@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/users/users.shared.schemas.js

@@ -8,7 +8,7 @@ import { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles
 import { UserPrivacySchema } from '../compliance/privacy/privacy.shared.schemas.js';
 import { OrganizationMemberSchema } from '../organizations/organization-members.shared.schemas.js';
 import { AvailableLanguage, TimezoneSchema, DateFormat, TimeFormat } from '@wildo-ai/presets-components-models';
-import { EnumEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';
+import { EnumMultipleEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';
 import { RedactionType } from '../compliance/privacy/redaction.shared.schemas.js';
 import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
 /**
@@ -50,6 +50,17 @@ export var UserStatus;
     UserStatus["PENDING_INVITATION"] = "PENDING_INVITATION";
     UserStatus["DELETED"] = "DELETED";
 })(UserStatus || (UserStatus = {}));
+/**
+ * True when a person of this status may still act on their own data — ACTIVE only, the same rule the sign-in,
+ * token refresh and request-context gates apply to the person themself.
+ *
+ * Named for the inbound pipeline (#1629): a USER-scope delivery runs on one person's data, and a handler must
+ * not act there for someone who could not act there themself. It is the user-scope twin of
+ * `isAuthorityConferringOrganizationStatus`.
+ */
+export function isAuthorityConferringUserStatus(status) {
+    return status === UserStatus.ACTIVE;
+}
 export var UserTheme;
 (function (UserTheme) {
     UserTheme["LIGHT"] = "LIGHT";
@@ -185,14 +196,33 @@ export const UserSchema = z.object({
     updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()
 });
 export const UserLanguagePreferencesSchema = z.object({
-    primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField(),
-    // Compact multi-select: render as a chips combobox (searchable popover) instead
-    // of a full inline checkbox column — `editMode: COMBOBOX` on the array item is the
-    // opt-in that `FormFieldArray` reads to render `ComboboxMultiple`. Fits a
-    // settings-row layout where the long language list would otherwise overflow.
-    fallbackLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).default([AvailableLanguage.EN]),
-    autoDetect: z.boolean().default(true),
-    useOrganizationDefault: z.boolean().default(false),
+    primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField().describe("The language this user reads the application in, and the language of the notification and password-reset emails sent to them. In the interface, the organization's primary language takes precedence when the organization enforces it or the user opts into the organization default, and a language the application does not offer is ignored. Defaults to `en`."),
+    /**
+     * The languages to use, in order, when `primaryLanguage` is one the application does not offer (#1799).
+     *
+     * Read in two places, through one ordering: the interface's language resolution tries them after the
+     * primary language and before anything it remembers or detects; the recipient language of a
+     * notification or password-reset email tries them after the primary language and before the user's
+     * regional locale. Each is used only if the application (and, in the interface, the organization)
+     * offers it. It was stored and edited and read by nothing until then.
+     *
+     * Defaults to EMPTY, not `[en]`: a fixed English default would quietly override the application's
+     * own fallback language for every user who never set this.
+     *
+     * Compact multi-select: render as a chips combobox (searchable popover) instead of a full inline
+     * checkbox column — `multipleEditMode: COMBOBOX` on the array item is the opt-in the multiple enum
+     * control reads (`resolveEnumMultipleEditMode`). The single-select `editMode` means nothing on an array item. Fits a settings-row layout where the long language list would
+     * otherwise overflow.
+     */
+    fallbackLanguages: z
+        .array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { multipleEditMode: EnumMultipleEditMode.COMBOBOX } }))
+        .default([])
+        .describe('Languages to use, in order, when `primaryLanguage` is not one the application offers — in the interface, and for the notification and password-reset emails sent to this user. A language the application does not offer is skipped. Empty by default, which leaves the application\'s own fallback in charge.'),
+    // `autoDetect` was removed (#1799). It was consulted only after the primary language had failed AND
+    // nothing was remembered, which for a signed-in user with the default `en` primary is effectively
+    // never. The application-level `appPreferences.languages.autoDetectFromBrowser` still governs the one
+    // case that remains, a first visit before anyone has signed in.
+    useOrganizationDefault: z.boolean().default(false).describe("When true, the interface uses the organization's primary language instead of this user's own `primaryLanguage`. Defaults to false."),
 });
 export const UserProfileSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
@@ -264,13 +294,14 @@ export const UserProfileSchema = z.object({
     title: addImpersonalizeWith(z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL), RedactionType.REMOVE)
 });
 export const UserPreferences_NotificationsSchema = z.object({
-    email: z.boolean().default(true),
-    push: z.boolean().default(true),
-    sms: z.boolean().default(false),
-    inApp: z.boolean().default(true)
+    email: z.boolean().default(true).describe("When false, notification emails about the user's own account are not sent to them. Emails the user receives because of a role they hold, notices marked as always delivered, and account-recovery emails such as password reset are sent regardless. Defaults to true."),
+    // `push` and `sms` were removed (#1799): the dispatcher sent neither channel — it logged "not yet
+    // implemented" and returned — and no notification declared either, so a user who turned push off "to
+    // stop notifications" turned off nothing. They come back with a channel that actually delivers.
+    inApp: z.boolean().default(true).describe("When false, the application's interface stops showing this user the real-time notifications the server sends them, as pop-ups or in the notification centre. Data on screen keeps updating live. Defaults to true.")
 });
 export const UserPreferences_UI_ThemeSchema = z.object({
-    theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField(),
+    theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField().describe("The colour scheme the interface uses for this user: `LIGHT`, `DARK`, or `AUTO` to follow the device's system setting. Applied whenever the user's preferences load, so the choice follows them across devices. Defaults to `AUTO`."),
 });
 /**
  * A member's OWN regional choices — and every field is OPTIONAL, deliberately.
@@ -304,13 +335,13 @@ export const UserPreferences_UI_ThemeSchema = z.object({
  * before — the difference is only that a tenant which HAS authored something is now heard.
  */
 export const UserPreferences_RegionalSchema = z.object({
-    timezone: TimezoneSchema.optional().isSummaryField(),
+    timezone: TimezoneSchema.optional().isSummaryField().describe("The IANA time zone (for example `Europe/Paris`) in which the interface shows dates and times to this user. When omitted, the organization's time zone applies, then UTC."),
     // LOCALE_DEFAULT (not ISO_8601) remains the framework FALLBACK, resolved in `I18nContext`: "no
     // expressed preference" must mean locale-driven rendering. Storing it here would pin every
     // preference-less member to it and mask both the organization layer and the locale fallback.
-    dateFormat: z.enum(DateFormat).systemEnum('DateFormat').optional(),
-    timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').optional(),
-    locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').optional().isSummaryField()
+    dateFormat: z.enum(DateFormat).systemEnum('DateFormat').optional().describe("How the interface shows dates to this user: `LOCALE_DEFAULT` follows the conventions of the resolved locale, every other value is a fixed pattern. When omitted, the organization's date format applies, then `LOCALE_DEFAULT`."),
+    timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').optional().describe("Whether the interface shows times to this user on a 12-hour (`12h`) or 24-hour (`24h`) clock. When omitted, the organization's setting applies, then `24h`."),
+    locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').optional().isSummaryField().describe("The language tag (for example `en-GB`) whose conventions the interface uses to format dates, times and numbers for this user. When omitted, the organization's locale applies, then the language the interface is shown in. It is also published as the `locale` claim to OpenID Connect clients.")
