@tailor-platform/erp-kit 0.6.0 → 0.8.0

package/src/modules/user-management/command/updateOwnProfile.ts

@@ -0,0 +1,82 @@
+import { Transaction } from "../generated/kysely-tailordb";
+import {
+  InvalidEmailError,
+  InvalidNameError,
+  InvalidStatusTransitionError,
+  MissingRequiredFieldError,
+  UserAlreadyExistsError,
+  UserNotFoundError,
+} from "../lib/errors.generated";
+import { ok, err, type CommandContext } from "@tailor-platform/erp-kit/module";
+
+export type UpdateOwnProfileInput = {
+  name?: string;
+  email?: string;
+};
+
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+export async function run<CF extends Record<string, unknown>>(
+  db: Transaction,
+  input: UpdateOwnProfileInput & Omit<Partial<CF>, "status">,
+  ctx: CommandContext,
+) {
+  const { name, email, ...customFields } = input;
+
+  const user = await db
+    .selectFrom("User")
+    .selectAll()
+    .where("id", "=", ctx.actorId)
+    .forUpdate()
+    .executeTakeFirst();
+
+  if (!user) {
+    return err(new UserNotFoundError(ctx.actorId));
+  }
+
+  if (user.status !== "ACTIVE") {
+    return err(new InvalidStatusTransitionError(`${user.status} to UPDATE_OWN_PROFILE`));
+  }
+
+  if (name === undefined && email === undefined) {
+    return err(new MissingRequiredFieldError("name or email"));
+  }
+
+  if (name?.trim() === "") {
+    return err(new InvalidNameError(name));
+  }
+
+  if (email !== undefined) {
+    if (!EMAIL_PATTERN.test(email)) {
+      return err(new InvalidEmailError(email));
+    }
+
+    // Skip uniqueness check if email is unchanged
+    if (email !== user.email) {
+      const existingUser = await db
+        .selectFrom("User")
+        .selectAll()
+        .where("email", "=", email)
+        .forUpdate()
+        .executeTakeFirst();
+
+      if (existingUser) {
+        return err(new UserAlreadyExistsError(email));
+      }
+    }
+  }
+
+  const updatedUser = await db
+    .updateTable("User")
+    .set({
+      ...(customFields as Record<string, unknown>),
+      ...(name !== undefined ? { name } : {}),
+      ...(email !== undefined ? { email } : {}),
+      updatedAt: new Date(),
+    })
+    .where("id", "=", ctx.actorId)
+    .returningAll()
+    .executeTakeFirst();
+
+  return ok({ user: updatedUser! });
+}

package/src/modules/user-management/command/updateUser.generated.ts

@@ -0,0 +1,6 @@
+// @generated — do not edit
+import { permissions } from "../lib/permissions.generated";
+import { run } from "./updateUser";
+import { defineCommand } from "@tailor-platform/erp-kit/module";
+
+export const updateUser = defineCommand(permissions.updateUser, run);

