@wildo-ai/saas-models 1.1.7 → 1.1.9

package/dist/esm/users/users.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,UAAU,EACV,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,oGAAoG;AACpG,sGAAsG;AACtG,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAU,CAAC;AAEvE,oCAAoC;AACpC,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,oGAAoG;IACpG,iGAAiG;IACjG,gGAAgG;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;CAC/D,CAAC;AAEF,qEAAqE;AACrE,MAAM,yBAAyB,GAAG;IAChC,GAAG,mBAAmB;IACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,uBAAuB,GAAG,CAAC,GAAG,iBAAiB,EAAE,QAAQ,CAAU,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,gCAAgC,GAAG,CAAC,EAAE,aAAa,EAA2D,EAAY,EAAE,CAChI,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,iCAAiC,GAAG,CAAC,EAAE,QAAQ,EAAyB,EAAW,EAAE,CACxF,QAAiD,EAAE,UAAU,KAAK,KAAK,CAAC;AAE3E,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,+FAA+F;AAC/F,gGAAgG;AAChG,uFAAuF;AACvF,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,iFAAiF;AACjF,EAAE;AACF,4CAA4C;AAC5C,gGAAgG;AAChG,qFAAqF;AACrF,8FAA8F;AAC9F,iGAAiG;AACjG,sEAAsE;AACtE,gGAAgG;AAChG,kFAAkF;AAClF,kGAAkG;AAClG,wFAAwF;AACxF,0EAA0E;AAC1E,2FAA2F;AAC3F,8DAA8D;AAC9D,8DAA8D;AAC9D,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,uEAAuE;AACvE,EAAE;AACF,2EAA2E;AAC3E,+FAA+F;AAC/F,qFAAqF;AACrF,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,mGAAmG;AACnG,EAAE;AACF,4FAA4F;AAC5F,yCAAyC;AACzC,8FAA8F;AAC9F,oGAAoG;AACpG,8FAA8F;AAC9F,oFAAoF;AACpF,qFAAqF;AACrF,0FAA0F;AAC1F,iCAAiC;AACjC,mGAAmG;AACnG,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,mGAAmG;AACnG,6FAA6F;AAC7F,mGAAmG;AACnG,gGAAgG;AAChG,4FAA4F;AAC5F,gGAAgG;AAChG,iGAAiG;AACjG,yDAAyD;AACzD,EAAE;AACF,4CAA4C;AAC5C,iGAAiG;AACjG,0EAA0E;AAC1E,iGAAiG;AACjG,iGAAiG;AACjG,6DAA6D;AAC7D,6FAA6F;AAC7F,wEAAwE;AACxE,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,wBAAwB;AACxB,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,uFAAuF;AACvF,mGAAmG;AACnG,4EAA4E;AAC5E,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,sCAAsC;AACtC,uEAAuE;AACvE,MAAM,CAAN,IAAY,gBAsBX;AAtBD,WAAY,gBAAgB;IAC1B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;IACnC,iEAA6C,CAAA;IAC7C;;;;;;;;;;;;;OAaG;IACH,mDAA+B,CAAA;AACjC,CAAC,EAtBW,gBAAgB,KAAhB,gBAAgB,QAsB3B;AAWD;;EAEE;AACF,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;IAC1C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACnF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,uBAAuB;IAE/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,6BAA6B,EAAE,KAAK;IAEpC,mFAAmF;IACnF,8EAA8E;IAC9E,sFAAsF;IACtF,sFAAsF;IACtF,qFAAqF;IACrF,2FAA2F;IAC3F,0FAA0F;IAC1F,EAAE;IACF,iEAAiE;IACjE,iFAAiF;IACjF,oFAAoF;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,kFAAkF;IAClF,iFAAiF;IACjF,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,2FAA2F;QAC3F,8EAA8E;KAC/E;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;;;OAMG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,gBAAgB;IAEjC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oFAAoF;oBACpF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,uFAAuF;oBACvF,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,uFAAuF;oBACvF,0FAA0F;oBAC1F,wFAAwF;oBACxF,2FAA2F;oBAC3F,sCAAsC;iBACvC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,yFAAyF;oBACzF,kFAAkF;oBAClF,oCAAoC,EAAE,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,2EAA2E;oBAC3E,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,2EAA2E;oBAC3E,yCAAyC;oBACzC,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,gEAAgE;oBAChE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,yEAAyE;oBACzE,yEAAyE;oBACzE,uEAAuE;oBACvE,mEAAmE;oBACnE,yEAAyE;oBACzE,2EAA2E;oBAC3E,wEAAwE;oBACxE,2EAA2E;oBAC3E,mEAAmE;oBACnE,0EAA0E;oBAC1E,gBAAgB,EAAE;wBAChB,OAAO;wBACP;4BACE,UAAU,EAAE,KAAK;4BACjB,eAAe,EAAE,gBAAgB,CAAC,aAAa;4BAC/C,gBAAgB,EAAE,QAAQ;4BAC1B,mEAAmE;4BACnE,sCAAsC;yBACvC;qBACF;oBACD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,EAAE;oBACF,uFAAuF;oBACvF,iFAAiF;oBACjF,0FAA0F;oBAC1F,qFAAqF;oBACrF,uFAAuF;oBACvF,wFAAwF;oBACxF,mEAAmE;iBACpE;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wDAAwD;oBACvG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qEAAqE;oBACrE,uEAAuE;oBACvE,kDAAkD;oBAClD,EAAE;oBACF,2DAA2D;oBAC3D,2FAA2F;oBAC3F,sFAAsF;oBACtF,EAAE;oBACF,2FAA2F;oBAC3F,+EAA+E;oBAC/E,+EAA+E;iBAChF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,iFAAiF;oBACjF,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,+FAA+F;oBAC/F,gGAAgG;oBAChG,gGAAgG;oBAChG,iGAAiG;oBACjG,+FAA+F;oBAC/F,iGAAiG;oBACjG,qDAAqD;oBACrD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gCAAgC;oBAC/E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,2FAA2F;oBAC3F,qFAAqF;oBACrF,kFAAkF;oBAClF,gFAAgF;oBAChF,uCAAuC;oBACvC,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,2FAA2F;oBAC3F,2FAA2F;oBAC3F,yFAAyF;oBACzF,uFAAuF;oBACvF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qJAAqJ,CAAC;wBACrM,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBACrI,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4FAA4F;oBAC5F,0FAA0F;oBAC1F,uFAAuF;oBACvF,mDAAmD;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wIAAwI,CAAC;wBACxL,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBACrI,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,6CAA6C;oBAC5F,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,yFAAyF;oBACzF,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;6BAC/B,QAAQ,CAAC,uFAAuF,CAAC;wBACpG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO;6BACrD,QAAQ,CAAC,iMAAiM,CAAC;wBAC9M,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oIAAoI,CAAC;qBACrL,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,gCAAgC;oBACjD,SAAS,EAAE,iCAAiC;oBAC5C,sFAAsF;oBACtF,uFAAuF;oBACvF,0EAA0E;oBAC1E,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;YACjC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,8BAA8B;oBAC7E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,sFAAsF;oBACtF,mFAAmF;oBACnF,qEAAqE;oBACrE,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;wBACjI,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,yFAAyF,CAAC;qBAC1I,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC;oBACvD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,gCAAgC;oBACjD,SAAS,EAAE,iCAAiC;oBAC5C,sFAAsF;oBACtF,uFAAuF;oBACvF,0EAA0E;oBAC1E,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BG;QACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,uFAAuF;oBACvF,iFAAiF;oBACjF,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,sFAAsF;oBACtF,kFAAkF;oBAClF,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,6DAA6D;wBAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gGAAgG,CAAC;wBAC7I,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,6FAA6F,CAAC;qBAC9I,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,gCAAgC;oBACjD,SAAS,EAAE,iCAAiC;oBAC5C,sFAAsF;oBACtF,uFAAuF;oBACvF,0EAA0E;oBAC1E,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE;YAChC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,oCAAoC,EAAE,IAAI;oBAC1C,wFAAwF;oBACxF,2FAA2F;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB;;;;;;;2BAOG;wBACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;6BACtC,QAAQ,CAAC,+KAA+K,CAAC;qBAC7L,CAAC;iBACH;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qDAAqD;oBACpG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,kGAAkG,CAAC;qBAChJ,CAAC;oBACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,+FAA+F;wBAC/F,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,mGAAmG,CAAC;wBACjI,+EAA+E;wBAC/E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,gHAAgH,CAAC;qBACxJ,CAAC;oBACF,oFAAoF;oBACpF,2EAA2E;oBAC3E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;oBACrD,CAAC;iBACF;aACF;YACD,yFAAyF;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,kDAAkD;YAClD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KAEF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Users Shared Resource Configuration\n *\n * Resource configuration for administrative user management operations.\n * Handles user lifecycle, role management, and administrative actions.\n */\n\nimport { z } from 'zod';\nimport {\n  UserSchema,\n  UserStatus,\n  UserTheme\n} from './users.shared.schemas';\nimport { AppRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Sort and filter fields for user management. `joinedAt` was listed in both and is not a field of a\n// user (#1806) — the row records `createdAt` — so sorting or filtering by it did nothing. The factory\n// now refuses a collection field that is not a field.\nconst USERS_SORT_FIELDS = ['createdAt', 'updatedAt', 'email'] as const;\n\n// App users get basic filter fields\nconst USERS_FILTER_FIELDS = {\n  status: z.enum(UserStatus),\n  email: z.string(),\n  // By id — how a REFERENCE to a user is labelled from inside an organization (#1661). The users READ\n  // lets a user read only themselves, so the label of an assignee or owner is resolved through the\n  // org-scoped people search (`/organizations/{org}/users/search`), filtered to that one id. That\n  // route is already confined to the organization's members, so filtering it narrows what it returns\n  // and exposes nothing new. The filter panel never offers `_id` (`parseFilterFieldDefinitions`).\n  _id: z.string().describe('Only return the user with this id.'),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst USERS_ADMIN_FILTER_FIELDS = {\n  ...USERS_FILTER_FIELDS,\n  createdAt: z.date(), // Admin can filter by creation date\n  updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst USERS_ADMIN_SORT_FIELDS = [...USERS_SORT_FIELDS, 'status'] as const;\n\n/**\n * The recipient of an administrative account-status notice: the user whose status changed (#1807).\n *\n * `USERS_CUSTOM` rather than `USER_SELF`, and the difference is the whole defect: `USER_SELF` is the\n * INITIATOR — here the administrator — so a \"your account was suspended\" email aimed at it lands in\n * the administrator's inbox. The row the operation just wrote IS the subject, so its `_id` is the\n * only recipient.\n */\nconst selectAccountStatusChangeSubject = ({ currentObject }: { currentObject: { _id?: unknown } | null | undefined }): string[] =>\n  currentObject?._id ? [String(currentObject._id)] : [];\n\n/**\n * Whether the administrator asked for the subject to be told (#1807).\n *\n * `suspend_user`, `unsuspend_user` and `reactivate_user` have always accepted `notifyUser` and nothing\n * read it, so every value — including the default `true` — sent the subject nothing. `!== false`\n * rather than a truthy test because the field carries `.default(true)`: an omitted value must notify.\n * That includes the suspension sweep, which lifts an elapsed suspension by calling `unsuspend_user`\n * with an empty body — a person whose access comes back on its own is told so, which is the point.\n *\n * Same shape as `organizations | suspend`'s `notifyMembers`, which a quiet suspension (a fraud hold\n * the operator does not want to tip off) is the reason for having at all.\n */\nconst administratorAskedToNotifySubject = ({ inputDto }: { inputDto: unknown }): boolean =>\n  (inputDto as { notifyUser?: boolean } | undefined)?.notifyUser !== false;\n\n// Custom operations enum for user management\n//\n// Invitation is intentionally absent. Organization invitations are created by\n// the organization-members lifecycle, where the pending membership, invitee\n// identity, token and email are produced together. A previous `send_invitation`\n// users operation declared an invitation-receipt DTO but registered no backend\n// implementation capable of producing it. Reintroduce an application-wide\n// invitation operation only with a real lifecycle owner and handler; an\n// API_CALL declaration by itself is not an implementation.\n//\n// IMPERSONATION IS NOT A TOKEN MINT — IT IS AN IDENTITY SUBSTRATE THE FRAMEWORK DOES NOT HAVE.\n// `IMPERSONATE` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ reason, durationMinutes, auditLog }` and promising a\n// `{ impersonationToken, expiresAt, auditId }` response, and was removed on 2026-08-01: it was\n// ROUTED but never implemented. With `resourceOperationLike: READ` the generic core path simply\n// returned the target's user row, so the most dangerous verb in the catalogue answered\n// **HTTP 200** — an operator is told an impersonation session exists when none does.\n//\n// Do NOT re-declare it as a plain token mint. A minted session JWT is today byte-for-byte\n// indistinguishable from a genuine one: the payload is `{…, sub: userId, aud: 'AUTH_TOKEN' }`\n// with NO actor claim, and `ExecutionContext` has no \"acting as\" dimension. Every audit event\n// raised during such a session would be attributed to the impersonated USER rather than the\n// administrator — the framework would manufacture false attribution in exactly the records an\n// auditor relies on. That is strictly worse than having no impersonation at all.\n//\n// Re-declaring requires, as one workstream:\n//   1. an actor claim on the session JWT (RFC 8693 `act`-style: `sub` = target, actor = admin),\n//      minted through a dedicated path — never by reusing the ordinary login issuer;\n//   2. `ExecutionContext` propagation of that actor, so it reaches every downstream consumer;\n//   3. actor-attributed audit events — a new `CoreAuditableEventType` pair for session start/end\n//      plus actor stamping on every event raised while impersonating;\n//   4. an explicit revocation path (revoking the impersonation must not log the real user out);\n//   5. a server-side hard duration cap from configuration — NOT a caller-supplied\n//      `durationMinutes`, and NOT a caller-supplied `auditLog` flag: an audit trail the actor can\n//      switch off is not an audit trail, which is why that field is not preserved here;\n//   6. notification to the impersonated user, not only to administrators;\n//   7. a forbidden-while-impersonating operation set (credential change, account deletion,\n//      API-key/token minting, and any further impersonation);\n//   8. an unmistakable frontend banner for the whole session.\n//\n// assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE · TODO(assurance-control) — privileged access\n// under another identity must be authorized, time-boxed, and attributable to the human actor.\n// See the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n//\n// ACCOUNT MERGE IS A MULTI-RESOURCE CAPABILITY — NOT AN UPDATE ON `users`.\n// `MERGE_ACCOUNTS` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ targetUserId, keepPrimaryUser, mergeProfile, mergePreferences,\n// mergeOrganizations, reason }` and promising a `{ mergedUser, removedUserId, mergedDataSummary }`\n// response, and was removed on 2026-08-01: it was ROUTED but never implemented. Not one request\n// field is a persisted `users` field, so the controller and repository strict parses left an empty\n// `$set` — nothing merged, nothing was removed, and the declared response could never be produced.\n//\n// It was removed rather than implemented because nothing asks for it AND the identity model\n// prevents the duplicate class it names:\n//   - `UserSchema.email` is the STRICT unique identity anchor — \"there is never more than one\n//     `User` per email\". All five provisioning paths (self-registration, org-admin invite, SSO JIT,\n//     SCIM, anonymous transposition) find-or-create by the normalized value; `.toLowerCase()`\n//     closes the casing fork and `.excludeFromUpdate()` keeps the anchor immutable.\n//   - The multi-provider case — one human, several IdPs — is already first-class via\n//     `USER_IDENTITY_LINKS` (many links per user, compound-unique per tenant connection).\n//     There is nothing to merge.\n//   - No duplicate-detection surface exists anywhere, so nothing could ever supply `targetUserId`.\n//     The verb had no consumer AND no producer.\n//\n// Do NOT re-declare it as an `UPDATE` on `users`. A merge is a transactional identity move across\n// every resource holding a `userId` FK (~21 engine schema/resource-config files declare one, plus\n// every app-defined resource the engine cannot enumerate), and the framework has no such primitive\n// today: the closest prior art, `AnonymousSessionBackendService.transposeOwnership()`, loops\n// resource types accumulating `failedTypes[]` and reports partial failure instead of rolling back.\n// The same problem in its EASIER form — a receiving identity with no competing state — was also\n// left undone: `ResourceTranspositionPolicy.MERGE` was declared vocabulary that no resource\n// selected and that warned \"not yet implemented — falling back to ADD\". It was REMOVED from the\n// enum on 2026-09-08 (#418) rather than implemented, on the same reasoning as this note: a merge\n// primitive is owed before either surface can offer one.\n//\n// Re-declaring requires, as one workstream:\n//   1. a duplicate-detection surface that produces merge candidates — without it the verb has no\n//      caller, which is how the removed declaration ended up unreachable;\n//   2. a cross-resource transaction via `resolveResourceOperationTransactionPersistenceContract`\n//      (`transactionalCore` + named `transactionParticipants`), NOT a per-resource loop that can\n//      half-apply and leave two partially-merged identities;\n//   3. an FK-graph walk reusing the subject-erasure traversal in `compliance/` rather than a\n//      re-derived inventory that silently misses app-defined resources;\n//   4. explicit conflict resolution for the 1:1 compositions (`USER_PROFILES`, `USER_PREFERENCES`\n//      are `.isUnique()` per user) and for two memberships in the same organization — the removed\n//      `mergeProfile` / `mergePreferences` / `mergeOrganizations` booleans named the axes but\n//      decided nothing;\n//   5. a settled, WRITTEN-DOWN answer for the losing user's audit history. It must NOT be silently\n//      rewritten: `auditable-events.shared.schema.ts` is the densest `userId` holder in the engine\n//      (32 occurrences), and re-pointing those rows would forge the record an auditor relies on;\n//   6. a dedicated auditable event for the merge itself — the removed operation emitted nothing at\n//      all. (Operation-level auditing now exists via risk-tiered `RESOURCE_OPERATION_PERFORMED`\n//      emission, so a reinstated merge verb would inherit a row from its declared risk level; it\n//      would still need its own event to name the two identities being consolidated.);\n//   7. a decision on the erasure interaction: a merged-away identity that was subject to retention\n//      must not resurrect scrubbed personal data through the surviving row.\n//\n// assurance-control: WILDO.IDENTITY.LIFECYCLE · TODO(assurance-control) — consolidating two\n// identities is a privileged identity-lifecycle change and must be authorized, attributable, and\n// non-destructive to the audit trail.\n// See the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\nexport enum Users_Operations {\n  ASSIGN_ROLES = 'assign_roles', // Assign application roles\n  REVOKE_ROLES = 'revoke_roles', // Revoke application roles\n  SUSPEND_USER = 'suspend_user', // Suspend user account\n  UNSUSPEND_USER = 'unsuspend_user', // Unsuspend user account\n  REACTIVATE_USER = 'reactivate_user', // Reactivate a SELF-deactivated account (INACTIVE → ACTIVE)\n  FORCE_PASSWORD_RESET = 'force_password_reset', // Force password reset\n  /**\n   * The audited see-through read of a RETAINED (erased-and-impersonalized) user row (#490).\n   *\n   * `retentionPolicy: RETAIN_AND_IMPERSONALIZE` keeps the row and scrubs its subject, and the M5a\n   * hide-predicate then makes it unreadable through every ordinary door — deliberately. The engine\n   * has held the audited way back in (`readRetainedAsSystem`) since that landed, and **nothing could\n   * reach it**: the primitive was referenced by the factory that derives its grant and by prose, and\n   * by no caller. So the only route to a retained record was a database console, which is the\n   * unaudited path the primitive exists to replace.\n   *\n   * This is that route. It is not a second read of the users table — it reveals personal data a\n   * retention policy deliberately made unreadable, which is why it is its own operation with its own\n   * role gate, its own mandatory justification and its own audit row.\n   */\n  READ_RETAINED = 'read_retained',\n}\n\ntype UsersCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\n/*\nUsers Resource Configuration Factory\n*/\nexport const usersResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof Users_Operations,\n  UsersCoreOperations,\n  typeof UserSchema\n>({\n  mainSchema: UserSchema,\n  resourceIdentifier: CoreResourceType.USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Users are app-scoped\n\n  /**\n   * `/users/{userId}` names the TARGET of an administrative action, never the caller.\n   *\n   * This resource's `resourceFieldIdentifier` is `userId` — the same key the W3.6 identity-coherence\n   * guard compares against the JWT subject. Without this declaration that guard read every\n   * `/users/{targetId}` request as \"the caller claims to be targetId\" and refused it with\n   * `403 authorization_user_id_mismatch`, which made the ENTIRE administrative surface unreachable\n   * cross-user: `assign_roles`, `revoke_roles`, `suspend_user`, `unsuspend_user`,\n   * `reactivate_user`, `force_password_reset`, the admin READ and the core UPDATE/DELETE. Every one of those is\n   * documented in the resource specification as acting on \"another user's record\" and is surfaced in\n   * the admin UI as a per-row action, so the framework contradicted itself.\n   *\n   * ⚠️ The SIBLING resource must keep the default. `USER_SELF` is a second configuration over the\n   * SAME collection and shares this exact field identifier (\"Same as USERS but different context\"),\n   * but there the segment genuinely names the caller — so it stays `true` and its horizontal-IDOR\n   * refusal keeps holding. The two are indistinguishable structurally, which is precisely why this\n   * is declared rather than inferred.