 });
 /**
  * The preference blocks a caller can address as a unit — the closed vocabulary behind

package/dist/esm/users/users.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAChH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,2DAA6C,CAAA;IAC7C,uDAAyC,CAAA;IACzC,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,0BAAa,CAAA;IACb,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,EAAE,iBAAiB,CACtB,oBAAoB,CAClB,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,EACrF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,6FAA6F;IAC7F,yDAAyD;IACzD,oBAAoB,CAAC,eAAe,CACrC;IACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC5E,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,oBAAoB;IACpB,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,+FAA+F;IAC/F,sFAAsF;IACtF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,iBAAiB,EAAE;IAC1H,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IACpG,+GAA+G;IAC/G,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC1E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE;IACzH,gFAAgF;IAChF,mFAAmF;IACnF,0EAA0E;IAC1E,6EAA6E;IAC7E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC3K,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,sEAAsE;IACtE,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,QAAQ,EAAE,oBAAoB,CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,WAAW,EAAE,oBAAoB,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7F,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;;OAOG;IACH,gGAAgG;IAChG,EAAE;IACF,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,6FAA6F;IAC7F,kGAAkG;IAClG,6EAA6E;IAC7E,EAAE;IACF,2FAA2F;IAC3F,gGAAgG;IAChG,gGAAgG;IAChG,yCAAyC;IACzC,MAAM,EAAE,oBAAoB,CAC1B,MAAM,CAAC;QACL,MAAM,EAAE,UAAU,CAAC,KAAK;QACxB,gBAAgB,EAAE,QAAQ;QAC1B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QACxB,gBAAgB,EAAE;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;YACpC,kBAAkB,EAAE,IAAI;SACzB;KACF,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC3D,aAAa,CAAC,MAAM,CACrB;IACD,+FAA+F;IAC/F,kGAAkG;IAClG,gGAAgG;IAChG,mEAAmE;IACnE,GAAG,EAAE,oBAAoB,CACvB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;OAMG;IACH,EAAE;IACF,yFAAyF;IACzF,6CAA6C;IAC7C,EAAE;IACF,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,+FAA+F;IAC/F,gDAAgD;IAChD,WAAW,EAAE,oBAAoB,CAC/B,iBAAiB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,MAAM,CACrB;IACD,KAAK,EAAE,oBAAoB,CACzB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;CAClE,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;IACpD,+FAA+F;IAC/F,2FAA2F;IAC3F,6FAA6F;IAC7F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAClE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAClE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE;CAC9F,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,0CAAmB,CAAA;IACnB,gCAAS,CAAA;IACT,4CAAqB,CAAA;IACrB,uDAAgC,CAAA;AAClC,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,oFAAoF;IACpF,oFAAoF;IACpF,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,yFAAyF;IACzF,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,kEAAkE;IAClE,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,gEAAgE;IAChE,EAAE;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,kDAAkD;IAClD,aAAa,EAAE,oBAAoB,CACjC,mCAAmC,CAAC,OAAO,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvF,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;IAED,oGAAoG;IACpG,oGAAoG;IACpG,iGAAiG;IACjG,kGAAkG;IAClG,8DAA8D;IAC9D,oGAAoG;IACpG,qGAAqG;IACrG,oCAAoC;IACpC,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACnD,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;SAC1C,iBAAiB,EAAE,EACtB,aAAa,CAAC,KAAK,CACpB;IAED,EAAE,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAErG,+FAA+F;IAC/F,gGAAgG;IAChG,kGAAkG;IAClG,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAC5B,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC9F,cAAc,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAC9E,aAAa,CAAC,KAAK,CACpB;IAED,gCAAgC;IAChC,mBAAmB,EAAE,oBAAoB,CACvC,6BAA6B,CAAC,OAAO,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC5F,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;CACF,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC;IACjD,sFAAsF;IACtF,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC7C,mBAAmB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACrD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * User Shared Schemas\n * \n * Shared user schemas for frontend and backend with MongoDB compatibility\n */\n\nimport { z } from 'zod';\n\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { UserPrivacySchema } from '../compliance/privacy/privacy.shared.schemas';\nimport { OrganizationMemberSchema } from '../organizations/organization-members.shared.schemas';\nimport { AvailableLanguage, TimezoneSchema, DateFormat, TimeFormat } from '@wildo-ai/presets-components-models';\nimport { EnumEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * The address written over a user's `email` when the subject is erased and the row retained.\n *\n * `.invalid` is an RFC 2606 reserved TLD: it can never be registered and never resolves, so an\n * erased address cannot be delivered to, cannot be confused with a live account, and cannot become\n * a real identity if a stray code path ever re-mails it.\n *\n * Exported as ONE named source so the erasure orchestrator, tests and any operator query recognize\n * an erased subject without duplicating the literal.\n */\nexport const ERASED_USER_EMAIL = 'erased@erased.invalid';\n\n/**\n * What a REQUIRED name field becomes when the subject is erased.\n *\n * `firstName` and `lastName` are `min(1)`, so REMOVE is not available to them — nulling a required\n * field would leave a row the schema itself rejects on the next read. MASK with a value that is\n * obviously not a name keeps the row parseable while carrying no information about the person.\n *\n * Deliberately the same placeholder as `ERASED_FILE_NAME_PLACEHOLDER`: a reader meeting `[erased]`\n * in an export or an admin view should not have to learn a second vocabulary to recognise it.\n */\nexport const ERASED_USER_NAME = '[erased]';\n\n/**\n * What an erased EXTERNAL identifier becomes — a provider's own id for the person.\n *\n * Distinct from `ERASED_USER_NAME` despite the same literal, because the two answer different\n * questions and will diverge: a name is displayed to a human, an external id is matched against a\n * provider's records. Merging them would make a future change to either silently change the other.\n */\nexport const ERASED_IDENTITY_VALUE = '[erased]';\n\nexport enum UserStatus {\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED',\n  PENDING_VERIFICATION = 'PENDING_VERIFICATION',\n  PENDING_INVITATION = 'PENDING_INVITATION',\n  DELETED = 'DELETED'\n}\n\nexport enum UserTheme {\n  LIGHT = 'LIGHT',\n  DARK = 'DARK',\n  AUTO = 'AUTO'\n}\n\nexport const UserSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * Email is the STRICT unique identity anchor — there is never more than one\n   * `User` per email. `.isUnique()` is the fail-closed DB backstop; every\n   * provisioning path (self-registration, org-admin invite, SSO JIT, SCIM,\n   * anonymous transposition) MUST find-or-create by this normalized value rather\n   * than blind-create, and recover from the duplicate-key `409` on the rare\n   * concurrent race (e.g. an invite and an SSO JIT landing at once). `.toLowerCase()`\n   * normalizes before both the lookup and the unique check so casing can't fork an\n   * identity. `.excludeFromUpdate()` keeps the anchor immutable.\n   *\n   * **It is also the ONLY personal datum on this row** (the rest is `_id`, status, roles, types and\n   * timestamps; names / bio / phone / avatar all live on `USER_PROFILES`). So it is what a subject\n   * erasure scrubs — `MASK` to {@link ERASED_USER_EMAIL}, which keeps the row resolvable as an\n   * anonymized subject for the retained billing records whose foreign keys point at it.\n   *\n   * `MASK` with an explicit value rather than `REMOVE`: `REMOVE` writes `null`, which this schema\n   * rejects, so it would force `.nullish()` here — widening the identity anchor to\n   * `string | null | undefined` for ~20+ consumers (auth registration, password reset, JWT guard,\n   * SCIM, SSO provisioning, org invites) AND making it optional at CREATE, to represent a state only\n   * the audited see-through reader can ever observe, since a retained row is hidden from every\n   * normal read. The default mask constant cannot be used either — it is not a valid email.\n   * Every erased user shares this one address; that cannot collide, because the unique index on a\n   * retention-governed resource covers only non-retained rows and the scrub flips the row to\n   * `RETAINED` in the same write.\n   */\n  email: addDataCategories(\n    addImpersonalizeWith(\n      z.email().isDBIndexed().isUnique().toLowerCase().isSummaryField().excludeFromUpdate(),\n      RedactionType.MASK,\n      { maskValue: ERASED_USER_EMAIL },\n    ),\n    // Declared because the engine owes its OWN inventory. Without it, every generated application's\n    // privacy notice would name `users.email` as an outstanding category gap — the field carries a\n    // scrub treatment, which is the application saying it holds personal data, so the missing\n    // category would be a provable omission the framework left for each app to fix. CONTACT_DETAILS\n    // rather than IDENTITY: it is how the person is reached. That it also serves as the identity\n    // anchor is a property of this schema, not of the datum.\n    PersonalDataCategory.CONTACT_DETAILS,\n  ),\n  /**\n   * WHEN this address was proven to be reachable by the person who holds the account — and nothing else.