@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/identity/testing/test-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-auth.service.js","sourceRoot":"","sources":["../../../src/identity/testing/test-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAsE;AACtE,yDAAsD;AACtD,0DAAqH;AACrH,wDAAwE;AACxE,qCAAyC;AACzC,2CAA+C;AAC/C,6CAAsD;AACtD,4CAAmD;AAKnD,oCAA4D;AAC5D,6FAAiF;AACjF,kFAA8E;AAC9E,sEAAkE;AAClE,+DAAoE;AACpE,8DAG+B;AAC/B,iEAAqF;AACrF,wDAAqE;AAmBrE;;;;GAIG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAIkB;IACzB;IACA;IAEA;IAEA;IAEA;IAEuB;IAEvB;IACY;IAhBd,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE3D,YAC4C,MAAsB,EAC/C,UAAsB,EACtB,aAA4B;IAC7C,mEAAmE;IAClD,cAA8B;IAC/C,iEAAiE;IAChD,aAAmC;IACpD,6DAA6D;IAC5C,OAAuB,EAEA,YAA0B,EAEjD,kBAAiD,2CAAwB,EAC7D,MAAsB;QAbT,WAAM,GAAN,MAAM,CAAgB;QAC/C,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAe;QAE5B,mBAAc,GAAd,cAAc,CAAgB;QAE9B,kBAAa,GAAb,aAAa,CAAsB;QAEnC,YAAO,GAAP,OAAO,CAAgB;QAEA,iBAAY,GAAZ,YAAY,CAAc;QAEjD,oBAAe,GAAf,eAAe,CAA0D;QAC7D,WAAM,GAAN,MAAM,CAAgB;IAClD,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CAAC,GAAiB;QACrC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,KAAK,eAAe,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAE7E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC;QACjE,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,KAAK,GAAG,IAAA,wBAAS,GAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,8EAA8E;YAC9E,MAAM,IAAA,gCAAiB,EAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC9C,MAAM,kBAAkB,GACtB,QAAQ,KAAK,0BAAK,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QAE5G,4DAA4D;QAC5D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACvD,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,CAAC,cAAc,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC;QAChD,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAC3C,KAAK,EAAE,EAAE,KAAK,EAAE;YAChB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,kBAAkB;YAClB,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3D,sEAAsE;YACtE,yEAAyE;YACzE,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,cAAc,CAAC;gBACjE,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE;gBAC1C,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACjD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;oBACnC,IAAI,EAAE;wBACJ,KAAK;wBACL,WAAW;wBACX,QAAQ,EAAE,IAAI;wBACd,+BAA+B;wBAC/B,YAAY,EAAE;4BACZ,MAAM,EAAE;gCACN,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;6BACxC;yBACF;qBACF;iBACF,CAAC,CAAC;gBACH,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CACvC,EAAE,EACF,UAAU,CAAC,EAAE,EACb,OAAO,CAAC,EAAE,EACV,cAAc,CAAC,EAAE,CAClB,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,cAAc,GAAG,IAAI,CAAC;YAEtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;YAC/C,IAAA,mCAAiB,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,iCAAe,CAAC,YAAY,EAAE;gBACxE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK;gBACL,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,IAAI;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QAEvB,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAClF,CAAC;QACD,IACE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,uBAAuB;YACjD,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAC/D,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4BAA4B,MAAM,6DAA6D,CAChG,CAAC;YACF,MAAM,IAAI,2CAAwB,CAChC,iBAAiB,EACjB,oGAAoG,CACrG,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1C,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC7B,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;gBAC3C,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAE3C,iCAAiC;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAoB;YACpE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,OAAO,EAAE,0CAAsB;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,wEAAwE;QACxE,kEAAkE;QAClE,mCAAmC;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2CAAwB,CAChC,iBAAiB,EACjB,oGAAoG,CACrG,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,MAAM,KAAK,GAAG,oCAAgB,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAEjF,MAAM,OAAO,GAAe;YAC1B,GAAG,EAAE,QAAQ,CAAC,EAAE;YAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,KAAK;YACL,GAAG,EAAE,KAAK;SACX,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAC7C,sBAAsB,EACtB,EAAE,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElD,uDAAuD;QACvD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,mCAAmC,QAAQ,CAAC,KAAK,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAErG,OAAO;YACL,WAAW;YACX,SAAS,EAAE,gBAAgB,GAAG,EAAE,EAAE,qBAAqB;YACvD,YAAY;YACZ,IAAI,EAAE;gBACJ,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,KAAK;aACN;SACF,CAAC;IACJ,CAAC;IAED,sDAAsD;IAC9C,mBAAmB,CAAC,KAAa;QACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC;QACpG,OAAO,iBAAiB,CAAC,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/E,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,KAAa;QAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAC3C,oBAAoB,EACpB,EAAE,CACH,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC;QAExD,wBAAwB;QACxB,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAExC,iCAAiC;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YACpC,IAAI,EAAE;gBACJ,MAAM;gBACN,SAAS;gBACT,SAAS;gBACT,KAAK;aACN;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;QAE/D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,KAAa;QAC7B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;CACF,CAAA;AA7PY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IAUvB,WAAA,IAAA,eAAM,EAAC,qBAAa,CAAC,CAAA;IACrB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,mCAAgB,CAAC,CAAA;IAEpC,WAAA,IAAA,iBAAQ,GAAE,CAAA;6CAZkB,gBAAU;QACP,sBAAa;QAEZ,wCAAc;QAEf,4CAAoB;QAE1B,gCAAc,kBAKF,6BAAa;GAjB1C,eAAe,CA6P3B"}

