@opencrvs/toolkit 2.0.0-rc.fdc585a → 2.0.0-rc.ff04b30

package/dist/cli.js

@@ -1883,9 +1883,9 @@ function updateRouteHandlers(sourceFiles, group, srcDir, relCwd) {
   }
   return replacedCount;
 }
-function resolveConfigChain(configObj, path23) {
+function resolveConfigChain(configObj, path24) {
   let current = configObj;
-  for (const key of path23) {
+  for (const key of path24) {
     if (!import_ts_morph10.Node.isObjectLiteralExpression(current)) return null;
     const prop = current.getProperty(key);
     if (!prop || !import_ts_morph10.Node.isPropertyAssignment(prop)) return null;
@@ -2120,6 +2120,10 @@ Done. Converted ${convertedCount} config file(s), replaced ${totalReplaced} rout
 var import_ts_morph11 = require("ts-morph");
 var import_path11 = __toESM(require("path"));
 
+// ../commons/src/scopes.deprecated.do-not-use.ts
+var z4 = __toESM(require("zod/v4"));
+var import_lodash = require("lodash");
+
 // ../commons/src/scopes.ts
 var z3 = __toESM(require("zod/v4"));
 var qs = __toESM(require("qs"));
@@ -2389,11 +2393,12 @@ var decodeScope = (query) => {
 };
 var DEFAULT_SCOPE_OPTIONS = {
   placeOfEvent: JurisdictionFilter.enum.all,
-  accessLevel: JurisdictionFilter.enum.all
+  accessLevel: JurisdictionFilter.enum.all,
+  registeredIn: JurisdictionFilter.enum.all,
+  declaredIn: JurisdictionFilter.enum.all
 };
 
 // ../commons/src/scopes.deprecated.do-not-use.ts
-var z4 = __toESM(require("zod/v4"));
 var rawConfigurableScopeRegex = /^([a-zA-Z][a-zA-Z0-9.-]*(?:\.[a-zA-Z0-9.-]+)*)\[((?:\w+=[\w.-]+(?:\|[\w.-]+)*)(?:,[\w]+=[\w.-]+(?:\|[\w.-]+)*)*)\]$/;
 var rawConfigurableScope = z4.string().regex(rawConfigurableScopeRegex);
 var SearchScope = z4.object({
@@ -2627,6 +2632,74 @@ var legacyScopeToV2Scope = (v1Scope) => {
   }
   throw new Error(`Unsupported V1 scope type: ${v1Scope}`);
 };
+var MERGEABLE_USER_SCOPE_TYPES = ["user.create", "user.edit"];
+function isMergeableUserScopeType(type) {
+  return MERGEABLE_USER_SCOPE_TYPES.includes(type);
+}
+function decodeLegacyScope(legacy) {
+  const encoded = legacyScopeToV2Scope(legacy);
+  const scope = decodeScope(encoded);
+  if (!scope) {
+    throw new Error(
+      `Could not decode migrated scope from legacy '${legacy}' (encoded: '${encoded}').`
+    );
+  }
+  return { legacy, scope };
+}
+function groupByType(entries) {
+  return entries.reduce(
+    (groups, entry) => ({
+      ...groups,
+      [entry.scope.type]: [...groups[entry.scope.type] ?? [], entry]
+    }),
+    {}
+  );
+}
+function deduplicateEntries(entries) {
+  return entries.filter(
+    (entry, index) => entries.findIndex((e) => (0, import_lodash.isEqual)(e.scope, entry.scope)) === index
+  );
+}
+function mergeEntries(type, entries) {
+  const optionsList = entries.map(
+    (e) => "options" in e.scope && e.scope.options ? e.scope.options : {}
+  );
+  const allKeys = optionsList.flatMap(
+    (opts) => Object.keys(opts).filter((k) => opts[k] !== void 0)
+  );
+  const conflictKey = allKeys.find((key, i) => allKeys.indexOf(key) !== i);
+  if (conflictKey) {
+    const conflicting = entries.filter(
+      (e) => conflictKey in ("options" in e.scope && e.scope.options || {})
+    ).map((e) => JSON.stringify(e.legacy));
+    throw new Error(
+      `Cannot auto-merge two '${type}' scopes that both define '${conflictKey}'. Conflicting legacy scopes: [${conflicting.join(", ")}]. Resolve manually in roles.ts and re-run.`
+    );
+  }
+  const mergedOptions = Object.assign({}, ...optionsList);
+  const merged = Object.keys(mergedOptions).length > 0 ? { type, options: mergedOptions } : { type };
+  const parsed = Scope2.safeParse(merged);
+  if (!parsed.success) {
+    throw new Error(
+      `Merged '${type}' scope failed schema validation: ${parsed.error.message}. Legacy scopes: [${entries.map((e) => JSON.stringify(e.legacy)).join(", ")}].`
