@wildo-ai/saas-models 1.1.0 → 1.1.2

package/dist/esm/users/user-self-profiles.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-self-profiles.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-self-profiles.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAWhG;;EAEE;AACF,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIvK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;IACvD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;IAChG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,2CAA2C;IAEnE;;OAEG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEvE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,uCAAuC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,yCAAyC;oBAC3E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,yCAAyC;oBAC3E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Self Profiles Shared Resource Configuration\n *\n * Resource configuration for user self profile management operations.\n * Handles profile information that users can manage for themselves only.\n * Separated from USER_PROFILES for strict access control.\n */\n\nimport { UserProfileSchema } from './users.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// USER_SELF_PROFILES has NO custom operations — profile fields are edited through\n// the generic UPDATE form. The former granular update ops (avatar / contact info /\n// phone verify / personal info) were removed as redundant with UPDATE; phone-factor\n// MFA lives in the Security panel's enrollment flow, not on this resource.\ntype UserSelfProfilesCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE;\n\n/*\nUser Self Profiles Resource Configuration Factory\n*/\nexport const userSelfProfilesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  UserSelfProfilesCoreOperations,\n  typeof UserProfileSchema\n>({\n  mainSchema: UserProfileSchema,\n  resourceIdentifier: CoreResourceType.USER_SELF_PROFILES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_SELF_PROFILES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Self-scoped resource - same user context\n\n  /**\n   * Subject-export disclosure. Name, bio, avatar — supplied by the user.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject-export disclosure. Name, bio, avatar — supplied by the user.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // Only self can read their own profile\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // Only self can create their own profile\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // Only self can update their own profile\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n  },\n});\n"]}
+{"version":3,"file":"user-self-profiles.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-self-profiles.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAahG;;EAEE;AACF,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIvK;IACA,UAAU,EAAE,iBAAiB;IAC7B,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;IACvD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;IAChG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,2CAA2C;IAEnE;;OAEG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEvE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;OAEG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAGnE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,6FAA6F;QAC7F,oFAAoF;QACpF,0FAA0F;QAC1F,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,EAA2B;IAE5C,uBAAuB,EAAE;QACvB;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,0FAA0F;oBAC1F,4FAA4F;oBAC5F,yFAAyF;oBACzF,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,uCAAuC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,yCAAyC;oBAC3E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,yCAAyC;oBAC3E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Self Profiles Shared Resource Configuration\n *\n * Resource configuration for user self profile management operations.\n * Handles profile information that users can manage for themselves only.\n * Separated from USER_PROFILES for strict access control.\n */\n\nimport { UserProfileSchema } from './users.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// USER_SELF_PROFILES has NO custom operations — profile fields are edited through\n// the generic UPDATE form. The former granular update ops (avatar / contact info /\n// phone verify / personal info) were removed as redundant with UPDATE; phone-factor\n// MFA lives in the Security panel's enrollment flow, not on this resource.\ntype UserSelfProfilesCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.UPDATE_MANY;\n\n/*\nUser Self Profiles Resource Configuration Factory\n*/\nexport const userSelfProfilesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  Record<string, never>,\n  UserSelfProfilesCoreOperations,\n  typeof UserProfileSchema\n>({\n  mainSchema: UserProfileSchema,\n  resourceIdentifier: CoreResourceType.USER_SELF_PROFILES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_SELF_PROFILES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Self-scoped resource - same user context\n\n  /**\n   * Subject-export disclosure. Name, bio, avatar — supplied by the user.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject-export disclosure. Name, bio, avatar — supplied by the user.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the profile row rather than deleting it.\n   *\n   * `RETAIN_AND_IMPERSONALIZE` because this row holds personal data of its OWN — names, avatar, bio,\n   * phone, title — which the treatments on the shared `UserProfileSchema` mask or remove. The two\n   * required name fields MASK to `ERASED_USER_NAME` rather than REMOVE: they are `min(1)`, so nulling\n   * them would leave a row the schema rejects on the next read.\n   *\n   * RETAIN rather than delete, to match the identity row. `USERS` is retained so the financial records\n   * whose foreign keys point at it stay resolvable; a profile deleted out from under a retained user\n   * would leave that user's 1:1 composition dangling. Retaining and scrubbing keeps the collection's\n   * contract coherent and removes the personal data, which is what the obligation actually asks.\n   *\n   * ⚠️ `USER_SELF_PROFILES` declares the SAME policy on purpose — a second config over the SAME\n   * collection and the SAME `UserProfileSchema`. Both must inject the same marker and emit the same\n   * partial index, exactly as `USERS` / `USER_SELF` do. Change the two together.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject IS the person this profile describes, reached through its `userId` composition parent.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.CREATE,\n    // LIST + UPDATE_MANY exist for the retention capability ONLY, as INTERNAL_CALL variants that\n    // register no route. `retentionPolicy` requires UPDATE_MANY (the in-place scrub via\n    // `updateManyAsSystem`) plus READ + LIST (the audited see-through read of retained rows).\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: {} as Record<string, never>,\n\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing. Both are INTERNAL_CALL, *not* REPOSITORY_ONLY: the retention\n     * primitives resolve through `getServiceOperationPathDefault`, which matches INTERNAL_CALL /\n     * API_CALL / API_CALL_WITH_CALLBACK and deliberately excludes REPOSITORY_ONLY — so a\n     * REPOSITORY_ONLY variant satisfies the factory's boot-time \"operation exists\" guard and then\n     * FAILS TO RESOLVE when an erasure actually runs. `roles` is inert on a non-URL-bearing variant;\n     * the real gate is the derived `systemAccessPolicy` grant the trusted writer fails closed on.\n     */\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          // LOW, matching `USER_SELF`'s retention LIST. A read-shaped operation may not be declared\n          // HIGH/CRITICAL — the audit contract pairs that band with an emission obligation, and it is\n          // checked over the real engine catalogue. Declaring HIGH here failed both halves of that\n          // check at once: an unemitted HIGH, and a read at a write's risk band.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // Only self can read their own profile\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // Only self can create their own profile\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // Only self can update their own profile\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n  },\n});\n"]}

package/dist/esm/users/users.shared.schemas.d.ts

@@ -17,6 +17,25 @@ import { AvailableLanguage, DateFormat, TimeFormat } from '@wildo-ai/presets-com
  * an erased subject without duplicating the literal.