\n   *\n   * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an administrative action on another principal\n   * is authorized by the caller's ROLE, not by the caller and the subject being the same person.\n   */\n  primaryKeyIdentifiesInitiator: false,\n\n  // create: org-admin invite eagerly provisions a `User{status: PENDING_INVITATION}`\n  // in-process (the invitee has no account yet). The API_CALL CREATE variant is\n  // APP_ADMIN_SUPER_ADMIN-gated AND manually omits `status`/`appRoles` from its DTO, so\n  // a plain create could neither be issued by the org admin nor persist the non-default\n  // status. Opt CREATE into the trusted `createAsSystem` path (fail-closed elsewhere):\n  // the synthesized super-admin context satisfies the ACL and `preserveServerInjectedFields`\n  // re-attaches `status` past the DTO strip. See organization-member-custom-implementation.\n  //\n  // read: the INBOUND_CONTACTS anonymous-CREATE lead-triage prefix\n  // (`inbound-contact-custom-implementation`) must look up a user by email from an\n  // ANONYMOUS context that cannot read USERS. It routes that request-triggered bypass\n  // through the sanctioned `readAsSystem` (fail-closed + `SYSTEM_CONTEXT_READ` audit)\n  // rather than a hand-built super-admin EC. The caller enforces its own boundary: it\n  // consumes ONLY `.status` and returns ONLY a `.isBackendOnly()` enum, so the full\n  // super-admin row never reaches the anonymous submitter (no enumeration oracle).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    read: ResourceSystemAccessMode.ALLOWED,\n    /**\n     * Trusted server-side ACTIVATION / DEACTIVATION of a user's lifecycle `status`.\n     *\n     * `status` is `.excludeFromUpdate()`, so the client-facing UPDATE contract cannot carry it and\n     * the lifecycle verbs (`suspend_user` / `unsuspend_user`) own the administrative transitions.\n     * But four trusted flows legitimately move `status` WITHOUT a caller — email verification\n     * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning\n     * (`→ INACTIVE`) — and none of them is a lifecycle verb: they are consequences of an\n     * out-of-band fact (a confirmed email, a directory row disappearing), not an operator decision\n     * with a reason and a state machine.\n     *\n     * `updateAsSystem` is the door for exactly that shape, and it re-attaches the excluded field\n     * past the strict request-DTO parse. Without this grant those writes are silently stripped and\n     * users simply never activate — no error, no signal.\n     */\n    update: ResourceSystemAccessMode.ALLOWED,\n    // `updateMany` + `seeRetained` are NOT authored here — `retentionPolicy` derives both, and\n    // authoring either as FORBIDDEN is a config error. Leave them to the factory.\n  },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the user row instead of deleting it: the retained financial\n   * records (invoices, usage) keep a resolvable foreign key, now pointing at an anonymized subject.\n   * `RETAIN_AND_IMPERSONALIZE` because this row DOES hold personal data of its own — `email` — which\n   * the scrub masks to `ERASED_USER_EMAIL`. A retained row is hidden from every normal read and\n   * frozen; only the audited `seeRetained` path can reach it.\n   *\n   * ⚠️ `USER_SELF` declares the SAME policy on purpose. It is a second resource config over the SAME\n   * `users` collection (see `getCollectionNameForResource` in the zod→mongoose convertor: separate\n   * models, one collection). Retention governance is per-config, so opting in only here would leave\n   * an erased row readable AND updatable through the USER_SELF door, and would put a PLAIN unique\n   * index on `email` alongside this one's retention-scoped index — which the second erasure would\n   * then collide with (E11000) and abort. The two configs must be changed together.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject IS this row: erasing user `X` ends the session of user `X`. Declaring it makes that\n   * revocation EXPLICIT — until now it happened only as a side effect of the retention row-hide (the\n   * auth fronts re-read the user, find the row hidden, and 401) plus the scrub bumping\n   * `authorizationVersion`. Neither is a written revocation, so the guarantee rested entirely on two\n   * unrelated mechanisms continuing to behave that way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  /**\n   * Subject-export disclosure. The operator-facing export subject.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.UPDATE_MANY,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: Users_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // ⚠️ DELIBERATELY NOT `admitsCrossSubjectUserAdministration`. This variant is gated\n          // `APP_USER`, so admitting cross-subject addressing here would let ANY authenticated user\n          // read ANY other user's row — `email`, `appRoles`, `status` — for every application built\n          // on the framework. Reading another user is the `admin` variant's job, directly below.\n          //\n          // The pre-existing comment on this line read \"v1: app users can view other users\", which\n          // the USER_SELF-scope authorization has never permitted (`authorizeUserSelf` requires the\n          // addressed row to BE the caller). The claim was aspirational, not behaviour — removed\n          // rather than acted on, because acting on it is a privacy decision for the product, not a\n          // side effect of fixing the administrative surface. If app users SHOULD be able to view\n          // each other, that wants its own decision, its own DTO narrowing (this variant returns the\n          // full row today) and its own probes.\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // THE administrative read. Gated `APP_ADMIN_VIEWER`, and the surface the admin UI's user\n          // list is built on — so it must be able to address someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          // Framework-internal LIST only — INTERNAL_CALL registers NO HTTP route, so\n          // this is never reachable by an app user (or anyone) over HTTP. It exists for\n          // internal enumeration (e.g. enrichment / labelling), invoked with a system\n          // execution context that carries APP_ADMIN_SUPER_ADMIN. `roles: []` is inert\n          // here precisely because it is not URL-bearing and role-gating is bypassed for\n          // internal execution — it is NOT \"any app user can list users\" (an empty roles\n          // array on a URL-bearing variant would be fail-closed → 403). App users do not\n          // get a global list-all; they READ a user (APP_USER) and enumerate via the\n          // org-scoped SEARCH people-picker below.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          // The ONLY HTTP-exposed LIST — admin-gated global user listing.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `email` is the only human-searchable field ON the user row. First/last\n          // name and display name live on `USER_PROFILES` (1:1, keyed by `userId`)\n          // and are MUTABLE there, so they are searched RELATIONALLY rather than\n          // denormalized: the framework searches `USER_PROFILES` (by its own\n          // searchable fields — firstName/lastName/displayName) and intersects the\n          // matching `userId`s with this resource's `_id`. (`username` was a phantom\n          // field — it exists on no user collection — and has been removed.) This\n          // powers the org-scoped \"people picker\" (e.g. a `createdByUserId` filter):\n          // the junction scope filter keeps results within the caller's org.\n          // See SearchableRelationDescriptor in resources-config.shared.schemas.ts.\n          searchableFields: [\n            'email',\n            {\n              localField: '_id',\n              relatedResource: CoreResourceType.USER_PROFILES,\n              relatedJoinField: 'userId',\n              // fields omitted → defaults to USER_PROFILES' own searchableFields\n              // (firstName, lastName, displayName).\n            },\n          ],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: USERS_ADMIN_FILTER_FIELDS,\n          sortFields: USERS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 200,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // DTOs auto-derived from decorators (excludeFromCreate on _id, createdAt, updatedAt).\n          //\n          // ⚠️ `status` and `appRoles` ARE part of this create contract. An earlier comment here\n          // claimed they were \"manually excluded\"; they never were — neither field carries\n          // `.excludeFromCreate()` and this variant declares no narrowing `requestDto`, so both are\n          // accepted (confirmed against the generated OpenAPI create schema). `appRoles` being\n          // caller-settable is exactly why this path carries an explicit role-ceiling gate — see\n          // `user-role-administration.custom-impl.backend.service.ts`. An absent `appRoles` falls\n          // back to the schema default and is NOT treated as a caller grant.\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, users manage themselves via USER_SELF\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // DTOs auto-derived from decorators. Only `appRoles` and `userTypes`\n          // remain writable: `_id`, `email`, `status`, `scheduledReactivationAt`\n          // and timestamps all carry `excludeFromUpdate()`.\n          //\n          // Because `appRoles` is caller-settable here, this path is\n          // the one that actually grants application authority, and it carries the role-ceiling gate\n          // plus a USER_APP_ROLES_CHANGED audit event (`user-role-administration.custom-impl`).\n          //\n          // This whole-array REPLACE is why the additive `assign_roles` / subtractive `revoke_roles`\n          // verbs are not redundant with it: reaching the same end-state here requires a\n          // read-modify-write that races with, and silently clobbers, a concurrent edit.\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          // The CAPABILITY without a new HTTP surface. `retentionPolicy` requires UPDATE_MANY because\n          // the impersonalize writer scrubs rows in place through `updateManyAsSystem`. Exposing a bulk\n          // user update over HTTP would be a genuinely dangerous admin surface (mass role/status\n          // rewrites), and INTERNAL_CALL registers NO route — like the LIST default above.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY. Both are route-less, but the three retention\n          // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n          // their operation through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL /\n          // API_CALL / API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is deliberately excluded there and served\n          // by the separate `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant here\n          // therefore satisfies the factory's \"UPDATE_MANY exists\" guard at boot and then FAILS TO RESOLVE\n          // when an erasure actually runs. `roles` is inert on a non-URL-bearing variant (role gating is\n          // bypassed for internal execution); the real gate is the derived `systemAccessPolicy.updateMany`\n          // grant, which the trusted writer is fail-closed on.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, critical risk\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // Irreversible identity destruction — the caller must prove they are still themselves,\n          // not merely that they held a session at some point. `riskLevel: CRITICAL` above does NOT\n          // do this: it drives danger-zone placement and typed confirmation in the UI and is read by\n          // no authorization code. Nor does the per-user-type `stepUpAuth` policy, which is opt-in,\n          // off by default and satisfied by any authentication newer than `maxAgeSeconds`.\n          //\n          // The audience is the reason this one is safe to gate first: `APP_ADMIN_SUPER_ADMIN` is an\n          // APPLICATION-level authority, whereas the population that provably cannot step up —\n          // directory-managed (SCIM) users, whose `passwordHash` and passkeys the framework\n          // deliberately destroys in `_reconcileLocalCredentialsForDirectoryManaged` — is\n          // ORGANIZATION-scoped by construction.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n          requiresStepUpAuthentication: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.ASSIGN_ROLES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // ADDITIVE grant. `roles` is the REQUEST contract; the custom implementation translates it\n          // into a union over the persisted `appRoles` array, gates it against the caller's own role\n          // ceiling, and emits USER_APP_ROLES_CHANGED. Before that implementation existed, `roles`\n          // named no schema path, so the generic core UPDATE persisted nothing and answered 200.\n          requestDto: z.object({\n            roles: z.array(AppRolesSchema).min(1).describe('The application roles to add to the account. Added to the roles it already holds; none is removed. Each must be within the caller\\'s own authority.'),\n            reason: z.string().max(500).optional().describe('Why the roles are being granted. Recorded on the audit trail, not on the account.')\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.REVOKE_ROLES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // SUBTRACTIVE revocation — a set difference against the persisted `appRoles`, never a blind\n          // overwrite. Ceiling-gated like the grant: an administrator who may not GRANT a role must\n          // not be able to STRIP it either, or the cheapest attack on a privileged account is to\n          // remove the authority of whoever could intervene.\n          requestDto: z.object({\n            roles: z.array(AppRolesSchema).min(1).describe('The application roles to remove from the account. Roles it does not hold are ignored; each must be within the caller\\'s own authority.'),\n            reason: z.string().max(500).optional().describe('Why the roles are being revoked. Recorded on the audit trail, not on the account.')\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.SUSPEND_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects access\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory. `suspensionDuration` is in DAYS\n          // and is resolved to an absolute `scheduledReactivationAt` at write time — a duration is\n          // meaningless without the moment it is counted from, and the row records no such moment.\n          requestDto: z.object({\n            reason: z.string().min(1).max(500)\n              .describe('Why the account is being suspended. Recorded with the audit event for the suspension.'),\n            suspensionDuration: z.number().min(1).optional() // Days\n              .describe('How many days the suspension lasts, counted from now. The account is reactivated automatically once it has elapsed. Omit it to suspend the account until an administrator lifts the suspension.'),\n            notifyUser: z.boolean().default(true).describe('Whether the account holder is emailed that their account was suspended. Defaults to true. The reason is not included in the email.')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectAccountStatusChangeSubject,\n          condition: administratorAskedToNotifySubject,\n          // The subject learns of the change to their own account even with email notifications\n          // switched off: a person who loses access has no other way to find out why they cannot\n          // sign in, and the administrator has already decided they should be told.\n          alwaysDeliver: true,\n        },\n      ]\n    },\n\n    [Users_Operations.UNSUSPEND_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, medium risk\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory (SUSPENDED → ACTIVE), which also\n          // clears any pending `scheduledReactivationAt` so a manual unsuspend does not leave the\n          // sweep's deadline behind for a later suspension to inherit.\n          //\n          // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this declaration the trail\n          // would record every suspension (HIGH) and none of the reinstatements — leaving an\n          // account that was suspended and cleared reading as still suspended.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n          requestDto: z.object({\n            reason: z.string().max(500).optional().describe('Why the suspension is lifted. Recorded on the audit trail, not on the account.'),\n            notifyUser: z.boolean().default(true).describe('Whether the account holder is emailed that the suspension was lifted. Defaults to true.')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.SUSPENDED;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectAccountStatusChangeSubject,\n          condition: administratorAskedToNotifySubject,\n          // The subject learns of the change to their own account even with email notifications\n          // switched off: a person who loses access has no other way to find out why they cannot\n          // sign in, and the administrator has already decided they should be told.\n          alwaysDeliver: true,\n        },\n      ]\n    },\n\n    /**\n     * The only door back from a SELF-deactivated account (#430).\n     *\n     * `user_self | deactivate_account` writes INACTIVE, and until this verb existed nothing could\n     * lift it: `REACTIVATE_ACCOUNT` needs a session, sign-in admits only ACTIVE users\n     * (`_enforceUserStatus` refuses every other status), `unsuspend_user` refuses INACTIVE BY\n     * DESIGN, and `status` is excluded from update. A person who deactivated their own account was\n     * out permanently, and the only route back was a database write.\n     *\n     * ADMIN-TIER, which is door 2 of the three that were on the table, and its two costs were\n     * accepted rather than discovered: every self-deactivated user becomes a support ticket, and an\n     * administrator can reactivate an account whose owner did not ask. The second is why `reason`\n     * is MANDATORY here while `unsuspend_user` leaves it optional — an administrator reversing\n     * someone else's own choice about their account owes an auditor a sentence, where lifting an\n     * administrative suspension is merely undoing an administrative act.\n     *\n     * INACTIVE ONLY. A SUSPENDED account stays `unsuspend_user`'s business: an imposed halt and a\n     * chosen departure are two states whose whole distinction is who may lift them, and widening\n     * one verb to cover both was the option rejected precisely because it erases that.\n     *\n     * Implemented by the shared status-transition factory — which is also what routes the write\n     * through the SYSTEM door. `status` is `.excludeFromUpdate()`, so a handler writing it directly\n     * is stripped by the repository's strict re-parse and the operation reports success having\n     * persisted nothing; that failure mode has already cost this repository four sibling\n     * activations (`.claude/rules/invariant-call-site-enumeration.md` #8).\n     *\n     * assurance-control: WILDO.IDENTITY.LIFECYCLE — reinstating a deactivated principal is a\n     * privileged identity-lifecycle change and must be authorized, attributable and audited.\n     */\n    [Users_Operations.REACTIVATE_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is\n          // still gated by `roles` above; this only admits the SUBJECT to be someone else.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this the trail would record\n          // the departure (DEACTIVATE_ACCOUNT) and not the return — an account reinstated by an\n          // administrator reading as still deactivated. Same reasoning as `unsuspend_user`.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n          requestDto: z.object({\n            // MANDATORY, unlike `unsuspend_user`'s: see the JSDoc above.\n            reason: z.string().min(1).max(500).describe('Why the account is reactivated. Required, and recorded on the audit trail, not on the account.'),\n            notifyUser: z.boolean().default(true).describe('Whether the account holder is emailed that their account was reactivated. Defaults to true.'),\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.INACTIVE;\n          },\n        },\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectAccountStatusChangeSubject,\n          condition: administratorAskedToNotifySubject,\n          // The subject learns of the change to their own account even with email notifications\n          // switched off: a person who loses access has no other way to find out why they cannot\n          // sign in, and the administrator has already decided they should be told.\n          alwaysDeliver: true,\n        },\n      ],\n    },\n\n    /**\n     * Administrator-compelled credential reset.\n     *\n     * Implemented by `createUserForcePasswordResetFactories`, which mints a single-use\n     * PASSWORD_RESET token for the target, mails the reset link to the TARGET, revokes the\n     * target's live sessions, and emits `USER_PASSWORD_RESET_FORCED` naming the acting\n     * administrator and their reason.\n     *\n     * Three fields the original declaration carried are deliberately gone:\n     *\n     *  - **`customResponseDto: { resetToken, resetUrl }`** — an account-takeover primitive. An\n     *    administrator holding the link can set the user's password and then authenticate AS\n     *    them; with no actor claim on a session JWT, nothing downstream could tell that apart\n     *    from a genuine login, and the owner would never be told. The link now goes only to the\n     *    account owner's inbox, and the response carries non-secret metadata.\n     *  - **`resetExpirationHours` (1–168)** — a caller-widenable credential-recovery window is a\n     *    persistence mechanism, not a recovery one. The TTL is now a framework policy constant.