+    );
+  }
+  return parsed.data;
+}
+function migrateLegacyScopesArrayToV2Scopes(legacyScopes) {
+  const groups = groupByType(legacyScopes.map(decodeLegacyScope));
+  return Object.entries(groups).flatMap(([type, entries]) => {
+    const deduped = deduplicateEntries(entries);
+    if (deduped.length <= 1) return deduped.map((e) => e.scope);
+    if (!isMergeableUserScopeType(type)) {
+      console.warn(
+        `Multiple non-mergeable '${type}' scopes detected after dedup \u2014 kept all as-is. Legacy scopes: [${deduped.map((e) => JSON.stringify(e.legacy)).join(", ")}]. Review whether the duplication is intentional.`
+      );
+      return deduped.map((e) => e.scope);
+    }
+    return [mergeEntries(type, deduped)];
+  });
+}
 
 // src/migrations/v2.0/migrate-scopes.ts
 var ROLES_FILE_RELATIVE_PATH = "src/data-seeding/roles/roles.ts";
@@ -2664,57 +2737,65 @@ function resolveLegacyScopeFromElement(element) {
 }
 function migrateScopesArrays(rolesFilePath, project) {
   const sourceFile = project.getSourceFile(rolesFilePath);
-  if (!sourceFile) return { migratedCount: 0, removedCount: 0 };
+  if (!sourceFile) {
+    return { migratedCount: 0, removedCount: 0, mergedCount: 0 };
+  }
   let migratedCount = 0;
   let removedCount = 0;
+  let mergedCount = 0;
   const scopesProperties = sourceFile.getDescendantsOfKind(import_ts_morph11.SyntaxKind.PropertyAssignment).filter((prop) => prop.getName() === SCOPES_PROPERTY_NAME);
+  const relPath = import_path11.default.relative(process.cwd(), rolesFilePath);
   for (const scopesProp of scopesProperties) {
     const initializer = scopesProp.getInitializer();
     if (!initializer || !import_ts_morph11.Node.isArrayLiteralExpression(initializer)) continue;
-    const elements = initializer.getElements();
-    for (let index = elements.length - 1; index >= 0; index--) {
-      const element = elements[index];
-      if (!import_ts_morph11.Node.isExpression(element)) continue;
+    const rawTexts = [];
+    const legacyStrings = [];
+    let anyChange = false;
+    for (const element of initializer.getElements()) {
       const scopeKey = resolveScopeKeyFromElementAccess(element);
       if (scopeKey && !(scopeKey in SCOPES)) {
         console.warn(
-          `  [${import_path11.default.relative(process.cwd(), rolesFilePath)}] Removing unknown scope reference: SCOPES.${scopeKey}`
+          `  [${relPath}] Removing unknown scope reference: SCOPES.${scopeKey}`
         );
-        initializer.removeElement(index);
         removedCount++;
+        anyChange = true;
         continue;
       }
       const legacyScope = resolveLegacyScopeFromElement(element);
       if (!legacyScope) {
         console.warn(
-          `  [${import_path11.default.relative(process.cwd(), rolesFilePath)}] Skipping non-literal scope expression: ${element.getText()}`
+          `  [${relPath}] Preserving non-literal scope expression verbatim: ${element.getText()}`
         );
+        rawTexts.push(element.getText());
         continue;
       }
-      try {
-        const migratedScope = legacyScopeToV2Scope(legacyScope);
-        const scope = decodeScope(migratedScope);
-        if (!scope) {
-          console.warn(
-            `  [${import_path11.default.relative(process.cwd(), rolesFilePath)}] Could not decode migrated scope '${migratedScope}'.`
-          );
-          continue;
-        }
-        element.replaceWithText(JSON.stringify(scope));
-        migratedCount++;
-      } catch (error) {
-        console.warn(
-          `  [${import_path11.default.relative(process.cwd(), rolesFilePath)}] Could not migrate scope '${legacyScope}': ${error}`
-        );
-      }
+      legacyStrings.push(legacyScope);
+      anyChange = true;
+    }
+    if (!anyChange) continue;
+    let mergedScopes;
+    try {
+      mergedScopes = migrateLegacyScopesArrayToV2Scopes(legacyStrings);