package/src/modules/user-management/command/updateUser.test.ts

@@ -0,0 +1,195 @@
+import { describe, expect, it } from "vitest";
+import { createMockDb } from "../../../testing/index";
+import { Transaction } from "../generated/kysely-tailordb";
+import {
+  InvalidEmailError,
+  InvalidNameError,
+  MissingRequiredFieldError,
+  UserAlreadyExistsError,
+  UserNotFoundError,
+} from "../lib/errors.generated";
+import { activeUser, inactiveUser, pendingUser } from "../testing/fixtures";
+import { run } from "./updateUser";
+
+describe("updateUser", () => {
+  // Success cases
+  it("updates user name", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    const updatedUser = { ...activeUser, name: "New Name" };
+
+    spies.select.mockReturnValue(activeUser);
+    spies.update.mockReturnValue(updatedUser);
+
+    const result = await run(db, { id: activeUser.id, name: "New Name" });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.user.name).toBe("New Name");
+    }
+    expect(spies.update).toHaveBeenCalled();
+  });
+
+  it("updates user email", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    const updatedUser = { ...activeUser, email: "newemail@example.com" };
+
+    // First select: find the user being updated; second select: no conflicting email
+    spies.select.mockReturnValueOnce(activeUser);
+    spies.select.mockReturnValueOnce(undefined);
+    spies.update.mockReturnValue(updatedUser);
+
+    const result = await run(db, { id: activeUser.id, email: "newemail@example.com" });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.user.email).toBe("newemail@example.com");
+    }
+    expect(spies.update).toHaveBeenCalled();
+  });
+
+  it("updates both name and email", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    const updatedUser = { ...activeUser, name: "New Name", email: "newemail@example.com" };
+
+    // First select: find the user being updated; second select: no conflicting email
+    spies.select.mockReturnValueOnce(activeUser);
+    spies.select.mockReturnValueOnce(undefined);
+    spies.update.mockReturnValue(updatedUser);
+
+    const result = await run(db, {
+      id: activeUser.id,
+      name: "New Name",
+      email: "newemail@example.com",
+    });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.user.name).toBe("New Name");
+      expect(result.value.user.email).toBe("newemail@example.com");
+    }
+    expect(spies.update).toHaveBeenCalled();
+  });
+
+  it("updates user in PENDING status", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    const updatedUser = { ...pendingUser, name: "Updated Pending" };
+
+    spies.select.mockReturnValue(pendingUser);
+    spies.update.mockReturnValue(updatedUser);
+
+    const result = await run(db, { id: pendingUser.id, name: "Updated Pending" });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.user.name).toBe("Updated Pending");
+    }
+  });
+
+  it("updates user in ACTIVE status", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    const updatedUser = { ...activeUser, name: "Updated Active" };
+
+    spies.select.mockReturnValue(activeUser);
+    spies.update.mockReturnValue(updatedUser);
+
+    const result = await run(db, { id: activeUser.id, name: "Updated Active" });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.user.name).toBe("Updated Active");
+    }
+  });
+
+  it("updates user in INACTIVE status", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    const updatedUser = { ...inactiveUser, name: "Updated Inactive" };
+
+    spies.select.mockReturnValue(inactiveUser);
+    spies.update.mockReturnValue(updatedUser);
+
+    const result = await run(db, { id: inactiveUser.id, name: "Updated Inactive" });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.user.name).toBe("Updated Inactive");
+    }
+  });
+
+  it("succeeds when email is unchanged (same as current)", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    const updatedUser = { ...activeUser };
+
+    spies.select.mockReturnValue(activeUser);
+    spies.update.mockReturnValue(updatedUser);
+
+    // Email matches current — should skip uniqueness check
+    const result = await run(db, { id: activeUser.id, email: activeUser.email });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.user.email).toBe(activeUser.email);
+    }
+    expect(spies.update).toHaveBeenCalled();
+  });
+
+  // Error cases
+  it("returns error when user does not exist", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    spies.select.mockReturnValue(undefined);
+
+    const result = await run(db, { id: "nonexistent-user", name: "Test" });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(UserNotFoundError);
+    }
+  });
+
+  it("returns error when no fields are provided", async () => {
+    const { db } = createMockDb<Transaction>();
+
+    const result = await run(db, { id: "user-active-1" });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(MissingRequiredFieldError);
+    }
+  });
+
+  it("returns error when name is empty", async () => {
+    const { db } = createMockDb<Transaction>();
+
+    const result = await run(db, { id: "user-active-1", name: "" });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InvalidNameError);
+    }
+  });
+
+  it("returns error when name is whitespace only", async () => {
+    const { db } = createMockDb<Transaction>();
+
+    const result = await run(db, { id: "user-active-1", name: "   " });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InvalidNameError);
+    }
+  });
+
+  it("returns error when email format is invalid", async () => {
+    const { db } = createMockDb<Transaction>();
+
+    const result = await run(db, { id: "user-active-1", email: "invalidemail" });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InvalidEmailError);
+    }
+  });
+
+  it("returns error when email is already used by another user", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    const anotherUser = { ...activeUser, id: "other-user", email: "taken@example.com" };
+
+    // First select: find the user being updated
+    spies.select.mockReturnValueOnce(activeUser);
+    // Second select: find the conflicting user with the same email
+    spies.select.mockReturnValueOnce(anotherUser);
+
+    const result = await run(db, { id: activeUser.id, email: "taken@example.com" });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(UserAlreadyExistsError);
+    }
+  });
+});

