@7365admin1/core 3.142.0 → 3.144.0

package/dist/index.js

@@ -344,6 +344,7 @@ __export(src_exports, {
   SERVICE_TYPE_LABELS: () => SERVICE_TYPE_LABELS,
   SITE_STATES_MAX: () => SITE_STATES_MAX,
   SOFTWARE_VERSION_ENDPOINT: () => SOFTWARE_VERSION_ENDPOINT,
+  STAFF_CLIENT_PERMISSIONS: () => STAFF_CLIENT_PERMISSIONS,
   STAFF_VIEW_APPS: () => STAFF_VIEW_APPS,
   STAFF_VIEW_HISTORY_ACTIONS: () => STAFF_VIEW_HISTORY_ACTIONS,
   SUBCONTRACT_ADMIN_REFUSAL: () => SUBCONTRACT_ADMIN_REFUSAL,
@@ -959,6 +960,7 @@ __export(src_exports, {
   snapshotRefusalReason: () => snapshotRefusalReason,
   splitRobotSn: () => splitRobotSn,
   staffMayBypass: () => staffMayBypass,
+  staffReachesEveryClient: () => staffReachesEveryClient,
   staffViewWriteAudit: () => staffViewWriteAudit,
   startDemoTracking: () => startDemoTracking,
   startPadbotDrive: () => startPadbotDrive,
@@ -5999,6 +6001,100 @@ var import_mongodb17 = require("mongodb");
 // src/utils/super-admin.util.ts
 var import_node_server_utils17 = require("@7365admin1/node-server-utils");
 var import_mongodb16 = require("mongodb");
+
+// src/utils/console-permission.util.ts
+var CONSOLE_PERMISSIONS = Object.freeze({
+  organizations: Object.freeze([
+    "see-all-organizations",
+    "see-organization-details"
+  ]),
+  "promo-codes": Object.freeze([
+    "create-promo-code",
+    "see-promo-code-details",
+    "edit-promo-code-details",
+    "change-promo-code-status",
+    "delete-promo-code"
+  ]),
+  users: Object.freeze(["see-all-users", "see-user-details"]),
+  invitations: Object.freeze([
+    "create-invitation",
+    "view-invitations",
+    "cancel-invitation"
+  ]),
+  subscriptions: Object.freeze([
+    "see-all-subscriptions",
+    "see-subscription-details",
+    "manage-subscription"
+  ]),
+  "sp-approvals": Object.freeze([
+    "see-all-sp-approvals",
+    "approve-sp",
+    "reject-sp",
+    "delete-sp-approval"
+  ]),
+  "marketplace-vendors": Object.freeze([
+    "see-all-marketplace-vendors",
+    "see-marketplace-vendor-details"
+  ]),
+  "platform-terms": Object.freeze([
+    "see-platform-terms",
+    "edit-platform-terms"
+  ]),
+  "activity-history": Object.freeze(["see-activity-history"]),
+  members: Object.freeze([
+    "view-members",
+    "assign-member-role",
+    "suspend-member",
+    "activate-member",
+    "delete-member"
+  ]),
+  "roles-and-permissions": Object.freeze([
+    "add-role",
+    "see-all-roles",
+    "see-role-details",
+    "update-role",
+    "delete-role"
+  ])
+});
+var RESOURCE_SPELLINGS = Object.freeze({
+  "roles-and-permissions": Object.freeze([
+    "roles-and-permissions",
+    "roles"
+  ]),
+  roles: Object.freeze(["roles", "roles-and-permissions"])
+});
+function consoleSpellings(resource, action) {
+  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
+  return resources.map((name2) => `${name2}:${action}`);
+}
+function consoleRoleAllowsAll(held) {
+  if (!Array.isArray(held) || held.length === 0)
+    return true;
+  return held.includes("*");
+}
+function consoleRoleAllows(held, resource, action) {
+  if (consoleRoleAllowsAll(held))
+    return true;
+  const actions = CONSOLE_PERMISSIONS[resource];
+  if (!actions?.length)
+    return false;
+  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
+  return wanted.some(
+    (name2) => consoleSpellings(resource, name2).some(
+      (spelling) => held.includes(spelling)
+    )
+  );
+}
+var CROSS_CLIENT_GRANT = {
+  resource: "organizations"
+};
+function staffMayBypass(actor, grant = CROSS_CLIENT_GRANT) {
+  if (!actor.isSuperAdmin)
+    return false;
+  return consoleRoleAllows(actor.staffPermissions, grant.resource, grant.action);
+}
+
+// src/utils/super-admin.util.ts
 var LIVE_ROLE = { status: { $ne: "deleted" } };
 async function resolveStaffRole(userId) {
   const id = userId?.toString() ?? "";
@@ -6038,6 +6134,13 @@ async function isSuperAdmin(userId) {
 async function isPlatformOwner(userId) {
   return (await resolveStaffRole(userId))?.default === true;
 }
+async function staffReachesEveryClient(userId) {
+  const role = await resolveStaffRole(userId);
+  if (!role)
+    return false;
+  return consoleRoleAllows(role.permissions, "organizations");
+}
+var STAFF_CLIENT_PERMISSIONS = Object.freeze(["*"]);
 
 // src/utils/org-suspension.util.ts
 var ORG_SUSPENDED_MESSAGE = "Your organisation's access is currently suspended. Please contact your administrator.";
@@ -6212,11 +6315,11 @@ function useAuthService() {
         "Refresh token already used. Please log in again."
       );
     }
-    const client2 = import_node_server_utils19.useAtlas.getClient();
-    if (!client2) {
+    const client3 = import_node_server_utils19.useAtlas.getClient();
+    if (!client3) {
       throw new import_node_server_utils19.InternalServerError("Unable to connect to server.");
     }
-    const dbSession = client2.startSession();
+    const dbSession = client3.startSession();
     let newRefreshToken;
     try {
       dbSession.startTransaction();
@@ -9273,7 +9376,7 @@ var SP_INVITE_TYPES = [
 function escapeRegex(value) {
   return String(value ?? "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function relationshipMatch(org, relationship, client2) {
+function relationshipMatch(org, relationship, client3) {
   const self = [org, String(org)];
   const match = {};
   const and = [];
@@ -9282,9 +9385,9 @@ function relationshipMatch(org, relationship, client2) {
   } else if (relationship === "served") {
     and.push({ siteOrg: { $nin: [...self, null, ""] } });
   }
-  if (client2) {
+  if (client3) {
     and.push(
-      { siteOrg: { $in: [client2, String(client2)] } },
+      { siteOrg: { $in: [client3, String(client3)] } },
       { siteOrg: { $nin: self } }
     );
   }
@@ -9447,7 +9550,7 @@ function useCustomerSiteRepo() {
     status = "active",
     siteScope = null,
     relationship = "",
-    client: client2 = "",
+    client: client3 = "",
     category = ""
   }, session) {
     page2 = page2 > 0 ? page2 - 1 : 0;
@@ -9461,9 +9564,9 @@ function useCustomerSiteRepo() {
       status
     };
     let clientId = null;
-    if (client2) {
+    if (client3) {
       try {
-        clientId = new import_mongodb26.ObjectId(client2);
+        clientId = new import_mongodb26.ObjectId(client3);
       } catch (error) {
         throw new import_node_server_utils28.BadRequestError("Invalid client ID format.");
       }
@@ -9486,8 +9589,8 @@ function useCustomerSiteRepo() {
     }
     if (relationship)
       cacheOptions.relationship = relationship;
-    if (client2)
-      cacheOptions.client = client2;
+    if (client3)
+      cacheOptions.client = client3;
     if (category)
       cacheOptions.category = category;
     const cacheKey = (0, import_node_server_utils28.makeCacheKey)(namespace_collection3, cacheOptions);
@@ -12311,98 +12414,6 @@ async function recordConsoleAction(entry) {
   }
 }
 
-// src/utils/console-permission.util.ts
-var CONSOLE_PERMISSIONS = Object.freeze({
-  organizations: Object.freeze([
-    "see-all-organizations",
-    "see-organization-details"
-  ]),
-  "promo-codes": Object.freeze([
-    "create-promo-code",
-    "see-promo-code-details",
-    "edit-promo-code-details",
-    "change-promo-code-status",
-    "delete-promo-code"
-  ]),
-  users: Object.freeze(["see-all-users", "see-user-details"]),
-  invitations: Object.freeze([
-    "create-invitation",
-    "view-invitations",
-    "cancel-invitation"
-  ]),
-  subscriptions: Object.freeze([
-    "see-all-subscriptions",
-    "see-subscription-details",
-    "manage-subscription"
-  ]),
-  "sp-approvals": Object.freeze([
-    "see-all-sp-approvals",
-    "approve-sp",
-    "reject-sp",
-    "delete-sp-approval"
-  ]),
-  "marketplace-vendors": Object.freeze([
-    "see-all-marketplace-vendors",
-    "see-marketplace-vendor-details"
-  ]),
-  "platform-terms": Object.freeze([
-    "see-platform-terms",
-    "edit-platform-terms"
-  ]),
-  "activity-history": Object.freeze(["see-activity-history"]),
-  members: Object.freeze([
-    "view-members",
-    "assign-member-role",
-    "suspend-member",
-    "activate-member",
-    "delete-member"
-  ]),
-  "roles-and-permissions": Object.freeze([
-    "add-role",
-    "see-all-roles",
-    "see-role-details",
-    "update-role",
-    "delete-role"
-  ])
-});
-var RESOURCE_SPELLINGS = Object.freeze({
-  "roles-and-permissions": Object.freeze([
-    "roles-and-permissions",
-    "roles"
-  ]),
-  roles: Object.freeze(["roles", "roles-and-permissions"])
-});
-function consoleSpellings(resource, action) {
-  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
-  return resources.map((name2) => `${name2}:${action}`);
-}
-function consoleRoleAllowsAll(held) {
-  if (!Array.isArray(held) || held.length === 0)
-    return true;
-  return held.includes("*");
-}
-function consoleRoleAllows(held, resource, action) {
-  if (consoleRoleAllowsAll(held))
-    return true;
-  const actions = CONSOLE_PERMISSIONS[resource];
-  if (!actions?.length)
-    return false;
-  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
-  return wanted.some(
-    (name2) => consoleSpellings(resource, name2).some(
-      (spelling) => held.includes(spelling)
-    )
-  );
-}
-var CROSS_CLIENT_GRANT = {
-  resource: "organizations"
-};
-function staffMayBypass(actor, grant = CROSS_CLIENT_GRANT) {
-  if (!actor.isSuperAdmin)
-    return false;
-  return consoleRoleAllows(actor.staffPermissions, grant.resource, grant.action);
-}
-
 // src/services/module-gate.service.ts
 var idOf4 = (v) => v == null ? "" : String(v?._id ?? v).toLowerCase();
 var isId = (v) => /^[0-9a-f]{24}$/i.test(v);
@@ -19119,6 +19130,76 @@ function useVehicleRepo() {
   };
 }
 
+// src/services/spaces-object.service.ts
+var import_client_s3 = require("@aws-sdk/client-s3");
+
+// src/utils/spaces-object.util.ts
+function spacesUploadAcl(key2, setting = process.env.SPACES_PRIVATE_PREFIXES ?? "") {
+  const prefixes = String(setting).split(",").map((p) => p.trim()).filter(Boolean);
+  if (prefixes.includes("*"))
+    return "private";
+  return prefixes.some((p) => String(key2).startsWith(p)) ? "private" : "public-read";
+}
+var KEY = /^(?:[A-Za-z0-9_-]{1,64}\/){0,4}[a-f0-9]{24}$/;
+function isServableObjectKey(key2) {
+  return typeof key2 === "string" && KEY.test(key2);
+}
+function anprSiteOfKey(key2) {
+  const m = /^anpr\/([a-f0-9]{24})\//.exec(key2);
+  return m ? m[1] : null;
+}
+var INLINE_TYPES = /^(image\/(jpeg|png|gif|webp|heic|heif|bmp)|application\/pdf|video\/(mp4|webm|quicktime)|audio\/(mpeg|mp4|wav|webm|ogg))$/;
+function servedObjectHeaders(contentType) {
+  const type = String(contentType ?? "").split(";")[0].trim().toLowerCase();
+  const inline = INLINE_TYPES.test(type);
+  return {
+    "Content-Type": inline ? type : "application/octet-stream",
+    "Content-Disposition": inline ? "inline" : "attachment",
+    "X-Content-Type-Options": "nosniff",
+    "Content-Security-Policy": "default-src 'none'; sandbox",
+    "Cache-Control": "private, max-age=300"
+  };
+}
+
+// src/services/spaces-object.service.ts
+var client = null;
+function s3() {
+  if (!client) {
+    client = new import_client_s3.S3Client({
+      endpoint: SPACES_ENDPOINT,
+      region: SPACES_REGION,
+      credentials: { accessKeyId: SPACES_ACCESS_KEY, secretAccessKey: SPACES_SECRET_KEY },
+      forcePathStyle: true
+    });
+  }
+  return client;
+}
+async function putSpacesObject({
+  key: key2,
+  body,
+  contentType
+}) {
+  await s3().send(
+    new import_client_s3.PutObjectCommand({
+      Bucket: SPACES_BUCKET,
+      Key: key2,
+      Body: body,
+      ACL: spacesUploadAcl(key2),
+      ContentType: contentType,
+      ContentLength: body.length
+    })
+  );
+  return "Successfully uploaded file.";
+}
+async function getSpacesObject(key2) {
+  const res = await s3().send(new import_client_s3.GetObjectCommand({ Bucket: SPACES_BUCKET, Key: key2 }));
