@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/users/users.shared.schemas.js

@@ -8,6 +8,20 @@ import { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles
 import { UserPrivacySchema } from '../compliance/privacy/privacy.shared.schemas.js';
 import { OrganizationMemberSchema } from '../organizations/organization-members.shared.schemas.js';
 import { AvailableLanguage, TimezoneSchema, DateFormat, TimeFormat } from '@wildo-ai/presets-components-models';
+import { EnumEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';
+import { RedactionType } from '../compliance/privacy/redaction.shared.schemas.js';
+import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
+/**
+ * The address written over a user's `email` when the subject is erased and the row retained.
+ *
+ * `.invalid` is an RFC 2606 reserved TLD: it can never be registered and never resolves, so an
+ * erased address cannot be delivered to, cannot be confused with a live account, and cannot become
+ * a real identity if a stray code path ever re-mails it.
+ *
+ * Exported as ONE named source so the erasure orchestrator, tests and any operator query recognize
+ * an erased subject without duplicating the literal.
+ */
+export const ERASED_USER_EMAIL = 'erased@erased.invalid';
 export var UserStatus;
 (function (UserStatus) {
     UserStatus["ACTIVE"] = "ACTIVE";
@@ -25,30 +39,156 @@ export var UserTheme;
 })(UserTheme || (UserTheme = {}));
 export const UserSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
-    email: z.email().isDBIndexed().toLowerCase().isSummaryField().excludeFromUpdate(),
-    status: z.enum(UserStatus).default(UserStatus.ACTIVE).isDBIndexed().isSummaryField(),
-    appRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]).isDBIndexed(),
+    /**
+     * Email is the STRICT unique identity anchor — there is never more than one
+     * `User` per email. `.isUnique()` is the fail-closed DB backstop; every
+     * provisioning path (self-registration, org-admin invite, SSO JIT, SCIM,
+     * anonymous transposition) MUST find-or-create by this normalized value rather
+     * than blind-create, and recover from the duplicate-key `409` on the rare
+     * concurrent race (e.g. an invite and an SSO JIT landing at once). `.toLowerCase()`
+     * normalizes before both the lookup and the unique check so casing can't fork an
+     * identity. `.excludeFromUpdate()` keeps the anchor immutable.
+     *
+     * **It is also the ONLY personal datum on this row** (the rest is `_id`, status, roles, types and
+     * timestamps; names / bio / phone / avatar all live on `USER_PROFILES`). So it is what a subject
+     * erasure scrubs — `MASK` to {@link ERASED_USER_EMAIL}, which keeps the row resolvable as an
+     * anonymized subject for the retained billing records whose foreign keys point at it.
+     *
+     * `MASK` with an explicit value rather than `REMOVE`: `REMOVE` writes `null`, which this schema
+     * rejects, so it would force `.nullish()` here — widening the identity anchor to
+     * `string | null | undefined` for ~20+ consumers (auth registration, password reset, JWT guard,
+     * SCIM, SSO provisioning, org invites) AND making it optional at CREATE, to represent a state only
+     * the audited see-through reader can ever observe, since a retained row is hidden from every
+     * normal read. The default mask constant cannot be used either — it is not a valid email.
+     * Every erased user shares this one address; that cannot collide, because the unique index on a
+     * retention-governed resource covers only non-retained rows and the scrub flips the row to
+     * `RETAINED` in the same write.
+     */
+    email: addDataCategories(addImpersonalizeWith(z.email().isDBIndexed().isUnique().toLowerCase().isSummaryField().excludeFromUpdate(), RedactionType.MASK, { maskValue: ERASED_USER_EMAIL }), 
+    // Declared because the engine owes its OWN inventory. Without it, every generated application's
+    // privacy notice would name `users.email` as an outstanding category gap — the field carries a
+    // scrub treatment, which is the application saying it holds personal data, so the missing
+    // category would be a provable omission the framework left for each app to fix. CONTACT_DETAILS
+    // rather than IDENTITY: it is how the person is reached. That it also serves as the identity
+    // anchor is a property of this schema, not of the datum.
+    PersonalDataCategory.CONTACT_DETAILS),
+    // The three fields below carry `.isAuditEvidence()`: their VALUES are recorded before-and-after on
+    // the `resource_operation_performed` audit event. All three decide what the principal may do, and
+    // all three hold closed vocabulary rather than personal data — so recording them is both necessary
+    // as authorization evidence and free of personal data whose erasure obligations could reach the
+    // immutable ledger.
