@opencrvs/toolkit 2.0.0-rc.fef9d21 → 2.0.0-rc.ff1424b

package/dist/migrations/v2.0/index.js

@@ -190,6 +190,8 @@ function ensureImports(sourceFile) {
 var DEFINE_CONFIG_NAME2 = "defineConfig";
 var ACTIONS_PROPERTY_NAME2 = "actions";
 var TYPE_PROPERTY_NAME2 = "type";
+var ID_PROPERTY_NAME = "id";
+var FLAGS_PROPERTY_NAME = "flags";
 var CUSTOM_ACTION_TYPE_PROPERTY_NAME = "customActionType";
 var AUDIT_HISTORY_LABEL_PROPERTY_NAME = "auditHistoryLabel";
 var DEDUPLICATION_PROPERTY_NAME = "deduplication";
@@ -199,9 +201,12 @@ var FORM_PROPERTY_NAME = "form";
 var ACTION_TYPE_ENUM_NAME = "ActionType";
 var VALIDATE_MEMBER_NAME = "VALIDATE";
 var CUSTOM_MEMBER_NAME = "CUSTOM";
+var REGISTER_MEMBER_NAME2 = "REGISTER";
 var VALIDATE_STRING_LITERAL = "VALIDATE";
 var CUSTOM_STRING_LITERAL = "CUSTOM";
+var REGISTER_STRING_LITERAL2 = "REGISTER";
 var VALIDATE_DECLARATION_VALUE = "VALIDATE_DECLARATION";
+var VALIDATED_FLAG_VALUE = "validated";
 function isValidateType(typeInitializer) {
   if (typeInitializer.getKind() === import_ts_morph2.SyntaxKind.PropertyAccessExpression) {
     const propAccess = typeInitializer.asKindOrThrow(
@@ -325,6 +330,50 @@ function transformValidateActionToCustom(obj, eventType) {
   }
   return true;
 }
+function isRegisterAction(action) {
+  const typeProperty = action.getProperty(TYPE_PROPERTY_NAME2);
+  if (!typeProperty || !import_ts_morph2.Node.isPropertyAssignment(typeProperty)) return false;
+  const typeInit = typeProperty.getInitializer();
+  if (!typeInit) return false;
+  if (import_ts_morph2.Node.isPropertyAccessExpression(typeInit)) {
+    const enumExpr = typeInit.getExpression();
+    return import_ts_morph2.Node.isIdentifier(enumExpr) && enumExpr.getText() === ACTION_TYPE_ENUM_NAME && typeInit.getName() === REGISTER_MEMBER_NAME2;
+  }
+  if (import_ts_morph2.Node.isStringLiteral(typeInit)) {
+    return typeInit.getLiteralValue() === REGISTER_STRING_LITERAL2;
+  }
+  return false;
+}
+function arrayHasElementWithId(array3, id) {
+  for (const el of array3.getElements()) {
+    if (!import_ts_morph2.Node.isObjectLiteralExpression(el)) continue;
+    const idProp = el.getProperty(ID_PROPERTY_NAME);
+    if (!idProp || !import_ts_morph2.Node.isPropertyAssignment(idProp)) continue;
+    const idInit = idProp.getInitializer();
+    if (idInit && import_ts_morph2.Node.isStringLiteral(idInit) && idInit.getLiteralValue() === id) {
+      return true;
+    }
+  }
+  return false;
+}
+function ensureRegisterRemovesValidatedFlag(action) {
+  const entry = `{ id: '${VALIDATED_FLAG_VALUE}', operation: 'remove' }`;
+  const flagsProp = action.getProperty(FLAGS_PROPERTY_NAME);
+  if (flagsProp && import_ts_morph2.Node.isPropertyAssignment(flagsProp)) {
+    const flagsInit = flagsProp.getInitializer();
+    if (flagsInit && import_ts_morph2.Node.isArrayLiteralExpression(flagsInit)) {
+      if (arrayHasElementWithId(flagsInit, VALIDATED_FLAG_VALUE)) return false;
+      flagsInit.addElement(entry);
+      return true;
+    }
+    return false;
+  }
+  action.addPropertyAssignment({
+    name: FLAGS_PROPERTY_NAME,
+    initializer: `[${entry}]`
+  });
+  return true;
+}
 function processFile2(filePath, project) {
   const sourceFile = project.getSourceFile(filePath);
   if (!sourceFile) return 0;
@@ -390,6 +439,18 @@ function processFile2(filePath, project) {
         `  [${import_path2.default.relative(process.cwd(), filePath)}] Added top-level 'flags' array to defineConfig`
       );
     }
+    if (configHadValidateAction) {
+      for (const element of actionsInitializer.getElements()) {
+        if (!import_ts_morph2.Node.isObjectLiteralExpression(element)) continue;
+        if (!isRegisterAction(element)) continue;
+        if (ensureRegisterRemovesValidatedFlag(element)) {
+          transformedCount++;
+          console.log(
+            `  [${import_path2.default.relative(process.cwd(), filePath)}] Added '${VALIDATED_FLAG_VALUE}' remove-flag to REGISTER action`
+          );
+        }
+      }
+    }
     if (fileNeedsImports) {
       ensureImports(sourceFile);
     }
@@ -436,7 +497,7 @@ Saving ${modifiedFiles.length} modified file(s)...`);
   }
   console.log(
     `
-Done. Transformed ${totalTransformed} VALIDATE action(s) to CUSTOM with customActionType: '${VALIDATE_DECLARATION_VALUE}'.`
+Done. Applied ${totalTransformed} change(s): VALIDATE \u2192 CUSTOM (${VALIDATE_DECLARATION_VALUE}) and '${VALIDATED_FLAG_VALUE}' remove-flag on matching REGISTER actions.`
   );
 }
 
@@ -679,14 +740,14 @@ var QUERY_PROPERTY_NAME = "query";
 var TYPE_PROPERTY_NAME5 = "type";
 var CLAUSES_PROPERTY_NAME = "clauses";
 var STATUS_PROPERTY_NAME = "status";
-var FLAGS_PROPERTY_NAME = "flags";
+var FLAGS_PROPERTY_NAME2 = "flags";
 var TERMS_PROPERTY_NAME = "terms";
 var TERM_PROPERTY_NAME = "term";
 var ANY_OF_PROPERTY_NAME = "anyOf";
 var VALIDATED_STATUS_VALUE = "VALIDATED";
-var VALIDATED_FLAG_VALUE = "validated";
+var VALIDATED_FLAG_VALUE2 = "validated";
 function addValidatedFlag(clause) {
-  const flagsProperty = clause.getProperty(FLAGS_PROPERTY_NAME);
+  const flagsProperty = clause.getProperty(FLAGS_PROPERTY_NAME2);
   if (flagsProperty && import_ts_morph5.Node.isPropertyAssignment(flagsProperty)) {
     const flagsInit = flagsProperty.getInitializer();
     if (flagsInit && import_ts_morph5.Node.isObjectLiteralExpression(flagsInit)) {