  */
 export declare const ERASED_USER_EMAIL = "erased@erased.invalid";
+/**
+ * What a REQUIRED name field becomes when the subject is erased.
+ *
+ * `firstName` and `lastName` are `min(1)`, so REMOVE is not available to them — nulling a required
+ * field would leave a row the schema itself rejects on the next read. MASK with a value that is
+ * obviously not a name keeps the row parseable while carrying no information about the person.
+ *
+ * Deliberately the same placeholder as `ERASED_FILE_NAME_PLACEHOLDER`: a reader meeting `[erased]`
+ * in an export or an admin view should not have to learn a second vocabulary to recognise it.
+ */
+export declare const ERASED_USER_NAME = "[erased]";
+/**
+ * What an erased EXTERNAL identifier becomes — a provider's own id for the person.
+ *
+ * Distinct from `ERASED_USER_NAME` despite the same literal, because the two answer different
+ * questions and will diverge: a name is displayed to a human, an external id is matched against a
+ * provider's records. Merging them would make a future change to either silently change the other.
+ */
+export declare const ERASED_IDENTITY_VALUE = "[erased]";
 export declare enum UserStatus {
     ACTIVE = "ACTIVE",
     INACTIVE = "INACTIVE",

package/dist/esm/users/users.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EAAE,iBAAiB,EAAkB,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAKhH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,OAAO,YAAY;CACpB;AAED,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,UAAU;;;;;;;;;iBAoGrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,6BAA6B;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA+C5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mCAAmC;;;;;iBAK9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,QAAQ,wBAAwB;CACjC;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyChC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"users.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EAAE,iBAAiB,EAAkB,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAKhH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,OAAO,YAAY;CACpB;AAED,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,UAAU;;;;;;;;;iBAoGrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,6BAA6B;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA0E5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mCAAmC;;;;;iBAK9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,QAAQ,wBAAwB;CACjC;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuDhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/users/users.shared.schemas.js

@@ -22,6 +22,25 @@ import { PersonalDataCategory } from '../compliance/privacy/personal-data-catego
  * an erased subject without duplicating the literal.
  */
 export const ERASED_USER_EMAIL = 'erased@erased.invalid';
+/**
+ * What a REQUIRED name field becomes when the subject is erased.
+ *
+ * `firstName` and `lastName` are `min(1)`, so REMOVE is not available to them — nulling a required
+ * field would leave a row the schema itself rejects on the next read. MASK with a value that is
+ * obviously not a name keeps the row parseable while carrying no information about the person.
+ *
+ * Deliberately the same placeholder as `ERASED_FILE_NAME_PLACEHOLDER`: a reader meeting `[erased]`
+ * in an export or an admin view should not have to learn a second vocabulary to recognise it.
+ */
+export const ERASED_USER_NAME = '[erased]';
+/**
+ * What an erased EXTERNAL identifier becomes — a provider's own id for the person.
+ *
+ * Distinct from `ERASED_USER_NAME` despite the same literal, because the two answer different
+ * questions and will diverge: a name is displayed to a human, an external id is matched against a
+ * provider's records. Merging them would make a future change to either silently change the other.
+ */
+export const ERASED_IDENTITY_VALUE = '[erased]';
 export var UserStatus;
 (function (UserStatus) {
     UserStatus["ACTIVE"] = "ACTIVE";
@@ -148,9 +167,9 @@ export const UserProfileSchema = z.object({
     // `onParentCreate` seed + the provisioning paths against a concurrent
     // double-create — the durable idempotency guarantee behind the declarative seed.
     userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),
-    firstName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
-    lastName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
-    displayName: z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
+    firstName: addImpersonalizeWith(z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.MASK, { maskValue: ERASED_USER_NAME }),
+    lastName: addImpersonalizeWith(z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.MASK, { maskValue: ERASED_USER_NAME }),
+    displayName: addImpersonalizeWith(z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),
     /**
      * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored
      * as the standard file reference `{ fileId, updatedAt }` and rendered as a
@@ -159,7 +178,11 @@ export const UserProfileSchema = z.object({
      * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there
      * is no external-URL branch.
      */
-    avatar: z_file({
+    // REMOVE nulls the stored `{ fileId, updatedAt }` reference, which is what erasure can honestly
+    // promise here: the profile stops pointing at the person's face. It does NOT delete the underlying
+    // stored object — file bytes are owned by the file resource and its own lifecycle, and claiming
+    // otherwise in a schema comment would be the kind of unverified assertion this lane exists to stop.
+    avatar: addImpersonalizeWith(z_file({
         nature: FileNature.IMAGE,
         allowedMimeTypes: 'Images',
         maxSize: 2 * 1024 * 1024,
@@ -169,12 +192,12 @@ export const UserProfileSchema = z.object({
             aspectRatio: { width: 1, height: 1 },
             generateThumbnails: true,
         },
-    }).optional().dataCategories(PersonalDataCategory.IDENTITY),
+    }).optional().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),
     // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never
     // what it will contain — a bio is a classic surface where a special category (a health condition,
     // a religious observance, a political affiliation) arrives unannounced, and no schema certifies
     // otherwise. Nothing here is a claim that it does NOT contain one.
-    bio: z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),
+    bio: addImpersonalizeWith(z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),
     /**
      * E.164 phone number (e.g. "+33123456789"). `z_phone()` carries the phone
      * metadata that drives the international phone INPUT on edit (country selector +
@@ -187,8 +210,8 @@ export const UserProfileSchema = z.object({
     // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one). A phone
     // number is contact-detail personal data by definition, so the escape hatch is load-bearing here
     // rather than a curiosity.
-    phoneNumber: addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),
-    title: z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL)
+    phoneNumber: addImpersonalizeWith(addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS), RedactionType.REMOVE),
+    title: addImpersonalizeWith(z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL), RedactionType.REMOVE)
 });
 export const UserPreferences_NotificationsSchema = z.object({
     email: z.boolean().default(true),
@@ -258,18 +281,20 @@ export const UserPreferencesSchema = z.object({
     // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it
     // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a
     // reader nothing the word "preferences" does not.
-    notifications: UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))
-        .dataCategories(PersonalDataCategory.USAGE),
-    privacy: UserPrivacySchema.default(UserPrivacySchema.parse({}))
-        .dataCategories(PersonalDataCategory.USAGE),
+    notifications: addImpersonalizeWith(UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))
+        .dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET),
+    privacy: addImpersonalizeWith(UserPrivacySchema.default(UserPrivacySchema.parse({}))
+        .dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET),
     ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),
     // Timezone and locale are the two that most clearly identify something about the person rather
     // than about the session — a timezone narrows where they are, which is why LOCATION rides here.