+    //
+    // Contrast `email` directly above, which is deliberately NOT marked: it is the identity anchor and
+    // is `.impersonalizeWith(MASK)`, i.e. a value the framework must be able to scrub on erasure.
+    // Copying it into an unscrubbable audit row would defeat that capability. That is the whole D4
+    // boundary in one file — mark what decides authority, never what identifies a person.
+    /**
+     * Account lifecycle and access posture.
+     *
+     * `.excludeFromUpdate()` since 2026-08-01. Lifecycle transitions belong to the dedicated verbs —
+     * `users | suspend_user` / `unsuspend_user` and `user_self | deactivate_account` /
+     * `reactivate_account` — which own the state machine, the reason, the audit event and the
+     * administrative-continuity floors. A generic field patch reproduces none of that, so accepting
+     * `status` on the ordinary UPDATE contract meant an administrator could retire an account through
+     * a door that asked none of those questions. Mirrors `OrganizationMemberSchema.status`, whose
+     * JSDoc has described the same rule for the same reason since before these verbs existed.
+     *
+     * ⚠️ The trusted server-side writers must therefore use `updateAsSystem`, which re-attaches the
+     * field past the repository's strict request-DTO re-parse — email verification
+     * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning. All four
+     * were migrated in the same change, and `USERS` opts into `systemAccessPolicy.update` for exactly
+     * them. A NEW trusted writer that reaches for `servicesRegistryHandler.update` here will be
+     * SILENTLY stripped — the account simply never changes state, with no error and no signal.
+     *
+     * assurance-control: WILDO.IDENTITY.LIFECYCLE — a change to whether a principal may authenticate
+     * runs through one guarded, evidenced authority.
+     */
+    status: z.enum(UserStatus).default(UserStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence().excludeFromUpdate(),
+    appRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]).isDBIndexed().isAuditEvidence(),
     /** User types from config (e.g. 'user', 'admin', 'consumer'). Determines auth policy, registration context. */
-    userTypes: z.array(z.string()).default([]).isDBIndexed(),
+    userTypes: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),
+    /**
+     * When an automated sweep must return this account to `ACTIVE`.
+     *
+     * Written only by `users | suspend_user`, whose contract takes `suspensionDuration` in DAYS. The
+     * transition hook resolves that duration to an absolute instant before persisting, because a
+     * duration is only meaningful relative to a moment the row does not otherwise record.
+     *
+     * Voluntary `user_self | deactivate_account` deliberately has no schedule: an INACTIVE account
+     * returns only when its subject calls `reactivate_account`. Absent therefore means an indefinite
+     * admin suspension or a non-scheduled lifecycle state.
+     *
+     * Server-owned (`.excludeFromCreate().excludeFromUpdate()`) so the transition verbs are the only
+     * writers, and indexed because the reactivation sweep queries exactly "rows whose scheduled
+     * reactivation has passed". Deliberately NOT `.isAuditEvidence()`: unlike the three fields above
+     * it does not decide what the principal may do — it is a scheduling detail, and the transition's
+     * own audit event already records the reason and the resulting status.
+     *
+     * ⚠️ For admin suspension, the value is a PROMISE the reactivation batch keeps. Persisting it without that sweep would
+     * be the same defect as a verb answering success while writing nothing: an authored intention
+     * that nothing honors.
+     */
+    scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
     createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()
 });
 export const UserLanguagePreferencesSchema = z.object({
     primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField(),
-    fallbackLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),
+    // Compact multi-select: render as a chips combobox (searchable popover) instead
+    // of a full inline checkbox column — `editMode: COMBOBOX` on the array item is the
+    // opt-in that `FormFieldArray` reads to render `ComboboxMultiple`. Fits a
+    // settings-row layout where the long language list would otherwise overflow.