package/src/modules/user-management/command/updateUser.ts

@@ -0,0 +1,76 @@
+import { Transaction } from "../generated/kysely-tailordb";
+import {
+  InvalidEmailError,
+  InvalidNameError,
+  MissingRequiredFieldError,
+  UserAlreadyExistsError,
+  UserNotFoundError,
+} from "../lib/errors.generated";
+import { ok, err } from "@tailor-platform/erp-kit/module";
+
+export type UpdateUserInput = { id: string } & { name?: string; email?: string };
+
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+/**
+ * Function: updateUser
+ *
+ * Updates an existing user's name or email.
+ * At least one field must be provided. Email must be unique.
+ */
+export async function run<CF extends Record<string, unknown>>(
+  db: Transaction,
+  input: UpdateUserInput & Omit<Partial<CF>, "status">,
+) {
+  const { id, name, email, ...customFields } = input;
+
+  if (name === undefined && email === undefined && Object.keys(customFields).length === 0) {
+    return err(new MissingRequiredFieldError("name or email"));
+  }
+
+  if (name?.trim() === "") {
+    return err(new InvalidNameError(name));
+  }
+
+  if (email !== undefined && !EMAIL_PATTERN.test(email)) {
+    return err(new InvalidEmailError(email));
+  }
+
+  const user = await db
+    .selectFrom("User")
+    .selectAll()
+    .where("id", "=", id)
+    .forUpdate()
+    .executeTakeFirst();
+
+  if (!user) {
+    return err(new UserNotFoundError(id));
+  }
+
+  if (email !== undefined && email !== user.email) {
+    const existingUser = await db
+      .selectFrom("User")
+      .selectAll()
+      .where("email", "=", email)
+      .forUpdate()
+      .executeTakeFirst();
+
+    if (existingUser) {
+      return err(new UserAlreadyExistsError(email));
+    }
+  }
+
+  const updatedUser = await db
+    .updateTable("User")
+    .set({
+      ...(customFields as Record<string, unknown>),
+      ...(name !== undefined ? { name } : {}),
+      ...(email !== undefined ? { email } : {}),
+      updatedAt: new Date(),
+    })
+    .where("id", "=", id)
+    .returningAll()
+    .executeTakeFirst();
+
+  return ok({ user: updatedUser! });
+}

package/src/modules/user-management/docs/commands/UpdateOwnProfile.md

@@ -0,0 +1,68 @@
+# UpdateOwnProfile
+
+## Overview
+
+UpdateOwnProfile allows an ACTIVE user to update their own profile fields (name, email). The command implicitly targets the calling user — no userId parameter is needed. This provides a self-service update path that is separate from the admin-only updateUser command.
+
+Only ACTIVE users can update their own profile. PENDING and INACTIVE users are rejected.
+
+## Business Rules
+
+- Caller must be an existing user (resolved from context)
+- Caller must be in ACTIVE status
+- At least one field (name or email) must be provided
+- Name, if provided, must be non-empty
+- Email, if provided, must follow valid email format
+- Email must be unique across all users (active and inactive); case-insensitive comparison
+- Generates USER_UPDATED audit event with actor ID, timestamp, and changed fields
+
+## Process Flow
+
+```mermaid
+flowchart TD
+    A[Receive update request] --> B{Caller user exists?}
+    B -->|No| C[Return error: USER_NOT_FOUND]
+    B -->|Yes| D{Caller status is ACTIVE?}
+    D -->|No| E[Return error: INVALID_STATUS_TRANSITION]
+    D -->|Yes| F{At least one field provided?}
+    F -->|No| G[Return error: MISSING_REQUIRED_FIELD]
+    F -->|Yes| H{Name provided and empty?}
+    H -->|Yes| I[Return error: INVALID_NAME]
+    H -->|No| J{Email provided?}
+    J -->|Yes| K{Valid email format?}
+    K -->|No| L[Return error: INVALID_EMAIL]
+    K -->|Yes| M{Email unique?}
+    M -->|No| N[Return error: USER_ALREADY_EXISTS]
+    M -->|Yes| O[Update user record]
+    J -->|No| O
+    O --> P[Log USER_UPDATED audit event]
+    P --> Q[Return updated user]
+```
+
+## External Dependencies
+
+- None
+
+## Error Scenarios
+
+- **USER_NOT_FOUND**: Caller's user ID does not exist in the system
+- **INVALID_STATUS_TRANSITION**: Caller is not in ACTIVE status (PENDING or INACTIVE)
+- **MISSING_REQUIRED_FIELD**: Neither name nor email was provided in the update input
+- **INVALID_NAME**: Name is empty or whitespace only
+- **INVALID_EMAIL**: Email does not follow valid email format
+- **USER_ALREADY_EXISTS**: Email address is already registered by another user
+
+## Test Cases
+
+- updates own name
+- updates own email
+- updates both own name and email
+- returns error when caller user does not exist
+- returns error when caller is in PENDING status
+- returns error when caller is in INACTIVE status
+- returns error when no fields are provided
+- returns error when name is empty
+- returns error when name is whitespace only
+- returns error when email format is invalid
+- returns error when email is already used by another user
+- succeeds when email is unchanged (same as current)

