@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/base-classes/services/services/system-access.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-access.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/system-access.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAEL,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,SAAS,EACT,wBAAwB,EAExB,kCAAkC,EAClC,uCAAuC,EACvC,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAW7C;;;;GAIG;AACH,MAAM,6BAA6B,GAG/B;IACF,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;IACzE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;IACzE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,EAAE,YAAY,EAAE;CAC7F,CAAC;AAEF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,yBAAyB,EAAE,qCAAqC,EAAE,MAAM,yEAAyE,CAAC;AAC3J,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,mDAAmD,EACnD,+BAA+B,GAChC,MAAM,iGAAiG,CAAC;AACzG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAOtI,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AAIrH,OAAO,EAEL,sCAAsC,EACtC,wCAAwC,EACxC,8BAA8B,EAC9B,gCAAgC,GAEjC,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,6CAA6C,EAC7C,+CAA+C,EAC/C,uCAAuC,GACxC,MAAM,mFAAmF,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAE8B;IACI;IACc;IAG5B;IAGmB;IAKV;IAE/C;IAhBnB,YACmE,YAAwC,EACpC,iBAAkD,EACpC,uBAA8D,EAG1F,SAAoB,EAGD,gBAA0C,EAKpD,MAAsB,EAErE,6BAAmF;QAfnC,iBAAY,GAAZ,YAAY,CAA4B;QACpC,sBAAiB,GAAjB,iBAAiB,CAAiC;QACpC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAG1F,cAAS,GAAT,SAAS,CAAW;QAGD,qBAAgB,GAAhB,gBAAgB,CAA0B;QAKpD,WAAM,GAAN,MAAM,CAAgB;QAErE,kCAA6B,GAA7B,6BAA6B,CAAsD;IACnG,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,uBAAuB,CACnC,OAAyE;QAEzE,MAAM,EAAE,+BAA+B,EAAE,GAAG,qCAAqC,CAC/E,IAAI,CAAC,qBAAqB,EAAE,CAC7B,CAAC;QAEF,IAAI,CAAC,+BAA+B,EAAE,CAAC;YACrC,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QAED,mFAAmF;QACnF,mEAAmE;QACnE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;QACzG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,6BAA6B,CACtC,OAAO,CAAC,YAAY,EACpB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kGAAkG;IAC1F,qBAAqB;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS;iBAClB,GAAG,CAAiC,kBAAkB,CAAC,uBAAuB,CAAC;iBAC/E,QAAQ,EAAE,CAAC,cAAc,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,qFAAqF;YACrF,oFAAoF;YACpF,iEAAiE;YACjE,OAAO,yBAAyB,CAAC,mBAAmB,CAAC;QACvD,CAAC;IACH,CAAC;IAEO,6BAA6B,CAAC,YAAoB,EAAE,KAAa;QACvE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACtE,OAAO,EAAE;gBACP,MAAM,EAAE,uCAAuC;gBAC/C,OAAO,EACL,gCAAgC,YAAY,kDAAkD,KAAK,IAAI;sBACrG,iHAAiH;gBACrH,YAAY;aACb;SACF,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACvB,kBAAkB,CAAC,8BAA8B,CAClD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS;iBAClB,GAAG,CAAiC,kBAAkB,CAAC,uBAAuB,CAAC;iBAC/E,gBAAgB,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,sCAAsC,CAClD,YAA0B,EAC1B,UAAoB,EACpB,aAAoC,EACpC,sBAAgC;QAEhC,IAAI,CAAC,wCAAwC,CAAC,YAAY,CAAC;YAAE,OAAO;QAEpE,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAC7C,kBAAkB,CAAC,kCAAkC,CACtD,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;YACpD,UAAU;YACV,gBAAgB,EAAE,aAAa;YAC/B,oBAAoB;YACpB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,sBAAsB;SAC5C,CAAC,CAAC;QAEH,MAAM,sCAAsC,CAAC;YAC3C,QAAQ;YACR,gBAAgB,EAAE,aAAa;YAC/B,oBAAoB;YACpB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,eAAe,EAAE,gCAAgC,CAC/C,IAAI,CAAC,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,qBAAqB,CAAC,CAC3F;YACD,mBAAmB,EAAE,sBAAsB;YAC3C,sBAAsB,EAAE,sBAAsB,KAAK,IAAI;YACvD,4FAA4F;YAC5F,0FAA0F;YAC1F,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yFAAyF;sBACvF,oFAAoF;sBACpF,yFAAyF;sBACzF,0DAA0D,EAC5D;oBACE,mBAAmB,EAAE,YAAY;oBACjC,2BAA2B,EAAE,MAAM,CAAC,yBAAyB;oBAC7D,eAAe,EAAE,MAAM,CAAC,eAAe;iBACxC,CACF,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,6CAA6C,CACzD,YAA0B,EAC1B,UAAoB,EACpB,aAAoC,EACpC,2BAAqC;QAErC,IAAI,CAAC,+CAA+C,CAAC,YAAY,CAAC;YAAE,OAAO;QAE3E,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAC7C,kBAAkB,CAAC,kCAAkC,CACtD,CAAC;QAEF,MAAM,6CAA6C,CAAC;YAClD,cAAc,EAAE,UAAU;YAC1B,gBAAgB,EAAE,aAAa;YAC/B,oBAAoB;YACpB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,eAAe,EAAE,uCAAuC,CACtD,IAAI,CAAC,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,qBAAqB,CAAC,CAC3F;YACD,mBAAmB,EAAE,sBAAsB;YAC3C,2BAA2B,EAAE,2BAA2B,KAAK,IAAI;YACjE,2FAA2F;YAC3F,2FAA2F;YAC3F,4FAA4F;YAC5F,uEAAuE;YACvE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sFAAsF;sBACpF,yFAAyF;sBACzF,4CAA4C,EAC9C;oBACE,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,yBAAyB,EAAE,MAAM,CAAC,gBAAgB;oBAClD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,mBAAmB,EAAE,YAAY;oBACjC,UAAU;iBACX,CACF,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,+BAA+B,CACrC,YAA0B,EAC1B,SAA0G,EAC1G,OAEC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YACrC,MAAM,IAAI,CAAC,gBAAiB,CAAC,qBAAqB,CAAC;gBACjD,YAAY,EAAE,YAAsB;gBACpC,SAAS;gBACT,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;gBACrD,YAAY,EAAE,OAAO,EAAE,YAAY;gBACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;aACnD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC;QACF,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACxC,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC;YACvC,mCAAmC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE;oBACH,4BAA4B;oBAC5B,MAAM,CAAC,YAAY,CAAC;oBACpB,MAAM,CAAC,SAAS,CAAC;oBACjB,WAAW,CAAC,EAAE;oBACd,iBAAiB;iBAClB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACK,0BAA0B,CAAC,YAAmF;QACpH,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtC,IAAI,YAAY,EAAE,cAAc,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,YAAY,EAAE,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAC7B,YAAmF;QAEnF,OAAO,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,yBAAyB,CAC/B,YAA0B,EAC1B,SAKqC;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC7E,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,IAAI,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,qCAAqC;oBAC7C,YAAY;oBACZ,mBAAmB,EAAE,SAAS;oBAC9B,OAAO,EACL,GAAG,SAAS,mCAAmC,MAAM,CAAC,YAAY,CAAC,SAAS;wBAC5E,sBAAsB,IAAI,yCAAyC;wBACnE,sBAAsB,IAAI,sDAAsD;wBAChF,0DAA0D,IAAI,oBAAoB;wBAClF,qFAAqF;iBACxF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,yBAAyB,CAC/B,YAA0B,EAC1B,IAAa,EACb,IAAqG;QAErG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC7E,OAAO,uCAAuC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,KAAK,CAAC,YAAY,CACvB,YAA0B,EAC1B,mBAAwC,EACxC,OAUC;QAED,4EAA4E;QAC5E,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,aAAa,GAAkD,OAAO,EAAE,UAAU;YACtF,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC9G,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAI,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC1H,6EAA6E;QAC7E,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,uBAAuB,CAAC;gBACjC,YAAY,EAAE,YAAsB;gBACpC,SAAS,EAAE,qBAAqB,CAAC,IAAI;gBACrC,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;gBACrD,YAAY,EAAE,OAAO,EAAE,YAAY;gBACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,YAAY,CACvB,YAA0B,EAC1B,MAAyB,EACzB,UAAiD,EACjD,OAIC;QAED,4EAA4E;QAC5E,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,aAAa,GAAkD,OAAO,EAAE,UAAU;YACtF,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC9G,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAI,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACzH,iFAAiF;QACjF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;YAChF,MAAM,IAAI,CAAC,uBAAuB,CAAC;gBACjC,YAAY,EAAE,YAAsB;gBACpC,SAAS,EAAE,qBAAqB,CAAC,IAAI;gBACrC,WAAW;gBACX,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;gBACrD,YAAY,EAAE,OAAO,EAAE,YAAY;gBACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kGAAkG;IAClG,sGAAsG;IACtG,sGAAsG;IACtG,sGAAsG;IACtG,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAElG;;;;OAIG;IACK,wBAAwB,CAAC,YAA0B;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,kBAAkB,EAAE,WAAW,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAChF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,mCAAmC;oBAC3C,YAAY;oBACZ,OAAO,EACL,4EAA4E;wBAC5E,IAAI,MAAM,CAAC,YAAY,CAAC,sEAAsE;wBAC9F,kFAAkF;iBACrF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAAC,kBAA4B;QACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,qBAAqB,CAAC,CAAC;QAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,2BAA2B;oBACnC,OAAO,EACL,0DAA0D;wBAC1D,IAAI,cAAc,CAAC,qBAAqB,2CAA2C;iBACtF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,2BAA2B,CAAC,eAAuB,EAAE,MAAc;QACzE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,kCAAkC;oBAC1C,OAAO,EACL,+EAA+E;wBAC/E,uFAAuF;iBAC1F;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,oBAAoB,CAC/B,YAA0B,EAC1B,mBAAwC,EACxC,IAA+E,EAC/E,OAEC;QAED,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpE,MAAM,aAAa,GAAkD,OAAO,EAAE,UAAU;YACtF,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC9G,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QACH,qGAAqG;QACrG,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAI,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAE1H,mFAAmF;QACnF,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;YAC3C,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,KAAK,EAAE,IAAI,CAAC,kBAAkB;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,YAAsB;YACpC,mBAAmB,EAAE,sBAAsB;YAC3C,mBAAmB,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;SACtD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;QAE/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,oBAAoB,CAC/B,YAA0B,EAC1B,IAA+E,EAC/E,MAAyB,EACzB,UAAiD,EACjD,OAEC;QAED,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpE,MAAM,aAAa,GAAkD,OAAO,EAAE,UAAU;YACtF,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC9G,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QACH,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAI,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACzH,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QAExF,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;YAC3C,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,KAAK,EAAE,IAAI,CAAC,kBAAkB;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,YAAsB;YACpC,mBAAmB,EAAE,sBAAsB;YAC3C,mBAAmB;YACnB,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;SACtD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;QAE/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,KAAK,CAAC,cAAc,CACzB,YAA0B,EAC1B,IAA6B,EAC7B,OAEC;QAED,8EAA8E;QAC9E,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAE3E,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,4BAA4B,GAAG;YACnC,GAAG,CAAC,OAAO,EAAE,4BAA4B,IAAI,EAAE,CAAC;YAChD,GAAG,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC;SACpF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAC3D,YAAY,EACZ,aAAa,EACb,IAAI,EACJ,EAAE,GAAG,OAAO,EAAE,4BAA4B,EAAE,CAC7C,CAAC;QACF,iFAAiF;QACjF,IAAI,CAAC,+BAA+B,CAClC,YAAY,EACZ,qBAAqB,CAAC,MAAM,EAC5B,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc,CACzB,YAA0B,EAC1B,mBAAwC,EACxC,IAA6B,EAC7B,OAEC;QAED,8EAA8E;QAC9E,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAE3E,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,4BAA4B,GAAG;YACnC,GAAG,CAAC,OAAO,EAAE,4BAA4B,IAAI,EAAE,CAAC;YAChD,GAAG,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC;SACpF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAC3D,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,IAAI,EACJ,EAAE,GAAG,OAAO,EAAE,4BAA4B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,+BAA+B,CAClC,YAAY,EACZ,qBAAqB,CAAC,MAAM,EAC5B,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,kBAAkB,CAC7B,YAA0B,EAC1B,mBAAwC,EACxC,IAA6B,EAC7B,OAEC;QAED,mFAAmF;QACnF,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEhF,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEzG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,4BAA4B,GAAG;YACnC,GAAG,CAAC,OAAO,EAAE,4BAA4B,IAAI,EAAE,CAAC;YAChD,GAAG,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,IAAI,EAAE,qBAAqB,CAAC,WAAW,CAAC;SACzF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,UAAU,CAC/D,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,IAAI,EACJ,EAAE,GAAG,OAAO,EAAE,4BAA4B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,+BAA+B,CAClC,YAAY,EACZ,qBAAqB,CAAC,WAAW,EACjC,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACI,KAAK,CAAC,4BAA4B,CACvC,YAA0B,EAC1B,SAA4B,EAC5B,OAEC;QAED,iGAAiG;QACjG,oBAAoB;QACpB,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEhF,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEzG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,0BAA0B,EAAE;aACpC,UAAU,CAAC,YAAY,CAAC;aACxB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAE1E,6FAA6F;QAC7F,kGAAkG;QAClG,mCAAmC;QACnC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;YAC3C,YAAY,EAAE,YAAsB;YACpC,SAAS,EAAE,qBAAqB,CAAC,WAAW;YAC5C,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;YACrD,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;SACnD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACI,KAAK,CAAC,qBAAqB,CAChC,YAA0B,EAC1B,SAA4B,EAC5B,OAA6B,EAC7B,OAEC;QAED,6FAA6F;QAC7F,0FAA0F;QAC1F,kDAAkD;QAClD,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,UAAU,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE;oBACN,OAAO;oBACP,mBAAmB,EAAE,YAAY;oBACjC,UAAU,EAAE,EAAE;oBACd,KAAK,EAAE,EAAE;oBACT,uBAAuB,EAAE,EAAE;oBAC3B,8BAA8B,EAAE,EAAE;oBAClC,gBAAgB,EAAE,CAAC;iBACpB;gBACD,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAElG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE;aACnD,UAAU,CAAC,YAAY,CAAC;aACxB,oBAAoB,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAEnF,wBAAwB;QACxB,EAAE;QACF,+FAA+F;QAC/F,+FAA+F;QAC/F,0FAA0F;QAC1F,wFAAwF;QACxF,6FAA6F;QAC7F,0DAA0D;QAC1D,EAAE;QACF,2FAA2F;QAC3F,8FAA8F;QAC9F,sFAAsF;QACtF,uCAAuC;QACvC,MAAM,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;YAChD,OAAO;YACP,mBAAmB,EAAE,YAAsB;YAC3C,UAAU;YACV,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;iBACvC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;iBAChC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAClD,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB;YAChD,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB;YAC9D,8BAA8B,EAAE,MAAM,CAAC,MAAM,CAAC,8BAA8B;YAC5E,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;SACtD,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,mCAAmC,CACzC,mBAAiC,EACjC,YAAiC,EACjC,gBAAuC;QAEvC,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,mBAAmB,CAE/F,CAAC;QACF,MAAM,kBAAkB,GAAG,oBAAoB,EAAE,qBAAqB;YACpE,CAAC,CAAC,8BAA8B,CAAC,oBAAoB,CAAC,qBAAqB,CAAC;YAC5E,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,QAAQ,GAAkF,EAAE,CAAC;QACnG,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;QACjD,KAAK,MAAM,YAAY,IAAI,kBAAkB,EAAE,CAAC;YAC9C,IAAK,YAAyC,CAAC,UAAU,KAAK,IAAI;gBAAE,SAAS;YAC7E,MAAM,iBAAiB,GAAG,MAAM,CAAE,YAA4C,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAAE,SAAS;YAClF,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAE9C,IAAI,kBAA8H,CAAC;YACnI,IAAI,CAAC;gBACH,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,iBAAiC,CAAC,CAAC;YAC1G,CAAC;YAAC,MAAM,CAAC;gBACP,yFAAyF;gBACzF,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,kBAAkB,EAAE,cAAc,CAAC;YACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,KAAK,oBAAoB,CAAC,mCAAmC;gBAAE,SAAS;YAC/G,QAAQ,CAAC,IAAI,CAAC;gBACZ,YAAY,EAAE,iBAAiB;gBAC/B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,eAAe,EAAE,OAAO,CAAC,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO;QAE3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACvE,OAAO,EAAE;gBACP,MAAM,EAAE,qCAAqC;gBAC7C,OAAO,EACL,uBAAuB,mBAAmB,iBAAiB,QAAQ,CAAC,MAAM,qCAAqC;sBAC7G,kHAAkH;sBAClH,uFAAuF;sBACvF,oHAAoH;sBACpH,4FAA4F;gBAChG,mBAAmB;gBACnB,SAAS,EAAE,QAAQ;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,YAA0B,EAC1B,SAA4B,EAC5B,OAwCC;QAED,iGAAiG;QACjG,8BAA8B;QAC9B,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEhF,MAAM,UAAU,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,mBAAmB,EAAE,YAAY;gBACjC,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,EAAE;gBACT,qBAAqB,EAAE,KAAK;gBAC5B,2FAA2F;gBAC3F,iFAAiF;gBACjF,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEzG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,oDAAoD;QACpD,EAAE;QACF,+FAA+F;QAC/F,gGAAgG;QAChG,4FAA4F;QAC5F,mDAAmD;QACnD,EAAE;QACF,+EAA+E;QAC/E,EAAE;QACF,+FAA+F;QAC/F,oFAAoF;QACpF,+FAA+F;QAC/F,yFAAyF;QACzF,gCAAgC;QAChC,MAAM,IAAI,CAAC,sCAAsC,CAC/C,YAAY,EACZ,UAAU,EACV,aAAa,EACb,OAAO,EAAE,8CAA8C,CACxD,CAAC;QAEF,mDAAmD;QACnD,EAAE;QACF,8FAA8F;QAC9F,wFAAwF;QACxF,gGAAgG;QAChG,iFAAiF;QACjF,EAAE;QACF,4FAA4F;QAC5F,MAAM,IAAI,CAAC,6CAA6C,CACtD,YAAY,EACZ,UAAU,EACV,aAAa,EACb,OAAO,EAAE,uCAAuC,CACjD,CAAC;QAEF,mFAAmF;QACnF,EAAE;QACF,uFAAuF;QACvF,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,qDAAqD;QACrD,IAAI,CAAC,mCAAmC,CACtC,YAAY,EACZ,OAAO,EAAE,4BAA4B,EACrC,aAAa,CACd,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE;aACnD,UAAU,CAAC,YAAY,CAAC;aACxB,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAEzE,0EAA0E;QAC1E,EAAE;QACF,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,mEAAmE;QACnE,EAAE;QACF,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,qFAAqF;QACrF,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,6BAA6B;YACzD,CAAC,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC;gBAChD,mBAAmB,EAAE,YAAY;gBACjC,UAAU;gBACV,YAAY,EAAE,OAAO,EAAE,YAAY;aACpC,CAAC;YACF,CAAC,CAAC,EAAE,CAAC;QAEP;;;;;;;;;;;WAWG;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,KAAK,CAChB,kGAAkG;kBAChG,iGAAiG;kBACjG,4CAA4C,EAC9C,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,MAAM,CAAC,eAAe,EAAE,CAChH,CAAC;YACF,MAAM,CAAC,eAAe,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,iBAAiB,GAAG,+BAA+B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAClF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,oFAAoF;YACpF,8FAA8F;YAC9F,yFAAyF;YACzF,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,uEAAuE,EAAE;gBAC1F,mBAAmB,EAAE,YAAY;gBACjC,YAAY,EAAE,UAAU,CAAC,MAAM;gBAC/B,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;oBACpD,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;yBAC9B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;yBACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;iBACtF,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QAED,gGAAgG;QAChG,8FAA8F;QAC9F,4FAA4F;QAC5F,6BAA6B;QAC7B,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;YAC3C,YAAY,EAAE,YAAsB;YACpC,SAAS,EAAE,qBAAqB,CAAC,WAAW;YAC5C,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;YACrD,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;SACnD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;QAE/C,OAAO,MAAM,CAAC;IAChB,CAAC;CAEF,CAAA;AA14CY,0BAA0B;IADtC,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAGhE,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAGpC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAKvD,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAC7C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAdG,0BAA0B;QACjB,+BAA+B;QACX,qCAAqC;QAG/E,SAAS,YAQF,aAAa;QAErC,mDAAmD;GAjB3F,0BAA0B,CA04CtC","sourcesContent":["import 'reflect-metadata';\nimport { randomUUID } from 'node:crypto';\nimport { Container, inject, injectable, optional } from 'inversify';\nimport {\n  ResourceType,\n  CoreResourceOperation,\n  CoreResourceType,\n  CORE_APP_ROLES,\n  ResourcePrimaryScope,\n  ErrorType,\n  ResourceSystemAccessMode,\n  ResourceDataSubjectKind,\n  coreResourceShared_FieldIdentifier,\n  deriveTrustedSystemWritePreservedFields,\n  getChildDirectionRelationships,\n} from '@wildo-ai/saas-models';\nimport {\n  HttpApiErasureStance,\n} from '@wildo-ai/saas-models/external-data';\nimport type {\n  ResourceConfiguration_OperationPath,\n  ResourceSystemAccessPolicy,\n  Resources_PaginationRequest,\n  Resources_PaginatedResult,\n  SubjectErasureReport,\n  SubjectExportBundle,\n  SubjectExportPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Maps each system-context verb to its public primitive name (for error copy)\n * and the {@link ResourceSystemAccessPolicy} key that gates it. The single place\n * the two write verbs and the two read verbs share their gating vocabulary.\n */\nconst SYSTEM_ACCESS_PRIMITIVE_BY_OP: Record<\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY,\n  { primitive: string; verb: keyof ResourceSystemAccessPolicy }\n> = {\n  [CoreResourceOperation.READ]: { primitive: 'readAsSystem', verb: 'read' },\n  [CoreResourceOperation.LIST]: { primitive: 'listAsSystem', verb: 'list' },\n  [CoreResourceOperation.CREATE]: { primitive: 'createAsSystem', verb: 'create' },\n  [CoreResourceOperation.UPDATE]: { primitive: 'updateAsSystem', verb: 'update' },\n  [CoreResourceOperation.UPDATE_MANY]: { primitive: 'updateManyAsSystem', verb: 'updateMany' },\n};\nimport type { FilterQuery } from 'mongoose';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { RuntimePrincipalBackendService } from '~wildo-backend-lib/config/bootstrap/runtime-principal.backend.service';\nimport { ApplicationRuntimeProfile, resolveApplicationRuntimeAccessPolicy } from '~wildo-backend-lib/config/bootstrap/application-runtime-profile.backend';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n  SubjectErasureExternalEffectsRegistryBackendService,\n  selectIncompleteExternalEffects,\n} from '~wildo-backend-lib/compliance/privacy/services/subject-erasure-external-effects.backend.service';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { ServiceOptions, IdOrIdsOrFilterType } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\n// Type-only: the runtime dependency is resolved via the DI symbol\n// (`SAAS_SERVICE_TYPES.AuditLogsService`), so this never creates a static ESM\n// import edge into the audit subsystem.\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport {\n  assertSuperAdminFloorPreservedForRemoval,\n  assertSuperAdminFloorForSubjectErasure,\n  isSuperAdminFloorGovernedSubjectResource,\n  readSubjectsForSuperAdminFloor,\n  resolveSuperAdminConferringRoles,\n  SuperAdminFloorReductionCause,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n  assertOrganizationOwnerFloorForSubjectErasure,\n  isOrganizationOwnerFloorGovernedSubjectResource,\n  resolveOrganizationOwnerConferringRoles,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\n\n/**\n * The single, deliberately-injected home for **request-triggered** ACL bypass —\n * the system-context read primitives (`readAsSystem` / `listAsSystem`) and the\n * trusted-write primitives (`createAsSystem` / `updateAsSystem` /\n * `updateManyAsSystem`).\n *\n * SCOPE OF THE DOCTRINE (read this before assuming \"all system access lives\n * here\"). There are two distinct reasons in-process code holds a system context,\n * and only ONE is required to route through this service:\n *   - **Request-triggered ACL bypass** — an HTTP request arrives as an anonymous\n *     / low-privilege caller and code must reach a resource that context cannot\n *     (e.g. an anonymous lead-capture CREATE doing a users-by-email lookup). This\n *     MUST go through these primitives, so the bypass is fail-closed + audited.\n *     Custom implementations reach them via `utils.systemAccessService`.\n *   - **Context-free system actors** — batch jobs, cron, queue workers, and\n *     bootstrap have NO initiating request and no user to authorize against; they\n *     legitimately synthesise an `INTERNALLY_INITIATED_REQUEST` super-admin EC via\n *     {@link ExecutionContextCreatorBackendService} directly. They are NOT required\n *     to route through this service (there is nothing to \"bypass\").\n *\n * **Guard 3** of the system-access-guards workstream. These primitives used to\n * live on the universally-injected {@link ServicesRegistryHandlerBackendService},\n * so any service holding the handler could bypass the caller's scope + role ACL.