+    fallbackLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).default([AvailableLanguage.EN]),
     autoDetect: z.boolean().default(true),
     useOrganizationDefault: z.boolean().default(false),
 });
 export const UserProfileSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
-    userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
-    firstName: z.string().min(1).max(50).isSummaryField(),
-    lastName: z.string().min(1).max(50).isSummaryField(),
-    displayName: z.string().max(100).optional().isSummaryField(),
-    avatar: z.url().optional(),
-    bio: z.string().max(500).optional(),
-    phoneNumber: z.string().regex(/^\+?[1-9]\d{1,14}$/).optional(),
-    title: z.string().max(100).optional()
+    // `.isUnique()`: one profile per user (1:1 composition). Backstops the eager
+    // `onParentCreate` seed + the provisioning paths against a concurrent
+    // double-create — the durable idempotency guarantee behind the declarative seed.
+    userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),
+    firstName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
+    lastName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
+    displayName: z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
+    /**
+     * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored
+     * as the standard file reference `{ fileId, updatedAt }` and rendered as a
+     * square avatar. Uses the plain `z_file()` image pipeline (upload / storage /
+     * DTO / persistence / metadata population) with no bespoke field type; the
+     * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there
+     * is no external-URL branch.
+     */
+    avatar: z_file({
+        nature: FileNature.IMAGE,
+        allowedMimeTypes: 'Images',
+        maxSize: 2 * 1024 * 1024,
+        imageConstraints: {
+            maxWidth: 1024,
+            maxHeight: 1024,
+            aspectRatio: { width: 1, height: 1 },
+            generateThumbnails: true,
+        },
+    }).optional().dataCategories(PersonalDataCategory.IDENTITY),
+    // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never
+    // what it will contain — a bio is a classic surface where a special category (a health condition,
+    // a religious observance, a political affiliation) arrives unannounced, and no schema certifies
+    // otherwise. Nothing here is a claim that it does NOT contain one.
+    bio: z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),
+    /**
+     * E.164 phone number (e.g. "+33123456789"). `z_phone()` carries the phone
+     * metadata that drives the international phone INPUT on edit (country selector +
+     * national number) and the formatted international DISPLAY on read — replacing
+     * the old raw `z.string().regex(...)` that surfaced the regex to the user.
+     * Stored value is still a plain E.164 string, so DTO/persistence are unchanged.
+     */
+    //
+    // `addDataCategories` rather than the fluent form: `z_phone()` returns a ZodPipe, which carries no
+    // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one). A phone
+    // number is contact-detail personal data by definition, so the escape hatch is load-bearing here
+    // rather than a curiosity.
+    phoneNumber: addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),
+    title: z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL)
 });
 export const UserPreferences_NotificationsSchema = z.object({
     email: z.boolean().default(true),
@@ -61,19 +201,75 @@ export const UserPreferences_UI_ThemeSchema = z.object({
 });
 export const UserPreferences_RegionalSchema = z.object({
     timezone: TimezoneSchema.default('UTC').isSummaryField(),
-    dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.ISO_8601),
+    // LOCALE_DEFAULT (not ISO_8601): "no expressed preference" must mean locale-driven
+    // rendering. A stored ISO_8601 default materializes at parse and masks the frontend's
+    // locale fallback (I18nContext), pinning every preference-less user to `YYYY-MM-DD`.
+    dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.LOCALE_DEFAULT),
     timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').default(TimeFormat.TWENTY_FOUR_HOUR),
     locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField()
 });
+/**
+ * The preference blocks a caller can address as a unit — the closed vocabulary behind
+ * `reset_to_defaults` on USER_SELF_PREFERENCES.
+ *
+ * **Every value IS the persisted field name on {@link UserPreferencesSchema}.** That is the
+ * point of the enum, not a coincidence: it lets the reset patch be DERIVED from the vocabulary
+ * instead of routed through a hand-written flag-to-field map. The previous contract was six
+ * booleans (`resetNotifications`, `resetUI`, …) that named no schema path, so the whole request
+ * was stripped before persistence and the route answered 200 having reset nothing.
+ *
+ * Adding a preference group to the schema means adding a member here; the mapped type in
+ * `user-preferences-reset.shared.utils.ts` then refuses to compile until the group declares how
+ * it resets. Renaming a group field without renaming the value fails the same way.
+ *
+ * Note `LANGUAGE = 'languagePreferences'` — the member reads as the concept, the value is the
+ * field. Do not "tidy" the value to `language`; it is an address, not a label.