package/dist/identity/users/dto/update-user-roles.dto.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+/**
+ * `roleNames` keeps its pre-split vocabulary (`admin`, `contributor`,
+ * `viewer`). In single-org mode `admin` is the system administrator role (and
+ * makes the default-org membership `org_admin`); `contributor`/`viewer` set
+ * the membership role. In multi-org mode only system roles are accepted; an
+ * org role name is a 400 (organization roles are managed per organization).
+ */
+export declare const updateUserRolesSchema: z.ZodObject<{
+    roleNames: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+declare const UpdateUserRolesDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    roleNames: z.ZodArray<z.ZodString>;
+}, z.core.$strip>, false>;
+export declare class UpdateUserRolesDto extends UpdateUserRolesDto_base {
+}
+export {};
+//# sourceMappingURL=update-user-roles.dto.d.ts.map

package/dist/identity/users/dto/update-user-roles.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-user-roles.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/users/dto/update-user-roles.dto.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;iBAOhC,CAAC;;;;AAEH,qBAAa,kBAAmB,SAAQ,uBAAmC;CAAG"}

package/dist/identity/users/dto/update-user-roles.dto.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateUserRolesDto = exports.updateUserRolesSchema = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const zod_1 = require("zod");
+/**
+ * `roleNames` keeps its pre-split vocabulary (`admin`, `contributor`,
+ * `viewer`). In single-org mode `admin` is the system administrator role (and
+ * makes the default-org membership `org_admin`); `contributor`/`viewer` set
+ * the membership role. In multi-org mode only system roles are accepted; an
+ * org role name is a 400 (organization roles are managed per organization).
+ */
+exports.updateUserRolesSchema = zod_1.z.object({
+    roleNames: zod_1.z
+        .array(zod_1.z.string())
+        .min(1, 'At least one role is required')
+        .describe('Role names. Single-org mode: `admin` (system administrator, plus `org_admin` on the default organization), `contributor` or `viewer` (the membership role). Multi-org mode: system roles only.'),
+});
+class UpdateUserRolesDto extends (0, nestjs_zod_1.createZodDto)(exports.updateUserRolesSchema) {
+}
+exports.UpdateUserRolesDto = UpdateUserRolesDto;
+//# sourceMappingURL=update-user-roles.dto.js.map

package/dist/identity/users/dto/update-user-roles.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-user-roles.dto.js","sourceRoot":"","sources":["../../../../src/identity/users/dto/update-user-roles.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,6BAAwB;AAExB;;;;;;GAMG;AACU,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,OAAC;SACT,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC;SACvC,QAAQ,CACP,gMAAgM,CACjM;CACJ,CAAC,CAAC;AAEH,MAAa,kBAAmB,SAAQ,IAAA,yBAAY,EAAC,6BAAqB,CAAC;CAAG;AAA9E,gDAA8E"}

package/dist/identity/users/dto/update-user.dto.d.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+export declare const updateUserSchema: z.ZodObject<{
+    displayName: z.ZodOptional<z.ZodString>;
+    isActive: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+declare const UpdateUserDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    displayName: z.ZodOptional<z.ZodString>;
+    isActive: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, false>;
+export declare class UpdateUserDto extends UpdateUserDto_base {
+}
+export {};
+//# sourceMappingURL=update-user.dto.d.ts.map