\n * Moving them here means a caller must DELIBERATELY resolve this named service —\n * the handler no longer exposes the capability at all, so a request-triggered\n * bypass cannot be reached by accident and every call site is greppable by the\n * service name.\n *\n * The capability itself is unchanged from Phase 1: **Guard 1** (fail-closed\n * `systemAccessPolicy` opt-in, enforced by {@link assertSystemAccessAllowed}) and\n * **Guard 4** (best-effort `SYSTEM_CONTEXT_READ` / `SYSTEM_CONTEXT_WRITE` audit)\n * travel with the primitives.\n *\n * The actual data access is delegated to the handler's normal `read` / `list`\n * (with the synthesised system execution context); the handler is resolved LAZILY\n * via the container because it is the large singleton graph this service\n * participates in, and a direct constructor injection would re-enter it during\n * backend startup (mirrors the late-resolve pattern in `WebhookConfigBackendService`\n * and `AuthOrganizationConfigurationService`).\n */\n@injectable()\nexport class SystemAccessBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n    // Late-resolved (see class doc): only the big handler graph is lazy; the leaf\n    // deps above are injected directly (this service is itself constructed lazily).\n    @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n    // Optional so minimal test containers that don't bind the audit subsystem still\n    // construct; emission is best-effort and never blocks or fails a read.\n    @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional() private readonly auditLogsService?: AuditLogsBackendService,\n    // Appended LAST and @optional() on purpose — this class is constructed positionally in a number\n    // of focused tests, so inserting a required param anywhere earlier would silently shift every\n    // existing argument. Optional also keeps minimal containers constructible: a deployment that\n    // registers no external erasure effect simply has none to run.\n    @inject(SAAS_SERVICE_TYPES.Logger) @optional() private readonly logger?: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.SubjectErasureExternalEffectsService) @optional()\n    private readonly subjectErasureExternalEffects?: SubjectErasureExternalEffectsRegistryBackendService,\n  ) {}\n\n  /**\n   * Emit the privileged-READ audit under the posture the current runtime requires.\n   *\n   * Two postures, one call site each for READ and LIST:\n   *\n   * - **Best-effort** (application backend): fire-and-forget, exactly as before. The\n   *   framework's most common internal read path must not depend on audit availability;\n   *   blocking it would turn an audit hiccup into an application-wide outage.\n   * - **Accountable / fail-closed** (minion — D9 + OQ-5(b)): the audit must be written\n   *   BEFORE the data is handed back. If it cannot be, the caller gets an error instead\n   *   of the data. The system-access door legitimately bypasses per-tenant authorization;\n   *   what makes that acceptable for a non-human background worker is that every passage\n   *   leaves evidence, so an unrecordable passage must not happen.\n   *\n   * Throwing here withholds data the DB already returned. That is the meaningful boundary\n   * for a read: the minion never OBTAINS cross-tenant data whose access went unrecorded.\n   *\n   * assurance-control: WILDO.AUDIT.SECURITY_EVENT — non-human privileged access is audited or refused.\n   */\n  private async emitPrivilegedReadAudit(\n    payload: Parameters<AuditLogsBackendService['logSystemContextAccess']>[0],\n  ): Promise<void> {\n    const { requiresAccountableSystemAccess } = resolveApplicationRuntimeAccessPolicy(\n      this.resolveRuntimeProfile(),\n    );\n\n    if (!requiresAccountableSystemAccess) {\n      this.auditLogsService?.logSystemContextAccess(payload).catch(() => { /* audit is best-effort */ });\n      return;\n    }\n\n    // Fail-closed: an unbound audit subsystem is itself an inability to record, not an\n    // exemption from recording. Treated identically to a failed write.\n    if (!this.auditLogsService) {\n      throw this.buildUnaccountableAccessError(payload.resourceType, 'the audit subsystem is not available');\n    }\n\n    try {\n      await this.auditLogsService.logSystemContextAccess(payload);\n    } catch (error) {\n      throw this.buildUnaccountableAccessError(\n        payload.resourceType,\n        error instanceof Error ? error.message : String(error),\n      );\n    }\n  }\n\n  /** The runtime profile of this process, defaulting fail-safe if the principal is unresolvable. */\n  private resolveRuntimeProfile(): ApplicationRuntimeProfile {\n    try {\n      return this.container\n        .get<RuntimePrincipalBackendService>(SAAS_SERVICE_TYPES.RuntimePrincipalService)\n        .describe().runtimeProfile;\n    } catch {\n      // An unresolvable principal cannot be a MINION (minion startup binds and initializes\n      // it). Defaulting to APPLICATION_BACKEND therefore preserves existing behaviour for\n      // minimal/test containers rather than failing every read closed.\n      return ApplicationRuntimeProfile.APPLICATION_BACKEND;\n    }\n  }\n\n  private buildUnaccountableAccessError(resourceType: string, cause: string): unknown {\n    return this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n      context: {\n        reason: 'system_context_access_not_accountable',\n        message:\n          `Privileged system access to '${resourceType}' was refused because it could not be audited: ${cause}. `\n          + 'This runtime requires accountable system access — a privileged bypass that cannot be recorded is not performed.',\n        resourceType,\n      },\n    });\n  }\n\n  private getServicesRegistryHandler(): ServicesRegistryHandlerBackendService {\n    return this.container.get<ServicesRegistryHandlerBackendService>(\n      SAAS_SERVICE_TYPES.ServicesRegistryHandlerService,\n    );\n  }\n\n  /**\n   * WHICH RUNTIME is performing this privileged access, for audit attribution.\n   *\n   * Resolved lazily from the container (like the registry handler above) rather than\n   * constructor-injected, because `SystemAccessBackendService` is constructed lazily and\n   * the principal is a process-level singleton established during startup.\n   *\n   * Attribution ONLY. This never influences whether the access is permitted — it records\n   * who performed one that already was. Wrapped defensively because minimal test\n   * containers may not bind it; an unattributable access must still be audited (an audit\n   * record missing its `performedByRuntime` is far better than no audit record at all).\n   */\n  private describeRuntimeForAudit(): { runtimeProfile: string; runtimeKey?: string; serviceIdentifier?: string } | undefined {\n    try {\n      return this.container\n        .get<RuntimePrincipalBackendService>(SAAS_SERVICE_TYPES.RuntimePrincipalService)\n        .describeForAudit();\n    } catch {\n      return undefined;\n    }\n  }\n\n  /**\n   * Refuse a subject erasure that would leave the application without a usable super-administrator.\n   *\n   * ## Why this narrow resource test lives in a generic service\n   *\n   * `eraseSubjectAsSystem` is generic over subject resource types, and the floor is specific to the\n   * resource that carries the application authority axis. The alternative — an erasure-guard registry\n   * so the rule could register itself from the users domain — would be new machinery invented for a\n   * single consumer, and would hide a fail-closed invariant behind an indirection where its absence\n   * is invisible. A named, delegating call whose entire decision lives in the floor authority is the\n   * honest shape: this method chooses WHEN the rule applies, the authority owns WHAT it says.\n   *\n   * ## Fail-closed on an unresolvable population\n   *\n   * Any error from the floor authority propagates and aborts the erasure. That is deliberate: the\n   * failure modes are \"the users repository is unregistered\" and \"the population query failed\",\n   * neither of which is evidence that the erasure is safe.\n   *\n   * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a data-protection erasure must not\n   * remove the last accountable administrative principal.\n   */\n  private async assertSuperAdminFloorForSubjectErasure(\n    resourceType: ResourceType,\n    subjectIds: string[],\n    systemContext: ExecutionContext<any>,\n    acknowledgeFloorBreach?: boolean,\n  ): Promise<void> {\n    if (!isSuperAdminFloorGovernedSubjectResource(resourceType)) return;\n\n    const repositoriesRegistry = this.container.get<RepositoriesRegistryHandlerBackendService>(\n      SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService,\n    );\n\n    const subjects = await readSubjectsForSuperAdminFloor({\n      subjectIds,\n      executionContext: systemContext,\n      repositoriesRegistry,\n      errorBuilder: this.errorBuilder,\n      operationIdentifier: 'eraseSubjectAsSystem',\n    });\n\n    await assertSuperAdminFloorForSubjectErasure({\n      subjects,\n      executionContext: systemContext,\n      repositoriesRegistry,\n      errorBuilder: this.errorBuilder,\n      conferringRoles: resolveSuperAdminConferringRoles(\n        this.container.get<AuthorizationsBackendService>(SAAS_SERVICE_TYPES.AuthorizationsService),\n      ),\n      operationIdentifier: 'eraseSubjectAsSystem',\n      acknowledgeFloorBreach: acknowledgeFloorBreach === true,\n      // The record IS the control here — see the authority's doc. Error level because there is no\n      // scope above the application: nobody will discover this by being denied something later.\n      onAcknowledgedBreach: async (breach) => {\n        this.logger.error(\n          'Subject erasure completed with an ACKNOWLEDGED super-administrator floor breach. If no '\n          + 'usable super-administrator remains, the application cannot be administered and no '\n          + 'in-product path can restore the role, because every such path requires it. Restore one '\n          + 'out-of-band (seed or direct database write) immediately.',\n          {\n            subjectResourceType: resourceType,\n            erasedSuperAdministratorIds: breach.erasedUsableSuperAdminIds,\n            conferringRoles: breach.conferringRoles,\n          },\n        );\n      },\n    });\n  }\n\n  /**\n   * Refuse a subject erasure that would leave any protected organization without a usable owner.\n   *\n   * ## The cross-scope case\n   *\n   * The application twin above measures ONE population, so a refusal names one condition. This one\n   * fans out: a single user can be the last usable owner of SEVERAL tenants at once, and each is an\n   * independent lockout. The floor authority collects every breach and the refusal names them all,\n   * so an operator planning the remediation does not discover the tenants one failed erasure at a\n   * time.\n   *\n   * ## Why it is a separate guard rather than a branch of the one above\n   *\n   * The two invariants share a subject resource list and nothing else. They measure different\n   * populations (application `appRoles` versus per-tenant membership rows), resolve conferral from\n   * different role tables, and answer to different remedies. Fusing them would produce one guard\n   * that reports the wrong condition for half its refusals.\n   *\n   * ## Fail-closed on an unresolvable population\n   *\n   * Any error from the floor authority propagates and aborts the erasure, for the same reason as the\n   * application twin: a query that failed is not evidence that the erasure is safe.\n   *\n   * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a data-protection erasure must not\n   * remove a tenant's last accountable administrative principal.\n   */\n  private async assertOrganizationOwnerFloorForSubjectErasure(\n    resourceType: ResourceType,\n    subjectIds: string[],\n    systemContext: ExecutionContext<any>,\n    acknowledgeOwnerFloorBreach?: boolean,\n  ): Promise<void> {\n    if (!isOrganizationOwnerFloorGovernedSubjectResource(resourceType)) return;\n\n    const repositoriesRegistry = this.container.get<RepositoriesRegistryHandlerBackendService>(\n      SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService,\n    );\n\n    await assertOrganizationOwnerFloorForSubjectErasure({\n      subjectUserIds: subjectIds,\n      executionContext: systemContext,\n      repositoriesRegistry,\n      errorBuilder: this.errorBuilder,\n      conferringRoles: resolveOrganizationOwnerConferringRoles(\n        this.container.get<AuthorizationsBackendService>(SAAS_SERVICE_TYPES.AuthorizationsService),\n      ),\n      operationIdentifier: 'eraseSubjectAsSystem',\n      acknowledgeOwnerFloorBreach: acknowledgeOwnerFloorBreach === true,\n      // The acknowledgement's whole justification is that the consequence becomes VISIBLE rather\n      // than prevented, so this record is not optional decoration — it is the control. Logged at\n      // error level for the same reason the boot report is: an ownerless tenant has no in-product\n      // remedy, so the operator has to learn about it without going looking.\n      onAcknowledgedBreach: async (breach) => {\n        this.logger.error(\n          'Subject erasure completed with an ACKNOWLEDGED organization-owner floor breach. The '\n          + 'organization below now has no administratively usable owner and cannot be administered '\n          + 'in-product. Restore ownership out-of-band.',\n          {\n            organizationId: breach.organizationId,\n            removedOwnerMembershipIds: breach.reducedMemberIds,\n            remainingUsableOwners: breach.remainingUsableOwners,\n            subjectResourceType: resourceType,\n            subjectIds,\n          },\n        );\n      },\n    });\n  }\n\n  /**\n   * A privileged-write audit is an external observer of committed state. When a\n   * trusted system mutation joins a caller-owned transaction, defer the audit to\n   * that transaction's root post-commit queue so Mongo callback retries cannot\n   * emit records for aborted attempts.\n   */\n  private scheduleSystemContextWriteAudit(\n    resourceType: ResourceType,\n    operation: CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): void {\n    if (!this.auditLogsService) return;\n    const emit = async (): Promise<void> => {\n      await this.auditLogsService!.logSystemContextWrite({\n        resourceType: resourceType as string,\n        operation,\n        organizationId: options?.scopeContext?.organizationId,\n        scopeContext: options?.scopeContext,\n        performedByRuntime: this.describeRuntimeForAudit(),\n      }).catch(() => { /* audit is best-effort */ });\n    };\n    if (options?.transaction) {\n      const transaction = options.transaction;\n      // One system-access primitive call is one audit occurrence. A semantic\n      // occurrence id preserves separate writes to the same resource inside a\n      // caller-owned transaction without deriving identity from queue order.\n      const auditOccurrenceId = randomUUID();\n      registerTransactionPostCommitEffect(transaction, {\n        key: [\n          'system-context-write-audit',\n          String(resourceType),\n          String(operation),\n          transaction.id,\n          auditOccurrenceId,\n        ].join(':'),\n        execute: emit,\n      });\n      return;\n    }\n    void emit();\n  }\n\n  /**\n   * Route the caller-supplied scope FKs into the WHICH-resources-in-scope\n   * channel (`contextResourcesFieldIdentifier`) — NOT the WHO channel\n   * (`initiatorIds`).\n   *\n   * These primitives synthesise an `INTERNALLY_INITIATED_REQUEST` execution\n   * context, whose constructor is fail-closed: it REJECTS identity fields\n   * (`organizationId`, `userId`, …) on `initiatorIds` — only `applicationId`\n   * is permitted there. That invariant is correct: the initiator of a system\n   * operation is the SYSTEM (super-admin), not the org/user; the org/user is\n   * merely the SCOPE the operation targets. Seeding `organizationId` onto\n   * `initiatorIds` therefore threw `ExecutionContext_InitiatorIds for\n   * internally_initiated_request … should not have identity fields` for every\n   * `AuthScopeType.ORGANIZATION` load (the `applicationId` case slipped\n   * through only because that one field is allowed).\n   *\n   * Scope-of-operation is exactly what `contextResourcesFieldIdentifier`\n   * (\"WHICH resources are in scope\") models — and it is the channel BOTH\n   * `buildContextualFilter` (reads) AND `enrichDataWithContext`'s context-map\n   * loop (writes) consult to scope the query / inject the FK. `initiatorIds`\n   * is never read for scope filtering. `applicationId` is intentionally left\n   * off this map: it stays on `initiatorIds` (allowed) and\n   * `populateApplicationIdIfNeeded` auto-fills it for APPLICATION-scoped\n   * operations.\n   *\n   * CONTRACT — the target resource MUST model the org/user scope FK in its Zod\n   * main schema. Because the FK travels via `contextResourcesFieldIdentifier`,\n   * both consumers fail CLOSED on a context field the schema does not declare\n   * (`findRequiredNestedFieldPathsFromZodSchema` throws — pinned by\n   * `resource-operation-helper-context-enforcement.test.ts` and by the\n   * `scopeContext` write pins in `system-access.service.test.ts`). This is the\n   * SAME guard the URL-scoped write path enforces, not a new limitation: a\n   * scope FK routed through the context map is required-to-be-modeled by design,\n   * so silent scope-skip is impossible. Every real org/user-scoped resource\n   * satisfies it automatically — the polymorphic/scoped-resource factory\n   * `.extend({ [scopeField]: z.string().isForeignKey() })`s the FK into the\n   * variant schema (`resource-polymorphism.schemas.ts`). This is precisely why\n   * `applicationId` is handled differently and NOT an asymmetry to mirror: it is\n   * the one identity field the internal EC allows on `initiatorIds`, so it alone\n   * can also arrive with an EMPTY context map and be injected top-level even when\n   * the scope column is Mongoose-only (e.g. `auditLogs.applicationId`). org/user\n   * have no such `initiatorIds` channel on an internal EC, so the Zod-modeled\n   * context-map path is the only correct one for them — which every real\n   * org/user-scoped resource has.\n   */\n  private buildSystemScopeContextMap(scopeContext?: { organizationId?: string; applicationId?: string; userId?: string }): Map<string, string> {\n    const map = new Map<string, string>();\n    if (scopeContext?.organizationId) {\n      map.set(coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], scopeContext.organizationId);\n    }\n    if (scopeContext?.userId) {\n      map.set(coreResourceShared_FieldIdentifier[CoreResourceType.USERS], scopeContext.userId);\n    }\n    return map;\n  }\n\n  /**\n   * The `applicationId` scope FK is the ONE identity field the\n   * `INTERNALLY_INITIATED_REQUEST` EC permits on `initiatorIds`. Forward it\n   * there (org/user go through {@link buildSystemScopeContextMap} instead);\n   * omit entirely when unset so `populateApplicationIdIfNeeded` resolves it.\n   */\n  private buildSystemInitiatorIds(\n    scopeContext?: { organizationId?: string; applicationId?: string; userId?: string },\n  ): { applicationId: string } | null {\n    return scopeContext?.applicationId ? { applicationId: scopeContext.applicationId } : null;\n  }\n\n  /**\n   * Guard 1: enforce the target resource's fail-closed `systemAccessPolicy`.\n   * `readAsSystem` / `listAsSystem` run with a synthesised `APP_ADMIN_SUPER_ADMIN`\n   * context and therefore bypass the caller's scope + role checks, so a resource is\n   * read this way ONLY if its owner explicitly opted the verb in\n   * (`ResourceSystemAccessMode.ALLOWED`). Anything else — no policy at all, the verb\n   * omitted, or `FORBIDDEN` — throws.\n   *\n   * Thrown as a CONFIGURATION error rather than AUTHORIZATION on purpose: the caller\n   * is internal system code (not an end user), and the remedy is to declare\n   * `systemAccessPolicy` on the resource config, so this must not masquerade as a\n   * user-facing 403.\n   */\n  private assertSystemAccessAllowed(\n    resourceType: ResourceType,\n    operation:\n      | CoreResourceOperation.READ\n      | CoreResourceOperation.LIST\n      | CoreResourceOperation.CREATE\n      | CoreResourceOperation.UPDATE\n      | CoreResourceOperation.UPDATE_MANY,\n  ): void {\n    const config = this.resourcesRegistry.getResourceConfiguration(resourceType);\n    const { primitive, verb } = SYSTEM_ACCESS_PRIMITIVE_BY_OP[operation];\n    const mode = config.systemAccessPolicy?.[verb];\n\n    if (mode !== ResourceSystemAccessMode.ALLOWED) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'system_context_access_not_permitted',\n          resourceType,\n          attemptedSystemVerb: operation,\n          message:\n            `${primitive} is not permitted for resource '${String(resourceType)}': its ` +\n            `systemAccessPolicy.${verb} is not ALLOWED (fail-closed). Declare ` +\n            `systemAccessPolicy.${verb} = ResourceSystemAccessMode.ALLOWED on the resource ` +\n            `configuration to opt this resource into system-context ${verb}s, and ensure the ` +\n            `caller enforces an explicit alternative authorization (e.g. token/email ownership).`,\n        },\n      });\n    }\n  }\n\n  /**\n   * Compute the trusted-write re-attach allowlist for a payload: exactly the keys\n   * the client-shaped request DTO would strip for a legitimate reason (backend-only\n   * material + context-auto-populated FKs). Forwarded as\n   * `options.preserveServerInjectedFields` so the repository re-attaches them after\n   * the strict parse. See `deriveTrustedSystemWritePreservedFields`.\n   */\n  private deriveWritePreserveFields(\n    resourceType: ResourceType,\n    data: unknown,\n    verb: CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY,\n  ): string[] {\n    if (!data || typeof data !== 'object' || Array.isArray(data)) {\n      return [];\n    }\n    const config = this.resourcesRegistry.getResourceConfiguration(resourceType);\n    return deriveTrustedSystemWritePreservedFields(config.mainSchema, Object.keys(data), verb);\n  }\n\n  /**\n   * @wildo_source:part:start saas.backend.system-access-service facet:layer:backend facet:family:service\n   *\n   * Read a resource using a synthesised INTERNALLY_INITIATED_REQUEST execution\n   * context with system-level admin roles, regardless of the originating user's\n   * roles. Use this for server-side policy / configuration loads that drive runtime\n   * behaviour (webhook config, SSO config, SIEM export config, …) where the\n   * originating user is not necessarily the configurer of the policy and therefore\n   * cannot satisfy the resource's READ ACL.\n   *\n   * REQUIRES the target resource to opt in via `systemAccessPolicy.read = ALLOWED`\n   * on its resource configuration — otherwise this throws `ErrorType.CONFIGURATION`\n   * (fail-closed; a never-registered resource throws `ErrorType.INTERNAL` first).\n   * The returned record is the FULL super-admin view (every field, no feature\n   * gating), so the caller MUST enforce an explicit alternative authorization and\n   * project only what is safe to surface to the originating (often lower-privilege)\n   * request.\n   *\n   * Behaviour notes:\n   *   - The synthesised EC is `INTERNALLY_INITIATED_REQUEST` — feature resolution\n   *     returns \"all features enabled\" for it (the call is server-internal).