npm - @wildo-ai/saas-models - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-models 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (588) hide show

package/dist/esm/users/users.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,UAAU,EACV,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,6CAA6C;AAC7C,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAEnF,oCAAoC;AACpC,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC;AAEF,qEAAqE;AACrE,MAAM,yBAAyB,GAAG;IAChC,GAAG,mBAAmB;IACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;IACvD,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,gCAAgC;CACrD,CAAC;AAEF,iDAAiD;AACjD,MAAM,uBAAuB,GAAG,CAAC,GAAG,iBAAiB,EAAE,QAAQ,CAAU,CAAC;AAE1E,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,+FAA+F;AAC/F,gGAAgG;AAChG,uFAAuF;AACvF,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,iFAAiF;AACjF,EAAE;AACF,4CAA4C;AAC5C,gGAAgG;AAChG,qFAAqF;AACrF,8FAA8F;AAC9F,iGAAiG;AACjG,sEAAsE;AACtE,gGAAgG;AAChG,kFAAkF;AAClF,kGAAkG;AAClG,wFAAwF;AACxF,0EAA0E;AAC1E,2FAA2F;AAC3F,8DAA8D;AAC9D,8DAA8D;AAC9D,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,sEAAsE;AACtE,EAAE;AACF,2EAA2E;AAC3E,+FAA+F;AAC/F,qFAAqF;AACrF,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,mGAAmG;AACnG,EAAE;AACF,4FAA4F;AAC5F,yCAAyC;AACzC,8FAA8F;AAC9F,oGAAoG;AACpG,8FAA8F;AAC9F,oFAAoF;AACpF,qFAAqF;AACrF,0FAA0F;AAC1F,iCAAiC;AACjC,mGAAmG;AACnG,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,mGAAmG;AACnG,6FAA6F;AAC7F,mGAAmG;AACnG,6FAA6F;AAC7F,gGAAgG;AAChG,sFAAsF;AACtF,4DAA4D;AAC5D,EAAE;AACF,4CAA4C;AAC5C,iGAAiG;AACjG,0EAA0E;AAC1E,iGAAiG;AACjG,iGAAiG;AACjG,6DAA6D;AAC7D,6FAA6F;AAC7F,wEAAwE;AACxE,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,wBAAwB;AACxB,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,uFAAuF;AACvF,mGAAmG;AACnG,4EAA4E;AAC5E,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,sCAAsC;AACtC,sEAAsE;AACtE,MAAM,CAAN,IAAY,gBAMX;AAND,WAAY,gBAAgB;IAC1B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,qDAAiC,CAAA;IACjC,iEAA6C,CAAA;AAC/C,CAAC,EANW,gBAAgB,KAAhB,gBAAgB,QAM3B;AAWD;;EAEE;AACF,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;IAC1C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACnF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,uBAAuB;IAE/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,6BAA6B,EAAE,KAAK;IAEpC,mFAAmF;IACnF,8EAA8E;IAC9E,sFAAsF;IACtF,sFAAsF;IACtF,qFAAqF;IACrF,2FAA2F;IAC3F,0FAA0F;IAC1F,EAAE;IACF,iEAAiE;IACjE,iFAAiF;IACjF,oFAAoF;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,kFAAkF;IAClF,iFAAiF;IACjF,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,2FAA2F;QAC3F,8EAA8E;KAC/E;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;;;OAMG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,gBAAgB;IAEjC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oFAAoF;oBACpF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,uFAAuF;oBACvF,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,uFAAuF;oBACvF,0FAA0F;oBAC1F,wFAAwF;oBACxF,2FAA2F;oBAC3F,sCAAsC;iBACvC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,yFAAyF;oBACzF,kFAAkF;oBAClF,oCAAoC,EAAE,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,2EAA2E;oBAC3E,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,2EAA2E;oBAC3E,yCAAyC;oBACzC,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,gEAAgE;oBAChE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,yEAAyE;oBACzE,yEAAyE;oBACzE,uEAAuE;oBACvE,mEAAmE;oBACnE,yEAAyE;oBACzE,2EAA2E;oBAC3E,wEAAwE;oBACxE,2EAA2E;oBAC3E,mEAAmE;oBACnE,0EAA0E;oBAC1E,gBAAgB,EAAE;wBAChB,OAAO;wBACP;4BACE,UAAU,EAAE,KAAK;4BACjB,eAAe,EAAE,gBAAgB,CAAC,aAAa;4BAC/C,gBAAgB,EAAE,QAAQ;4BAC1B,mEAAmE;4BACnE,sCAAsC;yBACvC;qBACF;oBACD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,EAAE;oBACF,uFAAuF;oBACvF,iFAAiF;oBACjF,0FAA0F;oBAC1F,qFAAqF;oBACrF,uFAAuF;oBACvF,wFAAwF;oBACxF,mEAAmE;iBACpE;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wDAAwD;oBACvG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qEAAqE;oBACrE,uEAAuE;oBACvE,kDAAkD;oBAClD,EAAE;oBACF,2DAA2D;oBAC3D,2FAA2F;oBAC3F,sFAAsF;oBACtF,EAAE;oBACF,2FAA2F;oBAC3F,+EAA+E;oBAC/E,+EAA+E;iBAChF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,iFAAiF;oBACjF,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,+FAA+F;oBAC/F,gGAAgG;oBAChG,gGAAgG;oBAChG,iGAAiG;oBACjG,+FAA+F;oBAC/F,iGAAiG;oBACjG,qDAAqD;oBACrD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gCAAgC;oBAC/E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,2FAA2F;oBAC3F,qFAAqF;oBACrF,kFAAkF;oBAClF,gFAAgF;oBAChF,uCAAuC;oBACvC,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,2FAA2F;oBAC3F,2FAA2F;oBAC3F,yFAAyF;oBACzF,uFAAuF;oBACvF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4FAA4F;oBAC5F,0FAA0F;oBAC1F,uFAAuF;oBACvF,mDAAmD;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,6CAA6C;oBAC5F,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,yFAAyF;oBACzF,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;wBAClC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO;wBACzD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;YACjC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,8BAA8B;oBAC7E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,sFAAsF;oBACtF,mFAAmF;oBACnF,qEAAqE;oBACrE,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;wBACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC;oBACvD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qDAAqD;oBACpG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;qBACnC,CAAC;oBACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,+FAA+F;wBAC/F,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;wBACnB,+EAA+E;wBAC/E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;qBAC7B,CAAC;oBACF,oFAAoF;oBACpF,2EAA2E;oBAC3E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;oBACrD,CAAC;iBACF;aACF;YACD,yFAAyF;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,kDAAkD;YAClD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KAEF;CACF,CAAC,CAAC","sourcesContent":["/*\n Users Shared Resource Configuration\n \n Resource configuration for administrative user management operations.\n * Handles user lifecycle, role management, and administrative actions.\n /\n\nimport { z } from 'zod';\nimport {\n UserSchema,\n UserStatus,\n UserTheme\n} from './users.shared.schemas';\nimport { AppRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Sort and filter fields for user management\nconst USERS_SORT_FIELDS = ['createdAt', 'updatedAt', 'joinedAt', 'email'] as const;\n\n// App users get basic filter fields\nconst USERS_FILTER_FIELDS = {\n status: z.enum(UserStatus),\n email: z.string(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst USERS_ADMIN_FILTER_FIELDS = {\n ...USERS_FILTER_FIELDS,\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n joinedAt: z.date(), // Admin can filter by join date\n};\n\n// App Admin gets additional sorting capabilities\nconst USERS_ADMIN_SORT_FIELDS = [...USERS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for user management\n//\n// Invitation is intentionally absent. Organization invitations are created by\n// the organization-members lifecycle, where the pending membership, invitee\n// identity, token and email are produced together. A previous `send_invitation`\n// users operation declared an invitation-receipt DTO but registered no backend\n// implementation capable of producing it. Reintroduce an application-wide\n// invitation operation only with a real lifecycle owner and handler; an\n// API_CALL declaration by itself is not an implementation.\n//\n// IMPERSONATION IS NOT A TOKEN MINT — IT IS AN IDENTITY SUBSTRATE THE FRAMEWORK DOES NOT HAVE.\n// `IMPERSONATE` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ reason, durationMinutes, auditLog }` and promising a\n// `{ impersonationToken, expiresAt, auditId }` response, and was removed on 2026-08-01: it was\n// ROUTED but never implemented. With `resourceOperationLike: READ` the generic core path simply\n// returned the target's user row, so the most dangerous verb in the catalogue answered\n// HTTP 200* — an operator is told an impersonation session exists when none does.\n//\n// Do NOT re-declare it as a plain token mint. A minted session JWT is today byte-for-byte\n// indistinguishable from a genuine one: the payload is `{…, sub: userId, aud: 'AUTH_TOKEN' }`\n// with NO actor claim, and `ExecutionContext` has no \"acting as\" dimension. Every audit event\n// raised during such a session would be attributed to the impersonated USER rather than the\n// administrator — the framework would manufacture false attribution in exactly the records an\n// auditor relies on. That is strictly worse than having no impersonation at all.\n//\n// Re-declaring requires, as one workstream:\n// 1. an actor claim on the session JWT (RFC 8693 `act`-style: `sub` = target, actor = admin),\n// minted through a dedicated path — never by reusing the ordinary login issuer;\n// 2. `ExecutionContext` propagation of that actor, so it reaches every downstream consumer;\n// 3. actor-attributed audit events — a new `CoreAuditableEventType` pair for session start/end\n// plus actor stamping on every event raised while impersonating;\n// 4. an explicit revocation path (revoking the impersonation must not log the real user out);\n// 5. a server-side hard duration cap from configuration — NOT a caller-supplied\n// `durationMinutes`, and NOT a caller-supplied `auditLog` flag: an audit trail the actor can\n// switch off is not an audit trail, which is why that field is not preserved here;\n// 6. notification to the impersonated user, not only to administrators;\n// 7. a forbidden-while-impersonating operation set (credential change, account deletion,\n// API-key/token minting, and any further impersonation);\n// 8. an unmistakable frontend banner for the whole session.\n//\n// assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE · TODO(assurance-control) — privileged access\n// under another identity must be authorized, time-boxed, and attributable to the human actor.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n//\n// ACCOUNT MERGE IS A MULTI-RESOURCE CAPABILITY — NOT AN UPDATE ON `users`.\n// `MERGE_ACCOUNTS` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ targetUserId, keepPrimaryUser, mergeProfile, mergePreferences,\n// mergeOrganizations, reason }` and promising a `{ mergedUser, removedUserId, mergedDataSummary }`\n// response, and was removed on 2026-08-01: it was ROUTED but never implemented. Not one request\n// field is a persisted `users` field, so the controller and repository strict parses left an empty\n// `$set` — nothing merged, nothing was removed, and the declared response could never be produced.\n//\n// It was removed rather than implemented because nothing asks for it AND the identity model\n// prevents the duplicate class it names:\n// - `UserSchema.email` is the STRICT unique identity anchor — \"there is never more than one\n// `User` per email\". All five provisioning paths (self-registration, org-admin invite, SSO JIT,\n// SCIM, anonymous transposition) find-or-create by the normalized value; `.toLowerCase()`\n// closes the casing fork and `.excludeFromUpdate()` keeps the anchor immutable.\n// - The multi-provider case — one human, several IdPs — is already first-class via\n// `USER_IDENTITY_LINKS` (many links per user, compound-unique per tenant connection).\n// There is nothing to merge.\n// - No duplicate-detection surface exists anywhere, so nothing could ever supply `targetUserId`.\n// The verb had no consumer AND no producer.\n//\n// Do NOT re-declare it as an `UPDATE` on `users`. A merge is a transactional identity move across\n// every resource holding a `userId` FK (~21 engine schema/resource-config files declare one, plus\n// every app-defined resource the engine cannot enumerate), and the framework has no such primitive\n// today: the closest prior art, `AnonymousSessionBackendService.transposeOwnership()`, loops\n// resource types accumulating `failedTypes[]` and reports partial failure instead of rolling back.