package/src/modules/user-management/docs/commands/UpdateUser.md

@@ -0,0 +1,67 @@
+# UpdateUser
+
+## Overview
+
+UpdateUser modifies the name or email of an existing user account. This command is intended for administrators who need to update any user's profile regardless of the user's current status (PENDING, ACTIVE, or INACTIVE). Email and name are optional in the update input, but at least one must be provided.
+
+This command supports profile corrections such as legal name changes and email address updates.
+
+## Business Rules
+
+- User must exist
+- At least one field (name or email) must be provided
+- Name, if provided, must be non-empty
+- Email, if provided, must follow valid email format
+- Email must be unique across all users (active and inactive); case-insensitive comparison
+- Updating is allowed on users in any status (PENDING, ACTIVE, INACTIVE)
+- Status is not part of the update input (use activateUser/deactivateUser/reactivateUser for status changes)
+- Generates USER_UPDATED audit event with actor ID, timestamp, and changed fields
+
+## Process Flow
+
+```mermaid
+flowchart TD
+    A[Receive update request] --> B{User exists?}
+    B -->|No| C[Return error: USER_NOT_FOUND]
+    B -->|Yes| D{At least one field provided?}
+    D -->|No| E[Return error: MISSING_REQUIRED_FIELD]
+    D -->|Yes| F{Name provided and empty?}
+    F -->|Yes| G[Return error: INVALID_NAME]
+    F -->|No| H{Email provided?}
+    H -->|Yes| I{Valid email format?}
+    I -->|No| J[Return error: INVALID_EMAIL]
+    I -->|Yes| K{Email unique?}
+    K -->|No| L[Return error: USER_ALREADY_EXISTS]
+    K -->|Yes| M[Update user record]
+    H -->|No| M
+    M --> N[Log USER_UPDATED audit event]
+    N --> O[Return updated user]
+```
+
+## External Dependencies
+
+- None
+
+## Error Scenarios
+
+- **USER_NOT_FOUND**: Specified user ID does not exist in the system
+- **MISSING_REQUIRED_FIELD**: Neither name nor email was provided in the update input
+- **INVALID_NAME**: Name is empty or whitespace only
+- **INVALID_EMAIL**: Email does not follow valid email format
+- **USER_ALREADY_EXISTS**: Email address is already registered by another user
+
+## Test Cases
+
+- updates user name
+- updates user email
+- updates both name and email
+- updates user in PENDING status
+- updates user in ACTIVE status
+- updates user in INACTIVE status
+- returns error when user does not exist
+- returns error when no fields are provided
+- returns error when name is empty
+- returns error when name is whitespace only
+- returns error when email format is invalid
+- returns error when email is already used by another user
+- succeeds when email is unchanged (same as current)

package/src/modules/user-management/docs/features/user-account-management.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-User Account Management handles the complete user lifecycle from creation through deactivation. Each user has a status that controls their access to the system: PENDING (awaiting activation), ACTIVE (full access), or INACTIVE (access revoked). Status transitions follow defined rules to ensure security and auditability.
+User Account Management handles the complete user lifecycle from creation through deactivation, including profile updates. Each user has a status that controls their access to the system: PENDING (awaiting activation), ACTIVE (full access), or INACTIVE (access revoked). Status transitions follow defined rules to ensure security and auditability. Profile fields (name, email) can be updated at any point in the lifecycle regardless of status.
 