+ */
+export var UserPreferenceGroup;
+(function (UserPreferenceGroup) {
+    UserPreferenceGroup["NOTIFICATIONS"] = "notifications";
+    UserPreferenceGroup["PRIVACY"] = "privacy";
+    UserPreferenceGroup["UI"] = "ui";
+    UserPreferenceGroup["REGIONAL"] = "regional";
+    UserPreferenceGroup["LANGUAGE"] = "languagePreferences";
+})(UserPreferenceGroup || (UserPreferenceGroup = {}));
 export const UserPreferencesSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
-    userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
-    notifications: UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({})),
-    privacy: UserPrivacySchema.default(UserPrivacySchema.parse({})),
+    // `.isUnique()` is the idempotency backstop for onParentCreate seeding: the eager
+    // seed (and any retry) is deduplicated at the DB layer — a second seed for the same
+    // user fails the unique constraint and is swallowed, guaranteeing exactly one
+    // preferences row per user. (Prod migration note: dedupe any pre-existing duplicate
+    // userId rows before this index builds; preferences was seeded nowhere pre-feature,
+    // so duplicates are unexpected.)
+    userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),
+    // ── Which preference blocks are data ABOUT the person, and which are rendering state ──
+    //
+    // Declared at the BLOCK, not on the leaves inside it. The resolver walks TOP-LEVEL fields only —
+    // the same limit the subject-export compiler and the impersonalize writer have — so a category on
+    // `regional.timezone` would be invisible. That is not a workaround: a notice enumerates KINDS, and
+    // "communication preferences" is the kind, not "the sms boolean".
+    //
+    // `ui` is deliberately NOT declared. A theme choice is about how the SYSTEM renders for someone,
+    // not a fact about them — the same line that keeps job executions, entitlement limits and unread
+    // counters out of the inventory. The three below are the other side of it: how the person wants to
+    // be CONTACTED, what they decided about their own privacy, and where and in what language they
+    // are — each a fact about them that a notice owes an answer on.
+    //
+    // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it
+    // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a
+    // reader nothing the word "preferences" does not.
+    notifications: UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))
+        .dataCategories(PersonalDataCategory.USAGE),
+    privacy: UserPrivacySchema.default(UserPrivacySchema.parse({}))
+        .dataCategories(PersonalDataCategory.USAGE),
     ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),
-    regional: UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField(),
+    // Timezone and locale are the two that most clearly identify something about the person rather
+    // than about the session — a timezone narrows where they are, which is why LOCATION rides here.
+    regional: UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()
+        .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),
     // Enhanced language preferences
     languagePreferences: UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()
+        .dataCategories(PersonalDataCategory.USAGE)
 });
 export const UserContextSchema = UserSchema.extend({
     // New relationship-based field names (matching auto-generated context)
@@ -81,4 +277,4 @@ export const UserContextSchema = UserSchema.extend({
     userSelfPreference: UserPreferencesSchema.optional(),
     organizationMembers: z.array(OrganizationMemberSchema).optional(),
 });
-//# sourceMappingURL=users.shared.schemas.js.map
+//# sourceMappingURL=users.shared.schemas.js.map

package/dist/esm/users/users.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAGhH,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,2DAA6C,CAAA;IAC7C,uDAAyC,CAAA;IACzC,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,0BAAa,CAAA;IACb,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACjF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACpF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE;IAClF,+GAA+G;IAC/G,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IACxD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;IACzH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACrH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC3F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IAC5D,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;CAClE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IACxD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACpF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAC5F,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;CACjH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC3F,aAAa,EAAE,mCAAmC,CAAC,OAAO,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAEzG,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE/D,EAAE,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAErG,QAAQ,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAE3G,gCAAgC;IAChC,mBAAmB,EAAE,6BAA6B,CAAC,OAAO,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;CACrH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC;IACjD,uEAAuE;IACvE,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC7C,kBAAkB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACpD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC"}