+    } catch (error) {
+      throw new Error(
+        `[${relPath}] Failed to migrate scopes for role: ${error instanceof Error ? error.message : String(error)}`,
+        { cause: error }
+      );
     }
+    migratedCount += legacyStrings.length;
+    mergedCount += legacyStrings.length - mergedScopes.length;
+    const outputElements = [
+      ...rawTexts,
+      ...mergedScopes.map((s) => JSON.stringify(s))
+    ];
+    scopesProp.setInitializer(`[${outputElements.join(", ")}]`);
   }
   if (removedCount > 0) {
     console.log(
-      `  Removed ${removedCount} unknown SCOPES reference(s) from '${import_path11.default.relative(process.cwd(), rolesFilePath)}'.`
+      `  Removed ${removedCount} unknown SCOPES reference(s) from '${relPath}'.`
     );
   }
-  return { migratedCount, removedCount };
+  return { migratedCount, removedCount, mergedCount };
 }
 function ensureScopesHelpersImport(rolesFilePath, project) {
   const sourceFile = project.getSourceFile(rolesFilePath);
@@ -2849,7 +2930,7 @@ async function main11() {
     return;
   }
   const importChanged = ensureScopesHelpersImport(rolesFilePath, project);
-  const { migratedCount, removedCount } = migrateScopesArrays(
+  const { migratedCount, removedCount, mergedCount } = migrateScopesArrays(
     rolesFilePath,
     project
   );
@@ -2868,7 +2949,7 @@ async function main11() {
   }
   await sourceFile.save();
   console.log(
-    `Done. Migrated ${migratedCount} legacy scope(s), removed ${removedCount} unknown SCOPES reference(s), wrapped ${wrappedScopesCount} scope array(s) with defineScopes()${wrappedRoles ? ", wrapped roles with defineRoles()" : ""}${removedRoleType ? ", and removed Role type definition" : ""}${importChanged ? ". Updated toolkit/scopes imports." : "."}`
+    `Done. Migrated ${migratedCount} legacy scope(s), merged ${mergedCount} AND-paired scope(s) into single v2 objects (privilege-escalation fix, see issue #12489), removed ${removedCount} unknown SCOPES reference(s), wrapped ${wrappedScopesCount} scope array(s) with defineScopes()${wrappedRoles ? ", wrapped roles with defineRoles()" : ""}${removedRoleType ? ", and removed Role type definition" : ""}${importChanged ? ". Updated toolkit/scopes imports." : "."}`
   );
 }
 
@@ -3674,6 +3755,10 @@ var ACTION_PROPERTY_NAME2 = "action";
 var CONDITIONALS_PROPERTY_NAME = "conditionals";
 var TYPE_PROPERTY_NAME7 = "type";
 var SLUG_PROPERTY_NAME = "slug";
+var READ_ACTION_TYPE = "READ";
+var ACTION_TYPE_IMPORT_NAME = "ActionType";
+var TOOLKIT_EVENTS_MODULE2 = "@opencrvs/toolkit/events";
+var READ_ACTION_FALLBACK_INITIALIZER = `{ type: ${ACTION_TYPE_IMPORT_NAME}.${READ_ACTION_TYPE} }`;
 var SUPPORTED_WORKQUEUE_ACTION_TYPES = /* @__PURE__ */ new Set([
   "READ",
   "DELETE",
@@ -3721,91 +3806,137 @@ function isUnsupportedActionType(action) {
   }
   return !SUPPORTED_WORKQUEUE_ACTION_TYPES.has(typeName);
 }
-function migrateWorkqueueActions(workqueue, relPath) {
-  const actionsProperty = workqueue.getProperty(ACTIONS_PROPERTY_NAME5);
-  if (!actionsProperty || !import_ts_morph17.Node.isPropertyAssignment(actionsProperty)) {
-    return 0;
-  }
-  const actionsInitializer = actionsProperty.getInitializer();
-  if (!actionsInitializer || !import_ts_morph17.Node.isArrayLiteralExpression(actionsInitializer)) {
-    return 0;
+function ensureValidAction(workqueue, relPath) {
+  const workqueueLabel = getWorkqueueLabel(workqueue);
+  const actionProperty = workqueue.getProperty(ACTION_PROPERTY_NAME2);
+  if (actionProperty && import_ts_morph17.Node.isPropertyAssignment(actionProperty)) {
+    const initializer = actionProperty.getInitializer();
+    if (initializer && import_ts_morph17.Node.isObjectLiteralExpression(initializer)) {
+      if (!isUnsupportedActionType(initializer)) {
+        return { changed: false, usedReadFallback: false };