@@ -694,19 +755,19 @@ function addValidatedFlag(clause) {
       if (anyOfProperty && import_ts_morph5.Node.isPropertyAssignment(anyOfProperty)) {
         const anyOfInit = anyOfProperty.getInitializer();
         if (anyOfInit && import_ts_morph5.Node.isArrayLiteralExpression(anyOfInit)) {
-          anyOfInit.addElement(`'${VALIDATED_FLAG_VALUE}'`);
+          anyOfInit.addElement(`'${VALIDATED_FLAG_VALUE2}'`);
         }
       } else {
         flagsInit.addPropertyAssignment({
           name: ANY_OF_PROPERTY_NAME,
-          initializer: `['${VALIDATED_FLAG_VALUE}']`
+          initializer: `['${VALIDATED_FLAG_VALUE2}']`
         });
       }
     }
   } else {
     clause.addPropertyAssignment({
-      name: FLAGS_PROPERTY_NAME,
-      initializer: `{ ${ANY_OF_PROPERTY_NAME}: ['${VALIDATED_FLAG_VALUE}'] }`
+      name: FLAGS_PROPERTY_NAME2,
+      initializer: `{ ${ANY_OF_PROPERTY_NAME}: ['${VALIDATED_FLAG_VALUE2}'] }`
     });
   }
 }
@@ -872,23 +933,26 @@ var DEFINE_CONFIG_NAME4 = "defineConfig";
 var DEFINE_WORKQUEUES_NAME2 = "defineWorkqueues";
 var ACTIONS_PROPERTY_NAME4 = "actions";
 var ACTION_PROPERTY_NAME = "action";
-var FLAGS_PROPERTY_NAME2 = "flags";
+var FLAGS_PROPERTY_NAME3 = "flags";
 var QUERY_PROPERTY_NAME2 = "query";
 var TYPE_PROPERTY_NAME6 = "type";
+var ID_PROPERTY_NAME2 = "id";
 var CLAUSES_PROPERTY_NAME2 = "clauses";
 var ANY_OF_PROPERTY_NAME2 = "anyOf";
 var FLAG_ID = "pending-first-certificate-issuance";
 var REGISTER_TYPE = "REGISTER";
 var PRINT_CERTIFICATE_TYPE = "PRINT_CERTIFICATE";
-var FLAG_DEFINITION_INITIALIZER = `{
+function flagDefinitionInitializer(eventType) {
+  return `{
   id: '${FLAG_ID}',
   label: {
-    id: 'event.birth.flag.${FLAG_ID}',
+    id: 'event.${eventType}.flag.${FLAG_ID}',
     defaultMessage: 'Pending first certificate issuance',
     description: 'Flag label for first certificate issuance'
   },
   requiresAction: true
 }`;
+}
 function isActionOfType(obj, typeName) {
   const typeProperty = obj.getProperty(TYPE_PROPERTY_NAME6);
   if (!typeProperty || !import_ts_morph6.Node.isPropertyAssignment(typeProperty)) return false;
@@ -902,18 +966,20 @@ function isActionOfType(obj, typeName) {
   }
   return false;
 }
-function isBirthConfig(configArg) {
-  const typeProperty = configArg.getProperty(TYPE_PROPERTY_NAME6);
-  if (!typeProperty || !import_ts_morph6.Node.isPropertyAssignment(typeProperty)) return false;
-  const initializer = typeProperty.getInitializer();
-  if (!initializer) return false;
-  if (import_ts_morph6.Node.isStringLiteral(initializer)) {
-    return initializer.getLiteralValue().toLowerCase() === "birth";
-  }
-  if (import_ts_morph6.Node.isPropertyAccessExpression(initializer)) {
-    return initializer.getName().toLowerCase() === "birth";
+function getEventType(configArg) {
+  for (const propName of [TYPE_PROPERTY_NAME6, ID_PROPERTY_NAME2]) {
+    const prop = configArg.getProperty(propName);
+    if (!prop || !import_ts_morph6.Node.isPropertyAssignment(prop)) continue;
+    const initializer = prop.getInitializer();
+    if (!initializer) continue;
+    if (import_ts_morph6.Node.isStringLiteral(initializer)) {
+      return initializer.getLiteralValue().toLowerCase();
+    }
+    if (import_ts_morph6.Node.isPropertyAccessExpression(initializer)) {
+      return initializer.getName().toLowerCase();
+    }
   }
-  return false;
+  return null;
 }
 function hasElementWithId(array3, id) {
   for (const el of array3.getElements()) {
@@ -927,27 +993,28 @@ function hasElementWithId(array3, id) {
   }
   return false;
 }
-function ensureTopLevelFlagDefinition(configArg) {
-  const flagsProp = configArg.getProperty(FLAGS_PROPERTY_NAME2);
+function ensureTopLevelFlagDefinition(configArg, eventType) {
+  const initializer = flagDefinitionInitializer(eventType);
+  const flagsProp = configArg.getProperty(FLAGS_PROPERTY_NAME3);
   if (flagsProp && import_ts_morph6.Node.isPropertyAssignment(flagsProp)) {
     const flagsInit = flagsProp.getInitializer();
     if (flagsInit && import_ts_morph6.Node.isArrayLiteralExpression(flagsInit)) {
       if (hasElementWithId(flagsInit, FLAG_ID)) return false;
-      flagsInit.addElement(FLAG_DEFINITION_INITIALIZER);
+      flagsInit.addElement(initializer);
       return true;
     }
     return false;
   }
   configArg.addPropertyAssignment({
-    name: FLAGS_PROPERTY_NAME2,
+    name: FLAGS_PROPERTY_NAME3,
     initializer: `[
-  ${FLAG_DEFINITION_INITIALIZER}
+  ${initializer}
 ]`
   });
   return true;
 }
 function ensureActionOperationFlag(action, operation) {
-  const flagsProp = action.getProperty(FLAGS_PROPERTY_NAME2);
+  const flagsProp = action.getProperty(FLAGS_PROPERTY_NAME3);
   const entry = `{ id: '${FLAG_ID}', operation: '${operation}' }`;
   if (flagsProp && import_ts_morph6.Node.isPropertyAssignment(flagsProp)) {
     const flagsInit = flagsProp.getInitializer();
@@ -959,16 +1026,18 @@ function ensureActionOperationFlag(action, operation) {
     return false;
   }
   action.addPropertyAssignment({
-    name: FLAGS_PROPERTY_NAME2,
+    name: FLAGS_PROPERTY_NAME3,
     initializer: `[${entry}]`
   });
   return true;
 }
-function processBirthConfig(configArg, relPath) {
+function processConfig(configArg, eventType, relPath) {
   let changes = 0;
-  if (ensureTopLevelFlagDefinition(configArg)) {
+  if (ensureTopLevelFlagDefinition(configArg, eventType)) {
     changes++;
