@wildo-ai/saas-models 1.1.3 → 1.1.4

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kCAkI9C,CAAC"}
+{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kCAkI9C,CAAC"}

package/dist/esm/users/user-identity-links.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,QAAQ,CACxD,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAW/D,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAmJjC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,QAAQ,CACxD,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAW/D,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAmJjC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/esm/users/user-preferences-reset.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-preferences-reset.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,mBAAmB,EACnB,eAAe,EAKhB,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AA2B5F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,2BAA2B,EACpC,kBAAkB,EAAE,eAAe,GAAG,SAAS,GAC9C,OAAO,CAAC,eAAe,CAAC,CAU1B"}
+{"version":3,"file":"user-preferences-reset.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,mBAAmB,EACnB,eAAe,EAKhB,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AA2B5F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,2BAA2B,EACpC,kBAAkB,EAAE,eAAe,GAAG,SAAS,GAC9C,OAAO,CAAC,eAAe,CAAC,CAU1B"}

package/dist/esm/users/user-preferences.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAWzG,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAyJvH,CAAC"}
+{"version":3,"file":"user-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAWzG,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAyJvH,CAAC"}

package/dist/esm/users/user-profiles.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-profiles.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-profiles.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAyBzG,oBAAY,uBAAuB;IACjC,aAAa,kBAAkB,CAAE,qBAAqB;IACtD,aAAa,kBAAkB,CAAE,qBAAqB;IACtD,mBAAmB,wBAAwB;CAC5C;AAED,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,CAAC;AAKtC,eAAO,MAAM,uDAAuD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;kBAkUpH,CAAC"}
+{"version":3,"file":"user-profiles.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-profiles.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAyBzG,oBAAY,uBAAuB;IACjC,aAAa,kBAAkB,CAAE,qBAAqB;IACtD,aAAa,kBAAkB,CAAE,qBAAqB;IACtD,mBAAmB,wBAAwB;CAC5C;AAED,KAAK,0BAA0B,GAC3B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,CAAC;AAKtC,eAAO,MAAM,uDAAuD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;kBAkUpH,CAAC"}

package/dist/esm/users/user-self-preferences.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-self-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-self-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAgBzG,oBAAY,8BAA8B;IACxC,iBAAiB,sBAAsB;CACxC;AAED,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAoK3H,CAAC"}
+{"version":3,"file":"user-self-preferences.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-self-preferences.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAgBzG,oBAAY,8BAA8B;IACxC,iBAAiB,sBAAsB;CACxC;AAED,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAoK3H,CAAC"}

package/dist/esm/users/user-self-profiles.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-self-profiles.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-self-profiles.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAgBzG,KAAK,8BAA8B,GAC/B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,CAAC;AAKtC,eAAO,MAAM,2DAA2D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;iCA6IxH,CAAC"}
+{"version":3,"file":"user-self-profiles.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-self-profiles.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAgBzG,KAAK,8BAA8B,GAC/B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,WAAW,CAAC;AAKtC,eAAO,MAAM,2DAA2D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;iCA6IxH,CAAC"}

package/dist/esm/users/user-self.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-self.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-self.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAc,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAQzG,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AA2FjF,oBAAY,mBAAmB;IAC7B,kBAAkB,uBAAuB,CAAE,iCAAiC;IAC5E,kBAAkB,uBAAuB;CAC1C;AAED,KAAK,sBAAsB,GACvB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAKtC,eAAO,MAAM,mDAAmD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;kBAyThH,CAAC"}
+{"version":3,"file":"user-self.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-self.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAc,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAQzG,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AA2FjF,oBAAY,mBAAmB;IAC7B,kBAAkB,uBAAuB,CAAE,iCAAiC;IAC5E,kBAAkB,uBAAuB;CAC1C;AAED,KAAK,sBAAsB,GACvB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAKtC,eAAO,MAAM,mDAAmD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;kBAyThH,CAAC"}

package/dist/esm/users/user-self.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-self.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-self.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,kDAAkD;AAClD,EAAE;AACF,2FAA2F;AAC3F,0EAA0E;AAC1E,6FAA6F;AAC7F,8FAA8F;AAC9F,4FAA4F;AAC5F,iGAAiG;AACjG,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,4FAA4F;AAC5F,0FAA0F;AAC1F,2FAA2F;AAC3F,wFAAwF;AACxF,4FAA4F;AAC5F,8EAA8E;AAC9E,qDAAqD;AACrD,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,+EAA+E;AAC/E,sEAAsE;AACtE,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,oFAAoF;AACpF,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,SAAS;AACT,oGAAoG;AACpG,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,yDAAyD;AACzD,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,6EAA6E;AAC7E,mGAAmG;AACnG,2EAA2E;AAC3E,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,8FAA8F;AAC9F,+FAA+F;AAC/F,uBAAuB;AACvB,mGAAmG;AACnG,iGAAiG;AACjG,oFAAoF;AACpF,oGAAoG;AACpG,uDAAuD;AACvD,+FAA+F;AAC/F,kGAAkG;AAClG,2FAA2F;AAC3F,oGAAoG;AACpG,oGAAoG;AACpG,+EAA+E;AAC/E,mGAAmG;AACnG,oGAAoG;AACpG,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,gFAAgF;AAChF,4FAA4F;AAC5F,0FAA0F;AAC1F,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,oFAAoF;AACpF,kGAAkG;AAClG,wFAAwF;AACxF,iGAAiG;AACjG,wEAAwE;AACxE,sEAAsE;AACtE,EAAE;AACF,oFAAoF;AACpF,iGAAiG;AACjG,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,gEAAyC,CAAA;IACzC,gEAAyC,CAAA;AAC3C,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B;AAQD;;EAEE;AACF,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI/J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;IAC9C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,SAAS,CAAC;IACvF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,cAAc;IAEtC;;;;;;;;;;;OAWG;IACH,6BAA6B,EAAE,IAAI;IAEnC;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEvE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,6FAA6F;QAC7F,oFAAoF;QACpF,gGAAgG;QAChG,qEAAqE;QACrE,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,mBAAmB;IAGpC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,4CAA4C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,+CAA+C;iBAChD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,mFAAmF;oBACnF,wFAAwF;oBACxF,uFAAuF;oBACvF,0EAA0E;oBAC1E,EAAE;oBACF,uFAAuF;oBACvF,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,6EAA6E;oBAC7E,qFAAqF;oBACrF,kFAAkF;oBAClF,sFAAsF;oBACtF,qFAAqF;oBACrF,uFAAuF;oBACvF,uFAAuF;oBACvF,sCAAsC;oBACtC,EAAE;oBACF,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,0DAA0D;oBAC1D,kEAAkE;oBAClE,+EAA+E;oBAC/E,kFAAkF;oBAClF,sFAAsF;oBACtF,0EAA0E;oBAC1E,EAAE;oBACF,sFAAsF;oBACtF,oFAAoF;oBACpF,mFAAmF;oBACnF,oFAAoF;oBACpF,+DAA+D;oBAC/D,EAAE;oBACF,sFAAsF;oBACtF,qFAAqF;oBACrF,+EAA+E;oBAC/E,iFAAiF;oBACjF,kEAAkE;oBAClE,EAAE;oBACF,2EAA2E;oBAC3E,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,iFAAiF;oBACjF,6EAA6E;oBAC7E,iFAAiF;oBACjF,8EAA8E;oBAC9E,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,0FAA0F;oBAC1F,wFAAwF;oBACxF,6FAA6F;oBAC7F,gGAAgG;oBAChG,yFAAyF;oBACzF,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,2EAA2E;QAC3E,6FAA6F;QAC7F,8FAA8F;QAC9F,2FAA2F;QAC3F,8FAA8F;QAC9F,mDAAmD;QACnD,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,2CAA2C;oBAC7E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yFAAyF;oBACzF,yFAAyF;oBACzF,wFAAwF;oBACxF,+DAA+D;oBAC/D,2FAA2F;oBAC3F,yFAAyF;oBACzF,wFAAwF;oBACxF,kDAAkD;oBAClD,EAAE;oBACF,sEAAsE;oBACtE,2FAA2F;oBAC3F,wFAAwF;oBACxF,qFAAqF;oBACrF,2FAA2F;oBAC3F,wFAAwF;oBACxF,oBAAoB;oBACpB,EAAE;oBACF,mFAAmF;oBACnF,oFAAoF;oBACpF,0BAA0B;oBAC1B,EAAE;oBACF,qFAAqF;oBACrF,mFAAmF;oBACnF,yFAAyF;oBACzF,mFAAmF;oBACnF,6FAA6F;oBAC7F,yFAAyF;oBACzF,kCAAkC;oBAClC,EAAE;oBACF,+EAA+E;oBAC/E,oFAAoF;oBACpF,kFAAkF;oBAClF,sFAAsF;oBACtF,yFAAyF;oBACzF,4EAA4E;oBAC5E,EAAE;oBACF,yFAAyF;oBACzF,sFAAsF;oBACtF,qFAAqF;oBACrF,wFAAwF;oBACxF,uFAAuF;oBACvF,mBAAmB;oBACnB,EAAE;oBACF,yFAAyF;oBACzF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,yCAAyC;oBACzC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qFAAqF;oBACrF,wFAAwF;oBACxF,kFAAkF;oBAClF,gDAAgD;oBAChD,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,4BAA4B;oBAC9D,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,mFAAmF;oBACnF,mFAAmF;oBACnF,4EAA4E;oBAC5E,kFAAkF;oBAClF,+EAA+E;oBAC/E,gBAAgB;oBAChB,sFAAsF;oBACtF,2BAA2B;oBAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,yFAAyF;oBACzF,2EAA2E;oBAC3E,EAAE;oBACF,2EAA2E;oBAC3E,uFAAuF;oBACvF,uFAAuF;oBACvF,2EAA2E;oBAC3E,uFAAuF;oBACvF,qFAAqF;oBACrF,wBAAwB;oBACxB,EAAE;oBACF,uEAAuE;oBACvE,qFAAqF;oBACrF,+EAA+E;oBAC/E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qFAAqF;oBACrF,wFAAwF;oBACxF,kFAAkF;oBAClF,gDAAgD;oBAChD,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Self Shared Resource Configuration\n *\n * Resource configuration for user self-management operations.\n * Handles profile management, preferences, and personal data operations.\n */\n\nimport { z } from 'zod';\nimport { UserSchema, UserStatus } from './users.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Custom operations enum for user self management\n//\n// PASSWORD CHANGE IS NOT A RESOURCE OPERATION — IT IS AN AUTH ROUTE. `CHANGE_PASSWORD` was\n// declared here as an `APP_USER`-gated `riskLevel: HIGH` operation taking\n// `{ currentPassword, newPassword, confirmPassword }`, and was removed on 2026-08-01: it was\n// ROUTED but never implemented, so the request fell through to the generic core UPDATE, which\n// persists only fields the resource schema declares. A password verifier is not one of them\n// (credentials are a separate store), so every call answered **HTTP 200 having changed nothing**\n// — the caller is told their password rotated while the old one still works.\n//\n// The real implementation already exists and is the ONLY correct home for it:\n// `POST /auth/password/change` → `AuthMethodManagementBackendService.changePassword`, which\n// verifies the current-password proof, applies the per-user-type password policy, hashes,\n// invalidates every refresh token for the user, and writes a `USER_PASSWORD_CHANGED` audit\n// record. It is rate-limited (5/min/IP) and parses its body with `z.strictObject` so an\n// identity field smuggled into the payload is rejected loudly rather than silently ignored.\n// The frontend already calls exactly that route (`AppPage_SecuritySettings` →\n// `getManualCallsHttpClient().passwordChange(...)`).\n//\n// Do NOT re-declare this as a resource operation. Beyond duplicating a solved problem, it would\n// route a plaintext credential through the generic resource-write pipeline (DTO parse, repository\n// projection, notification fan-out) that the auth route deliberately bypasses.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n//\n// NOR ARE PROFILE / PREFERENCES WRITES — THEY BELONG TO THEIR OWN RESOURCES. `UPDATE_PROFILE` and\n// `UPDATE_PREFERENCES` were removed on 2026-08-01. Both ran `resourceOperationLike: UPDATE` against\n// THIS resource — whose `mainSchema` is the USER — while declaring the request DTO of a DIFFERENT\n// resource (`UserProfileSchema.partial()` / `UserPreferencesSchema.partial()`). A core UPDATE writes\n// only its own resource's row, so every declared field was dropped; the single intersecting key was\n// `_id`, which `ResourceOperationsHelper.cleanInputData` force-deletes before validation. The write\n// was therefore empty and the route answered **HTTP 200 having persisted nothing**.\n//\n// The persisted documents already have dedicated self-scoped resources, and they are already the\n// wired path: `USER_SELF_PROFILES` exposes READ/CREATE/UPDATE over its own `mainSchema`, while\n// `USER_SELF_PREFERENCES` exposes READ/UPDATE plus its selective reset operation over the eagerly\n// seeded preferences row. Both are embedded as child resources of this one in the frontend preset,\n// carry their own resource specifications, and — for preferences — are the MCP-exposed read/update\n// tools.\n// This resource's own specification already directed engineers there for \"the persisted documents\".\n//\n// Do NOT re-declare either verb here. A single `user_self`-rooted write across child resources\n// cannot be a core UPDATE at all; it would need a custom multi-resource implementation declaring\n// `transactionParticipants` — new machinery duplicating a path that already exists. Route clients\n// to `userSelfProfiles` / `userSelfPreferences` instead.\n//\n// NOR IS SELF-SERVICE ACCOUNT DELETION — DATA-SUBJECT ERASURE IS A SYSTEM-LEVEL API WITH NO ROUTE.\n// `DELETE_ACCOUNT` was removed on 2026-08-01. It was an `APP_USER`-gated `riskLevel: CRITICAL`\n// operation taking `{ password, reason }` and declaring a scheduled-deletion\n// `customResponseDto: { scheduledDeletionDate, recoveryPeriodDays, dataExportUrl }`. It was broken\n// in four independent ways, each verified against the built configuration:\n//\n//   - **The password was never verified.** Neither declared field is a persisted `UserSchema` path\n//     and no custom implementation was bound to the operation path, so the built `repositoryDto`\n//     was EMPTY: the controller strict-parsed the body, the repository re-parsed it, and both\n//     fields were discarded. A UI collecting the password as a confirmation gate was providing\n//     false assurance.\n//   - **It could never answer successfully.** `transformOutput` skips default-envelope composition\n//     for an op declaring a `customResponseDto` and validates the raw service output against it.\n//     A core DELETE returns the deleted `_id` as a bare string, so every call threw\n//     `service_resource_transformation_failed` → HTTP 500. Retries too: a second call returns `''`,\n//     which is not `null`, so it fails the same parse.\n//   - **Its destructive effect was NONDETERMINISTIC.** `resourceOperationLike: DELETE` reaches\n//     `_doDelete` through the repository's operations map (which holds custom ops), bypassing the\n//     `coreOperations` gate this config never opened — and fires `onParentDelete`. Neither\n//     `USER_SELF_PROFILES` nor `USER_SELF_PREFERENCES` declares a DELETE, so a user WITH either row\n//     hit `ErrorType.CONFIGURATION` inside the delete transaction and was rolled back, while a user\n//     with NEITHER row was destroyed. Same 500, opposite persistence outcomes.\n//   - **It contradicted this resource's own retention contract.** `retentionPolicy` below declares\n//     `RETAIN_AND_IMPERSONALIZE`: user rows are RETAINED and scrubbed in place, never hard-deleted.\n//\n// The erasure capability already exists and is the only correct home: `eraseSubjectAsSystem` /\n// `eraseSubjectInPlace` walk every dependent edge, derive delete-vs-retain from each edge's own\n// `onParentDelete` declaration, fail closed on unclassified edges, and return a\n// `SubjectErasureReport`. Like the four export/portability verbs removed the same day, they\n// **deliberately ship with NO ROUTE** — data-subject rights are a system-level API, not a\n// self-service HTTP verb. `dataExportUrl` compounded this: it named the portability artifact that\n// removal established does not exist.\n//\n// Do NOT re-declare this as a resource operation. Voluntary self-service closure is\n// `DEACTIVATE_ACCOUNT` below; actual erasure runs through the compliance capability. If a product\n// ever needs a user-initiated erasure REQUEST, it is a scheduling verb over a persisted\n// request state (with its own cancel path and a batch that calls `eraseSubjectAsSystem`) — not a\n// routed DELETE, and not something the generic core delete can express.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n//\n// assurance-control: WILDO.DATA.SECURE_LIFECYCLE — a destructive identity operation\n// must verify the principal and leave evidence; erasure must honour the declared retention mode.\nexport enum UserSelf_Operations {\n  DEACTIVATE_ACCOUNT = 'deactivate_account', // Temporarily deactivate account\n  REACTIVATE_ACCOUNT = 'reactivate_account', // Reactivate account\n}\n\ntype UserSelfCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY;\n\n/*\nUser Self Resource Configuration Factory\n*/\nexport const userSelfResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof UserSelf_Operations,\n  UserSelfCoreOperations,\n  typeof UserSchema\n>({\n  mainSchema: UserSchema,\n  resourceIdentifier: CoreResourceType.USER_SELF,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_SELF],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Self-scoped\n\n  /**\n   * `/user-self/{userId}` names the CALLER. Declared EXPLICITLY even though `true` is the default,\n   * because the sibling `USERS` configuration — over the SAME collection, with the SAME\n   * `resourceFieldIdentifier` — declares `false`, and a reader comparing the two must be able to see\n   * that the difference is intentional rather than an omission.\n   *\n   * This is the value that keeps the horizontal-IDOR refusal alive: user A addressing user B's\n   * self row is refused `403 authorization_user_id_mismatch` by the identity-coherence guard. Pinned\n   * by `external-access-auth.e2e.ts` (M4) and `users-administration.e2e.ts` (U-11). Flipping this to\n   * `false` would open that hole silently — nothing downstream would catch it, because the addressed\n   * id still reaches the contextual filter and would scope the read to B.\n   */\n  primaryKeyIdentifiesInitiator: true,\n\n  /**\n   * ⚠️ MUST MIRROR `USERS`. This config and `USERS` are two doors onto the SAME rows: they share\n   * `UserSchema` above and, per `getCollectionNameForResource` in the zod→mongoose convertor,\n   * `USER_SELF` builds a SEPARATE Mongoose model over the `USERS` COLLECTION.