+      }
+      actionProperty.set({
+        name: ACTION_PROPERTY_NAME2,
+        initializer: READ_ACTION_FALLBACK_INITIALIZER
+      });
+      console.log(
+        `  [${relPath}] Replaced unsupported 'action' type with '${ACTION_TYPE_IMPORT_NAME}.${READ_ACTION_TYPE}' on workqueue '${workqueueLabel}'`
+      );
+      return { changed: true, usedReadFallback: true };
+    }
   }
+  workqueue.addPropertyAssignment({
+    name: ACTION_PROPERTY_NAME2,
+    initializer: READ_ACTION_FALLBACK_INITIALIZER
+  });
+  console.log(
+    `  [${relPath}] Added default 'action: ${READ_ACTION_FALLBACK_INITIALIZER}' to workqueue '${workqueueLabel}'`
+  );
+  return { changed: true, usedReadFallback: true };
+}
+function migrateWorkqueueActions(workqueue, relPath) {
   const workqueueLabel = getWorkqueueLabel(workqueue);
-  const existingActionProperty = workqueue.getProperty(ACTION_PROPERTY_NAME2);
-  if (existingActionProperty) {
-    if (import_ts_morph17.Node.isPropertyAssignment(existingActionProperty)) {
-      const existingActionInitializer = existingActionProperty.getInitializer();
-      if (existingActionInitializer && import_ts_morph17.Node.isObjectLiteralExpression(existingActionInitializer)) {
-        const conditionalsProperty2 = existingActionInitializer.getProperty(
-          CONDITIONALS_PROPERTY_NAME
+  const actionsProperty = workqueue.getProperty(ACTIONS_PROPERTY_NAME5);
+  let actionsArrayMigrated = false;
+  if (actionsProperty && import_ts_morph17.Node.isPropertyAssignment(actionsProperty)) {
+    const actionsInitializer = actionsProperty.getInitializer();
+    if (actionsInitializer && import_ts_morph17.Node.isArrayLiteralExpression(actionsInitializer)) {
+      const existingActionProperty = workqueue.getProperty(ACTION_PROPERTY_NAME2);
+      if (existingActionProperty) {
+        if (import_ts_morph17.Node.isPropertyAssignment(existingActionProperty)) {
+          const existingActionInitializer = existingActionProperty.getInitializer();
+          if (existingActionInitializer && import_ts_morph17.Node.isObjectLiteralExpression(existingActionInitializer)) {
+            const conditionalsProperty = existingActionInitializer.getProperty(
+              CONDITIONALS_PROPERTY_NAME
+            );
+            if (conditionalsProperty) {
+              conditionalsProperty.remove();
+              console.log(
+                `  [${relPath}] Removed deprecated 'conditionals' from 'action' on workqueue '${workqueueLabel}'`
+              );
+            }
+          }
+        }
+        actionsProperty.remove();
+        console.log(
+          `  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' (existing 'action' kept)`
+        );
+        actionsArrayMigrated = true;
+      } else {
+        const actionCandidates = actionsInitializer.getElements().filter(
+          (element) => import_ts_morph17.Node.isObjectLiteralExpression(element)
         );
-        if (conditionalsProperty2) {
-          conditionalsProperty2.remove();
+        if (actionCandidates.length === 0) {
+          actionsProperty.remove();
           console.log(
-            `  [${relPath}] Removed deprecated 'conditionals' from 'action' on workqueue '${workqueueLabel}'`
+            `  [${relPath}] Removed empty 'actions' from workqueue '${workqueueLabel}'`
           );
-        }
-        if (isUnsupportedActionType(existingActionInitializer)) {
-          existingActionProperty.remove();
-          console.log(
-            `  [${relPath}] Removed unsupported 'action' type on workqueue '${workqueueLabel}'`
+          actionsArrayMigrated = true;
+        } else {
+          if (actionCandidates.length > 1) {
+            const droppedCount = actionCandidates.length - 1;
+            console.warn(