+{"version":3,"file":"users.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAChH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,2DAA6C,CAAA;IAC7C,uDAAyC,CAAA;IACzC,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,0BAAa,CAAA;IACb,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,EAAE,iBAAiB,CACtB,oBAAoB,CAClB,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,EACrF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,6FAA6F;IAC7F,yDAAyD;IACzD,oBAAoB,CAAC,eAAe,CACrC;IACD,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,oBAAoB;IACpB,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,+FAA+F;IAC/F,sFAAsF;IACtF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,iBAAiB,EAAE;IAC1H,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IACpG,+GAA+G;IAC/G,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC1E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;IACzH,gFAAgF;IAChF,mFAAmF;IACnF,0EAA0E;IAC1E,6EAA6E;IAC7E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC3K,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,sEAAsE;IACtE,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAClG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAC1G;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,UAAU,CAAC,KAAK;QACxB,gBAAgB,EAAE,QAAQ;QAC1B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QACxB,gBAAgB,EAAE;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;YACpC,kBAAkB,EAAE,IAAI;SACzB;KACF,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAC3D,+FAA+F;IAC/F,kGAAkG;IAClG,gGAAgG;IAChG,mEAAmE;IACnE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IACrF;;;;;;OAMG;IACH,EAAE;IACF,mGAAmG;IACnG,kGAAkG;IAClG,iGAAiG;IACjG,2BAA2B;IAC3B,WAAW,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,eAAe,CAAC;IAC1F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;CACxF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;CAClE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IACxD,mFAAmF;IACnF,sFAAsF;IACtF,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;IAC1F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAC5F,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;CACjH,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,0CAAmB,CAAA;IACnB,gCAAS,CAAA;IACT,4CAAqB,CAAA;IACrB,uDAAgC,CAAA;AAClC,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,oFAAoF;IACpF,oFAAoF;IACpF,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,yFAAyF;IACzF,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,kEAAkE;IAClE,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,gEAAgE;IAChE,EAAE;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,kDAAkD;IAClD,aAAa,EAAE,mCAAmC,CAAC,OAAO,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACtG,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAE7C,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SAC5D,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAE7C,EAAE,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAErG,+FAA+F;IAC/F,gGAAgG;IAChG,QAAQ,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SACxG,cAAc,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE9E,gCAAgC;IAChC,mBAAmB,EAAE,6BAA6B,CAAC,OAAO,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SACjH,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC;IACjD,uEAAuE;IACvE,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC7C,kBAAkB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACpD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * User Shared Schemas\n * \n * Shared user schemas for frontend and backend with MongoDB compatibility\n */\n\nimport { z } from 'zod';\n\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { UserPrivacySchema } from '../compliance/privacy/privacy.shared.schemas';\nimport { OrganizationMemberSchema } from '../organizations/organization-members.shared.schemas';\nimport { AvailableLanguage, TimezoneSchema, DateFormat, TimeFormat } from '@wildo-ai/presets-components-models';\nimport { EnumEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * The address written over a user's `email` when the subject is erased and the row retained.\n *\n * `.invalid` is an RFC 2606 reserved TLD: it can never be registered and never resolves, so an\n * erased address cannot be delivered to, cannot be confused with a live account, and cannot become\n * a real identity if a stray code path ever re-mails it.\n *\n * Exported as ONE named source so the erasure orchestrator, tests and any operator query recognize\n * an erased subject without duplicating the literal.