\n   *\n   * Retention governance is per-resource-config, so a `USERS`-only opt-in would leave two holes on\n   * these shared rows:\n   *  - an ERASED user's row would stay READABLE and UPDATABLE through this door, whose READ/UPDATE\n   *    are open to `APP_USER` and would carry neither the retention hide filter nor the freeze;\n   *  - this model would emit a PLAIN unique index on `email` next to the `USERS` model's\n   *    retention-scoped one, so the SECOND erased user would collide (E11000) on the shared mask\n   *    address and abort the erasure.\n   *\n   * Declaring the same mode makes both models inject the same marker and emit the identical partial\n   * index, so the collection has one coherent retention contract. Change the two configs together.\n   * The scrub treatment needs no restating — it lives on the shared `UserSchema`.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Same subject as `USERS` over the same collection — the self-service door onto the identity row.\n   * Mirrors that config's `SELF_PRINCIPAL` declaration; the two must be changed together.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  /**\n   * Subject-export disclosure. The self-service export subject. The identity row is what the user signed up with.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject-export disclosure. The self-service export subject. The identity row is what the user signed up with.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    // LIST + UPDATE_MANY exist for the retention capability ONLY, as INTERNAL_CALL variants that\n    // register no route: `retentionPolicy` requires UPDATE_MANY (the in-place scrub via\n    // `updateManyAsSystem`) plus READ + LIST (the audited see-through read of retained rows). There\n    // is deliberately no HTTP \"list my selves\" — see the variants below.\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: UserSelf_Operations,\n\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, user reading their own data\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Default variant returns basic User data only\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          // Retention capability only — INTERNAL_CALL registers NO HTTP route. A user-facing\n          // \"list my selves\" would be meaningless (this resource is addressed as the caller's own\n          // row); the op exists solely so `listRetainedAsSystem` has a read path through which a\n          // compliance auditor can see-through to retained rows on this collection.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY — see the UPDATE_MANY note below for why the\n          // distinction is load-bearing. `roles` is inert on a non-URL-bearing variant.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          // ⚠️ INTERNAL_CALL — registers NO HTTP route. This was an `API_CALL` open to\n          // `APP_USER` with an auto-derived request DTO, and on THIS resource the auto-derived\n          // user update DTO is `{status, appRoles, userTypes}`: every writable field on the\n          // `USER_SELF` row is server-owned. `email` is `.excludeFromUpdate()` and the editable\n          // self data (names, avatar, bio, phone / notification + UI preferences) lives on the\n          // `USER_SELF_PROFILES` and `USER_SELF_PREFERENCES` child resources, which is where the\n          // UI actually writes it. So the route offered a self-service caller nothing legitimate\n          // and three things it must never set:\n          //\n          //   - `appRoles`  — the app-level authorization axis. No ceiling gate exists on this\n          //     path (`assertRequestedRolesWithinCallerCeiling` is wired into org-member CREATE,\n          //     org-unit-members, oauth-clients and api-keys only, and no custom implementation is\n          //     registered for `USERS` / `USER_SELF`), so a plain authenticated user could grant\n          //     themselves any role, up to `APP_ADMIN_SUPER_ADMIN`.\n          //   - `userTypes` — selects auth policy and registration context.\n          //   - `status`    — the account lifecycle axis, which belongs to the dedicated\n          //     DEACTIVATE_ACCOUNT / REACTIVATE_ACCOUNT transitions below (and to the admin\n          //     SUSPEND_USER / UNSUSPEND_USER verbs on the `USERS` door). A self-service caller\n          //     flipping it directly bypasses every state gate those verbs declare.\n          //\n          // Narrowing `requestDto` would have left the route in place answering an empty write;\n          // removing the HTTP surface is the honest fix, because no caller wants it. Verified\n          // before the change: the engine presets surface no `UPDATE` action for `USER_SELF`\n          // (self edits go to the child resources), and no backend caller invokes `USER_SELF`\n          // update — the trusted internal door for user rows is `USERS`.\n          //\n          // The operation itself is KEPT (not dropped from `coreOperations`) because the custom\n          // self verbs borrow it through `resourceOperationLike: UPDATE`, and INTERNAL_CALL is\n          // the resource's established idiom for a route-less operation — see `LIST` and\n          // `UPDATE_MANY` above/below, and the note there on why INTERNAL_CALL rather than\n          // REPOSITORY_ONLY. `roles` is inert on a non-URL-bearing variant.\n          //\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a self-service surface\n          // must not be a privilege-assignment or lifecycle-override surface.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          // Retention capability only — INTERNAL_CALL registers NO HTTP route. Required by\n          // `retentionPolicy` because the impersonalize writer scrubs in place through\n          // `updateManyAsSystem`. A user bulk-updating rows through the self door would be\n          // nonsensical AND dangerous, so the only caller is the trusted system writer.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY. Both are route-less, but the three retention\n          // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n          // through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL / API_CALL /\n          // API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is excluded there and served by the separate\n          // `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant would satisfy the\n          // factory's boot guard and then FAIL TO RESOLVE when an erasure actually runs. `roles` is inert\n          // on a non-URL-bearing variant; the real gate is the derived `systemAccessPolicy` grant.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }\n      ],\n    },\n\n    // Profile / preferences writes ride the dedicated `USER_SELF_PROFILES` and\n    // `USER_SELF_PREFERENCES` resources — the `UPDATE_PROFILE` / `UPDATE_PREFERENCES` verbs were\n    // removed on 2026-08-01 (they declared another resource's schema, so they answered 200 having\n    // persisted nothing). Self-service account DELETION was removed the same day: erasure is a\n    // system-level API with no route, and a hard delete contradicted the `retentionPolicy` above.\n    // Both removals are explained in the enum comment.\n    [UserSelf_Operations.DEACTIVATE_ACCOUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, high risk - affects access\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory (ACTIVE → INACTIVE). INACTIVE, not\n          // SUSPENDED: the distinction is the point — SUSPENDED is imposed and only an admin lifts\n          // it, while INACTIVE is chosen and the user lifts it themselves via REACTIVATE_ACCOUNT.\n          // NO `reactivationDate`. It was declared here and persisted to\n          // `User.scheduledReactivationAt`, but nothing could ever honour it: the reactivation sweep\n          // dispatches each resource's own lifecycle verb, and the only verb that lifts `INACTIVE`\n          // is REACTIVATE_ACCOUNT below — self-scoped and `APP_USER`-gated, so a system principal\n          // cannot address another person's row through it.\n          //\n          // The two ways to make it work were both worse than the gap. Widening\n          // `users | unsuspend_user` to accept `INACTIVE` merges an IMPOSED suspension with a CHOSEN\n          // deactivation into one verb — two states whose whole distinction is who may lift them.\n          // And `admitsCrossSubjectUserAdministration` (the framework's per-variant \"this verb\n          // administers another person\" opt-in) relaxes WHOSE row may be addressed but never WHO may\n          // call, so putting it on an `APP_USER` verb would let any authenticated user reactivate\n          // anyone's account.\n          //\n          // Minting a new admin-tier reactivation verb purely to give the sweep a door would\n          // manufacture a routed surface nobody asked for — the exact pattern this workstream\n          // removed six times over.\n          //\n          // CORRECTED 2026-09-08 (#430). This paragraph used to end \"Voluntary deactivation is\n          // reversible by its subject at any time through REACTIVATE_ACCOUNT, so a scheduled\n          // auto-return was a convenience, not a promise\". That is FALSE, and it was load-bearing:\n          // it is the stated reason the auto-return was rejected. REACTIVATE_ACCOUNT needs a\n          // SESSION, and `_enforceUserStatus` (authentication-orchestrator.backend.service.ts:709-716)\n          // refuses every non-ACTIVE status at sign-in — so a self-deactivated person cannot reach\n          // the verb that would reverse it.\n          //\n          // RESOLVED, and the answer is that reversal is an ADMINISTRATIVE act: `users |\n          // reactivate_user` (INACTIVE → ACTIVE, `APP_ADMIN_SUPER_ADMIN`, mandatory `reason`,\n          // audited) is the door. So deactivation is NOT reversible by its subject, and the\n          // operation's own SPECIFICATION says so — that is where the words a person reads come\n          // from (`.claude/rules/display-text-comes-from-i18n.md`: display text is authored in the\n          // spec and generated into the label tree, never invented at the call site).\n          //\n          // The two alternatives rejected above are still rejected for the reasons given, which is\n          // why they are kept: widening `unsuspend_user` conflates an imposed suspension with a\n          // chosen departure, and `admitsCrossSubjectUserAdministration` on an `APP_USER` verb\n          // would let any authenticated user reactivate anyone. The third — admitting INACTIVE at\n          // sign-in with a session scoped to one verb — was rejected on #430 for widening what a\n          // sign-in returns.\n          //\n          // Note the ADMIN time-boxing is unaffected and IS honoured: `users | suspend_user` takes\n          // `suspensionDuration` and the hourly sweep lifts it, because `unsuspend_user` is a door a\n          // system principal can dispatch. That is the case that actually matters — an operator who\n          // said \"seven days\" must get seven days.\n          requestDto: z.object({\n            reason: z.string().max(500).optional(),\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          // Delivered even to a person who switched email notifications off (#409). An account\n          // lifecycle change is the alert that matters most precisely when the account holder did\n          // NOT perform it, and this email is how they find out. A preference about routine\n          // notifications must not be able to silence it.\n          alwaysDeliver: true,\n        }\n      ]\n    },\n\n    [UserSelf_Operations.REACTIVATE_ACCOUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, medium risk\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Self-service reactivation FORCES the one transition it names. Omitting\n          // `requestDto` would auto-derive the FULL user update DTO — which on this resource\n          // is `{status, appRoles, userTypes}` — so an end-user-facing verb would accept its\n          // own `appRoles` and `userTypes`, with no ceiling gate anywhere on the path\n          // (`assertRequestedRolesWithinCallerCeiling` is not called here). Narrowing to an\n          // empty contract removes the role surface entirely, which is why this needs no\n          // ceiling call.\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a self-service verb must not be a\n          // role-assignment surface.\n          requestDto: z.object({}),\n          // The transition itself is implemented by the SHARED status-transition factory, like its\n          // inverse DEACTIVATE_ACCOUNT above — not by a `basicPrefixOperation` here.\n          //\n          // It used to be the hook, and the asymmetry cost three things: the pending\n          // `scheduledReactivationAt` was never cleared (leaving a date on an ACTIVE row that no\n          // longer described anything), no transition audit row was emitted (so the self-service\n          // pair was half-trailed — the departure recorded, the return not), and the\n          // administrative-continuity floors did not run. Harmless individually, but it made the\n          // one lifecycle verb in the family that bypassed the shared authority the one nobody\n          // would think to check.\n          //\n          // The factory's registration declares `authoritativeFields: ['status',\n          // 'scheduledReactivationAt']`, which is what carries the patch past the repository's\n          // strict re-parse — the protection the hook's own declaration used to provide.\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          // Delivered even to a person who switched email notifications off (#409). An account\n          // lifecycle change is the alert that matters most precisely when the account holder did\n          // NOT perform it, and this email is how they find out. A preference about routine\n          // notifications must not be able to silence it.\n          alwaysDeliver: true,\n        }\n      ]\n    }\n  },\n});\n"]}
+{"version":3,"file":"user-self.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/user-self.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,kDAAkD;AAClD,EAAE;AACF,2FAA2F;AAC3F,0EAA0E;AAC1E,6FAA6F;AAC7F,8FAA8F;AAC9F,4FAA4F;AAC5F,iGAAiG;AACjG,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,4FAA4F;AAC5F,0FAA0F;AAC1F,2FAA2F;AAC3F,wFAAwF;AACxF,4FAA4F;AAC5F,8EAA8E;AAC9E,qDAAqD;AACrD,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,+EAA+E;AAC/E,sEAAsE;AACtE,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,oFAAoF;AACpF,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,SAAS;AACT,oGAAoG;AACpG,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,yDAAyD;AACzD,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,6EAA6E;AAC7E,mGAAmG;AACnG,2EAA2E;AAC3E,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,8FAA8F;AAC9F,+FAA+F;AAC/F,uBAAuB;AACvB,mGAAmG;AACnG,iGAAiG;AACjG,oFAAoF;AACpF,oGAAoG;AACpG,uDAAuD;AACvD,+FAA+F;AAC/F,kGAAkG;AAClG,2FAA2F;AAC3F,oGAAoG;AACpG,oGAAoG;AACpG,+EAA+E;AAC/E,mGAAmG;AACnG,oGAAoG;AACpG,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,gFAAgF;AAChF,4FAA4F;AAC5F,0FAA0F;AAC1F,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,oFAAoF;AACpF,kGAAkG;AAClG,wFAAwF;AACxF,iGAAiG;AACjG,wEAAwE;AACxE,sEAAsE;AACtE,EAAE;AACF,oFAAoF;AACpF,iGAAiG;AACjG,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,gEAAyC,CAAA;IACzC,gEAAyC,CAAA;AAC3C,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B;AAQD;;EAEE;AACF,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI/J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;IAC9C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,SAAS,CAAC;IACvF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,cAAc;IAEtC;;;;;;;;;;;OAWG;IACH,6BAA6B,EAAE,IAAI;IAEnC;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEvE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,6FAA6F;QAC7F,oFAAoF;QACpF,gGAAgG;QAChG,qEAAqE;QACrE,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;KAClC;IAED,eAAe,EAAE,mBAAmB;IAGpC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,4CAA4C;oBAC9E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,+CAA+C;iBAChD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,mFAAmF;oBACnF,wFAAwF;oBACxF,uFAAuF;oBACvF,0EAA0E;oBAC1E,EAAE;oBACF,uFAAuF;oBACvF,8EAA8E;oBAC9E,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,6EAA6E;oBAC7E,qFAAqF;oBACrF,kFAAkF;oBAClF,sFAAsF;oBACtF,qFAAqF;oBACrF,uFAAuF;oBACvF,uFAAuF;oBACvF,sCAAsC;oBACtC,EAAE;oBACF,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,0DAA0D;oBAC1D,kEAAkE;oBAClE,+EAA+E;oBAC/E,kFAAkF;oBAClF,sFAAsF;oBACtF,0EAA0E;oBAC1E,EAAE;oBACF,sFAAsF;oBACtF,oFAAoF;oBACpF,mFAAmF;oBACnF,oFAAoF;oBACpF,+DAA+D;oBAC/D,EAAE;oBACF,sFAAsF;oBACtF,qFAAqF;oBACrF,+EAA+E;oBAC/E,iFAAiF;oBACjF,kEAAkE;oBAClE,EAAE;oBACF,2EAA2E;oBAC3E,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,iFAAiF;oBACjF,6EAA6E;oBAC7E,iFAAiF;oBACjF,8EAA8E;oBAC9E,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,0FAA0F;oBAC1F,wFAAwF;oBACxF,6FAA6F;oBAC7F,gGAAgG;oBAChG,yFAAyF;oBACzF,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,2EAA2E;QAC3E,6FAA6F;QAC7F,8FAA8F;QAC9F,2FAA2F;QAC3F,8FAA8F;QAC9F,mDAAmD;QACnD,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,2CAA2C;oBAC7E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yFAAyF;oBACzF,yFAAyF;oBACzF,wFAAwF;oBACxF,+DAA+D;oBAC/D,2FAA2F;oBAC3F,yFAAyF;oBACzF,wFAAwF;oBACxF,kDAAkD;oBAClD,EAAE;oBACF,sEAAsE;oBACtE,2FAA2F;oBAC3F,wFAAwF;oBACxF,qFAAqF;oBACrF,2FAA2F;oBAC3F,wFAAwF;oBACxF,oBAAoB;oBACpB,EAAE;oBACF,mFAAmF;oBACnF,oFAAoF;oBACpF,0BAA0B;oBAC1B,EAAE;oBACF,qFAAqF;oBACrF,mFAAmF;oBACnF,yFAAyF;oBACzF,mFAAmF;oBACnF,6FAA6F;oBAC7F,yFAAyF;oBACzF,kCAAkC;oBAClC,EAAE;oBACF,+EAA+E;oBAC/E,oFAAoF;oBACpF,kFAAkF;oBAClF,sFAAsF;oBACtF,yFAAyF;oBACzF,4EAA4E;oBAC5E,EAAE;oBACF,yFAAyF;oBACzF,sFAAsF;oBACtF,qFAAqF;oBACrF,wFAAwF;oBACxF,uFAAuF;oBACvF,mBAAmB;oBACnB,EAAE;oBACF,yFAAyF;oBACzF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,yCAAyC;oBACzC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qFAAqF;oBACrF,wFAAwF;oBACxF,kFAAkF;oBAClF,gDAAgD;oBAChD,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,4BAA4B;oBAC9D,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,mFAAmF;oBACnF,mFAAmF;oBACnF,4EAA4E;oBAC5E,kFAAkF;oBAClF,+EAA+E;oBAC/E,gBAAgB;oBAChB,sFAAsF;oBACtF,2BAA2B;oBAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,yFAAyF;oBACzF,2EAA2E;oBAC3E,EAAE;oBACF,2EAA2E;oBAC3E,uFAAuF;oBACvF,uFAAuF;oBACvF,2EAA2E;oBAC3E,uFAAuF;oBACvF,qFAAqF;oBACrF,wBAAwB;oBACxB,EAAE;oBACF,uEAAuE;oBACvE,qFAAqF;oBACrF,+EAA+E;oBAC/E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,qFAAqF;oBACrF,wFAAwF;oBACxF,kFAAkF;oBAClF,gDAAgD;oBAChD,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Self Shared Resource Configuration\n *\n * Resource configuration for user self-management operations.