-    regional: UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()
-        .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),
+    // LOCATION as well as USAGE — a timezone and a locale narrow where a person is. RESET returns the
+    // application's own defaults, which is what a person who never chose still has.
+    regional: addImpersonalizeWith(UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()
+        .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]), RedactionType.RESET),
     // Enhanced language preferences
-    languagePreferences: UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()
-        .dataCategories(PersonalDataCategory.USAGE)
+    languagePreferences: addImpersonalizeWith(UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()
+        .dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET)
 });
 export const UserContextSchema = UserSchema.extend({
     // New relationship-based field names (matching auto-generated context)

package/dist/esm/users/users.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAChH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,2DAA6C,CAAA;IAC7C,uDAAyC,CAAA;IACzC,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,0BAAa,CAAA;IACb,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,EAAE,iBAAiB,CACtB,oBAAoB,CAClB,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,EACrF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,6FAA6F;IAC7F,yDAAyD;IACzD,oBAAoB,CAAC,eAAe,CACrC;IACD,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,oBAAoB;IACpB,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,+FAA+F;IAC/F,sFAAsF;IACtF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,iBAAiB,EAAE;IAC1H,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IACpG,+GAA+G;IAC/G,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC1E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;IACzH,gFAAgF;IAChF,mFAAmF;IACnF,0EAA0E;IAC1E,6EAA6E;IAC7E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC3K,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,sEAAsE;IACtE,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IACnG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAClG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAC1G;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,UAAU,CAAC,KAAK;QACxB,gBAAgB,EAAE,QAAQ;QAC1B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QACxB,gBAAgB,EAAE;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;YACpC,kBAAkB,EAAE,IAAI;SACzB;KACF,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAC3D,+FAA+F;IAC/F,kGAAkG;IAClG,gGAAgG;IAChG,mEAAmE;IACnE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IACrF;;;;;;OAMG;IACH,EAAE;IACF,mGAAmG;IACnG,kGAAkG;IAClG,iGAAiG;IACjG,2BAA2B;IAC3B,WAAW,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,eAAe,CAAC;IAC1F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;CACxF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;CAClE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IACxD,mFAAmF;IACnF,sFAAsF;IACtF,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;IAC1F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAC5F,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;CACjH,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,0CAAmB,CAAA;IACnB,gCAAS,CAAA;IACT,4CAAqB,CAAA;IACrB,uDAAgC,CAAA;AAClC,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,oFAAoF;IACpF,oFAAoF;IACpF,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,yFAAyF;IACzF,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,kEAAkE;IAClE,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,gEAAgE;IAChE,EAAE;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,kDAAkD;IAClD,aAAa,EAAE,mCAAmC,CAAC,OAAO,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACtG,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAE7C,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SAC5D,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAE7C,EAAE,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAErG,+FAA+F;IAC/F,gGAAgG;IAChG,QAAQ,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SACxG,cAAc,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE9E,gCAAgC;IAChC,mBAAmB,EAAE,6BAA6B,CAAC,OAAO,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SACjH,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC;IACjD,uEAAuE;IACvE,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC7C,kBAAkB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACpD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * User Shared Schemas\n * \n * Shared user schemas for frontend and backend with MongoDB compatibility\n */\n\nimport { z } from 'zod';\n\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { UserPrivacySchema } from '../compliance/privacy/privacy.shared.schemas';\nimport { OrganizationMemberSchema } from '../organizations/organization-members.shared.schemas';\nimport { AvailableLanguage, TimezoneSchema, DateFormat, TimeFormat } from '@wildo-ai/presets-components-models';\nimport { EnumEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * The address written over a user's `email` when the subject is erased and the row retained.\n *\n * `.invalid` is an RFC 2606 reserved TLD: it can never be registered and never resolves, so an\n * erased address cannot be delivered to, cannot be confused with a live account, and cannot become\n * a real identity if a stray code path ever re-mails it.\n *\n * Exported as ONE named source so the erasure orchestrator, tests and any operator query recognize\n * an erased subject without duplicating the literal.\n */\nexport const ERASED_USER_EMAIL = 'erased@erased.invalid';\n\nexport enum UserStatus {\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED',\n  PENDING_VERIFICATION = 'PENDING_VERIFICATION',\n  PENDING_INVITATION = 'PENDING_INVITATION',\n  DELETED = 'DELETED'\n}\n\nexport enum UserTheme {\n  LIGHT = 'LIGHT',\n  DARK = 'DARK',\n  AUTO = 'AUTO'\n}\n\nexport const UserSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * Email is the STRICT unique identity anchor — there is never more than one\n   * `User` per email. `.isUnique()` is the fail-closed DB backstop; every\n   * provisioning path (self-registration, org-admin invite, SSO JIT, SCIM,\n   * anonymous transposition) MUST find-or-create by this normalized value rather\n   * than blind-create, and recover from the duplicate-key `409` on the rare\n   * concurrent race (e.g. an invite and an SSO JIT landing at once). `.toLowerCase()`\n   * normalizes before both the lookup and the unique check so casing can't fork an\n   * identity. `.excludeFromUpdate()` keeps the anchor immutable.\n   *\n   * **It is also the ONLY personal datum on this row** (the rest is `_id`, status, roles, types and\n   * timestamps; names / bio / phone / avatar all live on `USER_PROFILES`). So it is what a subject\n   * erasure scrubs — `MASK` to {@link ERASED_USER_EMAIL}, which keeps the row resolvable as an\n   * anonymized subject for the retained billing records whose foreign keys point at it.\n   *\n   * `MASK` with an explicit value rather than `REMOVE`: `REMOVE` writes `null`, which this schema\n   * rejects, so it would force `.nullish()` here — widening the identity anchor to\n   * `string | null | undefined` for ~20+ consumers (auth registration, password reset, JWT guard,\n   * SCIM, SSO provisioning, org invites) AND making it optional at CREATE, to represent a state only\n   * the audited see-through reader can ever observe, since a retained row is hidden from every\n   * normal read. The default mask constant cannot be used either — it is not a valid email.