\n     *  - **`notifyUser`** — notifying the owner is the MECHANISM (the mail carries the only copy\n     *    of the link), not an option an operator can decline.\n     *\n     * `reason` stays and is mandatory: it is what an auditor reads when asking why a credential\n     * was reset out-of-band.\n     *\n     * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n     * intervention is authorized, attributable, justified, and evicts existing access.\n     */\n    /**\n     * See-through read of a retained subject (#490).\n     *\n     * ## Why it is UPDATE-like, when it plainly reads\n     *\n     * Same reasoning the webhook `testEndpoint` probe records, and for a sharper reason. Borrowing\n     * READ yields a GET, and a GET carries its parameters in the URL — which would put the operator's\n     * free-text `reason` into every access log, proxy log and browser history between here and the\n     * server. A justification for revealing scrubbed personal data routinely NAMES someone: a\n     * dispute, a legal hold, a subject. Putting it in a query string is a privacy defect, not an\n     * inconvenience.\n     *\n     * The operation also has a real side effect — every call emits a `RETAINED_DATA_ACCESS` audit row\n     * — so `x-idempotent` would have had to be false on a GET, which is the self-contradiction that\n     * argument already produced once.\n     *\n     * ## Why `reason` is in the DTO and the caller's identity is NOT\n     *\n     * `accessingUserId` and `accessingUserRoles` reach the primitive from the EXECUTION CONTEXT, never\n     * from the request. A body-supplied identity is a claim the caller writes about themselves, and\n     * the entire value of the audit row is that it says who really looked. `reason` is the one thing\n     * only the human can supply, so it is the one thing the request carries.\n     *\n     * `admitsCrossSubjectUserAdministration` is declared because the subject is by definition someone\n     * else: a retained row belongs to an erased person, and the caller is an administrator. The\n     * `roles` gate above still decides WHO may call it.\n     */\n    [Users_Operations.READ_RETAINED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          admitsCrossSubjectUserAdministration: true,\n          // The highest risk level the vocabulary has, and it is not decoration: this is the only\n          // operation in the resource that reveals personal data an erasure was performed to remove.\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            /**\n             * Why this reveal is happening — a legal hold, a dispute, an investigation.\n             *\n             * Required, and the length floor is enforced twice on purpose: here, so the request is\n             * refused before anything is read, and again inside `readRetainedAsSystem`, which\n             * fail-closes on a blank attribution because the audit store persists `eventData`\n             * unparsed. A reveal with no reason is an anonymous reveal.\n             */\n            reason: z.string().trim().min(1).max(500)\n              .describe('Why the personal detail an erasure removed is being revealed, such as a legal hold, a dispute or an investigation. Required, and recorded on the audit trail with the reveal.'),\n          }),\n        }\n      ],\n    },\n\n    [Users_Operations.FORCE_PASSWORD_RESET]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects authentication\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            reason: z.string().min(1).max(500).describe('Why the password reset is forced. Required, and recorded on the audit trail, not on the account.')\n          }),\n          customResponseDto: z.object({\n            /** When the emailed reset link stops working. Non-secret — the link itself is not returned. */\n            expiresAt: z.date().describe('When the reset link emailed to the account holder stops working. The link itself is not returned.'),\n            /** Always true today; explicit so the caller can see the eviction happened. */\n            sessionsRevoked: z.boolean().describe('Whether the account\\'s sessions were signed out. Always true: a forced reset signs the account out everywhere.')\n          }),\n          // A deleted identity has no credential path worth resetting; the service rejects it\n          // with a 409. Hides the roster action rather than letting it 409 on click.\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status !== UserStatus.DELETED;\n          }\n        }\n      ],\n      // The ADMIN-AUDIT copy. The user-facing reset mail is the system PASSWORD_RESET template\n      // dispatched by the auth service when the token is minted — deliberately not duplicated\n      // into this resource-operation fan-out, which would create a second reset email that can\n      // drift from the one the self-service flow sends.\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n  },\n});\n"]}
+{"version":3,"file":"users.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,UAAU,EACV,UAAU,EAEX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAA8C,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAExH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,oGAAoG;AACpG,sGAAsG;AACtG,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAU,CAAC;AAEvE,oCAAoC;AACpC,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,oGAAoG;IACpG,iGAAiG;IACjG,gGAAgG;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;CAC/D,CAAC;AAEF,qEAAqE;AACrE,MAAM,yBAAyB,GAAG;IAChC,GAAG,mBAAmB;IACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,uBAAuB,GAAG,CAAC,GAAG,iBAAiB,EAAE,QAAQ,CAAU,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,gCAAgC,GAAG,CAAC,EAAE,aAAa,EAA2D,EAAY,EAAE,CAChI,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,iCAAiC,GAAG,CAAC,EAAE,QAAQ,EAAyB,EAAW,EAAE,CACxF,QAAiD,EAAE,UAAU,KAAK,KAAK,CAAC;AAE3E,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,+FAA+F;AAC/F,gGAAgG;AAChG,uFAAuF;AACvF,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,iFAAiF;AACjF,EAAE;AACF,4CAA4C;AAC5C,gGAAgG;AAChG,qFAAqF;AACrF,8FAA8F;AAC9F,iGAAiG;AACjG,sEAAsE;AACtE,gGAAgG;AAChG,kFAAkF;AAClF,kGAAkG;AAClG,wFAAwF;AACxF,0EAA0E;AAC1E,2FAA2F;AAC3F,8DAA8D;AAC9D,8DAA8D;AAC9D,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,uEAAuE;AACvE,EAAE;AACF,2EAA2E;AAC3E,+FAA+F;AAC/F,qFAAqF;AACrF,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,mGAAmG;AACnG,EAAE;AACF,4FAA4F;AAC5F,yCAAyC;AACzC,8FAA8F;AAC9F,oGAAoG;AACpG,8FAA8F;AAC9F,oFAAoF;AACpF,qFAAqF;AACrF,0FAA0F;AAC1F,iCAAiC;AACjC,mGAAmG;AACnG,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,mGAAmG;AACnG,6FAA6F;AAC7F,mGAAmG;AACnG,gGAAgG;AAChG,4FAA4F;AAC5F,gGAAgG;AAChG,iGAAiG;AACjG,yDAAyD;AACzD,EAAE;AACF,4CAA4C;AAC5C,iGAAiG;AACjG,0EAA0E;AAC1E,iGAAiG;AACjG,iGAAiG;AACjG,6DAA6D;AAC7D,6FAA6F;AAC7F,wEAAwE;AACxE,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,wBAAwB;AACxB,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,uFAAuF;AACvF,mGAAmG;AACnG,4EAA4E;AAC5E,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,sCAAsC;AACtC,uEAAuE;AACvE,MAAM,CAAN,IAAY,gBAsBX;AAtBD,WAAY,gBAAgB;IAC1B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;IACnC,iEAA6C,CAAA;IAC7C;;;;;;;;;;;;;OAaG;IACH,mDAA+B,CAAA;AACjC,CAAC,EAtBW,gBAAgB,KAAhB,gBAAgB,QAsB3B;AAWD;;EAEE;AACF,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5J;IACA,UAAU,EAAE,UAAU;IACtB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;IAC1C,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACnF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,uBAAuB;IAE/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,6BAA6B,EAAE,KAAK;IAEpC,mFAAmF;IACnF,8EAA8E;IAC9E,sFAAsF;IACtF,sFAAsF;IACtF,qFAAqF;IACrF,2FAA2F;IAC3F,0FAA0F;IAC1F,EAAE;IACF,iEAAiE;IACjE,iFAAiF;IACjF,oFAAoF;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,kFAAkF;IAClF,iFAAiF;IACjF,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC;;;;;;;;;;;;;;WAcG;QACH,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,2FAA2F;QAC3F,8EAA8E;KAC/E;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;;;;OAMG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE;IAEnE;;OAEG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,gBAAgB;IAEjC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oFAAoF;oBACpF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,uFAAuF;oBACvF,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,uFAAuF;oBACvF,0FAA0F;oBAC1F,wFAAwF;oBACxF,2FAA2F;oBAC3F,sCAAsC;iBACvC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,yFAAyF;oBACzF,kFAAkF;oBAClF,oCAAoC,EAAE,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,2EAA2E;oBAC3E,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,+EAA+E;oBAC/E,2EAA2E;oBAC3E,yCAAyC;oBACzC,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,gEAAgE;oBAChE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBACxC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,yEAAyE;oBACzE,yEAAyE;oBACzE,uEAAuE;oBACvE,mEAAmE;oBACnE,yEAAyE;oBACzE,2EAA2E;oBAC3E,wEAAwE;oBACxE,2EAA2E;oBAC3E,mEAAmE;oBACnE,0EAA0E;oBAC1E,gBAAgB,EAAE;wBAChB,OAAO;wBACP;4BACE,UAAU,EAAE,KAAK;4BACjB,eAAe,EAAE,gBAAgB,CAAC,aAAa;4BAC/C,gBAAgB,EAAE,QAAQ;4BAC1B,mEAAmE;4BACnE,sCAAsC;yBACvC;qBACF;oBACD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,yBAAyB;oBACvC,UAAU,EAAE,uBAAuB;oBACnC,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,EAAE;oBACF,uFAAuF;oBACvF,iFAAiF;oBACjF,0FAA0F;oBAC1F,qFAAqF;oBACrF,uFAAuF;oBACvF,wFAAwF;oBACxF,mEAAmE;iBACpE;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wDAAwD;oBACvG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qEAAqE;oBACrE,uEAAuE;oBACvE,kDAAkD;oBAClD,EAAE;oBACF,2DAA2D;oBAC3D,2FAA2F;oBAC3F,sFAAsF;oBACtF,EAAE;oBACF,2FAA2F;oBAC3F,+EAA+E;oBAC/E,+EAA+E;iBAChF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,4FAA4F;oBAC5F,8FAA8F;oBAC9F,uFAAuF;oBACvF,iFAAiF;oBACjF,EAAE;oBACF,wFAAwF;oBACxF,4FAA4F;oBAC5F,+FAA+F;oBAC/F,gGAAgG;oBAChG,gGAAgG;oBAChG,iGAAiG;oBACjG,+FAA+F;oBAC/F,iGAAiG;oBACjG,qDAAqD;oBACrD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gCAAgC;oBAC/E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,2FAA2F;oBAC3F,qFAAqF;oBACrF,kFAAkF;oBAClF,gFAAgF;oBAChF,uCAAuC;oBACvC,EAAE;oBACF,4GAA4G;oBAC5G,4BAA4B,EAAE,IAAI;iBACnC;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,2FAA2F;oBAC3F,2FAA2F;oBAC3F,yFAAyF;oBACzF,uFAAuF;oBACvF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qJAAqJ,CAAC;wBACrM,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBACrI,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,kDAAkD;oBACjG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4FAA4F;oBAC5F,0FAA0F;oBAC1F,uFAAuF;oBACvF,mDAAmD;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wIAAwI,CAAC;wBACxL,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBACrI,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAC/B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,6CAA6C;oBAC5F,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,yFAAyF;oBACzF,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;6BAC/B,QAAQ,CAAC,uFAAuF,CAAC;wBACpG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO;6BACrD,QAAQ,CAAC,iMAAiM,CAAC;wBAC9M,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oIAAoI,CAAC;qBACrL,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;oBACpD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,gCAAgC;oBACjD,SAAS,EAAE,iCAAiC;oBAC5C,sFAAsF;oBACtF,uFAAuF;oBACvF,0EAA0E;oBAC1E,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;YACjC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,8BAA8B;oBAC7E,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,sFAAsF;oBACtF,mFAAmF;oBACnF,qEAAqE;oBACrE,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;wBACjI,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,yFAAyF,CAAC;qBAC1I,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC;oBACvD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,gCAAgC;oBACjD,SAAS,EAAE,iCAAiC;oBAC5C,sFAAsF;oBACtF,uFAAuF;oBACvF,0EAA0E;oBAC1E,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BG;QACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,uFAAuF;oBACvF,iFAAiF;oBACjF,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uFAAuF;oBACvF,sFAAsF;oBACtF,kFAAkF;oBAClF,qDAAqD;oBACrD,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,6DAA6D;wBAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gGAAgG,CAAC;wBAC7I,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,6FAA6F,CAAC;qBAC9I,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,YAAY;oBAC/C,OAAO,EAAE,2BAA2B,CAAC,KAAK;oBAC1C,eAAe,EAAE,gCAAgC;oBACjD,SAAS,EAAE,iCAAiC;oBAC5C,sFAAsF;oBACtF,uFAAuF;oBACvF,0EAA0E;oBAC1E,aAAa,EAAE,IAAI;iBACpB;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH;;;;;;;;;;;;;;;;;;;;;;;;;;WA0BG;QACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE;YAChC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,oCAAoC,EAAE,IAAI;oBAC1C,wFAAwF;oBACxF,2FAA2F;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB;;;;;;;2BAOG;wBACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;6BACtC,QAAQ,CAAC,+KAA+K,CAAC;qBAC7L,CAAC;iBACH;aACF;SACF;QAED,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qDAAqD;oBACpG,6FAA6F;oBAC7F,4FAA4F;oBAC5F,oCAAoC,EAAE,IAAI;oBAC1C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,kGAAkG,CAAC;qBAChJ,CAAC;oBACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,+FAA+F;wBAC/F,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,mGAAmG,CAAC;wBACjI,+EAA+E;wBAC/E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,gHAAgH,CAAC;qBACxJ,CAAC;oBACF,oFAAoF;oBACpF,2EAA2E;oBAC3E,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;oBACrD,CAAC;iBACF;aACF;YACD,yFAAyF;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,kDAAkD;YAClD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KAEF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Users Shared Resource Configuration\n *\n * Resource configuration for administrative user management operations.\n * Handles user lifecycle, role management, and administrative actions.\n */\n\nimport { z } from 'zod';\nimport {\n  UserSchema,\n  UserStatus,\n  UserTheme\n} from './users.shared.schemas';\nimport { AppRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\n// Sort and filter fields for user management. `joinedAt` was listed in both and is not a field of a\n// user (#1806) — the row records `createdAt` — so sorting or filtering by it did nothing. The factory\n// now refuses a collection field that is not a field.\nconst USERS_SORT_FIELDS = ['createdAt', 'updatedAt', 'email'] as const;\n\n// App users get basic filter fields\nconst USERS_FILTER_FIELDS = {\n  status: z.enum(UserStatus),\n  email: z.string(),\n  // By id — how a REFERENCE to a user is labelled from inside an organization (#1661). The users READ\n  // lets a user read only themselves, so the label of an assignee or owner is resolved through the\n  // org-scoped people search (`/organizations/{org}/users/search`), filtered to that one id. That\n  // route is already confined to the organization's members, so filtering it narrows what it returns\n  // and exposes nothing new. The filter panel never offers `_id` (`parseFilterFieldDefinitions`).\n  _id: z.string().describe('Only return the user with this id.'),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst USERS_ADMIN_FILTER_FIELDS = {\n  ...USERS_FILTER_FIELDS,\n  createdAt: z.date(), // Admin can filter by creation date\n  updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst USERS_ADMIN_SORT_FIELDS = [...USERS_SORT_FIELDS, 'status'] as const;\n\n/**\n * The recipient of an administrative account-status notice: the user whose status changed (#1807).\n *\n * `USERS_CUSTOM` rather than `USER_SELF`, and the difference is the whole defect: `USER_SELF` is the\n * INITIATOR — here the administrator — so a \"your account was suspended\" email aimed at it lands in\n * the administrator's inbox. The row the operation just wrote IS the subject, so its `_id` is the\n * only recipient.\n */\nconst selectAccountStatusChangeSubject = ({ currentObject }: { currentObject: { _id?: unknown } | null | undefined }): string[] =>\n  currentObject?._id ? [String(currentObject._id)] : [];\n\n/**\n * Whether the administrator asked for the subject to be told (#1807).\n *\n * `suspend_user`, `unsuspend_user` and `reactivate_user` have always accepted `notifyUser` and nothing\n * read it, so every value — including the default `true` — sent the subject nothing. `!== false`\n * rather than a truthy test because the field carries `.default(true)`: an omitted value must notify.\n * That includes the suspension sweep, which lifts an elapsed suspension by calling `unsuspend_user`\n * with an empty body — a person whose access comes back on its own is told so, which is the point.\n *\n * Same shape as `organizations | suspend`'s `notifyMembers`, which a quiet suspension (a fraud hold\n * the operator does not want to tip off) is the reason for having at all.\n */\nconst administratorAskedToNotifySubject = ({ inputDto }: { inputDto: unknown }): boolean =>\n  (inputDto as { notifyUser?: boolean } | undefined)?.notifyUser !== false;\n\n// Custom operations enum for user management\n//\n// Invitation is intentionally absent. Organization invitations are created by\n// the organization-members lifecycle, where the pending membership, invitee\n// identity, token and email are produced together. A previous `send_invitation`\n// users operation declared an invitation-receipt DTO but registered no backend\n// implementation capable of producing it. Reintroduce an application-wide\n// invitation operation only with a real lifecycle owner and handler; an\n// API_CALL declaration by itself is not an implementation.\n//\n// IMPERSONATION IS NOT A TOKEN MINT — IT IS AN IDENTITY SUBSTRATE THE FRAMEWORK DOES NOT HAVE.\n// `IMPERSONATE` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ reason, durationMinutes, auditLog }` and promising a\n// `{ impersonationToken, expiresAt, auditId }` response, and was removed on 2026-08-01: it was\n// ROUTED but never implemented. With `resourceOperationLike: READ` the generic core path simply\n// returned the target's user row, so the most dangerous verb in the catalogue answered\n// **HTTP 200** — an operator is told an impersonation session exists when none does.\n//\n// Do NOT re-declare it as a plain token mint. A minted session JWT is today byte-for-byte\n// indistinguishable from a genuine one: the payload is `{…, sub: userId, aud: 'AUTH_TOKEN' }`\n// with NO actor claim, and `ExecutionContext` has no \"acting as\" dimension. Every audit event\n// raised during such a session would be attributed to the impersonated USER rather than the\n// administrator — the framework would manufacture false attribution in exactly the records an\n// auditor relies on. That is strictly worse than having no impersonation at all.\n//\n// Re-declaring requires, as one workstream:\n//   1. an actor claim on the session JWT (RFC 8693 `act`-style: `sub` = target, actor = admin),\n//      minted through a dedicated path — never by reusing the ordinary login issuer;\n//   2. `ExecutionContext` propagation of that actor, so it reaches every downstream consumer;\n//   3. actor-attributed audit events — a new `CoreAuditableEventType` pair for session start/end\n//      plus actor stamping on every event raised while impersonating;\n//   4. an explicit revocation path (revoking the impersonation must not log the real user out);\n//   5. a server-side hard duration cap from configuration — NOT a caller-supplied\n//      `durationMinutes`, and NOT a caller-supplied `auditLog` flag: an audit trail the actor can\n//      switch off is not an audit trail, which is why that field is not preserved here;\n//   6. notification to the impersonated user, not only to administrators;\n//   7. a forbidden-while-impersonating operation set (credential change, account deletion,\n//      API-key/token minting, and any further impersonation);\n//   8. an unmistakable frontend banner for the whole session.\n//\n// assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE · TODO(assurance-control) — privileged access\n// under another identity must be authorized, time-boxed, and attributable to the human actor.\n// See the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\n//\n// ACCOUNT MERGE IS A MULTI-RESOURCE CAPABILITY — NOT AN UPDATE ON `users`.\n// `MERGE_ACCOUNTS` was declared here as an `APP_ADMIN_SUPER_ADMIN`-gated `riskLevel: CRITICAL`\n// operation taking `{ targetUserId, keepPrimaryUser, mergeProfile, mergePreferences,\n// mergeOrganizations, reason }` and promising a `{ mergedUser, removedUserId, mergedDataSummary }`\n// response, and was removed on 2026-08-01: it was ROUTED but never implemented. Not one request\n// field is a persisted `users` field, so the controller and repository strict parses left an empty\n// `$set` — nothing merged, nothing was removed, and the declared response could never be produced.\n//\n// It was removed rather than implemented because nothing asks for it AND the identity model\n// prevents the duplicate class it names:\n//   - `UserSchema.email` is the STRICT unique identity anchor — \"there is never more than one\n//     `User` per email\". All five provisioning paths (self-registration, org-admin invite, SSO JIT,\n//     SCIM, anonymous transposition) find-or-create by the normalized value; `.toLowerCase()`\n//     closes the casing fork and `.excludeFromUpdate()` keeps the anchor immutable.\n//   - The multi-provider case — one human, several IdPs — is already first-class via\n//     `USER_IDENTITY_LINKS` (many links per user, compound-unique per tenant connection).\n//     There is nothing to merge.\n//   - No duplicate-detection surface exists anywhere, so nothing could ever supply `targetUserId`.\n//     The verb had no consumer AND no producer.