\n   *\n   * ## Why a moment, and why it is not `status` (#1285)\n   *\n   * `email_verified` is an OIDC claim this application ISSUES to relying parties, and it was derived\n   * from `UserStatus.ACTIVE`. ACTIVE does not mean the address was proven: with\n   * `EmailVerificationMode.DEFERRED`, and on the password-less path, registration creates an ACTIVE\n   * account precisely so the emailed link can be the way in — the address is proven when the link is\n   * CLICKED, which may be later or never. So an application could assert to every relying party that\n   * an address was verified when nothing had verified it.\n   *\n   * The registration flow already knows the difference and says so at its own site: *\"The status gate\n   * and the verification gate are not the same gate, and conflating them is what makes this look wrong\n   * at first glance.\"* This field is that sentence made readable by everything downstream.\n   *\n   * ## Absent is UNKNOWN, never false\n   *\n   * There is no backfill, so an account verified before this field existed carries nothing. Readers\n   * therefore treat absence as unknown and OMIT the claim — which is the doctrine\n   * `oidc-user-claims.backend.service.ts` already states for itself: *\"assert the claim only when the\n   * status determines it; omit it otherwise rather than assert an unknown state.\"* Absence must not\n   * become `false`: that would tell a relying party an address is unverified when it may well have\n   * been, which is a different false statement rather than a safer one.\n   *\n   * Mirrors `UserCredentials.phoneVerifiedAt`, which has recorded the same fact for the phone channel\n   * since SMS OTP shipped. Email was the channel with no record at all.\n   *\n   * NOT `.isAuditEvidence()`, for the reason the block below gives about `email`: the act is already\n   * recorded as its own auditable event (`logUserEmailVerified`), and a moment beside a masked\n   * identity anchor does not decide authority.\n   */\n  emailVerifiedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  // The three fields below carry `.isAuditEvidence()`: their VALUES are recorded before-and-after on\n  // the `resource_operation_performed` audit event. All three decide what the principal may do, and\n  // all three hold closed vocabulary rather than personal data — so recording them is both necessary\n  // as authorization evidence and free of personal data whose erasure obligations could reach the\n  // immutable ledger.\n  //\n  // Contrast `email` directly above, which is deliberately NOT marked: it is the identity anchor and\n  // is `.impersonalizeWith(MASK)`, i.e. a value the framework must be able to scrub on erasure.\n  // Copying it into an unscrubbable audit row would defeat that capability. That is the whole D4\n  // boundary in one file — mark what decides authority, never what identifies a person.\n  /**\n   * Account lifecycle and access posture.\n   *\n   * `.excludeFromUpdate()` since 2026-08-01. Lifecycle transitions belong to the dedicated verbs —\n   * `users | suspend_user` / `unsuspend_user` and `user_self | deactivate_account` /\n   * `reactivate_account` — which own the state machine, the reason, the audit event and the\n   * administrative-continuity floors. A generic field patch reproduces none of that, so accepting\n   * `status` on the ordinary UPDATE contract meant an administrator could retire an account through\n   * a door that asked none of those questions. Mirrors `OrganizationMemberSchema.status`, whose\n   * JSDoc has described the same rule for the same reason since before these verbs existed.\n   *\n   * ⚠️ The trusted server-side writers must therefore use `updateAsSystem`, which re-attaches the\n   * field past the repository's strict request-DTO re-parse — email verification\n   * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning. All four\n   * were migrated in the same change, and `USERS` opts into `systemAccessPolicy.update` for exactly\n   * them. A NEW trusted writer that reaches for `servicesRegistryHandler.update` here will be\n   * SILENTLY stripped — the account simply never changes state, with no error and no signal.\n   *\n   * assurance-control: WILDO.IDENTITY.LIFECYCLE — a change to whether a principal may authenticate\n   * runs through one guarded, evidenced authority.\n   */\n  status: z.enum(UserStatus).default(UserStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence().excludeFromUpdate(),\n  appRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]).isDBIndexed().isAuditEvidence(),\n  /** User types from config (e.g. 'user', 'admin', 'consumer'). Determines auth policy, registration context. */\n  userTypes: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * When an automated sweep must return this account to `ACTIVE`.\n   *\n   * Written only by `users | suspend_user`, whose contract takes `suspensionDuration` in DAYS. The\n   * transition hook resolves that duration to an absolute instant before persisting, because a\n   * duration is only meaningful relative to a moment the row does not otherwise record.\n   *\n   * Voluntary `user_self | deactivate_account` deliberately has no schedule: an INACTIVE account\n   * returns only when its subject calls `reactivate_account`. Absent therefore means an indefinite\n   * admin suspension or a non-scheduled lifecycle state.\n   *\n   * Server-owned (`.excludeFromCreate().excludeFromUpdate()`) so the transition verbs are the only\n   * writers, and indexed because the reactivation sweep queries exactly \"rows whose scheduled\n   * reactivation has passed\". Deliberately NOT `.isAuditEvidence()`: unlike the three fields above\n   * it does not decide what the principal may do — it is a scheduling detail, and the transition's\n   * own audit event already records the reason and the resulting status.\n   *\n   * ⚠️ For admin suspension, the value is a PROMISE the reactivation batch keeps. Persisting it without that sweep would\n   * be the same defect as a verb answering success while writing nothing: an authored intention\n   * that nothing honors.\n   */\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type User = z.infer<typeof UserSchema>;\n\nexport const UserLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField(),\n  // Compact multi-select: render as a chips combobox (searchable popover) instead\n  // of a full inline checkbox column — `editMode: COMBOBOX` on the array item is the\n  // opt-in that `FormFieldArray` reads to render `ComboboxMultiple`. Fits a\n  // settings-row layout where the long language list would otherwise overflow.\n  fallbackLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { editMode: EnumEditMode.COMBOBOX } })).default([AvailableLanguage.EN]),\n  autoDetect: z.boolean().default(true),\n  useOrganizationDefault: z.boolean().default(false),\n});\nexport type UserLanguagePreferences = z.infer<typeof UserLanguagePreferencesSchema>;\n\nexport const UserProfileSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()`: one profile per user (1:1 composition). Backstops the eager\n  // `onParentCreate` seed + the provisioning paths against a concurrent\n  // double-create — the durable idempotency guarantee behind the declarative seed.\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  firstName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  lastName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  displayName: addImpersonalizeWith(\n    z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored\n   * as the standard file reference `{ fileId, updatedAt }` and rendered as a\n   * square avatar. Uses the plain `z_file()` image pipeline (upload / storage /\n   * DTO / persistence / metadata population) with no bespoke field type; the\n   * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there\n   * is no external-URL branch.\n   */\n  // REMOVE nulls the stored `{ fileId, updatedAt }` reference AND the underlying file is deleted.\n  //\n  // Corrected 2026-09-17: this said the stored object was NOT deleted, on the grounds that file bytes\n  // belong to the file resource's own lifecycle. That is not what the engine does. `userProfiles`\n  // declares a `retentionPolicy`, so `impersonalizeRowsInPlace` governs it; this field is a personal\n  // file field (REMOVE, not KEEP); and that scrub's own comment states the rule — \"a field-level\n  // scrub cannot reach INSIDE a stored blob, so a file field marked personal is only erased by\n  // deleting the file\". The deletion is sequenced as a post-commit effect on the parent transaction\n  // so a rolled-back scrub can never destroy files for a row that stayed live.\n  //\n  // The old comment under-claimed, which is the safer direction and still false — and it was\n  // load-bearing: `remove_avatar` was acknowledged as unimplementable partly by reasoning from it\n  // (#1275). A schema comment about what the product does is a claim, and this one had never been\n  // checked against the code it described.\n  avatar: addImpersonalizeWith(\n    z_file({\n      nature: FileNature.IMAGE,\n      allowedMimeTypes: 'Images',\n      maxSize: 2 * 1024 * 1024,\n      imageConstraints: {\n        maxWidth: 1024,\n        maxHeight: 1024,\n        aspectRatio: { width: 1, height: 1 },\n        generateThumbnails: true,\n      },\n    }).optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never\n  // what it will contain — a bio is a classic surface where a special category (a health condition,\n  // a religious observance, a political affiliation) arrives unannounced, and no schema certifies\n  // otherwise. Nothing here is a claim that it does NOT contain one.