\n// Note also that `ResourceTranspositionPolicy.MERGE` is declared vocabulary that no resource\n// selects and that warns \"not yet implemented — falling back to ADD\" — the same problem, in its\n// easier form (a receiving identity with no competing state), was already left undone\n// (tracked as RESCONFIG-10 in `.claude/plans/DEFERRED.md`).\n//\n// Re-declaring requires, as one workstream:\n// 1. a duplicate-detection surface that produces merge candidates — without it the verb has no\n// caller, which is how the removed declaration ended up unreachable;\n// 2. a cross-resource transaction via `resolveResourceOperationTransactionPersistenceContract`\n// (`transactionalCore` + named `transactionParticipants`), NOT a per-resource loop that can\n// half-apply and leave two partially-merged identities;\n// 3. an FK-graph walk reusing the subject-erasure traversal in `compliance/` rather than a\n// re-derived inventory that silently misses app-defined resources;\n// 4. explicit conflict resolution for the 1:1 compositions (`USER_PROFILES`, `USER_PREFERENCES`\n// are `.isUnique()` per user) and for two memberships in the same organization — the removed\n// `mergeProfile` / `mergePreferences` / `mergeOrganizations` booleans named the axes but\n// decided nothing;\n// 5. a settled, WRITTEN-DOWN answer for the losing user's audit history. It must NOT be silently\n// rewritten: `auditable-events.shared.schema.ts` is the densest `userId` holder in the engine\n// (32 occurrences), and re-pointing those rows would forge the record an auditor relies on;\n// 6. a dedicated auditable event for the merge itself — the removed operation emitted nothing at\n// all. (Operation-level auditing now exists via risk-tiered `RESOURCE_OPERATION_PERFORMED`\n// emission, so a reinstated merge verb would inherit a row from its declared risk level; it\n// would still need its own event to name the two identities being consolidated.);\n// 7. a decision on the erasure interaction: a merged-away identity that was subject to retention\n// must not resurrect scrubbed personal data through the surviving row.\n//\n// assurance-control: WILDO.IDENTITY.LIFECYCLE · TODO(assurance-control) — consolidating two\n// identities is a privileged identity-lifecycle change and must be authorized, attributable, and\n// non-destructive to the audit trail.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\nexport enum Users_Operations {\n ASSIGN_ROLES = 'assign_roles', // Assign application roles\n REVOKE_ROLES = 'revoke_roles', // Revoke application roles\n SUSPEND_USER = 'suspend_user', // Suspend user account\n UNSUSPEND_USER = 'unsuspend_user', // Unsuspend user account\n FORCE_PASSWORD_RESET = 'force_password_reset', // Force password reset\n}\n\ntype UsersCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.UPDATE_MANY\n \| CoreResourceOperation.DELETE;\n\n/\nUsers Resource Configuration Factory\n/\nexport const usersResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof Users_Operations,\n UsersCoreOperations,\n typeof UserSchema\n>({\n mainSchema: UserSchema,\n resourceIdentifier: CoreResourceType.USERS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Users are app-scoped\n\n /*\n `/users/{userId}` names the TARGET of an administrative action, never the caller.\n \n This resource's `resourceFieldIdentifier` is `userId` — the same key the W3.6 identity-coherence\n * guard compares against the JWT subject. Without this declaration that guard read every\n * `/users/{targetId}` request as \"the caller claims to be targetId\" and refused it with\n * `403 authorization_user_id_mismatch`, which made the ENTIRE administrative surface unreachable\n * cross-user: `assign_roles`, `revoke_roles`, `suspend_user`, `unsuspend_user`,\n * `force_password_reset`, the admin READ and the core UPDATE/DELETE. Every one of those is\n * documented in the resource specification as acting on \"another user's record\" and is surfaced in\n * the admin UI as a per-row action, so the framework contradicted itself.\n \n ⚠️ The SIBLING resource must keep the default. `USER_SELF` is a second configuration over the\n * SAME collection and shares this exact field identifier (\"Same as USERS but different context\"),\n * but there the segment genuinely names the caller — so it stays `true` and its horizontal-IDOR\n * refusal keeps holding. The two are indistinguishable structurally, which is precisely why this\n * is declared rather than inferred.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an administrative action on another principal\n * is authorized by the caller's ROLE, not by the caller and the subject being the same person.\n /\n primaryKeyIdentifiesInitiator: false,\n\n // create: org-admin invite eagerly provisions a `User{status: PENDING_INVITATION}`\n // in-process (the invitee has no account yet). The API_CALL CREATE variant is\n // APP_ADMIN_SUPER_ADMIN-gated AND manually omits `status`/`appRoles` from its DTO, so\n // a plain create could neither be issued by the org admin nor persist the non-default\n // status. Opt CREATE into the trusted `createAsSystem` path (fail-closed elsewhere):\n // the synthesized super-admin context satisfies the ACL and `preserveServerInjectedFields`\n // re-attaches `status` past the DTO strip. See organization-member-custom-implementation.\n //\n // read: the INBOUND_CONTACTS anonymous-CREATE lead-triage prefix\n // (`inbound-contact-custom-implementation`) must look up a user by email from an\n // ANONYMOUS context that cannot read USERS. It routes that request-triggered bypass\n // through the sanctioned `readAsSystem` (fail-closed + `SYSTEM_CONTEXT_READ` audit)\n // rather than a hand-built super-admin EC. The caller enforces its own boundary: it\n // consumes ONLY `.status` and returns ONLY a `.isBackendOnly()` enum, so the full\n // super-admin row never reaches the anonymous submitter (no enumeration oracle).\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n read: ResourceSystemAccessMode.ALLOWED,\n /\n Trusted server-side ACTIVATION / DEACTIVATION of a user's lifecycle `status`.\n \n `status` is `.excludeFromUpdate()`, so the client-facing UPDATE contract cannot carry it and\n * the lifecycle verbs (`suspend_user` / `unsuspend_user`) own the administrative transitions.\n * But four trusted flows legitimately move `status` WITHOUT a caller — email verification\n * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning\n * (`→ INACTIVE`) — and none of them is a lifecycle verb: they are consequences of an\n * out-of-band fact (a confirmed email, a directory row disappearing), not an operator decision\n * with a reason and a state machine.\n \n `updateAsSystem` is the door for exactly that shape, and it re-attaches the excluded field\n * past the strict request-DTO parse. Without this grant those writes are silently stripped and\n * users simply never activate — no error, no signal.\n /\n update: ResourceSystemAccessMode.ALLOWED,\n // `updateMany` + `seeRetained` are NOT authored here — `retentionPolicy` derives both, and\n // authoring either as FORBIDDEN is a config error. Leave them to the factory.\n },\n\n /\n Subject erasure scrubs-and-RETAINS the user row instead of deleting it: the retained financial\n * records (invoices, usage) keep a resolvable foreign key, now pointing at an anonymized subject.\n * `RETAIN_AND_IMPERSONALIZE` because this row DOES hold personal data of its own — `email` — which\n * the scrub masks to `ERASED_USER_EMAIL`. A retained row is hidden from every normal read and\n * frozen; only the audited `seeRetained` path can reach it.\n \n ⚠️ `USER_SELF` declares the SAME policy on purpose. It is a second resource config over the SAME\n * `users` collection (see `getCollectionNameForResource` in the zod→mongoose convertor: separate\n * models, one collection). Retention governance is per-config, so opting in only here would leave\n * an erased row readable AND updatable through the USER_SELF door, and would put a PLAIN unique\n * index on `email` alongside this one's retention-scoped index — which the second erasure would\n * then collide with (E11000) and abort. The two configs must be changed together.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n },\n\n /\n The subject IS this row: erasing user `X` ends the session of user `X`. Declaring it makes that\n * revocation EXPLICIT — until now it happened only as a side effect of the retention row-hide (the\n * auth fronts re-read the user, find the row hidden, and 401) plus the scrub bumping\n * `authorizationVersion`. Neither is a written revocation, so the guarantee rested entirely on two\n * unrelated mechanisms continuing to behave that way.\n /\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n /\n Subject-export disclosure. The operator-facing export subject.\n /\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n ],\n\n customOperation: Users_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n // ⚠️ DELIBERATELY NOT `admitsCrossSubjectUserAdministration`. This variant is gated\n // `APP_USER`, so admitting cross-subject addressing here would let ANY authenticated user\n // read ANY other user's row — `email`, `appRoles`, `status` — for every application built\n // on the framework. Reading another user is the `admin` variant's job, directly below.\n //\n // The pre-existing comment on this line read \"v1: app users can view other users\", which\n // the USER_SELF-scope authorization has never permitted (`authorizeUserSelf` requires the\n // addressed row to BE the caller). The claim was aspirational, not behaviour — removed\n // rather than acted on, because acting on it is a privacy decision for the product, not a\n // side effect of fixing the administrative surface. If app users SHOULD be able to view\n // each other, that wants its own decision, its own DTO narrowing (this variant returns the\n // full row today) and its own probes.\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n // THE administrative read. Gated `APP_ADMIN_VIEWER`, and the surface the admin UI's user\n // list is built on — so it must be able to address someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n // Framework-internal LIST only — INTERNAL_CALL registers NO HTTP route, so\n // this is never reachable by an app user (or anyone) over HTTP. It exists for\n // internal enumeration (e.g. enrichment / labelling), invoked with a system\n // execution context that carries APP_ADMIN_SUPER_ADMIN. `roles: []` is inert\n // here precisely because it is not URL-bearing and role-gating is bypassed for\n // internal execution — it is NOT \"any app user can list users\" (an empty roles\n // array on a URL-bearing variant would be fail-closed → 403). App users do not\n // get a global list-all; they READ a user (APP_USER) and enumerate via the\n // org-scoped SEARCH people-picker below.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n // The ONLY HTTP-exposed LIST — admin-gated global user listing.\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n // `email` is the only human-searchable field ON the user row. First/last\n // name and display name live on `USER_PROFILES` (1:1, keyed by `userId`)\n // and are MUTABLE there, so they are searched RELATIONALLY rather than\n // denormalized: the framework searches `USER_PROFILES` (by its own\n // searchable fields — firstName/lastName/displayName) and intersects the\n // matching `userId`s with this resource's `_id`. (`username` was a phantom\n // field — it exists on no user collection — and has been removed.) This\n // powers the org-scoped \"people picker\" (e.g. a `createdByUserId` filter):\n // the junction scope filter keeps results within the caller's org.\n // See SearchableRelationDescriptor in resources-config.shared.schemas.ts.\n searchableFields: [\n 'email',\n {\n localField: '_id',\n relatedResource: CoreResourceType.USER_PROFILES,\n relatedJoinField: 'userId',\n // fields omitted → defaults to USER_PROFILES' own searchableFields\n // (firstName, lastName, displayName).