+              `  [${relPath}] Workqueue '${workqueueLabel}' has ${actionCandidates.length} actions; keeping first as 'action' and dropping ${droppedCount} extra action(s)`
+            );
+          }
+          const conditionalsProperty = actionCandidates[0].getProperty(
+            CONDITIONALS_PROPERTY_NAME
           );
+          if (conditionalsProperty) {
+            conditionalsProperty.remove();
+            console.log(
+              `  [${relPath}] Removed deprecated 'conditionals' from migrated 'action' on workqueue '${workqueueLabel}'`
+            );
+          }
+          if (isUnsupportedActionType(actionCandidates[0])) {
+            actionsProperty.remove();
+            console.log(
+              `  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' because action type is unsupported`
+            );
+            actionsArrayMigrated = true;
+          } else {
+            const firstActionText = actionCandidates[0].getText();
+            workqueue.addPropertyAssignment({
+              name: ACTION_PROPERTY_NAME2,
+              initializer: firstActionText
+            });
+            actionsProperty.remove();
+            console.log(
+              `  [${relPath}] Replaced 'actions' with 'action' on workqueue '${workqueueLabel}'`
+            );
+            actionsArrayMigrated = true;
+          }
         }
       }
     }
-    actionsProperty.remove();
-    console.log(
-      `  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' (existing 'action' kept)`
-    );
-    return 1;
-  }
-  const actionCandidates = actionsInitializer.getElements().filter(
-    (element) => import_ts_morph17.Node.isObjectLiteralExpression(element)
-  );
-  if (actionCandidates.length === 0) {
-    actionsProperty.remove();
-    console.log(
-      `  [${relPath}] Removed empty 'actions' from workqueue '${workqueueLabel}'`
-    );
-    return 1;
   }
-  if (actionCandidates.length > 1) {
-    const droppedCount = actionCandidates.length - 1;
-    console.warn(
-      `  [${relPath}] Workqueue '${workqueueLabel}' has ${actionCandidates.length} actions; keeping first as 'action' and dropping ${droppedCount} extra action(s)`
-    );
-  }
-  const conditionalsProperty = actionCandidates[0].getProperty(
-    CONDITIONALS_PROPERTY_NAME
+  const fallback = ensureValidAction(workqueue, relPath);
+  return {
+    changed: actionsArrayMigrated || fallback.changed,
+    usedReadFallback: fallback.usedReadFallback
+  };
+}
+function ensureActionTypeImport(sourceFile) {
+  const existingImport = sourceFile.getImportDeclaration(
+    (decl) => decl.getModuleSpecifierValue() === TOOLKIT_EVENTS_MODULE2
   );
-  if (conditionalsProperty) {
-    conditionalsProperty.remove();
-    console.log(
-      `  [${relPath}] Removed deprecated 'conditionals' from migrated 'action' on workqueue '${workqueueLabel}'`
-    );
-  }
-  if (isUnsupportedActionType(actionCandidates[0])) {
-    actionsProperty.remove();
-    console.log(
-      `  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' because action type is unsupported`
-    );
-    return 1;
+  if (existingImport) {
+    const alreadyImported = existingImport.getNamedImports().some((ni) => ni.getName() === ACTION_TYPE_IMPORT_NAME);
+    if (!alreadyImported) {
+      existingImport.addNamedImport(ACTION_TYPE_IMPORT_NAME);
+    }
+    return;
   }
-  const firstActionText = actionCandidates[0].getText();
-  workqueue.addPropertyAssignment({
-    name: ACTION_PROPERTY_NAME2,
-    initializer: firstActionText
+  sourceFile.addImportDeclaration({
+    moduleSpecifier: TOOLKIT_EVENTS_MODULE2,
+    namedImports: [ACTION_TYPE_IMPORT_NAME]
   });
-  actionsProperty.remove();
-  console.log(
-    `  [${relPath}] Replaced 'actions' with 'action' on workqueue '${workqueueLabel}'`
-  );
-  return 1;
 }
 function processFile13(filePath, project) {