package/dist/identity/users/dto/update-user.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-user.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/users/dto/update-user.dto.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;;;;;AAEH,qBAAa,aAAc,SAAQ,kBAA8B;CAAG"}

package/dist/identity/users/dto/update-user.dto.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateUserDto = exports.updateUserSchema = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const zod_1 = require("zod");
+exports.updateUserSchema = zod_1.z.object({
+    displayName: zod_1.z.string().max(100).optional(),
+    isActive: zod_1.z.boolean().optional(),
+});
+class UpdateUserDto extends (0, nestjs_zod_1.createZodDto)(exports.updateUserSchema) {
+}
+exports.UpdateUserDto = UpdateUserDto;
+//# sourceMappingURL=update-user.dto.js.map

package/dist/identity/users/dto/update-user.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-user.dto.js","sourceRoot":"","sources":["../../../../src/identity/users/dto/update-user.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,6BAAwB;AAEX,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAa,aAAc,SAAQ,IAAA,yBAAY,EAAC,wBAAgB,CAAC;CAAG;AAApE,sCAAoE"}

package/dist/identity/users/dto/user-list-query.dto.d.ts

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+export declare const userListQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodString>;
+    isActive: z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "true" | "false">>>;
+    sortBy: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        createdAt: "createdAt";
+        updatedAt: "updatedAt";
+    }>>;
+    sortOrder: z.ZodDefault<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}, z.core.$strip>;
+declare const UserListQueryDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodString>;
+    isActive: z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "true" | "false">>>;
+    sortBy: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        createdAt: "createdAt";
+        updatedAt: "updatedAt";
+    }>>;
+    sortOrder: z.ZodDefault<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}, z.core.$strip>, false>;
+export declare class UserListQueryDto extends UserListQueryDto_base {
+}
+export {};
+//# sourceMappingURL=user-list-query.dto.d.ts.map

package/dist/identity/users/dto/user-list-query.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-list-query.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/users/dto/user-list-query.dto.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;iBAQ9B,CAAC;;;;;;;;;;;;;;;;;;;;AAEH,qBAAa,gBAAiB,SAAQ,qBAAiC;CAAG"}

package/dist/identity/users/dto/user-list-query.dto.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserListQueryDto = exports.userListQuerySchema = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const zod_1 = require("zod");
+exports.userListQuerySchema = zod_1.z.object({
+    page: zod_1.z.coerce.number().int().min(1).default(1),
+    pageSize: zod_1.z.coerce.number().int().min(1).max(100).default(20),
+    search: zod_1.z.string().optional(),
+    role: zod_1.z.string().optional(),
+    isActive: zod_1.z.enum(['true', 'false']).transform((v) => v === 'true').optional(),
+    sortBy: zod_1.z.enum(['email', 'createdAt', 'updatedAt']).default('createdAt'),
+    sortOrder: zod_1.z.enum(['asc', 'desc']).default('desc'),
+});
+class UserListQueryDto extends (0, nestjs_zod_1.createZodDto)(exports.userListQuerySchema) {
+}
+exports.UserListQueryDto = UserListQueryDto;
+//# sourceMappingURL=user-list-query.dto.js.map

package/dist/identity/users/dto/user-list-query.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-list-query.dto.js","sourceRoot":"","sources":["../../../../src/identity/users/dto/user-list-query.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,6BAAwB;AAEX,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,QAAQ,EAAE;IAC7E,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACxE,SAAS,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,MAAa,gBAAiB,SAAQ,IAAA,yBAAY,EAAC,2BAAmB,CAAC;CAAG;AAA1E,4CAA0E"}