+  return {
+    body: res.Body,
+    contentType: res.ContentType,
+    contentLength: res.ContentLength
+  };
+}
+
 // src/repositories/file.repo.ts
 var import_node_server_utils52 = require("@7365admin1/node-server-utils");
 
@@ -19298,7 +19379,7 @@ function useFileService() {
     deleteFileById,
     getAllDraftedFiles
   } = useFileRepo();
-  const s32 = new import_node_server_utils53.useS3({
+  const s33 = new import_node_server_utils53.useS3({
     accessKeyId: SPACES_ACCESS_KEY,
     secretAccessKey: SPACES_SECRET_KEY,
     endpoint: SPACES_ENDPOINT,
@@ -19317,7 +19398,7 @@ function useFileService() {
     };
     try {
       const id = await _createFile(file, session);
-      await s32.uploadObject({
+      await putSpacesObject({
         key: `${folder}/${id}`,
         body: value.buffer,
         contentType: value.mimetype
@@ -19336,7 +19417,7 @@ function useFileService() {
     session?.startTransaction();
     try {
       await deleteFileById(id, session);
-      await s32.deleteObject(id);
+      await s33.deleteObject(id);
       await session?.commitTransaction();
       return "File deleted successfully.";
     } catch (error) {
@@ -23291,6 +23372,9 @@ async function getUserPermissions(params) {
   if (!db3) {
     return [];
   }
+  if (await staffReachesEveryClient(user)) {
+    return [...STAFF_CLIENT_PERMISSIONS];
+  }
   let roleId = grantingRole;
   let memberSite = params.memberSite;
   let memberId;
@@ -23431,6 +23515,12 @@ function useCameraViewService() {
       engagedOrgs,
       prefer: params.prefer
     });
+    if (!grant && await staffReachesEveryClient(params.userId)) {
+      return {
+        memberships,
+        grant: { org: params.site?.orgId ?? params.site?.org, siteId: params.siteObjectId }
+      };
+    }
     return { memberships, grant };
   }
   async function permissionsForGrant(userId, grant, memberships) {
@@ -26272,7 +26362,7 @@ function useServiceProviderInviteService() {
     const runs = import_mongodb57.ObjectId.isValid(id) && actor.memberships.some(
       (m) => m.org === id && (m.companyWideRole === true || !m.siteId && m.orgLevelRole === true)
     );
-    if (!runs) {
+    if (!runs && !staffMayBypass(actor)) {
       throw new import_node_server_utils62.UnauthorizedError(
         "Only an administrator of that company can answer this invitation for it."
       );
@@ -27277,7 +27367,7 @@ function useUserService() {
       session?.endSession();
     }
   }
-  const s32 = new import_node_server_utils64.useS3({
+  const s33 = new import_node_server_utils64.useS3({
     accessKeyId: SPACES_ACCESS_KEY,
     secretAccessKey: SPACES_SECRET_KEY,
     endpoint: SPACES_ENDPOINT,
@@ -27298,14 +27388,14 @@ function useUserService() {
     };
     try {
       const id = await createFile(_file, session);
-      await s32.uploadObject({
+      await putSpacesObject({
         key: id,
         body: file.buffer,
         contentType: file.mimetype
       });
       if (previousProfile) {
         await deleteFileById(previousProfile, session);
-        await s32.deleteObject(previousProfile);
+        await s33.deleteObject(previousProfile);
       }
       await _updateUserFieldById(
         { _id: user, field: "profile", value: id },
@@ -31409,10 +31499,38 @@ function useFileController() {
       next(error2);
     }
   }
+  async function viewObject(req, res, next) {
+    const key2 = String(req.params?.[0] ?? "");
+    if (!isServableObjectKey(key2)) {
+      res.status(404).json({ message: "File not found." });
+      return;
+    }
+    try {
+      const site = anprSiteOfKey(key2);
+      if (site)
+        await requireSiteReach(req, site);
+      const object = await getSpacesObject(key2);
+      res.set(servedObjectHeaders(object.contentType));
+      if (object.contentLength)
+        res.set("Content-Length", String(object.contentLength));
+      object.body.pipe(res);
+      return;
+    } catch (error) {
+      const status = error?.$metadata?.httpStatusCode ?? error?.statusCode ?? error?.status;
+      if (status === 404 || status === 403 || error?.name === "NoSuchKey" || error?.name === "NotFoundError") {
+        res.status(404).json({ message: "File not found." });
+        return;
+      }
+      import_node_server_utils78.logger.log({ level: "error", message: error?.message });
+      next(error);
+      return;
+    }
+  }
   return {
     upload,
     deleteFile,
-    getFileById
+    getFileById,
+    viewObject
   };
 }
 
@@ -37572,8 +37690,8 @@ function useServiceProviderController() {
       if (siteId)
         await requireSiteReach(req, siteId);
       const engagements = req.query.include === "engagements" && siteId && status === "active" && !orgId && !serviceProviderOrgId;
-      const client2 = engagements ? await isSiteClient(req, siteId) : false;
-      const data = client2 ? await _getServiceProvidersForSite({ search, page: page2, limit, siteId }) : engagements ? (
+      const client3 = engagements ? await isSiteClient(req, siteId) : false;
+      const data = client3 ? await _getServiceProvidersForSite({ search, page: page2, limit, siteId }) : engagements ? (
         // A provider's own Service Providers page: the subcontractors it
         // brought onto this site, never the client's other contractors,
         // plus the stored rows it already saw here.
@@ -47235,7 +47353,7 @@ function useCustomerSiteController() {
     const org = req.query.org ?? "";
     const status = req.query.status ?? "active";
     const relationship = req.query.relationship || "";
-    const client2 = req.query.client || "";
+    const client3 = req.query.client || "";
     const category = req.query.category || "";
     const sortObj = {};
     const sortFields = String(req.query.sort).split(",");
@@ -47258,7 +47376,7 @@ function useCustomerSiteController() {
         status,
         siteScope,
         relationship,
-        client: client2,
+        client: client3,
         category
       });
       res.json(data);
@@ -48547,12 +48665,12 @@ function useAttendanceService() {
 }
 
 // src/services/attendance-photo.service.ts
-var import_client_s3 = require("@aws-sdk/client-s3");
+var import_client_s32 = require("@aws-sdk/client-s3");
 var ATTENDANCE_PHOTO_FOLDER = "attendance-private";
-var client = null;
-function s3() {
-  if (!client) {
-    client = new import_client_s3.S3Client({
+var client2 = null;
+function s32() {
+  if (!client2) {
+    client2 = new import_client_s32.S3Client({
       endpoint: SPACES_ENDPOINT,
       region: SPACES_REGION,
       credentials: {
@@ -48562,12 +48680,12 @@ function s3() {
       forcePathStyle: true
     });
   }
-  return client;
+  return client2;
 }
 var s3AttendancePhotoStore = {
   async put(key2, body, contentType) {
-    await s3().send(
-      new import_client_s3.PutObjectCommand({
+    await s32().send(
+      new import_client_s32.PutObjectCommand({
         Bucket: SPACES_BUCKET,
         Key: key2,
         Body: body,
@@ -48578,8 +48696,8 @@ var s3AttendancePhotoStore = {
     );
   },
   async get(key2) {
-    const res = await s3().send(
-      new import_client_s3.GetObjectCommand({ Bucket: SPACES_BUCKET, Key: key2 })
+    const res = await s32().send(
+      new import_client_s32.GetObjectCommand({ Bucket: SPACES_BUCKET, Key: key2 })
     );
     const bytes = await res.Body.transformToByteArray();
     return { body: Buffer.from(bytes), contentType: res.ContentType };
@@ -53140,20 +53258,20 @@ function createVisitorQrCredential(visitorId, readerId, qrValue) {
   const token = qrValue || `VIS${import_crypto4.default.randomBytes(12).toString("hex").toUpperCase()}`;
   return { credentialId, object: "qrcodes", value: token, qrValue: token };
 }
-async function configureVisitorQrReader(client2) {
+async function configureVisitorQrReader(client3) {
   const requestedConfiguration = {
     general: ["online", "local_identification"],
     face_id: ["qrcode_legacy_mode_enabled"],
     identifier: ["qrcode_identification_enabled", "multi_factor_authentication"]
   };
-  const currentConfiguration = await client2.getConfiguration(requestedConfiguration);
+  const currentConfiguration = await client3.getConfiguration(requestedConfiguration);
   const current = isUnknownRecord2(currentConfiguration) ? currentConfiguration : {};
   const currentGeneral = isUnknownRecord2(current.general) ? current.general : {};
   const currentFaceId = isUnknownRecord2(current.face_id) ? current.face_id : {};
   const currentIdentifier = isUnknownRecord2(current.identifier) ? current.identifier : {};
   let changed = false;
   if (String(currentGeneral.online ?? "") !== "0" || String(currentGeneral.local_identification ?? "") !== "1") {
-    await client2.setConfiguration({
+    await client3.setConfiguration({
       general: {
         online: "0",
         local_identification: "1"
@@ -53162,13 +53280,13 @@ async function configureVisitorQrReader(client2) {
     changed = true;
   }
   if (String(currentFaceId.qrcode_legacy_mode_enabled ?? "") !== VISITOR_QR_FORMAT) {
-    await client2.setConfiguration({
+    await client3.setConfiguration({
       face_id: { qrcode_legacy_mode_enabled: VISITOR_QR_FORMAT }
     });
     changed = true;
   }
   if (String(currentIdentifier.qrcode_identification_enabled ?? "") !== "1" || String(currentIdentifier.multi_factor_authentication ?? "") !== "0") {
-    await client2.setConfiguration({
+    await client3.setConfiguration({
       identifier: {
         qrcode_identification_enabled: "1",
         // A visitor pass is a single QR credential. Leaving MFA enabled makes
@@ -53178,7 +53296,7 @@ async function configureVisitorQrReader(client2) {
     });
     changed = true;
   }
-  const configuration = await client2.getConfiguration(requestedConfiguration);
+  const configuration = await client3.getConfiguration(requestedConfiguration);
   const savedConfiguration = isUnknownRecord2(configuration) ? configuration : {};
   const general = isUnknownRecord2(savedConfiguration.general) ? savedConfiguration.general : {};
   const faceId = isUnknownRecord2(savedConfiguration.face_id) ? savedConfiguration.face_id : {};
@@ -53190,7 +53308,7 @@ async function configureVisitorQrReader(client2) {
   }
   return changed;
 }
-async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUserId, scope = "visitor") {
+async function ensureVisitorAccessAuthorization(client3, readerId, reader, hidUserId, scope = "visitor") {
   const accessLabel = scope === "visitor" ? "Visitor" : "Facial";
   const accessRuleId = createStableHidId(`${scope}-access-rule:${readerId}`);
   const timeZoneId = createStableHidId(`${scope}-time-zone:${readerId}`);
@@ -53200,25 +53318,25 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
     type: 1,
     priority: 0
   };
-  const existingRuleResponse = await client2.loadObjects({
+  const existingRuleResponse = await client3.loadObjects({
     object: "access_rules",
     where: { access_rules: { id: accessRuleId } },
     limit: 1,
     offset: 0
   });
   if (getHidObjectRows(existingRuleResponse, "access_rules").length) {
-    await client2.modifyObjects({
+    await client3.modifyObjects({
       object: "access_rules",
       where: { access_rules: { id: accessRuleId } },
       values: accessRuleValues
     });
   } else {
-    await client2.createObjects({
+    await client3.createObjects({
       object: "access_rules",
       values: [{ id: accessRuleId, ...accessRuleValues }]
     });
   }
-  const verifiedAccessRuleResponse = await client2.loadObjects({
+  const verifiedAccessRuleResponse = await client3.loadObjects({
     object: "access_rules",
     where: { access_rules: { id: accessRuleId } },
     limit: 1,
@@ -53232,20 +53350,20 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
       "The HID reader did not save the visitor access rule. Try issuing the QR code again."