\n },\n ],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: USERS_ADMIN_FILTER_FIELDS,\n sortFields: USERS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 200,\n }\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only operation\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // DTOs auto-derived from decorators (excludeFromCreate on _id, createdAt, updatedAt).\n //\n // ⚠️ `status` and `appRoles` ARE part of this create contract. An earlier comment here\n // claimed they were \"manually excluded\"; they never were — neither field carries\n // `.excludeFromCreate()` and this variant declares no narrowing `requestDto`, so both are\n // accepted (confirmed against the generated OpenAPI create schema). `appRoles` being\n // caller-settable is exactly why this path carries an explicit role-ceiling gate — see\n // `user-role-administration.custom-impl.backend.service.ts`. An absent `appRoles` falls\n // back to the schema default and is NOT treated as a caller grant.\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, users manage themselves via USER_SELF\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // DTOs auto-derived from decorators. Only `appRoles` and `userTypes`\n // remain writable: `_id`, `email`, `status`, `scheduledReactivationAt`\n // and timestamps all carry `excludeFromUpdate()`.\n //\n // Because `appRoles` is caller-settable here, this path is\n // the one that actually grants application authority, and it carries the role-ceiling gate\n // plus a USER_APP_ROLES_CHANGED audit event (`user-role-administration.custom-impl`).\n //\n // This whole-array REPLACE is why the additive `assign_roles` / subtractive `revoke_roles`\n // verbs are not redundant with it: reaching the same end-state here requires a\n // read-modify-write that races with, and silently clobbers, a concurrent edit.\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [\n {\n // The CAPABILITY without a new HTTP surface. `retentionPolicy` requires UPDATE_MANY because\n // the impersonalize writer scrubs rows in place through `updateManyAsSystem`. Exposing a bulk\n // user update over HTTP would be a genuinely dangerous admin surface (mass role/status\n // rewrites), and INTERNAL_CALL registers NO route — like the LIST default above.\n //\n // ⚠️ INTERNAL_CALL, not* REPOSITORY_ONLY. Both are route-less, but the three retention\n // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n // their operation through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL /\n // API_CALL / API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is deliberately excluded there and served\n // by the separate `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant here\n // therefore satisfies the factory's \"UPDATE_MANY exists\" guard at boot and then FAILS TO RESOLVE\n // when an erasure actually runs. `roles` is inert on a non-URL-bearing variant (role gating is\n // bypassed for internal execution); the real gate is the derived `systemAccessPolicy.updateMany`\n // grant, which the trusted writer is fail-closed on.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n }\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, critical risk\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n // Irreversible identity destruction — the caller must prove they are still themselves,\n // not merely that they held a session at some point. `riskLevel: CRITICAL` above does NOT\n // do this: it drives danger-zone placement and typed confirmation in the UI and is read by\n // no authorization code. Nor does the per-user-type `stepUpAuth` policy, which is opt-in,\n // off by default and satisfied by any authentication newer than `maxAgeSeconds`.\n //\n // The audience is the reason this one is safe to gate first: `APP_ADMIN_SUPER_ADMIN` is an\n // APPLICATION-level authority, whereas the population that provably cannot step up —\n // directory-managed (SCIM) users, whose `passwordHash` and passkeys the framework\n // deliberately destroys in `_reconcileLocalCredentialsForDirectoryManaged` — is\n // ORGANIZATION-scoped by construction.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n requiresStepUpAuthentication: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [Users_Operations.ASSIGN_ROLES]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // ADDITIVE grant. `roles` is the REQUEST contract; the custom implementation translates it\n // into a union over the persisted `appRoles` array, gates it against the caller's own role\n // ceiling, and emits USER_APP_ROLES_CHANGED. Before that implementation existed, `roles`\n // named no schema path, so the generic core UPDATE persisted nothing and answered 200.\n requestDto: z.object({\n roles: z.array(AppRolesSchema).min(1),\n reason: z.string().max(500).optional()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [Users_Operations.REVOKE_ROLES]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // SUBTRACTIVE revocation — a set difference against the persisted `appRoles`, never a blind\n // overwrite. Ceiling-gated like the grant: an administrator who may not GRANT a role must\n // not be able to STRIP it either, or the cheapest attack on a privileged account is to\n // remove the authority of whoever could intervene.\n requestDto: z.object({\n roles: z.array(AppRolesSchema).min(1),\n reason: z.string().max(500).optional()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [Users_Operations.SUSPEND_USER]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects access\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Implemented by the shared status-transition factory. `suspensionDuration` is in DAYS\n // and is resolved to an absolute `scheduledReactivationAt` at write time — a duration is\n // meaningless without the moment it is counted from, and the row records no such moment.\n requestDto: z.object({\n reason: z.string().min(1).max(500),\n suspensionDuration: z.number().min(1).optional(), // Days\n notifyUser: z.boolean().default(true)\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === UserStatus.ACTIVE;\n }\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [Users_Operations.UNSUSPEND_USER]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, medium risk\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Implemented by the shared status-transition factory (SUSPENDED → ACTIVE), which also\n // clears any pending `scheduledReactivationAt` so a manual unsuspend does not leave the\n // sweep's deadline behind for a later suspension to inherit.\n //\n // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this declaration the trail\n // would record every suspension (HIGH) and none of the reinstatements — leaving an\n // account that was suspended and cleared reading as still suspended.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n auditableEvent: { auditBelowRiskFloor: true },\n requestDto: z.object({\n reason: z.string().max(500).optional(),\n notifyUser: z.boolean().default(true)\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === UserStatus.SUSPENDED;\n }\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n /*\n Administrator-compelled credential reset.\n \n Implemented by `createUserForcePasswordResetFactories`, which mints a single-use\n * PASSWORD_RESET token for the target, mails the reset link to the TARGET, revokes the\n * target's live sessions, and emits `USER_PASSWORD_RESET_FORCED` naming the acting\n * administrator and their reason.\n \n Three fields the original declaration carried are deliberately gone:\n \n - `customResponseDto: { resetToken, resetUrl }` — an account-takeover primitive. An\n * administrator holding the link can set the user's password and then authenticate AS\n * them; with no actor claim on a session JWT, nothing downstream could tell that apart\n * from a genuine login, and the owner would never be told. The link now goes only to the\n * account owner's inbox, and the response carries non-secret metadata.\n * - `resetExpirationHours` (1–168) — a caller-widenable credential-recovery window is a\n * persistence mechanism, not a recovery one. The TTL is now a framework policy constant.\n * - `notifyUser` — notifying the owner is the MECHANISM (the mail carries the only copy\n * of the link), not an option an operator can decline.\n \n `reason` stays and is mandatory: it is what an auditor reads when asking why a credential\n * was reset out-of-band.\n \n assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n * intervention is authorized, attributable, justified, and evicts existing access.\n /\n [Users_Operations.FORCE_PASSWORD_RESET]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects authentication\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n reason: z.string().min(1).max(500)\n }),\n customResponseDto: z.object({\n /* When the emailed reset link stops working. Non-secret — the link itself is not returned. /\n expiresAt: z.date(),\n /* Always true today; explicit so the caller can see the eviction happened. */\n sessionsRevoked: z.boolean()\n }),\n // A deleted identity has no credential path worth resetting; the service rejects it\n // with a 409. Hides the roster action rather than letting it 409 on click.\n enabledCondition: ({ currentObject }) => {\n return currentObject.status !== UserStatus.DELETED;\n }\n }\n ],\n // The ADMIN-AUDIT copy. The user-facing reset mail is the system PASSWORD_RESET template\n // dispatched by the auth service when the token is minted — deliberately not duplicated\n // into this resource-operation fan-out, which would create a second reset email that can\n // drift from the one the self-service flow sends.\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n },\n});\n"]}
1	+ {"version":3,"file":"users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,UAAU,EACV,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,6CAA6C;AAC7C,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAEnF,oCAAoC;AACpC,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC;AAEF,qEAAqE;AACrE,MAAM,yBAAyB,GAAG;IAChC,GAAG,mBAAmB;IACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;IACvD,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,gCAAgC;CACrD,CAAC;AAEF,iDAAiD;AACjD,MAAM,uBAAuB,GAAG,CAAC,GAAG,iBAAiB,EAAE,QAAQ,CAAU,CAAC;AAE1E,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,+FAA+F;AAC/F,gGAAgG;AAChG,uFAAuF;AACvF,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,iFAAiF;AACjF,EAAE;AACF,4CAA4C;AAC5C,gGAAgG;AAChG,qFAAqF;AACrF,8FAA8F;AAC9F,iGAAiG;AACjG,sEAAsE;AACtE,gGAAgG;AAChG,kFAAkF;AAClF,kGAAkG;AAClG,wFAAwF;AACxF,0EAA0E;AAC1E,2FAA2F;AAC3F,8DAA8D;AAC9D,8DAA8D;AAC9D,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,sEAAsE;AACtE,EAAE;AACF,2EAA2E;AAC3E,+FAA+F;AAC/F,qFAAqF;AACrF,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,mGAAmG;AACnG,EAAE;AACF,4FAA4F;AAC5F,yCAAyC;AACzC,8FAA8F;AAC9F,oGAAoG;AACpG,8FAA8F;AAC9F,oFAAoF;AACpF,qFAAqF;AACrF,0FAA0F;AAC1F,iCAAiC;AACjC,mGAAmG;AACnG,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,mGAAmG;AACnG,6FAA6F;AAC7F,mGAAmG;AACnG,gGAAgG;AAChG,4FAA4F;AAC5F,gGAAgG;AAChG,iGAAiG;AACjG,yDAAyD;AACzD,EAAE;AACF,4CAA4C;AAC5C,iGAAiG;AACjG,0EAA0E;AAC1E,iGAAiG;AACjG,iGAAiG;AACjG,6DAA6D;AAC7D,6FAA6F;AAC7F,wEAAwE;AACxE,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,wBAAwB;AACxB,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,uFAAuF;AACvF,mGAAmG;AACnG,4EAA4E;AAC5E,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,sCAAsC;AACtC,sEAAsE;AACtE,MAAM,CAAN,IAAY,gBAsBX;AAtBD,WAAY,gBAAgB;IAC1B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;IACnC,iEAA6C,CAAA;IAC7C;;;;;;;;;;;;;OAaG;IACH,mDAA+B,CAAA;AACjC,CAAC,EAtBW,gBAAgB,KAAhB,gBAAgB,QAsB3B;AAWD;;EAEE;AACF,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;IAC1C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACnF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,uBAAuB;IAE/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