   const sourceFile = project.getSourceFile(filePath);
   if (!sourceFile) return 0;
   let migratedWorkqueues = 0;
+  let needsActionTypeImport = false;
   const relPath = import_path18.default.relative(process.cwd(), filePath);
   const callExpressions = sourceFile.getDescendantsOfKind(
     import_ts_morph17.SyntaxKind.CallExpression
@@ -3821,9 +3952,14 @@ function processFile13(filePath, project) {
     if (!import_ts_morph17.Node.isArrayLiteralExpression(workqueuesArg)) continue;
     for (const element of workqueuesArg.getElements()) {
       if (!import_ts_morph17.Node.isObjectLiteralExpression(element)) continue;
-      migratedWorkqueues += migrateWorkqueueActions(element, relPath);
+      const result = migrateWorkqueueActions(element, relPath);
+      if (result.changed) migratedWorkqueues++;
+      if (result.usedReadFallback) needsActionTypeImport = true;
     }
   }
+  if (needsActionTypeImport) {
+    ensureActionTypeImport(sourceFile);
+  }
   return migratedWorkqueues;
 }
 async function main18() {
@@ -4158,7 +4294,7 @@ Saved ${handlerRelPath}.`);
 // src/migrations/v2.0/checkout-upstream-files.ts
 var import_child_process = require("child_process");
 var UPSTREAM_URL = "https://github.com/opencrvs/opencrvs-countryconfig.git";
-var UPSTREAM_BRANCH = "develop";
+var UPSTREAM_BRANCH = "release-v2.0.0";
 var TEMP_REMOTE = "opencrvs-upgrade-v19-v20-codemod";
 var FILES_TO_CHECKOUT = [
   "src/analytics/analytics.ts",
@@ -4697,9 +4833,9 @@ var import_path24 = require("path");
 var TEMP_REMOTE2 = "opencrvs-upgrade-v19-v20-codemod-merge-infra";
 var INFRASTRUCTURE_DIR = "infrastructure";
 var BASE_BRANCH = "release-v1.9";
-function gitShowBytes(ref, path23) {
+function gitShowBytes(ref, path24) {
   try {
-    const buf = (0, import_child_process2.execFileSync)("git", ["show", `${ref}:${path23}`], {
+    const buf = (0, import_child_process2.execFileSync)("git", ["show", `${ref}:${path24}`], {
       cwd: process.cwd(),
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4708,9 +4844,13 @@ function gitShowBytes(ref, path23) {
     return null;
   }
 }
-async function main25() {
+async function main25({
+  subdirs = []
+} = {}) {
+  const pathspecs = subdirs.length > 0 ? subdirs.map((s) => `${INFRASTRUCTURE_DIR}/${s}/`) : [`${INFRASTRUCTURE_DIR}/`];
+  const scopeLabel = pathspecs.map((p) => `'${p}'`).join(", ");
   console.log(
-    `Merging '${INFRASTRUCTURE_DIR}/' from ${UPSTREAM_URL}@${UPSTREAM_BRANCH} (base: ${BASE_BRANCH})...
+    `Merging ${scopeLabel} from ${UPSTREAM_URL}@${UPSTREAM_BRANCH} (base: ${BASE_BRANCH})...
 `
   );
   assertIsGitRepo();
@@ -4725,20 +4865,12 @@ async function main25() {
     const ref = `${TEMP_REMOTE2}/${UPSTREAM_BRANCH}`;
     const baseRef = `${TEMP_REMOTE2}/${BASE_BRANCH}`;
     const upstreamFiles = runGit(
-      [
-        "ls-tree",
-        "-r",
-        "--name-only",
-        "-z",
-        ref,
-        "--",
-        `${INFRASTRUCTURE_DIR}/`
-      ],
+      ["ls-tree", "-r", "--name-only", "-z", ref, "--", ...pathspecs],
       { silent: true }
     ).split("\0").filter(Boolean);
     if (upstreamFiles.length === 0) {
       console.log(
-        `  No files found under '${INFRASTRUCTURE_DIR}/' on ${ref}. Nothing to merge.`
+        `  No files found under ${scopeLabel} on ${ref}. Nothing to merge.`
       );
       return;
     }
@@ -4813,7 +4945,9 @@ async function main25() {
 var import_fs6 = require("fs");
 var import_path25 = require("path");
 var INFRASTRUCTURE_DIR2 = "infrastructure";
-async function main26() {
+async function main26({
+  keep = []
+} = {}) {
   const fullPath = (0, import_path25.join)(process.cwd(), INFRASTRUCTURE_DIR2);
   if (!(0, import_fs6.existsSync)(fullPath)) {
     console.log(
@@ -4821,24 +4955,152 @@ async function main26() {
     );
     return;
   }
-  console.log(`Deleting '${INFRASTRUCTURE_DIR2}/'...