-    console.log(`  [${relPath}] Added '${FLAG_ID}' to top-level flags`);
+    console.log(
+      `  [${relPath}] (${eventType}) Added '${FLAG_ID}' to top-level flags`
+    );
   }
   const actionsProp = configArg.getProperty(ACTIONS_PROPERTY_NAME4);
   if (!actionsProp || !import_ts_morph6.Node.isPropertyAssignment(actionsProp)) return changes;
@@ -982,7 +1051,7 @@ function processBirthConfig(configArg, relPath) {
       if (ensureActionOperationFlag(element, "add")) {
         changes++;
         console.log(
-          `  [${relPath}] Added '${FLAG_ID}' add-flag to REGISTER action`
+          `  [${relPath}] (${eventType}) Added '${FLAG_ID}' add-flag to REGISTER action`
         );
       }
     }
@@ -990,7 +1059,7 @@ function processBirthConfig(configArg, relPath) {
       if (ensureActionOperationFlag(element, "remove")) {
         changes++;
         console.log(
-          `  [${relPath}] Added '${FLAG_ID}' remove-flag to PRINT_CERTIFICATE action`
+          `  [${relPath}] (${eventType}) Added '${FLAG_ID}' remove-flag to PRINT_CERTIFICATE action`
         );
       }
     }
@@ -1019,7 +1088,7 @@ function hasPrintCertificateAction(workqueue) {
   return false;
 }
 function addFlagToQueryClause(clause) {
-  const flagsProp = clause.getProperty(FLAGS_PROPERTY_NAME2);
+  const flagsProp = clause.getProperty(FLAGS_PROPERTY_NAME3);
   if (flagsProp && import_ts_morph6.Node.isPropertyAssignment(flagsProp)) {
     const flagsInit = flagsProp.getInitializer();
     if (flagsInit && import_ts_morph6.Node.isObjectLiteralExpression(flagsInit)) {
@@ -1044,7 +1113,7 @@ function addFlagToQueryClause(clause) {
     }
   } else {
     clause.addPropertyAssignment({
-      name: FLAGS_PROPERTY_NAME2,
+      name: FLAGS_PROPERTY_NAME3,
       initializer: `{ ${ANY_OF_PROPERTY_NAME2}: ['${FLAG_ID}'] }`
     });
     return true;
@@ -1088,8 +1157,9 @@ function processFile6(filePath, project) {
       if (args.length === 0) continue;
       const configArg = args[0];
       if (!import_ts_morph6.Node.isObjectLiteralExpression(configArg)) continue;
-      if (!isBirthConfig(configArg)) continue;
-      totalChanges += processBirthConfig(configArg, relPath);
+      const eventType = getEventType(configArg);
+      if (!eventType) continue;
+      totalChanges += processConfig(configArg, eventType, relPath);
     }
     if (calleeName === DEFINE_WORKQUEUES_NAME2) {
       const args = call.getArguments();
@@ -1118,7 +1188,7 @@ function processFile6(filePath, project) {
 async function main6() {
   const srcDir = import_path6.default.join(process.cwd(), "src");
   console.log(
-    `Scanning for birth defineConfig and PRINT_CERTIFICATE workqueues in: ${srcDir}
+    `Scanning for defineConfig and PRINT_CERTIFICATE workqueues in: ${srcDir}
 `
   );
   const project = new import_ts_morph6.Project({
@@ -1143,7 +1213,7 @@ async function main6() {
   }
   if (modifiedFiles.length === 0) {
     console.log(
-      "No birth configs or PRINT_CERTIFICATE workqueues found. Nothing to do."
+      "No event configs or PRINT_CERTIFICATE workqueues found. Nothing to do."
     );
     return;
   }
@@ -1825,9 +1895,9 @@ function updateRouteHandlers(sourceFiles, group, srcDir, relCwd) {
   }
   return replacedCount;
 }
-function resolveConfigChain(configObj, path23) {
+function resolveConfigChain(configObj, path24) {
   let current = configObj;
-  for (const key of path23) {
+  for (const key of path24) {
     if (!import_ts_morph10.Node.isObjectLiteralExpression(current)) return null;
     const prop = current.getProperty(key);
     if (!prop || !import_ts_morph10.Node.isPropertyAssignment(prop)) return null;
@@ -2062,6 +2132,10 @@ Done. Converted ${convertedCount} config file(s), replaced ${totalReplaced} rout
 var import_ts_morph11 = require("ts-morph");
 var import_path11 = __toESM(require("path"));
 
+// ../commons/src/scopes.deprecated.do-not-use.ts
+var z4 = __toESM(require("zod/v4"));
+var import_lodash = require("lodash");
+
 // ../commons/src/scopes.ts
 var z3 = __toESM(require("zod/v4"));
 var qs = __toESM(require("qs"));
@@ -2122,6 +2196,10 @@ var scopeByEvent = z3.preprocess(
   (val) => val === void 0 ? void 0 : [val].flat(),
   z3.array(z3.string()).optional()
 ).describe("Event type, e.g. birth, death");
+var userRole = z3.preprocess(
+  (val) => val === void 0 ? void 0 : [val].flat(),
+  z3.array(z3.string()).optional()
+).describe("User role, e.g. admin, field agent");
 var scopeOptionsPlaceEvent = z3.object({
   event: scopeByEvent,
   placeOfEvent: JurisdictionFilter.optional()
@@ -2145,6 +2223,9 @@ var CustomActionScopeOptions = AllRecordScopeOptions.extend({
 var AccessLevelOptions = z3.object({
   accessLevel: JurisdictionFilter.optional()
 });
+var AllUserScopeOptions = AccessLevelOptions.extend({
+  role: userRole.optional()
+});
 var WorkqueueOrDashboardOptions = z3.object({
   ids: z3.preprocess(
     (val) => val === void 0 ? void 0 : [val].flat(),
@@ -2154,6 +2235,7 @@ var WorkqueueOrDashboardOptions = z3.object({
 var AllScopeOptions = z3.object({
   ...AllRecordScopeOptions.shape,
   ...AccessLevelOptions.shape,
+  ...AllUserScopeOptions.shape,
   ...WorkqueueOrDashboardOptions.shape
 });
 var ScopeOptionKey = AllScopeOptions.keyof();
@@ -2226,6 +2308,30 @@ var RecordScopeV2 = z3.discriminatedUnion("type", [
 ]).describe(
   "Scopes used to check user's permission to perform actions on a record."