\n   * Every erased user shares this one address; that cannot collide, because the unique index on a\n   * retention-governed resource covers only non-retained rows and the scrub flips the row to\n   * `RETAINED` in the same write.\n   */\n  email: addDataCategories(\n    addImpersonalizeWith(\n      z.email().isDBIndexed().isUnique().toLowerCase().isSummaryField().excludeFromUpdate(),\n      RedactionType.MASK,\n      { maskValue: ERASED_USER_EMAIL },\n    ),\n    // Declared because the engine owes its OWN inventory. Without it, every generated application's\n    // privacy notice would name `users.email` as an outstanding category gap — the field carries a\n    // scrub treatment, which is the application saying it holds personal data, so the missing\n    // category would be a provable omission the framework left for each app to fix. CONTACT_DETAILS\n    // rather than IDENTITY: it is how the person is reached. That it also serves as the identity\n    // anchor is a property of this schema, not of the datum.\n    PersonalDataCategory.CONTACT_DETAILS,\n  ),\n  // The three fields below carry `.isAuditEvidence()`: their VALUES are recorded before-and-after on\n  // the `resource_operation_performed` audit event. All three decide what the principal may do, and\n  // all three hold closed vocabulary rather than personal data — so recording them is both necessary\n  // as authorization evidence and free of personal data whose erasure obligations could reach the\n  // immutable ledger.\n  //\n  // Contrast `email` directly above, which is deliberately NOT marked: it is the identity anchor and\n  // is `.impersonalizeWith(MASK)`, i.e. a value the framework must be able to scrub on erasure.\n  // Copying it into an unscrubbable audit row would defeat that capability. That is the whole D4\n  // boundary in one file — mark what decides authority, never what identifies a person.\n  /**\n   * Account lifecycle and access posture.\n   *\n   * `.excludeFromUpdate()` since 2026-08-01. Lifecycle transitions belong to the dedicated verbs —\n   * `users | suspend_user` / `unsuspend_user` and `user_self | deactivate_account` /\n   * `reactivate_account` — which own the state machine, the reason, the audit event and the\n   * administrative-continuity floors. A generic field patch reproduces none of that, so accepting\n   * `status` on the ordinary UPDATE contract meant an administrator could retire an account through\n   * a door that asked none of those questions. Mirrors `OrganizationMemberSchema.status`, whose\n   * JSDoc has described the same rule for the same reason since before these verbs existed.\n   *\n   * ⚠️ The trusted server-side writers must therefore use `updateAsSystem`, which re-attaches the\n   * field past the repository's strict request-DTO re-parse — email verification\n   * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning. All four\n   * were migrated in the same change, and `USERS` opts into `systemAccessPolicy.update` for exactly\n   * them. A NEW trusted writer that reaches for `servicesRegistryHandler.update` here will be\n   * SILENTLY stripped — the account simply never changes state, with no error and no signal.\n   *\n   * assurance-control: WILDO.IDENTITY.LIFECYCLE — a change to whether a principal may authenticate\n   * runs through one guarded, evidenced authority.\n   */\n  status: z.enum(UserStatus).default(UserStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence().excludeFromUpdate(),\n  appRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]).isDBIndexed().isAuditEvidence(),\n  /** User types from config (e.g. 'user', 'admin', 'consumer'). Determines auth policy, registration context. */\n  userTypes: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * When an automated sweep must return this account to `ACTIVE`.\n   *\n   * Written only by `users | suspend_user`, whose contract takes `suspensionDuration` in DAYS. The\n   * transition hook resolves that duration to an absolute instant before persisting, because a\n   * duration is only meaningful relative to a moment the row does not otherwise record.\n   *\n   * Voluntary `user_self | deactivate_account` deliberately has no schedule: an INACTIVE account\n   * returns only when its subject calls `reactivate_account`. Absent therefore means an indefinite\n   * admin suspension or a non-scheduled lifecycle state.\n   *\n   * Server-owned (`.excludeFromCreate().excludeFromUpdate()`) so the transition verbs are the only\n   * writers, and indexed because the reactivation sweep queries exactly \"rows whose scheduled\n   * reactivation has passed\". Deliberately NOT `.isAuditEvidence()`: unlike the three fields above\n   * it does not decide what the principal may do — it is a scheduling detail, and the transition's\n   * own audit event already records the reason and the resulting status.\n   *\n   * ⚠️ For admin suspension, the value is a PROMISE the reactivation batch keeps. Persisting it without that sweep would\n   * be the same defect as a verb answering success while writing nothing: an authored intention\n   * that nothing honors.\n   */\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type User = z.infer<typeof UserSchema>;\n\nexport const UserLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField(),\n  // Compact multi-select: render as a chips combobox (searchable popover) instead\n  // of a full inline checkbox column — `editMode: COMBOBOX` on the array item is the\n  // opt-in that `FormFieldArray` reads to render `ComboboxMultiple`. Fits a\n  // settings-row layout where the long language list would otherwise overflow.\n  fallbackLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).default([AvailableLanguage.EN]),\n  autoDetect: z.boolean().default(true),\n  useOrganizationDefault: z.boolean().default(false),\n});\nexport type UserLanguagePreferences = z.infer<typeof UserLanguagePreferencesSchema>;\n\nexport const UserProfileSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()`: one profile per user (1:1 composition). Backstops the eager\n  // `onParentCreate` seed + the provisioning paths against a concurrent\n  // double-create — the durable idempotency guarantee behind the declarative seed.\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  firstName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n  lastName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n  displayName: z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n  /**\n   * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored\n   * as the standard file reference `{ fileId, updatedAt }` and rendered as a\n   * square avatar. Uses the plain `z_file()` image pipeline (upload / storage /\n   * DTO / persistence / metadata population) with no bespoke field type; the\n   * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there\n   * is no external-URL branch.