\n//\n// Do NOT re-declare it as an `UPDATE` on `users`. A merge is a transactional identity move across\n// every resource holding a `userId` FK (~21 engine schema/resource-config files declare one, plus\n// every app-defined resource the engine cannot enumerate), and the framework has no such primitive\n// today: the closest prior art, `AnonymousSessionBackendService.transposeOwnership()`, loops\n// resource types accumulating `failedTypes[]` and reports partial failure instead of rolling back.\n// The same problem in its EASIER form — a receiving identity with no competing state — was also\n// left undone: `ResourceTranspositionPolicy.MERGE` was declared vocabulary that no resource\n// selected and that warned \"not yet implemented — falling back to ADD\". It was REMOVED from the\n// enum on 2026-09-08 (#418) rather than implemented, on the same reasoning as this note: a merge\n// primitive is owed before either surface can offer one.\n//\n// Re-declaring requires, as one workstream:\n//   1. a duplicate-detection surface that produces merge candidates — without it the verb has no\n//      caller, which is how the removed declaration ended up unreachable;\n//   2. a cross-resource transaction via `resolveResourceOperationTransactionPersistenceContract`\n//      (`transactionalCore` + named `transactionParticipants`), NOT a per-resource loop that can\n//      half-apply and leave two partially-merged identities;\n//   3. an FK-graph walk reusing the subject-erasure traversal in `compliance/` rather than a\n//      re-derived inventory that silently misses app-defined resources;\n//   4. explicit conflict resolution for the 1:1 compositions (`USER_PROFILES`, `USER_PREFERENCES`\n//      are `.isUnique()` per user) and for two memberships in the same organization — the removed\n//      `mergeProfile` / `mergePreferences` / `mergeOrganizations` booleans named the axes but\n//      decided nothing;\n//   5. a settled, WRITTEN-DOWN answer for the losing user's audit history. It must NOT be silently\n//      rewritten: `auditable-events.shared.schema.ts` is the densest `userId` holder in the engine\n//      (32 occurrences), and re-pointing those rows would forge the record an auditor relies on;\n//   6. a dedicated auditable event for the merge itself — the removed operation emitted nothing at\n//      all. (Operation-level auditing now exists via risk-tiered `RESOURCE_OPERATION_PERFORMED`\n//      emission, so a reinstated merge verb would inherit a row from its declared risk level; it\n//      would still need its own event to name the two identities being consolidated.);\n//   7. a decision on the erasure interaction: a merged-away identity that was subject to retention\n//      must not resurrect scrubbed personal data through the surviving row.\n//\n// assurance-control: WILDO.IDENTITY.LIFECYCLE · TODO(assurance-control) — consolidating two\n// identities is a privileged identity-lifecycle change and must be authorized, attributable, and\n// non-destructive to the audit trail.\n// See the 2026-08-01 routed-but-unimplemented operation sweep (#1275).\nexport enum Users_Operations {\n  ASSIGN_ROLES = 'assign_roles', // Assign application roles\n  REVOKE_ROLES = 'revoke_roles', // Revoke application roles\n  SUSPEND_USER = 'suspend_user', // Suspend user account\n  UNSUSPEND_USER = 'unsuspend_user', // Unsuspend user account\n  REACTIVATE_USER = 'reactivate_user', // Reactivate a SELF-deactivated account (INACTIVE → ACTIVE)\n  FORCE_PASSWORD_RESET = 'force_password_reset', // Force password reset\n  /**\n   * The audited see-through read of a RETAINED (erased-and-impersonalized) user row (#490).\n   *\n   * `retentionPolicy: RETAIN_AND_IMPERSONALIZE` keeps the row and scrubs its subject, and the M5a\n   * hide-predicate then makes it unreadable through every ordinary door — deliberately. The engine\n   * has held the audited way back in (`readRetainedAsSystem`) since that landed, and **nothing could\n   * reach it**: the primitive was referenced by the factory that derives its grant and by prose, and\n   * by no caller. So the only route to a retained record was a database console, which is the\n   * unaudited path the primitive exists to replace.\n   *\n   * This is that route. It is not a second read of the users table — it reveals personal data a\n   * retention policy deliberately made unreadable, which is why it is its own operation with its own\n   * role gate, its own mandatory justification and its own audit row.\n   */\n  READ_RETAINED = 'read_retained',\n}\n\ntype UsersCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\n/*\nUsers Resource Configuration Factory\n*/\nexport const usersResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof Users_Operations,\n  UsersCoreOperations,\n  typeof UserSchema\n>({\n  mainSchema: UserSchema,\n  resourceIdentifier: CoreResourceType.USERS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USERS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Users are app-scoped\n\n  /**\n   * `/users/{userId}` names the TARGET of an administrative action, never the caller.\n   *\n   * This resource's `resourceFieldIdentifier` is `userId` — the same key the W3.6 identity-coherence\n   * guard compares against the JWT subject. Without this declaration that guard read every\n   * `/users/{targetId}` request as \"the caller claims to be targetId\" and refused it with\n   * `403 authorization_user_id_mismatch`, which made the ENTIRE administrative surface unreachable\n   * cross-user: `assign_roles`, `revoke_roles`, `suspend_user`, `unsuspend_user`,\n   * `reactivate_user`, `force_password_reset`, the admin READ and the core UPDATE/DELETE. Every one of those is\n   * documented in the resource specification as acting on \"another user's record\" and is surfaced in\n   * the admin UI as a per-row action, so the framework contradicted itself.\n   *\n   * ⚠️ The SIBLING resource must keep the default. `USER_SELF` is a second configuration over the\n   * SAME collection and shares this exact field identifier (\"Same as USERS but different context\"),\n   * but there the segment genuinely names the caller — so it stays `true` and its horizontal-IDOR\n   * refusal keeps holding. The two are indistinguishable structurally, which is precisely why this\n   * is declared rather than inferred.\n   *\n   * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an administrative action on another principal\n   * is authorized by the caller's ROLE, not by the caller and the subject being the same person.\n   */\n  primaryKeyIdentifiesInitiator: false,\n\n  // create: org-admin invite eagerly provisions a `User{status: PENDING_INVITATION}`\n  // in-process (the invitee has no account yet). The API_CALL CREATE variant is\n  // APP_ADMIN_SUPER_ADMIN-gated AND manually omits `status`/`appRoles` from its DTO, so\n  // a plain create could neither be issued by the org admin nor persist the non-default\n  // status. Opt CREATE into the trusted `createAsSystem` path (fail-closed elsewhere):\n  // the synthesized super-admin context satisfies the ACL and `preserveServerInjectedFields`\n  // re-attaches `status` past the DTO strip. See organization-member-custom-implementation.\n  //\n  // read: the INBOUND_CONTACTS anonymous-CREATE lead-triage prefix\n  // (`inbound-contact-custom-implementation`) must look up a user by email from an\n  // ANONYMOUS context that cannot read USERS. It routes that request-triggered bypass\n  // through the sanctioned `readAsSystem` (fail-closed + `SYSTEM_CONTEXT_READ` audit)\n  // rather than a hand-built super-admin EC. The caller enforces its own boundary: it\n  // consumes ONLY `.status` and returns ONLY a `.isBackendOnly()` enum, so the full\n  // super-admin row never reaches the anonymous submitter (no enumeration oracle).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    read: ResourceSystemAccessMode.ALLOWED,\n    /**\n     * Trusted server-side ACTIVATION / DEACTIVATION of a user's lifecycle `status`.\n     *\n     * `status` is `.excludeFromUpdate()`, so the client-facing UPDATE contract cannot carry it and\n     * the lifecycle verbs (`suspend_user` / `unsuspend_user`) own the administrative transitions.\n     * But four trusted flows legitimately move `status` WITHOUT a caller — email verification\n     * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning\n     * (`→ INACTIVE`) — and none of them is a lifecycle verb: they are consequences of an\n     * out-of-band fact (a confirmed email, a directory row disappearing), not an operator decision\n     * with a reason and a state machine.\n     *\n     * `updateAsSystem` is the door for exactly that shape, and it re-attaches the excluded field\n     * past the strict request-DTO parse. Without this grant those writes are silently stripped and\n     * users simply never activate — no error, no signal.\n     */\n    update: ResourceSystemAccessMode.ALLOWED,\n    // `updateMany` + `seeRetained` are NOT authored here — `retentionPolicy` derives both, and\n    // authoring either as FORBIDDEN is a config error. Leave them to the factory.\n  },\n\n  /**\n   * Subject erasure scrubs-and-RETAINS the user row instead of deleting it: the retained financial\n   * records (invoices, usage) keep a resolvable foreign key, now pointing at an anonymized subject.\n   * `RETAIN_AND_IMPERSONALIZE` because this row DOES hold personal data of its own — `email` — which\n   * the scrub masks to `ERASED_USER_EMAIL`. A retained row is hidden from every normal read and\n   * frozen; only the audited `seeRetained` path can reach it.\n   *\n   * ⚠️ `USER_SELF` declares the SAME policy on purpose. It is a second resource config over the SAME\n   * `users` collection (see `getCollectionNameForResource` in the zod→mongoose convertor: separate\n   * models, one collection). Retention governance is per-config, so opting in only here would leave\n   * an erased row readable AND updatable through the USER_SELF door, and would put a PLAIN unique\n   * index on `email` alongside this one's retention-scoped index — which the second erasure would\n   * then collide with (E11000) and abort. The two configs must be changed together.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * The subject IS this row: erasing user `X` ends the session of user `X`. Declaring it makes that\n   * revocation EXPLICIT — until now it happened only as a side effect of the retention row-hide (the\n   * auth fronts re-read the user, find the row hidden, and 401) plus the scrub bumping\n   * `authorizationVersion`. Neither is a written revocation, so the guarantee rested entirely on two\n   * unrelated mechanisms continuing to behave that way.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.SELF_PRINCIPAL },\n\n  /**\n   * Subject-export disclosure. The operator-facing export subject.\n   */\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.UPDATE_MANY,\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: Users_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // ⚠️ DELIBERATELY NOT `admitsCrossSubjectUserAdministration`. This variant is gated\n          // `APP_USER`, so admitting cross-subject addressing here would let ANY authenticated user\n          // read ANY other user's row — `email`, `appRoles`, `status` — for every application built\n          // on the framework. Reading another user is the `admin` variant's job, directly below.\n          //\n          // The pre-existing comment on this line read \"v1: app users can view other users\", which\n          // the USER_SELF-scope authorization has never permitted (`authorizeUserSelf` requires the\n          // addressed row to BE the caller). The claim was aspirational, not behaviour — removed\n          // rather than acted on, because acting on it is a privacy decision for the product, not a\n          // side effect of fixing the administrative surface. If app users SHOULD be able to view\n          // each other, that wants its own decision, its own DTO narrowing (this variant returns the\n          // full row today) and its own probes.\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // THE administrative read. Gated `APP_ADMIN_VIEWER`, and the surface the admin UI's user\n          // list is built on — so it must be able to address someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          // Framework-internal LIST only — INTERNAL_CALL registers NO HTTP route, so\n          // this is never reachable by an app user (or anyone) over HTTP. It exists for\n          // internal enumeration (e.g. enrichment / labelling), invoked with a system\n          // execution context that carries APP_ADMIN_SUPER_ADMIN. `roles: []` is inert\n          // here precisely because it is not URL-bearing and role-gating is bypassed for\n          // internal execution — it is NOT \"any app user can list users\" (an empty roles\n          // array on a URL-bearing variant would be fail-closed → 403). App users do not\n          // get a global list-all; they READ a user (APP_USER) and enumerate via the\n          // org-scoped SEARCH people-picker below.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          // The ONLY HTTP-exposed LIST — admin-gated global user listing.\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_VIEWER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `email` is the only human-searchable field ON the user row. First/last\n          // name and display name live on `USER_PROFILES` (1:1, keyed by `userId`)\n          // and are MUTABLE there, so they are searched RELATIONALLY rather than\n          // denormalized: the framework searches `USER_PROFILES` (by its own\n          // searchable fields — firstName/lastName/displayName) and intersects the\n          // matching `userId`s with this resource's `_id`. (`username` was a phantom\n          // field — it exists on no user collection — and has been removed.) This\n          // powers the org-scoped \"people picker\" (e.g. a `createdByUserId` filter):\n          // the junction scope filter keeps results within the caller's org.\n          // See SearchableRelationDescriptor in resources-config.shared.schemas.ts.\n          searchableFields: [\n            'email',\n            {\n              localField: '_id',\n              relatedResource: CoreResourceType.USER_PROFILES,\n              relatedJoinField: 'userId',\n              // fields omitted → defaults to USER_PROFILES' own searchableFields\n              // (firstName, lastName, displayName).\n            },\n          ],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: USERS_ADMIN_FILTER_FIELDS,\n          sortFields: USERS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 200,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // DTOs auto-derived from decorators (excludeFromCreate on _id, createdAt, updatedAt).\n          //\n          // ⚠️ `status` and `appRoles` ARE part of this create contract. An earlier comment here\n          // claimed they were \"manually excluded\"; they never were — neither field carries\n          // `.excludeFromCreate()` and this variant declares no narrowing `requestDto`, so both are\n          // accepted (confirmed against the generated OpenAPI create schema). `appRoles` being\n          // caller-settable is exactly why this path carries an explicit role-ceiling gate — see\n          // `user-role-administration.custom-impl.backend.service.ts`. An absent `appRoles` falls\n          // back to the schema default and is NOT treated as a caller grant.\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, users manage themselves via USER_SELF\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // DTOs auto-derived from decorators. Only `appRoles` and `userTypes`\n          // remain writable: `_id`, `email`, `status`, `scheduledReactivationAt`\n          // and timestamps all carry `excludeFromUpdate()`.\n          //\n          // Because `appRoles` is caller-settable here, this path is\n          // the one that actually grants application authority, and it carries the role-ceiling gate\n          // plus a USER_APP_ROLES_CHANGED audit event (`user-role-administration.custom-impl`).\n          //\n          // This whole-array REPLACE is why the additive `assign_roles` / subtractive `revoke_roles`\n          // verbs are not redundant with it: reaching the same end-state here requires a\n          // read-modify-write that races with, and silently clobbers, a concurrent edit.\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          // The CAPABILITY without a new HTTP surface. `retentionPolicy` requires UPDATE_MANY because\n          // the impersonalize writer scrubs rows in place through `updateManyAsSystem`. Exposing a bulk\n          // user update over HTTP would be a genuinely dangerous admin surface (mass role/status\n          // rewrites), and INTERNAL_CALL registers NO route — like the LIST default above.\n          //\n          // ⚠️ INTERNAL_CALL, *not* REPOSITORY_ONLY. Both are route-less, but the three retention\n          // primitives (`updateManyAsSystem`, `readRetainedAsSystem`, `listRetainedAsSystem`) resolve\n          // their operation through `getServiceOperationPathDefault`, which matches only INTERNAL_CALL /\n          // API_CALL / API_CALL_WITH_CALLBACK — REPOSITORY_ONLY is deliberately excluded there and served\n          // by the separate `getRepositoryOperationPathDefault` transport. A REPOSITORY_ONLY variant here\n          // therefore satisfies the factory's \"UPDATE_MANY exists\" guard at boot and then FAILS TO RESOLVE\n          // when an erasure actually runs. `roles` is inert on a non-URL-bearing variant (role gating is\n          // bypassed for internal execution); the real gate is the derived `systemAccessPolicy.updateMany`\n          // grant, which the trusted writer is fail-closed on.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, critical risk\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // Irreversible identity destruction — the caller must prove they are still themselves,\n          // not merely that they held a session at some point. `riskLevel: CRITICAL` above does NOT\n          // do this: it drives danger-zone placement and typed confirmation in the UI and is read by\n          // no authorization code. Nor does the per-user-type `stepUpAuth` policy, which is opt-in,\n          // off by default and satisfied by any authentication newer than `maxAgeSeconds`.\n          //\n          // The audience is the reason this one is safe to gate first: `APP_ADMIN_SUPER_ADMIN` is an\n          // APPLICATION-level authority, whereas the population that provably cannot step up —\n          // directory-managed (SCIM) users, whose `passwordHash` and passkeys the framework\n          // deliberately destroys in `_reconcileLocalCredentialsForDirectoryManaged` — is\n          // ORGANIZATION-scoped by construction.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-authentication before a high-impact action.\n          requiresStepUpAuthentication: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.ASSIGN_ROLES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // ADDITIVE grant. `roles` is the REQUEST contract; the custom implementation translates it\n          // into a union over the persisted `appRoles` array, gates it against the caller's own role\n          // ceiling, and emits USER_APP_ROLES_CHANGED. Before that implementation existed, `roles`\n          // named no schema path, so the generic core UPDATE persisted nothing and answered 200.\n          requestDto: z.object({\n            roles: z.array(AppRolesSchema).min(1).describe('The application roles to add to the account. Added to the roles it already holds; none is removed. Each must be within the caller\\'s own authority.'),\n            reason: z.string().max(500).optional().describe('Why the roles are being granted. Recorded on the audit trail, not on the account.')\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.REVOKE_ROLES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects permissions\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // SUBTRACTIVE revocation — a set difference against the persisted `appRoles`, never a blind\n          // overwrite. Ceiling-gated like the grant: an administrator who may not GRANT a role must\n          // not be able to STRIP it either, or the cheapest attack on a privileged account is to\n          // remove the authority of whoever could intervene.\n          requestDto: z.object({\n            roles: z.array(AppRolesSchema).min(1).describe('The application roles to remove from the account. Roles it does not hold are ignored; each must be within the caller\\'s own authority.'),\n            reason: z.string().max(500).optional().describe('Why the roles are being revoked. Recorded on the audit trail, not on the account.')\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [Users_Operations.SUSPEND_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects access\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory. `suspensionDuration` is in DAYS\n          // and is resolved to an absolute `scheduledReactivationAt` at write time — a duration is\n          // meaningless without the moment it is counted from, and the row records no such moment.\n          requestDto: z.object({\n            reason: z.string().min(1).max(500)\n              .describe('Why the account is being suspended. Recorded with the audit event for the suspension.'),\n            suspensionDuration: z.number().min(1).optional() // Days\n              .describe('How many days the suspension lasts, counted from now. The account is reactivated automatically once it has elapsed. Omit it to suspend the account until an administrator lifts the suspension.'),\n            notifyUser: z.boolean().default(true).describe('Whether the account holder is emailed that their account was suspended. Defaults to true. The reason is not included in the email.')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectAccountStatusChangeSubject,\n          condition: administratorAskedToNotifySubject,\n          // The subject learns of the change to their own account even with email notifications\n          // switched off: a person who loses access has no other way to find out why they cannot\n          // sign in, and the administrator has already decided they should be told.