\n  bio: addImpersonalizeWith(\n    z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * E.164 phone number (e.g. \"+33123456789\"). `z_phone()` carries the phone\n   * metadata that drives the international phone INPUT on edit (country selector +\n   * national number) and the formatted international DISPLAY on read — replacing\n   * the old raw `z.string().regex(...)` that surfaced the regex to the user.\n   * Stored value is still a plain E.164 string, so DTO/persistence are unchanged.\n   */\n  //\n  // A phone number is contact-detail personal data by definition, so both declarations are\n  // load-bearing here rather than a curiosity.\n  //\n  // The helper form is kept DELIBERATELY, and the reason changed on 2026-09-17. It used to be the\n  // only form that worked: `z_phone()` ends in `.pipe(z.string())`, so its constructor is `ZodPipe`,\n  // a name in no applyable-type list — and the per-instance decorator install keys on that name, so\n  // a phone schema carried NO decorators at all and the fluent form threw. That gap is closed and\n  // `z_phone().dataCategories(…).impersonalizeWith(…)` now works. What keeps the helper here is that\n  // it needs no prototype method at all, which makes this field's classification independent of the\n  // decorator-install path entirely — worth having on the one field whose misclassification is a\n  // privacy incident rather than a rendering bug.\n  phoneNumber: addImpersonalizeWith(\n    addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.REMOVE,\n  ),\n  title: addImpersonalizeWith(\n    z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL),\n    RedactionType.REMOVE,\n  )\n});\nexport type UserProfile = z.infer<typeof UserProfileSchema>;\n\nexport const UserPreferences_NotificationsSchema = z.object({\n  email: z.boolean().default(true),\n  push: z.boolean().default(true),\n  sms: z.boolean().default(false),\n  inApp: z.boolean().default(true)\n});\nexport type UserPreferences_Notifications = z.infer<typeof UserPreferences_NotificationsSchema>;\n\nexport const UserPreferences_UI_ThemeSchema = z.object({\n  theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField(),\n});\nexport type UserPreferences_UI_Theme = z.infer<typeof UserPreferences_UI_ThemeSchema>;\n\n/**\n * A member's OWN regional choices — and every field is OPTIONAL, deliberately.\n *\n * **Absence is a real state and it is the point of this block**: it means the member has expressed\n * no preference, so the value comes from the organization's own regional record\n * (`OrganizationPreferences.timezone` / `.locale` / `.dateFormat` / `.timeFormat`), and only then\n * from the framework fallback. `I18nContext` resolves that chain — member, then organization, then\n * framework — and it can only do so because an unexpressed preference is representable here.\n *\n * All four carried a Zod `.default(...)` until 2026-09-08 (#410), and the defaults were not a\n * convenience: they made the organization layer UNIMPLEMENTABLE. A `.default()` MATERIALIZES at\n * parse, so every member with a preferences row carried `'UTC'`, `EN`, `LOCALE_DEFAULT` and\n * `TWENTY_FOUR_HOUR` whether or not they had ever opened the settings screen — indistinguishable\n * from having chosen them. A tenant that set `Europe/Paris` could never reach a single member,\n * because there was no member left who had not \"expressed\" UTC.\n *\n * The same shape had already cost a decision elsewhere: `cancelImmediately: z.boolean().default(false)`\n * made \"the caller expressed no cancellation preference\" unobservable, which is why the authored\n * `defaultBehavior` policy beneath it was unimplementable rather than merely unimplemented (#408).\n * A default one layer up erases the state the layer beneath exists to answer for.\n *\n * `locale` in particular was also WRONG on its own terms. `I18nContext` resolves it as\n * `regional.locale ?? currentLanguage ?? 'en'`, so a materialized `EN` meant the left side always\n * won and the resolved UI language was never consulted: a member using the application in French\n * got `en` date, time and number formatting. Removing the default is what lets that `??` chain do\n * what it was written to do.\n *\n * Note what did NOT change: the framework's fallbacks are unchanged, and they are still exactly\n * these four values. A member in a tenant that has authored nothing sees precisely what they saw\n * before — the difference is only that a tenant which HAS authored something is now heard.\n */\nexport const UserPreferences_RegionalSchema = z.object({\n  timezone: TimezoneSchema.optional().isSummaryField(),\n  // LOCALE_DEFAULT (not ISO_8601) remains the framework FALLBACK, resolved in `I18nContext`: \"no\n  // expressed preference\" must mean locale-driven rendering. Storing it here would pin every\n  // preference-less member to it and mask both the organization layer and the locale fallback.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').optional(),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').optional(),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').optional().isSummaryField()\n});\nexport type UserPreferences_Regional = z.infer<typeof UserPreferences_RegionalSchema>;\n\n/**\n * The preference blocks a caller can address as a unit — the closed vocabulary behind\n * `reset_to_defaults` on USER_SELF_PREFERENCES.\n *\n * **Every value IS the persisted field name on {@link UserPreferencesSchema}.** That is the\n * point of the enum, not a coincidence: it lets the reset patch be DERIVED from the vocabulary\n * instead of routed through a hand-written flag-to-field map. The previous contract was six\n * booleans (`resetNotifications`, `resetUI`, …) that named no schema path, so the whole request\n * was stripped before persistence and the route answered 200 having reset nothing.\n *\n * Adding a preference group to the schema means adding a member here; the mapped type in\n * `user-preferences-reset.shared.utils.ts` then refuses to compile until the group declares how\n * it resets. Renaming a group field without renaming the value fails the same way.\n *\n * Note `LANGUAGE = 'languagePreferences'` — the member reads as the concept, the value is the\n * field. Do not \"tidy\" the value to `language`; it is an address, not a label.\n */\nexport enum UserPreferenceGroup {\n  NOTIFICATIONS = 'notifications',\n  PRIVACY = 'privacy',\n  UI = 'ui',\n  REGIONAL = 'regional',\n  LANGUAGE = 'languagePreferences',\n}\n\nexport const UserPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` is the idempotency backstop for onParentCreate seeding: the eager\n  // seed (and any retry) is deduplicated at the DB layer — a second seed for the same\n  // user fails the unique constraint and is swallowed, guaranteeing exactly one\n  // preferences row per user. (Prod migration note: dedupe any pre-existing duplicate\n  // userId rows before this index builds; preferences was seeded nowhere pre-feature,\n  // so duplicates are unexpected.)\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // ── Which preference blocks are data ABOUT the person, and which are rendering state ──\n  //\n  // Declared at the BLOCK, not on the leaves inside it. The resolver walks TOP-LEVEL fields only —\n  // the same limit the subject-export compiler and the impersonalize writer have — so a category on\n  // `regional.timezone` would be invisible. That is not a workaround: a notice enumerates KINDS, and\n  // \"communication preferences\" is the kind, not \"the sms boolean\".\n  //\n  // `ui` is deliberately NOT declared. A theme choice is about how the SYSTEM renders for someone,\n  // not a fact about them — the same line that keeps job executions, entitlement limits and unread\n  // counters out of the inventory. The three below are the other side of it: how the person wants to\n  // be CONTACTED, what they decided about their own privacy, and where and in what language they\n  // are — each a fact about them that a notice owes an answer on.\n  //\n  // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it\n  // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a\n  // reader nothing the word \"preferences\" does not.\n  notifications: addImpersonalizeWith(\n    UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  \n  // CREATE cannot carry the consent decision, because the row is SEEDED (the USERS → USER_PREFERENCES\n  // `onParentCreate` composition writes only the parent key) and a person has decided nothing at that\n  // point. Every door that writes a decision emits a row: the gate, the self and admin UPDATE, the\n  // RESET, and `carry_anonymous_consent`. CREATE sits below the automatic audit floor, so a consent\n  // accepted there would be stored with no trace, which is what\n  // `evidence-requirement:consent-decision-transition-record` C2 forbids. The control marker for that\n  // objective sits on the decision leaf itself (`UserPrivacySchema.consentedPurposes`); this site only\n  // narrows which verbs can reach it.\n  privacy: addImpersonalizeWith(\n    UserPrivacySchema.default(UserPrivacySchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE)\n      .excludeFromCreate(),\n    RedactionType.RESET,\n  ),\n  \n  ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),\n  \n  // Timezone and locale are the two that most clearly identify something about the person rather\n  // than about the session — a timezone narrows where they are, which is why LOCATION rides here.\n  // LOCATION as well as USAGE — a timezone and a locale narrow where a person is. RESET returns the\n  // application's own defaults, which is what a person who never chose still has.