\n   */\n  avatar: z_file({\n    nature: FileNature.IMAGE,\n    allowedMimeTypes: 'Images',\n    maxSize: 2 * 1024 * 1024,\n    imageConstraints: {\n      maxWidth: 1024,\n      maxHeight: 1024,\n      aspectRatio: { width: 1, height: 1 },\n      generateThumbnails: true,\n    },\n  }).optional().dataCategories(PersonalDataCategory.IDENTITY),\n  // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never\n  // what it will contain — a bio is a classic surface where a special category (a health condition,\n  // a religious observance, a political affiliation) arrives unannounced, and no schema certifies\n  // otherwise. Nothing here is a claim that it does NOT contain one.\n  bio: z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),\n  /**\n   * E.164 phone number (e.g. \"+33123456789\"). `z_phone()` carries the phone\n   * metadata that drives the international phone INPUT on edit (country selector +\n   * national number) and the formatted international DISPLAY on read — replacing\n   * the old raw `z.string().regex(...)` that surfaced the regex to the user.\n   * Stored value is still a plain E.164 string, so DTO/persistence are unchanged.\n   */\n  //\n  // `addDataCategories` rather than the fluent form: `z_phone()` returns a ZodPipe, which carries no\n  // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one). A phone\n  // number is contact-detail personal data by definition, so the escape hatch is load-bearing here\n  // rather than a curiosity.\n  phoneNumber: addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),\n  title: z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL)\n});\nexport type UserProfile = z.infer<typeof UserProfileSchema>;\n\nexport const UserPreferences_NotificationsSchema = z.object({\n  email: z.boolean().default(true),\n  push: z.boolean().default(true),\n  sms: z.boolean().default(false),\n  inApp: z.boolean().default(true)\n});\nexport type UserPreferences_Notifications = z.infer<typeof UserPreferences_NotificationsSchema>;\n\nexport const UserPreferences_UI_ThemeSchema = z.object({\n  theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField(),\n});\nexport type UserPreferences_UI_Theme = z.infer<typeof UserPreferences_UI_ThemeSchema>;\n\nexport const UserPreferences_RegionalSchema = z.object({\n  timezone: TimezoneSchema.default('UTC').isSummaryField(),\n  // LOCALE_DEFAULT (not ISO_8601): \"no expressed preference\" must mean locale-driven\n  // rendering. A stored ISO_8601 default materializes at parse and masks the frontend's\n  // locale fallback (I18nContext), pinning every preference-less user to `YYYY-MM-DD`.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.LOCALE_DEFAULT),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').default(TimeFormat.TWENTY_FOUR_HOUR),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField()\n});\nexport type UserPreferences_Regional = z.infer<typeof UserPreferences_RegionalSchema>;\n\n/**\n * The preference blocks a caller can address as a unit — the closed vocabulary behind\n * `reset_to_defaults` on USER_SELF_PREFERENCES.\n *\n * **Every value IS the persisted field name on {@link UserPreferencesSchema}.** That is the\n * point of the enum, not a coincidence: it lets the reset patch be DERIVED from the vocabulary\n * instead of routed through a hand-written flag-to-field map. The previous contract was six\n * booleans (`resetNotifications`, `resetUI`, …) that named no schema path, so the whole request\n * was stripped before persistence and the route answered 200 having reset nothing.\n *\n * Adding a preference group to the schema means adding a member here; the mapped type in\n * `user-preferences-reset.shared.utils.ts` then refuses to compile until the group declares how\n * it resets. Renaming a group field without renaming the value fails the same way.\n *\n * Note `LANGUAGE = 'languagePreferences'` — the member reads as the concept, the value is the\n * field. Do not \"tidy\" the value to `language`; it is an address, not a label.\n */\nexport enum UserPreferenceGroup {\n  NOTIFICATIONS = 'notifications',\n  PRIVACY = 'privacy',\n  UI = 'ui',\n  REGIONAL = 'regional',\n  LANGUAGE = 'languagePreferences',\n}\n\nexport const UserPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` is the idempotency backstop for onParentCreate seeding: the eager\n  // seed (and any retry) is deduplicated at the DB layer — a second seed for the same\n  // user fails the unique constraint and is swallowed, guaranteeing exactly one\n  // preferences row per user. (Prod migration note: dedupe any pre-existing duplicate\n  // userId rows before this index builds; preferences was seeded nowhere pre-feature,\n  // so duplicates are unexpected.)\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // ── Which preference blocks are data ABOUT the person, and which are rendering state ──\n  //\n  // Declared at the BLOCK, not on the leaves inside it. The resolver walks TOP-LEVEL fields only —\n  // the same limit the subject-export compiler and the impersonalize writer have — so a category on\n  // `regional.timezone` would be invisible. That is not a workaround: a notice enumerates KINDS, and\n  // \"communication preferences\" is the kind, not \"the sms boolean\".\n  //\n  // `ui` is deliberately NOT declared. A theme choice is about how the SYSTEM renders for someone,\n  // not a fact about them — the same line that keeps job executions, entitlement limits and unread\n  // counters out of the inventory. The three below are the other side of it: how the person wants to\n  // be CONTACTED, what they decided about their own privacy, and where and in what language they\n  // are — each a fact about them that a notice owes an answer on.\n  //\n  // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it\n  // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a\n  // reader nothing the word \"preferences\" does not.\n  notifications: UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))\n    .dataCategories(PersonalDataCategory.USAGE),\n  \n  privacy: UserPrivacySchema.default(UserPrivacySchema.parse({}))\n    .dataCategories(PersonalDataCategory.USAGE),\n  \n  ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),\n  \n  // Timezone and locale are the two that most clearly identify something about the person rather\n  // than about the session — a timezone narrows where they are, which is why LOCATION rides here.\n  regional: UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()\n    .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),\n  \n  // Enhanced language preferences\n  languagePreferences: UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()\n    .dataCategories(PersonalDataCategory.USAGE)\n});\nexport type UserPreferences = z.infer<typeof UserPreferencesSchema>;\n\nexport const UserContextSchema = UserSchema.extend({\n  // New relationship-based field names (matching auto-generated context)\n  userSelfProfile: UserProfileSchema.optional(),\n  userSelfPreference: UserPreferencesSchema.optional(),\n  organizationMembers: z.array(OrganizationMemberSchema).optional(),\n});\nexport type UserContext = z.infer<typeof UserContextSchema>; \n"]}