package/dist/identity/users/dto/user-response.dto.d.ts

@@ -0,0 +1,144 @@
+import { z } from 'zod';
+export declare const userResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
+    providerDisplayName: z.ZodNullable<z.ZodString>;
+    profileImageUrl: z.ZodNullable<z.ZodString>;
+    providerProfileImageUrl: z.ZodNullable<z.ZodString>;
+    isActive: z.ZodBoolean;
+    roles: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+}, z.core.$strip>;
+declare const UserResponseDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
+    providerDisplayName: z.ZodNullable<z.ZodString>;
+    profileImageUrl: z.ZodNullable<z.ZodString>;
+    providerProfileImageUrl: z.ZodNullable<z.ZodString>;
+    isActive: z.ZodBoolean;
+    roles: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+}, z.core.$strip>, false>;
+export declare class UserResponseDto extends UserResponseDto_base {
+}
+/**
+ * One row of `GET /api/users`: a {@link userResponseSchema} user plus, when the
+ * app registered user-list extensions (`registerUserListExtension`) and one
+ * contributed for this user, their `extensions`.
+ */
+export declare const userListItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
+    providerDisplayName: z.ZodNullable<z.ZodString>;
+    profileImageUrl: z.ZodNullable<z.ZodString>;
+    providerProfileImageUrl: z.ZodNullable<z.ZodString>;
+    isActive: z.ZodBoolean;
+    roles: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+    extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+}, z.core.$strip>;
+declare const UserListItemDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
+    providerDisplayName: z.ZodNullable<z.ZodString>;
+    profileImageUrl: z.ZodNullable<z.ZodString>;
+    providerProfileImageUrl: z.ZodNullable<z.ZodString>;
+    isActive: z.ZodBoolean;
+    roles: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+    extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+}, z.core.$strip>, false>;
+export declare class UserListItemDto extends UserListItemDto_base {
+}
+export declare const userListResponseSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        displayName: z.ZodNullable<z.ZodString>;
+        providerDisplayName: z.ZodNullable<z.ZodString>;
+        profileImageUrl: z.ZodNullable<z.ZodString>;
+        providerProfileImageUrl: z.ZodNullable<z.ZodString>;
+        isActive: z.ZodBoolean;
+        roles: z.ZodArray<z.ZodString>;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+        extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    }, z.core.$strip>>;
+    total: z.ZodNumber;
+    page: z.ZodNumber;
+    pageSize: z.ZodNumber;
+    totalPages: z.ZodNumber;
+}, z.core.$strip>;
+declare const UserListResponseDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        displayName: z.ZodNullable<z.ZodString>;
+        providerDisplayName: z.ZodNullable<z.ZodString>;
+        profileImageUrl: z.ZodNullable<z.ZodString>;
+        providerProfileImageUrl: z.ZodNullable<z.ZodString>;
+        isActive: z.ZodBoolean;
+        roles: z.ZodArray<z.ZodString>;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+        extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    }, z.core.$strip>>;
+    total: z.ZodNumber;
+    page: z.ZodNumber;
+    pageSize: z.ZodNumber;
+    totalPages: z.ZodNumber;
+}, z.core.$strip>, false>;
+export declare class UserListResponseDto extends UserListResponseDto_base {
+}
+/**
+ * `GET /api/users/{id}` returns everything in {@link userResponseSchema} plus
+ * the linked OAuth identities. It is the one user payload that differs, so it
+ * gets its own schema rather than being documented as a `UserResponseDto` that
+ * silently omits a field the endpoint actually sends.
+ */
+export declare const userDetailResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
+    providerDisplayName: z.ZodNullable<z.ZodString>;
+    profileImageUrl: z.ZodNullable<z.ZodString>;
+    providerProfileImageUrl: z.ZodNullable<z.ZodString>;
+    isActive: z.ZodBoolean;
+    roles: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+    identities: z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        providerEmail: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodISODateTime;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const UserDetailResponseDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
+    providerDisplayName: z.ZodNullable<z.ZodString>;
+    profileImageUrl: z.ZodNullable<z.ZodString>;
+    providerProfileImageUrl: z.ZodNullable<z.ZodString>;
+    isActive: z.ZodBoolean;
+    roles: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+    identities: z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        providerEmail: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodISODateTime;
+    }, z.core.$strip>>;
+}, z.core.$strip>, false>;
+export declare class UserDetailResponseDto extends UserDetailResponseDto_base {
+}
+export {};
+//# sourceMappingURL=user-response.dto.d.ts.map

package/dist/identity/users/dto/user-response.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-response.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/users/dto/user-response.dto.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAiB7B,CAAC;;;;;;;;;;;;;AAEH,qBAAa,eAAgB,SAAQ,oBAAgC;CAAG;AAExE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAM7B,CAAC;;;;;;;;;;;;;;AAEH,qBAAa,eAAgB,SAAQ,oBAAgC;CAAG;AAGxE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;iBAMjC,CAAC;;;;;;;;;;;;;;;;;;;;AAEH,qBAAa,mBAAoB,SAAQ,wBAAoC;CAAG;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;iBAQnC,CAAC;;;;;;;;;;;;;;;;;;AAEH,qBAAa,qBAAsB,SAAQ,0BAAsC;CAAG"}