\n  regional: addImpersonalizeWith(\n    UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()\n      .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),\n    RedactionType.RESET,\n  ),\n  \n  // Enhanced language preferences\n  languagePreferences: addImpersonalizeWith(\n    UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  )\n});\nexport type UserPreferences = z.infer<typeof UserPreferencesSchema>;\n\n/**\n * The hand-authored mirror of the auto-generated `USER_SELF` CONTEXT response.\n *\n * Every field name here MUST be the one `addRelationshipPlaceholders` declares on the generated\n * `contextDto`, i.e. `Resources_SharedUtils.resolveRelationshipObjectIdentity(...).objectFieldName`\n * for the relationship. This schema is a TYPE for consumers (the frontend casts the context read to\n * it, and the auth response embeds it); it does not validate the response, so a name that drifts\n * from the generated DTO is invisible until someone reads a field that is never there.\n *\n * `userSelfPreferences` is PLURAL because `USER_SELF_PREFERENCES` declares\n * `resourceFieldIdentifier: 'userSelfPreferencesId'` and the DTO's field name is that identifier's\n * base — unlike `userSelfProfile`, whose identifier is already singular (`userSelfProfileId`). It\n * read `userSelfPreference` until 2026-09-10, which is the name the POPULATION side used to\n * produce; the generated DTO never declared it, so the populated preferences were Zod-stripped on\n * the way out and no application ever received them (issue #563).\n */\nexport const UserContextSchema = UserSchema.extend({\n  // Relationship-based field names — must match the auto-generated context DTO exactly.\n  userSelfProfile: UserProfileSchema.optional(),\n  userSelfPreferences: UserPreferencesSchema.optional(),\n  organizationMembers: z.array(OrganizationMemberSchema).optional(),\n});\nexport type UserContext = z.infer<typeof UserContextSchema>; \n"]}
+{"version":3,"file":"users.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,2DAA6C,CAAA;IAC7C,uDAAyC,CAAA;IACzC,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAA8B;IAC5E,OAAO,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;AACtC,CAAC;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,0BAAa,CAAA;IACb,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,EAAE,iBAAiB,CACtB,oBAAoB,CAClB,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,EACrF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,6FAA6F;IAC7F,yDAAyD;IACzD,oBAAoB,CAAC,eAAe,CACrC;IACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC5E,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,oBAAoB;IACpB,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,+FAA+F;IAC/F,sFAAsF;IACtF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,iBAAiB,EAAE;IAC1H,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IACpG,+GAA+G;IAC/G,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC1E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,oWAAoW,CAAC;IACxe;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACtI,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,gTAAgT,CAAC;IAC7T,oGAAoG;IACpG,kGAAkG;IAClG,sGAAsG;IACtG,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,oIAAoI,CAAC;CAClM,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,sEAAsE;IACtE,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,QAAQ,EAAE,oBAAoB,CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,WAAW,EAAE,oBAAoB,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7F,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;;OAOG;IACH,gGAAgG;IAChG,EAAE;IACF,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,6FAA6F;IAC7F,kGAAkG;IAClG,6EAA6E;IAC7E,EAAE;IACF,2FAA2F;IAC3F,gGAAgG;IAChG,gGAAgG;IAChG,yCAAyC;IACzC,MAAM,EAAE,oBAAoB,CAC1B,MAAM,CAAC;QACL,MAAM,EAAE,UAAU,CAAC,KAAK;QACxB,gBAAgB,EAAE,QAAQ;QAC1B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QACxB,gBAAgB,EAAE;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;YACpC,kBAAkB,EAAE,IAAI;SACzB;KACF,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC3D,aAAa,CAAC,MAAM,CACrB;IACD,+FAA+F;IAC/F,kGAAkG;IAClG,gGAAgG;IAChG,mEAAmE;IACnE,GAAG,EAAE,oBAAoB,CACvB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;OAMG;IACH,EAAE;IACF,yFAAyF;IACzF,6CAA6C;IAC7C,EAAE;IACF,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,+FAA+F;IAC/F,gDAAgD;IAChD,WAAW,EAAE,oBAAoB,CAC/B,iBAAiB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,MAAM,CACrB;IACD,KAAK,EAAE,oBAAoB,CACzB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,wQAAwQ,CAAC;IACnT,kGAAkG;IAClG,qGAAqG;IACrG,gGAAgG;IAChG,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oNAAoN,CAAC;CAChQ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,oOAAoO,CAAC;CACjT,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,0KAA0K,CAAC;IACzO,+FAA+F;IAC/F,2FAA2F;IAC3F,6FAA6F;IAC7F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iOAAiO,CAAC;IAC9S,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6JAA6J,CAAC;IAC1O,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,mSAAmS,CAAC;CAC5Y,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,0CAAmB,CAAA;IACnB,gCAAS,CAAA;IACT,4CAAqB,CAAA;IACrB,uDAAgC,CAAA;AAClC,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,oFAAoF;IACpF,oFAAoF;IACpF,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,yFAAyF;IACzF,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,kEAAkE;IAClE,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,gEAAgE;IAChE,EAAE;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,kDAAkD;IAClD,aAAa,EAAE,oBAAoB,CACjC,mCAAmC,CAAC,OAAO,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvF,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;IAED,oGAAoG;IACpG,oGAAoG;IACpG,iGAAiG;IACjG,kGAAkG;IAClG,8DAA8D;IAC9D,oGAAoG;IACpG,qGAAqG;IACrG,oCAAoC;IACpC,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACnD,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;SAC1C,iBAAiB,EAAE,EACtB,aAAa,CAAC,KAAK,CACpB;IAED,EAAE,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAErG,+FAA+F;IAC/F,gGAAgG;IAChG,kGAAkG;IAClG,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAC5B,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC9F,cAAc,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAC9E,aAAa,CAAC,KAAK,CACpB;IAED,gCAAgC;IAChC,mBAAmB,EAAE,oBAAoB,CACvC,6BAA6B,CAAC,OAAO,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC5F,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;CACF,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC;IACjD,sFAAsF;IACtF,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC7C,mBAAmB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACrD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * User Shared Schemas\n * \n * Shared user schemas for frontend and backend with MongoDB compatibility\n */\n\nimport { z } from 'zod';\n\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { UserPrivacySchema } from '../compliance/privacy/privacy.shared.schemas';\nimport { OrganizationMemberSchema } from '../organizations/organization-members.shared.schemas';\nimport { AvailableLanguage, TimezoneSchema, DateFormat, TimeFormat } from '@wildo-ai/presets-components-models';\nimport { EnumMultipleEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * The address written over a user's `email` when the subject is erased and the row retained.\n *\n * `.invalid` is an RFC 2606 reserved TLD: it can never be registered and never resolves, so an\n * erased address cannot be delivered to, cannot be confused with a live account, and cannot become\n * a real identity if a stray code path ever re-mails it.\n *\n * Exported as ONE named source so the erasure orchestrator, tests and any operator query recognize\n * an erased subject without duplicating the literal.\n */\nexport const ERASED_USER_EMAIL = 'erased@erased.invalid';\n\n/**\n * What a REQUIRED name field becomes when the subject is erased.\n *\n * `firstName` and `lastName` are `min(1)`, so REMOVE is not available to them — nulling a required\n * field would leave a row the schema itself rejects on the next read. MASK with a value that is\n * obviously not a name keeps the row parseable while carrying no information about the person.\n *\n * Deliberately the same placeholder as `ERASED_FILE_NAME_PLACEHOLDER`: a reader meeting `[erased]`\n * in an export or an admin view should not have to learn a second vocabulary to recognise it.\n */\nexport const ERASED_USER_NAME = '[erased]';\n\n/**\n * What an erased EXTERNAL identifier becomes — a provider's own id for the person.\n *\n * Distinct from `ERASED_USER_NAME` despite the same literal, because the two answer different\n * questions and will diverge: a name is displayed to a human, an external id is matched against a\n * provider's records. Merging them would make a future change to either silently change the other.\n */\nexport const ERASED_IDENTITY_VALUE = '[erased]';\n\nexport enum UserStatus {\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED',\n  PENDING_VERIFICATION = 'PENDING_VERIFICATION',\n  PENDING_INVITATION = 'PENDING_INVITATION',\n  DELETED = 'DELETED'\n}\n\n/**\n * True when a person of this status may still act on their own data — ACTIVE only, the same rule the sign-in,\n * token refresh and request-context gates apply to the person themself.\n *\n * Named for the inbound pipeline (#1629): a USER-scope delivery runs on one person's data, and a handler must\n * not act there for someone who could not act there themself. It is the user-scope twin of\n * `isAuthorityConferringOrganizationStatus`.