\n * Handles profile management, preferences, and personal data operations.\n */\n\nimport { z } from 'zod';\nimport { UserSchema, UserStatus } from './users.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Custom operations enum for user self management\n//\n// PASSWORD CHANGE IS NOT A RESOURCE OPERATION — IT IS AN AUTH ROUTE. `CHANGE_PASSWORD` was\n// declared here as an `APP_USER`-gated `riskLevel: HIGH` operation taking\n// `{ currentPassword, newPassword, confirmPassword }`, and was removed on 2026-08-01: it was\n// ROUTED but never implemented, so the request fell through to the generic core UPDATE, which\n// persists only fields the resource schema declares. A password verifier is not one of them\n// (credentials are a separate store), so every call answered **HTTP 200 having changed nothing**\n// — the caller is told their password rotated while the old one still works.\n//\n// The real implementation already exists and is the ONLY correct home for it:\n// `POST /auth/password/change` → `AuthMethodManagementBackendService.changePassword`, which\n// verifies the current-password proof, applies the per-user-type password policy, hashes,\n// invalidates every refresh token for the user, and writes a `USER_PASSWORD_CHANGED` audit\n// record. It is rate-limited (5/min/IP) and parses its body with `z.strictObject` so an\n// identity field smuggled into the payload is rejected loudly rather than silently ignored.\n// The frontend already calls exactly that route (`AppPage_SecuritySettings` →\n// `getManualCallsHttpClient().passwordChange(...)`).\n//\n// Do NOT re-declare this as a resource operation. Beyond duplicating a solved problem, it would\n// route a plaintext credential through the generic resource-write pipeline (DTO parse, repository\n// projection, notification fan-out) that the auth route deliberately bypasses.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n//\n// NOR ARE PROFILE / PREFERENCES WRITES — THEY BELONG TO THEIR OWN RESOURCES. `UPDATE_PROFILE` and\n// `UPDATE_PREFERENCES` were removed on 2026-08-01. Both ran `resourceOperationLike: UPDATE` against\n// THIS resource — whose `mainSchema` is the USER — while declaring the request DTO of a DIFFERENT\n// resource (`UserProfileSchema.partial()` / `UserPreferencesSchema.partial()`). A core UPDATE writes\n// only its own resource's row, so every declared field was dropped; the single intersecting key was\n// `_id`, which `ResourceOperationsHelper.cleanInputData` force-deletes before validation. The write\n// was therefore empty and the route answered **HTTP 200 having persisted nothing**.\n//\n// The persisted documents already have dedicated self-scoped resources, and they are already the\n// wired path: `USER_SELF_PROFILES` exposes READ/CREATE/UPDATE over its own `mainSchema`, while\n// `USER_SELF_PREFERENCES` exposes READ/UPDATE plus its selective reset operation over the eagerly\n// seeded preferences row. Both are embedded as child resources of this one in the frontend preset,\n// carry their own resource specifications, and — for preferences — are the MCP-exposed read/update\n// tools.\n// This resource's own specification already directed engineers there for \"the persisted documents\".\n//\n// Do NOT re-declare either verb here. A single `user_self`-rooted write across child resources\n// cannot be a core UPDATE at all; it would need a custom multi-resource implementation declaring\n// `transactionParticipants` — new machinery duplicating a path that already exists. Route clients\n// to `userSelfProfiles` / `userSelfPreferences` instead.\n//\n// NOR IS SELF-SERVICE ACCOUNT DELETION — DATA-SUBJECT ERASURE IS A SYSTEM-LEVEL API WITH NO ROUTE.\n// `DELETE_ACCOUNT` was removed on 2026-08-01. It was an `APP_USER`-gated `riskLevel: CRITICAL`\n// operation taking `{ password, reason }` and declaring a scheduled-deletion\n// `customResponseDto: { scheduledDeletionDate, recoveryPeriodDays, dataExportUrl }`. It was broken\n// in four independent ways, each verified against the built configuration:\n//\n//   - **The password was never verified.** Neither declared field is a persisted `UserSchema` path\n//     and no custom implementation was bound to the operation path, so the built `repositoryDto`\n//     was EMPTY: the controller strict-parsed the body, the repository re-parsed it, and both\n//     fields were discarded. A UI collecting the password as a confirmation gate was providing\n//     false assurance.\n//   - **It could never answer successfully.** `transformOutput` skips default-envelope composition\n//     for an op declaring a `customResponseDto` and validates the raw service output against it.\n//     A core DELETE returns the deleted `_id` as a bare string, so every call threw\n//     `service_resource_transformation_failed` → HTTP 500. Retries too: a second call returns `''`,\n//     which is not `null`, so it fails the same parse.\n//   - **Its destructive effect was NONDETERMINISTIC.** `resourceOperationLike: DELETE` reaches\n//     `_doDelete` through the repository's operations map (which holds custom ops), bypassing the\n//     `coreOperations` gate this config never opened — and fires `onParentDelete`. Neither\n//     `USER_SELF_PROFILES` nor `USER_SELF_PREFERENCES` declares a DELETE, so a user WITH either row\n//     hit `ErrorType.CONFIGURATION` inside the delete transaction and was rolled back, while a user\n//     with NEITHER row was destroyed. Same 500, opposite persistence outcomes.\n//   - **It contradicted this resource's own retention contract.** `retentionPolicy` below declares\n//     `RETAIN_AND_IMPERSONALIZE`: user rows are RETAINED and scrubbed in place, never hard-deleted.\n//\n// The erasure capability already exists and is the only correct home: `eraseSubjectAsSystem` /\n// `eraseSubjectInPlace` walk every dependent edge, derive delete-vs-retain from each edge's own\n// `onParentDelete` declaration, fail closed on unclassified edges, and return a\n// `SubjectErasureReport`. Like the four export/portability verbs removed the same day, they\n// **deliberately ship with NO ROUTE** — data-subject rights are a system-level API, not a\n// self-service HTTP verb. `dataExportUrl` compounded this: it named the portability artifact that\n// removal established does not exist.\n//\n// Do NOT re-declare this as a resource operation. Voluntary self-service closure is\n// `DEACTIVATE_ACCOUNT` below; actual erasure runs through the compliance capability. If a product\n// ever needs a user-initiated erasure REQUEST, it is a scheduling verb over a persisted\n// request state (with its own cancel path and a batch that calls `eraseSubjectAsSystem`) — not a\n// routed DELETE, and not something the generic core delete can express.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n//\n// assurance-control: WILDO.DATA.SECURE_LIFECYCLE — a destructive identity operation\n// must verify the principal and leave evidence; erasure must honour the declared retention mode.\nexport enum UserSelf_Operations {\n  DEACTIVATE_ACCOUNT = 'deactivate_account', // Temporarily deactivate account\n  REACTIVATE_ACCOUNT = 'reactivate_account', // Reactivate account\n}\n\ntype UserSelfCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY;\n\n/*\nUser Self Resource Configuration Factory\n*/\nexport const userSelfResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof UserSelf_Operations,\n  UserSelfCoreOperations,\n  typeof UserSchema\n>({\n  mainSchema: UserSchema,\n  resourceIdentifier: CoreResourceType.USER_SELF,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_SELF],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Self-scoped\n\n  /**\n   * `/user-self/{userId}` names the CALLER. Declared EXPLICITLY even though `true` is the default,\n   * because the sibling `USERS` configuration — over the SAME collection, with the SAME\n   * `resourceFieldIdentifier` — declares `false`, and a reader comparing the two must be able to see\n   * that the difference is intentional rather than an omission.\n   *\n   * This is the value that keeps the horizontal-IDOR refusal alive: user A addressing user B's\n   * self row is refused `403 authorization_user_id_mismatch` by the identity-coherence guard. Pinned\n   * by `external-access-auth.e2e.ts` (M4) and `users-administration.e2e.ts` (U-11). Flipping this to\n   * `false` would open that hole silently — nothing downstream would catch it, because the addressed\n   * id still reaches the contextual filter and would scope the read to B.\n   */\n  primaryKeyIdentifiesInitiator: true,\n\n  /**\n   * ⚠️ MUST MIRROR `USERS`. This config and `USERS` are two doors onto the SAME rows: they share\n   * `UserSchema` above and, per `getCollectionNameForResource` in the zod→mongoose convertor,\n   * `USER_SELF` builds a SEPARATE Mongoose model over the `USERS` COLLECTION.\n   *\n   * Retention governance is per-resource-config, so a `USERS`-only opt-in would leave two holes on\n   * these shared rows:\n   *  - an ERASED user's row would stay READABLE and UPDATABLE through this door, whose READ/UPDATE\n   *    are open to `APP_USER` and would carry neither the retention hide filter nor the freeze;\n   *  - this model would emit a PLAIN unique index on `email` next to the `USERS` model's\n   *    retention-scoped one, so the SECOND erased user would collide (E11000) on the shared mask\n   *    address and abort the erasure.\n   *\n   * Declaring the same mode makes both models inject the same marker and emit the identical partial\n   * index, so the collection has one coherent retention contract. Change the two configs together.\n   * The scrub treatment needs no restating — it lives on the shared `UserSchema`.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Same subject as `USERS` over the same collection — the self-service door onto the identity row.\n   * Mirrors that config's `SELF_PRINCIPAL` declaration; the two must be changed together.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  /**\n   * Subject-export disclosure. The self-service export subject. The identity row is what the user signed up with.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.ALLOWED },\n\n  /**\n   * Subject-export disclosure. The self-service export subject. The identity row is what the user signed up with.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    // LIST + UPDATE_MANY exist for the retention capability ONLY, as INTERNAL_CALL variants that\n    // register no route: `retentionPolicy` requires UPDATE_MANY (the in-place scrub via\n    // `updateManyAsSystem`) plus READ + LIST (the audited see-through read of retained rows). There\n    // is deliberately no HTTP \"list my selves\" — see the variants below.\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  customOperation: UserSelf_Operations,\n\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, user reading their own data\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Default variant returns basic User data only\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          // Retention capability only — INTERNAL_CALL registers NO HTTP route. A user-facing\n          // \"list my selves\" would be meaningless (this resource is addressed as the caller's own\n          // row); the op exists solely so `listRetainedAsSystem` has a read path through which a\n          // compliance auditor can see-through to retained rows on this collection.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY — see the UPDATE_MANY note below for why the\n          // distinction is load-bearing. `roles` is inert on a non-URL-bearing variant.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          // ⚠️ INTERNAL_CALL — registers NO HTTP route. This was an `API_CALL` open to\n          // `APP_USER` with an auto-derived request DTO, and on THIS resource the auto-derived\n          // user update DTO is `{status, appRoles, userTypes}`: every writable field on the\n          // `USER_SELF` row is server-owned. `email` is `.excludeFromUpdate()` and the editable\n          // self data (names, avatar, bio, phone / notification + UI preferences) lives on the\n          // `USER_SELF_PROFILES` and `USER_SELF_PREFERENCES` child resources, which is where the\n          // UI actually writes it. So the route offered a self-service caller nothing legitimate\n          // and three things it must never set:\n          //\n          //   - `appRoles`  — the app-level authorization axis. No ceiling gate exists on this\n          //     path (`assertRequestedRolesWithinCallerCeiling` is wired into org-member CREATE,\n          //     org-unit-members, oauth-clients and api-keys only, and no custom implementation is\n          //     registered for `USERS` / `USER_SELF`), so a plain authenticated user could grant\n          //     themselves any role, up to `APP_ADMIN_SUPER_ADMIN`.\n          //   - `userTypes` — selects auth policy and registration context.\n          //   - `status`    — the account lifecycle axis, which belongs to the dedicated\n          //     DEACTIVATE_ACCOUNT / REACTIVATE_ACCOUNT transitions below (and to the admin\n          //     SUSPEND_USER / UNSUSPEND_USER verbs on the `USERS` door). A self-service caller\n          //     flipping it directly bypasses every state gate those verbs declare.\n          //\n          // Narrowing `requestDto` would have left the route in place answering an empty write;\n          // removing the HTTP surface is the honest fix, because no caller wants it. Verified\n          // before the change: the engine presets surface no `UPDATE` action for `USER_SELF`\n          // (self edits go to the child resources), and no backend caller invokes `USER_SELF`\n          // update — the trusted internal door for user rows is `USERS`.\n          //\n          // The operation itself is KEPT (not dropped from `coreOperations`) because the custom\n          // self verbs borrow it through `resourceOperationLike: UPDATE`, and INTERNAL_CALL is\n          // the resource's established idiom for a route-less operation — see `LIST` and\n          // `UPDATE_MANY` above/below, and the note there on why INTERNAL_CALL rather than\n          // REPOSITORY_ONLY. `roles` is inert on a non-URL-bearing variant.\n          //\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a self-service surface\n          // must not be a privilege-assignment or lifecycle-override surface.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          // Retention capability only — INTERNAL_CALL registers NO HTTP route. Required by\n          // `retentionPolicy` because the impersonalize writer scrubs in place through\n          // `updateManyAsSystem`. A user bulk-updating rows through the self door would be\n          // nonsensical AND dangerous, so the only caller is the trusted system writer.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY. Both are route-less, but the three retention\n          // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n          // through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL / API_CALL /\n          // API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is excluded there and served by the separate\n          // `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant would satisfy the\n          // factory's boot guard and then FAIL TO RESOLVE when an erasure actually runs. `roles` is inert\n          // on a non-URL-bearing variant; the real gate is the derived `systemAccessPolicy` grant.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }\n      ],\n    },\n\n    // Profile / preferences writes ride the dedicated `USER_SELF_PROFILES` and\n    // `USER_SELF_PREFERENCES` resources — the `UPDATE_PROFILE` / `UPDATE_PREFERENCES` verbs were\n    // removed on 2026-08-01 (they declared another resource's schema, so they answered 200 having\n    // persisted nothing). Self-service account DELETION was removed the same day: erasure is a\n    // system-level API with no route, and a hard delete contradicted the `retentionPolicy` above.\n    // Both removals are explained in the enum comment.\n    [UserSelf_Operations.DEACTIVATE_ACCOUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, high risk - affects access\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory (ACTIVE → INACTIVE). INACTIVE, not\n          // SUSPENDED: the distinction is the point — SUSPENDED is imposed and only an admin lifts\n          // it, while INACTIVE is chosen and the user lifts it themselves via REACTIVATE_ACCOUNT.\n          // NO `reactivationDate`. It was declared here and persisted to\n          // `User.scheduledReactivationAt`, but nothing could ever honour it: the reactivation sweep\n          // dispatches each resource's own lifecycle verb, and the only verb that lifts `INACTIVE`\n          // is REACTIVATE_ACCOUNT below — self-scoped and `APP_USER`-gated, so a system principal\n          // cannot address another person's row through it.\n          //\n          // The two ways to make it work were both worse than the gap. Widening\n          // `users | unsuspend_user` to accept `INACTIVE` merges an IMPOSED suspension with a CHOSEN\n          // deactivation into one verb — two states whose whole distinction is who may lift them.\n          // And `admitsCrossSubjectUserAdministration` (the framework's per-variant \"this verb\n          // administers another person\" opt-in) relaxes WHOSE row may be addressed but never WHO may\n          // call, so putting it on an `APP_USER` verb would let any authenticated user reactivate\n          // anyone's account.\n          //\n          // Minting a new admin-tier reactivation verb purely to give the sweep a door would\n          // manufacture a routed surface nobody asked for — the exact pattern this workstream\n          // removed six times over.\n          //\n          // CORRECTED 2026-09-08 (#430). This paragraph used to end \"Voluntary deactivation is\n          // reversible by its subject at any time through REACTIVATE_ACCOUNT, so a scheduled\n          // auto-return was a convenience, not a promise\". That is FALSE, and it was load-bearing:\n          // it is the stated reason the auto-return was rejected. REACTIVATE_ACCOUNT needs a\n          // SESSION, and `_enforceUserStatus` (authentication-orchestrator.backend.service.ts:709-716)\n          // refuses every non-ACTIVE status at sign-in — so a self-deactivated person cannot reach\n          // the verb that would reverse it.