 This feature provides the foundation for all identity-related operations in the ERP system.
 
@@ -12,8 +12,9 @@ Organizations need controlled user provisioning to ensure only authorized indivi
 
 - **Onboarding control**: New users start in PENDING status until verified
 - **Access management**: Only ACTIVE users can perform operations
+- **Profile maintenance**: User name and email can be corrected or updated throughout the account lifecycle
 - **Offboarding safety**: Deactivated users retain their data for audit purposes while losing access
-- **Compliance tracking**: Clear status transitions support regulatory requirements
+- **Compliance tracking**: Clear status transitions support regulatory requirements (GDPR right to rectification supported via profile updates)
 
 ## Process Flow
 
@@ -35,6 +36,16 @@ flowchart TD
     E -->|deactivateUser| H
     H -->|reactivateUser| E
     end
+
+    subgraph Profile Updates - Admin
+    B -->|updateUser| B
+    E -->|updateUser| E
+    H -->|updateUser| H
+    end
+
+    subgraph Profile Updates - Self
+    E -->|updateOwnProfile| E
+    end
 ```
 
 ## Scenario Patterns
@@ -42,7 +53,10 @@ flowchart TD
 - **New Employee Onboarding**: HR creates user account with name and email, user starts in PENDING status. After background check and IT setup complete, administrator activates the user.
 - **Employee Departure**: When employee resigns or is terminated, administrator deactivates user account. User data is preserved for audit and historical reporting, but all access is revoked.
 - **Contractor Return Engagement**: Previously offboarded contractor returns for new project. Administrator reactivates existing account rather than creating duplicate, preserving historical associations.
-- **Duplicate Prevention**: Attempt to create user with existing email address is rejected with clear error, preventing duplicate accounts.
+- **Profile Correction (Admin)**: Administrator updates a user's name after a legal name change via `updateUser`. The update applies immediately regardless of user status.
+- **Email Change (Admin)**: Administrator updates a user's email address via `updateUser`. The system validates format and uniqueness before applying the change.
+- **Self-Service Profile Update**: An ACTIVE user updates their own name or email via `updateOwnProfile`. The command implicitly targets the calling user — no userId parameter is needed. Only ACTIVE users can update their own profile.
+- **Duplicate Prevention**: Attempt to create or update a user with an email already used by another account is rejected with clear error, preventing duplicate accounts.
 - **Invalid Activation**: Attempt to activate already-active user or deactivate already-inactive user returns appropriate error with current status.
 
 ## Test Cases
@@ -55,6 +69,17 @@ flowchart TD
 - Deactivating a PENDING user should fail with INVALID_STATUS_TRANSITION error
 - Reactivating an INACTIVE user should transition status to ACTIVE
 - Reactivating a PENDING user should fail with INVALID_STATUS_TRANSITION error
+- updateUser: Updating a user's name should succeed for any user status (PENDING, ACTIVE, INACTIVE)
+- updateUser: Updating a user's email to a unique valid email should succeed
+- updateUser: Updating a user's email to an email already used by another user should fail with USER_ALREADY_EXISTS error
+- updateUser: Updating a user with an invalid email format should fail with validation error
+- updateUser: Updating a user's name to empty should fail with validation error
+- updateUser: Updating a non-existent user should fail with USER_NOT_FOUND error
+- updateOwnProfile: ACTIVE user updating own name should succeed
+- updateOwnProfile: ACTIVE user updating own email to a unique valid email should succeed
