 0)
+        return [...rows];
+    const memberships = await loadMemberships(db, userIds);
+    const tenantIds = [
+        ...new Set(memberships.map((m) => String(m.tenantId ?? "")).filter((id) => id !== "")),
+    ];
+    const tenants = tenantIds.length > 0
+        ? await selectMany(db, tenantTable, { id: { in: tenantIds } })
+        : [];
+    const byUser = labelsByUserId(memberships, tenantLabelById(tenants));
+    return rows.map((row) => {
+        const labels = byUser.get(String(row["id"] ?? "")) ?? [];
+        const sorted = [...labels].sort((a, b) => a.localeCompare(b));
+        return { ...row, tenants: sorted.length > 0 ? sorted.join(", ") : "" };
+    });
+}
+export function dbForList(ctx) {
+    if (!ctx.systemDb) {
+        throw new Error("user:list requires r.systemScope() / ctx.systemDb");
+    }
+    return ctx.systemDb.acknowledgeCrossTenant("user identity list is cross-tenant; tenants column joins memberships");
+}
+// System-wide user listing is SystemAdmin-only. Tenant admins list their
+// members via the tenant feature (which scopes by membership, not globally).
+// Wraps the entity-convention list so each row carries a `tenants` label
+// (derived field) — without it the platform roster is unusable for ops.
+export const listQuery = {
+    ...baseList,
+    handler: async (query, ctx) => {
+        const baseHandler = baseList.handler;
+        if (baseHandler === undefined) {
+            throw new Error("user:list base handler missing");
+        }
+        const result = await baseHandler(query, ctx);
+        if (result === null || typeof result !== "object" || !("rows" in result)) {
+            return result;
+        }
+        const envelope = result;
+        const rows = await attachTenantLabels(envelope.rows, dbForList(ctx));
+        return { ...envelope, rows };
+    },
+};

package/dist/user/handlers/me.query.d.ts

@@ -0,0 +1,2 @@
+import * as z from "zod";
+export declare const meQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"user:me", z.ZodObject<{}, z.core.$strip>, Record<string, unknown> | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/user/handlers/me.query.js

@@ -0,0 +1,31 @@
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { userEntity, userTable } from "../schema/user.js";
+const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+// Returns the currently signed-in user's profile. Field-level read access
+// strips out the passwordHash automatically (configured on the entity).
+export const meQuery = defineQueryHandler({
+    name: "user:me",
+    schema: z.object({}),
+    access: {
+        openToAll: {
+            reason: "each signed-in user reads only their own identity record; the detail lookup " +
+                "is by the caller's own id",
+        },
+    },
+    rateLimit: {
+        disabled: true,
+        reason: "self-scoped read of the caller's own user record, hit on every page load; per-tenant " +
+            "bucket would throttle the whole tenant, L1 IP limit still applies",
+    },
+    description: "Returns the signed-in caller's own identity record, with the password hash stripped by field-level read access; use it whenever the current user's own profile data is needed.",
+    handler: async (query, ctx) => {
+        if (!ctx.systemDb) {
+            throw new InternalError({ message: "user:me requires r.systemScope()" });
+        }
+        const db = ctx.systemDb.acknowledgeCrossTenant("user rows are tenant-agnostic identity records; self-lookup by id needs no tenant filter");
+        return crud.detail({ id: query.user.id }, query.user, db); // @wrapper-known semantic-alias
+    },
+});

package/dist/user/handlers/update-roles.d.ts

@@ -0,0 +1,21 @@
+import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { type HandlerContext, type SessionUser, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+type RolesUpdateEvent = {
+    payload: {
+        id: string;
+        version: number;
+        changes: {
+            roles: string | string[];
+            displayName?: string;
+            locale?: string;
+            timezone?: string;
+            email?: string;
+            passwordHash?: string;
+            lastActiveTenantId?: string;
+            emailVerified?: boolean;
+        };
+    };
+    user: SessionUser;
+};
+export declare function applyUserRolesUpdate(event: RolesUpdateEvent, ctx: HandlerContext, db: TenantDb): Promise<WriteResult>;
+export {};