     );
   }
-  const existingTimeZoneResponse = await client2.loadObjects({
+  const existingTimeZoneResponse = await client3.loadObjects({
     object: "time_zones",
     where: { time_zones: { id: timeZoneId } },
     limit: 1,
     offset: 0
   });
   if (getHidObjectRows(existingTimeZoneResponse, "time_zones").length) {
-    await client2.modifyObjects({
+    await client3.modifyObjects({
       object: "time_zones",
       where: { time_zones: { id: timeZoneId } },
       values: { name: `iService365 ${accessLabel} Schedule` }
     });
   } else {
-    await client2.createObjects({
+    await client3.createObjects({
       object: "time_zones",
       values: [{ id: timeZoneId, name: `iService365 ${accessLabel} Schedule` }]
     });
@@ -53265,25 +53383,25 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
     hol2: 1,
     hol3: 1
   };
-  const existingTimeSpanResponse = await client2.loadObjects({
+  const existingTimeSpanResponse = await client3.loadObjects({
     object: "time_spans",
     where: { time_spans: { id: timeSpanId } },
     limit: 1,
     offset: 0
   });
   if (getHidObjectRows(existingTimeSpanResponse, "time_spans").length) {
-    await client2.modifyObjects({
+    await client3.modifyObjects({
       object: "time_spans",
       where: { time_spans: { id: timeSpanId } },
       values: visitorTimeSpan
     });
   } else {
-    await client2.createObjects({
+    await client3.createObjects({
       object: "time_spans",
       values: [{ id: timeSpanId, ...visitorTimeSpan }]
     });
   }
-  const verifiedTimeZoneResponse = await client2.loadObjects({
+  const verifiedTimeZoneResponse = await client3.loadObjects({
     object: "time_zones",
     where: { time_zones: { id: timeZoneId } },
     limit: 1,
@@ -53297,7 +53415,7 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
       "The HID reader did not save the visitor access schedule."
     );
   }
-  const verifiedTimeSpanResponse = await client2.loadObjects({
+  const verifiedTimeSpanResponse = await client3.loadObjects({
     object: "time_spans",
     where: { time_spans: { id: timeSpanId } },
     limit: 1,
@@ -53315,7 +53433,7 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
     access_rule_id: accessRuleId,
     time_zone_id: timeZoneId
   };
-  const accessRuleTimeZoneResponse = await client2.loadObjects({
+  const accessRuleTimeZoneResponse = await client3.loadObjects({
     object: "access_rule_time_zones",
     where: {
       access_rule_time_zones: {
@@ -53329,12 +53447,12 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
     getHidObjectRows(accessRuleTimeZoneResponse, "access_rule_time_zones"),
     accessRuleTimeZoneValues
   )) {
-    await client2.createObjects({
+    await client3.createObjects({
       object: "access_rule_time_zones",
       values: [accessRuleTimeZoneValues]
     });
   }
-  const verifiedAccessRuleTimeZoneResponse = await client2.loadObjects({
+  const verifiedAccessRuleTimeZoneResponse = await client3.loadObjects({
     object: "access_rule_time_zones",
     where: { access_rule_time_zones: { access_rule_id: accessRuleId } },
     limit: 100,
@@ -53348,7 +53466,7 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
       "The HID reader did not save the visitor access schedule. Try issuing the QR code again."
     );
   }
-  const portalsResponse = await client2.loadObjects({
+  const portalsResponse = await client3.loadObjects({
     object: "portals",
     limit: 100,
     offset: 0
@@ -53385,7 +53503,7 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
     user_id: hidUserId,
     access_rule_id: accessRuleId
   };
-  const userAccessRulesResponse = await client2.loadObjects({
+  const userAccessRulesResponse = await client3.loadObjects({
     object: "user_access_rules",
     where: { user_access_rules: { user_id: hidUserId } },
     limit: 100,
@@ -53395,12 +53513,12 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
     getHidObjectRows(userAccessRulesResponse, "user_access_rules"),
     userAccessRuleValues
   )) {
-    await client2.createObjects({
+    await client3.createObjects({
       object: "user_access_rules",
       values: [userAccessRuleValues]
     });
   }
-  const verifiedUserAccessRulesResponse = await client2.loadObjects({
+  const verifiedUserAccessRulesResponse = await client3.loadObjects({
     object: "user_access_rules",
     where: { user_access_rules: { user_id: hidUserId } },
     limit: 100,
@@ -53414,7 +53532,7 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
       "The HID reader did not save the visitor access rule. Try issuing the QR code again."
     );
   }
-  const portalAccessRulesResponse = await client2.loadObjects({
+  const portalAccessRulesResponse = await client3.loadObjects({
     object: "portal_access_rules",
     where: { portal_access_rules: { access_rule_id: accessRuleId } },
     limit: 100,
@@ -53425,7 +53543,7 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
   );
   const stalePortalIds = [...linkedPortalIds].filter((portalId) => !portalIds.includes(portalId));
   for (const portalId of stalePortalIds) {
-    await client2.destroyObjects({
+    await client3.destroyObjects({
       object: "portal_access_rules",
       where: { portal_access_rules: { access_rule_id: accessRuleId, portal_id: portalId } }
     });
@@ -53433,12 +53551,12 @@ async function ensureVisitorAccessAuthorization(client2, readerId, reader, hidUs
   }
   const missingPortalLinks = portalIds.filter((portalId) => !linkedPortalIds.has(portalId)).map((portalId) => ({ portal_id: portalId, access_rule_id: accessRuleId }));
   if (missingPortalLinks.length) {
-    await client2.createObjects({
+    await client3.createObjects({
       object: "portal_access_rules",
       values: missingPortalLinks
     });
   }
-  const verifiedPortalAccessRulesResponse = await client2.loadObjects({
+  const verifiedPortalAccessRulesResponse = await client3.loadObjects({
     object: "portal_access_rules",
     where: { portal_access_rules: { access_rule_id: accessRuleId } },
     limit: 100,
@@ -53462,19 +53580,19 @@ function getHidPortals(response) {
     areaToId: Number(portal.area_to_id)
   })).filter((portal) => Number.isSafeInteger(portal.id) && portal.id > 0 && portal.name);
 }
-async function upsertHidObject(client2, object, id, values) {
-  const existing = await client2.loadObjects({
+async function upsertHidObject(client3, object, id, values) {
+  const existing = await client3.loadObjects({
     object,
     where: { [object]: { id } },
     limit: 1,
     offset: 0
   });
   if (getHidObjectRows(existing, object).length) {
-    await client2.modifyObjects({ object, where: { [object]: { id } }, values });
+    await client3.modifyObjects({ object, where: { [object]: { id } }, values });
   } else {
-    await client2.createObjects({ object, values: [{ id, ...values }] });
+    await client3.createObjects({ object, values: [{ id, ...values }] });
   }
-  const verified = await client2.loadObjects({
+  const verified = await client3.loadObjects({
     object,
     where: { [object]: { id } },
     limit: 1,
@@ -53484,17 +53602,17 @@ async function upsertHidObject(client2, object, id, values) {
     throw new import_node_server_utils149.BadRequestError(`The HID reader did not retain ${object.replace(/_/g, " ")}.`);
   }
 }
-async function ensureHidRelation(client2, object, values) {
-  const response = await client2.loadObjects({
+async function ensureHidRelation(client3, object, values) {
+  const response = await client3.loadObjects({
     object,
     where: { [object]: values },
     limit: 100,
     offset: 0
   });
   if (!hasHidObjectValues(getHidObjectRows(response, object), values)) {
-    await client2.createObjects({ object, values: [values] });
+    await client3.createObjects({ object, values: [values] });
   }
-  const verified = await client2.loadObjects({
+  const verified = await client3.loadObjects({
     object,
     where: { [object]: values },
     limit: 100,
@@ -53504,8 +53622,8 @@ async function ensureHidRelation(client2, object, values) {
     throw new import_node_server_utils149.BadRequestError(`The HID reader did not retain ${object.replace(/_/g, " ")}.`);
   }
 }
-async function reconcileHidRelation(client2, object, scope, values) {
-  const response = await client2.loadObjects({
+async function reconcileHidRelation(client3, object, scope, values) {
+  const response = await client3.loadObjects({
     object,
     where: { [object]: scope },
     limit: 1e3,
@@ -53517,11 +53635,11 @@ async function reconcileHidRelation(client2, object, scope, values) {
       const staleValues = Object.fromEntries(
         Object.keys(values).map((key2) => [key2, row[key2]])
       );
-      await client2.destroyObjects({ object, where: { [object]: staleValues } });
+      await client3.destroyObjects({ object, where: { [object]: staleValues } });
     }
   }
-  await ensureHidRelation(client2, object, values);
-  const verified = await client2.loadObjects({
+  await ensureHidRelation(client3, object, values);
+  const verified = await client3.loadObjects({
     object,
     where: { [object]: scope },
     limit: 1e3,
@@ -53532,21 +53650,21 @@ async function reconcileHidRelation(client2, object, scope, values) {
     throw new import_node_server_utils149.BadRequestError(`The HID reader did not reconcile ${object.replace(/_/g, " ")}.`);
   }
 }
-async function reconcileStandaloneGroupAccess(client2, readerId, portalId, userIds) {
+async function reconcileStandaloneGroupAccess(client3, readerId, portalId, userIds) {
   const groupId = createStableHidId(`permission-group:${readerId}`);
   const accessRuleId = createStableHidId(`permission-access-rule:${readerId}`);
   const timeZoneId = createStableHidId(`permission-time-zone:${readerId}`);
   const timeSpanId = createStableHidId(`permission-time-span:${readerId}`);
-  await upsertHidObject(client2, "groups", groupId, { name: "iService365 Assigned Access" });
-  await upsertHidObject(client2, "access_rules", accessRuleId, {
+  await upsertHidObject(client3, "groups", groupId, { name: "iService365 Assigned Access" });
+  await upsertHidObject(client3, "access_rules", accessRuleId, {
     name: "iService365 Assigned Access",
     type: 1,
     priority: 0
   });
-  await upsertHidObject(client2, "time_zones", timeZoneId, {
+  await upsertHidObject(client3, "time_zones", timeZoneId, {
     name: "iService365 Assigned Schedule"
   });
-  await upsertHidObject(client2, "time_spans", timeSpanId, {
+  await upsertHidObject(client3, "time_spans", timeSpanId, {
     time_zone_id: timeZoneId,
     start: 0,
     end: 86399,
@@ -53561,19 +53679,19 @@ async function reconcileStandaloneGroupAccess(client2, readerId, portalId, userI
     hol2: 1,
     hol3: 1
   });
-  await reconcileHidRelation(client2, "access_rule_time_zones", { access_rule_id: accessRuleId }, {