+- updateOwnProfile: ACTIVE user updating own email to an email already used by another user should fail with USER_ALREADY_EXISTS error
+- updateOwnProfile: PENDING user updating own profile should fail with INVALID_STATUS_TRANSITION error
+- updateOwnProfile: INACTIVE user updating own profile should fail with INVALID_STATUS_TRANSITION error
 - User email should be validated for proper format
 - User name should be required and non-empty
 

package/src/modules/user-management/docs/models/User.md

@@ -25,6 +25,8 @@ stateDiagram-v2
 ### Command Definitions
 
 - [createUser](../commands/CreateUser.md)
+- [updateUser](../commands/UpdateUser.md)
+- [updateOwnProfile](../commands/UpdateOwnProfile.md)
 - [activateUser](../commands/ActivateUser.md)
 - [deactivateUser](../commands/DeactivateUser.md)
 - [reactivateUser](../commands/ReactivateUser.md)

package/src/modules/user-management/lib/errors.generated.ts

@@ -60,3 +60,8 @@ export const AssignmentNotFoundError = createDomainError(
   "AssignmentNotFoundError", "USER_MANAGEMENT_ASSIGNMENT_NOT_FOUND",
   (identifier: string) => `Role does not have this permission assigned - return not found error indicating the association does not exist: ${identifier}`,
 );
+
+export const InvalidNameError = createDomainError(
+  "InvalidNameError", "USER_MANAGEMENT_INVALID_NAME",
+  (identifier: string) => `Name is empty or whitespace only: ${identifier}`,
+);

package/src/modules/user-management/lib/permissions.generated.ts

@@ -12,4 +12,6 @@ export const { permissions, own, all } = definePermissions("user-management", [
   "reactivateUser",
   "revokePermissionFromRole",
   "revokeRoleFromUser",
+  "updateOwnProfile",
+  "updateUser",
 ] as const);

package/src/modules/user-management/module.ts

@@ -9,6 +9,8 @@ import { assignPermissionToRole } from "./command/assignPermissionToRole.generat
 import { revokePermissionFromRole } from "./command/revokePermissionFromRole.generated";
 import { assignRoleToUser } from "./command/assignRoleToUser.generated";
 import { revokeRoleFromUser } from "./command/revokeRoleFromUser.generated";
+import { updateUser } from "./command/updateUser.generated";
+import { updateOwnProfile } from "./command/updateOwnProfile.generated";
 import { createPermissionType, CreatePermissionTypeParams } from "./db/permission";
 import { createRoleType, CreateRoleTypeParams } from "./db/role";
 import { createRolePermissionType, CreateRolePermissionTypeParams } from "./db/rolePermission";
@@ -33,6 +35,7 @@ export interface DefineModuleParams<
   rolePermission?: CreateRolePermissionTypeParams;
 }
 
+/* @__NO_SIDE_EFFECTS__ */
 export const defineModule = <
   const UF extends Record<string, TailorAnyDBField> = EmptyFields,
   const RF extends Record<string, TailorAnyDBField> = EmptyFields,
@@ -67,6 +70,8 @@ export const defineModule = <
       revokePermissionFromRole: revokePermissionFromRole(),
       assignRoleToUser: assignRoleToUser(),
       revokeRoleFromUser: revokeRoleFromUser(),
+      updateUser: updateUser<FieldsToInsertable<UF>>(),
+      updateOwnProfile: updateOwnProfile<FieldsToInsertable<UF>>(),
     },
   };
 };

package/src/modules/user-management/seed/index.ts

@@ -0,0 +1,19 @@
+// Export seed data maps here.
+// Use PascalCase names matching entity types — `erp-kit app generate seed`
+// discovers exports automatically and writes <ExportName>.jsonl files.
+//
+// Example:
+//
+//   import { uuidv5 } from "../../../shared/uuidv5";
+//   const NS = "erp-kit:<module-name>";
+//
+//   export const entityIds = {
+//     foo: uuidv5(NS, "entity:foo"),
+//   } as const;
+//
+//   const entities: Record<string, SeedRow> = {
+//     [entityIds.foo]: { name: "Foo", ... },
+//   };
+//
+//   // Re-export with PascalCase entity name
+//   export { entities as Entity };