\n          //\n          // RESOLVED, and the answer is that reversal is an ADMINISTRATIVE act: `users |\n          // reactivate_user` (INACTIVE → ACTIVE, `APP_ADMIN_SUPER_ADMIN`, mandatory `reason`,\n          // audited) is the door. So deactivation is NOT reversible by its subject, and the\n          // operation's own SPECIFICATION says so — that is where the words a person reads come\n          // from (`.claude/rules/display-text-comes-from-i18n.md`: display text is authored in the\n          // spec and generated into the label tree, never invented at the call site).\n          //\n          // The two alternatives rejected above are still rejected for the reasons given, which is\n          // why they are kept: widening `unsuspend_user` conflates an imposed suspension with a\n          // chosen departure, and `admitsCrossSubjectUserAdministration` on an `APP_USER` verb\n          // would let any authenticated user reactivate anyone. The third — admitting INACTIVE at\n          // sign-in with a session scoped to one verb — was rejected on #430 for widening what a\n          // sign-in returns.\n          //\n          // Note the ADMIN time-boxing is unaffected and IS honoured: `users | suspend_user` takes\n          // `suspensionDuration` and the hourly sweep lifts it, because `unsuspend_user` is a door a\n          // system principal can dispatch. That is the case that actually matters — an operator who\n          // said \"seven days\" must get seven days.\n          requestDto: z.object({\n            reason: z.string().max(500).optional(),\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          // Delivered even to a person who switched email notifications off (#409). An account\n          // lifecycle change is the alert that matters most precisely when the account holder did\n          // NOT perform it, and this email is how they find out. A preference about routine\n          // notifications must not be able to silence it.\n          alwaysDeliver: true,\n        }\n      ]\n    },\n\n    [UserSelf_Operations.REACTIVATE_ACCOUNT]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER], // v1: app-only, medium risk\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Self-service reactivation FORCES the one transition it names. Omitting\n          // `requestDto` would auto-derive the FULL user update DTO — which on this resource\n          // is `{status, appRoles, userTypes}` — so an end-user-facing verb would accept its\n          // own `appRoles` and `userTypes`, with no ceiling gate anywhere on the path\n          // (`assertRequestedRolesWithinCallerCeiling` is not called here). Narrowing to an\n          // empty contract removes the role surface entirely, which is why this needs no\n          // ceiling call.\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a self-service verb must not be a\n          // role-assignment surface.\n          requestDto: z.object({}),\n          // The transition itself is implemented by the SHARED status-transition factory, like its\n          // inverse DEACTIVATE_ACCOUNT above — not by a `basicPrefixOperation` here.\n          //\n          // It used to be the hook, and the asymmetry cost three things: the pending\n          // `scheduledReactivationAt` was never cleared (leaving a date on an ACTIVE row that no\n          // longer described anything), no transition audit row was emitted (so the self-service\n          // pair was half-trailed — the departure recorded, the return not), and the\n          // administrative-continuity floors did not run. Harmless individually, but it made the\n          // one lifecycle verb in the family that bypassed the shared authority the one nobody\n          // would think to check.\n          //\n          // The factory's registration declares `authoritativeFields: ['status',\n          // 'scheduledReactivationAt']`, which is what carries the patch past the repository's\n          // strict re-parse — the protection the hook's own declaration used to provide.\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.EMAIL,\n          // Delivered even to a person who switched email notifications off (#409). An account\n          // lifecycle change is the alert that matters most precisely when the account holder did\n          // NOT perform it, and this email is how they find out. A preference about routine\n          // notifications must not be able to silence it.\n          alwaysDeliver: true,\n        }\n      ]\n    }\n  },\n});\n"]}

package/dist/esm/users/users.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS/H,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AA4HjF,oBAAY,gBAAgB;IAC1B,YAAY,iBAAiB,CAAE,2BAA2B;IAC1D,YAAY,iBAAiB,CAAE,2BAA2B;IAC1D,YAAY,iBAAiB,CAAE,uBAAuB;IACtD,cAAc,mBAAmB,CAAE,yBAAyB;IAC5D,eAAe,oBAAoB,CAAE,4DAA4D;IACjG,oBAAoB,yBAAyB,CAAE,uBAAuB;IACtE;;;;;;;;;;;;;OAaG;IACH,aAAa,kBAAkB;CAChC;AAED,KAAK,mBAAmB,GACpB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,gDAAgD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;kBAioB7G,CAAC"}
+{"version":3,"file":"users.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAoD,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAS/H,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AA4HjF,oBAAY,gBAAgB;IAC1B,YAAY,iBAAiB,CAAE,2BAA2B;IAC1D,YAAY,iBAAiB,CAAE,2BAA2B;IAC1D,YAAY,iBAAiB,CAAE,uBAAuB;IACtD,cAAc,mBAAmB,CAAE,yBAAyB;IAC5D,eAAe,oBAAoB,CAAE,4DAA4D;IACjG,oBAAoB,yBAAyB,CAAE,uBAAuB;IACtE;;;;;;;;;;;;;OAaG;IACH,aAAa,kBAAkB;CAChC;AAED,KAAK,mBAAmB,GACpB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,GACjC,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,gDAAgD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;kBAioB7G,CAAC"}

package/dist/esm/users/users.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,UAAU,EACV,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,6CAA6C;AAC7C,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAEnF,oCAAoC;AACpC,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC;AAEF,qEAAqE;AACrE,MAAM,yBAAyB,GAAG;IAChC,GAAG,mBAAmB;IACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;IACvD,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,gCAAgC;CACrD,CAAC;AAEF,iDAAiD;AACjD,MAAM,uBAAuB,GAAG,CAAC,GAAG,iBAAiB,EAAE,QAAQ,CAAU,CAAC;AAE1E,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,+FAA+F;AAC/F,gGAAgG;AAChG,uFAAuF;AACvF,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,iFAAiF;AACjF,EAAE;AACF,4CAA4C;AAC5C,gGAAgG;AAChG,qFAAqF;AACrF,8FAA8F;AAC9F,iGAAiG;AACjG,sEAAsE;AACtE,gGAAgG;AAChG,kFAAkF;AAClF,kGAAkG;AAClG,wFAAwF;AACxF,0EAA0E;AAC1E,2FAA2F;AAC3F,8DAA8D;AAC9D,8DAA8D;AAC9D,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,sEAAsE;AACtE,EAAE;AACF,2EAA2E;AAC3E,+FAA+F;AAC/F,qFAAqF;AACrF,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,mGAAmG;AACnG,EAAE;AACF,4FAA4F;AAC5F,yCAAyC;AACzC,8FAA8F;AAC9F,oGAAoG;AACpG,8FAA8F;AAC9F,oFAAoF;AACpF,qFAAqF;AACrF,0FAA0F;AAC1F,iCAAiC;AACjC,mGAAmG;AACnG,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,mGAAmG;AACnG,6FAA6F;AAC7F,mGAAmG;AACnG,gGAAgG;AAChG,4FAA4F;AAC5F,gGAAgG;AAChG,iGAAiG;AACjG,yDAAyD;AACzD,EAAE;AACF,4CAA4C;AAC5C,iGAAiG;AACjG,0EAA0E;AAC1E,iGAAiG;AACjG,iGAAiG;AACjG,6DAA6D;AAC7D,6FAA6F;AAC7F,wEAAwE;AACxE,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,wBAAwB;AACxB,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,uFAAuF;AACvF,mGAAmG;AACnG,4EAA4E;AAC5E,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,sCAAsC;AACtC,sEAAsE;AACtE,MAAM,CAAN,IAAY,gBAsBX;AAtBD,WAAY,gBAAgB;IAC1B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;IACnC,iEAA6C,CAAA;IAC7C;;;;;;;;;;;;;OAaG;IACH,mDAA+B,CAAA;AACjC,CAAC,EAtBW,gBAAgB,KAAhB,gBAAgB,QAsB3B;AAWD;;EAEE;AACF,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;IAC1C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACnF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,uBAAuB;IAE/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,6BAA6B,EAAE,KAAK;IAEpC,mFAAmF;IACnF,8EAA8E;IAC9E,sFAAsF;IACtF,sFAAsF;IACtF,qFAAqF;IACrF,2FAA2F;IAC3F,0FAA0F;IAC1F,EAAE;IACF,iEAAiE;IACjE,iFAAiF;IACjF,oFAAoF;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,kFAAkF;IAClF,iFAAiF;IACjF,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,2FAA2F;QAC3F,8EAA8E;KAC/E;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;;;OAMG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,gBAAgB;IAEjC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oFAAoF;oBACpF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,uFAAuF;oBACvF,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,uFAAuF;oBACvF,0FAA0F;oBAC1F,wFAAwF;oBACxF,2FAA2F;oBAC3F,sCAAsC;iBACvC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,yFAAyF;oBACzF,kFAAkF;oBAClF,oCAAoC,EAAE,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,2EAA2E;oBAC3E,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,2EAA2E;oBAC3E,yCAAyC;oBACzC,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,gEAAgE;oBAChE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,yEAAyE;oBACzE,yEAAyE;oBACzE,uEAAuE;oBACvE,mEAAmE;oBACnE,yEAAyE;oBACzE,2EAA2E;oBAC3E,wEAAwE;oBACxE,2EAA2E;oBAC3E,mEAAmE;oBACnE,0EAA0E;oBAC1E,gBAAgB,EAAE;wBAChB,OAAO;wBACP;4BACE,UAAU,EAAE,KAAK;4BACjB,eAAe,EAAE,gBAAgB,CAAC,aAAa;4BAC/C,gBAAgB,EAAE,QAAQ;4BAC1B,mEAAmE;4BACnE,sCAAsC;yBACvC;qBACF;oBACD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,EAAE;oBACF,uFAAuF;oBACvF,iFAAiF;oBACjF,0FAA0F;oBAC1F,qFAAqF;oBACrF,uFAAuF;oBACvF,wFAAwF;oBACxF,mEAAmE;iBACpE;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wDAAwD;oBACvG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qEAAqE;oBACrE,uEAAuE;oBACvE,kDAAkD;oBAClD,EAAE;oBACF,2DAA2D;oBAC3D,2FAA2F;oBAC3F,sFAAsF;oBACtF,EAAE;oBACF,2FAA2F;oBAC3F,+EAA+E;oBAC/E,+EAA+E;iBAChF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,iFAAiF;oBACjF,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,+FAA+F;oBAC/F,gGAAgG;oBAChG,gGAAgG;oBAChG,iGAAiG;oBACjG,+FAA+F;oBAC/F,iGAAiG;oBACjG,qDAAqD;oBACrD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gCAAgC;oBAC/E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,2FAA2F;oBAC3F,qFAAqF;oBACrF,kFAAkF;oBAClF,gFAAgF;oBAChF,uCAAuC;oBACvC,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,2FAA2F;oBAC3F,2FAA2F;oBAC3F,yFAAyF;oBACzF,uFAAuF;oBACvF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4FAA4F;oBAC5F,0FAA0F;oBAC1F,uFAAuF;oBACvF,mDAAmD;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,6CAA6C;oBAC5F,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,yFAAyF;oBACzF,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;wBAClC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO;wBACzD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;YACjC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,8BAA8B;oBAC7E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,sFAAsF;oBACtF,mFAAmF;oBACnF,qEAAqE;oBACrE,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;wBACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC;oBACvD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BG;QACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,uFAAuF;oBACvF,iFAAiF;oBACjF,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,sFAAsF;oBACtF,kFAAkF;oBAClF,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,6DAA6D;wBAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;wBAClC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE;YAChC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,oCAAoC,EAAE,IAAI;oBAC1C,wFAAwF;oBACxF,2FAA2F;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB;;;;;;;2BAOG;wBACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;qBAC1C,CAAC;iBACH;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qDAAqD;oBACpG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;qBACnC,CAAC;oBACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,+FAA+F;wBAC/F,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;wBACnB,+EAA+E;wBAC/E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;qBAC7B,CAAC;oBACF,oFAAoF;oBACpF,2EAA2E;oBAC3E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;oBACrD,CAAC;iBACF;aACF;YACD,yFAAyF;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,kDAAkD;YAClD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KAEF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Users Shared Resource Configuration\n *\n * Resource configuration for administrative user management operations.\n * Handles user lifecycle, role management, and administrative actions.\n */\n\nimport { z } from 'zod';\nimport {\n  UserSchema,\n  UserStatus,\n  UserTheme\n} from './users.shared.schemas';\nimport { AppRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Sort and filter fields for user management\nconst USERS_SORT_FIELDS = ['createdAt', 'updatedAt', 'joinedAt', 'email'] as const;\n\n// App users get basic filter fields\nconst USERS_FILTER_FIELDS = {\n  status: z.enum(UserStatus),\n  email: z.string(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst USERS_ADMIN_FILTER_FIELDS = {\n  ...USERS_FILTER_FIELDS,\n  createdAt: z.date(), // Admin can filter by creation date\n  updatedAt: z.date(), // Admin can filter by update date\n  joinedAt: z.date(), // Admin can filter by join date\n};\n\n// App Admin gets additional sorting capabilities\nconst USERS_ADMIN_SORT_FIELDS = [...USERS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for user management\n//\n// Invitation is intentionally absent. Organization invitations are created by\n// the organization-members lifecycle, where the pending membership, invitee\n// identity, token and email are produced together. A previous `send_invitation`\n// users operation declared an invitation-receipt DTO but registered no backend\n// implementation capable of producing it. Reintroduce an application-wide\n// invitation operation only with a real lifecycle owner and handler; an\n// API_CALL declaration by itself is not an implementation.\n//\n// IMPERSONATION IS NOT A TOKEN MINT — IT IS AN IDENTITY SUBSTRATE THE FRAMEWORK DOES NOT HAVE.\n// `IMPERSONATE` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ reason, durationMinutes, auditLog }` and promising a\n// `{ impersonationToken, expiresAt, auditId }` response, and was removed on 2026-08-01: it was\n// ROUTED but never implemented. With `resourceOperationLike: READ` the generic core path simply\n// returned the target's user row, so the most dangerous verb in the catalogue answered\n// **HTTP 200** — an operator is told an impersonation session exists when none does.\n//\n// Do NOT re-declare it as a plain token mint. A minted session JWT is today byte-for-byte\n// indistinguishable from a genuine one: the payload is `{…, sub: userId, aud: 'AUTH_TOKEN' }`\n// with NO actor claim, and `ExecutionContext` has no \"acting as\" dimension. Every audit event\n// raised during such a session would be attributed to the impersonated USER rather than the\n// administrator — the framework would manufacture false attribution in exactly the records an\n// auditor relies on. That is strictly worse than having no impersonation at all.\n//\n// Re-declaring requires, as one workstream:\n//   1. an actor claim on the session JWT (RFC 8693 `act`-style: `sub` = target, actor = admin),\n//      minted through a dedicated path — never by reusing the ordinary login issuer;\n//   2. `ExecutionContext` propagation of that actor, so it reaches every downstream consumer;\n//   3. actor-attributed audit events — a new `CoreAuditableEventType` pair for session start/end\n//      plus actor stamping on every event raised while impersonating;\n//   4. an explicit revocation path (revoking the impersonation must not log the real user out);\n//   5. a server-side hard duration cap from configuration — NOT a caller-supplied\n//      `durationMinutes`, and NOT a caller-supplied `auditLog` flag: an audit trail the actor can\n//      switch off is not an audit trail, which is why that field is not preserved here;\n//   6. notification to the impersonated user, not only to administrators;\n//   7. a forbidden-while-impersonating operation set (credential change, account deletion,\n//      API-key/token minting, and any further impersonation);\n//   8. an unmistakable frontend banner for the whole session.\n//\n// assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE · TODO(assurance-control) — privileged access\n// under another identity must be authorized, time-boxed, and attributable to the human actor.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n//\n// ACCOUNT MERGE IS A MULTI-RESOURCE CAPABILITY — NOT AN UPDATE ON `users`.\n// `MERGE_ACCOUNTS` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ targetUserId, keepPrimaryUser, mergeProfile, mergePreferences,\n// mergeOrganizations, reason }` and promising a `{ mergedUser, removedUserId, mergedDataSummary }`\n// response, and was removed on 2026-08-01: it was ROUTED but never implemented. Not one request\n// field is a persisted `users` field, so the controller and repository strict parses left an empty\n// `$set` — nothing merged, nothing was removed, and the declared response could never be produced.\n//\n// It was removed rather than implemented because nothing asks for it AND the identity model\n// prevents the duplicate class it names:\n//   - `UserSchema.email` is the STRICT unique identity anchor — \"there is never more than one\n//     `User` per email\". All five provisioning paths (self-registration, org-admin invite, SSO JIT,\n//     SCIM, anonymous transposition) find-or-create by the normalized value; `.toLowerCase()`\n//     closes the casing fork and `.excludeFromUpdate()` keeps the anchor immutable.\n//   - The multi-provider case — one human, several IdPs — is already first-class via\n//     `USER_IDENTITY_LINKS` (many links per user, compound-unique per tenant connection).\n//     There is nothing to merge.\n//   - No duplicate-detection surface exists anywhere, so nothing could ever supply `targetUserId`.\n//     The verb had no consumer AND no producer.\n//\n// Do NOT re-declare it as an `UPDATE` on `users`. A merge is a transactional identity move across\n// every resource holding a `userId` FK (~21 engine schema/resource-config files declare one, plus\n// every app-defined resource the engine cannot enumerate), and the framework has no such primitive\n// today: the closest prior art, `AnonymousSessionBackendService.transposeOwnership()`, loops\n// resource types accumulating `failedTypes[]` and reports partial failure instead of rolling back.\n// The same problem in its EASIER form — a receiving identity with no competing state — was also\n// left undone: `ResourceTranspositionPolicy.MERGE` was declared vocabulary that no resource\n// selected and that warned \"not yet implemented — falling back to ADD\". It was REMOVED from the\n// enum on 2026-09-08 (#418) rather than implemented, on the same reasoning as this note: a merge\n// primitive is owed before either surface can offer one.