 );
+var SystemScopeType = z3.enum([
+  "organisation.read-locations",
+  "user.read",
+  "user.create",
+  "user.edit",
+  "user.search"
+]);
+var UserScopeType = SystemScopeType.extract([
+  "user.read",
+  "user.create",
+  "user.edit",
+  "user.search"
+]);
+var ScopesWithRoleOption = UserScopeType.extract(["user.edit", "user.create"]);
+var UserScopeV2 = z3.discriminatedUnion("type", [
+  z3.object({
+    type: ScopesWithRoleOption,
+    options: AllUserScopeOptions.optional()
+  }),
+  z3.object({
+    type: UserScopeType.extract(["user.read", "user.search"]),
+    options: AccessLevelOptions.optional()
+  })
+]);
 var ResolvedRecordScopeV2 = z3.discriminatedUnion("type", [
   z3.object({
     type: ScopesWithPlaceEventOptions,
@@ -2246,16 +2352,14 @@ var ResolvedRecordScopeV2 = z3.discriminatedUnion("type", [
     }).optional()
   })
 ]).describe("Resolved scope with location/user IDs instead of filters.");
-var SystemScopeType = z3.enum([
-  "organisation.read-locations",
-  "user.read",
-  "user.create",
-  "user.edit"
-]);
 var Scope2 = z3.discriminatedUnion("type", [
   z3.object({ type: PlainScopeType }),
   ...RecordScopeV2.options,
-  z3.object({ type: SystemScopeType, options: AccessLevelOptions.optional() }),
+  ...UserScopeV2.options,
+  z3.object({
+    type: z3.literal("organisation.read-locations"),
+    options: AccessLevelOptions.optional()
+  }),
   z3.object({
     type: z3.literal("workqueue"),
     options: WorkqueueOrDashboardOptions
@@ -2290,22 +2394,29 @@ var encodeScope = (scope) => {
     encode: false
   });
 };
-var decodeScope = (query) => {
-  const scope = qs.parse(query, {
+var decodedScopeCache = /* @__PURE__ */ new Map();
+var decodeScope = (encodedScope) => {
+  if (decodedScopeCache.has(encodedScope)) {
+    return decodedScopeCache.get(encodedScope);
+  }
+  const scope = qs.parse(encodedScope, {
     ignoreQueryPrefix: true,
     comma: true,
     allowDots: true
   });
   const unflattenedScope = unflattenScope(scope);
-  return Scope2.safeParse(unflattenedScope)?.data;
+  const result = Scope2.safeParse(unflattenedScope)?.data;
+  decodedScopeCache.set(encodedScope, result);
+  return result;
 };
 var DEFAULT_SCOPE_OPTIONS = {
   placeOfEvent: JurisdictionFilter.enum.all,
-  accessLevel: JurisdictionFilter.enum.all
+  accessLevel: JurisdictionFilter.enum.all,
+  registeredIn: JurisdictionFilter.enum.all,
+  declaredIn: JurisdictionFilter.enum.all
 };
 
 // ../commons/src/scopes.deprecated.do-not-use.ts
-var z4 = __toESM(require("zod/v4"));
 var rawConfigurableScopeRegex = /^([a-zA-Z][a-zA-Z0-9.-]*(?:\.[a-zA-Z0-9.-]+)*)\[((?:\w+=[\w.-]+(?:\|[\w.-]+)*)(?:,[\w]+=[\w.-]+(?:\|[\w.-]+)*)*)\]$/;
 var rawConfigurableScope = z4.string().regex(rawConfigurableScopeRegex);
 var SearchScope = z4.object({
@@ -2539,6 +2650,74 @@ var legacyScopeToV2Scope = (v1Scope) => {
   }
   throw new Error(`Unsupported V1 scope type: ${v1Scope}`);
 };
+var MERGEABLE_USER_SCOPE_TYPES = ["user.create", "user.edit"];
+function isMergeableUserScopeType(type) {
+  return MERGEABLE_USER_SCOPE_TYPES.includes(type);
+}
+function decodeLegacyScope(legacy) {
+  const encoded = legacyScopeToV2Scope(legacy);
+  const scope = decodeScope(encoded);
+  if (!scope) {
+    throw new Error(
+      `Could not decode migrated scope from legacy '${legacy}' (encoded: '${encoded}').`
+    );
+  }
+  return { legacy, scope };
+}
+function groupByType(entries) {
+  return entries.reduce(
+    (groups, entry) => ({
+      ...groups,
+      [entry.scope.type]: [...groups[entry.scope.type] ?? [], entry]
+    }),
+    {}
+  );
+}
+function deduplicateEntries(entries) {
+  return entries.filter(
+    (entry, index) => entries.findIndex((e) => (0, import_lodash.isEqual)(e.scope, entry.scope)) === index
+  );
+}
+function mergeEntries(type, entries) {
+  const optionsList = entries.map(
+    (e) => "options" in e.scope && e.scope.options ? e.scope.options : {}
+  );
+  const allKeys = optionsList.flatMap(
+    (opts) => Object.keys(opts).filter((k) => opts[k] !== void 0)
+  );
+  const conflictKey = allKeys.find((key, i) => allKeys.indexOf(key) !== i);
+  if (conflictKey) {
+    const conflicting = entries.filter(
+      (e) => conflictKey in ("options" in e.scope && e.scope.options || {})
+    ).map((e) => JSON.stringify(e.legacy));
+    throw new Error(
+      `Cannot auto-merge two '${type}' scopes that both define '${conflictKey}'. Conflicting legacy scopes: [${conflicting.join(", ")}]. Resolve manually in roles.ts and re-run.`
+    );
+  }
+  const mergedOptions = Object.assign({}, ...optionsList);
+  const merged = Object.keys(mergedOptions).length > 0 ? { type, options: mergedOptions } : { type };
+  const parsed = Scope2.safeParse(merged);
+  if (!parsed.success) {
+    throw new Error(
+      `Merged '${type}' scope failed schema validation: ${parsed.error.message}. Legacy scopes: [${entries.map((e) => JSON.stringify(e.legacy)).join(", ")}].`
+    );
+  }
+  return parsed.data;
+}
+function migrateLegacyScopesArrayToV2Scopes(legacyScopes) {
+  const groups = groupByType(legacyScopes.map(decodeLegacyScope));
+  return Object.entries(groups).flatMap(([type, entries]) => {
+    const deduped = deduplicateEntries(entries);
+    if (deduped.length <= 1) return deduped.map((e) => e.scope);
+    if (!isMergeableUserScopeType(type)) {
+      console.warn(
+        `Multiple non-mergeable '${type}' scopes detected after dedup \u2014 kept all as-is. Legacy scopes: [${deduped.map((e) => JSON.stringify(e.legacy)).join(", ")}]. Review whether the duplication is intentional.`
+      );
+      return deduped.map((e) => e.scope);
+    }
+    return [mergeEntries(type, deduped)];
+  });
+}
 
 // src/migrations/v2.0/migrate-scopes.ts
 var ROLES_FILE_RELATIVE_PATH = "src/data-seeding/roles/roles.ts";
@@ -2576,57 +2755,65 @@ function resolveLegacyScopeFromElement(element) {
 }
 function migrateScopesArrays(rolesFilePath, project) {
   const sourceFile = project.getSourceFile(rolesFilePath);
-  if (!sourceFile) return { migratedCount: 0, removedCount: 0 };
+  if (!sourceFile) {