package/dist/user/handlers/update-roles.js

@@ -0,0 +1,114 @@
+import { asEntityTableMeta, asRawClient, fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { acquireNamespacedAdvisoryLock, createEventStoreExecutor, } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, findForbiddenRoleAssignment, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, ConflictError, InternalError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { UserErrors } from "../constants.js";
+import { USER_STATUS, userEntity, userTable } from "../schema/user.js";
+const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user";
+// Serializes last-SystemAdmin demotion checks globally inside the write TX
+// (dispatcher batch wraps handlers in transaction — xact lock holds through update).
+const LAST_SYSTEM_ADMIN_LOCK_NAMESPACE = 0x7361646d; // 'sadm'
+function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+function isActiveUserRow(row) {
+    if (row.isDeleted === true)
+        return false;
+    return row.status === USER_STATUS.Active || !row.status;
+}
+function isActiveSystemAdminRow(row) {
+    return isActiveUserRow(row) && parseRoles(row.roles).includes("SystemAdmin");
+}
+async function countOtherActiveSystemAdmins(db, excludeUserId) {
+    const tableName = asEntityTableMeta(userTable)?.tableName;
+    if (!tableName) {
+        throw new InternalError({ message: "user read table meta missing" });
+    }
+    // kumiko-lint-ignore raw-sql jsonb @> prefilter for SystemAdmin roster under advisory lock
+    const rows = (await asRawClient(db).unsafe(`SELECT id, roles, status, is_deleted AS "isDeleted"
+     FROM ${quoteIdent(tableName)}
+     WHERE is_deleted = false
+       AND (status = $1 OR status IS NULL)
+       AND roles @> $2::jsonb`, 
+    // Pass a JS array — JSON.stringify + $n::jsonb double-encodes to a jsonb string
+    // (postgres.js), so `@>` never matches a roles array.
+    [USER_STATUS.Active, ["SystemAdmin"]]));
+    return rows.filter((u) => u.id !== excludeUserId && isActiveSystemAdminRow(u)).length;
+}
+export async function applyUserRolesUpdate(event, ctx, db) {
+    const targetUser = await fetchOne(db, userTable, { id: event.payload.id });
+    if (!targetUser) {
+        return writeFailure(new NotFoundError("user", event.payload.id, {
+            i18nKey: "user.errors.notFound",
+            i18nParams: { id: event.payload.id },
+        }));
+    }
+    const newRoles = parseRoles(event.payload.changes.roles);
+    const targetCurrentRoles = parseRoles(targetUser.roles);
+    const actorRoles = event.user.roles;
+    const forbidden = findForbiddenRoleAssignment(actorRoles, newRoles, targetCurrentRoles);
+    if (forbidden !== undefined) {
+        return writeFailure(new AccessDeniedError({
+            message: `role "${forbidden}" cannot be assigned by this actor`,
+            i18nKey: "user.errors.roleElevationForbidden",
+            details: { reason: UserErrors.roleElevationForbidden, role: forbidden },
+        }));
+    }
+    const wasActiveSystemAdmin = isActiveUserRow(targetUser) && targetCurrentRoles.includes("SystemAdmin");
+    const willBeSystemAdmin = newRoles.includes("SystemAdmin");
+    if (wasActiveSystemAdmin && !willBeSystemAdmin) {
+        // user is r.systemScope() — the lock + count span every tenant's SystemAdmins,
+        // so both need the raw runner, not the tenant-shaped `db` above.
+        if (!ctx.systemDb) {
+            throw new InternalError({ message: "user:update-roles requires ctx.systemDb" });
+        }
+        const lockRunner = ctx.systemDb.unsafeRaw("advisory lock serializing concurrent last-SystemAdmin demotions");
+        // Lock before count+update so two concurrent demotions cannot both
+        // observe otherActiveSystemAdmins >= 1 and leave zero active SystemAdmins.
+        await acquireNamespacedAdvisoryLock(lockRunner, LAST_SYSTEM_ADMIN_LOCK_NAMESPACE, "global");
+        const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(ctx.systemDb.unsafeRaw("jsonb @> prefilter over the global users table to count remaining active SystemAdmins"), event.payload.id);
+        if (otherActiveSystemAdmins === 0) {
+            return writeFailure(new ConflictError({
+                message: "cannot demote the last active SystemAdmin",
+                i18nKey: "user.errors.cannotDemoteLastSystemAdmin",
+                details: {
+                    reason: UserErrors.cannotDemoteLastSystemAdmin,
+                    targetUserId: event.payload.id,
+                },
+            }));
+        }
+    }
+    const normalizedChanges = {
+        ...event.payload.changes,
+        // multiSelect column is jsonb string[] — do not JSON.stringify.
+        roles: newRoles,
+    };
+    // Persist roles first. Session revoke runs only after a successful update so a
+    // version conflict / permission error cannot leave sessions revoked while roles
+    // stay unchanged. Nested writeAs returns {isSuccess:false} instead of throwing —
+    // we must propagate that failure so the dispatcher TX rolls the role update
+    // back with the revoke (writeAs alone does not abort the outer handler).
+    const updateResult = await crud.update({ ...event.payload, changes: normalizedChanges }, event.user, db);
+    if (!updateResult.isSuccess) {
+        return updateResult;
+    }
+    const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
+    if (revoker) {
+        const revokeResult = await ctx.writeAs(createSystemUser(event.user.tenantId ?? SYSTEM_TENANT_ID), REVOKE_ALL_SESSIONS_QN, {
+            userId: event.payload.id,
+        });
+        if (!revokeResult.isSuccess)
+            return revokeResult;
+    }
+    else {
+        // skip: sessions feature not mounted — no live JWTs to revoke; role update
+        // still commits. Apps that mount user without sessions accept stale claims
+        // until JWT TTL.
+        ctx.log?.warn("user:update-roles: sessions revoke-all handler missing; role change commits without session invalidation", {
+            userId: event.payload.id,
+        });
+    }
+    return updateResult;
+}