\n//\n// Re-declaring requires, as one workstream:\n//   1. a duplicate-detection surface that produces merge candidates — without it the verb has no\n//      caller, which is how the removed declaration ended up unreachable;\n//   2. a cross-resource transaction via `resolveResourceOperationTransactionPersistenceContract`\n//      (`transactionalCore` + named `transactionParticipants`), NOT a per-resource loop that can\n//      half-apply and leave two partially-merged identities;\n//   3. an FK-graph walk reusing the subject-erasure traversal in `compliance/` rather than a\n//      re-derived inventory that silently misses app-defined resources;\n//   4. explicit conflict resolution for the 1:1 compositions (`USER_PROFILES`, `USER_PREFERENCES`\n//      are `.isUnique()` per user) and for two memberships in the same organization — the removed\n//      `mergeProfile` / `mergePreferences` / `mergeOrganizations` booleans named the axes but\n//      decided nothing;\n//   5. a settled, WRITTEN-DOWN answer for the losing user's audit history. It must NOT be silently\n//      rewritten: `auditable-events.shared.schema.ts` is the densest `userId` holder in the engine\n//      (32 occurrences), and re-pointing those rows would forge the record an auditor relies on;\n//   6. a dedicated auditable event for the merge itself — the removed operation emitted nothing at\n//      all. (Operation-level auditing now exists via risk-tiered `RESOURCE_OPERATION_PERFORMED`\n//      emission, so a reinstated merge verb would inherit a row from its declared risk level; it\n//      would still need its own event to name the two identities being consolidated.);\n//   7. a decision on the erasure interaction: a merged-away identity that was subject to retention\n//      must not resurrect scrubbed personal data through the surviving row.\n//\n// assurance-control: WILDO.IDENTITY.LIFECYCLE · TODO(assurance-control) — consolidating two\n// identities is a privileged identity-lifecycle change and must be authorized, attributable, and\n// non-destructive to the audit trail.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\nexport enum Users_Operations {\n  ASSIGN_ROLES = 'assign_roles', // Assign application roles\n  REVOKE_ROLES = 'revoke_roles', // Revoke application roles\n  SUSPEND_USER = 'suspend_user', // Suspend user account\n  UNSUSPEND_USER = 'unsuspend_user', // Unsuspend user account\n  REACTIVATE_USER = 'reactivate_user', // Reactivate a SELF-deactivated account (INACTIVE → ACTIVE)\n  FORCE_PASSWORD_RESET = 'force_password_reset', // Force password reset\n  /**\n   * The audited see-through read of a RETAINED (erased-and-impersonalized) user row (#490).\n   *\n   * `retentionPolicy: RETAIN_AND_IMPERSONALIZE` keeps the row and scrubs its subject, and the M5a\n   * hide-predicate then makes it unreadable through every ordinary door — deliberately. The engine\n   * has held the audited way back in (`readRetainedAsSystem`) since that landed, and **nothing could\n   * reach it**: the primitive was referenced by the factory that derives its grant and by prose, and\n   * by no caller. So the only route to a retained record was a database console, which is the\n   * unaudited path the primitive exists to replace.\n   *\n   * This is that route. It is not a second read of the users table — it reveals personal data a\n   * retention policy deliberately made unreadable, which is why it is its own operation with its own\n   * role gate, its own mandatory justification and its own audit row.\n   */\n  READ_RETAINED = 'read_retained',\n}\n\ntype UsersCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\n/*\nUsers Resource Configuration Factory\n*/\nexport const usersResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof Users_Operations,\n  UsersCoreOperations,\n  typeof UserSchema\n>({\n  mainSchema: UserSchema,\n  resourceIdentifier: CoreResourceType.USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Users are app-scoped\n\n  /**\n   * `/users/{userId}` names the TARGET of an administrative action, never the caller.\n   *\n   * This resource's `resourceFieldIdentifier` is `userId` — the same key the W3.6 identity-coherence\n   * guard compares against the JWT subject. Without this declaration that guard read every\n   * `/users/{targetId}` request as \"the caller claims to be targetId\" and refused it with\n   * `403 authorization_user_id_mismatch`, which made the ENTIRE administrative surface unreachable\n   * cross-user: `assign_roles`, `revoke_roles`, `suspend_user`, `unsuspend_user`,\n   * `reactivate_user`, `force_password_reset`, the admin READ and the core UPDATE/DELETE. Every one of those is\n   * documented in the resource specification as acting on \"another user's record\" and is surfaced in\n   * the admin UI as a per-row action, so the framework contradicted itself.\n   *\n   * ⚠️ The SIBLING resource must keep the default. `USER_SELF` is a second configuration over the\n   * SAME collection and shares this exact field identifier (\"Same as USERS but different context\"),\n   * but there the segment genuinely names the caller — so it stays `true` and its horizontal-IDOR\n   * refusal keeps holding. The two are indistinguishable structurally, which is precisely why this\n   * is declared rather than inferred.\n   *\n   * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an administrative action on another principal\n   * is authorized by the caller's ROLE, not by the caller and the subject being the same person.\n   */\n  primaryKeyIdentifiesInitiator: false,\n\n  // create: org-admin invite eagerly provisions a `User{status: PENDING_INVITATION}`\n  // in-process (the invitee has no account yet). The API_CALL CREATE variant is\n  // APP_ADMIN_SUPER_ADMIN-gated AND manually omits `status`/`appRoles` from its DTO, so\n  // a plain create could neither be issued by the org admin nor persist the non-default\n  // status. Opt CREATE into the trusted `createAsSystem` path (fail-closed elsewhere):\n  // the synthesized super-admin context satisfies the ACL and `preserveServerInjectedFields`\n  // re-attaches `status` past the DTO strip. See organization-member-custom-implementation.\n  //\n  // read: the INBOUND_CONTACTS anonymous-CREATE lead-triage prefix\n  // (`inbound-contact-custom-implementation`) must look up a user by email from an\n  // ANONYMOUS context that cannot read USERS. It routes that request-triggered bypass\n  // through the sanctioned `readAsSystem` (fail-closed + `SYSTEM_CONTEXT_READ` audit)\n  // rather than a hand-built super-admin EC. The caller enforces its own boundary: it\n  // consumes ONLY `.status` and returns ONLY a `.isBackendOnly()` enum, so the full\n  // super-admin row never reaches the anonymous submitter (no enumeration oracle).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    read: ResourceSystemAccessMode.ALLOWED,\n    /**\n     * Trusted server-side ACTIVATION / DEACTIVATION of a user's lifecycle `status`.\n     *\n     * `status` is `.excludeFromUpdate()`, so the client-facing UPDATE contract cannot carry it and\n     * the lifecycle verbs (`suspend_user` / `unsuspend_user`) own the administrative transitions.\n     * But four trusted flows legitimately move `status` WITHOUT a caller — email verification\n     * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning\n     * (`→ INACTIVE`) — and none of them is a lifecycle verb: they are consequences of an\n     * out-of-band fact (a confirmed email, a directory row disappearing), not an operator decision\n     * with a reason and a state machine.\n     *\n     * `updateAsSystem` is the door for exactly that shape, and it re-attaches the excluded field\n     * past the strict request-DTO parse. Without this grant those writes are silently stripped and\n     * users simply never activate — no error, no signal.\n     */\n    update: ResourceSystemAccessMode.ALLOWED,\n    // `updateMany` + `seeRetained` are NOT authored here — `retentionPolicy` derives both, and\n    // authoring either as FORBIDDEN is a config error. Leave them to the factory.\n  },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the user row instead of deleting it: the retained financial\n   * records (invoices, usage) keep a resolvable foreign key, now pointing at an anonymized subject.\n   * `RETAIN_AND_IMPERSONALIZE` because this row DOES hold personal data of its own — `email` — which\n   * the scrub masks to `ERASED_USER_EMAIL`. A retained row is hidden from every normal read and\n   * frozen; only the audited `seeRetained` path can reach it.\n   *\n   * ⚠️ `USER_SELF` declares the SAME policy on purpose. It is a second resource config over the SAME\n   * `users` collection (see `getCollectionNameForResource` in the zod→mongoose convertor: separate\n   * models, one collection). Retention governance is per-config, so opting in only here would leave\n   * an erased row readable AND updatable through the USER_SELF door, and would put a PLAIN unique\n   * index on `email` alongside this one's retention-scoped index — which the second erasure would\n   * then collide with (E11000) and abort. The two configs must be changed together.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject IS this row: erasing user `X` ends the session of user `X`. Declaring it makes that\n   * revocation EXPLICIT — until now it happened only as a side effect of the retention row-hide (the\n   * auth fronts re-read the user, find the row hidden, and 401) plus the scrub bumping\n   * `authorizationVersion`. Neither is a written revocation, so the guarantee rested entirely on two\n   * unrelated mechanisms continuing to behave that way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  /**\n   * Subject-export disclosure. The operator-facing export subject.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.UPDATE_MANY,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: Users_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // ⚠️ DELIBERATELY NOT `admitsCrossSubjectUserAdministration`. This variant is gated\n          // `APP_USER`, so admitting cross-subject addressing here would let ANY authenticated user\n          // read ANY other user's row — `email`, `appRoles`, `status` — for every application built\n          // on the framework. Reading another user is the `admin` variant's job, directly below.\n          //\n          // The pre-existing comment on this line read \"v1: app users can view other users\", which\n          // the USER_SELF-scope authorization has never permitted (`authorizeUserSelf` requires the\n          // addressed row to BE the caller). The claim was aspirational, not behaviour — removed\n          // rather than acted on, because acting on it is a privacy decision for the product, not a\n          // side effect of fixing the administrative surface. If app users SHOULD be able to view\n          // each other, that wants its own decision, its own DTO narrowing (this variant returns the\n          // full row today) and its own probes.\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // THE administrative read. Gated `APP_ADMIN_VIEWER`, and the surface the admin UI's user\n          // list is built on — so it must be able to address someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          // Framework-internal LIST only — INTERNAL_CALL registers NO HTTP route, so\n          // this is never reachable by an app user (or anyone) over HTTP. It exists for\n          // internal enumeration (e.g. enrichment / labelling), invoked with a system\n          // execution context that carries APP_ADMIN_SUPER_ADMIN. `roles: []` is inert\n          // here precisely because it is not URL-bearing and role-gating is bypassed for\n          // internal execution — it is NOT \"any app user can list users\" (an empty roles\n          // array on a URL-bearing variant would be fail-closed → 403). App users do not\n          // get a global list-all; they READ a user (APP_USER) and enumerate via the\n          // org-scoped SEARCH people-picker below.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          // The ONLY HTTP-exposed LIST — admin-gated global user listing.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `email` is the only human-searchable field ON the user row. First/last\n          // name and display name live on `USER_PROFILES` (1:1, keyed by `userId`)\n          // and are MUTABLE there, so they are searched RELATIONALLY rather than\n          // denormalized: the framework searches `USER_PROFILES` (by its own\n          // searchable fields — firstName/lastName/displayName) and intersects the\n          // matching `userId`s with this resource's `_id`. (`username` was a phantom\n          // field — it exists on no user collection — and has been removed.) This\n          // powers the org-scoped \"people picker\" (e.g. a `createdByUserId` filter):\n          // the junction scope filter keeps results within the caller's org.\n          // See SearchableRelationDescriptor in resources-config.shared.schemas.ts.\n          searchableFields: [\n            'email',\n            {\n              localField: '_id',\n              relatedResource: CoreResourceType.USER_PROFILES,\n              relatedJoinField: 'userId',\n              // fields omitted → defaults to USER_PROFILES' own searchableFields\n              // (firstName, lastName, displayName).\n            },\n          ],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: USERS_ADMIN_FILTER_FIELDS,\n          sortFields: USERS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 200,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // DTOs auto-derived from decorators (excludeFromCreate on _id, createdAt, updatedAt).\n          //\n          // ⚠️ `status` and `appRoles` ARE part of this create contract. An earlier comment here\n          // claimed they were \"manually excluded\"; they never were — neither field carries\n          // `.excludeFromCreate()` and this variant declares no narrowing `requestDto`, so both are\n          // accepted (confirmed against the generated OpenAPI create schema). `appRoles` being\n          // caller-settable is exactly why this path carries an explicit role-ceiling gate — see\n          // `user-role-administration.custom-impl.backend.service.ts`. An absent `appRoles` falls\n          // back to the schema default and is NOT treated as a caller grant.\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, users manage themselves via USER_SELF\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // DTOs auto-derived from decorators. Only `appRoles` and `userTypes`\n          // remain writable: `_id`, `email`, `status`, `scheduledReactivationAt`\n          // and timestamps all carry `excludeFromUpdate()`.\n          //\n          // Because `appRoles` is caller-settable here, this path is\n          // the one that actually grants application authority, and it carries the role-ceiling gate\n          // plus a USER_APP_ROLES_CHANGED audit event (`user-role-administration.custom-impl`).\n          //\n          // This whole-array REPLACE is why the additive `assign_roles` / subtractive `revoke_roles`\n          // verbs are not redundant with it: reaching the same end-state here requires a\n          // read-modify-write that races with, and silently clobbers, a concurrent edit.\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          // The CAPABILITY without a new HTTP surface. `retentionPolicy` requires UPDATE_MANY because\n          // the impersonalize writer scrubs rows in place through `updateManyAsSystem`. Exposing a bulk\n          // user update over HTTP would be a genuinely dangerous admin surface (mass role/status\n          // rewrites), and INTERNAL_CALL registers NO route — like the LIST default above.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY. Both are route-less, but the three retention\n          // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n          // their operation through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL /\n          // API_CALL / API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is deliberately excluded there and served\n          // by the separate `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant here\n          // therefore satisfies the factory's \"UPDATE_MANY exists\" guard at boot and then FAILS TO RESOLVE\n          // when an erasure actually runs. `roles` is inert on a non-URL-bearing variant (role gating is\n          // bypassed for internal execution); the real gate is the derived `systemAccessPolicy.updateMany`\n          // grant, which the trusted writer is fail-closed on.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, critical risk\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // Irreversible identity destruction — the caller must prove they are still themselves,\n          // not merely that they held a session at some point. `riskLevel: CRITICAL` above does NOT\n          // do this: it drives danger-zone placement and typed confirmation in the UI and is read by\n          // no authorization code. Nor does the per-user-type `stepUpAuth` policy, which is opt-in,\n          // off by default and satisfied by any authentication newer than `maxAgeSeconds`.\n          //\n          // The audience is the reason this one is safe to gate first: `APP_ADMIN_SUPER_ADMIN` is an\n          // APPLICATION-level authority, whereas the population that provably cannot step up —\n          // directory-managed (SCIM) users, whose `passwordHash` and passkeys the framework\n          // deliberately destroys in `_reconcileLocalCredentialsForDirectoryManaged` — is\n          // ORGANIZATION-scoped by construction.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n          requiresStepUpAuthentication: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.ASSIGN_ROLES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // ADDITIVE grant. `roles` is the REQUEST contract; the custom implementation translates it\n          // into a union over the persisted `appRoles` array, gates it against the caller's own role\n          // ceiling, and emits USER_APP_ROLES_CHANGED. Before that implementation existed, `roles`\n          // named no schema path, so the generic core UPDATE persisted nothing and answered 200.\n          requestDto: z.object({\n            roles: z.array(AppRolesSchema).min(1),\n            reason: z.string().max(500).optional()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.REVOKE_ROLES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // SUBTRACTIVE revocation — a set difference against the persisted `appRoles`, never a blind\n          // overwrite. Ceiling-gated like the grant: an administrator who may not GRANT a role must\n          // not be able to STRIP it either, or the cheapest attack on a privileged account is to\n          // remove the authority of whoever could intervene.