\n */\nexport function isAuthorityConferringUserStatus(status: UserStatus | undefined): boolean {\n  return status === UserStatus.ACTIVE;\n}\n\nexport enum UserTheme {\n  LIGHT = 'LIGHT',\n  DARK = 'DARK',\n  AUTO = 'AUTO'\n}\n\nexport const UserSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * Email is the STRICT unique identity anchor — there is never more than one\n   * `User` per email. `.isUnique()` is the fail-closed DB backstop; every\n   * provisioning path (self-registration, org-admin invite, SSO JIT, SCIM,\n   * anonymous transposition) MUST find-or-create by this normalized value rather\n   * than blind-create, and recover from the duplicate-key `409` on the rare\n   * concurrent race (e.g. an invite and an SSO JIT landing at once). `.toLowerCase()`\n   * normalizes before both the lookup and the unique check so casing can't fork an\n   * identity. `.excludeFromUpdate()` keeps the anchor immutable.\n   *\n   * **It is also the ONLY personal datum on this row** (the rest is `_id`, status, roles, types and\n   * timestamps; names / bio / phone / avatar all live on `USER_PROFILES`). So it is what a subject\n   * erasure scrubs — `MASK` to {@link ERASED_USER_EMAIL}, which keeps the row resolvable as an\n   * anonymized subject for the retained billing records whose foreign keys point at it.\n   *\n   * `MASK` with an explicit value rather than `REMOVE`: `REMOVE` writes `null`, which this schema\n   * rejects, so it would force `.nullish()` here — widening the identity anchor to\n   * `string | null | undefined` for ~20+ consumers (auth registration, password reset, JWT guard,\n   * SCIM, SSO provisioning, org invites) AND making it optional at CREATE, to represent a state only\n   * the audited see-through reader can ever observe, since a retained row is hidden from every\n   * normal read. The default mask constant cannot be used either — it is not a valid email.\n   * Every erased user shares this one address; that cannot collide, because the unique index on a\n   * retention-governed resource covers only non-retained rows and the scrub flips the row to\n   * `RETAINED` in the same write.\n   */\n  email: addDataCategories(\n    addImpersonalizeWith(\n      z.email().isDBIndexed().isUnique().toLowerCase().isSummaryField().excludeFromUpdate(),\n      RedactionType.MASK,\n      { maskValue: ERASED_USER_EMAIL },\n    ),\n    // Declared because the engine owes its OWN inventory. Without it, every generated application's\n    // privacy notice would name `users.email` as an outstanding category gap — the field carries a\n    // scrub treatment, which is the application saying it holds personal data, so the missing\n    // category would be a provable omission the framework left for each app to fix. CONTACT_DETAILS\n    // rather than IDENTITY: it is how the person is reached. That it also serves as the identity\n    // anchor is a property of this schema, not of the datum.\n    PersonalDataCategory.CONTACT_DETAILS,\n  ),\n  /**\n   * WHEN this address was proven to be reachable by the person who holds the account — and nothing else.\n   *\n   * ## Why a moment, and why it is not `status` (#1285)\n   *\n   * `email_verified` is an OIDC claim this application ISSUES to relying parties, and it was derived\n   * from `UserStatus.ACTIVE`. ACTIVE does not mean the address was proven: with\n   * `EmailVerificationMode.DEFERRED`, and on the password-less path, registration creates an ACTIVE\n   * account precisely so the emailed link can be the way in — the address is proven when the link is\n   * CLICKED, which may be later or never. So an application could assert to every relying party that\n   * an address was verified when nothing had verified it.\n   *\n   * The registration flow already knows the difference and says so at its own site: *\"The status gate\n   * and the verification gate are not the same gate, and conflating them is what makes this look wrong\n   * at first glance.\"* This field is that sentence made readable by everything downstream.\n   *\n   * ## Absent is UNKNOWN, never false\n   *\n   * There is no backfill, so an account verified before this field existed carries nothing. Readers\n   * therefore treat absence as unknown and OMIT the claim — which is the doctrine\n   * `oidc-user-claims.backend.service.ts` already states for itself: *\"assert the claim only when the\n   * status determines it; omit it otherwise rather than assert an unknown state.\"* Absence must not\n   * become `false`: that would tell a relying party an address is unverified when it may well have\n   * been, which is a different false statement rather than a safer one.\n   *\n   * Mirrors `UserCredentials.phoneVerifiedAt`, which has recorded the same fact for the phone channel\n   * since SMS OTP shipped. Email was the channel with no record at all.\n   *\n   * NOT `.isAuditEvidence()`, for the reason the block below gives about `email`: the act is already\n   * recorded as its own auditable event (`logUserEmailVerified`), and a moment beside a masked\n   * identity anchor does not decide authority.\n   */\n  emailVerifiedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  // The three fields below carry `.isAuditEvidence()`: their VALUES are recorded before-and-after on\n  // the `resource_operation_performed` audit event. All three decide what the principal may do, and\n  // all three hold closed vocabulary rather than personal data — so recording them is both necessary\n  // as authorization evidence and free of personal data whose erasure obligations could reach the\n  // immutable ledger.\n  //\n  // Contrast `email` directly above, which is deliberately NOT marked: it is the identity anchor and\n  // is `.impersonalizeWith(MASK)`, i.e. a value the framework must be able to scrub on erasure.\n  // Copying it into an unscrubbable audit row would defeat that capability. That is the whole D4\n  // boundary in one file — mark what decides authority, never what identifies a person.\n  /**\n   * Account lifecycle and access posture.\n   *\n   * `.excludeFromUpdate()` since 2026-08-01. Lifecycle transitions belong to the dedicated verbs —\n   * `users | suspend_user` / `unsuspend_user` and `user_self | deactivate_account` /\n   * `reactivate_account` — which own the state machine, the reason, the audit event and the\n   * administrative-continuity floors. A generic field patch reproduces none of that, so accepting\n   * `status` on the ordinary UPDATE contract meant an administrator could retire an account through\n   * a door that asked none of those questions. Mirrors `OrganizationMemberSchema.status`, whose\n   * JSDoc has described the same rule for the same reason since before these verbs existed.\n   *\n   * ⚠️ The trusted server-side writers must therefore use `updateAsSystem`, which re-attaches the\n   * field past the repository's strict request-DTO re-parse — email verification\n   * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning. All four\n   * were migrated in the same change, and `USERS` opts into `systemAccessPolicy.update` for exactly\n   * them. A NEW trusted writer that reaches for `servicesRegistryHandler.update` here will be\n   * SILENTLY stripped — the account simply never changes state, with no error and no signal.\n   *\n   * assurance-control: WILDO.IDENTITY.LIFECYCLE — a change to whether a principal may authenticate\n   * runs through one guarded, evidenced authority.\n   */\n  status: z.enum(UserStatus).default(UserStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence().excludeFromUpdate(),\n  appRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]).isDBIndexed().isAuditEvidence(),\n  /** User types from config (e.g. 'user', 'admin', 'consumer'). Determines auth policy, registration context. */\n  userTypes: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * When an automated sweep must return this account to `ACTIVE`.\n   *\n   * Written only by `users | suspend_user`, whose contract takes `suspensionDuration` in DAYS. The\n   * transition hook resolves that duration to an absolute instant before persisting, because a\n   * duration is only meaningful relative to a moment the row does not otherwise record.\n   *\n   * Voluntary `user_self | deactivate_account` deliberately has no schedule: an INACTIVE account\n   * returns only when its subject calls `reactivate_account`. Absent therefore means an indefinite\n   * admin suspension or a non-scheduled lifecycle state.\n   *\n   * Server-owned (`.excludeFromCreate().excludeFromUpdate()`) so the transition verbs are the only\n   * writers, and indexed because the reactivation sweep queries exactly \"rows whose scheduled\n   * reactivation has passed\". Deliberately NOT `.isAuditEvidence()`: unlike the three fields above\n   * it does not decide what the principal may do — it is a scheduling detail, and the transition's\n   * own audit event already records the reason and the resulting status.\n   *\n   * ⚠️ For admin suspension, the value is a PROMISE the reactivation batch keeps. Persisting it without that sweep would\n   * be the same defect as a verb answering success while writing nothing: an authored intention\n   * that nothing honors.\n   */\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type User = z.infer<typeof UserSchema>;\n\nexport const UserLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField().describe(\"The language this user reads the application in, and the language of the notification and password-reset emails sent to them. In the interface, the organization's primary language takes precedence when the organization enforces it or the user opts into the organization default, and a language the application does not offer is ignored. Defaults to `en`.\"),\n  /**\n   * The languages to use, in order, when `primaryLanguage` is one the application does not offer (#1799).