-`);
   assertIsGitRepo();
-  runGit(["rm", "-rf", "--ignore-unmatch", "--", `${INFRASTRUCTURE_DIR2}/`], {
-    silent: true
+  if (keep.length === 0) {
+    console.log(`Deleting '${INFRASTRUCTURE_DIR2}/'...
+`);
+    runGit(["rm", "-rf", "--ignore-unmatch", "--", `${INFRASTRUCTURE_DIR2}/`], {
+      silent: true
+    });
+    console.log(
+      `  Staged deletion of tracked files under '${INFRASTRUCTURE_DIR2}/'.`
+    );
+    if ((0, import_fs6.existsSync)(fullPath)) {
+      (0, import_fs6.rmSync)(fullPath, { recursive: true, force: true });
+      console.log(
+        `  Removed remaining untracked files under '${INFRASTRUCTURE_DIR2}/'.`
+      );
+    }
+    console.log(
+      `
+  Done. Review the staged deletion with: git diff --cached -- '${INFRASTRUCTURE_DIR2}/'`
+    );
+    return;
+  }
+  const keepSet = new Set(keep);
+  console.log(
+    `Deleting contents of '${INFRASTRUCTURE_DIR2}/' except: ${[...keepSet].map((name) => `'${name}'`).join(", ")}
+`
+  );
+  const topLevelEntries = (0, import_fs6.readdirSync)(fullPath, { withFileTypes: true });
+  let deleted = 0;
+  for (const entry of topLevelEntries) {
+    if (keepSet.has(entry.name)) {
+      console.log(`  Keeping '${INFRASTRUCTURE_DIR2}/${entry.name}'.`);
+      continue;
+    }
+    const relPath = `${INFRASTRUCTURE_DIR2}/${entry.name}${entry.isDirectory() ? "/" : ""}`;
+    runGit(["rm", "-rf", "--ignore-unmatch", "--", relPath], { silent: true });
+    const fullEntryPath = (0, import_path25.join)(fullPath, entry.name);
+    if ((0, import_fs6.existsSync)(fullEntryPath)) {
+      (0, import_fs6.rmSync)(fullEntryPath, { recursive: true, force: true });
+    }
+    console.log(`  Deleted '${relPath}'.`);
+    deleted++;
+  }
+  const presentNames = new Set(topLevelEntries.map((e) => e.name));
+  const missingKeeps = [...keepSet].filter((name) => !presentNames.has(name));
+  if (missingKeeps.length > 0) {
+    console.warn(
+      `  [warn] Requested to keep ${missingKeeps.map((n) => `'${n}'`).join(", ")} but they don't exist under '${INFRASTRUCTURE_DIR2}/'.`
+    );
+  }
+  console.log(
+    `
+  Done. Deleted ${deleted} top-level entr${deleted === 1 ? "y" : "ies"}. Review the staged deletions with: git diff --cached -- '${INFRASTRUCTURE_DIR2}/'`
+  );
+}
+
+// src/migrations/v2.0/fix-accept-requested-registration-function-type.ts
+var import_ts_morph22 = require("ts-morph");
+var import_path26 = __toESM(require("path"));
+var TARGET_FUNCTION_NAME = "acceptRequestedRegistration";
+var ACTION_PARAMETER_NAME = "action";
+var OLD_TYPE = "ActionInput";
+var NEW_TYPE = "Extract<ActionInput, { type?: 'REGISTER' }>";
+function isAcceptRequestedRegistrationParameter(parameter) {
+  const functionDeclaration = parameter.getFirstAncestorByKind(
+    import_ts_morph22.SyntaxKind.FunctionDeclaration
+  );
+  if (functionDeclaration?.getName() === TARGET_FUNCTION_NAME) {
+    return true;
+  }
+  const arrowFunction = parameter.getFirstAncestorByKind(
+    import_ts_morph22.SyntaxKind.ArrowFunction
+  );
+  const variableDeclaration = arrowFunction?.getFirstAncestorByKind(
+    import_ts_morph22.SyntaxKind.VariableDeclaration
+  );
+  return variableDeclaration?.getName() === TARGET_FUNCTION_NAME;
+}
+function processFile14(filePath, project) {
+  const sourceFile = project.getSourceFile(filePath);
+  if (!sourceFile) return 0;
+  let updatedCount = 0;
+  for (const parameter of sourceFile.getDescendantsOfKind(