+  await reconcileHidRelation(client3, "access_rule_time_zones", { access_rule_id: accessRuleId }, {
     access_rule_id: accessRuleId,
     time_zone_id: timeZoneId
   });
-  await reconcileHidRelation(client2, "group_access_rules", { access_rule_id: accessRuleId }, {
+  await reconcileHidRelation(client3, "group_access_rules", { access_rule_id: accessRuleId }, {
     group_id: groupId,
     access_rule_id: accessRuleId
   });
-  await reconcileHidRelation(client2, "portal_access_rules", { access_rule_id: accessRuleId }, {
+  await reconcileHidRelation(client3, "portal_access_rules", { access_rule_id: accessRuleId }, {
     portal_id: portalId,
     access_rule_id: accessRuleId
   });
-  const currentResponse = await client2.loadObjects({
+  const currentResponse = await client3.loadObjects({
     object: "user_groups",
     where: { user_groups: { group_id: groupId } },
     limit: 2e5,
@@ -53584,7 +53702,7 @@ async function reconcileStandaloneGroupAccess(client2, readerId, portalId, userI
   for (const row of currentRows) {
     const userId = String(row.user_id ?? "");
     if (userId && !desired.has(userId)) {
-      await client2.destroyObjects({
+      await client3.destroyObjects({
         object: "user_groups",
         where: { user_groups: { group_id: groupId, user_id: Number(userId) } }
       });
@@ -53593,13 +53711,13 @@ async function reconcileStandaloneGroupAccess(client2, readerId, portalId, userI
   const current = new Set(currentRows.map((row) => String(row.user_id ?? "")));
   for (const userId of userIds) {
     if (!current.has(String(userId))) {
-      await client2.createObjects({
+      await client3.createObjects({
         object: "user_groups",
         values: [{ group_id: groupId, user_id: userId }]
       });
     }
   }
-  const verification = await client2.loadObjects({
+  const verification = await client3.loadObjects({
     object: "user_groups",
     where: { user_groups: { group_id: groupId } },
     limit: 2e5,
@@ -54102,10 +54220,10 @@ var HidAmicoClient = class {
     return res.data;
   }
 };
-async function configureMonitor(client2, callbackToken) {
+async function configureMonitor(client3, callbackToken) {
   const expected = getMonitorConfiguration(callbackToken);
-  await client2.setConfiguration({ monitor: expected });
-  const response = await client2.getConfiguration({
+  await client3.setConfiguration({ monitor: expected });
+  const response = await client3.getConfiguration({
     monitor: ["request_timeout", "hostname", "port", "path"]
   });
   const root = isUnknownRecord2(response) ? response : {};
@@ -54115,9 +54233,9 @@ async function configureMonitor(client2, callbackToken) {
   }
   return expected;
 }
-async function configureOperatingMode(client2, mode) {
+async function configureOperatingMode(client3, mode) {
   const expectedOnline = mode === "online" ? "1" : "0";
-  await client2.setConfiguration({
+  await client3.setConfiguration({
     general: {
       online: expectedOnline,
       // HID documents Online mode as both flags enabled. Keeping local
@@ -54125,7 +54243,7 @@ async function configureOperatingMode(client2, mode) {
       local_identification: "1"
     }
   });
-  const response = await client2.getConfiguration({
+  const response = await client3.getConfiguration({
     general: ["online", "local_identification"]
   });
   const root = isUnknownRecord2(response) ? response : {};
@@ -54509,8 +54627,8 @@ function useHidAmicoService() {
       return requestedType;
     return mode === "csn_for_mifare" ? "unknown" : mode;
   }
-  async function assertHidUserExists(client2, hidUserId) {
-    const response = await client2.loadObjects({
+  async function assertHidUserExists(client3, hidUserId) {
+    const response = await client3.loadObjects({
       object: "users",
       where: { users: { id: hidUserId } },
       limit: 1,
@@ -54520,18 +54638,18 @@ function useHidAmicoService() {
       throw new import_node_server_utils149.BadRequestError("HID user must exist before assigning a physical HID card.");
     }
   }
-  async function ensurePhysicalCardIdentification(client2) {
-    const before = await client2.getConfiguration({
+  async function ensurePhysicalCardIdentification(client3) {
+    const before = await client3.getConfiguration({
       identifier: ["card_identification_enabled"]
     });
     const root = isUnknownRecord2(before) ? before : {};
     const identifier = isUnknownRecord2(root.identifier) ? root.identifier : {};
     if (String(identifier.card_identification_enabled ?? "") !== "1") {
-      await client2.setConfiguration({
+      await client3.setConfiguration({
         identifier: { card_identification_enabled: "1" }
       });
     }
-    const verifiedResponse = await client2.getConfiguration({
+    const verifiedResponse = await client3.getConfiguration({
       identifier: ["card_identification_enabled"]
     });
     const verifiedRoot = isUnknownRecord2(verifiedResponse) ? verifiedResponse : {};
@@ -54542,8 +54660,8 @@ function useHidAmicoService() {
       );
     }
   }
-  async function loadPhysicalCardRows(client2, hidUserId) {
-    const response = await client2.loadObjects({
+  async function loadPhysicalCardRows(client3, hidUserId) {
+    const response = await client3.loadObjects({
       object: "cards",
       where: { cards: { user_id: hidUserId } },
       limit: 100,
@@ -54641,15 +54759,15 @@ function useHidAmicoService() {
     const refusal = discoveryUrlRefusalReason(value.baseUrl);
     if (refusal)
       throw new import_node_server_utils149.BadRequestError(refusal);
-    const client2 = new HidAmicoClient({
+    const client3 = new HidAmicoClient({
       ...value,
       baseUrl: normalizeHidReaderBaseUrl(value.baseUrl)
     });
     try {
-      await client2.login();
+      await client3.login();
       const [systemResponse, portalsResponse] = await Promise.all([
-        client2.getSystemInformation(),
-        client2.loadObjects({ object: "portals", limit: 100, offset: 0 })
+        client3.getSystemInformation(),
+        client3.loadObjects({ object: "portals", limit: 100, offset: 0 })
       ]);
       const system = getHidSystemInformation(systemResponse);
       const deviceId = isUnknownRecord2(system) ? String(system.device_id || "").trim() : "";
@@ -54679,7 +54797,7 @@ function useHidAmicoService() {
         portals
       };
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function createReader(value) {
@@ -54709,11 +54827,11 @@ function useHidAmicoService() {
     const readerId = String(reader._id);
     if (value.enabled === false)
       return reader;
-    const client2 = new HidAmicoClient(value);
+    const client3 = new HidAmicoClient(value);
     try {
-      await client2.login();
+      await client3.login();
       if (!monitorEnabled) {
-        await configureOperatingMode(client2, "standalone");
+        await configureOperatingMode(client3, "standalone");
         return repo.updateById(readerId, {
           monitorStatus: "disabled",
           monitorPath: "",
@@ -54722,8 +54840,8 @@ function useHidAmicoService() {
           lastSyncMessage: "Monitor callbacks are disabled; Standalone mode configured."
         });
       }
-      const monitor = await configureMonitor(client2, callbackToken);
-      await configureOperatingMode(client2, "standalone");
+      const monitor = await configureMonitor(client3, callbackToken);
+      await configureOperatingMode(client3, "standalone");
       const publicMonitor = getPublicMonitorConfiguration(monitor, callbackToken);
       return repo.updateById(readerId, {
         monitorPath: publicMonitor.path,
@@ -54749,7 +54867,7 @@ function useHidAmicoService() {
       });
       return { ...failed, monitorWarning: message };
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function updateReader(id, value) {
@@ -54789,10 +54907,10 @@ function useHidAmicoService() {
     }
     if (payload.portalId && current) {
       const candidate = { ...current, ...payload };
-      const client2 = new HidAmicoClient(candidate);
+      const client3 = new HidAmicoClient(candidate);
       try {
-        await client2.login();
-        const portals = getHidPortals(await client2.loadObjects({
+        await client3.login();
+        const portals = getHidPortals(await client3.loadObjects({
           object: "portals",
           limit: 100,
           offset: 0
@@ -54803,7 +54921,7 @@ function useHidAmicoService() {
         }
         payload.portalName = portal.name;
       } finally {
-        await client2.logout();
+        await client3.logout();
       }
     }
     return repo.updateById(id, payload);
@@ -54821,12 +54939,12 @@ function useHidAmicoService() {
         monitorStatus: "unconfigured"
       });
     }
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
+      await client3.login();
       const [systemResponse, portalsResponse] = await Promise.all([
-        client2.getSystemInformation(),
-        client2.loadObjects({ object: "portals", limit: 100, offset: 0 })
+        client3.getSystemInformation(),
+        client3.loadObjects({ object: "portals", limit: 100, offset: 0 })
       ]);
       const system = getHidSystemInformation(systemResponse);
       const serial = isUnknownRecord2(system) ? String(system.serial || "") : "";
@@ -54843,9 +54961,9 @@ function useHidAmicoService() {
           "The saved portal no longer exists on this HID reader. Edit the reader and select a valid portal."
         );
       }
-      const monitor = await configureMonitor(client2, callbackToken);
+      const monitor = await configureMonitor(client3, callbackToken);
       const mode = reader.operatingMode === "online" ? "online" : "standalone";
-      await configureOperatingMode(client2, mode);
+      await configureOperatingMode(client3, mode);
       const publicMonitor = getPublicMonitorConfiguration(monitor, callbackToken);
       await repo.updateById(id, {
         serial,
@@ -54868,17 +54986,17 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function setReaderMonitor(id, enabled) {
     if (enabled)
       return configureReaderIntegration(id);
     const reader = await getActiveReader(id);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      await configureOperatingMode(client2, "standalone");
+      await client3.login();
+      await configureOperatingMode(client3, "standalone");
       await repo.updateById(id, {
         monitorStatus: "disabled",
         monitorPath: "",
@@ -54895,7 +55013,7 @@ function useHidAmicoService() {
       });
       return { enabled: false, mode: "standalone", verified: true };
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function setOperatingMode(id, mode) {
@@ -54905,10 +55023,10 @@ function useHidAmicoService() {
         "Configure and verify the HID Monitor callback before enabling Online mode."