+{"version":3,"file":"users.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAChH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,2DAA6C,CAAA;IAC7C,uDAAyC,CAAA;IACzC,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,0BAAa,CAAA;IACb,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,EAAE,iBAAiB,CACtB,oBAAoB,CAClB,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,EACrF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,6FAA6F;IAC7F,yDAAyD;IACzD,oBAAoB,CAAC,eAAe,CACrC;IACD,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,oBAAoB;IACpB,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,+FAA+F;IAC/F,sFAAsF;IACtF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,iBAAiB,EAAE;IAC1H,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IACpG,+GAA+G;IAC/G,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC1E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;IACzH,gFAAgF;IAChF,mFAAmF;IACnF,0EAA0E;IAC1E,6EAA6E;IAC7E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC3K,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,sEAAsE;IACtE,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,QAAQ,EAAE,oBAAoB,CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,WAAW,EAAE,oBAAoB,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7F,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;;OAOG;IACH,gGAAgG;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,oGAAoG;IACpG,MAAM,EAAE,oBAAoB,CAC1B,MAAM,CAAC;QACL,MAAM,EAAE,UAAU,CAAC,KAAK;QACxB,gBAAgB,EAAE,QAAQ;QAC1B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QACxB,gBAAgB,EAAE;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;YACpC,kBAAkB,EAAE,IAAI;SACzB;KACF,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC3D,aAAa,CAAC,MAAM,CACrB;IACD,+FAA+F;IAC/F,kGAAkG;IAClG,gGAAgG;IAChG,mEAAmE;IACnE,GAAG,EAAE,oBAAoB,CACvB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;OAMG;IACH,EAAE;IACF,mGAAmG;IACnG,kGAAkG;IAClG,iGAAiG;IACjG,2BAA2B;IAC3B,WAAW,EAAE,oBAAoB,CAC/B,iBAAiB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,MAAM,CACrB;IACD,KAAK,EAAE,oBAAoB,CACzB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;CAClE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IACxD,mFAAmF;IACnF,sFAAsF;IACtF,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;IAC1F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAC5F,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;CACjH,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,0CAAmB,CAAA;IACnB,gCAAS,CAAA;IACT,4CAAqB,CAAA;IACrB,uDAAgC,CAAA;AAClC,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,oFAAoF;IACpF,oFAAoF;IACpF,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,yFAAyF;IACzF,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,kEAAkE;IAClE,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,gEAAgE;IAChE,EAAE;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,kDAAkD;IAClD,aAAa,EAAE,oBAAoB,CACjC,mCAAmC,CAAC,OAAO,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvF,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;IAED,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACnD,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;IAED,EAAE,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAErG,+FAA+F;IAC/F,gGAAgG;IAChG,kGAAkG;IAClG,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAC5B,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC9F,cAAc,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAC9E,aAAa,CAAC,KAAK,CACpB;IAED,gCAAgC;IAChC,mBAAmB,EAAE,oBAAoB,CACvC,6BAA6B,CAAC,OAAO,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC5F,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC;IACjD,uEAAuE;IACvE,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC7C,kBAAkB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACpD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * User Shared Schemas\n * \n * Shared user schemas for frontend and backend with MongoDB compatibility\n */\n\nimport { z } from 'zod';\n\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { UserPrivacySchema } from '../compliance/privacy/privacy.shared.schemas';\nimport { OrganizationMemberSchema } from '../organizations/organization-members.shared.schemas';\nimport { AvailableLanguage, TimezoneSchema, DateFormat, TimeFormat } from '@wildo-ai/presets-components-models';\nimport { EnumEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * The address written over a user's `email` when the subject is erased and the row retained.\n *\n * `.invalid` is an RFC 2606 reserved TLD: it can never be registered and never resolves, so an\n * erased address cannot be delivered to, cannot be confused with a live account, and cannot become\n * a real identity if a stray code path ever re-mails it.\n *\n * Exported as ONE named source so the erasure orchestrator, tests and any operator query recognize\n * an erased subject without duplicating the literal.\n */\nexport const ERASED_USER_EMAIL = 'erased@erased.invalid';\n\n/**\n * What a REQUIRED name field becomes when the subject is erased.\n *\n * `firstName` and `lastName` are `min(1)`, so REMOVE is not available to them — nulling a required\n * field would leave a row the schema itself rejects on the next read. MASK with a value that is\n * obviously not a name keeps the row parseable while carrying no information about the person.\n *\n * Deliberately the same placeholder as `ERASED_FILE_NAME_PLACEHOLDER`: a reader meeting `[erased]`\n * in an export or an admin view should not have to learn a second vocabulary to recognise it.\n */\nexport const ERASED_USER_NAME = '[erased]';\n\n/**\n * What an erased EXTERNAL identifier becomes — a provider's own id for the person.\n *\n * Distinct from `ERASED_USER_NAME` despite the same literal, because the two answer different\n * questions and will diverge: a name is displayed to a human, an external id is matched against a\n * provider's records. Merging them would make a future change to either silently change the other.\n */\nexport const ERASED_IDENTITY_VALUE = '[erased]';\n\nexport enum UserStatus {\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED',\n  PENDING_VERIFICATION = 'PENDING_VERIFICATION',\n  PENDING_INVITATION = 'PENDING_INVITATION',\n  DELETED = 'DELETED'\n}\n\nexport enum UserTheme {\n  LIGHT = 'LIGHT',\n  DARK = 'DARK',\n  AUTO = 'AUTO'\n}\n\nexport const UserSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * Email is the STRICT unique identity anchor — there is never more than one\n   * `User` per email. `.isUnique()` is the fail-closed DB backstop; every\n   * provisioning path (self-registration, org-admin invite, SSO JIT, SCIM,\n   * anonymous transposition) MUST find-or-create by this normalized value rather\n   * than blind-create, and recover from the duplicate-key `409` on the rare\n   * concurrent race (e.g. an invite and an SSO JIT landing at once). `.toLowerCase()`\n   * normalizes before both the lookup and the unique check so casing can't fork an\n   * identity. `.excludeFromUpdate()` keeps the anchor immutable.\n   *\n   * **It is also the ONLY personal datum on this row** (the rest is `_id`, status, roles, types and\n   * timestamps; names / bio / phone / avatar all live on `USER_PROFILES`). So it is what a subject\n   * erasure scrubs — `MASK` to {@link ERASED_USER_EMAIL}, which keeps the row resolvable as an\n   * anonymized subject for the retained billing records whose foreign keys point at it.\n   *\n   * `MASK` with an explicit value rather than `REMOVE`: `REMOVE` writes `null`, which this schema\n   * rejects, so it would force `.nullish()` here — widening the identity anchor to\n   * `string | null | undefined` for ~20+ consumers (auth registration, password reset, JWT guard,\n   * SCIM, SSO provisioning, org invites) AND making it optional at CREATE, to represent a state only\n   * the audited see-through reader can ever observe, since a retained row is hidden from every\n   * normal read. The default mask constant cannot be used either — it is not a valid email.