+    return { migratedCount: 0, removedCount: 0, mergedCount: 0 };
+  }
   let migratedCount = 0;
   let removedCount = 0;
+  let mergedCount = 0;
   const scopesProperties = sourceFile.getDescendantsOfKind(import_ts_morph11.SyntaxKind.PropertyAssignment).filter((prop) => prop.getName() === SCOPES_PROPERTY_NAME);
+  const relPath = import_path11.default.relative(process.cwd(), rolesFilePath);
   for (const scopesProp of scopesProperties) {
     const initializer = scopesProp.getInitializer();
     if (!initializer || !import_ts_morph11.Node.isArrayLiteralExpression(initializer)) continue;
-    const elements = initializer.getElements();
-    for (let index = elements.length - 1; index >= 0; index--) {
-      const element = elements[index];
-      if (!import_ts_morph11.Node.isExpression(element)) continue;
+    const rawTexts = [];
+    const legacyStrings = [];
+    let anyChange = false;
+    for (const element of initializer.getElements()) {
       const scopeKey = resolveScopeKeyFromElementAccess(element);
       if (scopeKey && !(scopeKey in SCOPES)) {
         console.warn(
-          `  [${import_path11.default.relative(process.cwd(), rolesFilePath)}] Removing unknown scope reference: SCOPES.${scopeKey}`
+          `  [${relPath}] Removing unknown scope reference: SCOPES.${scopeKey}`
         );
-        initializer.removeElement(index);
         removedCount++;
+        anyChange = true;
         continue;
       }
       const legacyScope = resolveLegacyScopeFromElement(element);
       if (!legacyScope) {
         console.warn(
-          `  [${import_path11.default.relative(process.cwd(), rolesFilePath)}] Skipping non-literal scope expression: ${element.getText()}`
+          `  [${relPath}] Preserving non-literal scope expression verbatim: ${element.getText()}`
         );
+        rawTexts.push(element.getText());
         continue;
       }
-      try {
-        const migratedScope = legacyScopeToV2Scope(legacyScope);
-        const scope = decodeScope(migratedScope);
-        if (!scope) {
-          console.warn(
-            `  [${import_path11.default.relative(process.cwd(), rolesFilePath)}] Could not decode migrated scope '${migratedScope}'.`
-          );
-          continue;
-        }
-        element.replaceWithText(JSON.stringify(scope));
-        migratedCount++;
-      } catch (error) {
-        console.warn(
-          `  [${import_path11.default.relative(process.cwd(), rolesFilePath)}] Could not migrate scope '${legacyScope}': ${error}`
-        );
-      }
+      legacyStrings.push(legacyScope);
+      anyChange = true;
     }
+    if (!anyChange) continue;
+    let mergedScopes;
+    try {
+      mergedScopes = migrateLegacyScopesArrayToV2Scopes(legacyStrings);
+    } catch (error) {
+      throw new Error(
+        `[${relPath}] Failed to migrate scopes for role: ${error instanceof Error ? error.message : String(error)}`,
+        { cause: error }
+      );
+    }
+    migratedCount += legacyStrings.length;
+    mergedCount += legacyStrings.length - mergedScopes.length;
+    const outputElements = [
+      ...rawTexts,
+      ...mergedScopes.map((s) => JSON.stringify(s))
+    ];
+    scopesProp.setInitializer(`[${outputElements.join(", ")}]`);
   }
   if (removedCount > 0) {
     console.log(
-      `  Removed ${removedCount} unknown SCOPES reference(s) from '${import_path11.default.relative(process.cwd(), rolesFilePath)}'.`
+      `  Removed ${removedCount} unknown SCOPES reference(s) from '${relPath}'.`
     );
   }
-  return { migratedCount, removedCount };
+  return { migratedCount, removedCount, mergedCount };
 }
 function ensureScopesHelpersImport(rolesFilePath, project) {
   const sourceFile = project.getSourceFile(rolesFilePath);
@@ -2761,7 +2948,7 @@ async function main11() {
     return;
   }
   const importChanged = ensureScopesHelpersImport(rolesFilePath, project);
-  const { migratedCount, removedCount } = migrateScopesArrays(
+  const { migratedCount, removedCount, mergedCount } = migrateScopesArrays(
     rolesFilePath,
     project
   );
@@ -2780,7 +2967,7 @@ async function main11() {
   }
   await sourceFile.save();
   console.log(
-    `Done. Migrated ${migratedCount} legacy scope(s), removed ${removedCount} unknown SCOPES reference(s), wrapped ${wrappedScopesCount} scope array(s) with defineScopes()${wrappedRoles ? ", wrapped roles with defineRoles()" : ""}${removedRoleType ? ", and removed Role type definition" : ""}${importChanged ? ". Updated toolkit/scopes imports." : "."}`
+    `Done. Migrated ${migratedCount} legacy scope(s), merged ${mergedCount} AND-paired scope(s) into single v2 objects (privilege-escalation fix, see issue #12489), removed ${removedCount} unknown SCOPES reference(s), wrapped ${wrappedScopesCount} scope array(s) with defineScopes()${wrappedRoles ? ", wrapped roles with defineRoles()" : ""}${removedRoleType ? ", and removed Role type definition" : ""}${importChanged ? ". Updated toolkit/scopes imports." : "."}`
   );
 }
 
@@ -3586,6 +3773,10 @@ var ACTION_PROPERTY_NAME2 = "action";
 var CONDITIONALS_PROPERTY_NAME = "conditionals";
 var TYPE_PROPERTY_NAME7 = "type";
 var SLUG_PROPERTY_NAME = "slug";
+var READ_ACTION_TYPE = "READ";
+var ACTION_TYPE_IMPORT_NAME = "ActionType";
+var TOOLKIT_EVENTS_MODULE2 = "@opencrvs/toolkit/events";
+var READ_ACTION_FALLBACK_INITIALIZER = `{ type: ${ACTION_TYPE_IMPORT_NAME}.${READ_ACTION_TYPE} }`;
 var SUPPORTED_WORKQUEUE_ACTION_TYPES = /* @__PURE__ */ new Set([
   "READ",
   "DELETE",
@@ -3633,91 +3824,137 @@ function isUnsupportedActionType(action) {
   }
   return !SUPPORTED_WORKQUEUE_ACTION_TYPES.has(typeName);
 }
-function migrateWorkqueueActions(workqueue, relPath) {
-  const actionsProperty = workqueue.getProperty(ACTIONS_PROPERTY_NAME5);
-  if (!actionsProperty || !import_ts_morph17.Node.isPropertyAssignment(actionsProperty)) {
-    return 0;
-  }
-  const actionsInitializer = actionsProperty.getInitializer();
-  if (!actionsInitializer || !import_ts_morph17.Node.isArrayLiteralExpression(actionsInitializer)) {
-    return 0;
+function ensureValidAction(workqueue, relPath) {