package/dist/user/handlers/update.write.d.ts

@@ -0,0 +1,15 @@
+import * as z from "zod";
+export declare const updateWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"user:update", z.ZodObject<{
+    id: z.ZodUUID;
+    version: z.ZodNumber;
+    changes: z.ZodObject<{
+        displayName: z.ZodOptional<z.ZodString>;
+        locale: z.ZodOptional<z.ZodString>;
+        timezone: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodEmail>;
+        passwordHash: z.ZodOptional<z.ZodString>;
+        lastActiveTenantId: z.ZodOptional<z.ZodString>;
+        emailVerified: z.ZodOptional<z.ZodBoolean>;
+        roles: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>]>>;
+    }, z.core.$strip>;
+}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/user/handlers/update.write.js

@@ -0,0 +1,82 @@
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { access, defineWriteHandler, hasAccess } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
+import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
+import * as z from "zod";
+import { UserErrors } from "../constants.js";
+import { rolesInputSchema } from "../roles-input-schema.js";
+import { userEntity, userTable } from "../schema/user.js";
+import { applyUserRolesUpdate } from "./update-roles.js";
+const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+const SYSTEM_ADMIN_DEMOTION_COUNT_REASON = "on a SystemAdmin demotion, a jsonb @> prefilter over the global users table counts remaining active SystemAdmins";
+// Users can update their OWN profile; SystemAdmin/system can update anyone.
+// Handler-level access is openToAll — the row guard below is the actual gate,
+// and field-level access (passwordHash/email write-locked to "privileged")
+// stops any write that shouldn't touch an identity column.
+export const updateWrite = defineWriteHandler({
+    name: "user:update",
+    schema: z.object({
+        id: z.uuid(),
+        // Clients must send the version they read. The CrudExecutor rejects
+        // missing versions with version_conflict — see optimistic-locking in
+        // crud-executor.ts.
+        version: z.number(),
+        changes: z.object({
+            displayName: z.string().min(1).max(100).optional(),
+            locale: z.string().min(2).max(10).refine(isValidLocaleTag, "invalid locale tag").optional(),
+            timezone: z.string().max(64).refine(isValidIanaTimeZone, "invalid IANA time zone").optional(),
+            email: z.email().optional(),
+            passwordHash: z.string().optional(),
+            lastActiveTenantId: z.string().optional(),
+            emailVerified: z.boolean().optional(),
+            // Field-level write access is privileged (see userEntity.roles); handler
+            // also requires a privileged actor and runs the elevation guard.
+            roles: rolesInputSchema.optional(),
+        }),
+    }),
+    access: {
+        openToAll: {
+            reason: "Any signed-in user edits their own profile and privileged actors edit any user; " +
+                "the self-or-privileged check lives in the handler body, not in userEntity.access.write.",
+            personalData: "tenant-members",
+        },
+    },