,6BAA6B,EAAE,KAAK;IAEpC,mFAAmF;IACnF,8EAA8E;IAC9E,sFAAsF;IACtF,sFAAsF;IACtF,qFAAqF;IACrF,2FAA2F;IAC3F,0FAA0F;IAC1F,EAAE;IACF,iEAAiE;IACjE,iFAAiF;IACjF,oFAAoF;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,kFAAkF;IAClF,iFAAiF;IACjF,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,2FAA2F;QAC3F,8EAA8E;KAC/E;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;;;OAMG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,gBAAgB;IAEjC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oFAAoF;oBACpF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,uFAAuF;oBACvF,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,uFAAuF;oBACvF,0FAA0F;oBAC1F,wFAAwF;oBACxF,2FAA2F;oBAC3F,sCAAsC;iBACvC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,yFAAyF;oBACzF,kFAAkF;oBAClF,oCAAoC,EAAE,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,2EAA2E;oBAC3E,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,2EAA2E;oBAC3E,yCAAyC;oBACzC,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,gEAAgE;oBAChE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,yEAAyE;oBACzE,yEAAyE;oBACzE,uEAAuE;oBACvE,mEAAmE;oBACnE,yEAAyE;oBACzE,2EAA2E;oBAC3E,wEAAwE;oBACxE,2EAA2E;oBAC3E,mEAAmE;oBACnE,0EAA0E;oBAC1E,gBAAgB,EAAE;wBAChB,OAAO;wBACP;4BACE,UAAU,EAAE,KAAK;4BACjB,eAAe,EAAE,gBAAgB,CAAC,aAAa;4BAC/C,gBAAgB,EAAE,QAAQ;4BAC1B,mEAAmE;4BACnE,sCAAsC;yBACvC;qBACF;oBACD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,EAAE;oBACF,uFAAuF;oBACvF,iFAAiF;oBACjF,0FAA0F;oBAC1F,qFAAqF;oBACrF,uFAAuF;oBACvF,wFAAwF;oBACxF,mEAAmE;iBACpE;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wDAAwD;oBACvG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qEAAqE;oBACrE,uEAAuE;oBACvE,kDAAkD;oBAClD,EAAE;oBACF,2DAA2D;oBAC3D,2FAA2F;oBAC3F,sFAAsF;oBACtF,EAAE;oBACF,2FAA2F;oBAC3F,+EAA+E;oBAC/E,+EAA+E;iBAChF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,iFAAiF;oBACjF,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,+FAA+F;oBAC/F,gGAAgG;oBAChG,gGAAgG;oBAChG,iGAAiG;oBACjG,+FAA+F;oBAC/F,iGAAiG;oBACjG,qDAAqD;oBACrD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gCAAgC;oBAC/E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,2FAA2F;oBAC3F,qFAAqF;oBACrF,kFAAkF;oBAClF,gFAAgF;oBAChF,uCAAuC;oBACvC,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,2FAA2F;oBAC3F,2FAA2F;oBAC3F,yFAAyF;oBACzF,uFAAuF;oBACvF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4FAA4F;oBAC5F,0FAA0F;oBAC1F,uFAAuF;oBACvF,mDAAmD;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,6CAA6C;oBAC5F,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,yFAAyF;oBACzF,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;wBAClC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO;wBACzD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;YACjC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,8BAA8B;oBAC7E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,sFAAsF;oBACtF,mFAAmF;oBACnF,qEAAqE;oBACrE,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;wBACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC;oBACvD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BG;QACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,uFAAuF;oBACvF,iFAAiF;oBACjF,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,sFAAsF;oBACtF,kFAAkF;oBAClF,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,6DAA6D;wBAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;wBAClC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE;YAChC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,oCAAoC,EAAE,IAAI;oBAC1C,wFAAwF;oBACxF,2FAA2F;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB;;;;;;;2BAOG;wBACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;qBAC1C,CAAC;iBACH;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qDAAqD;oBACpG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;qBACnC,CAAC;oBACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,+FAA+F;wBAC/F,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;wBACnB,+EAA+E;wBAC/E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;qBAC7B,CAAC;oBACF,oFAAoF;oBACpF,2EAA2E;oBAC3E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;oBACrD,CAAC;iBACF;aACF;YACD,yFAAyF;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,kDAAkD;YAClD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KAEF;CACF,CAAC,CAAC","sourcesContent":["/*\n Users Shared Resource Configuration\n \n Resource configuration for administrative user management operations.\n * Handles user lifecycle, role management, and administrative actions.\n /\n\nimport { z } from 'zod';\nimport {\n UserSchema,\n UserStatus,\n UserTheme\n} from './users.shared.schemas';\nimport { AppRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Sort and filter fields for user management\nconst USERS_SORT_FIELDS = ['createdAt', 'updatedAt', 'joinedAt', 'email'] as const;\n\n// App users get basic filter fields\nconst USERS_FILTER_FIELDS = {\n status: z.enum(UserStatus),\n email: z.string(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst USERS_ADMIN_FILTER_FIELDS = {\n ...USERS_FILTER_FIELDS,\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n joinedAt: z.date(), // Admin can filter by join date\n};\n\n// App Admin gets additional sorting capabilities\nconst USERS_ADMIN_SORT_FIELDS = [...USERS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for user management\n//\n// Invitation is intentionally absent. Organization invitations are created by\n// the organization-members lifecycle, where the pending membership, invitee\n// identity, token and email are produced together. A previous `send_invitation`\n// users operation declared an invitation-receipt DTO but registered no backend\n// implementation capable of producing it. Reintroduce an application-wide\n// invitation operation only with a real lifecycle owner and handler; an\n// API_CALL declaration by itself is not an implementation.\n//\n// IMPERSONATION IS NOT A TOKEN MINT — IT IS AN IDENTITY SUBSTRATE THE FRAMEWORK DOES NOT HAVE.\n// `IMPERSONATE` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ reason, durationMinutes, auditLog }` and promising a\n// `{ impersonationToken, expiresAt, auditId }` response, and was removed on 2026-08-01: it was\n// ROUTED but never implemented. With `resourceOperationLike: READ` the generic core path simply\n// returned the target's user row, so the most dangerous verb in the catalogue answered\n// HTTP 200* — an operator is told an impersonation session exists when none does.\n//\n// Do NOT re-declare it as a plain token mint. A minted session JWT is today byte-for-byte\n// indistinguishable from a genuine one: the payload is `{…, sub: userId, aud: 'AUTH_TOKEN' }`\n// with NO actor claim, and `ExecutionContext` has no \"acting as\" dimension. Every audit event\n// raised during such a session would be attributed to the impersonated USER rather than the\n// administrator — the framework would manufacture false attribution in exactly the records an\n// auditor relies on. That is strictly worse than having no impersonation at all.\n//\n// Re-declaring requires, as one workstream:\n// 1. an actor claim on the session JWT (RFC 8693 `act`-style: `sub` = target, actor = admin),\n// minted through a dedicated path — never by reusing the ordinary login issuer;\n// 2. `ExecutionContext` propagation of that actor, so it reaches every downstream consumer;\n// 3. actor-attributed audit events — a new `CoreAuditableEventType` pair for session start/end\n// plus actor stamping on every event raised while impersonating;\n// 4. an explicit revocation path (revoking the impersonation must not log the real user out);\n// 5. a server-side hard duration cap from configuration — NOT a caller-supplied\n// `durationMinutes`, and NOT a caller-supplied `auditLog` flag: an audit trail the actor can\n// switch off is not an audit trail, which is why that field is not preserved here;\n// 6. notification to the impersonated user, not only to administrators;\n// 7. a forbidden-while-impersonating operation set (credential change, account deletion,\n// API-key/token minting, and any further impersonation);\n// 8. an unmistakable frontend banner for the whole session.\n//\n// assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE · TODO(assurance-control) — privileged access\n// under another identity must be authorized, time-boxed, and attributable to the human actor.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n//\n// ACCOUNT MERGE IS A MULTI-RESOURCE CAPABILITY — NOT AN UPDATE ON `users`.\n// `MERGE_ACCOUNTS` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ targetUserId, keepPrimaryUser, mergeProfile, mergePreferences,\n// mergeOrganizations, reason }` and promising a `{ mergedUser, removedUserId, mergedDataSummary }`\n// response, and was removed on 2026-08-01: it was ROUTED but never implemented. Not one request\n// field is a persisted `users` field, so the controller and repository strict parses left an empty\n// `$set` — nothing merged, nothing was removed, and the declared response could never be produced.\n//\n// It was removed rather than implemented because nothing asks for it AND the identity model\n// prevents the duplicate class it names:\n// - `UserSchema.email` is the STRICT unique identity anchor — \"there is never more than one\n// `User` per email\". All five provisioning paths (self-registration, org-admin invite, SSO JIT,\n// SCIM, anonymous transposition) find-or-create by the normalized value; `.toLowerCase()`\n// closes the casing fork and `.excludeFromUpdate()` keeps the anchor immutable.\n// - The multi-provider case — one human, several IdPs — is already first-class via\n// `USER_IDENTITY_LINKS` (many links per user, compound-unique per tenant connection).\n// There is nothing to merge.\n// - No duplicate-detection surface exists anywhere, so nothing could ever supply `targetUserId`.\n// The verb had no consumer AND no producer.\n//\n// Do NOT re-declare it as an `UPDATE` on `users`. A merge is a transactional identity move across\n// every resource holding a `userId` FK (~21 engine schema/resource-config files declare one, plus\n// every app-defined resource the engine cannot enumerate), and the framework has no such primitive\n// today: the closest prior art, `AnonymousSessionBackendService.transposeOwnership()`, loops\n// resource types accumulating `failedTypes[]` and reports partial failure instead of rolling back.\n// The same problem in its EASIER form — a receiving identity with no competing state — was also\n// left undone: `ResourceTranspositionPolicy.MERGE` was declared vocabulary that no resource\n// selected and that warned \"not yet implemented — falling back to ADD\". It was REMOVED from the\n// enum on 2026-09-08 (#418) rather than implemented, on the same reasoning as this note: a merge\n// primitive is owed before either surface can offer one.\n//\n// Re-declaring requires, as one workstream:\n// 1. a duplicate-detection surface that produces merge candidates — without it the verb has no\n// caller, which is how the removed declaration ended up unreachable;\n// 2. a cross-resource transaction via `resolveResourceOperationTransactionPersistenceContract`\n// (`transactionalCore` + named `transactionParticipants`), NOT a per-resource loop that can\n// half-apply and leave two partially-merged identities;\n// 3. an FK-graph walk reusing the subject-erasure traversal in `compliance/` rather than a\n// re-derived inventory that silently misses app-defined resources;\n// 4. explicit conflict resolution for the 1:1 compositions (`USER_PROFILES`, `USER_PREFERENCES`\n// are `.isUnique()` per user) and for two memberships in the same organization — the removed\n// `mergeProfile` / `mergePreferences` / `mergeOrganizations` booleans named the axes but\n// decided nothing;\n// 5. a settled, WRITTEN-DOWN answer for the losing user's audit history. It must NOT be silently\n// rewritten: `auditable-events.shared.schema.ts` is the densest `userId` holder in the engine\n// (32 occurrences), and re-pointing those rows would forge the record an auditor relies on;\n// 6. a dedicated auditable event for the merge itself — the removed operation emitted nothing at\n// all. (Operation-level auditing now exists via risk-tiered `RESOURCE_OPERATION_PERFORMED`\n// emission, so a reinstated merge verb would inherit a row from its declared risk level; it\n// would still need its own event to name the two identities being consolidated.);\n// 7. a decision on the erasure interaction: a merged-away identity that was subject to retention\n// must not resurrect scrubbed personal data through the surviving row.