+    import_ts_morph22.SyntaxKind.Parameter
+  )) {
+    if (parameter.getName() !== ACTION_PARAMETER_NAME) {
+      continue;
+    }
+    if (!isAcceptRequestedRegistrationParameter(parameter)) {
+      continue;
+    }
+    const typeNode = parameter.getTypeNode();
+    if (!typeNode || typeNode.getText() !== OLD_TYPE) {
+      continue;
+    }
+    parameter.setType(NEW_TYPE);
+    updatedCount++;
+    console.log(
+      `  [${import_path26.default.relative(process.cwd(), filePath)}] Updated '${ACTION_PARAMETER_NAME}' in ${TARGET_FUNCTION_NAME} to ${NEW_TYPE}`
+    );
+  }
+  return updatedCount;
+}
+async function main27() {
+  const srcDir = import_path26.default.join(process.cwd(), "src");
+  console.log(`Scanning for ${TARGET_FUNCTION_NAME} in: ${srcDir}
+`);
+  const project = new import_ts_morph22.Project({
+    tsConfigFilePath: import_path26.default.resolve(srcDir, "../tsconfig.json"),
+    skipAddingFilesFromTsConfig: false
   });
-  console.log(`  Staged deletion of tracked files under '${INFRASTRUCTURE_DIR2}/'.`);
-  if ((0, import_fs6.existsSync)(fullPath)) {
-    (0, import_fs6.rmSync)(fullPath, { recursive: true, force: true });
-    console.log(`  Removed remaining untracked files under '${INFRASTRUCTURE_DIR2}/'.`);
+  const sourceFiles = project.getSourceFiles().filter((sf) => {
+    const filePath = sf.getFilePath();
+    return filePath.includes("/src/") && !filePath.includes("/node_modules/");
+  });
+  let totalUpdated = 0;
+  const modifiedFiles = [];
+  for (const sourceFile of sourceFiles) {
+    const filePath = sourceFile.getFilePath();
+    const updated = processFile14(filePath, project);
+    if (updated > 0) {
+      totalUpdated += updated;
+      modifiedFiles.push(filePath);
+    }
+  }
+  if (modifiedFiles.length === 0) {
+    console.log(
+      `No '${ACTION_PARAMETER_NAME}: ${OLD_TYPE}' parameter in ${TARGET_FUNCTION_NAME} found. Nothing to do.`
+    );
+    return;
+  }
+  console.log(`
+Saving ${modifiedFiles.length} modified file(s)...`);
+  for (const filePath of modifiedFiles) {
+    const sourceFile = project.getSourceFileOrThrow(filePath);
+    await sourceFile.save();
+    console.log(`  Saved: ${import_path26.default.relative(process.cwd(), filePath)}`);
   }
   console.log(
     `
-  Done. Review the staged deletion with: git diff --cached -- '${INFRASTRUCTURE_DIR2}/'`
+Done. Updated ${totalUpdated} parameter type annotation(s) in ${TARGET_FUNCTION_NAME}.`
   );
 }
 
 // src/migrations/v2.0/index.ts
+var NON_SWARM_INFRA_SUBDIRS = ["postgres", "metabase"];
 async function runUpgrade(dockerSwarm) {
   await main18();
   await main();
@@ -4863,11 +5125,13 @@ async function runUpgrade(dockerSwarm) {
   await main22();
   await main23();
   await main24();
+  await main27();
   await main17();
   if (dockerSwarm) {
     await main25();
   } else {
-    await main26();
+    await main26({ keep: NON_SWARM_INFRA_SUBDIRS });
+    await main25({ subdirs: NON_SWARM_INFRA_SUBDIRS });
   }
 }
 
@@ -4896,7 +5160,7 @@ Options:
                    'infrastructure/' directory is deleted (default).
   -h, --help       Show this message.
 `.trim();
-function main27() {
+function main28() {
   const command = args[0];
   if (!command || command === "--help" || command === "-h") {
     console.log(USAGE);
@@ -4971,4 +5235,4 @@ function handleCheckTranslations() {
   console.warn("This command is not implemented yet!");
   process.exit(1);
 }
-main27();
+main28();