\n   * Every erased user shares this one address; that cannot collide, because the unique index on a\n   * retention-governed resource covers only non-retained rows and the scrub flips the row to\n   * `RETAINED` in the same write.\n   */\n  email: addDataCategories(\n    addImpersonalizeWith(\n      z.email().isDBIndexed().isUnique().toLowerCase().isSummaryField().excludeFromUpdate(),\n      RedactionType.MASK,\n      { maskValue: ERASED_USER_EMAIL },\n    ),\n    // Declared because the engine owes its OWN inventory. Without it, every generated application's\n    // privacy notice would name `users.email` as an outstanding category gap — the field carries a\n    // scrub treatment, which is the application saying it holds personal data, so the missing\n    // category would be a provable omission the framework left for each app to fix. CONTACT_DETAILS\n    // rather than IDENTITY: it is how the person is reached. That it also serves as the identity\n    // anchor is a property of this schema, not of the datum.\n    PersonalDataCategory.CONTACT_DETAILS,\n  ),\n  // The three fields below carry `.isAuditEvidence()`: their VALUES are recorded before-and-after on\n  // the `resource_operation_performed` audit event. All three decide what the principal may do, and\n  // all three hold closed vocabulary rather than personal data — so recording them is both necessary\n  // as authorization evidence and free of personal data whose erasure obligations could reach the\n  // immutable ledger.\n  //\n  // Contrast `email` directly above, which is deliberately NOT marked: it is the identity anchor and\n  // is `.impersonalizeWith(MASK)`, i.e. a value the framework must be able to scrub on erasure.\n  // Copying it into an unscrubbable audit row would defeat that capability. That is the whole D4\n  // boundary in one file — mark what decides authority, never what identifies a person.\n  /**\n   * Account lifecycle and access posture.\n   *\n   * `.excludeFromUpdate()` since 2026-08-01. Lifecycle transitions belong to the dedicated verbs —\n   * `users | suspend_user` / `unsuspend_user` and `user_self | deactivate_account` /\n   * `reactivate_account` — which own the state machine, the reason, the audit event and the\n   * administrative-continuity floors. A generic field patch reproduces none of that, so accepting\n   * `status` on the ordinary UPDATE contract meant an administrator could retire an account through\n   * a door that asked none of those questions. Mirrors `OrganizationMemberSchema.status`, whose\n   * JSDoc has described the same rule for the same reason since before these verbs existed.\n   *\n   * ⚠️ The trusted server-side writers must therefore use `updateAsSystem`, which re-attaches the\n   * field past the repository's strict request-DTO re-parse — email verification\n   * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning. All four\n   * were migrated in the same change, and `USERS` opts into `systemAccessPolicy.update` for exactly\n   * them. A NEW trusted writer that reaches for `servicesRegistryHandler.update` here will be\n   * SILENTLY stripped — the account simply never changes state, with no error and no signal.\n   *\n   * assurance-control: WILDO.IDENTITY.LIFECYCLE — a change to whether a principal may authenticate\n   * runs through one guarded, evidenced authority.\n   */\n  status: z.enum(UserStatus).default(UserStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence().excludeFromUpdate(),\n  appRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]).isDBIndexed().isAuditEvidence(),\n  /** User types from config (e.g. 'user', 'admin', 'consumer'). Determines auth policy, registration context. */\n  userTypes: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * When an automated sweep must return this account to `ACTIVE`.\n   *\n   * Written only by `users | suspend_user`, whose contract takes `suspensionDuration` in DAYS. The\n   * transition hook resolves that duration to an absolute instant before persisting, because a\n   * duration is only meaningful relative to a moment the row does not otherwise record.\n   *\n   * Voluntary `user_self | deactivate_account` deliberately has no schedule: an INACTIVE account\n   * returns only when its subject calls `reactivate_account`. Absent therefore means an indefinite\n   * admin suspension or a non-scheduled lifecycle state.\n   *\n   * Server-owned (`.excludeFromCreate().excludeFromUpdate()`) so the transition verbs are the only\n   * writers, and indexed because the reactivation sweep queries exactly \"rows whose scheduled\n   * reactivation has passed\". Deliberately NOT `.isAuditEvidence()`: unlike the three fields above\n   * it does not decide what the principal may do — it is a scheduling detail, and the transition's\n   * own audit event already records the reason and the resulting status.\n   *\n   * ⚠️ For admin suspension, the value is a PROMISE the reactivation batch keeps. Persisting it without that sweep would\n   * be the same defect as a verb answering success while writing nothing: an authored intention\n   * that nothing honors.\n   */\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type User = z.infer<typeof UserSchema>;\n\nexport const UserLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField(),\n  // Compact multi-select: render as a chips combobox (searchable popover) instead\n  // of a full inline checkbox column — `editMode: COMBOBOX` on the array item is the\n  // opt-in that `FormFieldArray` reads to render `ComboboxMultiple`. Fits a\n  // settings-row layout where the long language list would otherwise overflow.\n  fallbackLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).default([AvailableLanguage.EN]),\n  autoDetect: z.boolean().default(true),\n  useOrganizationDefault: z.boolean().default(false),\n});\nexport type UserLanguagePreferences = z.infer<typeof UserLanguagePreferencesSchema>;\n\nexport const UserProfileSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()`: one profile per user (1:1 composition). Backstops the eager\n  // `onParentCreate` seed + the provisioning paths against a concurrent\n  // double-create — the durable idempotency guarantee behind the declarative seed.\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  firstName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  lastName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  displayName: addImpersonalizeWith(\n    z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored\n   * as the standard file reference `{ fileId, updatedAt }` and rendered as a\n   * square avatar. Uses the plain `z_file()` image pipeline (upload / storage /\n   * DTO / persistence / metadata population) with no bespoke field type; the\n   * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there\n   * is no external-URL branch.\n   */\n  // REMOVE nulls the stored `{ fileId, updatedAt }` reference, which is what erasure can honestly\n  // promise here: the profile stops pointing at the person's face. It does NOT delete the underlying\n  // stored object — file bytes are owned by the file resource and its own lifecycle, and claiming\n  // otherwise in a schema comment would be the kind of unverified assertion this lane exists to stop.