\n          alwaysDeliver: true,\n        },\n      ]\n    },\n\n    [Users_Operations.UNSUSPEND_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, medium risk\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Implemented by the shared status-transition factory (SUSPENDED → ACTIVE), which also\n          // clears any pending `scheduledReactivationAt` so a manual unsuspend does not leave the\n          // sweep's deadline behind for a later suspension to inherit.\n          //\n          // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this declaration the trail\n          // would record every suspension (HIGH) and none of the reinstatements — leaving an\n          // account that was suspended and cleared reading as still suspended.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n          requestDto: z.object({\n            reason: z.string().max(500).optional().describe('Why the suspension is lifted. Recorded on the audit trail, not on the account.'),\n            notifyUser: z.boolean().default(true).describe('Whether the account holder is emailed that the suspension was lifted. Defaults to true.')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.SUSPENDED;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectAccountStatusChangeSubject,\n          condition: administratorAskedToNotifySubject,\n          // The subject learns of the change to their own account even with email notifications\n          // switched off: a person who loses access has no other way to find out why they cannot\n          // sign in, and the administrator has already decided they should be told.\n          alwaysDeliver: true,\n        },\n      ]\n    },\n\n    /**\n     * The only door back from a SELF-deactivated account (#430).\n     *\n     * `user_self | deactivate_account` writes INACTIVE, and until this verb existed nothing could\n     * lift it: `REACTIVATE_ACCOUNT` needs a session, sign-in admits only ACTIVE users\n     * (`_enforceUserStatus` refuses every other status), `unsuspend_user` refuses INACTIVE BY\n     * DESIGN, and `status` is excluded from update. A person who deactivated their own account was\n     * out permanently, and the only route back was a database write.\n     *\n     * ADMIN-TIER, which is door 2 of the three that were on the table, and its two costs were\n     * accepted rather than discovered: every self-deactivated user becomes a support ticket, and an\n     * administrator can reactivate an account whose owner did not ask. The second is why `reason`\n     * is MANDATORY here while `unsuspend_user` leaves it optional — an administrator reversing\n     * someone else's own choice about their account owes an auditor a sentence, where lifting an\n     * administrative suspension is merely undoing an administrative act.\n     *\n     * INACTIVE ONLY. A SUSPENDED account stays `unsuspend_user`'s business: an imposed halt and a\n     * chosen departure are two states whose whole distinction is who may lift them, and widening\n     * one verb to cover both was the option rejected precisely because it erases that.\n     *\n     * Implemented by the shared status-transition factory — which is also what routes the write\n     * through the SYSTEM door. `status` is `.excludeFromUpdate()`, so a handler writing it directly\n     * is stripped by the repository's strict re-parse and the operation reports success having\n     * persisted nothing; that failure mode has already cost this repository four sibling\n     * activations (`.claude/rules/invariant-call-site-enumeration.md` #8).\n     *\n     * assurance-control: WILDO.IDENTITY.LIFECYCLE — reinstating a deactivated principal is a\n     * privileged identity-lifecycle change and must be authorized, attributable and audited.\n     */\n    [Users_Operations.REACTIVATE_USER]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is\n          // still gated by `roles` above; this only admits the SUBJECT to be someone else.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // MEDIUM is below `AUTOMATIC_AUDIT_RISK_FLOOR`, so without this the trail would record\n          // the departure (DEACTIVATE_ACCOUNT) and not the return — an account reinstated by an\n          // administrator reading as still deactivated. Same reasoning as `unsuspend_user`.\n          // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n          auditableEvent: { auditBelowRiskFloor: true },\n          requestDto: z.object({\n            // MANDATORY, unlike `unsuspend_user`'s: see the JSDoc above.\n            reason: z.string().min(1).max(500).describe('Why the account is reactivated. Required, and recorded on the audit trail, not on the account.'),\n            notifyUser: z.boolean().default(true).describe('Whether the account holder is emailed that their account was reactivated. Defaults to true.'),\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === UserStatus.INACTIVE;\n          },\n        },\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USERS_CUSTOM,\n          channel: CoreUserNotificationChannel.EMAIL,\n          userIdsSelector: selectAccountStatusChangeSubject,\n          condition: administratorAskedToNotifySubject,\n          // The subject learns of the change to their own account even with email notifications\n          // switched off: a person who loses access has no other way to find out why they cannot\n          // sign in, and the administrator has already decided they should be told.\n          alwaysDeliver: true,\n        },\n      ],\n    },\n\n    /**\n     * Administrator-compelled credential reset.\n     *\n     * Implemented by `createUserForcePasswordResetFactories`, which mints a single-use\n     * PASSWORD_RESET token for the target, mails the reset link to the TARGET, revokes the\n     * target's live sessions, and emits `USER_PASSWORD_RESET_FORCED` naming the acting\n     * administrator and their reason.\n     *\n     * Three fields the original declaration carried are deliberately gone:\n     *\n     *  - **`customResponseDto: { resetToken, resetUrl }`** — an account-takeover primitive. An\n     *    administrator holding the link can set the user's password and then authenticate AS\n     *    them; with no actor claim on a session JWT, nothing downstream could tell that apart\n     *    from a genuine login, and the owner would never be told. The link now goes only to the\n     *    account owner's inbox, and the response carries non-secret metadata.\n     *  - **`resetExpirationHours` (1–168)** — a caller-widenable credential-recovery window is a\n     *    persistence mechanism, not a recovery one. The TTL is now a framework policy constant.\n     *  - **`notifyUser`** — notifying the owner is the MECHANISM (the mail carries the only copy\n     *    of the link), not an option an operator can decline.\n     *\n     * `reason` stays and is mandatory: it is what an auditor reads when asking why a credential\n     * was reset out-of-band.\n     *\n     * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — privileged credential\n     * intervention is authorized, attributable, justified, and evicts existing access.\n     */\n    /**\n     * See-through read of a retained subject (#490).\n     *\n     * ## Why it is UPDATE-like, when it plainly reads\n     *\n     * Same reasoning the webhook `testEndpoint` probe records, and for a sharper reason. Borrowing\n     * READ yields a GET, and a GET carries its parameters in the URL — which would put the operator's\n     * free-text `reason` into every access log, proxy log and browser history between here and the\n     * server. A justification for revealing scrubbed personal data routinely NAMES someone: a\n     * dispute, a legal hold, a subject. Putting it in a query string is a privacy defect, not an\n     * inconvenience.\n     *\n     * The operation also has a real side effect — every call emits a `RETAINED_DATA_ACCESS` audit row\n     * — so `x-idempotent` would have had to be false on a GET, which is the self-contradiction that\n     * argument already produced once.\n     *\n     * ## Why `reason` is in the DTO and the caller's identity is NOT\n     *\n     * `accessingUserId` and `accessingUserRoles` reach the primitive from the EXECUTION CONTEXT, never\n     * from the request. A body-supplied identity is a claim the caller writes about themselves, and\n     * the entire value of the audit row is that it says who really looked. `reason` is the one thing\n     * only the human can supply, so it is the one thing the request carries.\n     *\n     * `admitsCrossSubjectUserAdministration` is declared because the subject is by definition someone\n     * else: a retained row belongs to an erased person, and the caller is an administrator. The\n     * `roles` gate above still decides WHO may call it.\n     */\n    [Users_Operations.READ_RETAINED]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          admitsCrossSubjectUserAdministration: true,\n          // The highest risk level the vocabulary has, and it is not decoration: this is the only\n          // operation in the resource that reveals personal data an erasure was performed to remove.\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            /**\n             * Why this reveal is happening — a legal hold, a dispute, an investigation.\n             *\n             * Required, and the length floor is enforced twice on purpose: here, so the request is\n             * refused before anything is read, and again inside `readRetainedAsSystem`, which\n             * fail-closes on a blank attribution because the audit store persists `eventData`\n             * unparsed. A reveal with no reason is an anonymous reveal.\n             */\n            reason: z.string().trim().min(1).max(500)\n              .describe('Why the personal detail an erasure removed is being revealed, such as a legal hold, a dispute or an investigation. Required, and recorded on the audit trail with the reveal.'),\n          }),\n        }\n      ],\n    },\n\n    [Users_Operations.FORCE_PASSWORD_RESET]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // v1: admin-only, high risk - affects authentication\n          // Administers ANOTHER user — see `admitsCrossSubjectUserAdministration`. The caller is still\n          // gated by `roles` above; this only admits the SUBJECT to be someone other than the caller.\n          admitsCrossSubjectUserAdministration: true,\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            reason: z.string().min(1).max(500).describe('Why the password reset is forced. Required, and recorded on the audit trail, not on the account.')\n          }),\n          customResponseDto: z.object({\n            /** When the emailed reset link stops working. Non-secret — the link itself is not returned. */\n            expiresAt: z.date().describe('When the reset link emailed to the account holder stops working. The link itself is not returned.'),\n            /** Always true today; explicit so the caller can see the eviction happened. */\n            sessionsRevoked: z.boolean().describe('Whether the account\\'s sessions were signed out. Always true: a forced reset signs the account out everywhere.')\n          }),\n          // A deleted identity has no credential path worth resetting; the service rejects it\n          // with a 409. Hides the roster action rather than letting it 409 on click.\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status !== UserStatus.DELETED;\n          }\n        }\n      ],\n      // The ADMIN-AUDIT copy. The user-facing reset mail is the system PASSWORD_RESET template\n      // dispatched by the auth service when the token is minted — deliberately not duplicated\n      // into this resource-operation fan-out, which would create a second reset email that can\n      // drift from the one the self-service flow sends.\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n  },\n});\n"]}

package/dist/esm/users/users.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EAAE,iBAAiB,EAAkB,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAKhH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,OAAO,YAAY;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAEvF;AAED,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,UAAU;;;;;;;;;;iBAqIrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,6BAA6B;;;;iBA4BxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA2F5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mCAAmC;;;iBAM9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,8BAA8B;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,QAAQ,wBAAwB;CACjC;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;iBAgEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"users.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjG,OAAO,EAAE,iBAAiB,EAAkB,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAKhH;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,oBAAoB,yBAAyB;IAC7C,kBAAkB,uBAAuB;IACzC,OAAO,YAAY;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAEvF;AAED,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,UAAU;;;;;;;;;;iBAqIrB,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,6BAA6B;;;;iBA4BxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA2F5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,mCAAmC;;;iBAM9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,8BAA8B;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,QAAQ,wBAAwB;CACjC;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;iBAgEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/users/users.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,2DAA6C,CAAA;IAC7C,uDAAyC,CAAA;IACzC,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAA8B;IAC5E,OAAO,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;AACtC,CAAC;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,0BAAa,CAAA;IACb,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,EAAE,iBAAiB,CACtB,oBAAoB,CAClB,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,EACrF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,6FAA6F;IAC7F,yDAAyD;IACzD,oBAAoB,CAAC,eAAe,CACrC;IACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC5E,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,oBAAoB;IACpB,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,+FAA+F;IAC/F,sFAAsF;IACtF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,iBAAiB,EAAE;IAC1H,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IACpG,+GAA+G;IAC/G,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC1E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,oWAAoW,CAAC;IACxe;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACtI,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,gTAAgT,CAAC;IAC7T,oGAAoG;IACpG,kGAAkG;IAClG,sGAAsG;IACtG,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,oIAAoI,CAAC;CAClM,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,sEAAsE;IACtE,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,QAAQ,EAAE,oBAAoB,CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,WAAW,EAAE,oBAAoB,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7F,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;;OAOG;IACH,gGAAgG;IAChG,EAAE;IACF,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,6FAA6F;IAC7F,kGAAkG;IAClG,6EAA6E;IAC7E,EAAE;IACF,2FAA2F;IAC3F,gGAAgG;IAChG,gGAAgG;IAChG,yCAAyC;IACzC,MAAM,EAAE,oBAAoB,CAC1B,MAAM,CAAC;QACL,MAAM,EAAE,UAAU,CAAC,KAAK;QACxB,gBAAgB,EAAE,QAAQ;QAC1B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QACxB,gBAAgB,EAAE;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;YACpC,kBAAkB,EAAE,IAAI;SACzB;KACF,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC3D,aAAa,CAAC,MAAM,CACrB;IACD,+FAA+F;IAC/F,kGAAkG;IAClG,gGAAgG;IAChG,mEAAmE;IACnE,GAAG,EAAE,oBAAoB,CACvB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;OAMG;IACH,EAAE;IACF,yFAAyF;IACzF,6CAA6C;IAC7C,EAAE;IACF,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,+FAA+F;IAC/F,gDAAgD;IAChD,WAAW,EAAE,oBAAoB,CAC/B,iBAAiB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,MAAM,CACrB;IACD,KAAK,EAAE,oBAAoB,CACzB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,wQAAwQ,CAAC;IACnT,kGAAkG;IAClG,qGAAqG;IACrG,gGAAgG;IAChG,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oNAAoN,CAAC;CAChQ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,oOAAoO,CAAC;CACjT,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,0KAA0K,CAAC;IACzO,+FAA+F;IAC/F,2FAA2F;IAC3F,6FAA6F;IAC7F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iOAAiO,CAAC;IAC9S,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6JAA6J,CAAC;IAC1O,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,mSAAmS,CAAC;CAC5Y,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,0CAAmB,CAAA;IACnB,gCAAS,CAAA;IACT,4CAAqB,CAAA;IACrB,uDAAgC,CAAA;AAClC,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,oFAAoF;IACpF,oFAAoF;IACpF,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,yFAAyF;IACzF,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,kEAAkE;IAClE,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,gEAAgE;IAChE,EAAE;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,kDAAkD;IAClD,aAAa,EAAE,oBAAoB,CACjC,mCAAmC,CAAC,OAAO,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvF,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;IAED,oGAAoG;IACpG,oGAAoG;IACpG,iGAAiG;IACjG,kGAAkG;IAClG,8DAA8D;IAC9D,oGAAoG;IACpG,qGAAqG;IACrG,oCAAoC;IACpC,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACnD,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;SAC1C,iBAAiB,EAAE,EACtB,aAAa,CAAC,KAAK,CACpB;IAED,EAAE,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAErG,+FAA+F;IAC/F,gGAAgG;IAChG,kGAAkG;IAClG,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAC5B,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC9F,cAAc,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAC9E,aAAa,CAAC,KAAK,CACpB;IAED,gCAAgC;IAChC,mBAAmB,EAAE,oBAAoB,CACvC,6BAA6B,CAAC,OAAO,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC5F,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;CACF,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC;IACjD,sFAAsF;IACtF,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC7C,mBAAmB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACrD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * User Shared Schemas\n * \n * Shared user schemas for frontend and backend with MongoDB compatibility\n */\n\nimport { z } from 'zod';\n\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { UserPrivacySchema } from '../compliance/privacy/privacy.shared.schemas';\nimport { OrganizationMemberSchema } from '../organizations/organization-members.shared.schemas';\nimport { AvailableLanguage, TimezoneSchema, DateFormat, TimeFormat } from '@wildo-ai/presets-components-models';\nimport { EnumMultipleEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * The address written over a user's `email` when the subject is erased and the row retained.\n *\n * `.invalid` is an RFC 2606 reserved TLD: it can never be registered and never resolves, so an\n * erased address cannot be delivered to, cannot be confused with a live account, and cannot become\n * a real identity if a stray code path ever re-mails it.\n *\n * Exported as ONE named source so the erasure orchestrator, tests and any operator query recognize\n * an erased subject without duplicating the literal.\n */\nexport const ERASED_USER_EMAIL = 'erased@erased.invalid';\n\n/**\n * What a REQUIRED name field becomes when the subject is erased.\n *\n * `firstName` and `lastName` are `min(1)`, so REMOVE is not available to them — nulling a required\n * field would leave a row the schema itself rejects on the next read. MASK with a value that is\n * obviously not a name keeps the row parseable while carrying no information about the person.\n *\n * Deliberately the same placeholder as `ERASED_FILE_NAME_PLACEHOLDER`: a reader meeting `[erased]`\n * in an export or an admin view should not have to learn a second vocabulary to recognise it.\n */\nexport const ERASED_USER_NAME = '[erased]';\n\n/**\n * What an erased EXTERNAL identifier becomes — a provider's own id for the person.\n *\n * Distinct from `ERASED_USER_NAME` despite the same literal, because the two answer different\n * questions and will diverge: a name is displayed to a human, an external id is matched against a\n * provider's records. Merging them would make a future change to either silently change the other.\n */\nexport const ERASED_IDENTITY_VALUE = '[erased]';\n\nexport enum UserStatus {\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED',\n  PENDING_VERIFICATION = 'PENDING_VERIFICATION',\n  PENDING_INVITATION = 'PENDING_INVITATION',\n  DELETED = 'DELETED'\n}\n\n/**\n * True when a person of this status may still act on their own data — ACTIVE only, the same rule the sign-in,\n * token refresh and request-context gates apply to the person themself.\n *\n * Named for the inbound pipeline (#1629): a USER-scope delivery runs on one person's data, and a handler must\n * not act there for someone who could not act there themself. It is the user-scope twin of\n * `isAuthorityConferringOrganizationStatus`.\n */\nexport function isAuthorityConferringUserStatus(status: UserStatus | undefined): boolean {\n  return status === UserStatus.ACTIVE;\n}\n\nexport enum UserTheme {\n  LIGHT = 'LIGHT',\n  DARK = 'DARK',\n  AUTO = 'AUTO'\n}\n\nexport const UserSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * Email is the STRICT unique identity anchor — there is never more than one\n   * `User` per email. `.isUnique()` is the fail-closed DB backstop; every\n   * provisioning path (self-registration, org-admin invite, SSO JIT, SCIM,\n   * anonymous transposition) MUST find-or-create by this normalized value rather\n   * than blind-create, and recover from the duplicate-key `409` on the rare\n   * concurrent race (e.g. an invite and an SSO JIT landing at once). `.toLowerCase()`\n   * normalizes before both the lookup and the unique check so casing can't fork an\n   * identity. `.excludeFromUpdate()` keeps the anchor immutable.