\n          requestDto: z.object({\n            roles: z.array(AppRolesSchema).min(1),\n            reason: z.string().max(500).optional()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.SUSPEND_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects access\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory. `suspensionDuration` is in DAYS\n          // and is resolved to an absolute `scheduledReactivationAt` at write time — a duration is\n          // meaningless without the moment it is counted from, and the row records no such moment.\n          requestDto: z.object({\n            reason: z.string().min(1).max(500),\n            suspensionDuration: z.number().min(1).optional(), // Days\n            notifyUser: z.boolean().default(true)\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.UNSUSPEND_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, medium risk\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory (SUSPENDED → ACTIVE), which also\n          // clears any pending `scheduledReactivationAt` so a manual unsuspend does not leave the\n          // sweep's deadline behind for a later suspension to inherit.\n          //\n          // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this declaration the trail\n          // would record every suspension (HIGH) and none of the reinstatements — leaving an\n          // account that was suspended and cleared reading as still suspended.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n          requestDto: z.object({\n            reason: z.string().max(500).optional(),\n            notifyUser: z.boolean().default(true)\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.SUSPENDED;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * The only door back from a SELF-deactivated account (#430).\n     *\n     * `user_self | deactivate_account` writes INACTIVE, and until this verb existed nothing could\n     * lift it: `REACTIVATE_ACCOUNT` needs a session, sign-in admits only ACTIVE users\n     * (`_enforceUserStatus` refuses every other status), `unsuspend_user` refuses INACTIVE BY\n     * DESIGN, and `status` is excluded from update. A person who deactivated their own account was\n     * out permanently, and the only route back was a database write.\n     *\n     * ADMIN-TIER, which is door 2 of the three that were on the table, and its two costs were\n     * accepted rather than discovered: every self-deactivated user becomes a support ticket, and an\n     * administrator can reactivate an account whose owner did not ask. The second is why `reason`\n     * is MANDATORY here while `unsuspend_user` leaves it optional — an administrator reversing\n     * someone else's own choice about their account owes an auditor a sentence, where lifting an\n     * administrative suspension is merely undoing an administrative act.\n     *\n     * INACTIVE ONLY. A SUSPENDED account stays `unsuspend_user`'s business: an imposed halt and a\n     * chosen departure are two states whose whole distinction is who may lift them, and widening\n     * one verb to cover both was the option rejected precisely because it erases that.\n     *\n     * Implemented by the shared status-transition factory — which is also what routes the write\n     * through the SYSTEM door. `status` is `.excludeFromUpdate()`, so a handler writing it directly\n     * is stripped by the repository's strict re-parse and the operation reports success having\n     * persisted nothing; that failure mode has already cost this repository four sibling\n     * activations (`.claude/rules/invariant-call-site-enumeration.md` #8).\n     *\n     * assurance-control: WILDO.IDENTITY.LIFECYCLE — reinstating a deactivated principal is a\n     * privileged identity-lifecycle change and must be authorized, attributable and audited.\n     */\n    [Users_Operations.REACTIVATE_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is\n          // still gated by `roles` above; this only admits the SUBJECT to be someone else.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this the trail would record\n          // the departure (DEACTIVATE_ACCOUNT) and not the return — an account reinstated by an\n          // administrator reading as still deactivated. Same reasoning as `unsuspend_user`.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n          requestDto: z.object({\n            // MANDATORY, unlike `unsuspend_user`'s: see the JSDoc above.\n            reason: z.string().min(1).max(500),\n            notifyUser: z.boolean().default(true),\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.INACTIVE;\n          },\n        },\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n      ],\n    },\n\n    /**\n     * Administrator-compelled credential reset.\n     *\n     * Implemented by `createUserForcePasswordResetFactories`, which mints a single-use\n     * PASSWORD_RESET token for the target, mails the reset link to the TARGET, revokes the\n     * target's live sessions, and emits `USER_PASSWORD_RESET_FORCED` naming the acting\n     * administrator and their reason.\n     *\n     * Three fields the original declaration carried are deliberately gone:\n     *\n     *  - **`customResponseDto: { resetToken, resetUrl }`** — an account-takeover primitive. An\n     *    administrator holding the link can set the user's password and then authenticate AS\n     *    them; with no actor claim on a session JWT, nothing downstream could tell that apart\n     *    from a genuine login, and the owner would never be told. The link now goes only to the\n     *    account owner's inbox, and the response carries non-secret metadata.\n     *  - **`resetExpirationHours` (1–168)** — a caller-widenable credential-recovery window is a\n     *    persistence mechanism, not a recovery one. The TTL is now a framework policy constant.\n     *  - **`notifyUser`** — notifying the owner is the MECHANISM (the mail carries the only copy\n     *    of the link), not an option an operator can decline.\n     *\n     * `reason` stays and is mandatory: it is what an auditor reads when asking why a credential\n     * was reset out-of-band.\n     *\n     * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n     * intervention is authorized, attributable, justified, and evicts existing access.\n     */\n    /**\n     * See-through read of a retained subject (#490).\n     *\n     * ## Why it is UPDATE-like, when it plainly reads\n     *\n     * Same reasoning the webhook `testEndpoint` probe records, and for a sharper reason. Borrowing\n     * READ yields a GET, and a GET carries its parameters in the URL — which would put the operator's\n     * free-text `reason` into every access log, proxy log and browser history between here and the\n     * server. A justification for revealing scrubbed personal data routinely NAMES someone: a\n     * dispute, a legal hold, a subject. Putting it in a query string is a privacy defect, not an\n     * inconvenience.\n     *\n     * The operation also has a real side effect — every call emits a `RETAINED_DATA_ACCESS` audit row\n     * — so `x-idempotent` would have had to be false on a GET, which is the self-contradiction that\n     * argument already produced once.\n     *\n     * ## Why `reason` is in the DTO and the caller's identity is NOT\n     *\n     * `accessingUserId` and `accessingUserRoles` reach the primitive from the EXECUTION CONTEXT, never\n     * from the request. A body-supplied identity is a claim the caller writes about themselves, and\n     * the entire value of the audit row is that it says who really looked. `reason` is the one thing\n     * only the human can supply, so it is the one thing the request carries.\n     *\n     * `admitsCrossSubjectUserAdministration` is declared because the subject is by definition someone\n     * else: a retained row belongs to an erased person, and the caller is an administrator. The\n     * `roles` gate above still decides WHO may call it.\n     */\n    [Users_Operations.READ_RETAINED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          admitsCrossSubjectUserAdministration: true,\n          // The highest risk level the vocabulary has, and it is not decoration: this is the only\n          // operation in the resource that reveals personal data an erasure was performed to remove.\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            /**\n             * Why this reveal is happening — a legal hold, a dispute, an investigation.\n             *\n             * Required, and the length floor is enforced twice on purpose: here, so the request is\n             * refused before anything is read, and again inside `readRetainedAsSystem`, which\n             * fail-closes on a blank attribution because the audit store persists `eventData`\n             * unparsed. A reveal with no reason is an anonymous reveal.\n             */\n            reason: z.string().trim().min(1).max(500),\n          }),\n        }\n      ],\n    },\n\n    [Users_Operations.FORCE_PASSWORD_RESET]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects authentication\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            reason: z.string().min(1).max(500)\n          }),\n          customResponseDto: z.object({\n            /** When the emailed reset link stops working. Non-secret — the link itself is not returned. */\n            expiresAt: z.date(),\n            /** Always true today; explicit so the caller can see the eviction happened. */\n            sessionsRevoked: z.boolean()\n          }),\n          // A deleted identity has no credential path worth resetting; the service rejects it\n          // with a 409. Hides the roster action rather than letting it 409 on click.\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status !== UserStatus.DELETED;\n          }\n        }\n      ],\n      // The ADMIN-AUDIT copy. The user-facing reset mail is the system PASSWORD_RESET template\n      // dispatched by the auth service when the token is minted — deliberately not duplicated\n      // into this resource-operation fan-out, which would create a second reset email that can\n      // drift from the one the self-service flow sends.\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n  },\n});\n"]}
+{"version":3,"file":"users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,UAAU,EACV,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,6CAA6C;AAC7C,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAEnF,oCAAoC;AACpC,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC;AAEF,qEAAqE;AACrE,MAAM,yBAAyB,GAAG;IAChC,GAAG,mBAAmB;IACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;IACvD,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,gCAAgC;CACrD,CAAC;AAEF,iDAAiD;AACjD,MAAM,uBAAuB,GAAG,CAAC,GAAG,iBAAiB,EAAE,QAAQ,CAAU,CAAC;AAE1E,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,+FAA+F;AAC/F,gGAAgG;AAChG,uFAAuF;AACvF,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,iFAAiF;AACjF,EAAE;AACF,4CAA4C;AAC5C,gGAAgG;AAChG,qFAAqF;AACrF,8FAA8F;AAC9F,iGAAiG;AACjG,sEAAsE;AACtE,gGAAgG;AAChG,kFAAkF;AAClF,kGAAkG;AAClG,wFAAwF;AACxF,0EAA0E;AAC1E,2FAA2F;AAC3F,8DAA8D;AAC9D,8DAA8D;AAC9D,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,sEAAsE;AACtE,EAAE;AACF,2EAA2E;AAC3E,+FAA+F;AAC/F,qFAAqF;AACrF,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,mGAAmG;AACnG,EAAE;AACF,4FAA4F;AAC5F,yCAAyC;AACzC,8FAA8F;AAC9F,oGAAoG;AACpG,8FAA8F;AAC9F,oFAAoF;AACpF,qFAAqF;AACrF,0FAA0F;AAC1F,iCAAiC;AACjC,mGAAmG;AACnG,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,mGAAmG;AACnG,6FAA6F;AAC7F,mGAAmG;AACnG,gGAAgG;AAChG,4FAA4F;AAC5F,gGAAgG;AAChG,iGAAiG;AACjG,yDAAyD;AACzD,EAAE;AACF,4CAA4C;AAC5C,iGAAiG;AACjG,0EAA0E;AAC1E,iGAAiG;AACjG,iGAAiG;AACjG,6DAA6D;AAC7D,6FAA6F;AAC7F,wEAAwE;AACxE,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,wBAAwB;AACxB,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,uFAAuF;AACvF,mGAAmG;AACnG,4EAA4E;AAC5E,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,sCAAsC;AACtC,sEAAsE;AACtE,MAAM,CAAN,IAAY,gBAsBX;AAtBD,WAAY,gBAAgB;IAC1B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;IACnC,iEAA6C,CAAA;IAC7C;;;;;;;;;;;;;OAaG;IACH,mDAA+B,CAAA;AACjC,CAAC,EAtBW,gBAAgB,KAAhB,gBAAgB,QAsB3B;AAWD;;EAEE;AACF,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;IAC1C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACnF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,uBAAuB;IAE/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,6BAA6B,EAAE,KAAK;IAEpC,mFAAmF;IACnF,8EAA8E;IAC9E,sFAAsF;IACtF,sFAAsF;IACtF,qFAAqF;IACrF,2FAA2F;IAC3F,0FAA0F;IAC1F,EAAE;IACF,iEAAiE;IACjE,iFAAiF;IACjF,oFAAoF;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,kFAAkF;IAClF,iFAAiF;IACjF,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,2FAA2F;QAC3F,8EAA8E;KAC/E;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;;;OAMG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,gBAAgB;IAEjC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oFAAoF;oBACpF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,uFAAuF;oBACvF,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,uFAAuF;oBACvF,0FAA0F;oBAC1F,wFAAwF;oBACxF,2FAA2F;oBAC3F,sCAAsC;iBACvC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,yFAAyF;oBACzF,kFAAkF;oBAClF,oCAAoC,EAAE,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,2EAA2E;oBAC3E,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,2EAA2E;oBAC3E,yCAAyC;oBACzC,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,gEAAgE;oBAChE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,yEAAyE;oBACzE,yEAAyE;oBACzE,uEAAuE;oBACvE,mEAAmE;oBACnE,yEAAyE;oBACzE,2EAA2E;oBAC3E,wEAAwE;oBACxE,2EAA2E;oBAC3E,mEAAmE;oBACnE,0EAA0E;oBAC1E,gBAAgB,EAAE;wBAChB,OAAO;wBACP;4BACE,UAAU,EAAE,KAAK;4BACjB,eAAe,EAAE,gBAAgB,CAAC,aAAa;4BAC/C,gBAAgB,EAAE,QAAQ;4BAC1B,mEAAmE;4BACnE,sCAAsC;yBACvC;qBACF;oBACD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,EAAE;oBACF,uFAAuF;oBACvF,iFAAiF;oBACjF,0FAA0F;oBAC1F,qFAAqF;oBACrF,uFAAuF;oBACvF,wFAAwF;oBACxF,mEAAmE;iBACpE;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wDAAwD;oBACvG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qEAAqE;oBACrE,uEAAuE;oBACvE,kDAAkD;oBAClD,EAAE;oBACF,2DAA2D;oBAC3D,2FAA2F;oBAC3F,sFAAsF;oBACtF,EAAE;oBACF,2FAA2F;oBAC3F,+EAA+E;oBAC/E,+EAA+E;iBAChF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,iFAAiF;oBACjF,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,+FAA+F;oBAC/F,gGAAgG;oBAChG,gGAAgG;oBAChG,iGAAiG;oBACjG,+FAA+F;oBAC/F,iGAAiG;oBACjG,qDAAqD;oBACrD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gCAAgC;oBAC/E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,2FAA2F;oBAC3F,qFAAqF;oBACrF,kFAAkF;oBAClF,gFAAgF;oBAChF,uCAAuC;oBACvC,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,2FAA2F;oBAC3F,2FAA2F;oBAC3F,yFAAyF;oBACzF,uFAAuF;oBACvF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4FAA4F;oBAC5F,0FAA0F;oBAC1F,uFAAuF;oBACvF,mDAAmD;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,6CAA6C;oBAC5F,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,yFAAyF;oBACzF,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;wBAClC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO;wBACzD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;YACjC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,8BAA8B;oBAC7E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,sFAAsF;oBACtF,mFAAmF;oBACnF,qEAAqE;oBACrE,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;wBACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC;oBACvD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BG;QACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,uFAAuF;oBACvF,iFAAiF;oBACjF,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,sFAAsF;oBACtF,kFAAkF;oBAClF,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,6DAA6D;wBAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;wBAClC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBACtC,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE;YAChC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,oCAAoC,EAAE,IAAI;oBAC1C,wFAAwF;oBACxF,2FAA2F;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB;;;;;;;2BAOG;wBACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;qBAC1C,CAAC;iBACH;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qDAAqD;oBACpG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;qBACnC,CAAC;oBACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,+FAA+F;wBAC/F,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;wBACnB,+EAA+E;wBAC/E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;qBAC7B,CAAC;oBACF,oFAAoF;oBACpF,2EAA2E;oBAC3E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;oBACrD,CAAC;iBACF;aACF;YACD,yFAAyF;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,kDAAkD;YAClD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KAEF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Users Shared Resource Configuration\n *\n * Resource configuration for administrative user management operations.\n * Handles user lifecycle, role management, and administrative actions.\n */\n\nimport { z } from 'zod';\nimport {\n  UserSchema,\n  UserStatus,\n  UserTheme\n} from './users.shared.schemas';\nimport { AppRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Sort and filter fields for user management\nconst USERS_SORT_FIELDS = ['createdAt', 'updatedAt', 'joinedAt', 'email'] as const;\n\n// App users get basic filter fields\nconst USERS_FILTER_FIELDS = {\n  status: z.enum(UserStatus),\n  email: z.string(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst USERS_ADMIN_FILTER_FIELDS = {\n  ...USERS_FILTER_FIELDS,\n  createdAt: z.date(), // Admin can filter by creation date\n  updatedAt: z.date(), // Admin can filter by update date\n  joinedAt: z.date(), // Admin can filter by join date\n};\n\n// App Admin gets additional sorting capabilities\nconst USERS_ADMIN_SORT_FIELDS = [...USERS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for user management\n//\n// Invitation is intentionally absent. Organization invitations are created by\n// the organization-members lifecycle, where the pending membership, invitee\n// identity, token and email are produced together. A previous `send_invitation`\n// users operation declared an invitation-receipt DTO but registered no backend\n// implementation capable of producing it. Reintroduce an application-wide\n// invitation operation only with a real lifecycle owner and handler; an\n// API_CALL declaration by itself is not an implementation.\n//\n// IMPERSONATION IS NOT A TOKEN MINT — IT IS AN IDENTITY SUBSTRATE THE FRAMEWORK DOES NOT HAVE.