package dev.ulfrx.recipe.shared.dto

import kotlinx.serialization.Serializable

/**
 * Authenticated user identity shared by client and server (D-25, D-27).
 *
 * Phase 2 always emits `User` in the [dev.ulfrx.recipe.shared.dto.MeResponse] payload;
 * Phase 3 will extend the response with a household lookup but `User` itself stays
 * stable. `id` is a server-issued UUID serialized as a string so the shared module
 * stays free of Exposed / SQLDelight / kotlin.uuid dependencies (D-19 / INFRA-06).
 *
 * Field semantics:
 * - [id] — server primary key (`users.id` UUID per D-24).
 * - [sub] — opaque OIDC subject claim from Authentik; the only stable identity key
 *   for JIT provisioning per D-25.
 * - [email] — most recent `email` claim. May change between logins (D-25 upserts).
 * - [displayName] — most recent `name` / `preferred_username` claim (D-25).
 */
@Serializable
public data class User(
    public val id: String,
    public val sub: String,
    public val email: String,
    public val displayName: String,
)