       );
     }
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const result = await configureOperatingMode(client2, mode);
+      await client3.login();
+      const result = await configureOperatingMode(client3, mode);
       await repo.updateById(id, {
         operatingMode: mode,
         lastSyncStatus: "completed",
@@ -54923,7 +55041,7 @@ function useHidAmicoService() {
       });
       return sanitizeHidPayload(result);
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function listReaders(value) {
@@ -54978,12 +55096,12 @@ function useHidAmicoService() {
   }
   async function testReader(id) {
     const reader = await repo.getById(id, { includePassword: true });
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
+      await client3.login();
       const [valid, systemResponse] = await Promise.all([
-        client2.sessionIsValid(),
-        client2.getSystemInformation()
+        client3.sessionIsValid(),
+        client3.getSystemInformation()
       ]);
       const system = getHidSystemInformation(systemResponse);
       const firmwareVersion = getHidFirmwareVersion(systemResponse);
@@ -55037,19 +55155,19 @@ function useHidAmicoService() {
       await repo.addEvent({ reader: id, site: reader.site, type: "test_failed", payload: { message } });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function syncReader(id, payload) {
     const reader = await getActiveReader(id);
     const batches = normalizeBatches(payload);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     const results = [];
     await repo.updateById(id, { lastSyncStatus: "running", lastSyncMessage: "Sync started." });
     try {
-      await client2.login();
+      await client3.login();
       for (const batch of batches) {
-        const result = await client2.createObjects(batch);
+        const result = await client3.createObjects(batch);
         results.push({
           object: batch.object,
           count: batch.values.length,
@@ -55077,7 +55195,7 @@ function useHidAmicoService() {
       await repo.addEvent({ reader: id, site: reader.site, type: "sync_failed", payload: { message } });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function isIdentityAssignedToReader(reader, identity, requestedPortalId) {
@@ -55193,9 +55311,9 @@ function useHidAmicoService() {
   async function listReaderUsers(readerId, page2 = 1, limit = 10, search = "", status = "", includeVisitors = false, userType = "all") {
     const reader = await getActiveReader(readerId);
     const offset = (page2 - 1) * limit;
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
+      await client3.login();
       const normalizedSearch = search.trim();
       const numericSearch = /^\d{1,15}$/.test(normalizedSearch) ? Number(normalizedSearch) : null;
       const userWhere = {};
@@ -55207,7 +55325,7 @@ function useHidAmicoService() {
       let rows = [];
       let reportedTotal = null;
       let hasMore = false;
-      const response = await client2.loadObjects({
+      const response = await client3.loadObjects({
         object: "users",
         where: { users: userWhere },
         limit: 500,
@@ -55227,7 +55345,7 @@ function useHidAmicoService() {
           const userId = Number(row.id);
           if (!Number.isSafeInteger(userId) || userId <= 0)
             return false;
-          const roleResponse = await client2.loadObjects({
+          const roleResponse = await client3.loadObjects({
             object: "user_roles",
             where: { user_roles: { user_id: userId, role: 1 } },
             limit: 1,
@@ -55235,7 +55353,7 @@ function useHidAmicoService() {
           });
           return getHidObjectRows(roleResponse, "user_roles").length > 0;
         })),
-        readerSupportsFacial(reader) ? client2.listUserImageIds().catch(() => []) : Promise.resolve([])
+        readerSupportsFacial(reader) ? client3.listUserImageIds().catch(() => []) : Promise.resolve([])
       ]);
       const facialUserIdSet = new Set(facialUserIds.map(String));
       const items = rows.map((row, index) => {
@@ -55265,15 +55383,15 @@ function useHidAmicoService() {
         pageRange: items.length ? `${offset + 1}-${offset + items.length} of ${reportedTotal ?? `${offset + items.length}${hasMore ? "+" : ""}`}` : "0-0 of 0"
       };
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function listReaderAccessLogs(readerId, page2 = 1, limit = 10, search = "", status = "", method = "", tab = "all") {
     const reader = await getActiveReader(readerId);
     const offset = (page2 - 1) * limit;
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
+      await client3.login();
       const where = {};
       if (status === "authorized")
         where.event = 7;
@@ -55294,7 +55412,7 @@ function useHidAmicoService() {
         const userIds = [...new Set(rows.map((row) => toPositiveInteger(row.user_id ?? row.userId)).filter((value) => value !== null))];
         const [identities, roleResponse, userResponse] = await Promise.all([
           repo.findIdentitiesByHidUserIds(readerId, userIds.map(String)),
-          userIds.length ? client2.loadObjects({
+          userIds.length ? client3.loadObjects({
             object: "user_roles",
             where: {
               user_roles: {
@@ -55305,7 +55423,7 @@ function useHidAmicoService() {
             limit: Math.max(1, userIds.length),
             offset: 0
           }) : Promise.resolve({ user_roles: [] }),
-          userIds.length ? client2.loadObjects({
+          userIds.length ? client3.loadObjects({
             object: "users",
             where: {
               users: {
@@ -55377,7 +55495,7 @@ function useHidAmicoService() {
       let deviceOffset = 0;
       let exhausted = false;
       while (!exhausted && matchedItems.length < targetCount) {
-        const response = await client2.loadObjects({
+        const response = await client3.loadObjects({
           object: "access_logs",
           ...Object.keys(where).length ? { where: { access_logs: where } } : {},
           limit: chunkSize,
@@ -55404,7 +55522,7 @@ function useHidAmicoService() {
         pageRange: items.length ? `${offset + 1}-${offset + items.length} of ${offset + items.length}${hasMore ? "+" : ""}` : "0-0 of 0"
       };
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function createIdentity(readerId, value) {
@@ -55496,18 +55614,18 @@ function useHidAmicoService() {
   async function runObjectOperation(id, operation, payload) {
     const reader = await getActiveReader(id);
     assertAllowedHidObject(payload.object, operation);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
+      await client3.login();
       let result;
       if (operation === "load") {
-        result = await client2.loadObjects(payload);
+        result = await client3.loadObjects(payload);
       } else if (operation === "create") {
-        result = await client2.createObjects(payload);
+        result = await client3.createObjects(payload);
       } else if (operation === "modify") {
-        result = await client2.modifyObjects(payload);
+        result = await client3.modifyObjects(payload);
       } else {
-        result = await client2.destroyObjects(payload);
+        result = await client3.destroyObjects(payload);
       }
       await repo.updateById(id, { lastSeenAt: /* @__PURE__ */ new Date() });
       const safeRequest = sanitizeHidObjectPayload(payload.object, payload);
@@ -55531,7 +55649,7 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function issueVisitorQrAtReader(readerId, value) {
@@ -55562,10 +55680,10 @@ function useHidAmicoService() {
     const hidUserId = createStableHidId(`visitor:${readerId}:${value.visitorId}`);
     const registration = `VIS-${value.visitorId.slice(-12).toUpperCase()}`;
     const credential = createVisitorQrCredential(value.visitorId, readerId, value.qrValue);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const readerConfigurationChanged = await configureVisitorQrReader(client2);
+      await client3.login();
+      const readerConfigurationChanged = await configureVisitorQrReader(client3);
       if (readerConfigurationChanged) {
         await repo.addEvent({
           reader: readerId,
@@ -55579,7 +55697,7 @@ function useHidAmicoService() {
           }
         });
       }
-      const existingUserResponse = await client2.loadObjects({
+      const existingUserResponse = await client3.loadObjects({
         object: "users",
         where: { users: { id: hidUserId } },
         limit: 1,
@@ -55600,18 +55718,18 @@ function useHidAmicoService() {
         );
       }
       if (existingUsers.length) {
-        await client2.modifyObjects({
+        await client3.modifyObjects({
           object: "users",
           where: { users: { id: hidUserId } },
           values: user
         });
       } else {
-        await client2.createObjects({
+        await client3.createObjects({
           object: "users",
           values: [{ id: hidUserId, ...user }]
         });
       }
-      const savedUserResponse = await client2.loadObjects({
+      const savedUserResponse = await client3.loadObjects({
         object: "users",
         where: { users: { id: hidUserId } },
         limit: 1,
@@ -55626,12 +55744,12 @@ function useHidAmicoService() {
         );
       }
       const authorization = await ensureVisitorAccessAuthorization(
-        client2,
+        client3,
         readerId,
         reader,
         hidUserId
       );
-      const existingQrResponse = await client2.loadObjects({
+      const existingQrResponse = await client3.loadObjects({
         object: credential.object,
         where: { [credential.object]: { user_id: hidUserId } },
         limit: 100,
@@ -55640,18 +55758,18 @@ function useHidAmicoService() {
       const existingQrs = getHidObjectRows(existingQrResponse, credential.object);
       const credentialValues = { value: credential.value, user_id: hidUserId };
       if (existingQrs.some((row) => String(row.id) === String(credential.credentialId))) {
-        await client2.modifyObjects({
+        await client3.modifyObjects({
           object: credential.object,
           where: { [credential.object]: { id: credential.credentialId } },
           values: credentialValues
         });
       } else {
-        await client2.createObjects({
+        await client3.createObjects({
           object: credential.object,
           values: [{ id: credential.credentialId, ...credentialValues }]
         });
       }
-      const savedCredentialResponse = await client2.loadObjects({
+      const savedCredentialResponse = await client3.loadObjects({
         object: credential.object,
         where: { [credential.object]: { id: credential.credentialId } },
         limit: 1,
@@ -55669,20 +55787,20 @@ function useHidAmicoService() {
       for (const staleQr of existingQrs) {
         const staleId = Number(staleQr.id);
         if (Number.isSafeInteger(staleId) && staleId > 0 && staleId !== credential.credentialId) {
-          await client2.destroyObjects({
+          await client3.destroyObjects({
             object: credential.object,
             where: { [credential.object]: { id: staleId } }
           });
         }
       }
-      const existingCardsResponse = await client2.loadObjects({
+      const existingCardsResponse = await client3.loadObjects({
         object: "cards",
         where: { cards: { user_id: hidUserId } },
         limit: 100,
         offset: 0
       });
       if (getHidObjectRows(existingCardsResponse, "cards").length) {
-        await client2.destroyObjects({
+        await client3.destroyObjects({
           object: "cards",
           where: { cards: { user_id: hidUserId } }
         });
@@ -55763,7 +55881,7 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function resolveVisitorQrGateReaders(siteId, callerId5, fallbackReaderId, issuer) {
@@ -55881,10 +55999,10 @@ function useHidAmicoService() {
     const enrolledAt = /* @__PURE__ */ new Date();
     const timestamp = options.timestamp || Math.floor(enrolledAt.getTime() / 1e3);
     const match = options.match ?? true;
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const existingUserResponse = await client2.loadObjects({
+      await client3.login();
+      const existingUserResponse = await client3.loadObjects({
         object: "users",
         where: { users: { id: context.hidUserId } },
         limit: 1,
@@ -55895,18 +56013,18 @@ function useHidAmicoService() {
         registration: context.registration
       };
       if (getHidObjectRows(existingUserResponse, "users").length) {
-        await client2.modifyObjects({
+        await client3.modifyObjects({
           object: "users",
           where: { users: { id: context.hidUserId } },
           values: hidUser
         });
       } else {
-        await client2.createObjects({
+        await client3.createObjects({
           object: "users",
           values: [{ id: context.hidUserId, ...hidUser }]
         });
       }
-      const result = await client2.setUserImage(context.hidUserId, image, timestamp, match);
+      const result = await client3.setUserImage(context.hidUserId, image, timestamp, match);
       const existingIdentity = context.profileIdentity || await repo.findExistingIdentity({
         reader: readerId,
         hidUserId: context.hidUserId
@@ -55971,25 +56089,25 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function getUserImage(readerId, hidUserId) {
     const reader = await getActiveReader(readerId);
     assertReaderCapability(reader, "facial");
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      return await client2.getUserImage(hidUserId);
+      await client3.login();
+      return await client3.getUserImage(hidUserId);
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
-  async function getReaderFacialUserIds(client2) {
+  async function getReaderFacialUserIds(client3) {
     try {
-      return await client2.listUserImageIds();
+      return await client3.listUserImageIds();
     } catch {
-      const usersResponse = await client2.loadObjects({
+      const usersResponse = await client3.loadObjects({
         object: "users",
         where: { users: {} },
         limit: 500,
@@ -56003,7 +56121,7 @@ function useHidAmicoService() {
         const batch = userIds.slice(offset, offset + batchSize);
         const results = await Promise.all(batch.map(async (userId) => {
           try {
-            const image = await client2.getUserImage(userId);
+            const image = await client3.getUserImage(userId);