\n   *\n   * **It is also the ONLY personal datum on this row** (the rest is `_id`, status, roles, types and\n   * timestamps; names / bio / phone / avatar all live on `USER_PROFILES`). So it is what a subject\n   * erasure scrubs — `MASK` to {@link ERASED_USER_EMAIL}, which keeps the row resolvable as an\n   * anonymized subject for the retained billing records whose foreign keys point at it.\n   *\n   * `MASK` with an explicit value rather than `REMOVE`: `REMOVE` writes `null`, which this schema\n   * rejects, so it would force `.nullish()` here — widening the identity anchor to\n   * `string | null | undefined` for ~20+ consumers (auth registration, password reset, JWT guard,\n   * SCIM, SSO provisioning, org invites) AND making it optional at CREATE, to represent a state only\n   * the audited see-through reader can ever observe, since a retained row is hidden from every\n   * normal read. The default mask constant cannot be used either — it is not a valid email.\n   * Every erased user shares this one address; that cannot collide, because the unique index on a\n   * retention-governed resource covers only non-retained rows and the scrub flips the row to\n   * `RETAINED` in the same write.\n   */\n  email: addDataCategories(\n    addImpersonalizeWith(\n      z.email().isDBIndexed().isUnique().toLowerCase().isSummaryField().excludeFromUpdate(),\n      RedactionType.MASK,\n      { maskValue: ERASED_USER_EMAIL },\n    ),\n    // Declared because the engine owes its OWN inventory. Without it, every generated application's\n    // privacy notice would name `users.email` as an outstanding category gap — the field carries a\n    // scrub treatment, which is the application saying it holds personal data, so the missing\n    // category would be a provable omission the framework left for each app to fix. CONTACT_DETAILS\n    // rather than IDENTITY: it is how the person is reached. That it also serves as the identity\n    // anchor is a property of this schema, not of the datum.\n    PersonalDataCategory.CONTACT_DETAILS,\n  ),\n  /**\n   * WHEN this address was proven to be reachable by the person who holds the account — and nothing else.\n   *\n   * ## Why a moment, and why it is not `status` (#1285)\n   *\n   * `email_verified` is an OIDC claim this application ISSUES to relying parties, and it was derived\n   * from `UserStatus.ACTIVE`. ACTIVE does not mean the address was proven: with\n   * `EmailVerificationMode.DEFERRED`, and on the password-less path, registration creates an ACTIVE\n   * account precisely so the emailed link can be the way in — the address is proven when the link is\n   * CLICKED, which may be later or never. So an application could assert to every relying party that\n   * an address was verified when nothing had verified it.\n   *\n   * The registration flow already knows the difference and says so at its own site: *\"The status gate\n   * and the verification gate are not the same gate, and conflating them is what makes this look wrong\n   * at first glance.\"* This field is that sentence made readable by everything downstream.\n   *\n   * ## Absent is UNKNOWN, never false\n   *\n   * There is no backfill, so an account verified before this field existed carries nothing. Readers\n   * therefore treat absence as unknown and OMIT the claim — which is the doctrine\n   * `oidc-user-claims.backend.service.ts` already states for itself: *\"assert the claim only when the\n   * status determines it; omit it otherwise rather than assert an unknown state.\"* Absence must not\n   * become `false`: that would tell a relying party an address is unverified when it may well have\n   * been, which is a different false statement rather than a safer one.\n   *\n   * Mirrors `UserCredentials.phoneVerifiedAt`, which has recorded the same fact for the phone channel\n   * since SMS OTP shipped. Email was the channel with no record at all.\n   *\n   * NOT `.isAuditEvidence()`, for the reason the block below gives about `email`: the act is already\n   * recorded as its own auditable event (`logUserEmailVerified`), and a moment beside a masked\n   * identity anchor does not decide authority.\n   */\n  emailVerifiedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  // The three fields below carry `.isAuditEvidence()`: their VALUES are recorded before-and-after on\n  // the `resource_operation_performed` audit event. All three decide what the principal may do, and\n  // all three hold closed vocabulary rather than personal data — so recording them is both necessary\n  // as authorization evidence and free of personal data whose erasure obligations could reach the\n  // immutable ledger.\n  //\n  // Contrast `email` directly above, which is deliberately NOT marked: it is the identity anchor and\n  // is `.impersonalizeWith(MASK)`, i.e. a value the framework must be able to scrub on erasure.\n  // Copying it into an unscrubbable audit row would defeat that capability. That is the whole D4\n  // boundary in one file — mark what decides authority, never what identifies a person.\n  /**\n   * Account lifecycle and access posture.\n   *\n   * `.excludeFromUpdate()` since 2026-08-01. Lifecycle transitions belong to the dedicated verbs —\n   * `users | suspend_user` / `unsuspend_user` and `user_self | deactivate_account` /\n   * `reactivate_account` — which own the state machine, the reason, the audit event and the\n   * administrative-continuity floors. A generic field patch reproduces none of that, so accepting\n   * `status` on the ordinary UPDATE contract meant an administrator could retire an account through\n   * a door that asked none of those questions. Mirrors `OrganizationMemberSchema.status`, whose\n   * JSDoc has described the same rule for the same reason since before these verbs existed.\n   *\n   * ⚠️ The trusted server-side writers must therefore use `updateAsSystem`, which re-attaches the\n   * field past the repository's strict request-DTO re-parse — email verification\n   * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning. All four\n   * were migrated in the same change, and `USERS` opts into `systemAccessPolicy.update` for exactly\n   * them. A NEW trusted writer that reaches for `servicesRegistryHandler.update` here will be\n   * SILENTLY stripped — the account simply never changes state, with no error and no signal.\n   *\n   * assurance-control: WILDO.IDENTITY.LIFECYCLE — a change to whether a principal may authenticate\n   * runs through one guarded, evidenced authority.\n   */\n  status: z.enum(UserStatus).default(UserStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence().excludeFromUpdate(),\n  appRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]).isDBIndexed().isAuditEvidence(),\n  /** User types from config (e.g. 'user', 'admin', 'consumer'). Determines auth policy, registration context. */\n  userTypes: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * When an automated sweep must return this account to `ACTIVE`.\n   *\n   * Written only by `users | suspend_user`, whose contract takes `suspensionDuration` in DAYS. The\n   * transition hook resolves that duration to an absolute instant before persisting, because a\n   * duration is only meaningful relative to a moment the row does not otherwise record.\n   *\n   * Voluntary `user_self | deactivate_account` deliberately has no schedule: an INACTIVE account\n   * returns only when its subject calls `reactivate_account`. Absent therefore means an indefinite\n   * admin suspension or a non-scheduled lifecycle state.\n   *\n   * Server-owned (`.excludeFromCreate().excludeFromUpdate()`) so the transition verbs are the only\n   * writers, and indexed because the reactivation sweep queries exactly \"rows whose scheduled\n   * reactivation has passed\". Deliberately NOT `.isAuditEvidence()`: unlike the three fields above\n   * it does not decide what the principal may do — it is a scheduling detail, and the transition's\n   * own audit event already records the reason and the resulting status.\n   *\n   * ⚠️ For admin suspension, the value is a PROMISE the reactivation batch keeps. Persisting it without that sweep would\n   * be the same defect as a verb answering success while writing nothing: an authored intention\n   * that nothing honors.\n   */\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type User = z.infer<typeof UserSchema>;\n\nexport const UserLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField().describe(\"The language this user reads the application in, and the language of the notification and password-reset emails sent to them. In the interface, the organization's primary language takes precedence when the organization enforces it or the user opts into the organization default, and a language the application does not offer is ignored. Defaults to `en`.\"),\n  /**\n   * The languages to use, in order, when `primaryLanguage` is one the application does not offer (#1799).\n   *\n   * Read in two places, through one ordering: the interface's language resolution tries them after the\n   * primary language and before anything it remembers or detects; the recipient language of a\n   * notification or password-reset email tries them after the primary language and before the user's\n   * regional locale. Each is used only if the application (and, in the interface, the organization)\n   * offers it. It was stored and edited and read by nothing until then.\n   *\n   * Defaults to EMPTY, not `[en]`: a fixed English default would quietly override the application's\n   * own fallback language for every user who never set this.\n   *\n   * Compact multi-select: render as a chips combobox (searchable popover) instead of a full inline\n   * checkbox column — `multipleEditMode: COMBOBOX` on the array item is the opt-in the multiple enum\n   * control reads (`resolveEnumMultipleEditMode`). The single-select `editMode` means nothing on an array item. Fits a settings-row layout where the long language list would\n   * otherwise overflow.\n   */\n  fallbackLanguages: z\n    .array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { multipleEditMode: EnumMultipleEditMode.COMBOBOX } }))\n    .default([])\n    .describe('Languages to use, in order, when `primaryLanguage` is not one the application offers — in the interface, and for the notification and password-reset emails sent to this user. A language the application does not offer is skipped. Empty by default, which leaves the application\\'s own fallback in charge.'),\n  // `autoDetect` was removed (#1799). It was consulted only after the primary language had failed AND\n  // nothing was remembered, which for a signed-in user with the default `en` primary is effectively\n  // never. The application-level `appPreferences.languages.autoDetectFromBrowser` still governs the one\n  // case that remains, a first visit before anyone has signed in.\n  useOrganizationDefault: z.boolean().default(false).describe(\"When true, the interface uses the organization's primary language instead of this user's own `primaryLanguage`. Defaults to false.\"),\n});\nexport type UserLanguagePreferences = z.infer<typeof UserLanguagePreferencesSchema>;\n\nexport const UserProfileSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()`: one profile per user (1:1 composition). Backstops the eager\n  // `onParentCreate` seed + the provisioning paths against a concurrent\n  // double-create — the durable idempotency guarantee behind the declarative seed.\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  firstName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  lastName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  displayName: addImpersonalizeWith(\n    z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored\n   * as the standard file reference `{ fileId, updatedAt }` and rendered as a\n   * square avatar. Uses the plain `z_file()` image pipeline (upload / storage /\n   * DTO / persistence / metadata population) with no bespoke field type; the\n   * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there\n   * is no external-URL branch.\n   */\n  // REMOVE nulls the stored `{ fileId, updatedAt }` reference AND the underlying file is deleted.\n  //\n  // Corrected 2026-09-17: this said the stored object was NOT deleted, on the grounds that file bytes\n  // belong to the file resource's own lifecycle. That is not what the engine does. `userProfiles`\n  // declares a `retentionPolicy`, so `impersonalizeRowsInPlace` governs it; this field is a personal\n  // file field (REMOVE, not KEEP); and that scrub's own comment states the rule — \"a field-level\n  // scrub cannot reach INSIDE a stored blob, so a file field marked personal is only erased by\n  // deleting the file\". The deletion is sequenced as a post-commit effect on the parent transaction\n  // so a rolled-back scrub can never destroy files for a row that stayed live.\n  //\n  // The old comment under-claimed, which is the safer direction and still false — and it was\n  // load-bearing: `remove_avatar` was acknowledged as unimplementable partly by reasoning from it\n  // (#1275). A schema comment about what the product does is a claim, and this one had never been\n  // checked against the code it described.\n  avatar: addImpersonalizeWith(\n    z_file({\n      nature: FileNature.IMAGE,\n      allowedMimeTypes: 'Images',\n      maxSize: 2 * 1024 * 1024,\n      imageConstraints: {\n        maxWidth: 1024,\n        maxHeight: 1024,\n        aspectRatio: { width: 1, height: 1 },\n        generateThumbnails: true,\n      },\n    }).optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never\n  // what it will contain — a bio is a classic surface where a special category (a health condition,\n  // a religious observance, a political affiliation) arrives unannounced, and no schema certifies\n  // otherwise. Nothing here is a claim that it does NOT contain one.\n  bio: addImpersonalizeWith(\n    z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * E.164 phone number (e.g. \"+33123456789\"). `z_phone()` carries the phone\n   * metadata that drives the international phone INPUT on edit (country selector +\n   * national number) and the formatted international DISPLAY on read — replacing\n   * the old raw `z.string().regex(...)` that surfaced the regex to the user.\n   * Stored value is still a plain E.164 string, so DTO/persistence are unchanged.\n   */\n  //\n  // A phone number is contact-detail personal data by definition, so both declarations are\n  // load-bearing here rather than a curiosity.\n  //\n  // The helper form is kept DELIBERATELY, and the reason changed on 2026-09-17. It used to be the\n  // only form that worked: `z_phone()` ends in `.pipe(z.string())`, so its constructor is `ZodPipe`,\n  // a name in no applyable-type list — and the per-instance decorator install keys on that name, so\n  // a phone schema carried NO decorators at all and the fluent form threw. That gap is closed and\n  // `z_phone().dataCategories(…).impersonalizeWith(…)` now works. What keeps the helper here is that\n  // it needs no prototype method at all, which makes this field's classification independent of the\n  // decorator-install path entirely — worth having on the one field whose misclassification is a\n  // privacy incident rather than a rendering bug.\n  phoneNumber: addImpersonalizeWith(\n    addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.REMOVE,\n  ),\n  title: addImpersonalizeWith(\n    z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL),\n    RedactionType.REMOVE,\n  )\n});\nexport type UserProfile = z.infer<typeof UserProfileSchema>;\n\nexport const UserPreferences_NotificationsSchema = z.object({\n  email: z.boolean().default(true).describe(\"When false, notification emails about the user's own account are not sent to them. Emails the user receives because of a role they hold, notices marked as always delivered, and account-recovery emails such as password reset are sent regardless. Defaults to true.\"),\n  // `push` and `sms` were removed (#1799): the dispatcher sent neither channel — it logged \"not yet\n  // implemented\" and returned — and no notification declared either, so a user who turned push off \"to\n  // stop notifications\" turned off nothing. They come back with a channel that actually delivers.\n  inApp: z.boolean().default(true).describe(\"When false, the application's interface stops showing this user the real-time notifications the server sends them, as pop-ups or in the notification centre. Data on screen keeps updating live. Defaults to true.\")\n});\nexport type UserPreferences_Notifications = z.infer<typeof UserPreferences_NotificationsSchema>;\n\nexport const UserPreferences_UI_ThemeSchema = z.object({\n  theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField().describe(\"The colour scheme the interface uses for this user: `LIGHT`, `DARK`, or `AUTO` to follow the device's system setting. Applied whenever the user's preferences load, so the choice follows them across devices. Defaults to `AUTO`.\"),\n});\nexport type UserPreferences_UI_Theme = z.infer<typeof UserPreferences_UI_ThemeSchema>;\n\n/**\n * A member's OWN regional choices — and every field is OPTIONAL, deliberately.\n *\n * **Absence is a real state and it is the point of this block**: it means the member has expressed\n * no preference, so the value comes from the organization's own regional record\n * (`OrganizationPreferences.timezone` / `.locale` / `.dateFormat` / `.timeFormat`), and only then\n * from the framework fallback. `I18nContext` resolves that chain — member, then organization, then\n * framework — and it can only do so because an unexpressed preference is representable here.\n *\n * All four carried a Zod `.default(...)` until 2026-09-08 (#410), and the defaults were not a\n * convenience: they made the organization layer UNIMPLEMENTABLE. A `.default()` MATERIALIZES at\n * parse, so every member with a preferences row carried `'UTC'`, `EN`, `LOCALE_DEFAULT` and\n * `TWENTY_FOUR_HOUR` whether or not they had ever opened the settings screen — indistinguishable\n * from having chosen them. A tenant that set `Europe/Paris` could never reach a single member,\n * because there was no member left who had not \"expressed\" UTC.\n *\n * The same shape had already cost a decision elsewhere: `cancelImmediately: z.boolean().default(false)`\n * made \"the caller expressed no cancellation preference\" unobservable, which is why the authored\n * `defaultBehavior` policy beneath it was unimplementable rather than merely unimplemented (#408).\n * A default one layer up erases the state the layer beneath exists to answer for.\n *\n * `locale` in particular was also WRONG on its own terms. `I18nContext` resolves it as\n * `regional.locale ?? currentLanguage ?? 'en'`, so a materialized `EN` meant the left side always\n * won and the resolved UI language was never consulted: a member using the application in French\n * got `en` date, time and number formatting. Removing the default is what lets that `??` chain do\n * what it was written to do.\n *\n * Note what did NOT change: the framework's fallbacks are unchanged, and they are still exactly\n * these four values. A member in a tenant that has authored nothing sees precisely what they saw\n * before — the difference is only that a tenant which HAS authored something is now heard.\n */\nexport const UserPreferences_RegionalSchema = z.object({\n  timezone: TimezoneSchema.optional().isSummaryField().describe(\"The IANA time zone (for example `Europe/Paris`) in which the interface shows dates and times to this user. When omitted, the organization's time zone applies, then UTC.\"),\n  // LOCALE_DEFAULT (not ISO_8601) remains the framework FALLBACK, resolved in `I18nContext`: \"no\n  // expressed preference\" must mean locale-driven rendering. Storing it here would pin every\n  // preference-less member to it and mask both the organization layer and the locale fallback.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').optional().describe(\"How the interface shows dates to this user: `LOCALE_DEFAULT` follows the conventions of the resolved locale, every other value is a fixed pattern. When omitted, the organization's date format applies, then `LOCALE_DEFAULT`.\"),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').optional().describe(\"Whether the interface shows times to this user on a 12-hour (`12h`) or 24-hour (`24h`) clock. When omitted, the organization's setting applies, then `24h`.\"),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').optional().isSummaryField().describe(\"The language tag (for example `en-GB`) whose conventions the interface uses to format dates, times and numbers for this user. When omitted, the organization's locale applies, then the language the interface is shown in. It is also published as the `locale` claim to OpenID Connect clients.\")\n});\nexport type UserPreferences_Regional = z.infer<typeof UserPreferences_RegionalSchema>;\n\n/**\n * The preference blocks a caller can address as a unit — the closed vocabulary behind\n * `reset_to_defaults` on USER_SELF_PREFERENCES.\n *\n * **Every value IS the persisted field name on {@link UserPreferencesSchema}.** That is the\n * point of the enum, not a coincidence: it lets the reset patch be DERIVED from the vocabulary\n * instead of routed through a hand-written flag-to-field map. The previous contract was six\n * booleans (`resetNotifications`, `resetUI`, …) that named no schema path, so the whole request\n * was stripped before persistence and the route answered 200 having reset nothing.\n *\n * Adding a preference group to the schema means adding a member here; the mapped type in\n * `user-preferences-reset.shared.utils.ts` then refuses to compile until the group declares how\n * it resets. Renaming a group field without renaming the value fails the same way.