\n   *   - `scopeContext` (optional) seeds the EC's `contextResourcesFieldIdentifier`\n   *     (the WHICH-resources-in-scope channel) so `buildContextualFilter` scopes\n   *     the read to the right tenant FK (e.g. `organizationId`). It must NOT go on\n   *     `initiatorIds` — the internal EC fail-closed rejects identity fields there\n   *     (see {@link buildSystemScopeContextMap}). When omitted, the caller scopes\n   *     via the filter argument.\n   *   - Role injection is APPLICATION-scoped `APP_ADMIN_SUPER_ADMIN` — the broadest\n   *     system role, accepted by every variant's READ ACL.\n   */\n  public async readAsSystem<T = any>(\n    resourceType: ResourceType,\n    id_or_ids_or_filter: IdOrIdsOrFilterType,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n      /**\n       * Skip the `SYSTEM_CONTEXT_READ` privileged-access audit for THIS call. For SELF-REFERENTIAL\n       * internal reads that are framework plumbing rather than tenant-actionable access — e.g. the\n       * audit pipeline resolving a user's memberships / an org's SIEM config to ROUTE an audit event\n       * — where auditing the read would only amplify (and can recurse into) the audit trail. Genuine\n       * privileged reads leave this unset so they still audit.\n       */\n      suppressSystemAudit?: boolean;\n    },\n  ): Promise<T | null> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system READ.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.READ);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> = options?.variantKey\n      ? this.resourcesRegistry.getServiceOperationPath(resourceType, CoreResourceOperation.READ, options.variantKey)\n      : this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.READ);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const result = await this.getServicesRegistryHandler().read<T>(resourceType, systemContext, id_or_ids_or_filter, options);\n    // Guard 4: emit a best-effort privileged-access audit event. Never blocks or\n    // fails the read — `?.` short-circuits when audit is unbound and errors are\n    // swallowed (`logEvent` is already fire-and-forget internally).\n    if (!options?.suppressSystemAudit) {\n      await this.emitPrivilegedReadAudit({\n        resourceType: resourceType as string,\n        operation: CoreResourceOperation.READ,\n        resultCount: result == null ? 0 : 1,\n        organizationId: options?.scopeContext?.organizationId,\n        scopeContext: options?.scopeContext,\n        performedByRuntime: this.describeRuntimeForAudit(),\n      });\n    }\n    return result;\n  }\n\n  /**\n   * List resources using a synthesised INTERNALLY_INITIATED_REQUEST execution\n   * context with system-level admin roles. The cross-scope sibling of\n   * {@link readAsSystem}: use it for server-side LISTs that must span scopes the\n   * originating user is not a member of (e.g. \"all pending invitations for this\n   * email across every organization\"), where a normal scoped LIST would filter the\n   * rows out by the caller's scope. Same role/scope semantics as `readAsSystem`;\n   * with no `pagination` the return is a plain `T[]`.\n   */\n  public async listAsSystem<T = any>(\n    resourceType: ResourceType,\n    filter?: FilterQuery<any>,\n    pagination?: Partial<Resources_PaginationRequest>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n      /** Skip the `SYSTEM_CONTEXT_READ` audit for a self-referential internal routing read — see {@link readAsSystem}. */\n      suppressSystemAudit?: boolean;\n    },\n  ): Promise<T[] | Resources_PaginatedResult<T>> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system LIST.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.LIST);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> = options?.variantKey\n      ? this.resourcesRegistry.getServiceOperationPath(resourceType, CoreResourceOperation.LIST, options.variantKey)\n      : this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.LIST);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const result = await this.getServicesRegistryHandler().list<T>(resourceType, systemContext, filter, pagination, options);\n    // Guard 4: best-effort privileged-access audit (never blocks or fails the list).\n    if (!options?.suppressSystemAudit) {\n      const resultCount = Array.isArray(result) ? result.length : result.data?.length;\n      await this.emitPrivilegedReadAudit({\n        resourceType: resourceType as string,\n        operation: CoreResourceOperation.LIST,\n        resultCount,\n        organizationId: options?.scopeContext?.organizationId,\n        scopeContext: options?.scopeContext,\n        performedByRuntime: this.describeRuntimeForAudit(),\n      });\n    }\n    return result;\n  }\n\n  // ═══════════════════════════════════════════════════════════════════════════════════════════════\n  // RETENTION SEE-THROUGH primitives (M5b) — privileged reads that REVEAL retained (impersonalized-and-\n  // retained) rows the M5a hide-predicate keeps hidden from normal callers. Distinct from readAsSystem/\n  // listAsSystem: they assert the `seeRetained` policy verb (NOT read/list), require a privileged HUMAN\n  // role, SET the EC see-through flag, and emit the HUMAN-attributed `RETAINED_DATA_ACCESS` audit\n  // (accessingUserId + reason threaded in — this layer has no ambient user). Strictly read-only.\n  // ═══════════════════════════════════════════════════════════════════════════════════════════════\n\n  /**\n   * Fail-closed gate for the retention see-through verb. Unlike {@link assertSystemAccessAllowed}\n   * (whose op→verb map is 1:1), the see-through reads run over the resource's READ / LIST core op yet\n   * must assert the SEPARATE `seeRetained` verb — so this is a dedicated check, not a map entry.\n   */\n  private assertSeeRetainedAllowed(resourceType: ResourceType): void {\n    const config = this.resourcesRegistry.getResourceConfiguration(resourceType);\n    if (config.systemAccessPolicy?.seeRetained !== ResourceSystemAccessMode.ALLOWED) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'see_retained_access_not_permitted',\n          resourceType,\n          message:\n            `readRetainedAsSystem / listRetainedAsSystem is not permitted for resource ` +\n            `'${String(resourceType)}': its systemAccessPolicy.seeRetained is not ALLOWED (fail-closed). ` +\n            `This grant is derived automatically when the resource opts into retentionPolicy.`,\n        },\n      });\n    }\n  }\n\n  /**\n   * Privileged-role gate for a see-through read: the HUMAN principal must hold a role authorized to\n   * reveal retained (scrubbed) PII. Phase 1 gates on `APP_ADMIN_SUPER_ADMIN` only (super-admin already\n   * has full access); a dedicated `COMPLIANCE_AUDITOR` role is a purely-additive follow-up — add it to\n   * the `authorized` set once that `_core` role lands. Thrown as AUTHORIZATION (a human 403), unlike the\n   * CONFIGURATION error above (a resource-opt-in problem).\n   */\n  private assertSeeThroughRole(accessingUserRoles: string[]): void {\n    const authorized = accessingUserRoles.some(r => r === CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN);\n    if (!authorized) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n        context: {\n          reason: 'see_through_role_required',\n          message:\n            `A retention see-through read requires a privileged role ` +\n            `(${CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN}); the caller's roles do not include one.`,\n        },\n      });\n    }\n  }\n\n  /**\n   * Fail-closed attribution guard: a see-through reveal of scrubbed PII is only permitted with a REAL\n   * human id AND a real reason. The `RETAINED_DATA_ACCESS` event schema pins both as `.trim().min(1)`,\n   * but the audit store persists `eventData` as an unparsed record — so this is the ENFORCEMENT point\n   * that stops a blank/whitespace attribution from producing an anonymous, reason-less audited reveal\n   * (which would defeat the entire justification for allowing the read). Thrown as VALIDATION.\n   */\n  private assertSeeThroughAttribution(accessingUserId: string, reason: string): void {\n    if (!accessingUserId?.trim() || !reason?.trim()) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n        context: {\n          reason: 'see_through_attribution_required',\n          message:\n            `A retention see-through read requires a non-empty accessingUserId AND reason ` +\n            `(human attribution + justification for revealing scrubbed PII); neither may be blank.`,\n        },\n      });\n    }\n  }\n\n  /**\n   * SEE-THROUGH single-record read (M5b): reveals a RETAINED (impersonalized-and-retained) record that\n   * the M5a hide-predicate hides from normal callers. Fail-closed on the `seeRetained` policy verb + a\n   * privileged HUMAN role; sets the EC see-through flag so `buildContextualFilter` suppresses ONLY the\n   * retention predicate for THIS read (scope still applies); emits the HUMAN-attributed\n   * `RETAINED_DATA_ACCESS` audit. The human's id/roles + a `reason` are REQUIRED — this layer has no\n   * ambient user. Strictly read-only.\n   */\n  public async readRetainedAsSystem<T = any>(\n    resourceType: ResourceType,\n    id_or_ids_or_filter: IdOrIdsOrFilterType,\n    auth: { accessingUserId: string; accessingUserRoles: string[]; reason: string },\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T | null> {\n    this.assertSeeRetainedAllowed(resourceType);\n    this.assertSeeThroughRole(auth.accessingUserRoles);\n    this.assertSeeThroughAttribution(auth.accessingUserId, auth.reason);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> = options?.variantKey\n      ? this.resourcesRegistry.getServiceOperationPath(resourceType, CoreResourceOperation.READ, options.variantKey)\n      : this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.READ);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n    // M5b: reveal retained rows for THIS read only (suppresses ONLY the retention predicate, not scope).\n    systemContext.setSeeRetainedData(true);\n\n    const result = await this.getServicesRegistryHandler().read<T>(resourceType, systemContext, id_or_ids_or_filter, options);\n\n    // M6: HUMAN-attributed, reason-bearing, best-effort (never blocks/fails the read).\n    this.auditLogsService?.logRetainedDataAccess({\n      accessingUserId: auth.accessingUserId,\n      roles: auth.accessingUserRoles,\n      reason: auth.reason,\n      resourceType: resourceType as string,\n      operationIdentifier: 'readRetainedAsSystem',\n      retainedRecordCount: result == null ? 0 : 1,\n      organizationId: options?.scopeContext?.organizationId,\n    }).catch(() => { /* audit is best-effort */ });\n\n    return result;\n  }\n\n  /**\n   * SEE-THROUGH collection read (M5b): the list sibling of {@link readRetainedAsSystem}. Same gates\n   * (`seeRetained` verb + privileged role), same EC see-through flag, same HUMAN-attributed audit.\n   */\n  public async listRetainedAsSystem<T = any>(\n    resourceType: ResourceType,\n    auth: { accessingUserId: string; accessingUserRoles: string[]; reason: string },\n    filter?: FilterQuery<any>,\n    pagination?: Partial<Resources_PaginationRequest>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T[] | Resources_PaginatedResult<T>> {\n    this.assertSeeRetainedAllowed(resourceType);\n    this.assertSeeThroughRole(auth.accessingUserRoles);\n    this.assertSeeThroughAttribution(auth.accessingUserId, auth.reason);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> = options?.variantKey\n      ? this.resourcesRegistry.getServiceOperationPath(resourceType, CoreResourceOperation.LIST, options.variantKey)\n      : this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.LIST);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n    systemContext.setSeeRetainedData(true);\n\n    const result = await this.getServicesRegistryHandler().list<T>(resourceType, systemContext, filter, pagination, options);\n    const retainedRecordCount = Array.isArray(result) ? result.length : result.data?.length;\n\n    this.auditLogsService?.logRetainedDataAccess({\n      accessingUserId: auth.accessingUserId,\n      roles: auth.accessingUserRoles,\n      reason: auth.reason,\n      resourceType: resourceType as string,\n      operationIdentifier: 'listRetainedAsSystem',\n      retainedRecordCount,\n      organizationId: options?.scopeContext?.organizationId,\n    }).catch(() => { /* audit is best-effort */ });\n\n    return result;\n  }\n\n  /**\n   * Create a resource using a synthesised super-admin system context, RE-ATTACHING\n   * the fields the client-shaped request DTO strips: `.isBackendOnly()` material\n   * (e.g. a credential `passwordHash`) and the context-auto-populated FKs (e.g.\n   * `userId` on a system resource that has no HTTP surface to seed it). Use this\n   * for trusted in-process writes to system resources — e.g. registration\n   * persisting `USER_CREDENTIALS` / `USER_PROFILES` — where the payload IS the\n   * source of truth and there is no request context to inject the FKs.\n   *\n   * REQUIRES the target resource to opt in via `systemAccessPolicy.create = ALLOWED`\n   * (fail-closed; otherwise throws `ErrorType.CONFIGURATION`). The re-attach\n   * allowlist is DERIVED from the resource schema (never caller-supplied), and this\n   * primitive is reachable only from trusted engine code — never an HTTP payload —\n   * so it cannot be used to smuggle client-forbidden fields.\n   *\n   * `scopeContext` (optional) seeds the EC's `contextResourcesFieldIdentifier`\n   * (the WHICH-resources-in-scope channel — NOT `initiatorIds`, which fail-closed\n   * rejects identity fields on the internal EC; see\n   * {@link buildSystemScopeContextMap}) so `enrichDataWithContext`'s context-map\n   * loop injects the right scope FK. It is NOT required when the scope FKs are\n   * already present on `data` (they are preserved by the allowlist).\n   */\n  public async createAsSystem<T = any>(\n    resourceType: ResourceType,\n    data: Record<string, unknown>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system CREATE.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.CREATE);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.CREATE);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const preserveServerInjectedFields = [\n      ...(options?.preserveServerInjectedFields ?? []),\n      ...this.deriveWritePreserveFields(resourceType, data, CoreResourceOperation.CREATE),\n    ];\n\n    const result = await this.getServicesRegistryHandler().create<T>(\n      resourceType,\n      systemContext,\n      data,\n      { ...options, preserveServerInjectedFields },\n    );\n    // Guard 4: best-effort privileged-write audit (never blocks or fails the write).\n    this.scheduleSystemContextWriteAudit(\n      resourceType,\n      CoreResourceOperation.CREATE,\n      options,\n    );\n    return result;\n  }\n\n  /**\n   * Update a single resource using a synthesised super-admin system context,\n   * re-attaching the DTO-stripped fields (backend-only material like a rotated\n   * `passwordHash`, and context-auto-populated FKs). The single-target sibling of\n   * {@link createAsSystem}. Requires `systemAccessPolicy.update = ALLOWED`\n   * (fail-closed). `id_or_ids_or_filter` selects the target exactly as the normal\n   * `update` does (an id or a filter).\n   */\n  public async updateAsSystem<T = any>(\n    resourceType: ResourceType,\n    id_or_ids_or_filter: IdOrIdsOrFilterType,\n    data: Record<string, unknown>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T | null> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system UPDATE.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.UPDATE);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.UPDATE);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const preserveServerInjectedFields = [\n      ...(options?.preserveServerInjectedFields ?? []),\n      ...this.deriveWritePreserveFields(resourceType, data, CoreResourceOperation.UPDATE),\n    ];\n\n    const result = await this.getServicesRegistryHandler().update<T>(\n      resourceType,\n      systemContext,\n      id_or_ids_or_filter,\n      data,\n      { ...options, preserveServerInjectedFields },\n    );\n    this.scheduleSystemContextWriteAudit(\n      resourceType,\n      CoreResourceOperation.UPDATE,\n      options,\n    );\n    return result;\n  }\n\n  /**\n   * Bulk-update resources matched by `id_or_ids_or_filter` using a synthesised\n   * super-admin system context, re-attaching the DTO-stripped fields. The\n   * many-target sibling of {@link updateAsSystem}; requires\n   * `systemAccessPolicy.updateMany = ALLOWED` (fail-closed). Used e.g. by\n   * anonymous→user ownership transposition, where a shared patch (`userId`,\n   * `anonymousUserId`) must land on many rows.\n   */\n  public async updateManyAsSystem<T = any>(\n    resourceType: ResourceType,\n    id_or_ids_or_filter: IdOrIdsOrFilterType,\n    data: Record<string, unknown>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T[]> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system UPDATE_MANY.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const preserveServerInjectedFields = [\n      ...(options?.preserveServerInjectedFields ?? []),\n      ...this.deriveWritePreserveFields(resourceType, data, CoreResourceOperation.UPDATE_MANY),\n    ];\n\n    const result = await this.getServicesRegistryHandler().updateMany<T>(\n      resourceType,\n      systemContext,\n      id_or_ids_or_filter,\n      data,\n      { ...options, preserveServerInjectedFields },\n    );\n    this.scheduleSystemContextWriteAudit(\n      resourceType,\n      CoreResourceOperation.UPDATE_MANY,\n      options,\n    );\n    return result;\n  }\n\n  /**\n   * DIRECT subject erasure — impersonalize-and-retain the named rows of a retention-governed resource.\n   *\n   * This is the entry point for \"erase this subject\": scrub the personal fields in place, keep the row,\n   * and mark it `RETAINED` (hidden from normal reads, immutable, reachable only through the audited\n   * see-through path).\n   *\n   * WHY IT EXISTS: until now the ONLY way to reach impersonalization was the `onParentDelete` cascade —\n   * i.e. a PARENT being deleted. That structurally excludes every SCOPE ROOT, and `USERS` is a scope\n   * root, so the resource that actually holds the personal data could never be erased. A\n   * parent-delete-only trigger can only ever reach CHILD resources, which are precisely the ones\n   * holding no PII (a billing row points at a person; the name and address live on the user). This\n   * closes that gap: erasure can now be initiated on the subject itself.\n   *\n   * Shares ONE definition of \"impersonalize these rows\" with the cascade\n   * (`impersonalizeRowsInPlace`) — the asserts, the scrub patch, the marker write and the\n   * treatment-driven file erasure are not duplicated here, so the two entry points cannot drift on\n   * what counts as erased.\n   *\n   * Fail-closed twice over: the resource must grant system `updateMany` (Guard 1, as for every trusted\n   * write) AND must be retention-governed (asserted by the shared core — otherwise there is no\n   * `retentionStatus` marker to flip and no derived grant to flip it with).\n   *\n   * Takes EXPLICIT ids rather than a filter: an erasure is not a query, and resolving a filter here\n   * would need a system LIST grant plus a silent decision about what to do when it matches more (or\n   * fewer) rows than the caller expected. The caller knows the subject.\n   */\n  public async impersonalizeSubjectAsSystem(\n    resourceType: ResourceType,\n    id_or_ids: string | string[],\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<void> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system UPDATE_MANY — the verb the\n    // scrub write uses.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const rowIds = typeof id_or_ids === 'string' ? [id_or_ids] : id_or_ids;\n    if (rowIds.length === 0) {\n      return;\n    }\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    await this.getServicesRegistryHandler()\n      .getService(resourceType)\n      .impersonalizeRowsInPlace(resourceType, rowIds, systemContext, options);\n\n    // Best-effort privileged-write audit (never blocks or fails the erasure) — mirrors the other\n    // trusted writes. The per-row RETAINED_DATA_ACCESS audit covers later READS of the retained rows;\n    // this records the erasure itself.\n    this.auditLogsService?.logSystemContextWrite({\n      resourceType: resourceType as string,\n      operation: CoreResourceOperation.UPDATE_MANY,\n      organizationId: options?.scopeContext?.organizationId,\n      scopeContext: options?.scopeContext,\n      performedByRuntime: this.describeRuntimeForAudit(),\n    }).catch(() => { /* audit is best-effort */ });\n  }\n\n  /**\n   * SUBJECT ERASURE — the entry point a \"delete my account\" request calls.\n   *\n   * The whole erasure, not just its last step: tear down the subject's dependents according to what\n   * each edge declared, THEN scrub the subject row and flip it to `RETAINED`. Prefer this over\n   * {@link impersonalizeSubjectAsSystem} for any real erasure request — that method scrubs the\n   * subject row ALONE, which for a user leaves the profile holding the name, the bio and the avatar\n   * completely intact (the `USERS → USER_PROFILES` cascade is delete-driven, and an erasure does not\n   * delete the user). `impersonalizeSubjectAsSystem` remains the right call only when the caller has\n   * already dealt with the dependents, or when the subject genuinely has none.\n   *\n   * The delete-vs-retain decision per dependent is DERIVED FROM CONFIGURATION — each edge's\n   * `onParentDelete` declaration, read through the same authority the delete cascade uses — never\n   * from a hardcoded list of resource types. Edges the author never classified abort the erasure\n   * instead of being guessed at. See `classifySubjectErasureDisposition` for the full table.\n   *\n   * Fail-closed three times over: the resource must grant system `updateMany` (Guard 1, as for every\n   * trusted write), must be retention-governed (the subject is kept, so there must be a\n   * `retentionStatus` marker to flip), and must have an executable disposition for every dependent\n   * edge.\n   *\n   * Takes EXPLICIT ids for the same reason {@link impersonalizeSubjectAsSystem} does: an erasure is\n   * not a query, and resolving a filter here would silently decide what to do when it matches more\n   * (or fewer) subjects than the caller expected.\n   *\n   * @returns the `SubjectErasureReport` — every edge with the disposition applied and the\n   *   configuration that justified it. Returned rather than only logged so the flow fronting the\n   *   request can record or surface it as the evidence of what was erased.\n   */\n  /**\n   * Assemble a data subject's export bundle under a synthesised system context — the disclosure\n   * counterpart of {@link eraseSubjectAsSystem}, and the ONLY public door to a subject export.\n   *\n   * ## No route, deliberately\n   *\n   * There is no resource operation and no HTTP endpoint for this, exactly as there is none for\n   * erasure. GDPR Art. 15 and Art. 20 bind the data **controller** — the application built with this\n   * framework, not the framework — so WHO may request an export, what identity proof is required\n   * first, and how the result is delivered are the application's decisions. The framework's job is\n   * to make the bundle assemblable and to refuse to assemble a misleading one.