package/dist/identity/users/dto/user-response.dto.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDetailResponseDto = exports.userDetailResponseSchema = exports.UserListResponseDto = exports.userListResponseSchema = exports.UserListItemDto = exports.userListItemSchema = exports.UserResponseDto = exports.userResponseSchema = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const identity_1 = require("@marinoscar/platform-contract/identity");
+const zod_1 = require("zod");
+exports.userResponseSchema = zod_1.z.object({
+    id: zod_1.z.string().uuid(),
+    email: zod_1.z.string().email(),
+    displayName: zod_1.z.string().nullable(),
+    providerDisplayName: zod_1.z.string().nullable(),
+    // Resolved from the user's `profile.imageSource` (#367): null, the provider
+    // URL, or a root-relative avatar path — hence not `.url()`.
+    profileImageUrl: zod_1.z.string().nullable(),
+    providerProfileImageUrl: zod_1.z.string().url().nullable(),
+    isActive: zod_1.z.boolean(),
+    roles: zod_1.z
+        .array(zod_1.z.string())
+        .describe('System roles (`admin`) plus the role on the current organization membership (`org_admin`, `contributor` or `viewer`)'),
+    createdAt: zod_1.z.iso.datetime(),
+    updatedAt: zod_1.z.iso.datetime(),
+});
+class UserResponseDto extends (0, nestjs_zod_1.createZodDto)(exports.userResponseSchema) {
+}
+exports.UserResponseDto = UserResponseDto;
+/**
+ * One row of `GET /api/users`: a {@link userResponseSchema} user plus, when the
+ * app registered user-list extensions (`registerUserListExtension`) and one
+ * contributed for this user, their `extensions`.
+ */
+exports.userListItemSchema = exports.userResponseSchema.extend({
+    extensions: identity_1.userExtensionsSchema
+        .optional()
+        .describe("What the app's user-list extensions added for this user (`registerUserListExtension`), keyed by extension id: small JSON objects, never secrets. Absent when none contributed."),
+});
+class UserListItemDto extends (0, nestjs_zod_1.createZodDto)(exports.userListItemSchema) {
+}
+exports.UserListItemDto = UserListItemDto;
+// List response with pagination
+exports.userListResponseSchema = zod_1.z.object({
+    items: zod_1.z.array(exports.userListItemSchema),
+    total: zod_1.z.number(),
+    page: zod_1.z.number(),
+    pageSize: zod_1.z.number(),
+    totalPages: zod_1.z.number(),
+});
+class UserListResponseDto extends (0, nestjs_zod_1.createZodDto)(exports.userListResponseSchema) {
+}
+exports.UserListResponseDto = UserListResponseDto;
+/**
+ * `GET /api/users/{id}` returns everything in {@link userResponseSchema} plus
+ * the linked OAuth identities. It is the one user payload that differs, so it
+ * gets its own schema rather than being documented as a `UserResponseDto` that
+ * silently omits a field the endpoint actually sends.
+ */
+exports.userDetailResponseSchema = exports.userResponseSchema.extend({
+    identities: zod_1.z.array(zod_1.z.object({
+        provider: zod_1.z.string(),
+        providerEmail: zod_1.z.string().nullable(),
+        createdAt: zod_1.z.iso.datetime(),
+    })),
+});
+class UserDetailResponseDto extends (0, nestjs_zod_1.createZodDto)(exports.userDetailResponseSchema) {
+}
+exports.UserDetailResponseDto = UserDetailResponseDto;
+//# sourceMappingURL=user-response.dto.js.map

