In `@apps/meteor/app/lib/server/functions/saveUser/saveUser.ts`:
- Around line 127-129: The call to setStatusText currently unsafely casts
userData to IUser; instead pass the full existing user document oldUserData
(which contains required fields like createdAt, roles, type, active, _updatedAt)
as the user argument and keep userData.statusText as the new status string;
update the call from setStatusText(userData as IUser, userData.statusText, {
updater, session }) to setStatusText(oldUserData, userData.statusText, {
updater, session }) so setStatusText receives a complete IUser for presence
broadcast while using the incoming SaveUserData.statusText as the new value.

In `@apps/meteor/app/message-pin/server/pinMessage.ts`:
- Line 112: In pinMessage, the Apps.self?.triggerEvent call passes an undefined
variable user; replace that argument with the existing me object (the
authenticated user retrieved earlier in pinMessage) so the event uses the
correct user object (update the AppEvents.IPostMessagePinned invocation to pass
me instead of user and scan pinMessage for any other references to user that
should be me).
- Line 192: The unpinMessage function calls
Apps.self?.triggerEvent(AppEvents.IPostMessagePinned, originalMessage, user,
originalMessage.pinned) but the variable is named me in this scope; update the
call in unpinMessage to pass the correct user object (me) instead of undefined
user—i.e., replace user with me (or assign const user = me earlier) so
Apps.self?.triggerEvent and any related code use the defined user variable.

In `@apps/meteor/app/slashcommands-status/server/status.ts`:
- Around line 17-24: The Users.findOneById call uses a too-narrow projection
(only language) but setUserStatusMethod ultimately calls setStatusText which
expects user.statusText, user.username, user.status, user.name, and user.roles;
update the projection used in Users.findOneById to include these fields so the
user object passed to setUserStatusMethod/setStatusText has statusText,
username, status, name, roles (in addition to language/_id).

In `@apps/meteor/app/api/server/helpers/getUserFromParams.ts`:
- Around line 6-7: The function getUserFromParams is missing an explicit return
type and uses an untyped let user;—add a proper return type annotation (e.g.,
the same Promise<User | null> or the exact union used by getUserListFromParams)
to the function signature and type the internal user variable accordingly so
callers can statically access ._id and .username; mirror the return type/pattern
from getUserListFromParams and update getUserFromParams's signature and user
declaration to match.

In `@apps/meteor/app/2fa/server/twoFactorRequired.ts`:
- Line 6: The AuthenticatedContext type declares connection as required but the
wrapper and checkCodeForUser treat it as optional; change the
AuthenticatedContext definition (AuthenticatedContext) to make connection
optional (connection?: Meteor.Connection) so it matches checkCodeForUser's
signature and removes the need for defensive this.connection || undefined usage
in the wrapper functions that call checkCodeForUser.
- Around line 8-15: The exported twoFactorRequired wrapper incorrectly exposes a
non-Promise return type because the wrapper is async; update its generic
signature so the returned function type reflects a Promise by either
constraining TFunction to async functions (e.g. TFunction extends (...args:any)
=> Promise<any>) or change the asserted return type to
Promise<Awaited<ReturnType<TFunction>>>; adjust the cast on the returned async
function accordingly and keep the existing type checks involving
ThisParameterType<TFunction>, ReturnType<TFunction>, and ITwoFactorOptions in
sync with the new Promise-wrapped return type.