\n *\n * Note `LANGUAGE = 'languagePreferences'` — the member reads as the concept, the value is the\n * field. Do not \"tidy\" the value to `language`; it is an address, not a label.\n */\nexport enum UserPreferenceGroup {\n  NOTIFICATIONS = 'notifications',\n  PRIVACY = 'privacy',\n  UI = 'ui',\n  REGIONAL = 'regional',\n  LANGUAGE = 'languagePreferences',\n}\n\nexport const UserPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` is the idempotency backstop for onParentCreate seeding: the eager\n  // seed (and any retry) is deduplicated at the DB layer — a second seed for the same\n  // user fails the unique constraint and is swallowed, guaranteeing exactly one\n  // preferences row per user. (Prod migration note: dedupe any pre-existing duplicate\n  // userId rows before this index builds; preferences was seeded nowhere pre-feature,\n  // so duplicates are unexpected.)\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // ── Which preference blocks are data ABOUT the person, and which are rendering state ──\n  //\n  // Declared at the BLOCK, not on the leaves inside it. The resolver walks TOP-LEVEL fields only —\n  // the same limit the subject-export compiler and the impersonalize writer have — so a category on\n  // `regional.timezone` would be invisible. That is not a workaround: a notice enumerates KINDS, and\n  // \"communication preferences\" is the kind, not \"the sms boolean\".\n  //\n  // `ui` is deliberately NOT declared. A theme choice is about how the SYSTEM renders for someone,\n  // not a fact about them — the same line that keeps job executions, entitlement limits and unread\n  // counters out of the inventory. The three below are the other side of it: how the person wants to\n  // be CONTACTED, what they decided about their own privacy, and where and in what language they\n  // are — each a fact about them that a notice owes an answer on.\n  //\n  // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it\n  // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a\n  // reader nothing the word \"preferences\" does not.\n  notifications: addImpersonalizeWith(\n    UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  \n  // CREATE cannot carry the consent decision, because the row is SEEDED (the USERS → USER_PREFERENCES\n  // `onParentCreate` composition writes only the parent key) and a person has decided nothing at that\n  // point. Every door that writes a decision emits a row: the gate, the self and admin UPDATE, the\n  // RESET, and `carry_anonymous_consent`. CREATE sits below the automatic audit floor, so a consent\n  // accepted there would be stored with no trace, which is what\n  // `evidence-requirement:consent-decision-transition-record` C2 forbids. The control marker for that\n  // objective sits on the decision leaf itself (`UserPrivacySchema.consentedPurposes`); this site only\n  // narrows which verbs can reach it.\n  privacy: addImpersonalizeWith(\n    UserPrivacySchema.default(UserPrivacySchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE)\n      .excludeFromCreate(),\n    RedactionType.RESET,\n  ),\n  \n  ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),\n  \n  // Timezone and locale are the two that most clearly identify something about the person rather\n  // than about the session — a timezone narrows where they are, which is why LOCATION rides here.\n  // LOCATION as well as USAGE — a timezone and a locale narrow where a person is. RESET returns the\n  // application's own defaults, which is what a person who never chose still has.\n  regional: addImpersonalizeWith(\n    UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()\n      .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),\n    RedactionType.RESET,\n  ),\n  \n  // Enhanced language preferences\n  languagePreferences: addImpersonalizeWith(\n    UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  )\n});\nexport type UserPreferences = z.infer<typeof UserPreferencesSchema>;\n\n/**\n * The hand-authored mirror of the auto-generated `USER_SELF` CONTEXT response.\n *\n * Every field name here MUST be the one `addRelationshipPlaceholders` declares on the generated\n * `contextDto`, i.e. `Resources_SharedUtils.resolveRelationshipObjectIdentity(...).objectFieldName`\n * for the relationship. This schema is a TYPE for consumers (the frontend casts the context read to\n * it, and the auth response embeds it); it does not validate the response, so a name that drifts\n * from the generated DTO is invisible until someone reads a field that is never there.\n *\n * `userSelfPreferences` is PLURAL because `USER_SELF_PREFERENCES` declares\n * `resourceFieldIdentifier: 'userSelfPreferencesId'` and the DTO's field name is that identifier's\n * base — unlike `userSelfProfile`, whose identifier is already singular (`userSelfProfileId`). It\n * read `userSelfPreference` until 2026-09-10, which is the name the POPULATION side used to\n * produce; the generated DTO never declared it, so the populated preferences were Zod-stripped on\n * the way out and no application ever received them (issue #563).\n */\nexport const UserContextSchema = UserSchema.extend({\n  // Relationship-based field names — must match the auto-generated context DTO exactly.\n  userSelfProfile: UserProfileSchema.optional(),\n  userSelfPreferences: UserPreferencesSchema.optional(),\n  organizationMembers: z.array(OrganizationMemberSchema).optional(),\n});\nexport type UserContext = z.infer<typeof UserContextSchema>; \n"]}
+{"version":3,"file":"users.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/users.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACtI,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,2DAA6C,CAAA;IAC7C,uDAAyC,CAAA;IACzC,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAA8B;IAC5E,OAAO,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;AACtC,CAAC;AAED,MAAM,CAAN,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,0BAAa,CAAA;IACb,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,KAAT,SAAS,QAIpB;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,EAAE,iBAAiB,CACtB,oBAAoB,CAClB,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,EACrF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,0FAA0F;IAC1F,gGAAgG;IAChG,6FAA6F;IAC7F,yDAAyD;IACzD,oBAAoB,CAAC,eAAe,CACrC;IACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC5E,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,oBAAoB;IACpB,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,+FAA+F;IAC/F,sFAAsF;IACtF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,iBAAiB,EAAE;IAC1H,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IACpG,+GAA+G;IAC/G,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC1E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,oWAAoW,CAAC;IACxe;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACtI,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,gTAAgT,CAAC;IAC7T,oGAAoG;IACpG,kGAAkG;IAClG,sGAAsG;IACtG,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,oIAAoI,CAAC;CAClM,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,6EAA6E;IAC7E,sEAAsE;IACtE,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,oBAAoB,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,QAAQ,EAAE,oBAAoB,CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EACxF,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAChC;IACD,WAAW,EAAE,oBAAoB,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC7F,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;;OAOG;IACH,gGAAgG;IAChG,EAAE;IACF,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,6FAA6F;IAC7F,kGAAkG;IAClG,6EAA6E;IAC7E,EAAE;IACF,2FAA2F;IAC3F,gGAAgG;IAChG,gGAAgG;IAChG,yCAAyC;IACzC,MAAM,EAAE,oBAAoB,CAC1B,MAAM,CAAC;QACL,MAAM,EAAE,UAAU,CAAC,KAAK;QACxB,gBAAgB,EAAE,QAAQ;QAC1B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QACxB,gBAAgB,EAAE;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;YACpC,kBAAkB,EAAE,IAAI;SACzB;KACF,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAC3D,aAAa,CAAC,MAAM,CACrB;IACD,+FAA+F;IAC/F,kGAAkG;IAClG,gGAAgG;IAChG,mEAAmE;IACnE,GAAG,EAAE,oBAAoB,CACvB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;IACD;;;;;;OAMG;IACH,EAAE;IACF,yFAAyF;IACzF,6CAA6C;IAC7C,EAAE;IACF,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,+FAA+F;IAC/F,gDAAgD;IAChD,WAAW,EAAE,oBAAoB,CAC/B,iBAAiB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,eAAe,CAAC,EAC7E,aAAa,CAAC,MAAM,CACrB;IACD,KAAK,EAAE,oBAAoB,CACzB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAChF,aAAa,CAAC,MAAM,CACrB;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,wQAAwQ,CAAC;IACnT,kGAAkG;IAClG,qGAAqG;IACrG,gGAAgG;IAChG,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oNAAoN,CAAC;CAChQ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,oOAAoO,CAAC;CACjT,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,0KAA0K,CAAC;IACzO,+FAA+F;IAC/F,2FAA2F;IAC3F,6FAA6F;IAC7F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iOAAiO,CAAC;IAC9S,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6JAA6J,CAAC;IAC1O,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,mSAAmS,CAAC;CAC5Y,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,0CAAmB,CAAA;IACnB,gCAAS,CAAA;IACT,4CAAqB,CAAA;IACrB,uDAAgC,CAAA;AAClC,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,oFAAoF;IACpF,oFAAoF;IACpF,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACtG,yFAAyF;IACzF,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,kEAAkE;IAClE,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,gEAAgE;IAChE,EAAE;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,kDAAkD;IAClD,aAAa,EAAE,oBAAoB,CACjC,mCAAmC,CAAC,OAAO,CAAC,mCAAmC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvF,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;IAED,oGAAoG;IACpG,oGAAoG;IACpG,iGAAiG;IACjG,kGAAkG;IAClG,8DAA8D;IAC9D,oGAAoG;IACpG,qGAAqG;IACrG,oCAAoC;IACpC,OAAO,EAAE,oBAAoB,CAC3B,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACnD,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;SAC1C,iBAAiB,EAAE,EACtB,aAAa,CAAC,KAAK,CACpB;IAED,EAAE,EAAE,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAErG,+FAA+F;IAC/F,gGAAgG;IAChG,kGAAkG;IAClG,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAC5B,8BAA8B,CAAC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC9F,cAAc,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAC9E,aAAa,CAAC,KAAK,CACpB;IAED,gCAAgC;IAChC,mBAAmB,EAAE,oBAAoB,CACvC,6BAA6B,CAAC,OAAO,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;SAC5F,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAC7C,aAAa,CAAC,KAAK,CACpB;CACF,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC;IACjD,sFAAsF;IACtF,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC7C,mBAAmB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACrD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * User Shared Schemas\n * \n * Shared user schemas for frontend and backend with MongoDB compatibility\n */\n\nimport { z } from 'zod';\n\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { UserPrivacySchema } from '../compliance/privacy/privacy.shared.schemas';\nimport { OrganizationMemberSchema } from '../organizations/organization-members.shared.schemas';\nimport { AvailableLanguage, TimezoneSchema, DateFormat, TimeFormat } from '@wildo-ai/presets-components-models';\nimport { EnumMultipleEditMode, z_phone, z_file, FileNature, addDataCategories, addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * The address written over a user's `email` when the subject is erased and the row retained.\n *\n * `.invalid` is an RFC 2606 reserved TLD: it can never be registered and never resolves, so an\n * erased address cannot be delivered to, cannot be confused with a live account, and cannot become\n * a real identity if a stray code path ever re-mails it.\n *\n * Exported as ONE named source so the erasure orchestrator, tests and any operator query recognize\n * an erased subject without duplicating the literal.\n */\nexport const ERASED_USER_EMAIL = 'erased@erased.invalid';\n\n/**\n * What a REQUIRED name field becomes when the subject is erased.\n *\n * `firstName` and `lastName` are `min(1)`, so REMOVE is not available to them — nulling a required\n * field would leave a row the schema itself rejects on the next read. MASK with a value that is\n * obviously not a name keeps the row parseable while carrying no information about the person.\n *\n * Deliberately the same placeholder as `ERASED_FILE_NAME_PLACEHOLDER`: a reader meeting `[erased]`\n * in an export or an admin view should not have to learn a second vocabulary to recognise it.\n */\nexport const ERASED_USER_NAME = '[erased]';\n\n/**\n * What an erased EXTERNAL identifier becomes — a provider's own id for the person.\n *\n * Distinct from `ERASED_USER_NAME` despite the same literal, because the two answer different\n * questions and will diverge: a name is displayed to a human, an external id is matched against a\n * provider's records. Merging them would make a future change to either silently change the other.\n */\nexport const ERASED_IDENTITY_VALUE = '[erased]';\n\nexport enum UserStatus {\n  ACTIVE = 'ACTIVE',\n  INACTIVE = 'INACTIVE',\n  SUSPENDED = 'SUSPENDED',\n  PENDING_VERIFICATION = 'PENDING_VERIFICATION',\n  PENDING_INVITATION = 'PENDING_INVITATION',\n  DELETED = 'DELETED'\n}\n\n/**\n * True when a person of this status may still act on their own data — ACTIVE only, the same rule the sign-in,\n * token refresh and request-context gates apply to the person themself.\n *\n * Named for the inbound pipeline (#1629): a USER-scope delivery runs on one person's data, and a handler must\n * not act there for someone who could not act there themself. It is the user-scope twin of\n * `isAuthorityConferringOrganizationStatus`.\n */\nexport function isAuthorityConferringUserStatus(status: UserStatus | undefined): boolean {\n  return status === UserStatus.ACTIVE;\n}\n\nexport enum UserTheme {\n  LIGHT = 'LIGHT',\n  DARK = 'DARK',\n  AUTO = 'AUTO'\n}\n\nexport const UserSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  /**\n   * Email is the STRICT unique identity anchor — there is never more than one\n   * `User` per email. `.isUnique()` is the fail-closed DB backstop; every\n   * provisioning path (self-registration, org-admin invite, SSO JIT, SCIM,\n   * anonymous transposition) MUST find-or-create by this normalized value rather\n   * than blind-create, and recover from the duplicate-key `409` on the rare\n   * concurrent race (e.g. an invite and an SSO JIT landing at once). `.toLowerCase()`\n   * normalizes before both the lookup and the unique check so casing can't fork an\n   * identity. `.excludeFromUpdate()` keeps the anchor immutable.\n   *\n   * **It is also the ONLY personal datum on this row** (the rest is `_id`, status, roles, types and\n   * timestamps; names / bio / phone / avatar all live on `USER_PROFILES`). So it is what a subject\n   * erasure scrubs — `MASK` to {@link ERASED_USER_EMAIL}, which keeps the row resolvable as an\n   * anonymized subject for the retained billing records whose foreign keys point at it.\n   *\n   * `MASK` with an explicit value rather than `REMOVE`: `REMOVE` writes `null`, which this schema\n   * rejects, so it would force `.nullish()` here — widening the identity anchor to\n   * `string | null | undefined` for ~20+ consumers (auth registration, password reset, JWT guard,\n   * SCIM, SSO provisioning, org invites) AND making it optional at CREATE, to represent a state only\n   * the audited see-through reader can ever observe, since a retained row is hidden from every\n   * normal read. The default mask constant cannot be used either — it is not a valid email.\n   * Every erased user shares this one address; that cannot collide, because the unique index on a\n   * retention-governed resource covers only non-retained rows and the scrub flips the row to\n   * `RETAINED` in the same write.\n   */\n  email: addDataCategories(\n    addImpersonalizeWith(\n      z.email().isDBIndexed().isUnique().toLowerCase().isSummaryField().excludeFromUpdate(),\n      RedactionType.MASK,\n      { maskValue: ERASED_USER_EMAIL },\n    ),\n    // Declared because the engine owes its OWN inventory. Without it, every generated application's\n    // privacy notice would name `users.email` as an outstanding category gap — the field carries a\n    // scrub treatment, which is the application saying it holds personal data, so the missing\n    // category would be a provable omission the framework left for each app to fix. CONTACT_DETAILS\n    // rather than IDENTITY: it is how the person is reached. That it also serves as the identity\n    // anchor is a property of this schema, not of the datum.\n    PersonalDataCategory.CONTACT_DETAILS,\n  ),\n  /**\n   * WHEN this address was proven to be reachable by the person who holds the account — and nothing else.\n   *\n   * ## Why a moment, and why it is not `status` (#1285)\n   *\n   * `email_verified` is an OIDC claim this application ISSUES to relying parties, and it was derived\n   * from `UserStatus.ACTIVE`. ACTIVE does not mean the address was proven: with\n   * `EmailVerificationMode.DEFERRED`, and on the password-less path, registration creates an ACTIVE\n   * account precisely so the emailed link can be the way in — the address is proven when the link is\n   * CLICKED, which may be later or never. So an application could assert to every relying party that\n   * an address was verified when nothing had verified it.\n   *\n   * The registration flow already knows the difference and says so at its own site: *\"The status gate\n   * and the verification gate are not the same gate, and conflating them is what makes this look wrong\n   * at first glance.\"* This field is that sentence made readable by everything downstream.\n   *\n   * ## Absent is UNKNOWN, never false\n   *\n   * There is no backfill, so an account verified before this field existed carries nothing. Readers\n   * therefore treat absence as unknown and OMIT the claim — which is the doctrine\n   * `oidc-user-claims.backend.service.ts` already states for itself: *\"assert the claim only when the\n   * status determines it; omit it otherwise rather than assert an unknown state.\"* Absence must not\n   * become `false`: that would tell a relying party an address is unverified when it may well have\n   * been, which is a different false statement rather than a safer one.\n   *\n   * Mirrors `UserCredentials.phoneVerifiedAt`, which has recorded the same fact for the phone channel\n   * since SMS OTP shipped. Email was the channel with no record at all.\n   *\n   * NOT `.isAuditEvidence()`, for the reason the block below gives about `email`: the act is already\n   * recorded as its own auditable event (`logUserEmailVerified`), and a moment beside a masked\n   * identity anchor does not decide authority.\n   */\n  emailVerifiedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n  // The three fields below carry `.isAuditEvidence()`: their VALUES are recorded before-and-after on\n  // the `resource_operation_performed` audit event. All three decide what the principal may do, and\n  // all three hold closed vocabulary rather than personal data — so recording them is both necessary\n  // as authorization evidence and free of personal data whose erasure obligations could reach the\n  // immutable ledger.\n  //\n  // Contrast `email` directly above, which is deliberately NOT marked: it is the identity anchor and\n  // is `.impersonalizeWith(MASK)`, i.e. a value the framework must be able to scrub on erasure.\n  // Copying it into an unscrubbable audit row would defeat that capability. That is the whole D4\n  // boundary in one file — mark what decides authority, never what identifies a person.\n  /**\n   * Account lifecycle and access posture.\n   *\n   * `.excludeFromUpdate()` since 2026-08-01. Lifecycle transitions belong to the dedicated verbs —\n   * `users | suspend_user` / `unsuspend_user` and `user_self | deactivate_account` /\n   * `reactivate_account` — which own the state machine, the reason, the audit event and the\n   * administrative-continuity floors. A generic field patch reproduces none of that, so accepting\n   * `status` on the ordinary UPDATE contract meant an administrator could retire an account through\n   * a door that asked none of those questions. Mirrors `OrganizationMemberSchema.status`, whose\n   * JSDoc has described the same rule for the same reason since before these verbs existed.\n   *\n   * ⚠️ The trusted server-side writers must therefore use `updateAsSystem`, which re-attaches the\n   * field past the repository's strict request-DTO re-parse — email verification\n   * (`PENDING_VERIFICATION → ACTIVE`), SCIM re-activation, and SCIM/IdP deprovisioning. All four\n   * were migrated in the same change, and `USERS` opts into `systemAccessPolicy.update` for exactly\n   * them. A NEW trusted writer that reaches for `servicesRegistryHandler.update` here will be\n   * SILENTLY stripped — the account simply never changes state, with no error and no signal.\n   *\n   * assurance-control: WILDO.IDENTITY.LIFECYCLE — a change to whether a principal may authenticate\n   * runs through one guarded, evidenced authority.\n   */\n  status: z.enum(UserStatus).default(UserStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence().excludeFromUpdate(),\n  appRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]).isDBIndexed().isAuditEvidence(),\n  /** User types from config (e.g. 'user', 'admin', 'consumer'). Determines auth policy, registration context. */\n  userTypes: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * When an automated sweep must return this account to `ACTIVE`.\n   *\n   * Written only by `users | suspend_user`, whose contract takes `suspensionDuration` in DAYS. The\n   * transition hook resolves that duration to an absolute instant before persisting, because a\n   * duration is only meaningful relative to a moment the row does not otherwise record.