package/dist/identity/users/dto/user-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-response.dto.js","sourceRoot":"","sources":["../../../../src/identity/users/dto/user-response.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,qEAA8E;AAC9E,6BAAwB;AAEX,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,4EAA4E;IAC5E,4DAA4D;IAC5D,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,uBAAuB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpD,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;IACrB,KAAK,EAAE,OAAC;SACL,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CACP,sHAAsH,CACvH;IACH,SAAS,EAAE,OAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,OAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAa,eAAgB,SAAQ,IAAA,yBAAY,EAAC,0BAAkB,CAAC;CAAG;AAAxE,0CAAwE;AAExE;;;;GAIG;AACU,QAAA,kBAAkB,GAAG,0BAAkB,CAAC,MAAM,CAAC;IAC1D,UAAU,EAAE,+BAAoB;SAC7B,QAAQ,EAAE;SACV,QAAQ,CACP,gLAAgL,CACjL;CACJ,CAAC,CAAC;AAEH,MAAa,eAAgB,SAAQ,IAAA,yBAAY,EAAC,0BAAkB,CAAC;CAAG;AAAxE,0CAAwE;AAExE,gCAAgC;AACnB,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,0BAAkB,CAAC;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;IACpB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH,MAAa,mBAAoB,SAAQ,IAAA,yBAAY,EAAC,8BAAsB,CAAC;CAAG;AAAhF,kDAAgF;AAEhF;;;;;GAKG;AACU,QAAA,wBAAwB,GAAG,0BAAkB,CAAC,MAAM,CAAC;IAChE,UAAU,EAAE,OAAC,CAAC,KAAK,CACjB,OAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;QACpB,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,SAAS,EAAE,OAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;KAC5B,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAa,qBAAsB,SAAQ,IAAA,yBAAY,EAAC,gCAAwB,CAAC;CAAG;AAApF,sDAAoF"}

package/dist/identity/users/users.controller.d.ts

@@ -0,0 +1,75 @@
+import { UsersService } from './users.service';
+import { UserListQueryDto } from './dto/user-list-query.dto';
+import type { RequestUser } from '../auth/interfaces/authenticated-user.interface';
+import { UpdateUserDto } from './dto/update-user.dto';
+import { UpdateUserRolesDto } from './dto/update-user-roles.dto';
+export declare class UsersController {
+    private readonly usersService;
+    constructor(usersService: UsersService);
+    listUsers(query: UserListQueryDto, viewer?: RequestUser): Promise<{
+        items: {
+            extensions?: Record<string, Record<string, unknown>> | undefined;
+            id: string;
+            email: string;
+            displayName: string | null;
+            providerDisplayName: string | null;
+            profileImageUrl: string | null;
+            providerProfileImageUrl: string | null;
+            isActive: boolean;
+            roles: string[];
+            createdAt: Date;
+            updatedAt: Date;
+        }[];
+        total: number;
+        page: number;
+        pageSize: number;
+        totalPages: number;
+    }>;
+    getUserById(id: string): Promise<{
+        id: string;
+        email: string;
+        displayName: string | null;
+        providerDisplayName: string | null;
+        profileImageUrl: string | null;
+        providerProfileImageUrl: string | null;
+        isActive: boolean;
+        roles: string[];
+        identities: {
+            provider: string;
+            providerEmail: string | null;
+            createdAt: Date;
+        }[];
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    updateUser(id: string, dto: UpdateUserDto, adminUserId: string): Promise<{
+        id: string;
+        email: string;
+        displayName: string | null;
+        providerDisplayName: string | null;
+        profileImageUrl: string | null;
+        providerProfileImageUrl: string | null;
+        isActive: boolean;
+        roles: string[];
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    updateUserRoles(id: string, dto: UpdateUserRolesDto, adminUserId: string): Promise<{
+        id: string;
+        email: string;
+        displayName: string | null;
+        providerDisplayName: string | null;
+        profileImageUrl: string | null;
+        providerProfileImageUrl: string | null;
+        isActive: boolean;
+        roles: string[];
+        identities: {
+            provider: string;
+            providerEmail: string | null;
+            createdAt: Date;
+        }[];
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+}
+//# sourceMappingURL=users.controller.d.ts.map

package/dist/identity/users/users.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.controller.d.ts","sourceRoot":"","sources":["../../../src/identity/users/users.controller.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAK/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,YAAY;IAmBjD,SAAS,CAAU,KAAK,EAAE,gBAAgB,EAAiB,MAAM,CAAC,EAAE,WAAW;;;;;;;;;;;;;;;;;;;IAe/E,WAAW,CAA6B,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;IAWlD,UAAU,CACc,EAAE,EAAE,MAAM,EAC9B,GAAG,EAAE,aAAa,EACP,WAAW,EAAE,MAAM;;;;;;;;;;;;IAiBlC,eAAe,CACS,EAAE,EAAE,MAAM,EAC9B,GAAG,EAAE,kBAAkB,EACZ,WAAW,EAAE,MAAM;;;;;;;;;;;;;;;;;CAIzC"}