\n// `IMPERSONATE` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ reason, durationMinutes, auditLog }` and promising a\n// `{ impersonationToken, expiresAt, auditId }` response, and was removed on 2026-08-01: it was\n// ROUTED but never implemented. With `resourceOperationLike: READ` the generic core path simply\n// returned the target's user row, so the most dangerous verb in the catalogue answered\n// **HTTP 200** — an operator is told an impersonation session exists when none does.\n//\n// Do NOT re-declare it as a plain token mint. A minted session JWT is today byte-for-byte\n// indistinguishable from a genuine one: the payload is `{…, sub: userId, aud: 'AUTH_TOKEN' }`\n// with NO actor claim, and `ExecutionContext` has no \"acting as\" dimension. Every audit event\n// raised during such a session would be attributed to the impersonated USER rather than the\n// administrator — the framework would manufacture false attribution in exactly the records an\n// auditor relies on. That is strictly worse than having no impersonation at all.\n//\n// Re-declaring requires, as one workstream:\n//   1. an actor claim on the session JWT (RFC 8693 `act`-style: `sub` = target, actor = admin),\n//      minted through a dedicated path — never by reusing the ordinary login issuer;\n//   2. `ExecutionContext` propagation of that actor, so it reaches every downstream consumer;\n//   3. actor-attributed audit events — a new `CoreAuditableEventType` pair for session start/end\n//      plus actor stamping on every event raised while impersonating;\n//   4. an explicit revocation path (revoking the impersonation must not log the real user out);\n//   5. a server-side hard duration cap from configuration — NOT a caller-supplied\n//      `durationMinutes`, and NOT a caller-supplied `auditLog` flag: an audit trail the actor can\n//      switch off is not an audit trail, which is why that field is not preserved here;\n//   6. notification to the impersonated user, not only to administrators;\n//   7. a forbidden-while-impersonating operation set (credential change, account deletion,\n//      API-key/token minting, and any further impersonation);\n//   8. an unmistakable frontend banner for the whole session.\n//\n// assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE · TODO(assurance-control) — privileged access\n// under another identity must be authorized, time-boxed, and attributable to the human actor.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n//\n// ACCOUNT MERGE IS A MULTI-RESOURCE CAPABILITY — NOT AN UPDATE ON `users`.\n// `MERGE_ACCOUNTS` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ targetUserId, keepPrimaryUser, mergeProfile, mergePreferences,\n// mergeOrganizations, reason }` and promising a `{ mergedUser, removedUserId, mergedDataSummary }`\n// response, and was removed on 2026-08-01: it was ROUTED but never implemented. Not one request\n// field is a persisted `users` field, so the controller and repository strict parses left an empty\n// `$set` — nothing merged, nothing was removed, and the declared response could never be produced.\n//\n// It was removed rather than implemented because nothing asks for it AND the identity model\n// prevents the duplicate class it names:\n//   - `UserSchema.email` is the STRICT unique identity anchor — \"there is never more than one\n//     `User` per email\". All five provisioning paths (self-registration, org-admin invite, SSO JIT,\n//     SCIM, anonymous transposition) find-or-create by the normalized value; `.toLowerCase()`\n//     closes the casing fork and `.excludeFromUpdate()` keeps the anchor immutable.\n//   - The multi-provider case — one human, several IdPs — is already first-class via\n//     `USER_IDENTITY_LINKS` (many links per user, compound-unique per tenant connection).\n//     There is nothing to merge.\n//   - No duplicate-detection surface exists anywhere, so nothing could ever supply `targetUserId`.\n//     The verb had no consumer AND no producer.\n//\n// Do NOT re-declare it as an `UPDATE` on `users`. A merge is a transactional identity move across\n// every resource holding a `userId` FK (~21 engine schema/resource-config files declare one, plus\n// every app-defined resource the engine cannot enumerate), and the framework has no such primitive\n// today: the closest prior art, `AnonymousSessionBackendService.transposeOwnership()`, loops\n// resource types accumulating `failedTypes[]` and reports partial failure instead of rolling back.\n// The same problem in its EASIER form — a receiving identity with no competing state — was also\n// left undone: `ResourceTranspositionPolicy.MERGE` was declared vocabulary that no resource\n// selected and that warned \"not yet implemented — falling back to ADD\". It was REMOVED from the\n// enum on 2026-09-08 (#418) rather than implemented, on the same reasoning as this note: a merge\n// primitive is owed before either surface can offer one.\n//\n// Re-declaring requires, as one workstream:\n//   1. a duplicate-detection surface that produces merge candidates — without it the verb has no\n//      caller, which is how the removed declaration ended up unreachable;\n//   2. a cross-resource transaction via `resolveResourceOperationTransactionPersistenceContract`\n//      (`transactionalCore` + named `transactionParticipants`), NOT a per-resource loop that can\n//      half-apply and leave two partially-merged identities;\n//   3. an FK-graph walk reusing the subject-erasure traversal in `compliance/` rather than a\n//      re-derived inventory that silently misses app-defined resources;\n//   4. explicit conflict resolution for the 1:1 compositions (`USER_PROFILES`, `USER_PREFERENCES`\n//      are `.isUnique()` per user) and for two memberships in the same organization — the removed\n//      `mergeProfile` / `mergePreferences` / `mergeOrganizations` booleans named the axes but\n//      decided nothing;\n//   5. a settled, WRITTEN-DOWN answer for the losing user's audit history. It must NOT be silently\n//      rewritten: `auditable-events.shared.schema.ts` is the densest `userId` holder in the engine\n//      (32 occurrences), and re-pointing those rows would forge the record an auditor relies on;\n//   6. a dedicated auditable event for the merge itself — the removed operation emitted nothing at\n//      all. (Operation-level auditing now exists via risk-tiered `RESOURCE_OPERATION_PERFORMED`\n//      emission, so a reinstated merge verb would inherit a row from its declared risk level; it\n//      would still need its own event to name the two identities being consolidated.);\n//   7. a decision on the erasure interaction: a merged-away identity that was subject to retention\n//      must not resurrect scrubbed personal data through the surviving row.\n//\n// assurance-control: WILDO.IDENTITY.LIFECYCLE · TODO(assurance-control) — consolidating two\n// identities is a privileged identity-lifecycle change and must be authorized, attributable, and\n// non-destructive to the audit trail.\n// See `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\nexport enum Users_Operations {\n  ASSIGN_ROLES = 'assign_roles', // Assign application roles\n  REVOKE_ROLES = 'revoke_roles', // Revoke application roles\n  SUSPEND_USER = 'suspend_user', // Suspend user account\n  UNSUSPEND_USER = 'unsuspend_user', // Unsuspend user account\n  REACTIVATE_USER = 'reactivate_user', // Reactivate a SELF-deactivated account (INACTIVE → ACTIVE)\n  FORCE_PASSWORD_RESET = 'force_password_reset', // Force password reset\n  /**\n   * The audited see-through read of a RETAINED (erased-and-impersonalized) user row (#490).\n   *\n   * `retentionPolicy: RETAIN_AND_IMPERSONALIZE` keeps the row and scrubs its subject, and the M5a\n   * hide-predicate then makes it unreadable through every ordinary door — deliberately. The engine\n   * has held the audited way back in (`readRetainedAsSystem`) since that landed, and **nothing could\n   * reach it**: the primitive was referenced by the factory that derives its grant and by prose, and\n   * by no caller. So the only route to a retained record was a database console, which is the\n   * unaudited path the primitive exists to replace.\n   *\n   * This is that route. It is not a second read of the users table — it reveals personal data a\n   * retention policy deliberately made unreadable, which is why it is its own operation with its own\n   * role gate, its own mandatory justification and its own audit row.\n   */\n  READ_RETAINED = 'read_retained',\n}\n\ntype UsersCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\n/*\nUsers Resource Configuration Factory\n*/\nexport const usersResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof Users_Operations,\n  UsersCoreOperations,\n  typeof UserSchema\n>({\n  mainSchema: UserSchema,\n  resourceIdentifier: CoreResourceType.USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Users are app-scoped\n\n  /**\n   * `/users/{userId}` names the TARGET of an administrative action, never the caller.\n   *\n   * This resource's `resourceFieldIdentifier` is `userId` — the same key the W3.6 identity-coherence\n   * guard compares against the JWT subject. Without this declaration that guard read every\n   * `/users/{targetId}` request as \"the caller claims to be targetId\" and refused it with\n   * `403 authorization_user_id_mismatch`, which made the ENTIRE administrative surface unreachable\n   * cross-user: `assign_roles`, `revoke_roles`, `suspend_user`, `unsuspend_user`,\n   * `reactivate_user`, `force_password_reset`, the admin READ and the core UPDATE/DELETE. Every one of those is\n   * documented in the resource specification as acting on \"another user's record\" and is surfaced in\n   * the admin UI as a per-row action, so the framework contradicted itself.\n   *\n   * ⚠️ The SIBLING resource must keep the default. `USER_SELF` is a second configuration over the\n   * SAME collection and shares this exact field identifier (\"Same as USERS but different context\"),\n   * but there the segment genuinely names the caller — so it stays `true` and its horizontal-IDOR\n   * refusal keeps holding. The two are indistinguishable structurally, which is precisely why this\n   * is declared rather than inferred.\n   *\n   * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an administrative action on another principal\n   * is authorized by the caller's ROLE, not by the caller and the subject being the same person.\n   */\n  primaryKeyIdentifiesInitiator: false,\n\n  // create: org-admin invite eagerly provisions a `User{status: PENDING_INVITATION}`\n  // in-process (the invitee has no account yet). The API_CALL CREATE variant is\n  // APP_ADMIN_SUPER_ADMIN-gated AND manually omits `status`/`appRoles` from its DTO, so\n  // a plain create could neither be issued by the org admin nor persist the non-default\n  // status. Opt CREATE into the trusted `createAsSystem` path (fail-closed elsewhere):\n  // the synthesized super-admin context satisfies the ACL and `preserveServerInjectedFields`\n  // re-attaches `status` past the DTO strip. See organization-member-custom-implementation.\n  //\n  // read: the INBOUND_CONTACTS anonymous-CREATE lead-triage prefix\n  // (`inbound-contact-custom-implementation`) must look up a user by email from an\n  // ANONYMOUS context that cannot read USERS. It routes that request-triggered bypass\n  // through the sanctioned `readAsSystem` (fail-closed + `SYSTEM_CONTEXT_READ` audit)\n  // rather than a hand-built super-admin EC. The caller enforces its own boundary: it\n  // consumes ONLY `.status` and returns ONLY a `.isBackendOnly()` enum, so the full\n  // super-admin row never reaches the anonymous submitter (no enumeration oracle).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    read: ResourceSystemAccessMode.ALLOWED,\n    /**\n     * Trusted server-side ACTIVATION / DEACTIVATION of a user's lifecycle `status`.\n     *\n     * `status` is `.excludeFromUpdate()`, so the client-facing UPDATE contract cannot carry it and\n     * the lifecycle verbs (`suspend_user` / `unsuspend_user`) own the administrative transitions.\n     * But four trusted flows legitimately move `status` WITHOUT a caller — email verification\n     * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning\n     * (`→ INACTIVE`) — and none of them is a lifecycle verb: they are consequences of an\n     * out-of-band fact (a confirmed email, a directory row disappearing), not an operator decision\n     * with a reason and a state machine.\n     *\n     * `updateAsSystem` is the door for exactly that shape, and it re-attaches the excluded field\n     * past the strict request-DTO parse. Without this grant those writes are silently stripped and\n     * users simply never activate — no error, no signal.\n     */\n    update: ResourceSystemAccessMode.ALLOWED,\n    // `updateMany` + `seeRetained` are NOT authored here — `retentionPolicy` derives both, and\n    // authoring either as FORBIDDEN is a config error. Leave them to the factory.\n  },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the user row instead of deleting it: the retained financial\n   * records (invoices, usage) keep a resolvable foreign key, now pointing at an anonymized subject.\n   * `RETAIN_AND_IMPERSONALIZE` because this row DOES hold personal data of its own — `email` — which\n   * the scrub masks to `ERASED_USER_EMAIL`. A retained row is hidden from every normal read and\n   * frozen; only the audited `seeRetained` path can reach it.\n   *\n   * ⚠️ `USER_SELF` declares the SAME policy on purpose. It is a second resource config over the SAME\n   * `users` collection (see `getCollectionNameForResource` in the zod→mongoose convertor: separate\n   * models, one collection). Retention governance is per-config, so opting in only here would leave\n   * an erased row readable AND updatable through the USER_SELF door, and would put a PLAIN unique\n   * index on `email` alongside this one's retention-scoped index — which the second erasure would\n   * then collide with (E11000) and abort. The two configs must be changed together.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject IS this row: erasing user `X` ends the session of user `X`. Declaring it makes that\n   * revocation EXPLICIT — until now it happened only as a side effect of the retention row-hide (the\n   * auth fronts re-read the user, find the row hidden, and 401) plus the scrub bumping\n   * `authorizationVersion`. Neither is a written revocation, so the guarantee rested entirely on two\n   * unrelated mechanisms continuing to behave that way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  /**\n   * Subject-export disclosure. The operator-facing export subject.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.UPDATE_MANY,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: Users_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // ⚠️ DELIBERATELY NOT `admitsCrossSubjectUserAdministration`. This variant is gated\n          // `APP_USER`, so admitting cross-subject addressing here would let ANY authenticated user\n          // read ANY other user's row — `email`, `appRoles`, `status` — for every application built\n          // on the framework. Reading another user is the `admin` variant's job, directly below.\n          //\n          // The pre-existing comment on this line read \"v1: app users can view other users\", which\n          // the USER_SELF-scope authorization has never permitted (`authorizeUserSelf` requires the\n          // addressed row to BE the caller). The claim was aspirational, not behaviour — removed\n          // rather than acted on, because acting on it is a privacy decision for the product, not a\n          // side effect of fixing the administrative surface. If app users SHOULD be able to view\n          // each other, that wants its own decision, its own DTO narrowing (this variant returns the\n          // full row today) and its own probes.\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // THE administrative read. Gated `APP_ADMIN_VIEWER`, and the surface the admin UI's user\n          // list is built on — so it must be able to address someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          // Framework-internal LIST only — INTERNAL_CALL registers NO HTTP route, so\n          // this is never reachable by an app user (or anyone) over HTTP. It exists for\n          // internal enumeration (e.g. enrichment / labelling), invoked with a system\n          // execution context that carries APP_ADMIN_SUPER_ADMIN. `roles: []` is inert\n          // here precisely because it is not URL-bearing and role-gating is bypassed for\n          // internal execution — it is NOT \"any app user can list users\" (an empty roles\n          // array on a URL-bearing variant would be fail-closed → 403). App users do not\n          // get a global list-all; they READ a user (APP_USER) and enumerate via the\n          // org-scoped SEARCH people-picker below.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          // The ONLY HTTP-exposed LIST — admin-gated global user listing.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `email` is the only human-searchable field ON the user row. First/last\n          // name and display name live on `USER_PROFILES` (1:1, keyed by `userId`)\n          // and are MUTABLE there, so they are searched RELATIONALLY rather than\n          // denormalized: the framework searches `USER_PROFILES` (by its own\n          // searchable fields — firstName/lastName/displayName) and intersects the\n          // matching `userId`s with this resource's `_id`. (`username` was a phantom\n          // field — it exists on no user collection — and has been removed.) This\n          // powers the org-scoped \"people picker\" (e.g. a `createdByUserId` filter):\n          // the junction scope filter keeps results within the caller's org.\n          // See SearchableRelationDescriptor in resources-config.shared.schemas.ts.\n          searchableFields: [\n            'email',\n            {\n              localField: '_id',\n              relatedResource: CoreResourceType.USER_PROFILES,\n              relatedJoinField: 'userId',\n              // fields omitted → defaults to USER_PROFILES' own searchableFields\n              // (firstName, lastName, displayName).\n            },\n          ],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: USERS_ADMIN_FILTER_FIELDS,\n          sortFields: USERS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 200,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // DTOs auto-derived from decorators (excludeFromCreate on _id, createdAt, updatedAt).