\n   *\n   * Read in two places, through one ordering: the interface's language resolution tries them after the\n   * primary language and before anything it remembers or detects; the recipient language of a\n   * notification or password-reset email tries them after the primary language and before the user's\n   * regional locale. Each is used only if the application (and, in the interface, the organization)\n   * offers it. It was stored and edited and read by nothing until then.\n   *\n   * Defaults to EMPTY, not `[en]`: a fixed English default would quietly override the application's\n   * own fallback language for every user who never set this.\n   *\n   * Compact multi-select: render as a chips combobox (searchable popover) instead of a full inline\n   * checkbox column — `multipleEditMode: COMBOBOX` on the array item is the opt-in the multiple enum\n   * control reads (`resolveEnumMultipleEditMode`). The single-select `editMode` means nothing on an array item. Fits a settings-row layout where the long language list would\n   * otherwise overflow.\n   */\n  fallbackLanguages: z\n    .array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { multipleEditMode: EnumMultipleEditMode.COMBOBOX } }))\n    .default([])\n    .describe('Languages to use, in order, when `primaryLanguage` is not one the application offers — in the interface, and for the notification and password-reset emails sent to this user. A language the application does not offer is skipped. Empty by default, which leaves the application\\'s own fallback in charge.'),\n  // `autoDetect` was removed (#1799). It was consulted only after the primary language had failed AND\n  // nothing was remembered, which for a signed-in user with the default `en` primary is effectively\n  // never. The application-level `appPreferences.languages.autoDetectFromBrowser` still governs the one\n  // case that remains, a first visit before anyone has signed in.\n  useOrganizationDefault: z.boolean().default(false).describe(\"When true, the interface uses the organization's primary language instead of this user's own `primaryLanguage`. Defaults to false.\"),\n});\nexport type UserLanguagePreferences = z.infer<typeof UserLanguagePreferencesSchema>;\n\nexport const UserProfileSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()`: one profile per user (1:1 composition). Backstops the eager\n  // `onParentCreate` seed + the provisioning paths against a concurrent\n  // double-create — the durable idempotency guarantee behind the declarative seed.\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  firstName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  lastName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  displayName: addImpersonalizeWith(\n    z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored\n   * as the standard file reference `{ fileId, updatedAt }` and rendered as a\n   * square avatar. Uses the plain `z_file()` image pipeline (upload / storage /\n   * DTO / persistence / metadata population) with no bespoke field type; the\n   * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there\n   * is no external-URL branch.\n   */\n  // REMOVE nulls the stored `{ fileId, updatedAt }` reference AND the underlying file is deleted.\n  //\n  // Corrected 2026-09-17: this said the stored object was NOT deleted, on the grounds that file bytes\n  // belong to the file resource's own lifecycle. That is not what the engine does. `userProfiles`\n  // declares a `retentionPolicy`, so `impersonalizeRowsInPlace` governs it; this field is a personal\n  // file field (REMOVE, not KEEP); and that scrub's own comment states the rule — \"a field-level\n  // scrub cannot reach INSIDE a stored blob, so a file field marked personal is only erased by\n  // deleting the file\". The deletion is sequenced as a post-commit effect on the parent transaction\n  // so a rolled-back scrub can never destroy files for a row that stayed live.\n  //\n  // The old comment under-claimed, which is the safer direction and still false — and it was\n  // load-bearing: `remove_avatar` was acknowledged as unimplementable partly by reasoning from it\n  // (#1275). A schema comment about what the product does is a claim, and this one had never been\n  // checked against the code it described.\n  avatar: addImpersonalizeWith(\n    z_file({\n      nature: FileNature.IMAGE,\n      allowedMimeTypes: 'Images',\n      maxSize: 2 * 1024 * 1024,\n      imageConstraints: {\n        maxWidth: 1024,\n        maxHeight: 1024,\n        aspectRatio: { width: 1, height: 1 },\n        generateThumbnails: true,\n      },\n    }).optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never\n  // what it will contain — a bio is a classic surface where a special category (a health condition,\n  // a religious observance, a political affiliation) arrives unannounced, and no schema certifies\n  // otherwise. Nothing here is a claim that it does NOT contain one.\n  bio: addImpersonalizeWith(\n    z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * E.164 phone number (e.g. \"+33123456789\"). `z_phone()` carries the phone\n   * metadata that drives the international phone INPUT on edit (country selector +\n   * national number) and the formatted international DISPLAY on read — replacing\n   * the old raw `z.string().regex(...)` that surfaced the regex to the user.\n   * Stored value is still a plain E.164 string, so DTO/persistence are unchanged.\n   */\n  //\n  // A phone number is contact-detail personal data by definition, so both declarations are\n  // load-bearing here rather than a curiosity.\n  //\n  // The helper form is kept DELIBERATELY, and the reason changed on 2026-09-17. It used to be the\n  // only form that worked: `z_phone()` ends in `.pipe(z.string())`, so its constructor is `ZodPipe`,\n  // a name in no applyable-type list — and the per-instance decorator install keys on that name, so\n  // a phone schema carried NO decorators at all and the fluent form threw. That gap is closed and\n  // `z_phone().dataCategories(…).impersonalizeWith(…)` now works. What keeps the helper here is that\n  // it needs no prototype method at all, which makes this field's classification independent of the\n  // decorator-install path entirely — worth having on the one field whose misclassification is a\n  // privacy incident rather than a rendering bug.\n  phoneNumber: addImpersonalizeWith(\n    addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.REMOVE,\n  ),\n  title: addImpersonalizeWith(\n    z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL),\n    RedactionType.REMOVE,\n  )\n});\nexport type UserProfile = z.infer<typeof UserProfileSchema>;\n\nexport const UserPreferences_NotificationsSchema = z.object({\n  email: z.boolean().default(true).describe(\"When false, notification emails about the user's own account are not sent to them. Emails the user receives because of a role they hold, notices marked as always delivered, and account-recovery emails such as password reset are sent regardless. Defaults to true.\"),\n  // `push` and `sms` were removed (#1799): the dispatcher sent neither channel — it logged \"not yet\n  // implemented\" and returned — and no notification declared either, so a user who turned push off \"to\n  // stop notifications\" turned off nothing. They come back with a channel that actually delivers.\n  inApp: z.boolean().default(true).describe(\"When false, the application's interface stops showing this user the real-time notifications the server sends them, as pop-ups or in the notification centre. Data on screen keeps updating live. Defaults to true.\")\n});\nexport type UserPreferences_Notifications = z.infer<typeof UserPreferences_NotificationsSchema>;\n\nexport const UserPreferences_UI_ThemeSchema = z.object({\n  theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField().describe(\"The colour scheme the interface uses for this user: `LIGHT`, `DARK`, or `AUTO` to follow the device's system setting. Applied whenever the user's preferences load, so the choice follows them across devices. Defaults to `AUTO`.\"),\n});\nexport type UserPreferences_UI_Theme = z.infer<typeof UserPreferences_UI_ThemeSchema>;\n\n/**\n * A member's OWN regional choices — and every field is OPTIONAL, deliberately.\n *\n * **Absence is a real state and it is the point of this block**: it means the member has expressed\n * no preference, so the value comes from the organization's own regional record\n * (`OrganizationPreferences.timezone` / `.locale` / `.dateFormat` / `.timeFormat`), and only then\n * from the framework fallback. `I18nContext` resolves that chain — member, then organization, then\n * framework — and it can only do so because an unexpressed preference is representable here.\n *\n * All four carried a Zod `.default(...)` until 2026-09-08 (#410), and the defaults were not a\n * convenience: they made the organization layer UNIMPLEMENTABLE. A `.default()` MATERIALIZES at\n * parse, so every member with a preferences row carried `'UTC'`, `EN`, `LOCALE_DEFAULT` and\n * `TWENTY_FOUR_HOUR` whether or not they had ever opened the settings screen — indistinguishable\n * from having chosen them. A tenant that set `Europe/Paris` could never reach a single member,\n * because there was no member left who had not \"expressed\" UTC.\n *\n * The same shape had already cost a decision elsewhere: `cancelImmediately: z.boolean().default(false)`\n * made \"the caller expressed no cancellation preference\" unobservable, which is why the authored\n * `defaultBehavior` policy beneath it was unimplementable rather than merely unimplemented (#408).\n * A default one layer up erases the state the layer beneath exists to answer for.