\n   *\n   * Four routed export operations that claimed to do this were removed on 2026-08-01 for exactly\n   * this reason: each answered HTTP 200 with an unfiltered row while ignoring its whole request\n   * contract. This is the honest replacement, at the layer the decision actually belongs to.\n   *\n   * ## Two-key gate\n   *\n   * The caller's invocation is the first key — reaching this method at all is a deliberate act by\n   * the controller. The per-resource `systemAccessPolicy.exportSubject` opt-in is the second, and it\n   * is enforced inside the orchestrator across EVERY resource that would enter the bundle, not just\n   * the subject's own. A resource that never consented to disclosure cannot be swept in because it\n   * happens to sit on an edge.\n   *\n   * `// assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT`\n   *\n   * ## Interaction with erasure RETENTION (checked 2026-08-09 — deliberate, not an oversight)\n   *\n   * This path does NOT set the see-through flag; only `readRetainedAsSystem` / `listRetainedAsSystem` do.\n   * So exporting a subject who has ALREADY been erased-and-retained reads through the ordinary chokepoint,\n   * finds the row hidden, and discloses nothing — which is the correct answer twice over: the row's\n   * personal fields are already scrubbed, and an export is a disclosure door, so it must not be the one\n   * that reveals what erasure withdrew.\n   *\n   * Do not \"fix\" a thin bundle for an erased subject by granting see-through here. The audited reveal has\n   * its own two primitives precisely so that a compliance auditor's read is separable, attributed and\n   * logged; routing it through export would make every export a potential retained-data disclosure.\n   *\n   * @param resourceType the subject's resource type.\n   * @param id_or_ids the explicit subject rows. An export is not a query.\n   * @param purpose WHICH right is being answered — the two produce genuinely different bundles.\n   * @returns the {@link SubjectExportBundle}. Only `bundle.report` is safe to log; `bundle.slices`\n   *   carry the personal data itself.\n   */\n  public async exportSubjectAsSystem(\n    resourceType: ResourceType,\n    id_or_ids: string | string[],\n    purpose: SubjectExportPurpose,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<SubjectExportBundle> {\n    // Guard 1 (fail-closed): the subject's own resource must permit system READ — the verb every\n    // row of the bundle is gathered with. The narrower `exportSubject` opt-in is asserted per\n    // participating resource inside the orchestrator.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.READ);\n\n    const subjectIds = typeof id_or_ids === 'string' ? [id_or_ids] : id_or_ids;\n    if (subjectIds.length === 0) {\n      return {\n        report: {\n          purpose,\n          subjectResourceType: resourceType,\n          subjectIds: [],\n          edges: [],\n          fieldsExcludedAsDerived: [],\n          fieldsWithheldAsNonDisclosable: [],\n          totalRecordCount: 0,\n        },\n        slices: [],\n      };\n    }\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.READ);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const bundle = await this.getServicesRegistryHandler()\n      .getService(resourceType)\n      .exportSubjectInPlace(resourceType, subjectIds, purpose, systemContext, options);\n\n    // ── The audit event ──\n    //\n    // A subject export is arguably the most audit-worthy READ the framework performs: it assembles\n    // everything held about one person and hands it out. No framework mechanism would emit for it:\n    // `FIELD_ACCESS` fires only on first exposure of a backend-only secret at CREATE, and the\n    // risk-tiered `RESOURCE_OPERATION_PERFORMED` emission deliberately excludes read-shaped\n    // operations. The removed export operations produced no trail whatsoever — which is why this\n    // event is emitted explicitly here rather than inherited.\n    //\n    // The report is logged, never the slices: the report is designed to carry dispositions and\n    // counts and NO personal data, so it is safe to persist in an audit store. Logging the bundle\n    // would put the exported personal data into the audit trail — turning the record of a\n    // disclosure into a second copy of it.\n    await this.auditLogsService?.logSubjectDataExport({\n      purpose,\n      subjectResourceType: resourceType as string,\n      subjectIds,\n      includedResourceTypes: bundle.report.edges\n        .filter((edge) => edge.collected)\n        .map((edge) => String(edge.relatedResourceType)),\n      totalRecordCount: bundle.report.totalRecordCount,\n      fieldsExcludedAsDerived: bundle.report.fieldsExcludedAsDerived,\n      fieldsWithheldAsNonDisclosable: bundle.report.fieldsWithheldAsNonDisclosable,\n      organizationId: options?.scopeContext?.organizationId,\n    });\n\n    return bundle;\n  }\n\n  /**\n   * Guard 4 of {@link eraseSubjectAsSystem}: rows linked to the subject in an HTTP_API-bound\n   * external system declaring erasure stance `CONTROLLER_ACKNOWLEDGED_NON_ERASURE` (ETL D6, 6c)\n   * refuse the erasure until the CONTROLLER acknowledges the hole — per request, via\n   * `acknowledgeHttpApiNonErasure`, never as a standing posture.\n   *\n   * `CONFLICT` (409), like the floors: the caller is authorized and the payload valid — what\n   * refuses is the declared state of the subject's graph, and the refusal names its own remedy.\n   * Enumerates the subject's child-direction edges (the erasure's own discovery boundary — linkage\n   * no relationship declares is outside every part of the erasure, not only this guard). The\n   * acknowledged path's RECORD (the CRITICAL audit event + the report entry) is emitted by the\n   * per-resource external effect post-commit, where the outcome it records actually exists.\n   */\n  private assertHttpApiNonErasureAcknowledged(\n    subjectResourceType: ResourceType,\n    acknowledged: boolean | undefined,\n    executionContext: ExecutionContext<any>,\n  ): void {\n    const subjectConfiguration = this.resourcesRegistry.getResourceConfiguration(subjectResourceType) as {\n      resourceRelationships?: Parameters<typeof getChildDirectionRelationships>[0];\n    };\n    const childRelationships = subjectConfiguration?.resourceRelationships\n      ? getChildDirectionRelationships(subjectConfiguration.resourceRelationships)\n      : [];\n\n    const affected: Array<{ resourceType: string; providerRef: string; remoteEntityRef: string }> = [];\n    const seenChildResourceTypes = new Set<string>();\n    for (const relationship of childRelationships) {\n      if ((relationship as { isDisabled?: boolean }).isDisabled === true) continue;\n      const childResourceType = String((relationship as { resourceType2?: unknown }).resourceType2 ?? '');\n      if (!childResourceType || seenChildResourceTypes.has(childResourceType)) continue;\n      seenChildResourceTypes.add(childResourceType);\n\n      let childConfiguration: { httpApiBinding?: { providerRef: string; entityRef: string; erasure?: { stance?: string } } } | undefined;\n      try {\n        childConfiguration = this.resourcesRegistry.getResourceConfiguration(childResourceType as ResourceType);\n      } catch {\n        // An unregistered child is the erasure orchestrator's problem to name, not this guard's.\n        continue;\n      }\n      const binding = childConfiguration?.httpApiBinding;\n      if (!binding || binding.erasure?.stance !== HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE) continue;\n      affected.push({\n        resourceType: childResourceType,\n        providerRef: binding.providerRef,\n        remoteEntityRef: binding.entityRef,\n      });\n    }\n\n    if (affected.length === 0 || acknowledged === true) return;\n\n    throw this.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        reason: 'http_api_non_erasure_unacknowledged',\n        message:\n          `Subject erasure of \"${subjectResourceType}\" is REFUSED: ${affected.length} linked HTTP_API-bound resource(s) `\n          + `declare erasure stance CONTROLLER_ACKNOWLEDGED_NON_ERASURE — their remote rows cannot be erased by the platform `\n          + `and would silently survive an erasure that reports itself complete. To proceed, pass `\n          + `'acknowledgeHttpApiNonErasure: true' on THIS request: the erasure will then complete locally, each named resource `\n          + `will be recorded as a CRITICAL audit event, and the report will carry the hole explicitly.`,\n        subjectResourceType,\n        resources: affected,\n      },\n    });\n  }\n\n  public async eraseSubjectAsSystem(\n    resourceType: ResourceType,\n    id_or_ids: string | string[],\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n      /**\n       * The CONTROLLER's explicit decision to complete an erasure that would leave one or more\n       * organizations with no usable owner.\n       *\n       * Off by default, so stranding a tenant is never accidental. Supplied, the erasure proceeds and\n       * each stranded tenant is recorded as a CRITICAL audit event instead of the write being\n       * refused. See `assertOrganizationOwnerFloorForSubjectErasure` in the floor authority for why\n       * this door is defeasible while every administrative door is not — in short, GDPR Art. 17(3)\n       * does not recognise \"the tenant would become unadministrable\" as a ground to refuse erasure,\n       * and the framework must not impose that posture on the application that owes the answer.\n       */\n      acknowledgeOrganizationOwnerFloorBreach?: boolean;\n      /**\n       * The same controller decision for the APPLICATION-scope floor.\n       *\n       * Separate from its organization sibling on purpose: the two guard different populations with\n       * different remedies, and an erasure that may lawfully strand one tenant is not thereby\n       * licensed to leave the whole application unadministrable. Acknowledging one must never\n       * silently acknowledge the other.\n       */\n      acknowledgeAdministrativeContinuityFloorBreach?: boolean;\n      /**\n       * The CONTROLLER's explicit decision to complete an erasure although rows linked to the\n       * subject live in HTTP_API-bound EXTERNAL systems declaring erasure stance\n       * `CONTROLLER_ACKNOWLEDGED_NON_ERASURE` (ETL D6 stance 6c).\n       *\n       * Off by default and PER REQUEST, never a standing posture: unacknowledged, guard 4 refuses\n       * before anything is written, naming every such resource. Acknowledged, the erasure proceeds\n       * and each resource is recorded twice — a CRITICAL `HTTP_API_NON_ERASURE_ACKNOWLEDGED` audit\n       * event, and an `ACKNOWLEDGED_NON_ERASURE` entry in the report's `externalEffects` (which\n       * `isIncompleteSubjectErasureExternalEffect` deliberately counts as incomplete: the data is\n       * still live at the third party, however deliberate the decision).\n       *\n       * A THIRD acknowledgement, separate from the two floor acknowledgements on purpose — each\n       * guards a different consequence with a different remedy, and acknowledging one must never\n       * silently acknowledge another.\n       */\n      acknowledgeHttpApiNonErasure?: boolean;\n    },\n  ): Promise<SubjectErasureReport> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system UPDATE_MANY — the verb the\n    // subject's scrub write uses.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const subjectIds = typeof id_or_ids === 'string' ? [id_or_ids] : id_or_ids;\n    if (subjectIds.length === 0) {\n      return {\n        subjectResourceType: resourceType,\n        subjectIds: [],\n        edges: [],\n        subjectImpersonalized: false,\n        // No subject means nothing to erase anywhere, including externally — and the effects below\n        // are deliberately never reached, so no provider is called for an empty request.\n        externalEffects: [],\n      };\n    }\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    // ── Guard 2: the last-super-administrator floor ──\n    //\n    // An erasure scrubs the subject's row and retention-hides it, so an erased administrator stops\n    // counting as decisively as a deleted or demoted one — and `appRoles` deliberately survives the\n    // scrub (`.isAuditEvidence()`, no `.impersonalizeWith()`), so a naive role query would keep\n    // counting a principal nobody can authenticate as.\n    //\n    // This runs BEFORE `eraseSubjectInPlace`, so a refusal leaves nothing written.\n    //\n    // The floor is NOT bypassed for this system path even though the ceiling gate exempts internal\n    // writes. An erasure that leaves the application unadministrable is not a completed\n    // data-protection request — it is an availability incident wearing one. The remedy the refusal\n    // names (appoint another administrator, then erase) satisfies both obligations; silently\n    // proceeding satisfies neither.\n    await this.assertSuperAdminFloorForSubjectErasure(\n      resourceType,\n      subjectIds,\n      systemContext,\n      options?.acknowledgeAdministrativeContinuityFloorBreach,\n    );\n\n    // ── Guard 3: the last-organization-owner floor ──\n    //\n    // The per-tenant sibling of Guard 2, and the only one of the two that can refuse on behalf of\n    // several populations at once. It runs SECOND because the application floor is the more\n    // fundamental condition: an application with no administrator cannot repair an ownerless tenant\n    // either, so reporting that first gives the operator the outer problem to solve.\n    //\n    // Also BEFORE `eraseSubjectInPlace`, so a refusal from either guard leaves nothing written.\n    await this.assertOrganizationOwnerFloorForSubjectErasure(\n      resourceType,\n      subjectIds,\n      systemContext,\n      options?.acknowledgeOrganizationOwnerFloorBreach,\n    );\n\n    // ── Guard 4: HTTP_API stance-6c resources demand a per-request acknowledgement ──\n    //\n    // Rows linked to the subject that live in an external system the platform CANNOT erase\n    // (D6 stance 6c) must not be silently skipped by an erasure that then reports itself done.\n    // Refusing HERE — before `eraseSubjectInPlace`, like the two floors — leaves nothing written;\n    // the stance's post-commit effect can only RECORD, never refuse. The refusal is escapable per\n    // request (`acknowledgeHttpApiNonErasure`), never by a standing configuration — the same\n    // defeasibility argument as the floors: GDPR Art. 17(3) does not list \"a third party holds\n    // copies we cannot delete\" as a ground for the FRAMEWORK to refuse indefinitely, so the\n    // controller decides, and the record is the control.\n    this.assertHttpApiNonErasureAcknowledged(\n      resourceType,\n      options?.acknowledgeHttpApiNonErasure,\n      systemContext,\n    );\n\n    const report = await this.getServicesRegistryHandler()\n      .getService(resourceType)\n      .eraseSubjectInPlace(resourceType, subjectIds, systemContext, options);\n\n    // ── External, non-transactional effects — POST-COMMIT by construction ──\n    //\n    // `eraseSubjectInPlace` has returned, so its transaction is closed and the local scrub is\n    // durable. Only now may we call out to systems we do not own (a billing provider anonymizing\n    // its customer, say). Running them inside the transaction would be wrong twice over: it would\n    // hold a database transaction open across third-party network latency, and a later rollback\n    // could not undo a provider-side erasure that had already applied.\n    //\n    // The consequence is deliberate and asymmetric: a failure here does NOT fail the erasure. The\n    // local rows are correctly scrubbed either way, and throwing would invite the caller to retry\n    // an erasure whose local half already succeeded. The incomplete state travels in the report\n    // instead — which is why `SubjectErasureReport.externalEffects` exists rather than a boolean.\n    // No registry bound → no effect ever declared itself for this subject, so an empty list is the\n    // truthful answer (NOT `NOT_REGISTERED`, which means a KNOWN effect had no handler).\n    report.externalEffects = this.subjectErasureExternalEffects\n      ? await this.subjectErasureExternalEffects.runAll({\n        subjectResourceType: resourceType,\n        subjectIds,\n        scopeContext: options?.scopeContext,\n      })\n      : [];\n\n    /**\n     * Tolerate a port that answers with nothing — because the LOCAL ERASURE IS ALREADY COMMITTED.\n     *\n     * `runAll` is typed to resolve an array, but this is an injected port: an implementation that\n     * returns `undefined` (or a stub standing in for one) satisfies the binding and violates the\n     * contract. Dereferencing it threw `Cannot read properties of undefined (reading 'filter')` AFTER\n     * the transaction committed — so a completed, correct erasure surfaced to its caller as a failure,\n     * inviting a retry of work already done. Turning a successful data-protection request into an\n     * apparent failure is the worse outcome, so the malformed answer is coerced and reported LOUDLY\n     * rather than thrown: nothing here can undo the erasure, and an operator still has to learn that\n     * external effects were not actually measured.\n     */\n    if (!Array.isArray(report.externalEffects)) {\n      this.logger?.error(\n        'Subject-erasure external-effects port returned a non-array; treating it as NO effects measured. '\n        + 'The LOCAL erasure is committed and correct, but whether personal data is still live at a third '\n        + 'party is now UNKNOWN rather than reported.',\n        { subjectResourceType: resourceType, subjectCount: subjectIds.length, received: typeof report.externalEffects },\n      );\n      report.externalEffects = [];\n    }\n\n    const incompleteEffects = selectIncompleteExternalEffects(report.externalEffects);\n    if (incompleteEffects.length > 0) {\n      // ERROR, not warn: personal data is potentially still live at a third party after a\n      // completed data-protection request. That is an operator obligation, not a footnote — and the\n      // report is returned to a caller who may only persist it, so the log has to stand alone.\n      this.logger?.error('Subject erasure completed LOCALLY but external effects are incomplete', {\n        subjectResourceType: resourceType,\n        subjectCount: subjectIds.length,\n        incompleteEffects: incompleteEffects.map((effect) => ({\n          effectRef: effect.effectRef,\n          status: effect.status,\n          detail: effect.detail,\n          failedSteps: (effect.steps ?? [])\n            .filter((step) => !step.succeeded)\n            .map((step) => ({ step: step.step, targetRef: step.targetRef, error: step.error })),\n        })),\n      });\n    }\n\n    // Best-effort privileged-write audit of the erasure itself (never blocks or fails it) — mirrors\n    // the other trusted writes. The dependent teardowns audit themselves through the writers they\n    // run on; the per-edge dispositions are additionally carried by the returned report and the\n    // structured completion log.\n    this.auditLogsService?.logSystemContextWrite({\n      resourceType: resourceType as string,\n      operation: CoreResourceOperation.UPDATE_MANY,\n      organizationId: options?.scopeContext?.organizationId,\n      scopeContext: options?.scopeContext,\n      performedByRuntime: this.describeRuntimeForAudit(),\n    }).catch(() => { /* audit is best-effort */ });\n\n    return report;\n  }\n  /** @wildo_source:part:end saas.backend.system-access-service */\n}\n\n"]}
+{"version":3,"file":"system-access.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/system-access.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAEL,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,SAAS,EACT,wBAAwB,EAExB,kCAAkC,EAClC,uCAAuC,EACvC,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAW7C;;;;GAIG;AACH,MAAM,6BAA6B,GAG/B;IACF,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;IACzE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;IACzE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,EAAE,YAAY,EAAE;CAC7F,CAAC;AAEF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,yBAAyB,EAAE,qCAAqC,EAAE,MAAM,yEAAyE,CAAC;AAC3J,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,mDAAmD,EACnD,+BAA+B,GAChC,MAAM,iGAAiG,CAAC;AACzG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,mBAAmB,EAA+B,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAOtI,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AAIrH,OAAO,EAEL,sCAAsC,EACtC,wCAAwC,EACxC,8BAA8B,EAC9B,gCAAgC,GAEjC,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,6CAA6C,EAC7C,+CAA+C,EAC/C,uCAAuC,GACxC,MAAM,mFAAmF,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAE8B;IACI;IACc;IAG5B;IAKmB;IAKV;IAE/C;IAlBnB,YACmE,YAAwC,EACpC,iBAAkD,EACpC,uBAA8D,EAG1F,SAAoB,EAKD,gBAA0C,EAKpD,MAAsB,EAErE,6BAAmF;QAjBnC,iBAAY,GAAZ,YAAY,CAA4B;QACpC,sBAAiB,GAAjB,iBAAiB,CAAiC;QACpC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAG1F,cAAS,GAAT,SAAS,CAAW;QAKD,qBAAgB,GAAhB,gBAAgB,CAA0B;QAKpD,WAAM,GAAN,MAAM,CAAgB;QAErE,kCAA6B,GAA7B,6BAA6B,CAAsD;IACnG,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,uBAAuB,CACnC,OAAyE;QAEzE,MAAM,EAAE,+BAA+B,EAAE,GAAG,qCAAqC,CAC/E,IAAI,CAAC,qBAAqB,EAAE,CAC7B,CAAC;QAEF,IAAI,CAAC,+BAA+B,EAAE,CAAC;YACrC,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QAED,mFAAmF;QACnF,mEAAmE;QACnE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;QACzG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,6BAA6B,CACtC,OAAO,CAAC,YAAY,EACpB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kGAAkG;IAC1F,qBAAqB;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS;iBAClB,GAAG,CAAiC,kBAAkB,CAAC,uBAAuB,CAAC;iBAC/E,QAAQ,EAAE,CAAC,cAAc,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,qFAAqF;YACrF,oFAAoF;YACpF,iEAAiE;YACjE,OAAO,yBAAyB,CAAC,mBAAmB,CAAC;QACvD,CAAC;IACH,CAAC;IAEO,6BAA6B,CAAC,YAAoB,EAAE,KAAa;QACvE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACtE,OAAO,EAAE;gBACP,MAAM,EAAE,uCAAuC;gBAC/C,OAAO,EACL,gCAAgC,YAAY,kDAAkD,KAAK,IAAI;sBACrG,iHAAiH;gBACrH,YAAY;aACb;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,KAAK,CAAC,2BAA2B,CACvC,OAAwE;QAExE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,YAAY,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,4BAA4B,CAAC,YAAoB,EAAE,KAAa;QACtE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACtE,OAAO,EAAE;gBACP,MAAM,EAAE,qCAAqC;gBAC7C,OAAO,EACL,mCAAmC,YAAY,wDAAwD;sBACrG,YAAY,KAAK,uFAAuF;sBACxG,0EAA0E;gBAC9E,YAAY;aACb;SACF,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACvB,kBAAkB,CAAC,8BAA8B,CAClD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS;iBAClB,GAAG,CAAiC,kBAAkB,CAAC,uBAAuB,CAAC;iBAC/E,gBAAgB,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,sCAAsC,CAClD,YAA0B,EAC1B,UAAoB,EACpB,aAAoC,EACpC,sBAAgC;QAEhC,IAAI,CAAC,wCAAwC,CAAC,YAAY,CAAC;YAAE,OAAO;QAEpE,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAC7C,kBAAkB,CAAC,kCAAkC,CACtD,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;YACpD,UAAU;YACV,gBAAgB,EAAE,aAAa;YAC/B,oBAAoB;YACpB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,sBAAsB;SAC5C,CAAC,CAAC;QAEH,MAAM,sCAAsC,CAAC;YAC3C,QAAQ;YACR,gBAAgB,EAAE,aAAa;YAC/B,oBAAoB;YACpB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,eAAe,EAAE,gCAAgC,CAC/C,IAAI,CAAC,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,qBAAqB,CAAC,CAC3F;YACD,mBAAmB,EAAE,sBAAsB;YAC3C,sBAAsB,EAAE,sBAAsB,KAAK,IAAI;YACvD,4FAA4F;YAC5F,0FAA0F;YAC1F,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yFAAyF;sBACvF,oFAAoF;sBACpF,yFAAyF;sBACzF,0DAA0D,EAC5D;oBACE,mBAAmB,EAAE,YAAY;oBACjC,2BAA2B,EAAE,MAAM,CAAC,yBAAyB;oBAC7D,eAAe,EAAE,MAAM,CAAC,eAAe;iBACxC,CACF,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,6CAA6C,CACzD,YAA0B,EAC1B,UAAoB,EACpB,aAAoC,EACpC,2BAAqC;QAErC,IAAI,CAAC,+CAA+C,CAAC,YAAY,CAAC;YAAE,OAAO;QAE3E,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAC7C,kBAAkB,CAAC,kCAAkC,CACtD,CAAC;QAEF,MAAM,6CAA6C,CAAC;YAClD,cAAc,EAAE,UAAU;YAC1B,gBAAgB,EAAE,aAAa;YAC/B,oBAAoB;YACpB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,eAAe,EAAE,uCAAuC,CACtD,IAAI,CAAC,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,qBAAqB,CAAC,CAC3F;YACD,mBAAmB,EAAE,sBAAsB;YAC3C,2BAA2B,EAAE,2BAA2B,KAAK,IAAI;YACjE,2FAA2F;YAC3F,2FAA2F;YAC3F,4FAA4F;YAC5F,uEAAuE;YACvE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sFAAsF;sBACpF,yFAAyF;sBACzF,4CAA4C,EAC9C;oBACE,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,yBAAyB,EAAE,MAAM,CAAC,gBAAgB;oBAClD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,mBAAmB,EAAE,YAAY;oBACjC,UAAU;iBACX,CACF,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,+BAA+B,CACrC,YAA0B,EAC1B,SAA0G,EAC1G,OAEC;QAED;;;;;;;WAOG;QACH,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YACrC,MAAM,IAAI,CAAC,gBAAiB,CAAC,qBAAqB,CAAC;gBACjD,YAAY,EAAE,YAAsB;gBACpC,SAAS;gBACT,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;gBACrD,YAAY,EAAE,OAAO,EAAE,YAAY;gBACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;aACnD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC;QACF,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACxC,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC;YACvC,mCAAmC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE;oBACH,4BAA4B;oBAC5B,MAAM,CAAC,YAAY,CAAC;oBACpB,MAAM,CAAC,SAAS,CAAC;oBACjB,WAAW,CAAC,EAAE;oBACd,iBAAiB;iBAClB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACK,0BAA0B,CAAC,YAAmF;QACpH,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtC,IAAI,YAAY,EAAE,cAAc,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,YAAY,EAAE,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAC7B,YAAmF;QAEnF,OAAO,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,yBAAyB,CAC/B,YAA0B,EAC1B,SAKqC;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC7E,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,IAAI,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,qCAAqC;oBAC7C,YAAY;oBACZ,mBAAmB,EAAE,SAAS;oBAC9B,OAAO,EACL,GAAG,SAAS,mCAAmC,MAAM,CAAC,YAAY,CAAC,SAAS;wBAC5E,sBAAsB,IAAI,yCAAyC;wBACnE,sBAAsB,IAAI,sDAAsD;wBAChF,0DAA0D,IAAI,oBAAoB;wBAClF,qFAAqF;iBACxF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,yBAAyB,CAC/B,YAA0B,EAC1B,IAAa,EACb,IAAqG;QAErG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC7E,OAAO,uCAAuC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,KAAK,CAAC,YAAY,CACvB,YAA0B,EAC1B,mBAAwC,EACxC,OAUC;QAED,4EAA4E;QAC5E,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,aAAa,GAAkD,OAAO,EAAE,UAAU;YACtF,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC9G,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAI,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC1H,6EAA6E;QAC7E,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,uBAAuB,CAAC;gBACjC,YAAY,EAAE,YAAsB;gBACpC,SAAS,EAAE,qBAAqB,CAAC,IAAI;gBACrC,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;gBACrD,YAAY,EAAE,OAAO,EAAE,YAAY;gBACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,YAAY,CACvB,YAA0B,EAC1B,MAAyB,EACzB,UAAiD,EACjD,OAIC;QAED,4EAA4E;QAC5E,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,aAAa,GAAkD,OAAO,EAAE,UAAU;YACtF,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC9G,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAI,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACzH,iFAAiF;QACjF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;YAChF,MAAM,IAAI,CAAC,uBAAuB,CAAC;gBACjC,YAAY,EAAE,YAAsB;gBACpC,SAAS,EAAE,qBAAqB,CAAC,IAAI;gBACrC,WAAW;gBACX,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;gBACrD,YAAY,EAAE,OAAO,EAAE,YAAY;gBACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kGAAkG;IAClG,sGAAsG;IACtG,sGAAsG;IACtG,sGAAsG;IACtG,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAElG;;;;OAIG;IACK,wBAAwB,CAAC,YAA0B;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,kBAAkB,EAAE,WAAW,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAChF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,mCAAmC;oBAC3C,YAAY;oBACZ,OAAO,EACL,4EAA4E;wBAC5E,IAAI,MAAM,CAAC,YAAY,CAAC,sEAAsE;wBAC9F,kFAAkF;iBACrF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAAC,kBAA4B;QACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,qBAAqB,CAAC,CAAC;QAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,2BAA2B;oBACnC,OAAO,EACL,0DAA0D;wBAC1D,IAAI,cAAc,CAAC,qBAAqB,2CAA2C;iBACtF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,2BAA2B,CAAC,eAAuB,EAAE,MAAc;QACzE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,OAAO,EAAE;oBACP,MAAM,EAAE,kCAAkC;oBAC1C,OAAO,EACL,+EAA+E;wBAC/E,uFAAuF;iBAC1F;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,oBAAoB,CAC/B,YAA0B,EAC1B,mBAAwC,EACxC,IAA+E,EAC/E,OAEC;QAED,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpE,MAAM,aAAa,GAAkD,OAAO,EAAE,UAAU;YACtF,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC9G,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QACH,qGAAqG;QACrG,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAI,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAE1H,6FAA6F;QAC7F,MAAM,IAAI,CAAC,2BAA2B,CAAC;YACrC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,KAAK,EAAE,IAAI,CAAC,kBAAkB;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,YAAsB;YACpC,mBAAmB,EAAE,sBAAsB;YAC3C,mBAAmB,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;SACtD,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAC/B,YAA0B,EAC1B,IAA+E,EAC/E,MAAyB,EACzB,UAAiD,EACjD,OAEC;QAED,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpE,MAAM,aAAa,GAAkD,OAAO,EAAE,UAAU;YACtF,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC9G,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QACH,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAI,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACzH,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QAExF,MAAM,IAAI,CAAC,2BAA2B,CAAC;YACrC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,KAAK,EAAE,IAAI,CAAC,kBAAkB;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,YAAsB;YACpC,mBAAmB,EAAE,sBAAsB;YAC3C,mBAAmB;YACnB,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;SACtD,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,KAAK,CAAC,cAAc,CACzB,YAA0B,EAC1B,IAA6B,EAC7B,OAEC;QAED,8EAA8E;QAC9E,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAE3E,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,4BAA4B,GAAG;YACnC,GAAG,CAAC,OAAO,EAAE,4BAA4B,IAAI,EAAE,CAAC;YAChD,GAAG,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC;SACpF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAC3D,YAAY,EACZ,aAAa,EACb,IAAI,EACJ,EAAE,GAAG,OAAO,EAAE,4BAA4B,EAAE,CAC7C,CAAC;QACF,iFAAiF;QACjF,IAAI,CAAC,+BAA+B,CAClC,YAAY,EACZ,qBAAqB,CAAC,MAAM,EAC5B,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc,CACzB,YAA0B,EAC1B,mBAAwC,EACxC,IAA6B,EAC7B,OAEC;QAED,8EAA8E;QAC9E,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAE3E,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAEpG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,4BAA4B,GAAG;YACnC,GAAG,CAAC,OAAO,EAAE,4BAA4B,IAAI,EAAE,CAAC;YAChD,GAAG,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC;SACpF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAC3D,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,IAAI,EACJ,EAAE,GAAG,OAAO,EAAE,4BAA4B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,+BAA+B,CAClC,YAAY,EACZ,qBAAqB,CAAC,MAAM,EAC5B,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,kBAAkB,CAC7B,YAA0B,EAC1B,mBAAwC,EACxC,IAA6B,EAC7B,OAEC;QAED,mFAAmF;QACnF,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEhF,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEzG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,4BAA4B,GAAG;YACnC,GAAG,CAAC,OAAO,EAAE,4BAA4B,IAAI,EAAE,CAAC;YAChD,GAAG,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,IAAI,EAAE,qBAAqB,CAAC,WAAW,CAAC;SACzF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,UAAU,CAC/D,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,IAAI,EACJ,EAAE,GAAG,OAAO,EAAE,4BAA4B,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,+BAA+B,CAClC,YAAY,EACZ,qBAAqB,CAAC,WAAW,EACjC,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACI,KAAK,CAAC,4BAA4B,CACvC,YAA0B,EAC1B,SAA4B,EAC5B,OAEC;QAED,iGAAiG;QACjG,oBAAoB;QACpB,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEhF,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEzG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,0BAA0B,EAAE;aACpC,UAAU,CAAC,YAAY,CAAC;aACxB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAE1E,6FAA6F;QAC7F,kGAAkG;QAClG,mCAAmC;QACnC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;YAC3C,YAAY,EAAE,YAAsB;YACpC,SAAS,EAAE,qBAAqB,CAAC,WAAW;YAC5C,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;YACrD,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;SACnD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACI,KAAK,CAAC,qBAAqB,CAChC,YAA0B,EAC1B,SAA4B,EAC5B,OAA6B,EAC7B,OAEC;QAED,6FAA6F;QAC7F,0FAA0F;QAC1F,kDAAkD;QAClD,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,UAAU,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE;oBACN,OAAO;oBACP,mBAAmB,EAAE,YAAY;oBACjC,UAAU,EAAE,EAAE;oBACd,KAAK,EAAE,EAAE;oBACT,uBAAuB,EAAE,EAAE;oBAC3B,8BAA8B,EAAE,EAAE;oBAClC,gBAAgB,EAAE,CAAC;iBACpB;gBACD,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAElG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE;aACnD,UAAU,CAAC,YAAY,CAAC;aACxB,oBAAoB,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAEnF,wBAAwB;QACxB,EAAE;QACF,+FAA+F;QAC/F,+FAA+F;QAC/F,0FAA0F;QAC1F,wFAAwF;QACxF,6FAA6F;QAC7F,0DAA0D;QAC1D,EAAE;QACF,2FAA2F;QAC3F,8FAA8F;QAC9F,sFAAsF;QACtF,uCAAuC;QACvC,MAAM,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;YAChD,OAAO;YACP,mBAAmB,EAAE,YAAsB;YAC3C,UAAU;YACV,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;iBACvC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;iBAChC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAClD,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB;YAChD,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB;YAC9D,8BAA8B,EAAE,MAAM,CAAC,MAAM,CAAC,8BAA8B;YAC5E,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;SACtD,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,mCAAmC,CACzC,mBAAiC,EACjC,YAAiC,EACjC,gBAAuC;QAEvC,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,mBAAmB,CAE/F,CAAC;QACF,MAAM,kBAAkB,GAAG,oBAAoB,EAAE,qBAAqB;YACpE,CAAC,CAAC,8BAA8B,CAAC,oBAAoB,CAAC,qBAAqB,CAAC;YAC5E,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,QAAQ,GAAkF,EAAE,CAAC;QACnG,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;QACjD,KAAK,MAAM,YAAY,IAAI,kBAAkB,EAAE,CAAC;YAC9C,IAAK,YAAyC,CAAC,UAAU,KAAK,IAAI;gBAAE,SAAS;YAC7E,MAAM,iBAAiB,GAAG,MAAM,CAAE,YAA4C,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAAE,SAAS;YAClF,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAE9C,IAAI,kBAA8H,CAAC;YACnI,IAAI,CAAC;gBACH,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,iBAAiC,CAAC,CAAC;YAC1G,CAAC;YAAC,MAAM,CAAC;gBACP,yFAAyF;gBACzF,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,kBAAkB,EAAE,cAAc,CAAC;YACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,KAAK,oBAAoB,CAAC,mCAAmC;gBAAE,SAAS;YAC/G,QAAQ,CAAC,IAAI,CAAC;gBACZ,YAAY,EAAE,iBAAiB;gBAC/B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,eAAe,EAAE,OAAO,CAAC,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO;QAE3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACvE,OAAO,EAAE;gBACP,MAAM,EAAE,qCAAqC;gBAC7C,OAAO,EACL,uBAAuB,mBAAmB,iBAAiB,QAAQ,CAAC,MAAM,qCAAqC;sBAC7G,kHAAkH;sBAClH,uFAAuF;sBACvF,oHAAoH;sBACpH,4FAA4F;gBAChG,mBAAmB;gBACnB,SAAS,EAAE,QAAQ;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,YAA0B,EAC1B,SAA4B,EAC5B,OAwCC;QAED,iGAAiG;QACjG,8BAA8B;QAC9B,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEhF,MAAM,UAAU,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,mBAAmB,EAAE,YAAY;gBACjC,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,EAAE;gBACT,qBAAqB,EAAE,KAAK;gBAC5B,2FAA2F;gBAC3F,iFAAiF;gBACjF,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GACjB,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEzG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAClF,SAAS,EAAE,aAAa;YACxB,+BAA+B,EAAE,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;YACvF,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;YACjE,cAAc,EAAE;gBACd;oBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;iBACtD;aACF;SACF,CAAC,CAAC;QAEH,oDAAoD;QACpD,EAAE;QACF,+FAA+F;QAC/F,gGAAgG;QAChG,4FAA4F;QAC5F,mDAAmD;QACnD,EAAE;QACF,+EAA+E;QAC/E,EAAE;QACF,+FAA+F;QAC/F,oFAAoF;QACpF,+FAA+F;QAC/F,yFAAyF;QACzF,gCAAgC;QAChC,MAAM,IAAI,CAAC,sCAAsC,CAC/C,YAAY,EACZ,UAAU,EACV,aAAa,EACb,OAAO,EAAE,8CAA8C,CACxD,CAAC;QAEF,mDAAmD;QACnD,EAAE;QACF,8FAA8F;QAC9F,wFAAwF;QACxF,gGAAgG;QAChG,iFAAiF;QACjF,EAAE;QACF,4FAA4F;QAC5F,MAAM,IAAI,CAAC,6CAA6C,CACtD,YAAY,EACZ,UAAU,EACV,aAAa,EACb,OAAO,EAAE,uCAAuC,CACjD,CAAC;QAEF,mFAAmF;QACnF,EAAE;QACF,uFAAuF;QACvF,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,qDAAqD;QACrD,IAAI,CAAC,mCAAmC,CACtC,YAAY,EACZ,OAAO,EAAE,4BAA4B,EACrC,aAAa,CACd,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE;aACnD,UAAU,CAAC,YAAY,CAAC;aACxB,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAEzE,0EAA0E;QAC1E,EAAE;QACF,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,mEAAmE;QACnE,EAAE;QACF,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,qFAAqF;QACrF,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,6BAA6B;YACzD,CAAC,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC;gBAChD,mBAAmB,EAAE,YAAY;gBACjC,UAAU;gBACV,YAAY,EAAE,OAAO,EAAE,YAAY;aACpC,CAAC;YACF,CAAC,CAAC,EAAE,CAAC;QAEP;;;;;;;;;;;WAWG;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,KAAK,CAChB,kGAAkG;kBAChG,iGAAiG;kBACjG,4CAA4C,EAC9C,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,MAAM,CAAC,eAAe,EAAE,CAChH,CAAC;YACF,MAAM,CAAC,eAAe,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,iBAAiB,GAAG,+BAA+B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAClF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,oFAAoF;YACpF,8FAA8F;YAC9F,yFAAyF;YACzF,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,uEAAuE,EAAE;gBAC1F,mBAAmB,EAAE,YAAY;gBACjC,YAAY,EAAE,UAAU,CAAC,MAAM;gBAC/B,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;oBACpD,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;yBAC9B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;yBACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;iBACtF,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QAED,gGAAgG;QAChG,8FAA8F;QAC9F,4FAA4F;QAC5F,6BAA6B;QAC7B,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;YAC3C,YAAY,EAAE,YAAsB;YACpC,SAAS,EAAE,qBAAqB,CAAC,WAAW;YAC5C,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc;YACrD,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,EAAE;SACnD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8B,CAAC,CAAC,CAAC;QAE/C,OAAO,MAAM,CAAC;IAChB,CAAC;CAEF,CAAA;AA98CY,0BAA0B;IADtC,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAGhE,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAKpC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAKvD,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAC7C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAhBG,0BAA0B;QACjB,+BAA+B;QACX,qCAAqC;QAG/E,SAAS,YAUF,aAAa;QAErC,mDAAmD;GAnB3F,0BAA0B,CA88CtC","sourcesContent":["import 'reflect-metadata';\nimport { randomUUID } from 'node:crypto';\nimport { Container, inject, injectable, optional } from 'inversify';\nimport {\n  ResourceType,\n  CoreResourceOperation,\n  CoreResourceType,\n  CORE_APP_ROLES,\n  ResourcePrimaryScope,\n  ErrorType,\n  ResourceSystemAccessMode,\n  ResourceDataSubjectKind,\n  coreResourceShared_FieldIdentifier,\n  deriveTrustedSystemWritePreservedFields,\n  getChildDirectionRelationships,\n} from '@wildo-ai/saas-models';\nimport {\n  HttpApiErasureStance,\n} from '@wildo-ai/saas-models/external-data';\nimport type {\n  ResourceConfiguration_OperationPath,\n  ResourceSystemAccessPolicy,\n  Resources_PaginationRequest,\n  Resources_PaginatedResult,\n  SubjectErasureReport,\n  SubjectExportBundle,\n  SubjectExportPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Maps each system-context verb to its public primitive name (for error copy)\n * and the {@link ResourceSystemAccessPolicy} key that gates it. The single place\n * the two write verbs and the two read verbs share their gating vocabulary.\n */\nconst SYSTEM_ACCESS_PRIMITIVE_BY_OP: Record<\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY,\n  { primitive: string; verb: keyof ResourceSystemAccessPolicy }\n> = {\n  [CoreResourceOperation.READ]: { primitive: 'readAsSystem', verb: 'read' },\n  [CoreResourceOperation.LIST]: { primitive: 'listAsSystem', verb: 'list' },\n  [CoreResourceOperation.CREATE]: { primitive: 'createAsSystem', verb: 'create' },\n  [CoreResourceOperation.UPDATE]: { primitive: 'updateAsSystem', verb: 'update' },\n  [CoreResourceOperation.UPDATE_MANY]: { primitive: 'updateManyAsSystem', verb: 'updateMany' },\n};\nimport type { FilterQuery } from 'mongoose';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { RuntimePrincipalBackendService } from '~wildo-backend-lib/config/bootstrap/runtime-principal.backend.service';\nimport { ApplicationRuntimeProfile, resolveApplicationRuntimeAccessPolicy } from '~wildo-backend-lib/config/bootstrap/application-runtime-profile.backend';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n  SubjectErasureExternalEffectsRegistryBackendService,\n  selectIncompleteExternalEffects,\n} from '~wildo-backend-lib/compliance/privacy/services/subject-erasure-external-effects.backend.service';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { ServiceOptions, IdOrIdsOrFilterType } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\n// Type-only: the runtime dependency is resolved via the DI symbol\n// (`SAAS_SERVICE_TYPES.AuditLogsService`), so this never creates a static ESM\n// import edge into the audit subsystem.\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport {\n  assertSuperAdminFloorPreservedForRemoval,\n  assertSuperAdminFloorForSubjectErasure,\n  isSuperAdminFloorGovernedSubjectResource,\n  readSubjectsForSuperAdminFloor,\n  resolveSuperAdminConferringRoles,\n  SuperAdminFloorReductionCause,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n  assertOrganizationOwnerFloorForSubjectErasure,\n  isOrganizationOwnerFloorGovernedSubjectResource,\n  resolveOrganizationOwnerConferringRoles,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\n\n/**\n * The single, deliberately-injected home for **request-triggered** ACL bypass —\n * the system-context read primitives (`readAsSystem` / `listAsSystem`) and the\n * trusted-write primitives (`createAsSystem` / `updateAsSystem` /\n * `updateManyAsSystem`).\n *\n * SCOPE OF THE DOCTRINE (read this before assuming \"all system access lives\n * here\"). There are two distinct reasons in-process code holds a system context,\n * and only ONE is required to route through this service:\n *   - **Request-triggered ACL bypass** — an HTTP request arrives as an anonymous\n *     / low-privilege caller and code must reach a resource that context cannot\n *     (e.g. an anonymous lead-capture CREATE doing a users-by-email lookup). This\n *     MUST go through these primitives, so the bypass is fail-closed + audited.\n *     Custom implementations reach them via `utils.systemAccessService`.\n *   - **Context-free system actors** — batch jobs, cron, queue workers, and\n *     bootstrap have NO initiating request and no user to authorize against; they\n *     legitimately synthesise an `INTERNALLY_INITIATED_REQUEST` super-admin EC via\n *     {@link ExecutionContextCreatorBackendService} directly. They are NOT required\n *     to route through this service (there is nothing to \"bypass\").\n *\n * **Guard 3** of the system-access-guards workstream. These primitives used to\n * live on the universally-injected {@link ServicesRegistryHandlerBackendService},\n * so any service holding the handler could bypass the caller's scope + role ACL.\n * Moving them here means a caller must DELIBERATELY resolve this named service —\n * the handler no longer exposes the capability at all, so a request-triggered\n * bypass cannot be reached by accident and every call site is greppable by the\n * service name.\n *\n * The capability itself is unchanged from Phase 1: **Guard 1** (fail-closed\n * `systemAccessPolicy` opt-in, enforced by {@link assertSystemAccessAllowed}) and\n * **Guard 4** (best-effort `SYSTEM_CONTEXT_READ` / `SYSTEM_CONTEXT_WRITE` audit)\n * travel with the primitives.\n *\n * The actual data access is delegated to the handler's normal `read` / `list`\n * (with the synthesised system execution context); the handler is resolved LAZILY\n * via the container because it is the large singleton graph this service\n * participates in, and a direct constructor injection would re-enter it during\n * backend startup (mirrors the late-resolve pattern in `WebhookConfigBackendService`\n * and `AuthOrganizationConfigurationService`).\n */\n@injectable()\nexport class SystemAccessBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n    // Late-resolved (see class doc): only the big handler graph is lazy; the leaf\n    // deps above are injected directly (this service is itself constructed lazily).\n    @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n    // Optional so minimal test containers that don't bind the audit subsystem still construct.\n    // Emission is best-effort for the ordinary paths only: an ACCOUNTABLE runtime's privileged read\n    // (`emitPrivilegedReadAudit`) and every see-through reveal (`emitRetainedDataRevealAudit`) treat an\n    // unbound subsystem as an inability to record and refuse, so absence is not an exemption there.\n    @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional() private readonly auditLogsService?: AuditLogsBackendService,\n    // Appended LAST and @optional() on purpose — this class is constructed positionally in a number\n    // of focused tests, so inserting a required param anywhere earlier would silently shift every\n    // existing argument. Optional also keeps minimal containers constructible: a deployment that\n    // registers no external erasure effect simply has none to run.\n    @inject(SAAS_SERVICE_TYPES.Logger) @optional() private readonly logger?: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.SubjectErasureExternalEffectsService) @optional()\n    private readonly subjectErasureExternalEffects?: SubjectErasureExternalEffectsRegistryBackendService,\n  ) {}\n\n  /**\n   * Emit the privileged-READ audit under the posture the current runtime requires.\n   *\n   * Two postures, one call site each for READ and LIST:\n   *\n   * - **Best-effort** (application backend): fire-and-forget, exactly as before. The\n   *   framework's most common internal read path must not depend on audit availability;\n   *   blocking it would turn an audit hiccup into an application-wide outage.\n   * - **Accountable / fail-closed** (minion — D9 + OQ-5(b)): the audit must be written\n   *   BEFORE the data is handed back. If it cannot be, the caller gets an error instead\n   *   of the data. The system-access door legitimately bypasses per-tenant authorization;\n   *   what makes that acceptable for a non-human background worker is that every passage\n   *   leaves evidence, so an unrecordable passage must not happen.