             return image.base64 ? userId : null;
           } catch {
             return null;
@@ -56017,10 +56135,10 @@ function useHidAmicoService() {
   async function syncReaderFacialData(readerId) {
     const reader = await getActiveReader(readerId);
     assertReaderCapability(reader, "facial");
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const facialUserIds = await getReaderFacialUserIds(client2);
+      await client3.login();
+      const facialUserIds = await getReaderFacialUserIds(client3);
       const message = facialUserIds.length ? `Found ${facialUserIds.length} Amico user(s) with facial data. Facial status and images are read directly from the reader.` : "No facial enrollments found on the HID reader.";
       await repo.updateById(readerId, { status: "active", lastSeenAt: /* @__PURE__ */ new Date() });
       await repo.addEvent({
@@ -56052,7 +56170,7 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function setVisitorImage(readerId, visitorId, image, options = {}) {
@@ -56071,10 +56189,10 @@ function useHidAmicoService() {
     );
     const timestamp = options.timestamp || Math.floor(issuedAt.getTime() / 1e3);
     const match = options.match ?? true;
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const existingUserResponse = await client2.loadObjects({
+      await client3.login();
+      const existingUserResponse = await client3.loadObjects({
         object: "users",
         where: { users: { id: hidUserId } },
         limit: 1,
@@ -56088,24 +56206,24 @@ function useHidAmicoService() {
         end_time: Math.floor(expiresAt.getTime() / 1e3)
       };
       if (getHidObjectRows(existingUserResponse, "users").length) {
-        await client2.modifyObjects({
+        await client3.modifyObjects({
           object: "users",
           where: { users: { id: hidUserId } },
           values: user
         });
       } else {
-        await client2.createObjects({
+        await client3.createObjects({
           object: "users",
           values: [{ id: hidUserId, ...user }]
         });
       }
       const authorization = await ensureVisitorAccessAuthorization(
-        client2,
+        client3,
         readerId,
         reader,
         hidUserId
       );
-      const result = await client2.setUserImage(hidUserId, image, timestamp, match);
+      const result = await client3.setUserImage(hidUserId, image, timestamp, match);
       const existingIdentity = await repo.findExistingIdentity({ reader: readerId, hidUserId });
       const existingMetadata = existingIdentity && isUnknownRecord2(existingIdentity.metadata) ? existingIdentity.metadata : {};
       const identityPayload = {
@@ -56171,17 +56289,17 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function deleteVisitorImage(readerId, visitorId) {
     const reader = await getActiveReader(readerId);
     assertReaderCapability(reader, "facial");
     const { hidUserId } = await getVisitorEnrollmentContext(readerId, reader, visitorId);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const result = await client2.deleteUserImage(hidUserId);
+      await client3.login();
+      const result = await client3.deleteUserImage(hidUserId);
       const existingIdentity = await repo.findExistingIdentity({ reader: readerId, hidUserId });
       if (existingIdentity?._id) {
         const existingMetadata = isUnknownRecord2(existingIdentity.metadata) ? existingIdentity.metadata : {};
@@ -56210,7 +56328,7 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function listUserCards(readerId, hidUserIdValue) {
@@ -56218,19 +56336,19 @@ function useHidAmicoService() {
     assertReaderCapability(reader, "card");
     const cardType = reader.cardReadingMode === "pacs" || reader.cardReadingMode === "csn" ? reader.cardReadingMode : "unknown";
     const hidUserId = Number(hidUserIdValue);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      await assertHidUserExists(client2, hidUserId);
+      await client3.login();
+      await assertHidUserExists(client3, hidUserId);
       const [rows, identity] = await Promise.all([
-        loadPhysicalCardRows(client2, hidUserId),
+        loadPhysicalCardRows(client3, hidUserId),
         repo.findExistingIdentity({ reader: readerId, hidUserId })
       ]);
       const metadataRows = getIdentityPhysicalCards(identity);
       const cards = rows.map((row) => toHidPhysicalCard(row, metadataRows, cardType)).filter((card) => Boolean(card));
       return { readerId, hidUserId, cards };
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function assignUserCard(readerId, hidUserIdValue, input) {
@@ -56244,12 +56362,12 @@ function useHidAmicoService() {
     } catch (error) {
       throw new import_node_server_utils149.BadRequestError(getErrorMessage2(error));
     }
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      await assertHidUserExists(client2, hidUserId);
-      await ensurePhysicalCardIdentification(client2);
-      const collisionResponse = await client2.loadObjects({
+      await client3.login();
+      await assertHidUserExists(client3, hidUserId);
+      await ensurePhysicalCardIdentification(client3);
+      const collisionResponse = await client3.loadObjects({
         object: "cards",
         where: { cards: { value: hidRawUint64(cardValue) } },
         limit: 10,
@@ -56267,11 +56385,11 @@ function useHidAmicoService() {
       );
       if (!savedRow) {
         const credentialId = createStableHidId(`physical-card:${readerId}:${cardValue}`);
-        await client2.createObjects({
+        await client3.createObjects({
           object: "cards",
           values: [{ id: credentialId, value: hidRawUint64(cardValue), user_id: hidUserId }]
         });
-        const verifiedResponse = await client2.loadObjects({
+        const verifiedResponse = await client3.loadObjects({
           object: "cards",
           where: { cards: { id: credentialId } },
           limit: 1,
@@ -56312,7 +56430,7 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function enrollUserCard(readerId, hidUserIdValue, cardType, timeoutSeconds) {
@@ -56320,17 +56438,17 @@ function useHidAmicoService() {
     assertReaderCapability(reader, "card");
     assertReaderCardProfile(reader, cardType);
     const hidUserId = Number(hidUserIdValue);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     const lockOwner = import_crypto4.default.randomUUID();
     const acquired = await repo.acquireEnrollmentLock(readerId, lockOwner, timeoutSeconds + 30);
     if (!acquired) {
       throw new import_node_server_utils149.BadRequestError("Another physical HID card enrollment is already running on this reader.");
     }
     try {
-      await client2.login();
-      await assertHidUserExists(client2, hidUserId);
-      await ensurePhysicalCardIdentification(client2);
-      const beforeRows = await loadPhysicalCardRows(client2, hidUserId);
+      await client3.login();
+      await assertHidUserExists(client3, hidUserId);
+      await ensurePhysicalCardIdentification(client3);
+      const beforeRows = await loadPhysicalCardRows(client3, hidUserId);
       const beforeValues = new Set(beforeRows.map((row) => String(row.value ?? "")));
       await repo.addEvent({
         reader: readerId,
@@ -56339,7 +56457,7 @@ function useHidAmicoService() {
         payload: { hidUserId, cardType, timeoutSeconds }
       });
       const startedAt = Date.now();
-      const response = await client2.remoteEnrollCard(hidUserId, timeoutSeconds);
+      const response = await client3.remoteEnrollCard(hidUserId, timeoutSeconds);
       const responseRecord = isUnknownRecord2(response) ? response : {};
       const responseData = isUnknownRecord2(responseRecord.data) ? responseRecord.data : responseRecord;
       if (responseData.success === false) {
@@ -56356,7 +56474,7 @@ function useHidAmicoService() {
       const deadline = startedAt + timeoutSeconds * 1e3;
       let savedRow;
       do {
-        const rows = await loadPhysicalCardRows(client2, hidUserId);
+        const rows = await loadPhysicalCardRows(client3, hidUserId);
         savedRow = responseValue === null ? rows.find((row) => !beforeValues.has(String(row.value ?? ""))) : rows.find((row) => String(row.value ?? "") === String(responseValue));
         if (savedRow || Date.now() >= deadline)
           break;
@@ -56389,7 +56507,7 @@ function useHidAmicoService() {
       return { readerId, hidUserId, card, verified: true };
     } catch (error) {
       try {
-        await client2.cancelRemoteEnrollment();
+        await client3.cancelRemoteEnrollment();
       } catch {
       }
       await repo.addEvent({
@@ -56402,15 +56520,15 @@ function useHidAmicoService() {
       throw error;
     } finally {
       await repo.releaseEnrollmentLock(readerId, lockOwner);
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function cancelUserCardEnrollment(readerId) {
     const reader = await getActiveReader(readerId);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      await client2.cancelRemoteEnrollment();
+      await client3.login();
+      await client3.cancelRemoteEnrollment();
       const enrollmentWasRunning = await repo.releaseEnrollmentLock(readerId);
       await repo.addEvent({
         reader: readerId,
@@ -56420,27 +56538,27 @@ function useHidAmicoService() {
       });
       return { readerId, cancelled: true };
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function deleteUserCard(readerId, hidUserIdValue, cardIdValue) {
     const reader = await getActiveReader(readerId);
     const hidUserId = Number(hidUserIdValue);
     const cardId = Number(cardIdValue);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const rows = await loadPhysicalCardRows(client2, hidUserId);
+      await client3.login();
+      const rows = await loadPhysicalCardRows(client3, hidUserId);
       const cardRow = rows.find((row) => String(row.id ?? "") === String(cardId));
       if (!cardRow) {
         throw new import_node_server_utils149.BadRequestError("Physical HID card was not found for this HID user.");
       }
       const cardValue = String(normalizeHidCardValue(cardRow.value));
-      await client2.destroyObjects({
+      await client3.destroyObjects({
         object: "cards",
         where: { cards: { id: cardId } }
       });
-      const verifiedRows = await loadPhysicalCardRows(client2, hidUserId);
+      const verifiedRows = await loadPhysicalCardRows(client3, hidUserId);
       if (verifiedRows.some((row) => String(row.id ?? "") === String(cardId))) {
         throw new import_node_server_utils149.BadRequestError("The HID reader did not remove the physical card.");
       }
@@ -56463,17 +56581,17 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function getUserPinStatus(readerId, hidUserIdValue) {
     const reader = await getActiveReader(readerId);
     assertReaderCapability(reader, "pin");
     const hidUserId = Number(hidUserIdValue);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const response = await client2.loadObjects({
+      await client3.login();
+      const response = await client3.loadObjects({
         object: "pins",
         where: { pins: { user_id: hidUserId } },
         limit: 1,
@@ -56481,7 +56599,7 @@ function useHidAmicoService() {
       });
       return { readerId, hidUserId, pinEnrolled: getHidObjectRows(response, "pins").length > 0 };
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function setUserPin(readerId, hidUserIdValue, pin) {
@@ -56489,10 +56607,10 @@ function useHidAmicoService() {
     assertReaderCapability(reader, "pin");
     const hidUserId = Number(hidUserIdValue);
     const credentialId = createStableHidId(`user-pin:${readerId}:${hidUserId}`);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const userResponse = await client2.loadObjects({
+      await client3.login();
+      const userResponse = await client3.loadObjects({
         object: "users",
         where: { users: { id: hidUserId } },
         limit: 1,
@@ -56502,13 +56620,13 @@ function useHidAmicoService() {
         throw new import_node_server_utils149.BadRequestError("HID user must exist before assigning an access PIN.");
       }
       const [byUserResponse, byValueResponse] = await Promise.all([
-        client2.loadObjects({
+        client3.loadObjects({
           object: "pins",
           where: { pins: { user_id: hidUserId } },
           limit: 10,
           offset: 0
         }),
-        client2.loadObjects({
+        client3.loadObjects({
           object: "pins",
           where: { pins: { value: pin } },
           limit: 10,
@@ -56524,18 +56642,18 @@ function useHidAmicoService() {
       }
       const existingPin = existingPins[0];
       if (existingPin) {
-        await client2.modifyObjects({
+        await client3.modifyObjects({
           object: "pins",
           where: { pins: { id: existingPin.id } },
           values: { value: pin, user_id: hidUserId }
         });
       } else {
-        await client2.createObjects({
+        await client3.createObjects({
           object: "pins",
           values: [{ id: credentialId, value: pin, user_id: hidUserId }]
         });
       }
-      const savedResponse = await client2.loadObjects({
+      const savedResponse = await client3.loadObjects({
         object: "pins",
         where: { pins: { user_id: hidUserId } },
         limit: 1,
@@ -56545,7 +56663,7 @@ function useHidAmicoService() {
       if (!savedPin || String(savedPin.value) !== pin) {
         throw new import_node_server_utils149.BadRequestError("The HID reader did not retain the access PIN.");
       }
-      await client2.setConfiguration({
+      await client3.setConfiguration({
         identifier: {
           pin_identification_enabled: "1",
           multi_factor_authentication: "0"
@@ -56569,17 +56687,17 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function deleteUserPin(readerId, hidUserIdValue) {
     const reader = await getActiveReader(readerId);
     assertReaderCapability(reader, "pin");
     const hidUserId = Number(hidUserIdValue);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      await client2.destroyObjects({
+      await client3.login();
+      await client3.destroyObjects({
         object: "pins",
         where: { pins: { user_id: hidUserId } }
       });
@@ -56601,7 +56719,7 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function revokeVisitorQr(readerId, visitorId) {
@@ -56613,44 +56731,44 @@ function useHidAmicoService() {
         "The generated HID user ID is assigned to another visitor."