+  const workqueueLabel = getWorkqueueLabel(workqueue);
+  const actionProperty = workqueue.getProperty(ACTION_PROPERTY_NAME2);
+  if (actionProperty && import_ts_morph17.Node.isPropertyAssignment(actionProperty)) {
+    const initializer = actionProperty.getInitializer();
+    if (initializer && import_ts_morph17.Node.isObjectLiteralExpression(initializer)) {
+      if (!isUnsupportedActionType(initializer)) {
+        return { changed: false, usedReadFallback: false };
+      }
+      actionProperty.set({
+        name: ACTION_PROPERTY_NAME2,
+        initializer: READ_ACTION_FALLBACK_INITIALIZER
+      });
+      console.log(
+        `  [${relPath}] Replaced unsupported 'action' type with '${ACTION_TYPE_IMPORT_NAME}.${READ_ACTION_TYPE}' on workqueue '${workqueueLabel}'`
+      );
+      return { changed: true, usedReadFallback: true };
+    }
   }
+  workqueue.addPropertyAssignment({
+    name: ACTION_PROPERTY_NAME2,
+    initializer: READ_ACTION_FALLBACK_INITIALIZER
+  });
+  console.log(
+    `  [${relPath}] Added default 'action: ${READ_ACTION_FALLBACK_INITIALIZER}' to workqueue '${workqueueLabel}'`
+  );
+  return { changed: true, usedReadFallback: true };
+}
+function migrateWorkqueueActions(workqueue, relPath) {
   const workqueueLabel = getWorkqueueLabel(workqueue);
-  const existingActionProperty = workqueue.getProperty(ACTION_PROPERTY_NAME2);
-  if (existingActionProperty) {
-    if (import_ts_morph17.Node.isPropertyAssignment(existingActionProperty)) {
-      const existingActionInitializer = existingActionProperty.getInitializer();
-      if (existingActionInitializer && import_ts_morph17.Node.isObjectLiteralExpression(existingActionInitializer)) {
-        const conditionalsProperty2 = existingActionInitializer.getProperty(
-          CONDITIONALS_PROPERTY_NAME
+  const actionsProperty = workqueue.getProperty(ACTIONS_PROPERTY_NAME5);
+  let actionsArrayMigrated = false;
+  if (actionsProperty && import_ts_morph17.Node.isPropertyAssignment(actionsProperty)) {
+    const actionsInitializer = actionsProperty.getInitializer();
+    if (actionsInitializer && import_ts_morph17.Node.isArrayLiteralExpression(actionsInitializer)) {
+      const existingActionProperty = workqueue.getProperty(ACTION_PROPERTY_NAME2);
+      if (existingActionProperty) {
+        if (import_ts_morph17.Node.isPropertyAssignment(existingActionProperty)) {
+          const existingActionInitializer = existingActionProperty.getInitializer();
+          if (existingActionInitializer && import_ts_morph17.Node.isObjectLiteralExpression(existingActionInitializer)) {
+            const conditionalsProperty = existingActionInitializer.getProperty(
+              CONDITIONALS_PROPERTY_NAME
+            );
+            if (conditionalsProperty) {
+              conditionalsProperty.remove();
+              console.log(
+                `  [${relPath}] Removed deprecated 'conditionals' from 'action' on workqueue '${workqueueLabel}'`
+              );
+            }
+          }
+        }
+        actionsProperty.remove();
+        console.log(
+          `  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' (existing 'action' kept)`
+        );
+        actionsArrayMigrated = true;
+      } else {
+        const actionCandidates = actionsInitializer.getElements().filter(
+          (element) => import_ts_morph17.Node.isObjectLiteralExpression(element)
         );
-        if (conditionalsProperty2) {
-          conditionalsProperty2.remove();
+        if (actionCandidates.length === 0) {
+          actionsProperty.remove();
           console.log(
-            `  [${relPath}] Removed deprecated 'conditionals' from 'action' on workqueue '${workqueueLabel}'`
+            `  [${relPath}] Removed empty 'actions' from workqueue '${workqueueLabel}'`
           );
-        }
-        if (isUnsupportedActionType(existingActionInitializer)) {
-          existingActionProperty.remove();
-          console.log(
-            `  [${relPath}] Removed unsupported 'action' type on workqueue '${workqueueLabel}'`
+          actionsArrayMigrated = true;
+        } else {
+          if (actionCandidates.length > 1) {
+            const droppedCount = actionCandidates.length - 1;
+            console.warn(
+              `  [${relPath}] Workqueue '${workqueueLabel}' has ${actionCandidates.length} actions; keeping first as 'action' and dropping ${droppedCount} extra action(s)`
+            );
+          }
+          const conditionalsProperty = actionCandidates[0].getProperty(
+            CONDITIONALS_PROPERTY_NAME
           );
+          if (conditionalsProperty) {
+            conditionalsProperty.remove();
+            console.log(
+              `  [${relPath}] Removed deprecated 'conditionals' from migrated 'action' on workqueue '${workqueueLabel}'`
+            );
+          }
+          if (isUnsupportedActionType(actionCandidates[0])) {
+            actionsProperty.remove();
+            console.log(
+              `  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' because action type is unsupported`
+            );
+            actionsArrayMigrated = true;
+          } else {
+            const firstActionText = actionCandidates[0].getText();
+            workqueue.addPropertyAssignment({
+              name: ACTION_PROPERTY_NAME2,
+              initializer: firstActionText
+            });
+            actionsProperty.remove();
+            console.log(
+              `  [${relPath}] Replaced 'actions' with 'action' on workqueue '${workqueueLabel}'`
+            );
+            actionsArrayMigrated = true;
+          }
         }
       }
     }
-    actionsProperty.remove();
-    console.log(
-      `  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' (existing 'action' kept)`
-    );
-    return 1;
-  }
-  const actionCandidates = actionsInitializer.getElements().filter(
-    (element) => import_ts_morph17.Node.isObjectLiteralExpression(element)
-  );
-  if (actionCandidates.length === 0) {
-    actionsProperty.remove();
-    console.log(
-      `  [${relPath}] Removed empty 'actions' from workqueue '${workqueueLabel}'`