\n   *\n   * Throwing here withholds data the DB already returned. That is the meaningful boundary\n   * for a read: the minion never OBTAINS cross-tenant data whose access went unrecorded.\n   *\n   * assurance-control: WILDO.AUDIT.SECURITY_EVENT — non-human privileged access is audited or refused.\n   */\n  private async emitPrivilegedReadAudit(\n    payload: Parameters<AuditLogsBackendService['logSystemContextAccess']>[0],\n  ): Promise<void> {\n    const { requiresAccountableSystemAccess } = resolveApplicationRuntimeAccessPolicy(\n      this.resolveRuntimeProfile(),\n    );\n\n    if (!requiresAccountableSystemAccess) {\n      this.auditLogsService?.logSystemContextAccess(payload).catch(() => { /* audit is best-effort */ });\n      return;\n    }\n\n    // Fail-closed: an unbound audit subsystem is itself an inability to record, not an\n    // exemption from recording. Treated identically to a failed write.\n    if (!this.auditLogsService) {\n      throw this.buildUnaccountableAccessError(payload.resourceType, 'the audit subsystem is not available');\n    }\n\n    try {\n      await this.auditLogsService.logSystemContextAccess(payload);\n    } catch (error) {\n      throw this.buildUnaccountableAccessError(\n        payload.resourceType,\n        error instanceof Error ? error.message : String(error),\n      );\n    }\n  }\n\n  /** The runtime profile of this process, defaulting fail-safe if the principal is unresolvable. */\n  private resolveRuntimeProfile(): ApplicationRuntimeProfile {\n    try {\n      return this.container\n        .get<RuntimePrincipalBackendService>(SAAS_SERVICE_TYPES.RuntimePrincipalService)\n        .describe().runtimeProfile;\n    } catch {\n      // An unresolvable principal cannot be a MINION (minion startup binds and initializes\n      // it). Defaulting to APPLICATION_BACKEND therefore preserves existing behaviour for\n      // minimal/test containers rather than failing every read closed.\n      return ApplicationRuntimeProfile.APPLICATION_BACKEND;\n    }\n  }\n\n  private buildUnaccountableAccessError(resourceType: string, cause: string): unknown {\n    return this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n      context: {\n        reason: 'system_context_access_not_accountable',\n        message:\n          `Privileged system access to '${resourceType}' was refused because it could not be audited: ${cause}. `\n          + 'This runtime requires accountable system access — a privileged bypass that cannot be recorded is not performed.',\n        resourceType,\n      },\n    });\n  }\n\n  /**\n   * Emit the see-through REVEAL audit. Always fail-closed, on every runtime.\n   *\n   * This is deliberately NOT {@link emitPrivilegedReadAudit}'s two-posture rule, and the difference\n   * is the act rather than the process. That method asks WHICH RUNTIME is reading, because its\n   * subject is the framework's most common internal read path and blocking it on audit availability\n   * would turn an audit hiccup into an application-wide outage. A see-through read is the opposite\n   * kind of event: rare, human-initiated, and already refused unless the caller clears three\n   * fail-closed gates — the `seeRetained` policy verb, a privileged role, and a real `accessingUserId`\n   * plus `reason`. Those three answer WHO may reveal scrubbed personal data. The reason it is\n   * permitted at all is that the reveal leaves evidence, and that fourth gate was the only one of the\n   * four that a failure could silently skip.\n   *\n   * So the trade runs the other way here: refusing costs one operator one retry, while proceeding\n   * costs a reveal of retained PII that no record can attest to. An unbound audit subsystem is\n   * treated identically to a failed write — an inability to record is not an exemption from\n   * recording, the same reading {@link emitPrivilegedReadAudit} takes.\n   *\n   * Called AFTER the read, so throwing withholds rows the database already returned. That is the\n   * meaningful boundary: the caller never OBTAINS retained data whose reveal went unrecorded.\n   *\n   * assurance-control: WILDO.PRIVACY.RETAINED_DATA_REVEAL — a see-through reveal is recorded or refused.\n   */\n  private async emitRetainedDataRevealAudit(\n    payload: Parameters<AuditLogsBackendService['logRetainedDataAccess']>[0],\n  ): Promise<void> {\n    if (!this.auditLogsService) {\n      throw this.buildUnrecordableRevealError(payload.resourceType, 'the audit subsystem is not available');\n    }\n\n    try {\n      await this.auditLogsService.logRetainedDataAccess(payload);\n    } catch (error) {\n      throw this.buildUnrecordableRevealError(payload.resourceType, describeCaughtError(error));\n    }\n  }\n\n  /**\n   * Distinct from {@link buildUnaccountableAccessError} on purpose: both refuse an unrecordable\n   * privileged access, but the remedies differ and a client branching on `reason` has to be able to\n   * tell them apart. That one means \"this runtime requires accountability and the audit is down\";\n   * this one means \"a reveal of retained personal data was not recorded, so it did not happen\".\n   */\n  private buildUnrecordableRevealError(resourceType: string, cause: string): unknown {\n    return this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n      context: {\n        reason: 'retained_data_reveal_not_recordable',\n        message:\n          `A see-through read of retained '${resourceType}' records was refused because the reveal could not be `\n          + `audited: ${cause}. A reveal of impersonalized-and-retained personal data is permitted only because it `\n          + 'leaves an attributed record, so an unrecordable reveal is not performed.',\n        resourceType,\n      },\n    });\n  }\n\n  private getServicesRegistryHandler(): ServicesRegistryHandlerBackendService {\n    return this.container.get<ServicesRegistryHandlerBackendService>(\n      SAAS_SERVICE_TYPES.ServicesRegistryHandlerService,\n    );\n  }\n\n  /**\n   * WHICH RUNTIME is performing this privileged access, for audit attribution.\n   *\n   * Resolved lazily from the container (like the registry handler above) rather than\n   * constructor-injected, because `SystemAccessBackendService` is constructed lazily and\n   * the principal is a process-level singleton established during startup.\n   *\n   * Attribution ONLY. This never influences whether the access is permitted — it records\n   * who performed one that already was. Wrapped defensively because minimal test\n   * containers may not bind it; an unattributable access must still be audited (an audit\n   * record missing its `performedByRuntime` is far better than no audit record at all).\n   */\n  private describeRuntimeForAudit(): { runtimeProfile: string; runtimeKey?: string; serviceIdentifier?: string } | undefined {\n    try {\n      return this.container\n        .get<RuntimePrincipalBackendService>(SAAS_SERVICE_TYPES.RuntimePrincipalService)\n        .describeForAudit();\n    } catch {\n      return undefined;\n    }\n  }\n\n  /**\n   * Refuse a subject erasure that would leave the application without a usable super-administrator.\n   *\n   * ## Why this narrow resource test lives in a generic service\n   *\n   * `eraseSubjectAsSystem` is generic over subject resource types, and the floor is specific to the\n   * resource that carries the application authority axis. The alternative — an erasure-guard registry\n   * so the rule could register itself from the users domain — would be new machinery invented for a\n   * single consumer, and would hide a fail-closed invariant behind an indirection where its absence\n   * is invisible. A named, delegating call whose entire decision lives in the floor authority is the\n   * honest shape: this method chooses WHEN the rule applies, the authority owns WHAT it says.\n   *\n   * ## Fail-closed on an unresolvable population\n   *\n   * Any error from the floor authority propagates and aborts the erasure. That is deliberate: the\n   * failure modes are \"the users repository is unregistered\" and \"the population query failed\",\n   * neither of which is evidence that the erasure is safe.\n   *\n   * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a data-protection erasure must not\n   * remove the last accountable administrative principal.\n   */\n  private async assertSuperAdminFloorForSubjectErasure(\n    resourceType: ResourceType,\n    subjectIds: string[],\n    systemContext: ExecutionContext<any>,\n    acknowledgeFloorBreach?: boolean,\n  ): Promise<void> {\n    if (!isSuperAdminFloorGovernedSubjectResource(resourceType)) return;\n\n    const repositoriesRegistry = this.container.get<RepositoriesRegistryHandlerBackendService>(\n      SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService,\n    );\n\n    const subjects = await readSubjectsForSuperAdminFloor({\n      subjectIds,\n      executionContext: systemContext,\n      repositoriesRegistry,\n      errorBuilder: this.errorBuilder,\n      operationIdentifier: 'eraseSubjectAsSystem',\n    });\n\n    await assertSuperAdminFloorForSubjectErasure({\n      subjects,\n      executionContext: systemContext,\n      repositoriesRegistry,\n      errorBuilder: this.errorBuilder,\n      conferringRoles: resolveSuperAdminConferringRoles(\n        this.container.get<AuthorizationsBackendService>(SAAS_SERVICE_TYPES.AuthorizationsService),\n      ),\n      operationIdentifier: 'eraseSubjectAsSystem',\n      acknowledgeFloorBreach: acknowledgeFloorBreach === true,\n      // The record IS the control here — see the authority's doc. Error level because there is no\n      // scope above the application: nobody will discover this by being denied something later.\n      onAcknowledgedBreach: async (breach) => {\n        this.logger.error(\n          'Subject erasure completed with an ACKNOWLEDGED super-administrator floor breach. If no '\n          + 'usable super-administrator remains, the application cannot be administered and no '\n          + 'in-product path can restore the role, because every such path requires it. Restore one '\n          + 'out-of-band (seed or direct database write) immediately.',\n          {\n            subjectResourceType: resourceType,\n            erasedSuperAdministratorIds: breach.erasedUsableSuperAdminIds,\n            conferringRoles: breach.conferringRoles,\n          },\n        );\n      },\n    });\n  }\n\n  /**\n   * Refuse a subject erasure that would leave any protected organization without a usable owner.\n   *\n   * ## The cross-scope case\n   *\n   * The application twin above measures ONE population, so a refusal names one condition. This one\n   * fans out: a single user can be the last usable owner of SEVERAL tenants at once, and each is an\n   * independent lockout. The floor authority collects every breach and the refusal names them all,\n   * so an operator planning the remediation does not discover the tenants one failed erasure at a\n   * time.\n   *\n   * ## Why it is a separate guard rather than a branch of the one above\n   *\n   * The two invariants share a subject resource list and nothing else. They measure different\n   * populations (application `appRoles` versus per-tenant membership rows), resolve conferral from\n   * different role tables, and answer to different remedies. Fusing them would produce one guard\n   * that reports the wrong condition for half its refusals.\n   *\n   * ## Fail-closed on an unresolvable population\n   *\n   * Any error from the floor authority propagates and aborts the erasure, for the same reason as the\n   * application twin: a query that failed is not evidence that the erasure is safe.\n   *\n   * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a data-protection erasure must not\n   * remove a tenant's last accountable administrative principal.\n   */\n  private async assertOrganizationOwnerFloorForSubjectErasure(\n    resourceType: ResourceType,\n    subjectIds: string[],\n    systemContext: ExecutionContext<any>,\n    acknowledgeOwnerFloorBreach?: boolean,\n  ): Promise<void> {\n    if (!isOrganizationOwnerFloorGovernedSubjectResource(resourceType)) return;\n\n    const repositoriesRegistry = this.container.get<RepositoriesRegistryHandlerBackendService>(\n      SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService,\n    );\n\n    await assertOrganizationOwnerFloorForSubjectErasure({\n      subjectUserIds: subjectIds,\n      executionContext: systemContext,\n      repositoriesRegistry,\n      errorBuilder: this.errorBuilder,\n      conferringRoles: resolveOrganizationOwnerConferringRoles(\n        this.container.get<AuthorizationsBackendService>(SAAS_SERVICE_TYPES.AuthorizationsService),\n      ),\n      operationIdentifier: 'eraseSubjectAsSystem',\n      acknowledgeOwnerFloorBreach: acknowledgeOwnerFloorBreach === true,\n      // The acknowledgement's whole justification is that the consequence becomes VISIBLE rather\n      // than prevented, so this record is not optional decoration — it is the control. Logged at\n      // error level for the same reason the boot report is: an ownerless tenant has no in-product\n      // remedy, so the operator has to learn about it without going looking.\n      onAcknowledgedBreach: async (breach) => {\n        this.logger.error(\n          'Subject erasure completed with an ACKNOWLEDGED organization-owner floor breach. The '\n          + 'organization below now has no administratively usable owner and cannot be administered '\n          + 'in-product. Restore ownership out-of-band.',\n          {\n            organizationId: breach.organizationId,\n            removedOwnerMembershipIds: breach.reducedMemberIds,\n            remainingUsableOwners: breach.remainingUsableOwners,\n            subjectResourceType: resourceType,\n            subjectIds,\n          },\n        );\n      },\n    });\n  }\n\n  /**\n   * A privileged-write audit is an external observer of committed state. When a\n   * trusted system mutation joins a caller-owned transaction, defer the audit to\n   * that transaction's root post-commit queue so Mongo callback retries cannot\n   * emit records for aborted attempts.\n   */\n  private scheduleSystemContextWriteAudit(\n    resourceType: ResourceType,\n    operation: CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): void {\n    /*\n     * Best-effort, and deliberately NOT the accountable posture the see-through reveal takes. A write is\n     * not a disclosure: refusing it withholds nothing from anyone, it only fails an operation whose\n     * effect the caller intended. The erasure paths below rely on this directly — an erasure refused\n     * because the audit subsystem is down would make availability a ground for declining a data\n     * subject's request, which GDPR Art. 17(3) does not admit (see\n     * `.claude/rules/administrative-continuity-floors.md`).\n     */\n    if (!this.auditLogsService) return;\n    const emit = async (): Promise<void> => {\n      await this.auditLogsService!.logSystemContextWrite({\n        resourceType: resourceType as string,\n        operation,\n        organizationId: options?.scopeContext?.organizationId,\n        scopeContext: options?.scopeContext,\n        performedByRuntime: this.describeRuntimeForAudit(),\n      }).catch(() => { /* audit is best-effort */ });\n    };\n    if (options?.transaction) {\n      const transaction = options.transaction;\n      // One system-access primitive call is one audit occurrence. A semantic\n      // occurrence id preserves separate writes to the same resource inside a\n      // caller-owned transaction without deriving identity from queue order.\n      const auditOccurrenceId = randomUUID();\n      registerTransactionPostCommitEffect(transaction, {\n        key: [\n          'system-context-write-audit',\n          String(resourceType),\n          String(operation),\n          transaction.id,\n          auditOccurrenceId,\n        ].join(':'),\n        execute: emit,\n      });\n      return;\n    }\n    void emit();\n  }\n\n  /**\n   * Route the caller-supplied scope FKs into the WHICH-resources-in-scope\n   * channel (`contextResourcesFieldIdentifier`) — NOT the WHO channel\n   * (`initiatorIds`).\n   *\n   * These primitives synthesise an `INTERNALLY_INITIATED_REQUEST` execution\n   * context, whose constructor is fail-closed: it REJECTS identity fields\n   * (`organizationId`, `userId`, …) on `initiatorIds` — only `applicationId`\n   * is permitted there. That invariant is correct: the initiator of a system\n   * operation is the SYSTEM (super-admin), not the org/user; the org/user is\n   * merely the SCOPE the operation targets. Seeding `organizationId` onto\n   * `initiatorIds` therefore threw `ExecutionContext_InitiatorIds for\n   * internally_initiated_request … should not have identity fields` for every\n   * `AuthScopeType.ORGANIZATION` load (the `applicationId` case slipped\n   * through only because that one field is allowed).\n   *\n   * Scope-of-operation is exactly what `contextResourcesFieldIdentifier`\n   * (\"WHICH resources are in scope\") models — and it is the channel BOTH\n   * `buildContextualFilter` (reads) AND `enrichDataWithContext`'s context-map\n   * loop (writes) consult to scope the query / inject the FK. `initiatorIds`\n   * is never read for scope filtering. `applicationId` is intentionally left\n   * off this map: it stays on `initiatorIds` (allowed) and\n   * `populateApplicationIdIfNeeded` auto-fills it for APPLICATION-scoped\n   * operations.\n   *\n   * CONTRACT — the target resource MUST model the org/user scope FK in its Zod\n   * main schema. Because the FK travels via `contextResourcesFieldIdentifier`,\n   * both consumers fail CLOSED on a context field the schema does not declare\n   * (`findRequiredNestedFieldPathsFromZodSchema` throws — pinned by\n   * `resource-operation-helper-context-enforcement.test.ts` and by the\n   * `scopeContext` write pins in `system-access.service.test.ts`). This is the\n   * SAME guard the URL-scoped write path enforces, not a new limitation: a\n   * scope FK routed through the context map is required-to-be-modeled by design,\n   * so silent scope-skip is impossible. Every real org/user-scoped resource\n   * satisfies it automatically — the polymorphic/scoped-resource factory\n   * `.extend({ [scopeField]: z.string().isForeignKey() })`s the FK into the\n   * variant schema (`resource-polymorphism.schemas.ts`). This is precisely why\n   * `applicationId` is handled differently and NOT an asymmetry to mirror: it is\n   * the one identity field the internal EC allows on `initiatorIds`, so it alone\n   * can also arrive with an EMPTY context map and be injected top-level even when\n   * the scope column is Mongoose-only (e.g. `auditLogs.applicationId`). org/user\n   * have no such `initiatorIds` channel on an internal EC, so the Zod-modeled\n   * context-map path is the only correct one for them — which every real\n   * org/user-scoped resource has.\n   */\n  private buildSystemScopeContextMap(scopeContext?: { organizationId?: string; applicationId?: string; userId?: string }): Map<string, string> {\n    const map = new Map<string, string>();\n    if (scopeContext?.organizationId) {\n      map.set(coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], scopeContext.organizationId);\n    }\n    if (scopeContext?.userId) {\n      map.set(coreResourceShared_FieldIdentifier[CoreResourceType.USERS], scopeContext.userId);\n    }\n    return map;\n  }\n\n  /**\n   * The `applicationId` scope FK is the ONE identity field the\n   * `INTERNALLY_INITIATED_REQUEST` EC permits on `initiatorIds`. Forward it\n   * there (org/user go through {@link buildSystemScopeContextMap} instead);\n   * omit entirely when unset so `populateApplicationIdIfNeeded` resolves it.\n   */\n  private buildSystemInitiatorIds(\n    scopeContext?: { organizationId?: string; applicationId?: string; userId?: string },\n  ): { applicationId: string } | null {\n    return scopeContext?.applicationId ? { applicationId: scopeContext.applicationId } : null;\n  }\n\n  /**\n   * Guard 1: enforce the target resource's fail-closed `systemAccessPolicy`.\n   * `readAsSystem` / `listAsSystem` run with a synthesised `APP_ADMIN_SUPER_ADMIN`\n   * context and therefore bypass the caller's scope + role checks, so a resource is\n   * read this way ONLY if its owner explicitly opted the verb in\n   * (`ResourceSystemAccessMode.ALLOWED`). Anything else — no policy at all, the verb\n   * omitted, or `FORBIDDEN` — throws.\n   *\n   * Thrown as a CONFIGURATION error rather than AUTHORIZATION on purpose: the caller\n   * is internal system code (not an end user), and the remedy is to declare\n   * `systemAccessPolicy` on the resource config, so this must not masquerade as a\n   * user-facing 403.\n   */\n  private assertSystemAccessAllowed(\n    resourceType: ResourceType,\n    operation:\n      | CoreResourceOperation.READ\n      | CoreResourceOperation.LIST\n      | CoreResourceOperation.CREATE\n      | CoreResourceOperation.UPDATE\n      | CoreResourceOperation.UPDATE_MANY,\n  ): void {\n    const config = this.resourcesRegistry.getResourceConfiguration(resourceType);\n    const { primitive, verb } = SYSTEM_ACCESS_PRIMITIVE_BY_OP[operation];\n    const mode = config.systemAccessPolicy?.[verb];\n\n    if (mode !== ResourceSystemAccessMode.ALLOWED) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'system_context_access_not_permitted',\n          resourceType,\n          attemptedSystemVerb: operation,\n          message:\n            `${primitive} is not permitted for resource '${String(resourceType)}': its ` +\n            `systemAccessPolicy.${verb} is not ALLOWED (fail-closed). Declare ` +\n            `systemAccessPolicy.${verb} = ResourceSystemAccessMode.ALLOWED on the resource ` +\n            `configuration to opt this resource into system-context ${verb}s, and ensure the ` +\n            `caller enforces an explicit alternative authorization (e.g. token/email ownership).`,\n        },\n      });\n    }\n  }\n\n  /**\n   * Compute the trusted-write re-attach allowlist for a payload: exactly the keys\n   * the client-shaped request DTO would strip for a legitimate reason (backend-only\n   * material + context-auto-populated FKs). Forwarded as\n   * `options.preserveServerInjectedFields` so the repository re-attaches them after\n   * the strict parse. See `deriveTrustedSystemWritePreservedFields`.\n   */\n  private deriveWritePreserveFields(\n    resourceType: ResourceType,\n    data: unknown,\n    verb: CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.UPDATE_MANY,\n  ): string[] {\n    if (!data || typeof data !== 'object' || Array.isArray(data)) {\n      return [];\n    }\n    const config = this.resourcesRegistry.getResourceConfiguration(resourceType);\n    return deriveTrustedSystemWritePreservedFields(config.mainSchema, Object.keys(data), verb);\n  }\n\n  /**\n   * @wildo_source:part:start saas.backend.system-access-service facet:layer:backend facet:family:service\n   *\n   * Read a resource using a synthesised INTERNALLY_INITIATED_REQUEST execution\n   * context with system-level admin roles, regardless of the originating user's\n   * roles. Use this for server-side policy / configuration loads that drive runtime\n   * behaviour (webhook config, SSO config, SIEM export config, …) where the\n   * originating user is not necessarily the configurer of the policy and therefore\n   * cannot satisfy the resource's READ ACL.