       );
     }
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const existingUserResponse = await client2.loadObjects({
+      await client3.login();
+      const existingUserResponse = await client3.loadObjects({
         object: "users",
         where: { users: { id: hidUserId } },
         limit: 1,
         offset: 0
       });
       const deviceUserExists = getHidObjectRows(existingUserResponse, "users").length > 0;
-      await client2.destroyObjects({
+      await client3.destroyObjects({
         object: "qrcodes",
         where: { qrcodes: { user_id: hidUserId } }
       });
-      await client2.destroyObjects({
+      await client3.destroyObjects({
         object: "cards",
         where: { cards: { user_id: hidUserId } }
       });
       if (reader.capabilities?.pin === true) {
-        await client2.destroyObjects({
+        await client3.destroyObjects({
           object: "pins",
           where: { pins: { user_id: hidUserId } }
         });
       }
-      await client2.destroyObjects({
+      await client3.destroyObjects({
         object: "user_access_rules",
         where: { user_access_rules: { user_id: hidUserId } }
       });
-      await client2.destroyObjects({
+      await client3.destroyObjects({
         object: "user_groups",
         where: { user_groups: { user_id: hidUserId } }
       });
       const metadata = identity && isUnknownRecord2(identity.metadata) ? identity.metadata : {};
       if (deviceUserExists && metadata.facialEnrolled === true) {
-        await client2.deleteUserImage(hidUserId);
+        await client3.deleteUserImage(hidUserId);
       }
       if (deviceUserExists) {
-        await client2.modifyObjects({
+        await client3.modifyObjects({
           object: "users",
           where: { users: { id: hidUserId } },
           values: { end_time: Math.floor(Date.now() / 1e3) }
@@ -56661,7 +56779,7 @@ function useHidAmicoService() {
       if (reader.capabilities?.pin === true)
         credentialObjects.push("pins");
       for (const object of credentialObjects) {
-        const response = await client2.loadObjects({
+        const response = await client3.loadObjects({
           object,
           where: { [object]: { user_id: hidUserId } },
           limit: 1,
@@ -56669,7 +56787,7 @@ function useHidAmicoService() {
         });
         credentialRemains || (credentialRemains = getHidObjectRows(response, object).length > 0);
       }
-      const savedUser = await client2.loadObjects({
+      const savedUser = await client3.loadObjects({
         object: "users",
         where: { users: { id: hidUserId } },
         limit: 1,
@@ -56707,7 +56825,7 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function queueVisitorQrJob(readerId, visitorId, operation) {
@@ -56817,16 +56935,16 @@ function useHidAmicoService() {
     const reader = await getActiveReader(readerId);
     assertReaderCapability(reader, "facial");
     assertReaderPortal(reader, "enrolling facial recognition");
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     const timestamp = options.timestamp || Math.floor(Date.now() / 1e3);
     const match = options.match ?? true;
     try {
-      await client2.login();
+      await client3.login();
       const numericUserId = Number(hidUserId);
       if (!Number.isSafeInteger(numericUserId) || numericUserId <= 0) {
         throw new import_node_server_utils149.BadRequestError("A valid HID user ID is required for facial enrollment.");
       }
-      const result = await client2.setUserImage(numericUserId, image, timestamp, match);
+      const result = await client3.setUserImage(numericUserId, image, timestamp, match);
       await repo.updateById(readerId, { lastSeenAt: /* @__PURE__ */ new Date() });
       await repo.addEvent({
         reader: readerId,
@@ -56850,16 +56968,16 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function deleteUserImage(readerId, hidUserId) {
     const reader = await getActiveReader(readerId);
     assertReaderCapability(reader, "facial");
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const result = await client2.deleteUserImage(hidUserId);
+      await client3.login();
+      const result = await client3.deleteUserImage(hidUserId);
       await repo.updateById(readerId, { lastSeenAt: /* @__PURE__ */ new Date() });
       await repo.addEvent({
         reader: readerId,
@@ -56877,28 +56995,28 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function getDoorState(id) {
     const reader = await getActiveReader(id);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const state = await client2.doorState();
+      await client3.login();
+      const state = await client3.doorState();
       await repo.updateById(id, { lastSeenAt: /* @__PURE__ */ new Date() });
       await repo.addEvent({ reader: id, site: reader.site, type: "door_state", payload: state });
       return state;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function executeActions(id, actions) {
     const reader = await getActiveReader(id);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const result = await client2.executeActions(actions);
+      await client3.login();
+      const result = await client3.executeActions(actions);
       await repo.updateById(id, { lastSeenAt: /* @__PURE__ */ new Date() });
       await repo.addEvent({ reader: id, site: reader.site, type: "execute_actions", payload: { actions, result } });
       return result;
@@ -56906,16 +57024,16 @@ function useHidAmicoService() {
       await repo.addEvent({ reader: id, site: reader.site, type: "execute_actions_failed", payload: { actions, message: getErrorMessage2(error) } });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function getConfiguration(id, payload) {
     assertAllowedHidConfigurationRead(payload);
     const reader = await getActiveReader(id);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const result = await client2.getConfiguration(payload);
+      await client3.login();
+      const result = await client3.getConfiguration(payload);
       await repo.updateById(id, { lastSeenAt: /* @__PURE__ */ new Date() });
       await repo.addEvent({ reader: id, site: reader.site, type: "configuration", payload: { request: payload, result } });
       return sanitizeHidPayload(result);
@@ -56923,7 +57041,7 @@ function useHidAmicoService() {
       await repo.addEvent({ reader: id, site: reader.site, type: "configuration_failed", payload: { request: payload, message: getErrorMessage2(error) } });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function setConfiguration(id, payload) {
@@ -56935,10 +57053,10 @@ function useHidAmicoService() {
       );
     }
     assertAllowedHidConfiguration(payload);
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const result = await client2.setConfiguration(payload);
+      await client3.login();
+      const result = await client3.setConfiguration(payload);
       await repo.updateById(id, { lastSeenAt: /* @__PURE__ */ new Date() });
       await repo.addEvent({ reader: id, site: reader.site, type: "set_configuration", payload: { request: payload, result } });
       return sanitizeHidPayload(result);
@@ -56946,23 +57064,23 @@ function useHidAmicoService() {
       await repo.addEvent({ reader: id, site: reader.site, type: "set_configuration_failed", payload: { request: payload, message: getErrorMessage2(error) } });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function getIntercomStatus(id) {
     const reader = await getActiveReader(id);
     assertReaderCapability(reader, "intercom");
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
+      await client3.login();
       let result;
       try {
-        result = await client2.getSipStatus();
+        result = await client3.getSipStatus();
       } catch (error) {
         if (!isSipStatusUnavailable(error)) {
           throw error;
         }
-        const configuration = await client2.getConfiguration({ pjsip: PJSIP_PUBLIC_CONFIGURATION_KEYS });
+        const configuration = await client3.getConfiguration({ pjsip: PJSIP_PUBLIC_CONFIGURATION_KEYS });
         result = buildSipStatusFallback(configuration, error);
       }
       await repo.updateById(id, { lastSeenAt: /* @__PURE__ */ new Date() });
@@ -56973,16 +57091,16 @@ function useHidAmicoService() {
       await repo.addEvent({ reader: id, site: reader.site, type: "intercom_status_failed", payload: { message: getErrorMessage2(error) } });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function makeIntercomCall(id, target) {
     const reader = await getActiveReader(id);
     assertReaderCapability(reader, "intercom");
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const result = await client2.makeSipCall(target);
+      await client3.login();
+      const result = await client3.makeSipCall(target);
       await repo.updateById(id, { lastSeenAt: /* @__PURE__ */ new Date() });
       await repo.addEvent({ reader: id, site: reader.site, type: "intercom_call", payload: { target, result } });
       return result;
@@ -56990,16 +57108,16 @@ function useHidAmicoService() {
       await repo.addEvent({ reader: id, site: reader.site, type: "intercom_call_failed", payload: { target, message: getErrorMessage2(error) } });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function finalizeIntercomCall(id) {
     const reader = await getActiveReader(id);
     assertReaderCapability(reader, "intercom");
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
-      const result = await client2.finalizeSipCall();
+      await client3.login();
+      const result = await client3.finalizeSipCall();
       await repo.updateById(id, { lastSeenAt: /* @__PURE__ */ new Date() });
       await repo.addEvent({ reader: id, site: reader.site, type: "intercom_hangup", payload: result || {} });
       return result;
@@ -57007,7 +57125,7 @@ function useHidAmicoService() {
       await repo.addEvent({ reader: id, site: reader.site, type: "intercom_hangup_failed", payload: { message: getErrorMessage2(error) } });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   function normalizePermissionLocation(value) {
@@ -57064,7 +57182,7 @@ function useHidAmicoService() {
       return "contractor";
     return "staff";
   }
-  async function provisionPermissionUser(client2, reader, binding) {
+  async function provisionPermissionUser(client3, reader, binding) {
     const readerId = String(reader._id);
     const existingProfile = await repo.findProfileIdentity(readerId, binding.userId);
     const hidUserId = toPositiveInteger(existingProfile?.hidUserId) ?? createStableHidId(`profile:${readerId}:${binding.userId}`);
@@ -57080,7 +57198,7 @@ function useHidAmicoService() {
       throw new import_node_server_utils149.BadRequestError("The reader already uses this HID user ID for an unmanaged Amico user.");
     }
     const name2 = String(binding.name || "iService365 User").trim() || "iService365 User";
-    const existingUser = await client2.loadObjects({
+    const existingUser = await client3.loadObjects({
       object: "users",
       where: { users: { id: hidUserId } },
       limit: 1,
@@ -57088,13 +57206,13 @@ function useHidAmicoService() {
     });
     const userValues = { name: name2, registration };
     if (getHidObjectRows(existingUser, "users").length) {
-      await client2.modifyObjects({
+      await client3.modifyObjects({
         object: "users",
         where: { users: { id: hidUserId } },
         values: userValues
       });
     } else {
-      await client2.createObjects({
+      await client3.createObjects({
         object: "users",
         values: [{ id: hidUserId, ...userValues }]
       });
@@ -57134,14 +57252,14 @@ function useHidAmicoService() {
     const uniqueBindings = [...new Map(
       bindings.map((binding) => [String(binding.userId), binding])
     ).values()];
-    const client2 = new HidAmicoClient(reader);
+    const client3 = new HidAmicoClient(reader);
     try {
-      await client2.login();
+      await client3.login();
       const uniqueUserIds = await Promise.all(
-        uniqueBindings.map((binding) => provisionPermissionUser(client2, reader, binding))
+        uniqueBindings.map((binding) => provisionPermissionUser(client3, reader, binding))
       );
       const result = await reconcileStandaloneGroupAccess(
-        client2,
+        client3,
         readerId,
         Number(reader.portalId),
         uniqueUserIds
@@ -57164,7 +57282,7 @@ function useHidAmicoService() {
       });
       throw error;
     } finally {
-      await client2.logout();
+      await client3.logout();
     }
   }
   async function reconcileStoredReaderPermissions(readerId) {
@@ -68735,11 +68853,11 @@ function buildingInPlanFrame(building) {
     lifts
   };
 }
-function openRmfDoorDriver(client2, doorName) {
+function openRmfDoorDriver(client3, doorName) {
   return {
     name: doorName,
     async read() {