\n//\n// assurance-control: WILDO.IDENTITY.LIFECYCLE · TODO(assurance-control) — consolidating two\n// identities is a privileged identity-lifecycle change and must be authorized, attributable, and\n// non-destructive to the audit trail.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\nexport enum Users_Operations {\n ASSIGN_ROLES = 'assign_roles', // Assign application roles\n REVOKE_ROLES = 'revoke_roles', // Revoke application roles\n SUSPEND_USER = 'suspend_user', // Suspend user account\n UNSUSPEND_USER = 'unsuspend_user', // Unsuspend user account\n REACTIVATE_USER = 'reactivate_user', // Reactivate a SELF-deactivated account (INACTIVE → ACTIVE)\n FORCE_PASSWORD_RESET = 'force_password_reset', // Force password reset\n /*\n The audited see-through read of a RETAINED (erased-and-impersonalized) user row (#490).\n \n `retentionPolicy: RETAIN_AND_IMPERSONALIZE` keeps the row and scrubs its subject, and the M5a\n * hide-predicate then makes it unreadable through every ordinary door — deliberately. The engine\n * has held the audited way back in (`readRetainedAsSystem`) since that landed, and *nothing could\n reach it*: the primitive was referenced by the factory that derives its grant and by prose, and\n by no caller. So the only route to a retained record was a database console, which is the\n * unaudited path the primitive exists to replace.\n \n This is that route. It is not a second read of the users table — it reveals personal data a\n * retention policy deliberately made unreadable, which is why it is its own operation with its own\n * role gate, its own mandatory justification and its own audit row.\n /\n READ_RETAINED = 'read_retained',\n}\n\ntype UsersCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.UPDATE\n \| CoreResourceOperation.UPDATE_MANY\n \| CoreResourceOperation.DELETE;\n\n/\nUsers Resource Configuration Factory\n/\nexport const usersResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof Users_Operations,\n UsersCoreOperations,\n typeof UserSchema\n>({\n mainSchema: UserSchema,\n resourceIdentifier: CoreResourceType.USERS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Users are app-scoped\n\n /\n `/users/{userId}` names the TARGET of an administrative action, never the caller.\n \n This resource's `resourceFieldIdentifier` is `userId` — the same key the W3.6 identity-coherence\n * guard compares against the JWT subject. Without this declaration that guard read every\n * `/users/{targetId}` request as \"the caller claims to be targetId\" and refused it with\n * `403 authorization_user_id_mismatch`, which made the ENTIRE administrative surface unreachable\n * cross-user: `assign_roles`, `revoke_roles`, `suspend_user`, `unsuspend_user`,\n * `reactivate_user`, `force_password_reset`, the admin READ and the core UPDATE/DELETE. Every one of those is\n * documented in the resource specification as acting on \"another user's record\" and is surfaced in\n * the admin UI as a per-row action, so the framework contradicted itself.\n \n ⚠️ The SIBLING resource must keep the default. `USER_SELF` is a second configuration over the\n * SAME collection and shares this exact field identifier (\"Same as USERS but different context\"),\n * but there the segment genuinely names the caller — so it stays `true` and its horizontal-IDOR\n * refusal keeps holding. The two are indistinguishable structurally, which is precisely why this\n * is declared rather than inferred.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an administrative action on another principal\n * is authorized by the caller's ROLE, not by the caller and the subject being the same person.\n /\n primaryKeyIdentifiesInitiator: false,\n\n // create: org-admin invite eagerly provisions a `User{status: PENDING_INVITATION}`\n // in-process (the invitee has no account yet). The API_CALL CREATE variant is\n // APP_ADMIN_SUPER_ADMIN-gated AND manually omits `status`/`appRoles` from its DTO, so\n // a plain create could neither be issued by the org admin nor persist the non-default\n // status. Opt CREATE into the trusted `createAsSystem` path (fail-closed elsewhere):\n // the synthesized super-admin context satisfies the ACL and `preserveServerInjectedFields`\n // re-attaches `status` past the DTO strip. See organization-member-custom-implementation.\n //\n // read: the INBOUND_CONTACTS anonymous-CREATE lead-triage prefix\n // (`inbound-contact-custom-implementation`) must look up a user by email from an\n // ANONYMOUS context that cannot read USERS. It routes that request-triggered bypass\n // through the sanctioned `readAsSystem` (fail-closed + `SYSTEM_CONTEXT_READ` audit)\n // rather than a hand-built super-admin EC. The caller enforces its own boundary: it\n // consumes ONLY `.status` and returns ONLY a `.isBackendOnly()` enum, so the full\n // super-admin row never reaches the anonymous submitter (no enumeration oracle).\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n read: ResourceSystemAccessMode.ALLOWED,\n /\n Trusted server-side ACTIVATION / DEACTIVATION of a user's lifecycle `status`.\n \n `status` is `.excludeFromUpdate()`, so the client-facing UPDATE contract cannot carry it and\n * the lifecycle verbs (`suspend_user` / `unsuspend_user`) own the administrative transitions.\n * But four trusted flows legitimately move `status` WITHOUT a caller — email verification\n * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning\n * (`→ INACTIVE`) — and none of them is a lifecycle verb: they are consequences of an\n * out-of-band fact (a confirmed email, a directory row disappearing), not an operator decision\n * with a reason and a state machine.\n \n `updateAsSystem` is the door for exactly that shape, and it re-attaches the excluded field\n * past the strict request-DTO parse. Without this grant those writes are silently stripped and\n * users simply never activate — no error, no signal.\n /\n update: ResourceSystemAccessMode.ALLOWED,\n // `updateMany` + `seeRetained` are NOT authored here — `retentionPolicy` derives both, and\n // authoring either as FORBIDDEN is a config error. Leave them to the factory.\n },\n\n /\n Subject erasure scrubs-and-RETAINS the user row instead of deleting it: the retained financial\n * records (invoices, usage) keep a resolvable foreign key, now pointing at an anonymized subject.\n * `RETAIN_AND_IMPERSONALIZE` because this row DOES hold personal data of its own — `email` — which\n * the scrub masks to `ERASED_USER_EMAIL`. A retained row is hidden from every normal read and\n * frozen; only the audited `seeRetained` path can reach it.\n \n ⚠️ `USER_SELF` declares the SAME policy on purpose. It is a second resource config over the SAME\n * `users` collection (see `getCollectionNameForResource` in the zod→mongoose convertor: separate\n * models, one collection). Retention governance is per-config, so opting in only here would leave\n * an erased row readable AND updatable through the USER_SELF door, and would put a PLAIN unique\n * index on `email` alongside this one's retention-scoped index — which the second erasure would\n * then collide with (E11000) and abort. The two configs must be changed together.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n },\n\n /\n The subject IS this row: erasing user `X` ends the session of user `X`. Declaring it makes that\n * revocation EXPLICIT — until now it happened only as a side effect of the retention row-hide (the\n * auth fronts re-read the user, find the row hidden, and 401) plus the scrub bumping\n * `authorizationVersion`. Neither is a written revocation, so the guarantee rested entirely on two\n * unrelated mechanisms continuing to behave that way.\n /\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n /\n Subject-export disclosure. The operator-facing export subject.\n /\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE,\n ],\n\n customOperation: Users_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_USER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n // ⚠️ DELIBERATELY NOT `admitsCrossSubjectUserAdministration`. This variant is gated\n // `APP_USER`, so admitting cross-subject addressing here would let ANY authenticated user\n // read ANY other user's row — `email`, `appRoles`, `status` — for every application built\n // on the framework. Reading another user is the `admin` variant's job, directly below.\n //\n // The pre-existing comment on this line read \"v1: app users can view other users\", which\n // the USER_SELF-scope authorization has never permitted (`authorizeUserSelf` requires the\n // addressed row to BE the caller). The claim was aspirational, not behaviour — removed\n // rather than acted on, because acting on it is a privacy decision for the product, not a\n // side effect of fixing the administrative surface. If app users SHOULD be able to view\n // each other, that wants its own decision, its own DTO narrowing (this variant returns the\n // full row today) and its own probes.\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n // THE administrative read. Gated `APP_ADMIN_VIEWER`, and the surface the admin UI's user\n // list is built on — so it must be able to address someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n // Framework-internal LIST only — INTERNAL_CALL registers NO HTTP route, so\n // this is never reachable by an app user (or anyone) over HTTP. It exists for\n // internal enumeration (e.g. enrichment / labelling), invoked with a system\n // execution context that carries APP_ADMIN_SUPER_ADMIN. `roles: []` is inert\n // here precisely because it is not URL-bearing and role-gating is bypassed for\n // internal execution — it is NOT \"any app user can list users\" (an empty roles\n // array on a URL-bearing variant would be fail-closed → 403). App users do not\n // get a global list-all; they READ a user (APP_USER) and enumerate via the\n // org-scoped SEARCH people-picker below.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n // The ONLY HTTP-exposed LIST — admin-gated global user listing.\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n // `email` is the only human-searchable field ON the user row. First/last\n // name and display name live on `USER_PROFILES` (1:1, keyed by `userId`)\n // and are MUTABLE there, so they are searched RELATIONALLY rather than\n // denormalized: the framework searches `USER_PROFILES` (by its own\n // searchable fields — firstName/lastName/displayName) and intersects the\n // matching `userId`s with this resource's `_id`. (`username` was a phantom\n // field — it exists on no user collection — and has been removed.) This\n // powers the org-scoped \"people picker\" (e.g. a `createdByUserId` filter):\n // the junction scope filter keeps results within the caller's org.\n // See SearchableRelationDescriptor in resources-config.shared.schemas.ts.\n searchableFields: [\n 'email',\n {\n localField: '_id',\n relatedResource: CoreResourceType.USER_PROFILES,\n relatedJoinField: 'userId',\n // fields omitted → defaults to USER_PROFILES' own searchableFields\n // (firstName, lastName, displayName).\n },\n ],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: USERS_ADMIN_FILTER_FIELDS,\n sortFields: USERS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 200,\n }\n ],\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only operation\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // DTOs auto-derived from decorators (excludeFromCreate on _id, createdAt, updatedAt).