+    description: "Changes a user's display name, locale, timezone, email, verification flag, last active tenant or global roles against the version the caller read; callers may edit themselves, while editing someone else or granting roles needs a privileged actor.",
+    escapeHatch: {
+        reason: SYSTEM_ADMIN_DEMOTION_COUNT_REASON,
+    },
+    handler: async (event, ctx) => {
+        const isSelf = event.payload.id === event.user.id;
+        const isPrivileged = hasAccess(event.user, { roles: access.privileged });
+        if (!isSelf && !isPrivileged) {
+            return writeFailure(new AccessDeniedError({
+                message: "cannot edit other user",
+                i18nKey: "user.errors.cannotEditOtherUser",
+                details: { reason: UserErrors.cannotEditOtherUser, targetUserId: event.payload.id },
+            }));
+        }
+        if (event.payload.changes.roles !== undefined && !isPrivileged) {
+            return writeFailure(new AccessDeniedError({
+                message: "cannot modify global roles",
+                i18nKey: "user.errors.cannotModifyGlobalRoles",
+                details: { reason: UserErrors.cannotModifyGlobalRoles },
+            }));
+        }
+        if (!ctx.systemDb) {
+            throw new InternalError({ message: "user:update requires r.systemScope()" });
+        }
+        const db = ctx.systemDb.acknowledgeCrossTenant("user rows are tenant-agnostic identity records; self/admin update needs no tenant filter");
+        const roles = event.payload.changes.roles;
+        if (roles !== undefined) {
+            return applyUserRolesUpdate({
+                ...event,
+                payload: {
+                    ...event.payload,
+                    changes: { ...event.payload.changes, roles },
+                },
+            }, ctx, db);
+        }
+        return crud.update(event.payload, event.user, db);
+    },
+});

package/dist/user/i18n.d.ts

@@ -0,0 +1,5 @@
+type LocalizedString = {
+    readonly en: string;
+};
+export declare const USER_I18N: Readonly<Record<string, LocalizedString>>;
+export {};

package/dist/user/i18n.js

@@ -0,0 +1,21 @@
+export const USER_I18N = {
+    "screen:user-list.title": { en: "Users" },
+    "screen:user-edit.title": { en: "Edit user" },
+    "user:entity:user:field:email": { en: "Email" },
+    "user:entity:user:field:displayName": { en: "Display name" },
+    "user:entity:user:field:roles": { en: "Platform roles" },
+    "user:entity:user:field:tenants": { en: "Tenants" },
+    "user:entity:user:field:roles:option:SystemAdmin": { en: "SystemAdmin" },
+    "user:entity:user:field:status": { en: "Status" },
+    "user:entity:user:field:emailVerified": { en: "Email verified" },
+    "user:entity:user:field:locale": { en: "Locale" },
+    "user:entity:user:field:timezone": { en: "Timezone" },
+    "user:entity:user:field:status:option:active": { en: "Active" },
+    "user:entity:user:field:status:option:restricted": { en: "Restricted" },
+    "user:entity:user:field:status:option:deletionRequested": {
+        en: "Deletion requested",
+    },
+    "user:entity:user:field:status:option:deleted": { en: "Deleted" },
+    "user:entity:user:field:emailVerified:option:true": { en: "Yes" },
+    "user:entity:user:field:emailVerified:option:false": { en: "No" },
+};