\n */\nexport const ERASED_USER_EMAIL = 'erased@erased.invalid';\n\nexport enum UserStatus {\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED',\n  PENDING_VERIFICATION = 'PENDING_VERIFICATION',\n  PENDING_INVITATION = 'PENDING_INVITATION',\n  DELETED = 'DELETED'\n}\n\nexport enum UserTheme {\n  LIGHT = 'LIGHT',\n  DARK = 'DARK',\n  AUTO = 'AUTO'\n}\n\nexport const UserSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * Email is the STRICT unique identity anchor — there is never more than one\n   * `User` per email. `.isUnique()` is the fail-closed DB backstop; every\n   * provisioning path (self-registration, org-admin invite, SSO JIT, SCIM,\n   * anonymous transposition) MUST find-or-create by this normalized value rather\n   * than blind-create, and recover from the duplicate-key `409` on the rare\n   * concurrent race (e.g. an invite and an SSO JIT landing at once). `.toLowerCase()`\n   * normalizes before both the lookup and the unique check so casing can't fork an\n   * identity. `.excludeFromUpdate()` keeps the anchor immutable.\n   *\n   * **It is also the ONLY personal datum on this row** (the rest is `_id`, status, roles, types and\n   * timestamps; names / bio / phone / avatar all live on `USER_PROFILES`). So it is what a subject\n   * erasure scrubs — `MASK` to {@link ERASED_USER_EMAIL}, which keeps the row resolvable as an\n   * anonymized subject for the retained billing records whose foreign keys point at it.\n   *\n   * `MASK` with an explicit value rather than `REMOVE`: `REMOVE` writes `null`, which this schema\n   * rejects, so it would force `.nullish()` here — widening the identity anchor to\n   * `string | null | undefined` for ~20+ consumers (auth registration, password reset, JWT guard,\n   * SCIM, SSO provisioning, org invites) AND making it optional at CREATE, to represent a state only\n   * the audited see-through reader can ever observe, since a retained row is hidden from every\n   * normal read. The default mask constant cannot be used either — it is not a valid email.\n   * Every erased user shares this one address; that cannot collide, because the unique index on a\n   * retention-governed resource covers only non-retained rows and the scrub flips the row to\n   * `RETAINED` in the same write.\n   */\n  email: addDataCategories(\n    addImpersonalizeWith(\n      z.email().isDBIndexed().isUnique().toLowerCase().isSummaryField().excludeFromUpdate(),\n      RedactionType.MASK,\n      { maskValue: ERASED_USER_EMAIL },\n    ),\n    // Declared because the engine owes its OWN inventory. Without it, every generated application's\n    // privacy notice would name `users.email` as an outstanding category gap — the field carries a\n    // scrub treatment, which is the application saying it holds personal data, so the missing\n    // category would be a provable omission the framework left for each app to fix. CONTACT_DETAILS\n    // rather than IDENTITY: it is how the person is reached. That it also serves as the identity\n    // anchor is a property of this schema, not of the datum.\n    PersonalDataCategory.CONTACT_DETAILS,\n  ),\n  // The three fields below carry `.isAuditEvidence()`: their VALUES are recorded before-and-after on\n  // the `resource_operation_performed` audit event. All three decide what the principal may do, and\n  // all three hold closed vocabulary rather than personal data — so recording them is both necessary\n  // as authorization evidence and free of personal data whose erasure obligations could reach the\n  // immutable ledger.\n  //\n  // Contrast `email` directly above, which is deliberately NOT marked: it is the identity anchor and\n  // is `.impersonalizeWith(MASK)`, i.e. a value the framework must be able to scrub on erasure.\n  // Copying it into an unscrubbable audit row would defeat that capability. That is the whole D4\n  // boundary in one file — mark what decides authority, never what identifies a person.\n  /**\n   * Account lifecycle and access posture.\n   *\n   * `.excludeFromUpdate()` since 2026-08-01. Lifecycle transitions belong to the dedicated verbs —\n   * `users | suspend_user` / `unsuspend_user` and `user_self | deactivate_account` /\n   * `reactivate_account` — which own the state machine, the reason, the audit event and the\n   * administrative-continuity floors. A generic field patch reproduces none of that, so accepting\n   * `status` on the ordinary UPDATE contract meant an administrator could retire an account through\n   * a door that asked none of those questions. Mirrors `OrganizationMemberSchema.status`, whose\n   * JSDoc has described the same rule for the same reason since before these verbs existed.\n   *\n   * ⚠️ The trusted server-side writers must therefore use `updateAsSystem`, which re-attaches the\n   * field past the repository's strict request-DTO re-parse — email verification\n   * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning. All four\n   * were migrated in the same change, and `USERS` opts into `systemAccessPolicy.update` for exactly\n   * them. A NEW trusted writer that reaches for `servicesRegistryHandler.update` here will be\n   * SILENTLY stripped — the account simply never changes state, with no error and no signal.\n   *\n   * assurance-control: WILDO.IDENTITY.LIFECYCLE — a change to whether a principal may authenticate\n   * runs through one guarded, evidenced authority.\n   */\n  status: z.enum(UserStatus).default(UserStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence().excludeFromUpdate(),\n  appRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]).isDBIndexed().isAuditEvidence(),\n  /** User types from config (e.g. 