\n //\n // ⚠️ `status` and `appRoles` ARE part of this create contract. An earlier comment here\n // claimed they were \"manually excluded\"; they never were — neither field carries\n // `.excludeFromCreate()` and this variant declares no narrowing `requestDto`, so both are\n // accepted (confirmed against the generated OpenAPI create schema). `appRoles` being\n // caller-settable is exactly why this path carries an explicit role-ceiling gate — see\n // `user-role-administration.custom-impl.backend.service.ts`. An absent `appRoles` falls\n // back to the schema default and is NOT treated as a caller grant.\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.UPDATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, users manage themselves via USER_SELF\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // DTOs auto-derived from decorators. Only `appRoles` and `userTypes`\n // remain writable: `_id`, `email`, `status`, `scheduledReactivationAt`\n // and timestamps all carry `excludeFromUpdate()`.\n //\n // Because `appRoles` is caller-settable here, this path is\n // the one that actually grants application authority, and it carries the role-ceiling gate\n // plus a USER_APP_ROLES_CHANGED audit event (`user-role-administration.custom-impl`).\n //\n // This whole-array REPLACE is why the additive `assign_roles` / subtractive `revoke_roles`\n // verbs are not redundant with it: reaching the same end-state here requires a\n // read-modify-write that races with, and silently clobbers, a concurrent edit.\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [\n {\n // The CAPABILITY without a new HTTP surface. `retentionPolicy` requires UPDATE_MANY because\n // the impersonalize writer scrubs rows in place through `updateManyAsSystem`. Exposing a bulk\n // user update over HTTP would be a genuinely dangerous admin surface (mass role/status\n // rewrites), and INTERNAL_CALL registers NO route — like the LIST default above.\n //\n // ⚠️ INTERNAL_CALL, not* REPOSITORY_ONLY. Both are route-less, but the three retention\n // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n // their operation through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL /\n // API_CALL / API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is deliberately excluded there and served\n // by the separate `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant here\n // therefore satisfies the factory's \"UPDATE_MANY exists\" guard at boot and then FAILS TO RESOLVE\n // when an erasure actually runs. `roles` is inert on a non-URL-bearing variant (role gating is\n // bypassed for internal execution); the real gate is the derived `systemAccessPolicy.updateMany`\n // grant, which the trusted writer is fail-closed on.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n }\n ],\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, critical risk\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n // Irreversible identity destruction — the caller must prove they are still themselves,\n // not merely that they held a session at some point. `riskLevel: CRITICAL` above does NOT\n // do this: it drives danger-zone placement and typed confirmation in the UI and is read by\n // no authorization code. Nor does the per-user-type `stepUpAuth` policy, which is opt-in,\n // off by default and satisfied by any authentication newer than `maxAgeSeconds`.\n //\n // The audience is the reason this one is safe to gate first: `APP_ADMIN_SUPER_ADMIN` is an\n // APPLICATION-level authority, whereas the population that provably cannot step up —\n // directory-managed (SCIM) users, whose `passwordHash` and passkeys the framework\n // deliberately destroys in `_reconcileLocalCredentialsForDirectoryManaged` — is\n // ORGANIZATION-scoped by construction.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n requiresStepUpAuthentication: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [Users_Operations.ASSIGN_ROLES]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // ADDITIVE grant. `roles` is the REQUEST contract; the custom implementation translates it\n // into a union over the persisted `appRoles` array, gates it against the caller's own role\n // ceiling, and emits USER_APP_ROLES_CHANGED. Before that implementation existed, `roles`\n // named no schema path, so the generic core UPDATE persisted nothing and answered 200.\n requestDto: z.object({\n roles: z.array(AppRolesSchema).min(1),\n reason: z.string().max(500).optional()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [Users_Operations.REVOKE_ROLES]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // SUBTRACTIVE revocation — a set difference against the persisted `appRoles`, never a blind\n // overwrite. Ceiling-gated like the grant: an administrator who may not GRANT a role must\n // not be able to STRIP it either, or the cheapest attack on a privileged account is to\n // remove the authority of whoever could intervene.\n requestDto: z.object({\n roles: z.array(AppRolesSchema).min(1),\n reason: z.string().max(500).optional()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [Users_Operations.SUSPEND_USER]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects access\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Implemented by the shared status-transition factory. `suspensionDuration` is in DAYS\n // and is resolved to an absolute `scheduledReactivationAt` at write time — a duration is\n // meaningless without the moment it is counted from, and the row records no such moment.\n requestDto: z.object({\n reason: z.string().min(1).max(500),\n suspensionDuration: z.number().min(1).optional(), // Days\n notifyUser: z.boolean().default(true)\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === UserStatus.ACTIVE;\n }\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [Users_Operations.UNSUSPEND_USER]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, medium risk\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Implemented by the shared status-transition factory (SUSPENDED → ACTIVE), which also\n // clears any pending `scheduledReactivationAt` so a manual unsuspend does not leave the\n // sweep's deadline behind for a later suspension to inherit.\n //\n // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this declaration the trail\n // would record every suspension (HIGH) and none of the reinstatements — leaving an\n // account that was suspended and cleared reading as still suspended.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n auditableEvent: { auditBelowRiskFloor: true },\n requestDto: z.object({\n reason: z.string().max(500).optional(),\n notifyUser: z.boolean().default(true)\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === UserStatus.SUSPENDED;\n }\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n /*\n The only door back from a SELF-deactivated account (#430).\n \n `user_self \| deactivate_account` writes INACTIVE, and until this verb existed nothing could\n * lift it: `REACTIVATE_ACCOUNT` needs a session, sign-in admits only ACTIVE users\n * (`_enforceUserStatus` refuses every other status), `unsuspend_user` refuses INACTIVE BY\n * DESIGN, and `status` is excluded from update. A person who deactivated their own account was\n * out permanently, and the only route back was a database write.\n \n ADMIN-TIER, which is door 2 of the three that were on the table, and its two costs were\n * accepted rather than discovered: every self-deactivated user becomes a support ticket, and an\n * administrator can reactivate an account whose owner did not ask. The second is why `reason`\n * is MANDATORY here while `unsuspend_user` leaves it optional — an administrator reversing\n * someone else's own choice about their account owes an auditor a sentence, where lifting an\n * administrative suspension is merely undoing an administrative act.\n \n INACTIVE ONLY. A SUSPENDED account stays `unsuspend_user`'s business: an imposed halt and a\n * chosen departure are two states whose whole distinction is who may lift them, and widening\n * one verb to cover both was the option rejected precisely because it erases that.\n \n Implemented by the shared status-transition factory — which is also what routes the write\n * through the SYSTEM door. `status` is `.excludeFromUpdate()`, so a handler writing it directly\n * is stripped by the repository's strict re-parse and the operation reports success having\n * persisted nothing; that failure mode has already cost this repository four sibling\n * activations (`.claude/rules/invariant-call-site-enumeration.md` #8).\n \n assurance-control: WILDO.IDENTITY.LIFECYCLE — reinstating a deactivated principal is a\n * privileged identity-lifecycle change and must be authorized, attributable and audited.\n /\n [Users_Operations.REACTIVATE_USER]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is\n // still gated by `roles` above; this only admits the SUBJECT to be someone else.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this the trail would record\n // the departure (DEACTIVATE_ACCOUNT) and not the return — an account reinstated by an\n // administrator reading as still deactivated. Same reasoning as `unsuspend_user`.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n auditableEvent: { auditBelowRiskFloor: true },\n requestDto: z.object({\n // MANDATORY, unlike `unsuspend_user`'s: see the JSDoc above.\n reason: z.string().min(1).max(500),\n notifyUser: z.boolean().default(true),\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === UserStatus.INACTIVE;\n },\n },\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n ],\n },\n\n /\n Administrator-compelled credential reset.\n \n Implemented by `createUserForcePasswordResetFactories`, which mints a single-use\n * PASSWORD_RESET token for the target, mails the reset link to the TARGET, revokes the\n * target's live sessions, and emits `USER_PASSWORD_RESET_FORCED` naming the acting\n * administrator and their reason.\n \n Three fields the original declaration carried are deliberately gone:\n \n - `customResponseDto: { resetToken, resetUrl }` — an account-takeover primitive. An\n * administrator holding the link can set the user's password and then authenticate AS\n * them; with no actor claim on a session JWT, nothing downstream could tell that apart\n * from a genuine login, and the owner would never be told. The link now goes only to the\n * account owner's inbox, and the response carries non-secret metadata.\n * - `resetExpirationHours` (1–168) — a caller-widenable credential-recovery window is a\n * persistence mechanism, not a recovery one. The TTL is now a framework policy constant.\n * - `notifyUser` — notifying the owner is the MECHANISM (the mail carries the only copy\n * of the link), not an option an operator can decline.\n \n `reason` stays and is mandatory: it is what an auditor reads when asking why a credential\n * was reset out-of-band.\n \n assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n * intervention is authorized, attributable, justified, and evicts existing access.\n /\n /\n See-through read of a retained subject (#490).\n \n ## Why it is UPDATE-like, when it plainly reads\n \n Same reasoning the webhook `testEndpoint` probe records, and for a sharper reason. Borrowing\n * READ yields a GET, and a GET carries its parameters in the URL — which would put the operator's\n * free-text `reason` into every access log, proxy log and browser history between here and the\n * server. A justification for revealing scrubbed personal data routinely NAMES someone: a\n * dispute, a legal hold, a subject. Putting it in a query string is a privacy defect, not an\n * inconvenience.\n \n The operation also has a real side effect — every call emits a `RETAINED_DATA_ACCESS` audit row\n * — so `x-idempotent` would have had to be false on a GET, which is the self-contradiction that\n * argument already produced once.