package/dist/identity/users/users.controller.js

@@ -0,0 +1,124 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsersController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const users_service_1 = require("./users.service");
+const index_1 = require("../../core/index");
+const auth_decorator_1 = require("../auth/decorators/auth.decorator");
+const current_user_decorator_1 = require("../auth/decorators/current-user.decorator");
+const identity_constants_1 = require("../identity.constants");
+const user_list_query_dto_1 = require("./dto/user-list-query.dto");
+const user_response_dto_1 = require("./dto/user-response.dto");
+const update_user_dto_1 = require("./dto/update-user.dto");
+const update_user_roles_dto_1 = require("./dto/update-user-roles.dto");
+let UsersController = class UsersController {
+    usersService;
+    constructor(usersService) {
+        this.usersService = usersService;
+    }
+    async listUsers(query, viewer) {
+        // PP-14.25: the requester and their organization are what a user-list
+        // extension is told. Optional so a caller without a request user still works.
+        return this.usersService.listUsers(query, viewer ? { viewerId: viewer.id, orgId: viewer.activeOrgId ?? null } : undefined);
+    }
+    async getUserById(id) {
+        return this.usersService.getUserById(id);
+    }
+    async updateUser(id, dto, adminUserId) {
+        return this.usersService.updateUser(id, dto, adminUserId);
+    }
+    async updateUserRoles(id, dto, adminUserId) {
+        return this.usersService.updateUserRoles(id, dto, adminUserId);
+    }
+};
+exports.UsersController = UsersController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, auth_decorator_1.Auth)({ permissions: [identity_constants_1.PERMISSIONS.USERS_READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'List users (Admin only)' }),
+    (0, swagger_1.ApiQuery)({ name: 'page', required: false, type: Number }),
+    (0, swagger_1.ApiQuery)({ name: 'pageSize', required: false, type: Number }),
+    (0, swagger_1.ApiQuery)({ name: 'search', required: false, type: String }),
+    (0, swagger_1.ApiQuery)({ name: 'role', required: false, type: String })
+    // Not `type: Boolean`: the zod query schema accepts the literal strings
+    // 'true' and 'false' and rejects anything else, so a documented boolean would
+    // invite `isActive=1` and a 400.
+    ,
+    (0, swagger_1.ApiQuery)({ name: 'isActive', required: false, enum: ['true', 'false'] }),
+    (0, swagger_1.ApiQuery)({ name: 'sortBy', required: false, enum: ['email', 'createdAt', 'updatedAt'] }),
+    (0, swagger_1.ApiQuery)({ name: 'sortOrder', required: false, enum: ['asc', 'desc'] }),
+    (0, index_1.ApiDataResponse)(user_response_dto_1.UserListItemDto, {
+        pagination: 'flat',
+        description: 'Paginated user list',
+    }),
+    __param(0, (0, common_1.Query)()),
+    __param(1, (0, current_user_decorator_1.CurrentUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [user_list_query_dto_1.UserListQueryDto, Object]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "listUsers", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, auth_decorator_1.Auth)({ permissions: [identity_constants_1.PERMISSIONS.USERS_READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Get user by ID (Admin only)' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(user_response_dto_1.UserDetailResponseDto, { description: 'User details' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'User not found' }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "getUserById", null);
+__decorate([
+    (0, common_1.Patch)(':id'),
+    (0, auth_decorator_1.Auth)({ permissions: [identity_constants_1.PERMISSIONS.USERS_READ, identity_constants_1.PERMISSIONS.USERS_WRITE] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Update user (Admin only)' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(user_response_dto_1.UserResponseDto, { description: 'Updated user' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'User not found' }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: 'Cannot deactivate self' }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, current_user_decorator_1.CurrentUser)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, update_user_dto_1.UpdateUserDto, String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "updateUser", null);
+__decorate([
+    (0, common_1.Put)(':id/roles'),
+    (0, auth_decorator_1.Auth)({ permissions: [identity_constants_1.PERMISSIONS.RBAC_MANAGE] }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Update user roles (Admin only)',
+        description: 'Single-org mode: `admin` sets the system administrator role and `org_admin` on the default-organization membership; `contributor` or `viewer` set the membership role (the highest named wins). Multi-org mode: changes system roles only; an organization role name is refused with 400.',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'Updated user with new roles' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'User not found' }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Invalid role names, or (multi-org mode) an organization role name' }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: 'Cannot remove own admin role' }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, current_user_decorator_1.CurrentUser)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, update_user_roles_dto_1.UpdateUserRolesDto, String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "updateUserRoles", null);
+exports.UsersController = UsersController = __decorate([
+    (0, swagger_1.ApiTags)('Users'),
+    (0, common_1.Controller)('users'),
+    __metadata("design:paramtypes", [users_service_1.UsersService])
+], UsersController);
+//# sourceMappingURL=users.controller.js.map