\n *\n * `locale` in particular was also WRONG on its own terms. `I18nContext` resolves it as\n * `regional.locale ?? currentLanguage ?? 'en'`, so a materialized `EN` meant the left side always\n * won and the resolved UI language was never consulted: a member using the application in French\n * got `en` date, time and number formatting. Removing the default is what lets that `??` chain do\n * what it was written to do.\n *\n * Note what did NOT change: the framework's fallbacks are unchanged, and they are still exactly\n * these four values. A member in a tenant that has authored nothing sees precisely what they saw\n * before — the difference is only that a tenant which HAS authored something is now heard.\n */\nexport const UserPreferences_RegionalSchema = z.object({\n  timezone: TimezoneSchema.optional().isSummaryField().describe(\"The IANA time zone (for example `Europe/Paris`) in which the interface shows dates and times to this user. When omitted, the organization's time zone applies, then UTC.\"),\n  // LOCALE_DEFAULT (not ISO_8601) remains the framework FALLBACK, resolved in `I18nContext`: \"no\n  // expressed preference\" must mean locale-driven rendering. Storing it here would pin every\n  // preference-less member to it and mask both the organization layer and the locale fallback.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').optional().describe(\"How the interface shows dates to this user: `LOCALE_DEFAULT` follows the conventions of the resolved locale, every other value is a fixed pattern. When omitted, the organization's date format applies, then `LOCALE_DEFAULT`.\"),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').optional().describe(\"Whether the interface shows times to this user on a 12-hour (`12h`) or 24-hour (`24h`) clock. When omitted, the organization's setting applies, then `24h`.\"),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').optional().isSummaryField().describe(\"The language tag (for example `en-GB`) whose conventions the interface uses to format dates, times and numbers for this user. When omitted, the organization's locale applies, then the language the interface is shown in. It is also published as the `locale` claim to OpenID Connect clients.\")\n});\nexport type UserPreferences_Regional = z.infer<typeof UserPreferences_RegionalSchema>;\n\n/**\n * The preference blocks a caller can address as a unit — the closed vocabulary behind\n * `reset_to_defaults` on USER_SELF_PREFERENCES.\n *\n * **Every value IS the persisted field name on {@link UserPreferencesSchema}.** That is the\n * point of the enum, not a coincidence: it lets the reset patch be DERIVED from the vocabulary\n * instead of routed through a hand-written flag-to-field map. The previous contract was six\n * booleans (`resetNotifications`, `resetUI`, …) that named no schema path, so the whole request\n * was stripped before persistence and the route answered 200 having reset nothing.\n *\n * Adding a preference group to the schema means adding a member here; the mapped type in\n * `user-preferences-reset.shared.utils.ts` then refuses to compile until the group declares how\n * it resets. Renaming a group field without renaming the value fails the same way.\n *\n * Note `LANGUAGE = 'languagePreferences'` — the member reads as the concept, the value is the\n * field. Do not \"tidy\" the value to `language`; it is an address, not a label.\n */\nexport enum UserPreferenceGroup {\n  NOTIFICATIONS = 'notifications',\n  PRIVACY = 'privacy',\n  UI = 'ui',\n  REGIONAL = 'regional',\n  LANGUAGE = 'languagePreferences',\n}\n\nexport const UserPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` is the idempotency backstop for onParentCreate seeding: the eager\n  // seed (and any retry) is deduplicated at the DB layer — a second seed for the same\n  // user fails the unique constraint and is swallowed, guaranteeing exactly one\n  // preferences row per user. (Prod migration note: dedupe any pre-existing duplicate\n  // userId rows before this index builds; preferences was seeded nowhere pre-feature,\n  // so duplicates are unexpected.)\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // ── Which preference blocks are data ABOUT the person, and which are rendering state ──\n  //\n  // Declared at the BLOCK, not on the leaves inside it. The resolver walks TOP-LEVEL fields only —\n  // the same limit the subject-export compiler and the impersonalize writer have — so a category on\n  // `regional.timezone` would be invisible. That is not a workaround: a notice enumerates KINDS, and\n  // \"communication preferences\" is the kind, not \"the sms boolean\".\n  //\n  // `ui` is deliberately NOT declared. A theme choice is about how the SYSTEM renders for someone,\n  // not a fact about them — the same line that keeps job executions, entitlement limits and unread\n  // counters out of the inventory. The three below are the other side of it: how the person wants to\n  // be CONTACTED, what they decided about their own privacy, and where and in what language they\n  // are — each a fact about them that a notice owes an answer on.\n  //\n  // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it\n  // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a\n  // reader nothing the word \"preferences\" does not.\n  notifications: addImpersonalizeWith(\n    UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  \n  // CREATE cannot carry the consent decision, because the row is SEEDED (the USERS → USER_PREFERENCES\n  // `onParentCreate` composition writes only the parent key) and a person has decided nothing at that\n  // point. Every door that writes a decision emits a row: the gate, the self and admin UPDATE, the\n  // RESET, and `carry_anonymous_consent`. CREATE sits below the automatic audit floor, so a consent\n  // accepted there would be stored with no trace, which is what\n  // `evidence-requirement:consent-decision-transition-record` C2 forbids. The control marker for that\n  // objective sits on the decision leaf itself (`UserPrivacySchema.consentedPurposes`); this site only\n  // narrows which verbs can reach it.\n  privacy: addImpersonalizeWith(\n    UserPrivacySchema.default(UserPrivacySchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE)\n      .excludeFromCreate(),\n    RedactionType.RESET,\n  ),\n  \n  ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),\n  \n  // Timezone and locale are the two that most clearly identify something about the person rather\n  // than about the session — a timezone narrows where they are, which is why LOCATION rides here.\n  // LOCATION as well as USAGE — a timezone and a locale narrow where a person is. RESET returns the\n  // application's own defaults, which is what a person who never chose still has.\n  regional: addImpersonalizeWith(\n    UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()\n      .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),\n    RedactionType.RESET,\n  ),\n  \n  // Enhanced language preferences\n  languagePreferences: addImpersonalizeWith(\n    UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  )\n});\nexport type UserPreferences = z.infer<typeof UserPreferencesSchema>;\n\n/**\n * The hand-authored mirror of the auto-generated `USER_SELF` CONTEXT response.\n *\n * Every field name here MUST be the one `addRelationshipPlaceholders` declares on the generated\n * `contextDto`, i.e. `Resources_SharedUtils.resolveRelationshipObjectIdentity(...).objectFieldName`\n * for the relationship. This schema is a TYPE for consumers (the frontend casts the context read to\n * it, and the auth response embeds it); it does not validate the response, so a name that drifts\n * from the generated DTO is invisible until someone reads a field that is never there.\n *\n * `userSelfPreferences` is PLURAL because `USER_SELF_PREFERENCES` declares\n * `resourceFieldIdentifier: 'userSelfPreferencesId'` and the DTO's field name is that identifier's\n * base — unlike `userSelfProfile`, whose identifier is already singular (`userSelfProfileId`). It\n * read `userSelfPreference` until 2026-09-10, which is the name the POPULATION side used to\n * produce; the generated DTO never declared it, so the populated preferences were Zod-stripped on\n * the way out and no application ever received them (issue #563).\n */\nexport const UserContextSchema = UserSchema.extend({\n  // Relationship-based field names — must match the auto-generated context DTO exactly.\n  userSelfProfile: UserProfileSchema.optional(),\n  userSelfPreferences: UserPreferencesSchema.optional(),\n  organizationMembers: z.array(OrganizationMemberSchema).optional(),\n});\nexport type UserContext = z.infer<typeof UserContextSchema>; \n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wildo-ai/saas-models",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Shared TypeScript types and Zod schemas for SaaS infrastructure",
   "author": "Wildo AI",
@@ -60,9 +60,9 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@wildo-ai/external-connectors-models": "1.1.5",
-    "@wildo-ai/presets-components-models": "1.1.5",
-    "@wildo-ai/zod-decorators": "1.1.5"
+    "@wildo-ai/external-connectors-models": "1.1.6",
+    "@wildo-ai/presets-components-models": "1.1.6",
+    "@wildo-ai/zod-decorators": "1.1.6"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "4.0.15",

package/dist/esm/compliance/privacy/data-retention.shared.schemas.js

@@ -1,7 +0,0 @@
-import { z } from "zod";
-export const DataRetentionPolicySchema = z.object({
-    retentionDays: z.number().positive(),
-    autoDelete: z.boolean().default(true),
-    archiveAfterDays: z.number().positive().optional(),
-});
-//# sourceMappingURL=data-retention.shared.schemas.js.map