\n          //\n          // ⚠️ `status` and `appRoles` ARE part of this create contract. An earlier comment here\n          // claimed they were \"manually excluded\"; they never were — neither field carries\n          // `.excludeFromCreate()` and this variant declares no narrowing `requestDto`, so both are\n          // accepted (confirmed against the generated OpenAPI create schema). `appRoles` being\n          // caller-settable is exactly why this path carries an explicit role-ceiling gate — see\n          // `user-role-administration.custom-impl.backend.service.ts`. An absent `appRoles` falls\n          // back to the schema default and is NOT treated as a caller grant.\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, users manage themselves via USER_SELF\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // DTOs auto-derived from decorators. Only `appRoles` and `userTypes`\n          // remain writable: `_id`, `email`, `status`, `scheduledReactivationAt`\n          // and timestamps all carry `excludeFromUpdate()`.\n          //\n          // Because `appRoles` is caller-settable here, this path is\n          // the one that actually grants application authority, and it carries the role-ceiling gate\n          // plus a USER_APP_ROLES_CHANGED audit event (`user-role-administration.custom-impl`).\n          //\n          // This whole-array REPLACE is why the additive `assign_roles` / subtractive `revoke_roles`\n          // verbs are not redundant with it: reaching the same end-state here requires a\n          // read-modify-write that races with, and silently clobbers, a concurrent edit.\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          // The CAPABILITY without a new HTTP surface. `retentionPolicy` requires UPDATE_MANY because\n          // the impersonalize writer scrubs rows in place through `updateManyAsSystem`. Exposing a bulk\n          // user update over HTTP would be a genuinely dangerous admin surface (mass role/status\n          // rewrites), and INTERNAL_CALL registers NO route — like the LIST default above.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY. Both are route-less, but the three retention\n          // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n          // their operation through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL /\n          // API_CALL / API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is deliberately excluded there and served\n          // by the separate `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant here\n          // therefore satisfies the factory's \"UPDATE_MANY exists\" guard at boot and then FAILS TO RESOLVE\n          // when an erasure actually runs. `roles` is inert on a non-URL-bearing variant (role gating is\n          // bypassed for internal execution); the real gate is the derived `systemAccessPolicy.updateMany`\n          // grant, which the trusted writer is fail-closed on.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, critical risk\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // Irreversible identity destruction — the caller must prove they are still themselves,\n          // not merely that they held a session at some point. `riskLevel: CRITICAL` above does NOT\n          // do this: it drives danger-zone placement and typed confirmation in the UI and is read by\n          // no authorization code. Nor does the per-user-type `stepUpAuth` policy, which is opt-in,\n          // off by default and satisfied by any authentication newer than `maxAgeSeconds`.\n          //\n          // The audience is the reason this one is safe to gate first: `APP_ADMIN_SUPER_ADMIN` is an\n          // APPLICATION-level authority, whereas the population that provably cannot step up —\n          // directory-managed (SCIM) users, whose `passwordHash` and passkeys the framework\n          // deliberately destroys in `_reconcileLocalCredentialsForDirectoryManaged` — is\n          // ORGANIZATION-scoped by construction.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n          requiresStepUpAuthentication: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.ASSIGN_ROLES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // ADDITIVE grant. `roles` is the REQUEST contract; the custom implementation translates it\n          // into a union over the persisted `appRoles` array, gates it against the caller's own role\n          // ceiling, and emits USER_APP_ROLES_CHANGED. Before that implementation existed, `roles`\n          // named no schema path, so the generic core UPDATE persisted nothing and answered 200.\n          requestDto: z.object({\n            roles: z.array(AppRolesSchema).min(1),\n            reason: z.string().max(500).optional()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.REVOKE_ROLES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // SUBTRACTIVE revocation — a set difference against the persisted `appRoles`, never a blind\n          // overwrite. Ceiling-gated like the grant: an administrator who may not GRANT a role must\n          // not be able to STRIP it either, or the cheapest attack on a privileged account is to\n          // remove the authority of whoever could intervene.\n          requestDto: z.object({\n            roles: z.array(AppRolesSchema).min(1),\n            reason: z.string().max(500).optional()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.SUSPEND_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects access\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory. `suspensionDuration` is in DAYS\n          // and is resolved to an absolute `scheduledReactivationAt` at write time — a duration is\n          // meaningless without the moment it is counted from, and the row records no such moment.\n          requestDto: z.object({\n            reason: z.string().min(1).max(500),\n            suspensionDuration: z.number().min(1).optional(), // Days\n            notifyUser: z.boolean().default(true)\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.UNSUSPEND_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, medium risk\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory (SUSPENDED → ACTIVE), which also\n          // clears any pending `scheduledReactivationAt` so a manual unsuspend does not leave the\n          // sweep's deadline behind for a later suspension to inherit.\n          //\n          // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this declaration the trail\n          // would record every suspension (HIGH) and none of the reinstatements — leaving an\n          // account that was suspended and cleared reading as still suspended.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n          requestDto: z.object({\n            reason: z.string().max(500).optional(),\n            notifyUser: z.boolean().default(true)\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.SUSPENDED;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * The only door back from a SELF-deactivated account (#430).\n     *\n     * `user_self | deactivate_account` writes INACTIVE, and until this verb existed nothing could\n     * lift it: `REACTIVATE_ACCOUNT` needs a session, sign-in admits only ACTIVE users\n     * (`_enforceUserStatus` refuses every other status), `unsuspend_user` refuses INACTIVE BY\n     * DESIGN, and `status` is excluded from update. A person who deactivated their own account was\n     * out permanently, and the only route back was a database write.\n     *\n     * ADMIN-TIER, which is door 2 of the three that were on the table, and its two costs were\n     * accepted rather than discovered: every self-deactivated user becomes a support ticket, and an\n     * administrator can reactivate an account whose owner did not ask. The second is why `reason`\n     * is MANDATORY here while `unsuspend_user` leaves it optional — an administrator reversing\n     * someone else's own choice about their account owes an auditor a sentence, where lifting an\n     * administrative suspension is merely undoing an administrative act.\n     *\n     * INACTIVE ONLY. A SUSPENDED account stays `unsuspend_user`'s business: an imposed halt and a\n     * chosen departure are two states whose whole distinction is who may lift them, and widening\n     * one verb to cover both was the option rejected precisely because it erases that.\n     *\n     * Implemented by the shared status-transition factory — which is also what routes the write\n     * through the SYSTEM door. `status` is `.excludeFromUpdate()`, so a handler writing it directly\n     * is stripped by the repository's strict re-parse and the operation reports success having\n     * persisted nothing; that failure mode has already cost this repository four sibling\n     * activations (`.claude/rules/invariant-call-site-enumeration.md` #8).\n     *\n     * assurance-control: WILDO.IDENTITY.LIFECYCLE — reinstating a deactivated principal is a\n     * privileged identity-lifecycle change and must be authorized, attributable and audited.\n     */\n    [Users_Operations.REACTIVATE_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is\n          // still gated by `roles` above; this only admits the SUBJECT to be someone else.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this the trail would record\n          // the departure (DEACTIVATE_ACCOUNT) and not the return — an account reinstated by an\n          // administrator reading as still deactivated. Same reasoning as `unsuspend_user`.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n          requestDto: z.object({\n            // MANDATORY, unlike `unsuspend_user`'s: see the JSDoc above.\n            reason: z.string().min(1).max(500),\n            notifyUser: z.boolean().default(true),\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.INACTIVE;\n          },\n        },\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n      ],\n    },\n\n    /**\n     * Administrator-compelled credential reset.\n     *\n     * Implemented by `createUserForcePasswordResetFactories`, which mints a single-use\n     * PASSWORD_RESET token for the target, mails the reset link to the TARGET, revokes the\n     * target's live sessions, and emits `USER_PASSWORD_RESET_FORCED` naming the acting\n     * administrator and their reason.\n     *\n     * Three fields the original declaration carried are deliberately gone:\n     *\n     *  - **`customResponseDto: { resetToken, resetUrl }`** — an account-takeover primitive. An\n     *    administrator holding the link can set the user's password and then authenticate AS\n     *    them; with no actor claim on a session JWT, nothing downstream could tell that apart\n     *    from a genuine login, and the owner would never be told. The link now goes only to the\n     *    account owner's inbox, and the response carries non-secret metadata.\n     *  - **`resetExpirationHours` (1–168)** — a caller-widenable credential-recovery window is a\n     *    persistence mechanism, not a recovery one. The TTL is now a framework policy constant.\n     *  - **`notifyUser`** — notifying the owner is the MECHANISM (the mail carries the only copy\n     *    of the link), not an option an operator can decline.\n     *\n     * `reason` stays and is mandatory: it is what an auditor reads when asking why a credential\n     * was reset out-of-band.\n     *\n     * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n     * intervention is authorized, attributable, justified, and evicts existing access.\n     */\n    /**\n     * See-through read of a retained subject (#490).\n     *\n     * ## Why it is UPDATE-like, when it plainly reads\n     *\n     * Same reasoning the webhook `testEndpoint` probe records, and for a sharper reason. Borrowing\n     * READ yields a GET, and a GET carries its parameters in the URL — which would put the operator's\n     * free-text `reason` into every access log, proxy log and browser history between here and the\n     * server. A justification for revealing scrubbed personal data routinely NAMES someone: a\n     * dispute, a legal hold, a subject. Putting it in a query string is a privacy defect, not an\n     * inconvenience.\n     *\n     * The operation also has a real side effect — every call emits a `RETAINED_DATA_ACCESS` audit row\n     * — so `x-idempotent` would have had to be false on a GET, which is the self-contradiction that\n     * argument already produced once.\n     *\n     * ## Why `reason` is in the DTO and the caller's identity is NOT\n     *\n     * `accessingUserId` and `accessingUserRoles` reach the primitive from the EXECUTION CONTEXT, never\n     * from the request. A body-supplied identity is a claim the caller writes about themselves, and\n     * the entire value of the audit row is that it says who really looked. `reason` is the one thing\n     * only the human can supply, so it is the one thing the request carries.\n     *\n     * `admitsCrossSubjectUserAdministration` is declared because the subject is by definition someone\n     * else: a retained row belongs to an erased person, and the caller is an administrator. The\n     * `roles` gate above still decides WHO may call it.\n     */\n    [Users_Operations.READ_RETAINED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          admitsCrossSubjectUserAdministration: true,\n          // The highest risk level the vocabulary has, and it is not decoration: this is the only\n          // operation in the resource that reveals personal data an erasure was performed to remove.\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            /**\n             * Why this reveal is happening — a legal hold, a dispute, an investigation.\n             *\n             * Required, and the length floor is enforced twice on purpose: here, so the request is\n             * refused before anything is read, and again inside `readRetainedAsSystem`, which\n             * fail-closes on a blank attribution because the audit store persists `eventData`\n             * unparsed. A reveal with no reason is an anonymous reveal.\n             */\n            reason: z.string().trim().min(1).max(500),\n          }),\n        }\n      ],\n    },\n\n    [Users_Operations.FORCE_PASSWORD_RESET]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects authentication\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            reason: z.string().min(1).max(500)\n          }),\n          customResponseDto: z.object({\n            /** When the emailed reset link stops working. Non-secret — the link itself is not returned. */\n            expiresAt: z.date(),\n            /** Always true today; explicit so the caller can see the eviction happened. */\n            sessionsRevoked: z.boolean()\n          }),\n          // A deleted identity has no credential path worth resetting; the service rejects it\n          // with a 409. Hides the roster action rather than letting it 409 on click.\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status !== UserStatus.DELETED;\n          }\n        }\n      ],\n      // The ADMIN-AUDIT copy. The user-facing reset mail is the system PASSWORD_RESET template\n      // dispatched by the auth service when the token is minted — deliberately not duplicated\n      // into this resource-operation fan-out, which would create a second reset email that can\n      // drift from the one the self-service flow sends.\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n  },\n});\n"]}

package/dist/esm/users/users.shared.schemas.d.ts

@@ -182,6 +182,22 @@ export declare const UserPreferencesSchema: z.ZodObject<{
     }, z.core.$strip>>>>;
 }, z.core.$strip>;
 export type UserPreferences = z.infer<typeof UserPreferencesSchema>;
+/**
+ * The hand-authored mirror of the auto-generated `USER_SELF` CONTEXT response.
+ *
+ * Every field name here MUST be the one `addRelationshipPlaceholders` declares on the generated
+ * `contextDto`, i.e. `Resources_SharedUtils.resolveRelationshipObjectIdentity(...).objectFieldName`
+ * for the relationship. This schema is a TYPE for consumers (the frontend casts the context read to
+ * it, and the auth response embeds it); it does not validate the response, so a name that drifts
+ * from the generated DTO is invisible until someone reads a field that is never there.
+ *
+ * `userSelfPreferences` is PLURAL because `USER_SELF_PREFERENCES` declares
+ * `resourceFieldIdentifier: 'userSelfPreferencesId'` and the DTO's field name is that identifier's
+ * base — unlike `userSelfProfile`, whose identifier is already singular (`userSelfProfileId`). It
+ * read `userSelfPreference` until 2026-09-10, which is the name the POPULATION side used to
+ * produce; the generated DTO never declared it, so the populated preferences were Zod-stripped on
+ * the way out and no application ever received them (issue #563).
+ */
 export declare const UserContextSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>>>>;
@@ -202,7 +218,7 @@ export declare const UserContextSchema: z.ZodObject<{
         phoneNumber: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPhoneSchema>;
         title: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     }, z.core.$strip>>;
-    userSelfPreference: z.ZodOptional<z.ZodObject<{
+    userSelfPreferences: z.ZodOptional<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
         notifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{

package/dist/esm/users/users.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EAAE,iBAAiB,EAAkB,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAKhH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,OAAO,YAAY;CACpB;AAED,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,UAAU;;;;;;;;;iBAoGrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,6BAA6B;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA0E5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mCAAmC;;;;;iBAK9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,8BAA8B;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,QAAQ,wBAAwB;CACjC;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuDhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"users.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EAAE,iBAAiB,EAAkB,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAKhH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,OAAO,YAAY;CACpB;AAED,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,UAAU;;;;;;;;;iBAoGrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,6BAA6B;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA0E5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mCAAmC;;;;;iBAK9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,8BAA8B;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,QAAQ,wBAAwB;CACjC;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuDhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}