\n   *\n   * Voluntary `user_self | deactivate_account` deliberately has no schedule: an INACTIVE account\n   * returns only when its subject calls `reactivate_account`. Absent therefore means an indefinite\n   * admin suspension or a non-scheduled lifecycle state.\n   *\n   * Server-owned (`.excludeFromCreate().excludeFromUpdate()`) so the transition verbs are the only\n   * writers, and indexed because the reactivation sweep queries exactly \"rows whose scheduled\n   * reactivation has passed\". Deliberately NOT `.isAuditEvidence()`: unlike the three fields above\n   * it does not decide what the principal may do — it is a scheduling detail, and the transition's\n   * own audit event already records the reason and the resulting status.\n   *\n   * ⚠️ For admin suspension, the value is a PROMISE the reactivation batch keeps. Persisting it without that sweep would\n   * be the same defect as a verb answering success while writing nothing: an authored intention\n   * that nothing honors.\n   */\n  scheduledReactivationAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate()\n});\nexport type User = z.infer<typeof UserSchema>;\n\nexport const UserLanguagePreferencesSchema = z.object({\n  primaryLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN).isSummaryField().describe(\"The language this user reads the application in, and the language of the notification and password-reset emails sent to them. In the interface, the organization's primary language takes precedence when the organization enforces it or the user opts into the organization default, and a language the application does not offer is ignored. Defaults to `en`.\"),\n  /**\n   * The languages to use, in order, when `primaryLanguage` is one the application does not offer (#1799).\n   *\n   * Read in two places, through one ordering: the interface's language resolution tries them after the\n   * primary language and before anything it remembers or detects; the recipient language of a\n   * notification or password-reset email tries them after the primary language and before the user's\n   * regional locale. Each is used only if the application (and, in the interface, the organization)\n   * offers it. It was stored and edited and read by nothing until then.\n   *\n   * Defaults to EMPTY, not `[en]`: a fixed English default would quietly override the application's\n   * own fallback language for every user who never set this.\n   *\n   * Compact multi-select: render as a chips combobox (searchable popover) instead of a full inline\n   * checkbox column — `multipleEditMode: COMBOBOX` on the array item is the opt-in the multiple enum\n   * control reads (`resolveEnumMultipleEditMode`). The single-select `editMode` means nothing on an array item. Fits a settings-row layout where the long language list would\n   * otherwise overflow.\n   */\n  fallbackLanguages: z\n    .array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage').enumUI({ edit: { multipleEditMode: EnumMultipleEditMode.COMBOBOX } }))\n    .default([])\n    .describe('Languages to use, in order, when `primaryLanguage` is not one the application offers — in the interface, and for the notification and password-reset emails sent to this user. A language the application does not offer is skipped. Empty by default, which leaves the application\\'s own fallback in charge.'),\n  // `autoDetect` was removed (#1799). It was consulted only after the primary language had failed AND\n  // nothing was remembered, which for a signed-in user with the default `en` primary is effectively\n  // never. The application-level `appPreferences.languages.autoDetectFromBrowser` still governs the one\n  // case that remains, a first visit before anyone has signed in.\n  useOrganizationDefault: z.boolean().default(false).describe(\"When true, the interface uses the organization's primary language instead of this user's own `primaryLanguage`. Defaults to false.\"),\n});\nexport type UserLanguagePreferences = z.infer<typeof UserLanguagePreferencesSchema>;\n\nexport const UserProfileSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()`: one profile per user (1:1 composition). Backstops the eager\n  // `onParentCreate` seed + the provisioning paths against a concurrent\n  // double-create — the durable idempotency guarantee behind the declarative seed.\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  firstName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  lastName: addImpersonalizeWith(\n    z.string().min(1).max(50).isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.MASK,\n    { maskValue: ERASED_USER_NAME },\n  ),\n  displayName: addImpersonalizeWith(\n    z.string().max(100).optional().isSummaryField().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * Profile avatar — a single uploaded square image (≤ 2 MB, ≤ 1024px), stored\n   * as the standard file reference `{ fileId, updatedAt }` and rendered as a\n   * square avatar. Uses the plain `z_file()` image pipeline (upload / storage /\n   * DTO / persistence / metadata population) with no bespoke field type; the\n   * `aspectRatio 1:1` constraint enforces the square crop. Upload-only — there\n   * is no external-URL branch.\n   */\n  // REMOVE nulls the stored `{ fileId, updatedAt }` reference AND the underlying file is deleted.\n  //\n  // Corrected 2026-09-17: this said the stored object was NOT deleted, on the grounds that file bytes\n  // belong to the file resource's own lifecycle. That is not what the engine does. `userProfiles`\n  // declares a `retentionPolicy`, so `impersonalizeRowsInPlace` governs it; this field is a personal\n  // file field (REMOVE, not KEEP); and that scrub's own comment states the rule — \"a field-level\n  // scrub cannot reach INSIDE a stored blob, so a file field marked personal is only erased by\n  // deleting the file\". The deletion is sequenced as a post-commit effect on the parent transaction\n  // so a rolled-back scrub can never destroy files for a row that stayed live.\n  //\n  // The old comment under-claimed, which is the safer direction and still false — and it was\n  // load-bearing: `remove_avatar` was acknowledged as unimplementable partly by reasoning from it\n  // (#1275). A schema comment about what the product does is a claim, and this one had never been\n  // checked against the code it described.\n  avatar: addImpersonalizeWith(\n    z_file({\n      nature: FileNature.IMAGE,\n      allowedMimeTypes: 'Images',\n      maxSize: 2 * 1024 * 1024,\n      imageConstraints: {\n        maxWidth: 1024,\n        maxHeight: 1024,\n        aspectRatio: { width: 1, height: 1 },\n        generateThumbnails: true,\n      },\n    }).optional().dataCategories(PersonalDataCategory.IDENTITY),\n    RedactionType.REMOVE,\n  ),\n  // Free prose the person wrote about themselves. USER_CONTENT says what the field is FOR, never\n  // what it will contain — a bio is a classic surface where a special category (a health condition,\n  // a religious observance, a political affiliation) arrives unannounced, and no schema certifies\n  // otherwise. Nothing here is a claim that it does NOT contain one.\n  bio: addImpersonalizeWith(\n    z.string().max(500).optional().dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n  /**\n   * E.164 phone number (e.g. \"+33123456789\"). `z_phone()` carries the phone\n   * metadata that drives the international phone INPUT on edit (country selector +\n   * national number) and the formatted international DISPLAY on read — replacing\n   * the old raw `z.string().regex(...)` that surfaced the regex to the user.\n   * Stored value is still a plain E.164 string, so DTO/persistence are unchanged.\n   */\n  //\n  // A phone number is contact-detail personal data by definition, so both declarations are\n  // load-bearing here rather than a curiosity.\n  //\n  // The helper form is kept DELIBERATELY, and the reason changed on 2026-09-17. It used to be the\n  // only form that worked: `z_phone()` ends in `.pipe(z.string())`, so its constructor is `ZodPipe`,\n  // a name in no applyable-type list — and the per-instance decorator install keys on that name, so\n  // a phone schema carried NO decorators at all and the fluent form threw. That gap is closed and\n  // `z_phone().dataCategories(…).impersonalizeWith(…)` now works. What keeps the helper here is that\n  // it needs no prototype method at all, which makes this field's classification independent of the\n  // decorator-install path entirely — worth having on the one field whose misclassification is a\n  // privacy incident rather than a rendering bug.\n  phoneNumber: addImpersonalizeWith(\n    addDataCategories(z_phone().optional(), PersonalDataCategory.CONTACT_DETAILS),\n    RedactionType.REMOVE,\n  ),\n  title: addImpersonalizeWith(\n    z.string().max(100).optional().dataCategories(PersonalDataCategory.PROFESSIONAL),\n    RedactionType.REMOVE,\n  )\n});\nexport type UserProfile = z.infer<typeof UserProfileSchema>;\n\nexport const UserPreferences_NotificationsSchema = z.object({\n  email: z.boolean().default(true).describe(\"When false, notification emails about the user's own account are not sent to them. Emails the user receives because of a role they hold, notices marked as always delivered, and account-recovery emails such as password reset are sent regardless. Defaults to true.\"),\n  // `push` and `sms` were removed (#1799): the dispatcher sent neither channel — it logged \"not yet\n  // implemented\" and returned — and no notification declared either, so a user who turned push off \"to\n  // stop notifications\" turned off nothing. They come back with a channel that actually delivers.\n  inApp: z.boolean().default(true).describe(\"When false, the application's interface stops showing this user the real-time notifications the server sends them, as pop-ups or in the notification centre. Data on screen keeps updating live. Defaults to true.\")\n});\nexport type UserPreferences_Notifications = z.infer<typeof UserPreferences_NotificationsSchema>;\n\nexport const UserPreferences_UI_ThemeSchema = z.object({\n  theme: z.enum(UserTheme).default(UserTheme.AUTO).isSummaryField().describe(\"The colour scheme the interface uses for this user: `LIGHT`, `DARK`, or `AUTO` to follow the device's system setting. Applied whenever the user's preferences load, so the choice follows them across devices. Defaults to `AUTO`.\"),\n});\nexport type UserPreferences_UI_Theme = z.infer<typeof UserPreferences_UI_ThemeSchema>;\n\n/**\n * A member's OWN regional choices — and every field is OPTIONAL, deliberately.\n *\n * **Absence is a real state and it is the point of this block**: it means the member has expressed\n * no preference, so the value comes from the organization's own regional record\n * (`OrganizationPreferences.timezone` / `.locale` / `.dateFormat` / `.timeFormat`), and only then\n * from the framework fallback. `I18nContext` resolves that chain — member, then organization, then\n * framework — and it can only do so because an unexpressed preference is representable here.\n *\n * All four carried a Zod `.default(...)` until 2026-09-08 (#410), and the defaults were not a\n * convenience: they made the organization layer UNIMPLEMENTABLE. A `.default()` MATERIALIZES at\n * parse, so every member with a preferences row carried `'UTC'`, `EN`, `LOCALE_DEFAULT` and\n * `TWENTY_FOUR_HOUR` whether or not they had ever opened the settings screen — indistinguishable\n * from having chosen them. A tenant that set `Europe/Paris` could never reach a single member,\n * because there was no member left who had not \"expressed\" UTC.\n *\n * The same shape had already cost a decision elsewhere: `cancelImmediately: z.boolean().default(false)`\n * made \"the caller expressed no cancellation preference\" unobservable, which is why the authored\n * `defaultBehavior` policy beneath it was unimplementable rather than merely unimplemented (#408).\n * A default one layer up erases the state the layer beneath exists to answer for.\n *\n * `locale` in particular was also WRONG on its own terms. `I18nContext` resolves it as\n * `regional.locale ?? currentLanguage ?? 'en'`, so a materialized `EN` meant the left side always\n * won and the resolved UI language was never consulted: a member using the application in French\n * got `en` date, time and number formatting. Removing the default is what lets that `??` chain do\n * what it was written to do.\n *\n * Note what did NOT change: the framework's fallbacks are unchanged, and they are still exactly\n * these four values. A member in a tenant that has authored nothing sees precisely what they saw\n * before — the difference is only that a tenant which HAS authored something is now heard.\n */\nexport const UserPreferences_RegionalSchema = z.object({\n  timezone: TimezoneSchema.optional().isSummaryField().describe(\"The IANA time zone (for example `Europe/Paris`) in which the interface shows dates and times to this user. When omitted, the organization's time zone applies, then UTC.\"),\n  // LOCALE_DEFAULT (not ISO_8601) remains the framework FALLBACK, resolved in `I18nContext`: \"no\n  // expressed preference\" must mean locale-driven rendering. Storing it here would pin every\n  // preference-less member to it and mask both the organization layer and the locale fallback.\n  dateFormat: z.enum(DateFormat).systemEnum('DateFormat').optional().describe(\"How the interface shows dates to this user: `LOCALE_DEFAULT` follows the conventions of the resolved locale, every other value is a fixed pattern. When omitted, the organization's date format applies, then `LOCALE_DEFAULT`.\"),\n  timeFormat: z.enum(TimeFormat).systemEnum('TimeFormat').optional().describe(\"Whether the interface shows times to this user on a 12-hour (`12h`) or 24-hour (`24h`) clock. When omitted, the organization's setting applies, then `24h`.\"),\n  locale: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').optional().isSummaryField().describe(\"The language tag (for example `en-GB`) whose conventions the interface uses to format dates, times and numbers for this user. When omitted, the organization's locale applies, then the language the interface is shown in. It is also published as the `locale` claim to OpenID Connect clients.\")\n});\nexport type UserPreferences_Regional = z.infer<typeof UserPreferences_RegionalSchema>;\n\n/**\n * The preference blocks a caller can address as a unit — the closed vocabulary behind\n * `reset_to_defaults` on USER_SELF_PREFERENCES.\n *\n * **Every value IS the persisted field name on {@link UserPreferencesSchema}.** That is the\n * point of the enum, not a coincidence: it lets the reset patch be DERIVED from the vocabulary\n * instead of routed through a hand-written flag-to-field map. The previous contract was six\n * booleans (`resetNotifications`, `resetUI`, …) that named no schema path, so the whole request\n * was stripped before persistence and the route answered 200 having reset nothing.\n *\n * Adding a preference group to the schema means adding a member here; the mapped type in\n * `user-preferences-reset.shared.utils.ts` then refuses to compile until the group declares how\n * it resets. Renaming a group field without renaming the value fails the same way.\n *\n * Note `LANGUAGE = 'languagePreferences'` — the member reads as the concept, the value is the\n * field. Do not \"tidy\" the value to `language`; it is an address, not a label.\n */\nexport enum UserPreferenceGroup {\n  NOTIFICATIONS = 'notifications',\n  PRIVACY = 'privacy',\n  UI = 'ui',\n  REGIONAL = 'regional',\n  LANGUAGE = 'languagePreferences',\n}\n\nexport const UserPreferencesSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  // `.isUnique()` is the idempotency backstop for onParentCreate seeding: the eager\n  // seed (and any retry) is deduplicated at the DB layer — a second seed for the same\n  // user fails the unique constraint and is swallowed, guaranteeing exactly one\n  // preferences row per user. (Prod migration note: dedupe any pre-existing duplicate\n  // userId rows before this index builds; preferences was seeded nowhere pre-feature,\n  // so duplicates are unexpected.)\n  userId: z.string().min(1).isDBIndexed().isUnique().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // ── Which preference blocks are data ABOUT the person, and which are rendering state ──\n  //\n  // Declared at the BLOCK, not on the leaves inside it. The resolver walks TOP-LEVEL fields only —\n  // the same limit the subject-export compiler and the impersonalize writer have — so a category on\n  // `regional.timezone` would be invisible. That is not a workaround: a notice enumerates KINDS, and\n  // \"communication preferences\" is the kind, not \"the sms boolean\".\n  //\n  // `ui` is deliberately NOT declared. A theme choice is about how the SYSTEM renders for someone,\n  // not a fact about them — the same line that keeps job executions, entitlement limits and unread\n  // counters out of the inventory. The three below are the other side of it: how the person wants to\n  // be CONTACTED, what they decided about their own privacy, and where and in what language they\n  // are — each a fact about them that a notice owes an answer on.\n  //\n  // USAGE rather than a preference-specific category. The vocabulary is deliberately coarse where it\n  // is ours: a member per settings screen is a granularity nobody maintains, and it would tell a\n  // reader nothing the word \"preferences\" does not.\n  notifications: addImpersonalizeWith(\n    UserPreferences_NotificationsSchema.default(UserPreferences_NotificationsSchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n  \n  // CREATE cannot carry the consent decision, because the row is SEEDED (the USERS → USER_PREFERENCES\n  // `onParentCreate` composition writes only the parent key) and a person has decided nothing at that\n  // point. Every door that writes a decision emits a row: the gate, the self and admin UPDATE, the\n  // RESET, and `carry_anonymous_consent`. CREATE sits below the automatic audit floor, so a consent\n  // accepted there would be stored with no trace, which is what\n  // `evidence-requirement:consent-decision-transition-record` C2 forbids. The control marker for that\n  // objective sits on the decision leaf itself (`UserPrivacySchema.consentedPurposes`); this site only\n  // narrows which verbs can reach it.\n  privacy: addImpersonalizeWith(\n    UserPrivacySchema.default(UserPrivacySchema.parse({}))\n      .dataCategories(PersonalDataCategory.USAGE)\n      .excludeFromCreate(),\n    RedactionType.RESET,\n  ),\n  \n  ui: UserPreferences_UI_ThemeSchema.default(UserPreferences_UI_ThemeSchema.parse({})).isSummaryField(),\n  \n  // Timezone and locale are the two that most clearly identify something about the person rather\n  // than about the session — a timezone narrows where they are, which is why LOCATION rides here.\n  // LOCATION as well as USAGE — a timezone and a locale narrow where a person is. RESET returns the\n  // application's own defaults, which is what a person who never chose still has.\n  regional: addImpersonalizeWith(\n    UserPreferences_RegionalSchema.default(UserPreferences_RegionalSchema.parse({})).isSummaryField()\n      .dataCategories([PersonalDataCategory.USAGE, PersonalDataCategory.LOCATION]),\n    RedactionType.RESET,\n  ),\n  \n  // Enhanced language preferences\n  languagePreferences: addImpersonalizeWith(\n    UserLanguagePreferencesSchema.default(UserLanguagePreferencesSchema.parse({})).isSummaryField()\n      .dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  )\n});\nexport type UserPreferences = z.infer<typeof UserPreferencesSchema>;\n\n/**\n * The hand-authored mirror of the auto-generated `USER_SELF` CONTEXT response.\n *\n * Every field name here MUST be the one `addRelationshipPlaceholders` declares on the generated\n * `contextDto`, i.e. `Resources_SharedUtils.resolveRelationshipObjectIdentity(...).objectFieldName`\n * for the relationship. This schema is a TYPE for consumers (the frontend casts the context read to\n * it, and the auth response embeds it); it does not validate the response, so a name that drifts\n * from the generated DTO is invisible until someone reads a field that is never there.\n *\n * `userSelfPreferences` is PLURAL because `USER_SELF_PREFERENCES` declares\n * `resourceFieldIdentifier: 'userSelfPreferencesId'` and the DTO's field name is that identifier's\n * base — unlike `userSelfProfile`, whose identifier is already singular (`userSelfProfileId`). It\n * read `userSelfPreference` until 2026-09-10, which is the name the POPULATION side used to\n * produce; the generated DTO never declared it, so the populated preferences were Zod-stripped on\n * the way out and no application ever received them (issue #563).\n */\nexport const UserContextSchema = UserSchema.extend({\n  // Relationship-based field names — must match the auto-generated context DTO exactly.\n  userSelfProfile: UserProfileSchema.optional(),\n  userSelfPreferences: UserPreferencesSchema.optional(),\n  organizationMembers: z.array(OrganizationMemberSchema).optional(),\n});\nexport type UserContext = z.infer<typeof UserContextSchema>; \n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wildo-ai/saas-models",
-  "version": "1.1.7",
+  "version": "1.1.9",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Shared TypeScript types and Zod schemas for SaaS infrastructure",
   "author": "Wildo AI",
@@ -60,9 +60,9 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@wildo-ai/external-connectors-models": "1.1.7",
-    "@wildo-ai/presets-components-models": "1.1.7",
-    "@wildo-ai/zod-decorators": "1.1.7"
+    "@wildo-ai/external-connectors-models": "1.1.9",
+    "@wildo-ai/presets-components-models": "1.1.9",
+    "@wildo-ai/zod-decorators": "1.1.9"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "4.0.15",

package/dist/esm/__tests__/setup.d.ts

@@ -1,2 +0,0 @@
-import 'reflect-metadata';
-//# sourceMappingURL=setup.d.ts.map

package/dist/esm/__tests__/setup.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../src/__tests__/setup.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC"}