'user', 'admin', 'consumer'). Determines auth policy, registration context. */\n  userTypes: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * When an automated sweep must return this account to `ACTIVE`.\n   *\n   * Written only by `users | suspend_user`, whose contract takes `suspensionDuration` in DAYS. The\n   * transition hook resolves that duration to an absolute instant before persisting, because a\n   * duration is only meaningful relative to a moment the row does not otherwise record.\n   *\n   * Voluntary `user_self | deactivate_account` deliberately has no schedule: an INACTIVE account\n   * returns only when its subject calls `reactivate_account`. Absent therefore means an indefinite\n   * admin suspension or a non-scheduled lifecycle state.\n   *\n   * Server-owned (`.excludeFromCreate().excludeFromUpdate()`) so the transition verbs are the only\n   * writers, and indexed because the reactivation sweep queries exactly \"rows whose scheduled\n   * reactivation has passed\". Deliberately NOT `.isAuditEvidence()`: unlike the three fields above\n   * it does not decide what the principal may do — it is a scheduling detail, and the transition's\n   * own audit event already records the reason and the resulting status.\n   *\n   * ⚠️ For admin suspension, the value is a PROMISE the reactivation batch keeps. Persisting it without that sweep would\n   * be the same defect as a verb answering success while writing nothing: an authored intention\n   * that nothing honors.\n   */\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type User = z.infer<typeof UserSchema>;\n\nexport const UserLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField(),\n  // Compact multi-select: render as a chips combobox (searchable popover) instead\n  // of a full inline checkbox column — `editMode: COMBOBOX` on the array item is the\n  // opt-in that `FormFieldArray` reads to render `ComboboxMultiple`. Fits a\n  // settings-row layout where the long language list would otherwise overflow.\n  fallbackLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).default([AvailableLanguage.EN]),\n  autoDetect: z.boolean().default(true),\n  useOrganizationDefault: z.boolean().default(false),\n});\nexport type UserLanguagePreferences = z.infer<typeof UserLanguagePreferencesSchema>;\n\nexport const UserProfileSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()`: one profile per user (1:1 composition). Backstops the eager\n  // `onParentCreate` seed + the provisioning paths against a concurrent\n  // double-create — the durable idempotency guarantee behind the declarative seed.\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  firstName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n  lastName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n  displayName: z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n  /**\n   * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored\n   * as the standard file reference `{ fileId, updatedAt }` and rendered as a\n   * square avatar. Uses the plain `z_file()` image pipeline (upload / storage /\n   * DTO / persistence / metadata population) with no bespoke field type; the\n   * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there\n   * is no external-URL branch.\n   */\n  avatar: z_file({\n    nature: FileNature.IMAGE,\n    allowedMimeTypes: 'Images',\n    maxSize: 2 * 1024 * 1024,\n    imageConstraints: {\n      maxWidth: 1024,\n      maxHeight: 1024,\n      aspectRatio: { width: 1, height: 1 },\n      generateThumbnails: true,\n    },\n  }).optional().dataCategories(PersonalDataCategory.IDENTITY),\n  // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never\n  // what it will contain — a bio is a classic surface where a special category (a health condition,\n  // a religious observance, a political affiliation) arrives unannounced, and no schema certifies\n  // otherwise. Nothing here is a claim that it does NOT contain one.\n  bio: z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),\n  /**\n   * E.164 phone number (e.g. \"+33123456789\"). `z_phone()` carries the phone\n   * metadata that drives the international phone INPUT on edit (country selector +\n   * national number) and the formatted international DISPLAY on read — replacing\n   * the old raw `z.string().regex(...)` that surfaced the regex to the user.\n   * Stored value is still a plain E.164 string, so DTO/persistence are unchanged.\n   */\n  //\n  // `addDataCategories` rather than the fluent form: `z_phone()` returns a ZodPipe, which carries no\n  // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one). A phone\n  // number is contact-detail personal data by definition, so the escape hatch is load-bearing here\n  // rather than a curiosity.