-    );
-    return 1;
-  }
-  if (actionCandidates.length > 1) {
-    const droppedCount = actionCandidates.length - 1;
-    console.warn(
-      `  [${relPath}] Workqueue '${workqueueLabel}' has ${actionCandidates.length} actions; keeping first as 'action' and dropping ${droppedCount} extra action(s)`
-    );
   }
-  const conditionalsProperty = actionCandidates[0].getProperty(
-    CONDITIONALS_PROPERTY_NAME
+  const fallback = ensureValidAction(workqueue, relPath);
+  return {
+    changed: actionsArrayMigrated || fallback.changed,
+    usedReadFallback: fallback.usedReadFallback
+  };
+}
+function ensureActionTypeImport(sourceFile) {
+  const existingImport = sourceFile.getImportDeclaration(
+    (decl) => decl.getModuleSpecifierValue() === TOOLKIT_EVENTS_MODULE2
   );
-  if (conditionalsProperty) {
-    conditionalsProperty.remove();
-    console.log(
-      `  [${relPath}] Removed deprecated 'conditionals' from migrated 'action' on workqueue '${workqueueLabel}'`
-    );
-  }
-  if (isUnsupportedActionType(actionCandidates[0])) {
-    actionsProperty.remove();
-    console.log(
-      `  [${relPath}] Removed deprecated 'actions' from workqueue '${workqueueLabel}' because action type is unsupported`
-    );
-    return 1;
+  if (existingImport) {
+    const alreadyImported = existingImport.getNamedImports().some((ni) => ni.getName() === ACTION_TYPE_IMPORT_NAME);
+    if (!alreadyImported) {
+      existingImport.addNamedImport(ACTION_TYPE_IMPORT_NAME);
+    }
+    return;
   }
-  const firstActionText = actionCandidates[0].getText();
-  workqueue.addPropertyAssignment({
-    name: ACTION_PROPERTY_NAME2,
-    initializer: firstActionText
+  sourceFile.addImportDeclaration({
+    moduleSpecifier: TOOLKIT_EVENTS_MODULE2,
+    namedImports: [ACTION_TYPE_IMPORT_NAME]
   });
-  actionsProperty.remove();
-  console.log(
-    `  [${relPath}] Replaced 'actions' with 'action' on workqueue '${workqueueLabel}'`
-  );
-  return 1;
 }
 function processFile13(filePath, project) {
   const sourceFile = project.getSourceFile(filePath);
   if (!sourceFile) return 0;
   let migratedWorkqueues = 0;
+  let needsActionTypeImport = false;
   const relPath = import_path18.default.relative(process.cwd(), filePath);
   const callExpressions = sourceFile.getDescendantsOfKind(
     import_ts_morph17.SyntaxKind.CallExpression
@@ -3733,9 +3970,14 @@ function processFile13(filePath, project) {
     if (!import_ts_morph17.Node.isArrayLiteralExpression(workqueuesArg)) continue;
     for (const element of workqueuesArg.getElements()) {
       if (!import_ts_morph17.Node.isObjectLiteralExpression(element)) continue;
-      migratedWorkqueues += migrateWorkqueueActions(element, relPath);
+      const result = migrateWorkqueueActions(element, relPath);
+      if (result.changed) migratedWorkqueues++;
+      if (result.usedReadFallback) needsActionTypeImport = true;
     }
   }
+  if (needsActionTypeImport) {
+    ensureActionTypeImport(sourceFile);
+  }
   return migratedWorkqueues;
 }
 async function main18() {
@@ -4070,7 +4312,7 @@ Saved ${handlerRelPath}.`);
 // src/migrations/v2.0/checkout-upstream-files.ts
 var import_child_process = require("child_process");
 var UPSTREAM_URL = "https://github.com/opencrvs/opencrvs-countryconfig.git";
-var UPSTREAM_BRANCH = "develop";
+var UPSTREAM_BRANCH = "release/2.0.0";
 var TEMP_REMOTE = "opencrvs-upgrade-v19-v20-codemod";
 var FILES_TO_CHECKOUT = [
   "src/analytics/analytics.ts",
@@ -4609,9 +4851,9 @@ var import_path24 = require("path");
 var TEMP_REMOTE2 = "opencrvs-upgrade-v19-v20-codemod-merge-infra";
 var INFRASTRUCTURE_DIR = "infrastructure";
 var BASE_BRANCH = "release-v1.9";
-function gitShowBytes(ref, path23) {
+function gitShowBytes(ref, path24) {
   try {
-    const buf = (0, import_child_process2.execFileSync)("git", ["show", `${ref}:${path23}`], {
+    const buf = (0, import_child_process2.execFileSync)("git", ["show", `${ref}:${path24}`], {
       cwd: process.cwd(),
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4620,9 +4862,13 @@ function gitShowBytes(ref, path23) {
     return null;
   }
 }
-async function main25() {
+async function main25({
+  subdirs = []
+} = {}) {
+  const pathspecs = subdirs.length > 0 ? subdirs.map((s) => `${INFRASTRUCTURE_DIR}/${s}/`) : [`${INFRASTRUCTURE_DIR}/`];
+  const scopeLabel = pathspecs.map((p) => `'${p}'`).join(", ");
   console.log(
-    `Merging '${INFRASTRUCTURE_DIR}/' from ${UPSTREAM_URL}@${UPSTREAM_BRANCH} (base: ${BASE_BRANCH})...
+    `Merging ${scopeLabel} from ${UPSTREAM_URL}@${UPSTREAM_BRANCH} (base: ${BASE_BRANCH})...
 `
   );
   assertIsGitRepo();
@@ -4637,20 +4883,12 @@ async function main25() {
     const ref = `${TEMP_REMOTE2}/${UPSTREAM_BRANCH}`;
     const baseRef = `${TEMP_REMOTE2}/${BASE_BRANCH}`;
     const upstreamFiles = runGit(
-      [
-        "ls-tree",
-        "-r",
-        "--name-only",
-        "-z",
-        ref,
-        "--",
-        `${INFRASTRUCTURE_DIR}/`
-      ],
+      ["ls-tree", "-r", "--name-only", "-z", ref, "--", ...pathspecs],
       { silent: true }
     ).split("\0").filter(Boolean);
     if (upstreamFiles.length === 0) {
       console.log(
-        `  No files found under '${INFRASTRUCTURE_DIR}/' on ${ref}. Nothing to merge.`
+        `  No files found under ${scopeLabel} on ${ref}. Nothing to merge.`
       );
       return;
     }
@@ -4725,7 +4963,9 @@ async function main25() {
 var import_fs6 = require("fs");
 var import_path25 = require("path");
 var INFRASTRUCTURE_DIR2 = "infrastructure";
-async function main26() {
+async function main26({
+  keep = []
+} = {}) {
   const fullPath = (0, import_path25.join)(process.cwd(), INFRASTRUCTURE_DIR2);
   if (!(0, import_fs6.existsSync)(fullPath)) {
     console.log(
@@ -4733,24 +4973,152 @@ async function main26() {
     );
     return;
   }
-  console.log(`Deleting '${INFRASTRUCTURE_DIR2}/'...
-`);
   assertIsGitRepo();
-  runGit(["rm", "-rf", "--ignore-unmatch", "--", `${INFRASTRUCTURE_DIR2}/`], {
-    silent: true
+  if (keep.length === 0) {
+    console.log(`Deleting '${INFRASTRUCTURE_DIR2}/'...