package/dist/identity/users/users.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.controller.js","sourceRoot":"","sources":["../../../src/identity/users/users.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAMyB;AAEzB,mDAA+C;AAC/C,4CAAmD;AACnD,sEAAyD;AACzD,sFAAwE;AACxE,8DAAoD;AACpD,mEAA6D;AAC7D,+DAAkG;AAElG,2DAAsD;AACtD,uEAAiE;AAI1D,IAAM,eAAe,GAArB,MAAM,eAAe;IACG;IAA7B,YAA6B,YAA0B;QAA1B,iBAAY,GAAZ,YAAY,CAAc;IAAG,CAAC;IAmBrD,AAAN,KAAK,CAAC,SAAS,CAAU,KAAuB,EAAiB,MAAoB;QACnF,sEAAsE;QACtE,8EAA8E;QAC9E,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAChC,KAAK,EACL,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAChF,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,WAAW,CAA6B,EAAU;QACtD,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CACc,EAAU,EAC9B,GAAkB,EACP,WAAmB;QAEtC,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC;IAcK,AAAN,KAAK,CAAC,eAAe,CACS,EAAU,EAC9B,GAAuB,EACZ,WAAmB;QAEtC,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;CACF,CAAA;AAzEY,0CAAe;AAoBpB;IAjBL,IAAA,YAAG,GAAE;IACL,IAAA,qBAAI,EAAC,EAAE,WAAW,EAAE,CAAC,gCAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/C,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACpD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACzD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7D,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3D,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1D,wEAAwE;IACxE,8EAA8E;IAC9E,iCAAiC;;IAChC,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACxE,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;IACxF,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;IACvE,IAAA,uBAAe,EAAC,mCAAe,EAAE;QAChC,UAAU,EAAE,MAAM;QAClB,WAAW,EAAE,qBAAqB;KACnC,CAAC;IACe,WAAA,IAAA,cAAK,GAAE,CAAA;IAA2B,WAAA,IAAA,oCAAW,GAAE,CAAA;;qCAAhC,sCAAgB;;gDAO/C;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,qBAAI,EAAC,EAAE,WAAW,EAAE,CAAC,gCAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/C,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACxD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,yCAAqB,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IACvE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IACzC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDAE5C;AASK;IAPL,IAAA,cAAK,EAAC,KAAK,CAAC;IACZ,IAAA,qBAAI,EAAC,EAAE,WAAW,EAAE,CAAC,gCAAW,CAAC,UAAU,EAAE,gCAAW,CAAC,WAAW,CAAC,EAAE,CAAC;IACxE,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACrD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,mCAAe,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IACjE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC3D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IAEjE,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,oCAAW,EAAC,IAAI,CAAC,CAAA;;6CADL,+BAAa;;iDAI3B;AAcK;IAZL,IAAA,YAAG,EAAC,WAAW,CAAC;IAChB,IAAA,qBAAI,EAAC,EAAE,WAAW,EAAE,CAAC,gCAAW,CAAC,WAAW,CAAC,EAAE,CAAC;IAChD,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,2RAA2R;KAC9R,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IACxE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC3D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,mEAAmE,EAAE,CAAC;IAC9G,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAEvE,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,oCAAW,EAAC,IAAI,CAAC,CAAA;;6CADL,0CAAkB;;sDAIhC;0BAxEU,eAAe;IAF3B,IAAA,iBAAO,EAAC,OAAO,CAAC;IAChB,IAAA,mBAAU,EAAC,OAAO,CAAC;qCAEyB,4BAAY;GAD5C,eAAe,CAyE3B"}

package/dist/identity/users/users.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Users: `UsersController` (`/api/users`) and `UsersService`. Mounted by `IdentityModule.forRoot()`.
+ *
+ * @stability experimental
+ */
+export declare class UsersModule {
+}
+//# sourceMappingURL=users.module.d.ts.map

package/dist/identity/users/users.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.module.d.ts","sourceRoot":"","sources":["../../../src/identity/users/users.module.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,qBAWa,WAAW;CAAG"}