-      const s = await client2.doorState(doorName).catch((e) => {
+      const s = await client3.doorState(doorName).catch((e) => {
         if (/HTTP 404/.test(String(e?.message)))
           return null;
         throw e;
@@ -68757,13 +68875,13 @@ function openRmfDoorDriver(client2, doorName) {
       if (request2.requestedMode !== DOOR_MODE.OPEN && request2.requestedMode !== DOOR_MODE.CLOSED) {
         throw new OpenRmfError("A door can only be asked to open or close.");
       }
-      await client2.doorRequest(doorName, request2.requestedMode);
+      await client3.doorRequest(doorName, request2.requestedMode);
     }
   };
 }
-function openRmfLiftDriver(client2, liftName) {
+function openRmfLiftDriver(client3, liftName) {
   const destinations = /* @__PURE__ */ new Map();
-  const send2 = (requestType, sessionId, destination, doorState) => client2.liftRequest(liftName, {
+  const send2 = (requestType, sessionId, destination, doorState) => client3.liftRequest(liftName, {
     request_type: requestType,
     door_mode: doorState,
     destination,
@@ -68772,7 +68890,7 @@ function openRmfLiftDriver(client2, liftName) {
   return {
     name: liftName,
     async read() {
-      const s = await client2.liftState(liftName).catch((e) => {
+      const s = await client3.liftState(liftName).catch((e) => {
         if (/HTTP 404/.test(String(e?.message)))
           return null;
         throw e;
@@ -68808,18 +68926,18 @@ function openRmfLiftDriver(client2, liftName) {
   };
 }
 function createOpenRmfAdapter(options) {
-  const client2 = createOpenRmfClient(options && "config" in options ? options.config ?? null : openRmfConfig(), {
+  const client3 = createOpenRmfClient(options && "config" in options ? options.config ?? null : openRmfConfig(), {
     fetch: options?.fetch,
     timeoutMs: options?.timeoutMs
   });
   async function states() {
-    const [fleets, building] = await Promise.all([client2.fleets(), client2.buildingMap().catch(() => null)]);
+    const [fleets, building] = await Promise.all([client3.fleets(), client3.buildingMap().catch(() => null)]);
     return { fleets: fleets ?? [], building };
   }
   async function openInterruptions(taskId) {
     if (!taskId)
       return [];
-    const t = await client2.taskState(taskId).catch(() => null);
+    const t = await client3.taskState(taskId).catch(() => null);
     return Object.entries(t?.interruptions ?? {}).filter(([, v]) => !v?.resumed_by).map(([token]) => token);
   }
   async function find(robotSn) {
@@ -68831,7 +68949,7 @@ function createOpenRmfAdapter(options) {
     return s ? { key: key2, s, building } : null;
   }
   return {
-    client: client2,
+    client: client3,
     brand: OPEN_RMF_BRAND,
     displayName: OPEN_RMF_DISPLAY_NAME,
     capabilities: OPEN_RMF_CAPABILITIES,
@@ -68858,9 +68976,9 @@ function createOpenRmfAdapter(options) {
           const tokens = await openInterruptions(taskId);
           if (!tokens.length)
             throw new OpenRmfError("This robot's task is not paused.");
-          res2 = await client2.resumeTask(taskId, tokens);
+          res2 = await client3.resumeTask(taskId, tokens);
         } else {
-          res2 = command.kind === "pause" ? await client2.interruptTask(taskId) : await client2.cancelTask(taskId);
+          res2 = command.kind === "pause" ? await client3.interruptTask(taskId) : await client3.cancelTask(taskId);
         }
         if (res2 && res2.success === false)
           throw new OpenRmfError(`The fleet server refused to ${command.kind} the task.`);
@@ -68868,7 +68986,7 @@ function createOpenRmfAdapter(options) {
       }
       const wp = waypointsFor(hit.building, hit.s.location);
       const request2 = taskRequestFor(command, wp.cleaningZones.length ? "cleaning" : "security", wp);
-      const res = await client2.robotTask(hit.key.fleet, hit.key.robot, request2);
+      const res = await client3.robotTask(hit.key.fleet, hit.key.robot, request2);
       if (!res?.success)
         throw new OpenRmfError("The fleet server did not accept the task.");
     },
@@ -68884,7 +69002,7 @@ function createOpenRmfAdapter(options) {
       const taskId = hit?.s.task_id;
       if (!hit || !taskId)
         return none;
-      const t = await client2.taskState(taskId).catch(() => null);
+      const t = await client3.taskState(taskId).catch(() => null);
       if (!t || !/^patrol$/i.test(String(t.category ?? "")))
         return none;
       const level2 = hit.building?.levels.find((l) => l.name === hit.s.location?.map);
@@ -69979,10 +70097,10 @@ function fetchPadbotMqttCredentials(credentials) {
   return createPadbotClient(credentials).call(PADBOT_PATHS.mqttCredentials, {});
 }
 async function listPadbotAlarmsSince(credentials, serials, startTime) {
-  const client2 = createPadbotClient(credentials);
+  const client3 = createPadbotClient(credentials);
   const out = [];
   for (let p = 1; p <= 3; p++) {
-    const d = await client2.call(PADBOT_PATHS.alarms, { serialNumbers: serials.slice(0, 100), startTime, pageNumber: p, pageSize: 100 });
+    const d = await client3.call(PADBOT_PATHS.alarms, { serialNumbers: serials.slice(0, 100), startTime, pageNumber: p, pageSize: 100 });
     out.push(...asList(d));
     if (p >= (Number(d?.totalPages) || 0))
       break;
@@ -75182,16 +75300,16 @@ function useRobotMapController(deps) {
       const config2 = openRmfConfig();
       if (!config2)
         throw new import_node_server_utils175.NotFoundError("Fleet Core is not configured on this server.");
-      const client2 = createOpenRmfClient(config2);
+      const client3 = createOpenRmfClient(config2);
       if (value.format === "rmf") {
-        const rmf = rmfFromFleetCore(await client2.buildingMap());
+        const rmf = rmfFromFleetCore(await client3.buildingMap());
         res.json({ source: "fleet-core", rmf, summary: rmfSummary(rmf) });
         return;
       }
-      const building = buildingInPlanFrame(await client2.buildingMap());
+      const building = buildingInPlanFrame(await client3.buildingMap());
       const [doorStates, liftStates] = await Promise.all([
-        Promise.all(building.doors.slice(0, 100).map((d) => openRmfDoorDriver(client2, d.name).read().catch(() => null))),
-        Promise.all(building.lifts.slice(0, 20).map((l) => openRmfLiftDriver(client2, l.name).read().catch(() => null)))
+        Promise.all(building.doors.slice(0, 100).map((d) => openRmfDoorDriver(client3, d.name).read().catch(() => null))),
+        Promise.all(building.lifts.slice(0, 20).map((l) => openRmfLiftDriver(client3, l.name).read().catch(() => null)))
       ]);
       res.json({
         source: "fleet-core",
@@ -101278,11 +101396,11 @@ function useAuthServiceV2() {
         "Refresh token already used. Please log in again."
       );
     }
-    const client2 = import_node_server_utils292.useAtlas.getClient();
-    if (!client2) {
+    const client3 = import_node_server_utils292.useAtlas.getClient();
+    if (!client3) {
       throw new import_node_server_utils292.InternalServerError("Unable to connect to server.");
     }
-    const dbSession = client2.startSession();
+    const dbSession = client3.startSession();
     let newRefreshToken;
     try {
       dbSession.startTransaction();
@@ -103013,7 +103131,7 @@ function useUserServiceV2() {
       session?.endSession();
     }
   }
-  const s32 = new import_node_server_utils296.useS3({
+  const s33 = new import_node_server_utils296.useS3({
     accessKeyId: SPACES_ACCESS_KEY,
     secretAccessKey: SPACES_SECRET_KEY,
     endpoint: SPACES_ENDPOINT,
@@ -103034,14 +103152,14 @@ function useUserServiceV2() {
     };
     try {
       const id = await createFile(_file, session);
-      await s32.uploadObject({
+      await putSpacesObject({
         key: id,
         body: file.buffer,
         contentType: file.mimetype
       });
       if (previousProfile) {
         await deleteFileById(previousProfile, session);
-        await s32.deleteObject(previousProfile);
+        await s33.deleteObject(previousProfile);
       }
       await _updateUserFieldById(
         { _id: user, field: "profile", value: id },
@@ -105938,10 +106056,10 @@ function useChatPrelovedService() {
   const { add: _addChat } = useChatPrelovedRepo();
   const { add: _addChannel, getByParticipants: _getByParticipants } = useChannelPrelovedRepo();
   async function add(value) {
-    const client2 = import_node_server_utils314.useAtlas.getClient();
-    if (!client2)
+    const client3 = import_node_server_utils314.useAtlas.getClient();
+    if (!client3)
       throw new import_node_server_utils314.InternalServerError("Unable to connect to server.");
-    const session = client2.startSession();
+    const session = client3.startSession();
     session.startTransaction();
     try {
       let channelId = value.channelId;
@@ -106394,14 +106512,14 @@ function useBidPrelovedService() {
   const { add: _addChat } = useChatPrelovedRepo();
   const { updateStatus } = usePostPrelovedRepo();
   async function createBid(value) {
-    const client2 = import_node_server_utils320.useAtlas.getClient();
-    if (!client2)
+    const client3 = import_node_server_utils320.useAtlas.getClient();
+    if (!client3)
       throw new import_node_server_utils320.InternalServerError("Unable to connect to server.");
     const buyerId = value.buyerId;
     const receiverId = value.receiverId;
     const postId = value.postId;
     const messageText = value.message || "";
-    const session = client2.startSession();
+    const session = client3.startSession();
     session.startTransaction();
     try {
       const bidId = await _addBid(value, session);
@@ -108668,8 +108786,8 @@ async function staffOnly(req) {
 }
 async function clientAndSites(org) {
   const d = db2();
-  const client2 = await d.collection("organizations").findOne({ _id: new import_mongodb201.ObjectId(org), status: { $ne: "deleted" } }, { projection: { name: 1, nature: 1, status: 1 } });
-  if (!client2)
+  const client3 = await d.collection("organizations").findOne({ _id: new import_mongodb201.ObjectId(org), status: { $ne: "deleted" } }, { projection: { name: 1, nature: 1, status: 1 } });
+  if (!client3)
     throw new import_node_server_utils330.NotFoundError("Client not found.");
   const own = await d.collection("sites").find({ orgId: both3(org), status: { $ne: "deleted" } }, { projection: { name: 1 } }).toArray();
   const served = await d.collection("customer.sites").find({ org: both3(org), status: { $ne: "deleted" }, site: { $exists: true, $nin: [null, ""] } }, { projection: { name: 1, site: 1 } }).toArray();
@@ -108682,7 +108800,7 @@ async function clientAndSites(org) {
       sites.set(id, String(s.name ?? ""));
   }
   return {
-    client: { _id: org, name: String(client2.name ?? ""), nature: String(client2.nature ?? "") },
+    client: { _id: org, name: String(client3.name ?? ""), nature: String(client3.nature ?? "") },
     sites: [...sites].map(([_id, name2]) => ({ _id, name: name2 })).sort((a, b) => a.name.localeCompare(b.name))
   };
 }
@@ -108750,14 +108868,14 @@ function useStaffAccessController() {
       const sid = getSessionIdFromRequest(req);
       if (!sid)
         throw new import_node_server_utils330.UnauthorizedError("Not authorized.");
-      const { client: client2, sites: list } = await clientAndSites(value.org);
+      const { client: client3, sites: list } = await clientAndSites(value.org);
       const site = value.site ? list.find((s) => s._id === value.site) : null;
       if (value.site && !site)
         throw new import_node_server_utils330.BadRequestError("That site does not belong to this client.");
       const view = {
         user: actor,
-        org: client2._id,
-        orgName: client2.name,
+        org: client3._id,
+        orgName: client3.name,
         site: site?._id ?? "",
         siteName: site?.name ?? "",
         app: value.app,
@@ -108767,8 +108885,8 @@ function useStaffAccessController() {
       await recordConsoleAction({
         action: "staff-view.entered" /* STAFF_VIEW_ENTERED */,
         actor,
-        org: client2._id,
-        target: view.site || client2._id,
+        org: client3._id,
+        target: view.site || client3._id,
         targetType: view.site ? "site" /* SITE */ : "organization" /* ORGANIZATION */,
         after: pickAuditFields("staff-view.entered" /* STAFF_VIEW_ENTERED */, { ...view, reason: value.reason }) ?? null
       });
@@ -110031,6 +110149,7 @@ function usePersonalEmergencyChainController() {
   SERVICE_TYPE_LABELS,
   SITE_STATES_MAX,
   SOFTWARE_VERSION_ENDPOINT,
+  STAFF_CLIENT_PERMISSIONS,
   STAFF_VIEW_APPS,
   STAFF_VIEW_HISTORY_ACTIONS,
   SUBCONTRACT_ADMIN_REFUSAL,
@@ -110646,6 +110765,7 @@ function usePersonalEmergencyChainController() {
   snapshotRefusalReason,
   splitRobotSn,
   staffMayBypass,
+  staffReachesEveryClient,
   staffViewWriteAudit,
   startDemoTracking,
   startPadbotDrive,