+`);
+    runGit(["rm", "-rf", "--ignore-unmatch", "--", `${INFRASTRUCTURE_DIR2}/`], {
+      silent: true
+    });
+    console.log(
+      `  Staged deletion of tracked files under '${INFRASTRUCTURE_DIR2}/'.`
+    );
+    if ((0, import_fs6.existsSync)(fullPath)) {
+      (0, import_fs6.rmSync)(fullPath, { recursive: true, force: true });
+      console.log(
+        `  Removed remaining untracked files under '${INFRASTRUCTURE_DIR2}/'.`
+      );
+    }
+    console.log(
+      `
+  Done. Review the staged deletion with: git diff --cached -- '${INFRASTRUCTURE_DIR2}/'`
+    );
+    return;
+  }
+  const keepSet = new Set(keep);
+  console.log(
+    `Deleting contents of '${INFRASTRUCTURE_DIR2}/' except: ${[...keepSet].map((name) => `'${name}'`).join(", ")}
+`
+  );
+  const topLevelEntries = (0, import_fs6.readdirSync)(fullPath, { withFileTypes: true });
+  let deleted = 0;
+  for (const entry of topLevelEntries) {
+    if (keepSet.has(entry.name)) {
+      console.log(`  Keeping '${INFRASTRUCTURE_DIR2}/${entry.name}'.`);
+      continue;
+    }
+    const relPath = `${INFRASTRUCTURE_DIR2}/${entry.name}${entry.isDirectory() ? "/" : ""}`;
+    runGit(["rm", "-rf", "--ignore-unmatch", "--", relPath], { silent: true });
+    const fullEntryPath = (0, import_path25.join)(fullPath, entry.name);
+    if ((0, import_fs6.existsSync)(fullEntryPath)) {
+      (0, import_fs6.rmSync)(fullEntryPath, { recursive: true, force: true });
+    }
+    console.log(`  Deleted '${relPath}'.`);
+    deleted++;
+  }
+  const presentNames = new Set(topLevelEntries.map((e) => e.name));
+  const missingKeeps = [...keepSet].filter((name) => !presentNames.has(name));
+  if (missingKeeps.length > 0) {
+    console.warn(
+      `  [warn] Requested to keep ${missingKeeps.map((n) => `'${n}'`).join(", ")} but they don't exist under '${INFRASTRUCTURE_DIR2}/'.`
+    );
+  }
+  console.log(
+    `
+  Done. Deleted ${deleted} top-level entr${deleted === 1 ? "y" : "ies"}. Review the staged deletions with: git diff --cached -- '${INFRASTRUCTURE_DIR2}/'`
+  );
+}
+
+// src/migrations/v2.0/fix-accept-requested-registration-function-type.ts
+var import_ts_morph22 = require("ts-morph");
+var import_path26 = __toESM(require("path"));
+var TARGET_FUNCTION_NAME = "acceptRequestedRegistration";
+var ACTION_PARAMETER_NAME = "action";
+var OLD_TYPE = "ActionInput";
+var NEW_TYPE = "Extract<ActionInput, { type?: 'REGISTER' }>";
+function isAcceptRequestedRegistrationParameter(parameter) {
+  const functionDeclaration = parameter.getFirstAncestorByKind(
+    import_ts_morph22.SyntaxKind.FunctionDeclaration
+  );
+  if (functionDeclaration?.getName() === TARGET_FUNCTION_NAME) {
+    return true;
+  }
+  const arrowFunction = parameter.getFirstAncestorByKind(
+    import_ts_morph22.SyntaxKind.ArrowFunction
+  );
+  const variableDeclaration = arrowFunction?.getFirstAncestorByKind(
+    import_ts_morph22.SyntaxKind.VariableDeclaration
+  );
+  return variableDeclaration?.getName() === TARGET_FUNCTION_NAME;
+}
+function processFile14(filePath, project) {
+  const sourceFile = project.getSourceFile(filePath);
+  if (!sourceFile) return 0;
+  let updatedCount = 0;
+  for (const parameter of sourceFile.getDescendantsOfKind(
+    import_ts_morph22.SyntaxKind.Parameter
+  )) {
+    if (parameter.getName() !== ACTION_PARAMETER_NAME) {
+      continue;
+    }
+    if (!isAcceptRequestedRegistrationParameter(parameter)) {
+      continue;
+    }
+    const typeNode = parameter.getTypeNode();
+    if (!typeNode || typeNode.getText() !== OLD_TYPE) {
+      continue;
+    }
+    parameter.setType(NEW_TYPE);
+    updatedCount++;
+    console.log(
+      `  [${import_path26.default.relative(process.cwd(), filePath)}] Updated '${ACTION_PARAMETER_NAME}' in ${TARGET_FUNCTION_NAME} to ${NEW_TYPE}`
+    );
+  }
+  return updatedCount;
+}
+async function main27() {
+  const srcDir = import_path26.default.join(process.cwd(), "src");
+  console.log(`Scanning for ${TARGET_FUNCTION_NAME} in: ${srcDir}
+`);
+  const project = new import_ts_morph22.Project({
+    tsConfigFilePath: import_path26.default.resolve(srcDir, "../tsconfig.json"),
+    skipAddingFilesFromTsConfig: false
   });
-  console.log(`  Staged deletion of tracked files under '${INFRASTRUCTURE_DIR2}/'.`);
-  if ((0, import_fs6.existsSync)(fullPath)) {
-    (0, import_fs6.rmSync)(fullPath, { recursive: true, force: true });
-    console.log(`  Removed remaining untracked files under '${INFRASTRUCTURE_DIR2}/'.`);
+  const sourceFiles = project.getSourceFiles().filter((sf) => {
+    const filePath = sf.getFilePath();
+    return filePath.includes("/src/") && !filePath.includes("/node_modules/");
+  });
+  let totalUpdated = 0;
+  const modifiedFiles = [];
+  for (const sourceFile of sourceFiles) {
+    const filePath = sourceFile.getFilePath();
+    const updated = processFile14(filePath, project);
+    if (updated > 0) {
+      totalUpdated += updated;
+      modifiedFiles.push(filePath);
+    }
+  }
+  if (modifiedFiles.length === 0) {
+    console.log(
+      `No '${ACTION_PARAMETER_NAME}: ${OLD_TYPE}' parameter in ${TARGET_FUNCTION_NAME} found. Nothing to do.`
+    );
+    return;
+  }
+  console.log(`
+Saving ${modifiedFiles.length} modified file(s)...`);
+  for (const filePath of modifiedFiles) {
+    const sourceFile = project.getSourceFileOrThrow(filePath);
+    await sourceFile.save();
+    console.log(`  Saved: ${import_path26.default.relative(process.cwd(), filePath)}`);
   }
   console.log(
     `
-  Done. Review the staged deletion with: git diff --cached -- '${INFRASTRUCTURE_DIR2}/'`
+Done. Updated ${totalUpdated} parameter type annotation(s) in ${TARGET_FUNCTION_NAME}.`
   );
 }
 
 // src/migrations/v2.0/index.ts
+var NON_SWARM_INFRA_SUBDIRS = ["postgres", "metabase"];
 async function runUpgrade(dockerSwarm) {
   await main18();
   await main();
@@ -4775,10 +5143,12 @@ async function runUpgrade(dockerSwarm) {
   await main22();
   await main23();
   await main24();
+  await main27();
   await main17();
   if (dockerSwarm) {
     await main25();
   } else {
-    await main26();
+    await main26({ keep: NON_SWARM_INFRA_SUBDIRS });
+    await main25({ subdirs: NON_SWARM_INFRA_SUBDIRS });
   }
 }