\n  avatar: addImpersonalizeWith(\n    z_file({\n      nature: FileNature.IMAGE,\n      allowedMimeTypes: 'Images',\n      maxSize: 2 * 1024 * 1024,\n      imageConstraints: {\n        maxWidth: 1024,\n        maxHeight: 1024,\n        aspectRatio: { width: 1, height: 1 },\n        generateThumbnails: true,\n      },\n    }).optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never\n  // what it will contain — a bio is a classic surface where a special category (a health condition,\n  // a religious observance, a political affiliation) arrives unannounced, and no schema certifies\n  // otherwise. Nothing here is a claim that it does NOT contain one.\n  bio: addImpersonalizeWith(\n    z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * E.164 phone number (e.g. \"+33123456789\"). `z_phone()` carries the phone\n   * metadata that drives the international phone INPUT on edit (country selector +\n   * national number) and the formatted international DISPLAY on read — replacing\n   * the old raw `z.string().regex(...)` that surfaced the regex to the user.\n   * Stored value is still a plain E.164 string, so DTO/persistence are unchanged.\n   */\n  //\n  // `addDataCategories` rather than the fluent form: `z_phone()` returns a ZodPipe, which carries no\n  // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one). A phone\n  // number is contact-detail personal data by definition, so the escape hatch is load-bearing here\n  // rather than a curiosity.\n  phoneNumber: addImpersonalizeWith(\n    addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.REMOVE,\n  ),\n  title: addImpersonalizeWith(\n    z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL),\n    RedactionType.REMOVE,\n  )\n});\nexport type UserProfile = z.infer<typeof UserProfileSchema>;\n\nexport const UserPreferences_NotificationsSchema = z.object({\n  email: z.boolean().default(true),\n  push: z.boolean().default(true),\n  sms: z.boolean().default(false),\n  inApp: z.boolean().default(true)\n});\nexport type UserPreferences_Notifications = z.infer<typeof UserPreferences_NotificationsSchema>;\n\nexport const UserPreferences_UI_ThemeSchema = z.object({\n  theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField(),\n});\nexport type UserPreferences_UI_Theme = z.infer<typeof UserPreferences_UI_ThemeSchema>;\n\nexport const UserPreferences_RegionalSchema = z.object({\n  timezone: TimezoneSchema.default('UTC').isSummaryField(),\n  // LOCALE_DEFAULT (not ISO_8601): \"no expressed preference\" must mean locale-driven\n  // rendering. A stored ISO_8601 default materializes at parse and masks the frontend's\n  // locale fallback (I18nContext), pinning every preference-less user to `YYYY-MM-DD`.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.LOCALE_DEFAULT),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').default(TimeFormat.TWENTY_FOUR_HOUR),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField()\n});\nexport type UserPreferences_Regional = z.infer<typeof UserPreferences_RegionalSchema>;\n\n/**\n * The preference blocks a caller can address as a unit — the closed vocabulary behind\n * `reset_to_defaults` on USER_SELF_PREFERENCES.\n *\n * **Every value IS the persisted field name on {@link UserPreferencesSchema}.** That is the\n * point of the enum, not a coincidence: it lets the reset patch be DERIVED from the vocabulary\n * instead of routed through a hand-written flag-to-field map. The previous contract was six\n * booleans (`resetNotifications`, `resetUI`, …) that named no schema path, so the whole request\n * was stripped before persistence and the route answered 200 having reset nothing.\n *\n * Adding a preference group to the schema means adding a member here; the mapped type in\n * `user-preferences-reset.shared.utils.ts` then refuses to compile until the group declares how\n * it resets. Renaming a group field without renaming the value fails the same way.\n *\n * Note `LANGUAGE = 'languagePreferences'` — the member reads as the concept, the value is the\n * field. Do not \"tidy\" the value to `language`; it is an address, not a label.\n */\nexport enum UserPreferenceGroup {\n  NOTIFICATIONS = 'notifications',\n  PRIVACY = 'privacy',\n  UI = 'ui',\n  REGIONAL = 'regional',\n  LANGUAGE = 'languagePreferences',\n}\n\nexport const UserPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` is the idempotency backstop for onParentCreate seeding: the eager\n  // seed (and any retry) is deduplicated at the DB layer — a second seed for the same\n  // user fails the unique constraint and is swallowed, guaranteeing exactly one\n  // preferences row per user. (Prod migration note: dedupe any pre-existing duplicate\n  // userId rows before this index builds; preferences was seeded nowhere pre-feature,\n  // so duplicates are unexpected.)\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // ── Which preference blocks are data ABOUT the person, and which are rendering state ──\n  //\n  // Declared at the BLOCK, not on the leaves inside it. The resolver walks TOP-LEVEL fields only —\n  // the same limit the subject-export compiler and the impersonalize writer have — so a category on\n  // `regional.timezone` would be invisible. That is not a workaround: a notice enumerates KINDS, and\n  // \"communication preferences\" is the kind, not \"the sms boolean\".\n  //\n  // `ui` is deliberately NOT declared. A theme choice is about how the SYSTEM renders for someone,\n  // not a fact about them — the same line that keeps job executions, entitlement limits and unread\n  // counters out of the inventory. The three below are the other side of it: how the person wants to\n  // be CONTACTED, what they decided about their own privacy, and where and in what language they\n  // are — each a fact about them that a notice owes an answer on.\n  //\n  // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it\n  // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a\n  // reader nothing the word \"preferences\" does not.\n  notifications: addImpersonalizeWith(\n    UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  \n  privacy: addImpersonalizeWith(\n    UserPrivacySchema.default(UserPrivacySchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  \n  ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),\n  \n  // Timezone and locale are the two that most clearly identify something about the person rather\n  // than about the session — a timezone narrows where they are, which is why LOCATION rides here.\n  // LOCATION as well as USAGE — a timezone and a locale narrow where a person is. RESET returns the\n  // application's own defaults, which is what a person who never chose still has.\n  regional: addImpersonalizeWith(\n    UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()\n      .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),\n    RedactionType.RESET,\n  ),\n  \n  // Enhanced language preferences\n  languagePreferences: addImpersonalizeWith(\n    UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  )\n});\nexport type UserPreferences = z.infer<typeof UserPreferencesSchema>;\n\nexport const UserContextSchema = UserSchema.extend({\n  // New relationship-based field names (matching auto-generated context)\n  userSelfProfile: UserProfileSchema.optional(),\n  userSelfPreference: UserPreferencesSchema.optional(),\n  organizationMembers: z.array(OrganizationMemberSchema).optional(),\n});\nexport type UserContext = z.infer<typeof UserContextSchema>; \n"]}