\n \n ## Why `reason` is in the DTO and the caller's identity is NOT\n \n `accessingUserId` and `accessingUserRoles` reach the primitive from the EXECUTION CONTEXT, never\n * from the request. A body-supplied identity is a claim the caller writes about themselves, and\n * the entire value of the audit row is that it says who really looked. `reason` is the one thing\n * only the human can supply, so it is the one thing the request carries.\n \n `admitsCrossSubjectUserAdministration` is declared because the subject is by definition someone\n * else: a retained row belongs to an erased person, and the caller is an administrator. The\n * `roles` gate above still decides WHO may call it.\n /\n [Users_Operations.READ_RETAINED]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n admitsCrossSubjectUserAdministration: true,\n // The highest risk level the vocabulary has, and it is not decoration: this is the only\n // operation in the resource that reveals personal data an erasure was performed to remove.\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n /\n Why this reveal is happening — a legal hold, a dispute, an investigation.\n \n Required, and the length floor is enforced twice on purpose: here, so the request is\n * refused before anything is read, and again inside `readRetainedAsSystem`, which\n * fail-closes on a blank attribution because the audit store persists `eventData`\n * unparsed. A reveal with no reason is an anonymous reveal.\n /\n reason: z.string().trim().min(1).max(500),\n }),\n }\n ],\n },\n\n [Users_Operations.FORCE_PASSWORD_RESET]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects authentication\n // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n admitsCrossSubjectUserAdministration: true,\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n reason: z.string().min(1).max(500)\n }),\n customResponseDto: z.object({\n /* When the emailed reset link stops working. Non-secret — the link itself is not returned. /\n expiresAt: z.date(),\n /* Always true today; explicit so the caller can see the eviction happened. */\n sessionsRevoked: z.boolean()\n }),\n // A deleted identity has no credential path worth resetting; the service rejects it\n // with a 409. Hides the roster action rather than letting it 409 on click.\n enabledCondition: ({ currentObject }) => {\n return currentObject.status !== UserStatus.DELETED;\n }\n }\n ],\n // The ADMIN-AUDIT copy. The user-facing reset mail is the system PASSWORD_RESET template\n // dispatched by the auth service when the token is minted — deliberately not duplicated\n // into this resource-operation fan-out, which would create a second reset email that can\n // drift from the one the self-service flow sends.\n userNotifications: [\n {\n target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n },\n});\n"]}

package/dist/esm/users/users.shared.schemas.d.ts CHANGED Viewed

@@ -17,6 +17,25 @@ import { AvailableLanguage, DateFormat, TimeFormat } from '@wildo-ai/presets-com
  * an erased subject without duplicating the literal.
  */
 export declare const ERASED_USER_EMAIL = "erased@erased.invalid";
+/**
+ * What a REQUIRED name field becomes when the subject is erased.
+ *
+ * `firstName` and `lastName` are `min(1)`, so REMOVE is not available to them — nulling a required
+ * field would leave a row the schema itself rejects on the next read. MASK with a value that is
+ * obviously not a name keeps the row parseable while carrying no information about the person.
+ *
+ * Deliberately the same placeholder as `ERASED_FILE_NAME_PLACEHOLDER`: a reader meeting `[erased]`
+ * in an export or an admin view should not have to learn a second vocabulary to recognise it.
+ */
+export declare const ERASED_USER_NAME = "[erased]";
+/**
+ * What an erased EXTERNAL identifier becomes — a provider's own id for the person.
+ *
+ * Distinct from `ERASED_USER_NAME` despite the same literal, because the two answer different
+ * questions and will diverge: a name is displayed to a human, an external id is matched against a
+ * provider's records. Merging them would make a future change to either silently change the other.
+ */
+export declare const ERASED_IDENTITY_VALUE = "[erased]";
 export declare enum UserStatus {
     ACTIVE = "ACTIVE",
     INACTIVE = "INACTIVE",
@@ -71,11 +90,42 @@ export declare const UserPreferences_UI_ThemeSchema: z.ZodObject<{
     theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof UserTheme>>>;
 }, z.core.$strip>;
 export type UserPreferences_UI_Theme = z.infer<typeof UserPreferences_UI_ThemeSchema>;
+/**
+ * A member's OWN regional choices — and every field is OPTIONAL, deliberately.
+ *
+ * **Absence is a real state and it is the point of this block**: it means the member has expressed
+ * no preference, so the value comes from the organization's own regional record
+ * (`OrganizationPreferences.timezone` / `.locale` / `.dateFormat` / `.timeFormat`), and only then
+ * from the framework fallback. `I18nContext` resolves that chain — member, then organization, then
+ * framework — and it can only do so because an unexpressed preference is representable here.
+ *
+ * All four carried a Zod `.default(...)` until 2026-09-08 (#410), and the defaults were not a
+ * convenience: they made the organization layer UNIMPLEMENTABLE. A `.default()` MATERIALIZES at
+ * parse, so every member with a preferences row carried `'UTC'`, `EN`, `LOCALE_DEFAULT` and
+ * `TWENTY_FOUR_HOUR` whether or not they had ever opened the settings screen — indistinguishable
+ * from having chosen them. A tenant that set `Europe/Paris` could never reach a single member,
+ * because there was no member left who had not "expressed" UTC.
+ *
+ * The same shape had already cost a decision elsewhere: `cancelImmediately: z.boolean().default(false)`
+ * made "the caller expressed no cancellation preference" unobservable, which is why the authored
+ * `defaultBehavior` policy beneath it was unimplementable rather than merely unimplemented (#408).
+ * A default one layer up erases the state the layer beneath exists to answer for.
+ *
+ * `locale` in particular was also WRONG on its own terms. `I18nContext` resolves it as
+ * `regional.locale ?? currentLanguage ?? 'en'`, so a materialized `EN` meant the left side always
+ * won and the resolved UI language was never consulted: a member using the application in French
+ * got `en` date, time and number formatting. Removing the default is what lets that `??` chain do
+ * what it was written to do.
+ *
+ * Note what did NOT change: the framework's fallbacks are unchanged, and they are still exactly
+ * these four values. A member in a tenant that has authored nothing sees precisely what they saw
+ * before — the difference is only that a tenant which HAS authored something is now heard.
+ */
 export declare const UserPreferences_RegionalSchema: z.ZodObject<{
-    timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/presets-components-models").CommonTimezone>, z.ZodString]>>>;
-    dateFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DateFormat>>>;
-    timeFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof TimeFormat>>>;
-    locale: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AvailableLanguage>>>>;
+    timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/presets-components-models").CommonTimezone>, z.ZodString]>>>;
+    dateFormat: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DateFormat>>>;
+    timeFormat: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof TimeFormat>>>;
+    locale: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AvailableLanguage>>>>;
 }, z.core.$strip>;
 export type UserPreferences_Regional = z.infer<typeof UserPreferences_RegionalSchema>;
 /**
@@ -119,10 +169,10 @@ export declare const UserPreferencesSchema: z.ZodObject<{
         theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof UserTheme>>>;
     }, z.core.$strip>>>;
     regional: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-        timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/presets-components-models").CommonTimezone>, z.ZodString]>>>;
-        dateFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DateFormat>>>;
-        timeFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof TimeFormat>>>;
-        locale: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AvailableLanguage>>>>;
+        timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/presets-components-models").CommonTimezone>, z.ZodString]>>>;
+        dateFormat: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DateFormat>>>;
+        timeFormat: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof TimeFormat>>>;
+        locale: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AvailableLanguage>>>>;
     }, z.core.$strip>>>>;
     languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
         primaryLanguage: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AvailableLanguage>>>>;
@@ -169,10 +219,10 @@ export declare const UserContextSchema: z.ZodObject<{
             theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof UserTheme>>>;
         }, z.core.$strip>>>;
         regional: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-            timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/presets-components-models").CommonTimezone>, z.ZodString]>>>;
-            dateFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DateFormat>>>;
-            timeFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof TimeFormat>>>;
-            locale: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AvailableLanguage>>>>;
+            timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/presets-components-models").CommonTimezone>, z.ZodString]>>>;
+            dateFormat: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DateFormat>>>;
+            timeFormat: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof TimeFormat>>>;
+            locale: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AvailableLanguage>>>>;
         }, z.core.$strip>>>>;
         languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
             primaryLanguage: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AvailableLanguage>>>>;

package/dist/esm/users/users.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"users.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EAAE,iBAAiB,EAAkB,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAKhH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,OAAO,YAAY;CACpB;AAED,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,UAAU;;;;;;;;;iBAoGrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,6BAA6B;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;;;;~~iBA+C5B~~,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mCAAmC;;;;;iBAK9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,QAAQ,wBAAwB;CACjC;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBAyChC~~,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
1	+ {"version":3,"file":"users.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EAAE,iBAAiB,EAAkB,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAKhH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,OAAO,YAAY;CACpB;AAED,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,UAAU;;;;;;;;;iBAoGrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,6BAA6B;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA0E5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mCAAmC;;;;;iBAK9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,8BAA8B;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,QAAQ,wBAAwB;CACjC;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuDhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/users/users.shared.schemas.js CHANGED Viewed

@@ -22,6 +22,25 @@ import { PersonalDataCategory } from '../compliance/privacy/personal-data-catego
  * an erased subject without duplicating the literal.