\n   *\n   * REQUIRES the target resource to opt in via `systemAccessPolicy.read = ALLOWED`\n   * on its resource configuration — otherwise this throws `ErrorType.CONFIGURATION`\n   * (fail-closed; a never-registered resource throws `ErrorType.INTERNAL` first).\n   * The returned record is the FULL super-admin view (every field, no feature\n   * gating), so the caller MUST enforce an explicit alternative authorization and\n   * project only what is safe to surface to the originating (often lower-privilege)\n   * request.\n   *\n   * Behaviour notes:\n   *   - The synthesised EC is `INTERNALLY_INITIATED_REQUEST` — feature resolution\n   *     returns \"all features enabled\" for it (the call is server-internal).\n   *   - `scopeContext` (optional) seeds the EC's `contextResourcesFieldIdentifier`\n   *     (the WHICH-resources-in-scope channel) so `buildContextualFilter` scopes\n   *     the read to the right tenant FK (e.g. `organizationId`). It must NOT go on\n   *     `initiatorIds` — the internal EC fail-closed rejects identity fields there\n   *     (see {@link buildSystemScopeContextMap}). When omitted, the caller scopes\n   *     via the filter argument.\n   *   - Role injection is APPLICATION-scoped `APP_ADMIN_SUPER_ADMIN` — the broadest\n   *     system role, accepted by every variant's READ ACL.\n   */\n  public async readAsSystem<T = any>(\n    resourceType: ResourceType,\n    id_or_ids_or_filter: IdOrIdsOrFilterType,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n      /**\n       * Skip the `SYSTEM_CONTEXT_READ` privileged-access audit for THIS call. For SELF-REFERENTIAL\n       * internal reads that are framework plumbing rather than tenant-actionable access — e.g. the\n       * audit pipeline resolving a user's memberships / an org's SIEM config to ROUTE an audit event\n       * — where auditing the read would only amplify (and can recurse into) the audit trail. Genuine\n       * privileged reads leave this unset so they still audit.\n       */\n      suppressSystemAudit?: boolean;\n    },\n  ): Promise<T | null> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system READ.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.READ);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> = options?.variantKey\n      ? this.resourcesRegistry.getServiceOperationPath(resourceType, CoreResourceOperation.READ, options.variantKey)\n      : this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.READ);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const result = await this.getServicesRegistryHandler().read<T>(resourceType, systemContext, id_or_ids_or_filter, options);\n    // Guard 4: emit a best-effort privileged-access audit event. Never blocks or\n    // fails the read — `?.` short-circuits when audit is unbound and errors are\n    // swallowed (`logEvent` is already fire-and-forget internally).\n    if (!options?.suppressSystemAudit) {\n      await this.emitPrivilegedReadAudit({\n        resourceType: resourceType as string,\n        operation: CoreResourceOperation.READ,\n        resultCount: result == null ? 0 : 1,\n        organizationId: options?.scopeContext?.organizationId,\n        scopeContext: options?.scopeContext,\n        performedByRuntime: this.describeRuntimeForAudit(),\n      });\n    }\n    return result;\n  }\n\n  /**\n   * List resources using a synthesised INTERNALLY_INITIATED_REQUEST execution\n   * context with system-level admin roles. The cross-scope sibling of\n   * {@link readAsSystem}: use it for server-side LISTs that must span scopes the\n   * originating user is not a member of (e.g. \"all pending invitations for this\n   * email across every organization\"), where a normal scoped LIST would filter the\n   * rows out by the caller's scope. Same role/scope semantics as `readAsSystem`;\n   * with no `pagination` the return is a plain `T[]`.\n   */\n  public async listAsSystem<T = any>(\n    resourceType: ResourceType,\n    filter?: FilterQuery<any>,\n    pagination?: Partial<Resources_PaginationRequest>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n      /** Skip the `SYSTEM_CONTEXT_READ` audit for a self-referential internal routing read — see {@link readAsSystem}. */\n      suppressSystemAudit?: boolean;\n    },\n  ): Promise<T[] | Resources_PaginatedResult<T>> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system LIST.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.LIST);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> = options?.variantKey\n      ? this.resourcesRegistry.getServiceOperationPath(resourceType, CoreResourceOperation.LIST, options.variantKey)\n      : this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.LIST);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const result = await this.getServicesRegistryHandler().list<T>(resourceType, systemContext, filter, pagination, options);\n    // Guard 4: best-effort privileged-access audit (never blocks or fails the list).\n    if (!options?.suppressSystemAudit) {\n      const resultCount = Array.isArray(result) ? result.length : result.data?.length;\n      await this.emitPrivilegedReadAudit({\n        resourceType: resourceType as string,\n        operation: CoreResourceOperation.LIST,\n        resultCount,\n        organizationId: options?.scopeContext?.organizationId,\n        scopeContext: options?.scopeContext,\n        performedByRuntime: this.describeRuntimeForAudit(),\n      });\n    }\n    return result;\n  }\n\n  // ═══════════════════════════════════════════════════════════════════════════════════════════════\n  // RETENTION SEE-THROUGH primitives (M5b) — privileged reads that REVEAL retained (impersonalized-and-\n  // retained) rows the M5a hide-predicate keeps hidden from normal callers. Distinct from readAsSystem/\n  // listAsSystem: they assert the `seeRetained` policy verb (NOT read/list), require a privileged HUMAN\n  // role, SET the EC see-through flag, and emit the HUMAN-attributed `RETAINED_DATA_ACCESS` audit\n  // (accessingUserId + reason threaded in — this layer has no ambient user). Strictly read-only.\n  // ═══════════════════════════════════════════════════════════════════════════════════════════════\n\n  /**\n   * Fail-closed gate for the retention see-through verb. Unlike {@link assertSystemAccessAllowed}\n   * (whose op→verb map is 1:1), the see-through reads run over the resource's READ / LIST core op yet\n   * must assert the SEPARATE `seeRetained` verb — so this is a dedicated check, not a map entry.\n   */\n  private assertSeeRetainedAllowed(resourceType: ResourceType): void {\n    const config = this.resourcesRegistry.getResourceConfiguration(resourceType);\n    if (config.systemAccessPolicy?.seeRetained !== ResourceSystemAccessMode.ALLOWED) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'see_retained_access_not_permitted',\n          resourceType,\n          message:\n            `readRetainedAsSystem / listRetainedAsSystem is not permitted for resource ` +\n            `'${String(resourceType)}': its systemAccessPolicy.seeRetained is not ALLOWED (fail-closed). ` +\n            `This grant is derived automatically when the resource opts into retentionPolicy.`,\n        },\n      });\n    }\n  }\n\n  /**\n   * Privileged-role gate for a see-through read: the HUMAN principal must hold a role authorized to\n   * reveal retained (scrubbed) PII. Phase 1 gates on `APP_ADMIN_SUPER_ADMIN` only (super-admin already\n   * has full access); a dedicated `COMPLIANCE_AUDITOR` role is a purely-additive follow-up — add it to\n   * the `authorized` set once that `_core` role lands. Thrown as AUTHORIZATION (a human 403), unlike the\n   * CONFIGURATION error above (a resource-opt-in problem).\n   */\n  private assertSeeThroughRole(accessingUserRoles: string[]): void {\n    const authorized = accessingUserRoles.some(r => r === CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN);\n    if (!authorized) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n        context: {\n          reason: 'see_through_role_required',\n          message:\n            `A retention see-through read requires a privileged role ` +\n            `(${CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN}); the caller's roles do not include one.`,\n        },\n      });\n    }\n  }\n\n  /**\n   * Fail-closed attribution guard: a see-through reveal of scrubbed PII is only permitted with a REAL\n   * human id AND a real reason. The `RETAINED_DATA_ACCESS` event schema pins both as `.trim().min(1)`,\n   * but the audit store persists `eventData` as an unparsed record — so this is the ENFORCEMENT point\n   * that stops a blank/whitespace attribution from producing an anonymous, reason-less audited reveal\n   * (which would defeat the entire justification for allowing the read). Thrown as VALIDATION.\n   */\n  private assertSeeThroughAttribution(accessingUserId: string, reason: string): void {\n    if (!accessingUserId?.trim() || !reason?.trim()) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n        context: {\n          reason: 'see_through_attribution_required',\n          message:\n            `A retention see-through read requires a non-empty accessingUserId AND reason ` +\n            `(human attribution + justification for revealing scrubbed PII); neither may be blank.`,\n        },\n      });\n    }\n  }\n\n  /**\n   * SEE-THROUGH single-record read (M5b): reveals a RETAINED (impersonalized-and-retained) record that\n   * the M5a hide-predicate hides from normal callers. Fail-closed on the `seeRetained` policy verb + a\n   * privileged HUMAN role; sets the EC see-through flag so `buildContextualFilter` suppresses ONLY the\n   * retention predicate for THIS read (scope still applies); emits the HUMAN-attributed\n   * `RETAINED_DATA_ACCESS` audit, which is ACCOUNTABLE rather than best-effort — a reveal that cannot\n   * be recorded is refused and the rows are withheld (see {@link emitRetainedDataRevealAudit}). The\n   * human's id/roles + a `reason` are REQUIRED — this layer has no ambient user. Strictly read-only.\n   */\n  public async readRetainedAsSystem<T = any>(\n    resourceType: ResourceType,\n    id_or_ids_or_filter: IdOrIdsOrFilterType,\n    auth: { accessingUserId: string; accessingUserRoles: string[]; reason: string },\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T | null> {\n    this.assertSeeRetainedAllowed(resourceType);\n    this.assertSeeThroughRole(auth.accessingUserRoles);\n    this.assertSeeThroughAttribution(auth.accessingUserId, auth.reason);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> = options?.variantKey\n      ? this.resourcesRegistry.getServiceOperationPath(resourceType, CoreResourceOperation.READ, options.variantKey)\n      : this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.READ);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n    // M5b: reveal retained rows for THIS read only (suppresses ONLY the retention predicate, not scope).\n    systemContext.setSeeRetainedData(true);\n\n    const result = await this.getServicesRegistryHandler().read<T>(resourceType, systemContext, id_or_ids_or_filter, options);\n\n    // M6: HUMAN-attributed, reason-bearing, and ACCOUNTABLE — an unrecordable reveal is refused.\n    await this.emitRetainedDataRevealAudit({\n      accessingUserId: auth.accessingUserId,\n      roles: auth.accessingUserRoles,\n      reason: auth.reason,\n      resourceType: resourceType as string,\n      operationIdentifier: 'readRetainedAsSystem',\n      retainedRecordCount: result == null ? 0 : 1,\n      organizationId: options?.scopeContext?.organizationId,\n    });\n\n    return result;\n  }\n\n  /**\n   * SEE-THROUGH collection read (M5b): the list sibling of {@link readRetainedAsSystem}. Same gates\n   * (`seeRetained` verb + privileged role), same EC see-through flag, same HUMAN-attributed audit, and\n   * the same accountability: an unrecordable reveal is refused rather than performed silently.\n   */\n  public async listRetainedAsSystem<T = any>(\n    resourceType: ResourceType,\n    auth: { accessingUserId: string; accessingUserRoles: string[]; reason: string },\n    filter?: FilterQuery<any>,\n    pagination?: Partial<Resources_PaginationRequest>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T[] | Resources_PaginatedResult<T>> {\n    this.assertSeeRetainedAllowed(resourceType);\n    this.assertSeeThroughRole(auth.accessingUserRoles);\n    this.assertSeeThroughAttribution(auth.accessingUserId, auth.reason);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> = options?.variantKey\n      ? this.resourcesRegistry.getServiceOperationPath(resourceType, CoreResourceOperation.LIST, options.variantKey)\n      : this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.LIST);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n    systemContext.setSeeRetainedData(true);\n\n    const result = await this.getServicesRegistryHandler().list<T>(resourceType, systemContext, filter, pagination, options);\n    const retainedRecordCount = Array.isArray(result) ? result.length : result.data?.length;\n\n    await this.emitRetainedDataRevealAudit({\n      accessingUserId: auth.accessingUserId,\n      roles: auth.accessingUserRoles,\n      reason: auth.reason,\n      resourceType: resourceType as string,\n      operationIdentifier: 'listRetainedAsSystem',\n      retainedRecordCount,\n      organizationId: options?.scopeContext?.organizationId,\n    });\n\n    return result;\n  }\n\n  /**\n   * Create a resource using a synthesised super-admin system context, RE-ATTACHING\n   * the fields the client-shaped request DTO strips: `.isBackendOnly()` material\n   * (e.g. a credential `passwordHash`) and the context-auto-populated FKs (e.g.\n   * `userId` on a system resource that has no HTTP surface to seed it). Use this\n   * for trusted in-process writes to system resources — e.g. registration\n   * persisting `USER_CREDENTIALS` / `USER_PROFILES` — where the payload IS the\n   * source of truth and there is no request context to inject the FKs.\n   *\n   * REQUIRES the target resource to opt in via `systemAccessPolicy.create = ALLOWED`\n   * (fail-closed; otherwise throws `ErrorType.CONFIGURATION`). The re-attach\n   * allowlist is DERIVED from the resource schema (never caller-supplied), and this\n   * primitive is reachable only from trusted engine code — never an HTTP payload —\n   * so it cannot be used to smuggle client-forbidden fields.\n   *\n   * `scopeContext` (optional) seeds the EC's `contextResourcesFieldIdentifier`\n   * (the WHICH-resources-in-scope channel — NOT `initiatorIds`, which fail-closed\n   * rejects identity fields on the internal EC; see\n   * {@link buildSystemScopeContextMap}) so `enrichDataWithContext`'s context-map\n   * loop injects the right scope FK. It is NOT required when the scope FKs are\n   * already present on `data` (they are preserved by the allowlist).\n   */\n  public async createAsSystem<T = any>(\n    resourceType: ResourceType,\n    data: Record<string, unknown>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system CREATE.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.CREATE);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.CREATE);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const preserveServerInjectedFields = [\n      ...(options?.preserveServerInjectedFields ?? []),\n      ...this.deriveWritePreserveFields(resourceType, data, CoreResourceOperation.CREATE),\n    ];\n\n    const result = await this.getServicesRegistryHandler().create<T>(\n      resourceType,\n      systemContext,\n      data,\n      { ...options, preserveServerInjectedFields },\n    );\n    // Guard 4: best-effort privileged-write audit (never blocks or fails the write).\n    this.scheduleSystemContextWriteAudit(\n      resourceType,\n      CoreResourceOperation.CREATE,\n      options,\n    );\n    return result;\n  }\n\n  /**\n   * Update a single resource using a synthesised super-admin system context,\n   * re-attaching the DTO-stripped fields (backend-only material like a rotated\n   * `passwordHash`, and context-auto-populated FKs). The single-target sibling of\n   * {@link createAsSystem}. Requires `systemAccessPolicy.update = ALLOWED`\n   * (fail-closed). `id_or_ids_or_filter` selects the target exactly as the normal\n   * `update` does (an id or a filter).\n   */\n  public async updateAsSystem<T = any>(\n    resourceType: ResourceType,\n    id_or_ids_or_filter: IdOrIdsOrFilterType,\n    data: Record<string, unknown>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T | null> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system UPDATE.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.UPDATE);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.UPDATE);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const preserveServerInjectedFields = [\n      ...(options?.preserveServerInjectedFields ?? []),\n      ...this.deriveWritePreserveFields(resourceType, data, CoreResourceOperation.UPDATE),\n    ];\n\n    const result = await this.getServicesRegistryHandler().update<T>(\n      resourceType,\n      systemContext,\n      id_or_ids_or_filter,\n      data,\n      { ...options, preserveServerInjectedFields },\n    );\n    this.scheduleSystemContextWriteAudit(\n      resourceType,\n      CoreResourceOperation.UPDATE,\n      options,\n    );\n    return result;\n  }\n\n  /**\n   * Bulk-update resources matched by `id_or_ids_or_filter` using a synthesised\n   * super-admin system context, re-attaching the DTO-stripped fields. The\n   * many-target sibling of {@link updateAsSystem}; requires\n   * `systemAccessPolicy.updateMany = ALLOWED` (fail-closed). Used e.g. by\n   * anonymous→user ownership transposition, where a shared patch (`userId`,\n   * `anonymousUserId`) must land on many rows.\n   */\n  public async updateManyAsSystem<T = any>(\n    resourceType: ResourceType,\n    id_or_ids_or_filter: IdOrIdsOrFilterType,\n    data: Record<string, unknown>,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<T[]> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system UPDATE_MANY.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const preserveServerInjectedFields = [\n      ...(options?.preserveServerInjectedFields ?? []),\n      ...this.deriveWritePreserveFields(resourceType, data, CoreResourceOperation.UPDATE_MANY),\n    ];\n\n    const result = await this.getServicesRegistryHandler().updateMany<T>(\n      resourceType,\n      systemContext,\n      id_or_ids_or_filter,\n      data,\n      { ...options, preserveServerInjectedFields },\n    );\n    this.scheduleSystemContextWriteAudit(\n      resourceType,\n      CoreResourceOperation.UPDATE_MANY,\n      options,\n    );\n    return result;\n  }\n\n  /**\n   * DIRECT subject erasure — impersonalize-and-retain the named rows of a retention-governed resource.\n   *\n   * This is the entry point for \"erase this subject\": scrub the personal fields in place, keep the row,\n   * and mark it `RETAINED` (hidden from normal reads, immutable, reachable only through the audited\n   * see-through path).\n   *\n   * WHY IT EXISTS: until now the ONLY way to reach impersonalization was the `onParentDelete` cascade —\n   * i.e. a PARENT being deleted. That structurally excludes every SCOPE ROOT, and `USERS` is a scope\n   * root, so the resource that actually holds the personal data could never be erased. A\n   * parent-delete-only trigger can only ever reach CHILD resources, which are precisely the ones\n   * holding no PII (a billing row points at a person; the name and address live on the user). This\n   * closes that gap: erasure can now be initiated on the subject itself.\n   *\n   * Shares ONE definition of \"impersonalize these rows\" with the cascade\n   * (`impersonalizeRowsInPlace`) — the asserts, the scrub patch, the marker write and the\n   * treatment-driven file erasure are not duplicated here, so the two entry points cannot drift on\n   * what counts as erased.\n   *\n   * Fail-closed twice over: the resource must grant system `updateMany` (Guard 1, as for every trusted\n   * write) AND must be retention-governed (asserted by the shared core — otherwise there is no\n   * `retentionStatus` marker to flip and no derived grant to flip it with).\n   *\n   * Takes EXPLICIT ids rather than a filter: an erasure is not a query, and resolving a filter here\n   * would need a system LIST grant plus a silent decision about what to do when it matches more (or\n   * fewer) rows than the caller expected. The caller knows the subject.\n   */\n  public async impersonalizeSubjectAsSystem(\n    resourceType: ResourceType,\n    id_or_ids: string | string[],\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<void> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system UPDATE_MANY — the verb the\n    // scrub write uses.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const rowIds = typeof id_or_ids === 'string' ? [id_or_ids] : id_or_ids;\n    if (rowIds.length === 0) {\n      return;\n    }\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    await this.getServicesRegistryHandler()\n      .getService(resourceType)\n      .impersonalizeRowsInPlace(resourceType, rowIds, systemContext, options);\n\n    // Best-effort privileged-write audit (never blocks or fails the erasure) — mirrors the other\n    // trusted writes. The per-row RETAINED_DATA_ACCESS audit covers later READS of the retained rows;\n    // this records the erasure itself.\n    this.auditLogsService?.logSystemContextWrite({\n      resourceType: resourceType as string,\n      operation: CoreResourceOperation.UPDATE_MANY,\n      organizationId: options?.scopeContext?.organizationId,\n      scopeContext: options?.scopeContext,\n      performedByRuntime: this.describeRuntimeForAudit(),\n    }).catch(() => { /* audit is best-effort */ });\n  }\n\n  /**\n   * SUBJECT ERASURE — the entry point a \"delete my account\" request calls.\n   *\n   * The whole erasure, not just its last step: tear down the subject's dependents according to what\n   * each edge declared, THEN scrub the subject row and flip it to `RETAINED`. Prefer this over\n   * {@link impersonalizeSubjectAsSystem} for any real erasure request — that method scrubs the\n   * subject row ALONE, which for a user leaves the profile holding the name, the bio and the avatar\n   * completely intact (the `USERS → USER_PROFILES` cascade is delete-driven, and an erasure does not\n   * delete the user). `impersonalizeSubjectAsSystem` remains the right call only when the caller has\n   * already dealt with the dependents, or when the subject genuinely has none.\n   *\n   * The delete-vs-retain decision per dependent is DERIVED FROM CONFIGURATION — each edge's\n   * `onParentDelete` declaration, read through the same authority the delete cascade uses — never\n   * from a hardcoded list of resource types. Edges the author never classified abort the erasure\n   * instead of being guessed at. See `classifySubjectErasureDisposition` for the full table.\n   *\n   * Fail-closed three times over: the resource must grant system `updateMany` (Guard 1, as for every\n   * trusted write), must be retention-governed (the subject is kept, so there must be a\n   * `retentionStatus` marker to flip), and must have an executable disposition for every dependent\n   * edge.\n   *\n   * Takes EXPLICIT ids for the same reason {@link impersonalizeSubjectAsSystem} does: an erasure is\n   * not a query, and resolving a filter here would silently decide what to do when it matches more\n   * (or fewer) subjects than the caller expected.