package/dist/user/index.d.ts

@@ -0,0 +1,7 @@
+export { UserCommandSchemas } from "./command-schemas.js";
+export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants.js";
+export { backfillUserStreamTenants, type UserStreamBackfillResult, } from "./db/queries/stream-tenant-backfill.js";
+export { createUserFeature } from "./feature.js";
+export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export type { UserStatus } from "./schema/user.js";
+export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.js";

package/dist/user/index.js

@@ -0,0 +1,6 @@
+export { UserCommandSchemas } from "./command-schemas.js";
+export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants.js";
+export { backfillUserStreamTenants, } from "./db/queries/stream-tenant-backfill.js";
+export { createUserFeature } from "./feature.js";
+export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.js";

package/dist/user/principal-status.d.ts

@@ -0,0 +1,4 @@
+import type { PrincipalStatusPlugin } from "@cosmicdrift/kumiko-framework/engine";
+import { type UserStatus } from "./schema/user.js";
+export declare function isPrincipalBlocked(status: UserStatus): boolean;
+export declare const principalStatusPlugin: PrincipalStatusPlugin;

package/dist/user/principal-status.js

@@ -0,0 +1,36 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { USER_STATUS, userTable } from "./schema/user.js";
+// Locked accounts whose live sessions must be refused. deletionRequested is
+// intentionally absent — it's a reversible grace period and the user needs their session to reach cancel-deletion.
+const BLOCKED_STATUSES = new Set([
+    USER_STATUS.Restricted,
+    USER_STATUS.Deleted,
+]);
+// Shared with personal-access-tokens' resolver and sessions' sessionChecker
+// — a PAT or a live session belonging to a locked-out principal is refused the same way.
+export function isPrincipalBlocked(status) {
+    return BLOCKED_STATUSES.has(status);
+}
+// Registered via r.useExtension(EXT_PRINCIPAL_STATUS, "user", principalStatusPlugin)
+// so resolveActiveMembershipFn can reject a blocked principal without knowing about `user`'s table.
+export const principalStatusPlugin = {
+    async resolveStatus(userId, { db }) {
+        const row = await fetchOne(db, userTable, { id: userId });
+        if (!row)
+            return "unknown";
+        return isPrincipalBlocked(row.status) ? "blocked" : "active";
+    },
+    // ctx.queryAsMember's global-roles/timezone/locale source — same fields
+    // login mints a session from (see login.write.ts gateBuildSession).
+    async resolveProfile(userId, { db }) {
+        const row = await fetchOne(db, userTable, { id: userId });
+        if (!row)
+            return null;
+        return {
+            globalRoles: parseRoles(row.roles),
+            ...(row.timezone ? { timezone: row.timezone } : {}),
+            ...(row.locale ? { locale: row.locale } : {}),
+        };
+    },
+};

package/dist/user/roles-input-schema.d.ts

@@ -0,0 +1,3 @@
+import * as z from "zod";
+/** Accept string[] or a JSON-encoded string[]; reject bare non-JSON strings. */
+export declare const rolesInputSchema: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>]>;

package/dist/user/roles-input-schema.js

@@ -0,0 +1,20 @@
+import * as z from "zod";
+/** Accept string[] or a JSON-encoded string[]; reject bare non-JSON strings. */
+export const rolesInputSchema = z.union([
+    z.array(z.string()),
+    // Legacy wire form: JSON-encoded string[]. Bare "SystemAdmin" used to
+    // parseRoles → [] and silently wipe/clear roles — reject that at the boundary.
+    z.string().transform((raw, ctx) => {
+        try {
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed) && parsed.every((v) => typeof v === "string")) {
+                return parsed;
+            }
+        }
+        catch {
+            /* fall through */
+        }
+        ctx.addIssue({ code: "custom", message: "roles must be a string[] or JSON string array" });
+        return z.NEVER;
+    }),
+]);