  */
 export const ERASED_USER_EMAIL = 'erased@erased.invalid';
+/**
+ * What a REQUIRED name field becomes when the subject is erased.
+ *
+ * `firstName` and `lastName` are `min(1)`, so REMOVE is not available to them — nulling a required
+ * field would leave a row the schema itself rejects on the next read. MASK with a value that is
+ * obviously not a name keeps the row parseable while carrying no information about the person.
+ *
+ * Deliberately the same placeholder as `ERASED_FILE_NAME_PLACEHOLDER`: a reader meeting `[erased]`
+ * in an export or an admin view should not have to learn a second vocabulary to recognise it.
+ */
+export const ERASED_USER_NAME = '[erased]';
+/**
+ * What an erased EXTERNAL identifier becomes — a provider's own id for the person.
+ *
+ * Distinct from `ERASED_USER_NAME` despite the same literal, because the two answer different
+ * questions and will diverge: a name is displayed to a human, an external id is matched against a
+ * provider's records. Merging them would make a future change to either silently change the other.
+ */
+export const ERASED_IDENTITY_VALUE = '[erased]';
 export var UserStatus;
 (function (UserStatus) {
     UserStatus["ACTIVE"] = "ACTIVE";
@@ -148,9 +167,9 @@ export const UserProfileSchema = z.object({
     // `onParentCreate` seed + the provisioning paths against a concurrent
     // double-create — the durable idempotency guarantee behind the declarative seed.
     userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),
-    firstName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
-    lastName: z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
-    displayName: z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),
+    firstName: addImpersonalizeWith(z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.MASK, { maskValue: ERASED_USER_NAME }),
+    lastName: addImpersonalizeWith(z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.MASK, { maskValue: ERASED_USER_NAME }),
+    displayName: addImpersonalizeWith(z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),
     /**
      * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored
      * as the standard file reference `{ fileId, updatedAt }` and rendered as a
@@ -159,7 +178,11 @@ export const UserProfileSchema = z.object({
      * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there
      * is no external-URL branch.
      */
-    avatar: z_file({
+    // REMOVE nulls the stored `{ fileId, updatedAt }` reference, which is what erasure can honestly
+    // promise here: the profile stops pointing at the person's face. It does NOT delete the underlying
+    // stored object — file bytes are owned by the file resource and its own lifecycle, and claiming
+    // otherwise in a schema comment would be the kind of unverified assertion this lane exists to stop.
+    avatar: addImpersonalizeWith(z_file({
         nature: FileNature.IMAGE,
         allowedMimeTypes: 'Images',
         maxSize: 2 * 1024 * 1024,
@@ -169,12 +192,12 @@ export const UserProfileSchema = z.object({
             aspectRatio: { width: 1, height: 1 },
             generateThumbnails: true,
         },
-    }).optional().dataCategories(PersonalDataCategory.IDENTITY),
+    }).optional().dataCategories(PersonalDataCategory.IDENTITY), RedactionType.REMOVE),
     // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never
     // what it will contain — a bio is a classic surface where a special category (a health condition,
     // a religious observance, a political affiliation) arrives unannounced, and no schema certifies
     // otherwise. Nothing here is a claim that it does NOT contain one.
-    bio: z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),
+    bio: addImpersonalizeWith(z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),
     /**
      * E.164 phone number (e.g. "+33123456789"). `z_phone()` carries the phone
      * metadata that drives the international phone INPUT on edit (country selector +
@@ -187,8 +210,8 @@ export const UserProfileSchema = z.object({
     // prototype-installed decorators at all (a decorator-WIDE gap, not specific to this one). A phone
     // number is contact-detail personal data by definition, so the escape hatch is load-bearing here
     // rather than a curiosity.
-    phoneNumber: addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),
-    title: z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL)
+    phoneNumber: addImpersonalizeWith(addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS), RedactionType.REMOVE),
+    title: addImpersonalizeWith(z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL), RedactionType.REMOVE)
 });
 export const UserPreferences_NotificationsSchema = z.object({
     email: z.boolean().default(true),
@@ -199,14 +222,45 @@ export const UserPreferences_NotificationsSchema = z.object({
 export const UserPreferences_UI_ThemeSchema = z.object({
     theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField(),
 });
+/**
+ * A member's OWN regional choices — and every field is OPTIONAL, deliberately.
+ *
+ * **Absence is a real state and it is the point of this block**: it means the member has expressed
+ * no preference, so the value comes from the organization's own regional record
+ * (`OrganizationPreferences.timezone` / `.locale` / `.dateFormat` / `.timeFormat`), and only then
+ * from the framework fallback. `I18nContext` resolves that chain — member, then organization, then
+ * framework — and it can only do so because an unexpressed preference is representable here.
+ *
+ * All four carried a Zod `.default(...)` until 2026-09-08 (#410), and the defaults were not a
+ * convenience: they made the organization layer UNIMPLEMENTABLE. A `.default()` MATERIALIZES at
+ * parse, so every member with a preferences row carried `'UTC'`, `EN`, `LOCALE_DEFAULT` and
+ * `TWENTY_FOUR_HOUR` whether or not they had ever opened the settings screen — indistinguishable
+ * from having chosen them. A tenant that set `Europe/Paris` could never reach a single member,
+ * because there was no member left who had not "expressed" UTC.
+ *
+ * The same shape had already cost a decision elsewhere: `cancelImmediately: z.boolean().default(false)`
+ * made "the caller expressed no cancellation preference" unobservable, which is why the authored
+ * `defaultBehavior` policy beneath it was unimplementable rather than merely unimplemented (#408).
+ * A default one layer up erases the state the layer beneath exists to answer for.
+ *
+ * `locale` in particular was also WRONG on its own terms. `I18nContext` resolves it as
+ * `regional.locale ?? currentLanguage ?? 'en'`, so a materialized `EN` meant the left side always
+ * won and the resolved UI language was never consulted: a member using the application in French
+ * got `en` date, time and number formatting. Removing the default is what lets that `??` chain do
+ * what it was written to do.
+ *
+ * Note what did NOT change: the framework's fallbacks are unchanged, and they are still exactly
+ * these four values. A member in a tenant that has authored nothing sees precisely what they saw
+ * before — the difference is only that a tenant which HAS authored something is now heard.
+ */
 export const UserPreferences_RegionalSchema = z.object({
-    timezone: TimezoneSchema.default('UTC').isSummaryField(),
-    // LOCALE_DEFAULT (not ISO_8601): "no expressed preference" must mean locale-driven
-    // rendering. A stored ISO_8601 default materializes at parse and masks the frontend's
-    // locale fallback (I18nContext), pinning every preference-less user to `YYYY-MM-DD`.
-    dateFormat: z.enum(DateFormat).systemEnum('DateFormat').default(DateFormat.LOCALE_DEFAULT),
-    timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').default(TimeFormat.TWENTY_FOUR_HOUR),
-    locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField()
+    timezone: TimezoneSchema.optional().isSummaryField(),
+    // LOCALE_DEFAULT (not ISO_8601) remains the framework FALLBACK, resolved in `I18nContext`: "no
+    // expressed preference" must mean locale-driven rendering. Storing it here would pin every
+    // preference-less member to it and mask both the organization layer and the locale fallback.
+    dateFormat: z.enum(DateFormat).systemEnum('DateFormat').optional(),
+    timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').optional(),
+    locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').optional().isSummaryField()
 });
 /**
  * The preference blocks a caller can address as a unit — the closed vocabulary behind
@@ -258,18 +312,20 @@ export const UserPreferencesSchema = z.object({
     // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it
     // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a
     // reader nothing the word "preferences" does not.
-    notifications: UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))
-        .dataCategories(PersonalDataCategory.USAGE),
-    privacy: UserPrivacySchema.default(UserPrivacySchema.parse({}))
-        .dataCategories(PersonalDataCategory.USAGE),
+    notifications: addImpersonalizeWith(UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))
+        .dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET),
+    privacy: addImpersonalizeWith(UserPrivacySchema.default(UserPrivacySchema.parse({}))
+        .dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET),
     ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),
     // Timezone and locale are the two that most clearly identify something about the person rather
     // than about the session — a timezone narrows where they are, which is why LOCATION rides here.
-    regional: UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()
-        .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),
+    // LOCATION as well as USAGE — a timezone and a locale narrow where a person is. RESET returns the
+    // application's own defaults, which is what a person who never chose still has.
+    regional: addImpersonalizeWith(UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()
+        .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]), RedactionType.RESET),
     // Enhanced language preferences
-    languagePreferences: UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()
-        .dataCategories(PersonalDataCategory.USAGE)
+    languagePreferences: addImpersonalizeWith(UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()
+        .dataCategories(PersonalDataCategory.USAGE), RedactionType.RESET)
 });
 export const UserContextSchema = UserSchema.extend({
     // New relationship-based field names (matching auto-generated context)