\n   *\n   * @returns the `SubjectErasureReport` — every edge with the disposition applied and the\n   *   configuration that justified it. Returned rather than only logged so the flow fronting the\n   *   request can record or surface it as the evidence of what was erased.\n   */\n  /**\n   * Assemble a data subject's export bundle under a synthesised system context — the disclosure\n   * counterpart of {@link eraseSubjectAsSystem}, and the ONLY public door to a subject export.\n   *\n   * ## No route, deliberately\n   *\n   * There is no resource operation and no HTTP endpoint for this, exactly as there is none for\n   * erasure. GDPR Art. 15 and Art. 20 bind the data **controller** — the application built with this\n   * framework, not the framework — so WHO may request an export, what identity proof is required\n   * first, and how the result is delivered are the application's decisions. The framework's job is\n   * to make the bundle assemblable and to refuse to assemble a misleading one.\n   *\n   * Four routed export operations that claimed to do this were removed on 2026-08-01 for exactly\n   * this reason: each answered HTTP 200 with an unfiltered row while ignoring its whole request\n   * contract. This is the honest replacement, at the layer the decision actually belongs to.\n   *\n   * ## Two-key gate\n   *\n   * The caller's invocation is the first key — reaching this method at all is a deliberate act by\n   * the controller. The per-resource `systemAccessPolicy.exportSubject` opt-in is the second, and it\n   * is enforced inside the orchestrator across EVERY resource that would enter the bundle, not just\n   * the subject's own. A resource that never consented to disclosure cannot be swept in because it\n   * happens to sit on an edge.\n   *\n   * `// assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT`\n   *\n   * ## Interaction with erasure RETENTION (checked 2026-08-09 — deliberate, not an oversight)\n   *\n   * This path does NOT set the see-through flag; only `readRetainedAsSystem` / `listRetainedAsSystem` do.\n   * So exporting a subject who has ALREADY been erased-and-retained reads through the ordinary chokepoint,\n   * finds the row hidden, and discloses nothing — which is the correct answer twice over: the row's\n   * personal fields are already scrubbed, and an export is a disclosure door, so it must not be the one\n   * that reveals what erasure withdrew.\n   *\n   * Do not \"fix\" a thin bundle for an erased subject by granting see-through here. The audited reveal has\n   * its own two primitives precisely so that a compliance auditor's read is separable, attributed and\n   * logged; routing it through export would make every export a potential retained-data disclosure.\n   *\n   * @param resourceType the subject's resource type.\n   * @param id_or_ids the explicit subject rows. An export is not a query.\n   * @param purpose WHICH right is being answered — the two produce genuinely different bundles.\n   * @returns the {@link SubjectExportBundle}. Only `bundle.report` is safe to log; `bundle.slices`\n   *   carry the personal data itself.\n   */\n  public async exportSubjectAsSystem(\n    resourceType: ResourceType,\n    id_or_ids: string | string[],\n    purpose: SubjectExportPurpose,\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n    },\n  ): Promise<SubjectExportBundle> {\n    // Guard 1 (fail-closed): the subject's own resource must permit system READ — the verb every\n    // row of the bundle is gathered with. The narrower `exportSubject` opt-in is asserted per\n    // participating resource inside the orchestrator.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.READ);\n\n    const subjectIds = typeof id_or_ids === 'string' ? [id_or_ids] : id_or_ids;\n    if (subjectIds.length === 0) {\n      return {\n        report: {\n          purpose,\n          subjectResourceType: resourceType,\n          subjectIds: [],\n          edges: [],\n          fieldsExcludedAsDerived: [],\n          fieldsWithheldAsNonDisclosable: [],\n          totalRecordCount: 0,\n        },\n        slices: [],\n      };\n    }\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.READ);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    const bundle = await this.getServicesRegistryHandler()\n      .getService(resourceType)\n      .exportSubjectInPlace(resourceType, subjectIds, purpose, systemContext, options);\n\n    // ── The audit event ──\n    //\n    // A subject export is arguably the most audit-worthy READ the framework performs: it assembles\n    // everything held about one person and hands it out. No framework mechanism would emit for it:\n    // `FIELD_ACCESS` fires only on first exposure of a backend-only secret at CREATE, and the\n    // risk-tiered `RESOURCE_OPERATION_PERFORMED` emission deliberately excludes read-shaped\n    // operations. The removed export operations produced no trail whatsoever — which is why this\n    // event is emitted explicitly here rather than inherited.\n    //\n    // The report is logged, never the slices: the report is designed to carry dispositions and\n    // counts and NO personal data, so it is safe to persist in an audit store. Logging the bundle\n    // would put the exported personal data into the audit trail — turning the record of a\n    // disclosure into a second copy of it.\n    await this.auditLogsService?.logSubjectDataExport({\n      purpose,\n      subjectResourceType: resourceType as string,\n      subjectIds,\n      includedResourceTypes: bundle.report.edges\n        .filter((edge) => edge.collected)\n        .map((edge) => String(edge.relatedResourceType)),\n      totalRecordCount: bundle.report.totalRecordCount,\n      fieldsExcludedAsDerived: bundle.report.fieldsExcludedAsDerived,\n      fieldsWithheldAsNonDisclosable: bundle.report.fieldsWithheldAsNonDisclosable,\n      organizationId: options?.scopeContext?.organizationId,\n    });\n\n    return bundle;\n  }\n\n  /**\n   * Guard 4 of {@link eraseSubjectAsSystem}: rows linked to the subject in an HTTP_API-bound\n   * external system declaring erasure stance `CONTROLLER_ACKNOWLEDGED_NON_ERASURE` (ETL D6, 6c)\n   * refuse the erasure until the CONTROLLER acknowledges the hole — per request, via\n   * `acknowledgeHttpApiNonErasure`, never as a standing posture.\n   *\n   * `CONFLICT` (409), like the floors: the caller is authorized and the payload valid — what\n   * refuses is the declared state of the subject's graph, and the refusal names its own remedy.\n   * Enumerates the subject's child-direction edges (the erasure's own discovery boundary — linkage\n   * no relationship declares is outside every part of the erasure, not only this guard). The\n   * acknowledged path's RECORD (the CRITICAL audit event + the report entry) is emitted by the\n   * per-resource external effect post-commit, where the outcome it records actually exists.\n   */\n  private assertHttpApiNonErasureAcknowledged(\n    subjectResourceType: ResourceType,\n    acknowledged: boolean | undefined,\n    executionContext: ExecutionContext<any>,\n  ): void {\n    const subjectConfiguration = this.resourcesRegistry.getResourceConfiguration(subjectResourceType) as {\n      resourceRelationships?: Parameters<typeof getChildDirectionRelationships>[0];\n    };\n    const childRelationships = subjectConfiguration?.resourceRelationships\n      ? getChildDirectionRelationships(subjectConfiguration.resourceRelationships)\n      : [];\n\n    const affected: Array<{ resourceType: string; providerRef: string; remoteEntityRef: string }> = [];\n    const seenChildResourceTypes = new Set<string>();\n    for (const relationship of childRelationships) {\n      if ((relationship as { isDisabled?: boolean }).isDisabled === true) continue;\n      const childResourceType = String((relationship as { resourceType2?: unknown }).resourceType2 ?? '');\n      if (!childResourceType || seenChildResourceTypes.has(childResourceType)) continue;\n      seenChildResourceTypes.add(childResourceType);\n\n      let childConfiguration: { httpApiBinding?: { providerRef: string; entityRef: string; erasure?: { stance?: string } } } | undefined;\n      try {\n        childConfiguration = this.resourcesRegistry.getResourceConfiguration(childResourceType as ResourceType);\n      } catch {\n        // An unregistered child is the erasure orchestrator's problem to name, not this guard's.\n        continue;\n      }\n      const binding = childConfiguration?.httpApiBinding;\n      if (!binding || binding.erasure?.stance !== HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE) continue;\n      affected.push({\n        resourceType: childResourceType,\n        providerRef: binding.providerRef,\n        remoteEntityRef: binding.entityRef,\n      });\n    }\n\n    if (affected.length === 0 || acknowledged === true) return;\n\n    throw this.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        reason: 'http_api_non_erasure_unacknowledged',\n        message:\n          `Subject erasure of \"${subjectResourceType}\" is REFUSED: ${affected.length} linked HTTP_API-bound resource(s) `\n          + `declare erasure stance CONTROLLER_ACKNOWLEDGED_NON_ERASURE — their remote rows cannot be erased by the platform `\n          + `and would silently survive an erasure that reports itself complete. To proceed, pass `\n          + `'acknowledgeHttpApiNonErasure: true' on THIS request: the erasure will then complete locally, each named resource `\n          + `will be recorded as a CRITICAL audit event, and the report will carry the hole explicitly.`,\n        subjectResourceType,\n        resources: affected,\n      },\n    });\n  }\n\n  public async eraseSubjectAsSystem(\n    resourceType: ResourceType,\n    id_or_ids: string | string[],\n    options?: ServiceOptions & {\n      scopeContext?: { organizationId?: string; applicationId?: string; userId?: string };\n      /**\n       * The CONTROLLER's explicit decision to complete an erasure that would leave one or more\n       * organizations with no usable owner.\n       *\n       * Off by default, so stranding a tenant is never accidental. Supplied, the erasure proceeds and\n       * each stranded tenant is recorded as a CRITICAL audit event instead of the write being\n       * refused. See `assertOrganizationOwnerFloorForSubjectErasure` in the floor authority for why\n       * this door is defeasible while every administrative door is not — in short, GDPR Art. 17(3)\n       * does not recognise \"the tenant would become unadministrable\" as a ground to refuse erasure,\n       * and the framework must not impose that posture on the application that owes the answer.\n       */\n      acknowledgeOrganizationOwnerFloorBreach?: boolean;\n      /**\n       * The same controller decision for the APPLICATION-scope floor.\n       *\n       * Separate from its organization sibling on purpose: the two guard different populations with\n       * different remedies, and an erasure that may lawfully strand one tenant is not thereby\n       * licensed to leave the whole application unadministrable. Acknowledging one must never\n       * silently acknowledge the other.\n       */\n      acknowledgeAdministrativeContinuityFloorBreach?: boolean;\n      /**\n       * The CONTROLLER's explicit decision to complete an erasure although rows linked to the\n       * subject live in HTTP_API-bound EXTERNAL systems declaring erasure stance\n       * `CONTROLLER_ACKNOWLEDGED_NON_ERASURE` (ETL D6 stance 6c).\n       *\n       * Off by default and PER REQUEST, never a standing posture: unacknowledged, guard 4 refuses\n       * before anything is written, naming every such resource. Acknowledged, the erasure proceeds\n       * and each resource is recorded twice — a CRITICAL `HTTP_API_NON_ERASURE_ACKNOWLEDGED` audit\n       * event, and an `ACKNOWLEDGED_NON_ERASURE` entry in the report's `externalEffects` (which\n       * `isIncompleteSubjectErasureExternalEffect` deliberately counts as incomplete: the data is\n       * still live at the third party, however deliberate the decision).\n       *\n       * A THIRD acknowledgement, separate from the two floor acknowledgements on purpose — each\n       * guards a different consequence with a different remedy, and acknowledging one must never\n       * silently acknowledge another.\n       */\n      acknowledgeHttpApiNonErasure?: boolean;\n    },\n  ): Promise<SubjectErasureReport> {\n    // Guard 1 (fail-closed): the resource must explicitly opt into system UPDATE_MANY — the verb the\n    // subject's scrub write uses.\n    this.assertSystemAccessAllowed(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const subjectIds = typeof id_or_ids === 'string' ? [id_or_ids] : id_or_ids;\n    if (subjectIds.length === 0) {\n      return {\n        subjectResourceType: resourceType,\n        subjectIds: [],\n        edges: [],\n        subjectImpersonalized: false,\n        // No subject means nothing to erase anywhere, including externally — and the effects below\n        // are deliberately never reached, so no provider is called for an empty request.\n        externalEffects: [],\n      };\n    }\n\n    const operationPath: ResourceConfiguration_OperationPath<any, any> =\n      this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.UPDATE_MANY);\n\n    const systemContext = await this.executionContextCreator.createForInternalOperation({\n      operation: operationPath,\n      contextResourcesFieldIdentifier: this.buildSystemScopeContextMap(options?.scopeContext),\n      initiatorIds: this.buildSystemInitiatorIds(options?.scopeContext),\n      initiatorRoles: [\n        {\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n        },\n      ],\n    });\n\n    // ── Guard 2: the last-super-administrator floor ──\n    //\n    // An erasure scrubs the subject's row and retention-hides it, so an erased administrator stops\n    // counting as decisively as a deleted or demoted one — and `appRoles` deliberately survives the\n    // scrub (`.isAuditEvidence()`, no `.impersonalizeWith()`), so a naive role query would keep\n    // counting a principal nobody can authenticate as.\n    //\n    // This runs BEFORE `eraseSubjectInPlace`, so a refusal leaves nothing written.\n    //\n    // The floor is NOT bypassed for this system path even though the ceiling gate exempts internal\n    // writes. An erasure that leaves the application unadministrable is not a completed\n    // data-protection request — it is an availability incident wearing one. The remedy the refusal\n    // names (appoint another administrator, then erase) satisfies both obligations; silently\n    // proceeding satisfies neither.\n    await this.assertSuperAdminFloorForSubjectErasure(\n      resourceType,\n      subjectIds,\n      systemContext,\n      options?.acknowledgeAdministrativeContinuityFloorBreach,\n    );\n\n    // ── Guard 3: the last-organization-owner floor ──\n    //\n    // The per-tenant sibling of Guard 2, and the only one of the two that can refuse on behalf of\n    // several populations at once. It runs SECOND because the application floor is the more\n    // fundamental condition: an application with no administrator cannot repair an ownerless tenant\n    // either, so reporting that first gives the operator the outer problem to solve.\n    //\n    // Also BEFORE `eraseSubjectInPlace`, so a refusal from either guard leaves nothing written.\n    await this.assertOrganizationOwnerFloorForSubjectErasure(\n      resourceType,\n      subjectIds,\n      systemContext,\n      options?.acknowledgeOrganizationOwnerFloorBreach,\n    );\n\n    // ── Guard 4: HTTP_API stance-6c resources demand a per-request acknowledgement ──\n    //\n    // Rows linked to the subject that live in an external system the platform CANNOT erase\n    // (D6 stance 6c) must not be silently skipped by an erasure that then reports itself done.\n    // Refusing HERE — before `eraseSubjectInPlace`, like the two floors — leaves nothing written;\n    // the stance's post-commit effect can only RECORD, never refuse. The refusal is escapable per\n    // request (`acknowledgeHttpApiNonErasure`), never by a standing configuration — the same\n    // defeasibility argument as the floors: GDPR Art. 17(3) does not list \"a third party holds\n    // copies we cannot delete\" as a ground for the FRAMEWORK to refuse indefinitely, so the\n    // controller decides, and the record is the control.\n    this.assertHttpApiNonErasureAcknowledged(\n      resourceType,\n      options?.acknowledgeHttpApiNonErasure,\n      systemContext,\n    );\n\n    const report = await this.getServicesRegistryHandler()\n      .getService(resourceType)\n      .eraseSubjectInPlace(resourceType, subjectIds, systemContext, options);\n\n    // ── External, non-transactional effects — POST-COMMIT by construction ──\n    //\n    // `eraseSubjectInPlace` has returned, so its transaction is closed and the local scrub is\n    // durable. Only now may we call out to systems we do not own (a billing provider anonymizing\n    // its customer, say). Running them inside the transaction would be wrong twice over: it would\n    // hold a database transaction open across third-party network latency, and a later rollback\n    // could not undo a provider-side erasure that had already applied.\n    //\n    // The consequence is deliberate and asymmetric: a failure here does NOT fail the erasure. The\n    // local rows are correctly scrubbed either way, and throwing would invite the caller to retry\n    // an erasure whose local half already succeeded. The incomplete state travels in the report\n    // instead — which is why `SubjectErasureReport.externalEffects` exists rather than a boolean.\n    // No registry bound → no effect ever declared itself for this subject, so an empty list is the\n    // truthful answer (NOT `NOT_REGISTERED`, which means a KNOWN effect had no handler).\n    report.externalEffects = this.subjectErasureExternalEffects\n      ? await this.subjectErasureExternalEffects.runAll({\n        subjectResourceType: resourceType,\n        subjectIds,\n        scopeContext: options?.scopeContext,\n      })\n      : [];\n\n    /**\n     * Tolerate a port that answers with nothing — because the LOCAL ERASURE IS ALREADY COMMITTED.\n     *\n     * `runAll` is typed to resolve an array, but this is an injected port: an implementation that\n     * returns `undefined` (or a stub standing in for one) satisfies the binding and violates the\n     * contract. Dereferencing it threw `Cannot read properties of undefined (reading 'filter')` AFTER\n     * the transaction committed — so a completed, correct erasure surfaced to its caller as a failure,\n     * inviting a retry of work already done. Turning a successful data-protection request into an\n     * apparent failure is the worse outcome, so the malformed answer is coerced and reported LOUDLY\n     * rather than thrown: nothing here can undo the erasure, and an operator still has to learn that\n     * external effects were not actually measured.\n     */\n    if (!Array.isArray(report.externalEffects)) {\n      this.logger?.error(\n        'Subject-erasure external-effects port returned a non-array; treating it as NO effects measured. '\n        + 'The LOCAL erasure is committed and correct, but whether personal data is still live at a third '\n        + 'party is now UNKNOWN rather than reported.',\n        { subjectResourceType: resourceType, subjectCount: subjectIds.length, received: typeof report.externalEffects },\n      );\n      report.externalEffects = [];\n    }\n\n    const incompleteEffects = selectIncompleteExternalEffects(report.externalEffects);\n    if (incompleteEffects.length > 0) {\n      // ERROR, not warn: personal data is potentially still live at a third party after a\n      // completed data-protection request. That is an operator obligation, not a footnote — and the\n      // report is returned to a caller who may only persist it, so the log has to stand alone.\n      this.logger?.error('Subject erasure completed LOCALLY but external effects are incomplete', {\n        subjectResourceType: resourceType,\n        subjectCount: subjectIds.length,\n        incompleteEffects: incompleteEffects.map((effect) => ({\n          effectRef: effect.effectRef,\n          status: effect.status,\n          detail: effect.detail,\n          failedSteps: (effect.steps ?? [])\n            .filter((step) => !step.succeeded)\n            .map((step) => ({ step: step.step, targetRef: step.targetRef, error: step.error })),\n        })),\n      });\n    }\n\n    // Best-effort privileged-write audit of the erasure itself (never blocks or fails it) — mirrors\n    // the other trusted writes. The dependent teardowns audit themselves through the writers they\n    // run on; the per-edge dispositions are additionally carried by the returned report and the\n    // structured completion log.\n    this.auditLogsService?.logSystemContextWrite({\n      resourceType: resourceType as string,\n      operation: CoreResourceOperation.UPDATE_MANY,\n      organizationId: options?.scopeContext?.organizationId,\n      scopeContext: options?.scopeContext,\n      performedByRuntime: this.describeRuntimeForAudit(),\n    }).catch(() => { /* audit is best-effort */ });\n\n    return report;\n  }\n  /** @wildo_source:part:end saas.backend.system-access-service */\n}\n\n"]}

package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Billing Reconciliation — the scheduled tick that asks the provider what it actually holds.
+ *
+ * ## What this batch is for
+ *
+ * Local billing state is entirely webhook-derived. `StandardBilling_Interface.retrieveSubscription`
+ * documents itself as the read for "reconciliation (if webhook missed)", and until 2026-09-09 its
+ * only callers were inside the webhook router — so the recovery read ran exactly when a webhook
+ * DID arrive, and never when one did not. A lost delivery left a stale subscription still granting
+ * entitlements, or an invoice that existed only at the provider, with nothing anywhere that could
+ * notice.
+ *
+ * ## Why every number is reported and not just a total
+ *
+ * `subscriptionsExamined` is a health metric and `subscriptionsDrifted` is an ALARM. A steady
+ * non-zero drift count does not mean the sweep is working — it means webhook delivery is failing
+ * and the sweep is papering over it, which is a different problem with a different fix. Reporting
+ * one number would hide exactly that distinction.
+ *
+ * ## Failures are per row and the run keeps going
+ *
+ * One unreachable subscription must not stop the rest of the application from being reconciled: an
+ * unreconciled row is picked up by the next tick at no cost, so continuing is free and stopping
+ * costs a whole cycle. The same trade the usage flush makes.
+ */
+import { createCustomBatchExecutionService } from '../../base-classes/services/batches/batches-cronjobs-custom-execution.service';
+export declare function createBillingReconciliationBatch(): ReturnType<typeof createCustomBatchExecutionService>;
+//# sourceMappingURL=billing-reconciliation.batch.backend.service.d.ts.map

package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-reconciliation.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/billing/batches/billing-reconciliation.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AA0B/I,wBAAgB,gCAAgC,IAAI,UAAU,CAAC,OAAO,iCAAiC,CAAC,CA2CvG"}