\n  phoneNumber: addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),\n  title: z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL)\n});\nexport type UserProfile = z.infer<typeof UserProfileSchema>;\n\nexport const UserPreferences_NotificationsSchema = z.object({\n  email: z.boolean().default(true),\n  push: z.boolean().default(true),\n  sms: z.boolean().default(false),\n  inApp: z.boolean().default(true)\n});\nexport type UserPreferences_Notifications = z.infer<typeof UserPreferences_NotificationsSchema>;\n\nexport const UserPreferences_UI_ThemeSchema = z.object({\n  theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField(),\n});\nexport type UserPreferences_UI_Theme = z.infer<typeof UserPreferences_UI_ThemeSchema>;\n\nexport const UserPreferences_RegionalSchema = z.object({\n  timezone: TimezoneSchema.default('UTC').isSummaryField(),\n  // LOCALE_DEFAULT (not ISO_8601): \"no expressed preference\" must mean locale-driven\n  // rendering. A stored ISO_8601 default materializes at parse and masks the frontend's\n  // locale fallback (I18nContext), pinning every preference-less user to `YYYY-MM-DD`.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.LOCALE_DEFAULT),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').default(TimeFormat.TWENTY_FOUR_HOUR),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField()\n});\nexport type UserPreferences_Regional = z.infer<typeof UserPreferences_RegionalSchema>;\n\n/**\n * The preference blocks a caller can address as a unit — the closed vocabulary behind\n * `reset_to_defaults` on USER_SELF_PREFERENCES.\n *\n * **Every value IS the persisted field name on {@link UserPreferencesSchema}.** That is the\n * point of the enum, not a coincidence: it lets the reset patch be DERIVED from the vocabulary\n * instead of routed through a hand-written flag-to-field map. The previous contract was six\n * booleans (`resetNotifications`, `resetUI`, …) that named no schema path, so the whole request\n * was stripped before persistence and the route answered 200 having reset nothing.\n *\n * Adding a preference group to the schema means adding a member here; the mapped type in\n * `user-preferences-reset.shared.utils.ts` then refuses to compile until the group declares how\n * it resets. Renaming a group field without renaming the value fails the same way.\n *\n * Note `LANGUAGE = 'languagePreferences'` — the member reads as the concept, the value is the\n * field. Do not \"tidy\" the value to `language`; it is an address, not a label.\n */\nexport enum UserPreferenceGroup {\n  NOTIFICATIONS = 'notifications',\n  PRIVACY = 'privacy',\n  UI = 'ui',\n  REGIONAL = 'regional',\n  LANGUAGE = 'languagePreferences',\n}\n\nexport const UserPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` is the idempotency backstop for onParentCreate seeding: the eager\n  // seed (and any retry) is deduplicated at the DB layer — a second seed for the same\n  // user fails the unique constraint and is swallowed, guaranteeing exactly one\n  // preferences row per user. (Prod migration note: dedupe any pre-existing duplicate\n  // userId rows before this index builds; preferences was seeded nowhere pre-feature,\n  // so duplicates are unexpected.)\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // ── Which preference blocks are data ABOUT the person, and which are rendering state ──\n  //\n  // Declared at the BLOCK, not on the leaves inside it. The resolver walks TOP-LEVEL fields only —\n  // the same limit the subject-export compiler and the impersonalize writer have — so a category on\n  // `regional.timezone` would be invisible. That is not a workaround: a notice enumerates KINDS, and\n  // \"communication preferences\" is the kind, not \"the sms boolean\".\n  //\n  // `ui` is deliberately NOT declared. A theme choice is about how the SYSTEM renders for someone,\n  // not a fact about them — the same line that keeps job executions, entitlement limits and unread\n  // counters out of the inventory. The three below are the other side of it: how the person wants to\n  // be CONTACTED, what they decided about their own privacy, and where and in what language they\n  // are — each a fact about them that a notice owes an answer on.\n  //\n  // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it\n  // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a\n  // reader nothing the word \"preferences\" does not.\n  notifications: UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))\n    .dataCategories(PersonalDataCategory.USAGE),\n  \n  privacy: UserPrivacySchema.default(UserPrivacySchema.parse({}))\n    .dataCategories(PersonalDataCategory.USAGE),\n  \n  ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),\n  \n  // Timezone and locale are the two that most clearly identify something about the person rather\n  // than about the session — a timezone narrows where they are, which is why LOCATION rides here.\n  regional: UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()\n    .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),\n  \n  // Enhanced language preferences\n  languagePreferences: UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()\n    .dataCategories(PersonalDataCategory.USAGE)\n});\nexport type UserPreferences = z.infer<typeof UserPreferencesSchema>;\n\nexport const UserContextSchema = UserSchema.extend({\n  // New relationship-based field names (matching auto-generated context)\n  userSelfProfile: UserProfileSchema.optional(),\n  userSelfPreference: UserPreferencesSchema.optional(),\n  organizationMembers: z.array(OrganizationMemberSchema).optional(),\n});\nexport type UserContext = z.infer<typeof UserContextSchema>; \n"]}