@wildo-ai/saas-backend-lib 1.1.12 → 1.1.13

package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-status-transition.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAGH,OAAO,EACL,uCAAuC,EACvC,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAIpH,OAAO,EACL,2CAA2C,EAC3C,iCAAiC,EACjC,wCAAwC,GACzC,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,kDAAkD,EAClD,wCAAwC,EACxC,6CAA6C,EAC7C,gDAAgD,EAChD,+CAA+C,EAC/C,6CAA6C,EAC7C,uCAAuC,EACvC,qCAAqC,EACrC,iDAAiD,GAClD,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAgC,MAAM,gFAAgF,CAAC;AAE/J,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,6CAA6C,EAAE,MAAM,0GAA0G,CAAC;AACzK,OAAO,EACL,kDAAkD,EAClD,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AACrH,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,sFAAsF,CAAC;AACzJ,OAAO,EAAE,uCAAuC,EAAE,MAAM,4GAA4G,CAAC;AACrK,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EACL,yBAAyB,EACzB,qCAAqC,GACtC,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,MAAM,4EAA4E,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,MAAM,8FAA8F,CAAC;AAE1I,4EAA4E;AAC5E,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B;;;;;;;;GAQG;AACH,SAAS,+BAA+B,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAyD,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,0FAA0F;IAC1F,iEAA+B,CAAA;IAC/B;;;;OAIG;IACH,uEAAqC,CAAA;AACvC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,4BASX;AATD,WAAY,4BAA4B;IACtC,qDAAqD;IACrD,2CAAW,CAAA;IACX;;;;OAIG;IACH,+CAAe,CAAA;AACjB,CAAC,EATW,4BAA4B,KAA5B,4BAA4B,QASvC;AAED,+FAA+F;AAC/F,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,kCAAkC,CAAC;AAEzF,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA0GjD;;;;;;;;GAQG;AACH,SAAS,8BAA8B,CACrC,KAAc,EACd,cAAiC,EACjC,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO;IAExE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAC1E,OAAO,EAAE;YACP,OAAO,EACL,QAAQ,UAAU,CAAC,mBAAmB,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;kBAC5F,2BAA2B;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,YAAY,EAAE,UAAU,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YACnD,eAAe,EAAE,SAAS;SAC3B;KACF,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,SAAS,4BAA4B,CACnC,UAA8C,EAC9C,KAAc,EACd,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,8FAA8F;IAC9F,iEAAiE;IACjE,IAAI,UAAU,CAAC,IAAI,KAAK,4BAA4B,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExE,MAAM,QAAQ,GAAI,KAA6C,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,UAAU,CAAC,MAAM,KAAK,8BAA8B,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,OAAO,EAAE;oBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,sBAAsB;oBACzD,MAAM,EAAE,6CAA6C;oBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;oBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;iBACpD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,OAAO,EAAE;gBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,oCAAoC;gBACvE,MAAM,EAAE,6CAA6C;gBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,QAAQ;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU;QAClC,CAAC,CAAC,CAAC,YAAY,EAAE,4BAA4B,CAAC;QAC9C,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACnB,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,sCAAsC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAChH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,UAAmC,EACnC,gBAA8D,EAC9D,GAAS;IAET,MAAM,QAAQ,GAAG,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,OAAO,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,4BAA4B;WAChG,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2CAA2C,CACzD,kBAA0B,EAC1B,mBAA2B,EAC3B,SAAiB,EACjB,WAAiB;IAEjB,OAAO,+BAA+B,CACpC,GAAG,sBAAsB,CAAC,oCAAoC,IAAI,kBAAkB,IAAI,mBAAmB,IAAI,SAAS,IAAI,WAAW,CAAC,WAAW,EAAE,EAAE,CACxJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAM1C;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAE1E,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;YACvF,OAAO,EAAE;gBACP,MAAM,EAAE,8DAA8D;gBACtE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;gBAC1B,aAAa,EAAE,UAAU,CAAC,MAAM,IAAI,IAAI;gBACxC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,mBAAmB,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC;aACzD;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;IAEnF,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,CAAC,4BAA4B,CAAC,GAAG,4BAA4B,CAChE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAClE,CAAC;IACJ,CAAC;IAED,yHAAyH;IACzH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,UAAU,CAAC,4BAA4B,IAAI,+BAA+B,CAAC,UAAgD,EAAE,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;QACxJ,KAAK,CAAC,sCAAsC,CAAC,GAAG,GAAG,CAAC;IACtD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAAC,MAgBpE;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEhG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,8FAA8F;sBAC5F,uFAAuF;gBAC3F,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,2CAA2C,CAAC;QAChD,aAAa,EAAE,UAAU,CAAC,GAAG;QAC7B,aAAa,EAAE,UAAU,CAAC,QAAQ;QAClC,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,8CAA8C;QAC9C,SAAS,EAAE,UAAU,CAAC,QAAQ;QAC9B,UAAU;QACV,gBAAgB;QAChB,iCAAiC,EAAE,GAAG,EAAE,CAAC,6CAA6C,CAAC,MAAM,CAAC,kCAAkC,EAAE,CAAC;QACnI,oBAAoB,EAAE,0BAA0B,CAAC,KAAK,CAAC;QACvD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,qDAAqD,CAAC,MAU3E;IACC,MAAM,EACJ,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAC5E,kCAAkC,GACnC,GAAG,MAAM,CAAC;IAEX,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACxD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,6FAA6F;sBAC3F,6FAA6F;sBAC7F,eAAe;gBACnB,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,aAAa,EAAE,UAAU,CAAC,KAAK;QAC/B,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,+FAA+F;QAC/F,SAAS,EAAE,UAAU,CAAC,KAAK;QAC3B,UAAU;QACV,eAAe;KAChB,CAAC;IAEF,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC;QAAE,OAAO;IAE/D,MAAM,kDAAkD,CAAC;QACvD,GAAG,UAAU;QACb,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,cAAc;QACd,gBAAgB,EAAE,MAAM,6CAA6C,CAAC,kCAAkC,EAAE,CAAC;QAC3G,2FAA2F;QAC3F,uBAAuB,EAAE,gBAAgB;QACzC,oBAAoB,EAAE,0BAA0B,CAAC,KAAK,CAAC;QACvD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,+FAA+F;QAC/F,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW;KAC/C,CAAC,CAAC;AACL,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,SAAS,kCAAkC,CACzC,UAA8C,EAC9C,SAAoB;IAEpB,MAAM,MAAM,GAAiC,EAAE,CAAC;IAEhD,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,2BAAkF,CAAC;IACvF,MAAM,kCAAkC,GAAG,GAA8C,EAAE,CACzF,CAAC,2BAA2B,KAAK,SAAS,CAAC,GAAG,CAC5C,kBAAkB,CAAC,2BAA2B,CAC/C,CAAC,CAAC;IAEL,IAAI,wCAAwC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5E,MAAM,2BAA2B,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,8CAA8C,CAAC;YAC7C,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,2BAA2B,EAAE;YAC9C,kCAAkC;SACnC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,8FAA8F;IAC9F,gGAAgG;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,kFAAkF;IAClF,IAAI,+CAA+C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnF,MAAM,0BAA0B,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE;YACxE,8FAA8F;YAC9F,kFAAkF;YAClF,IAAI,uCAAuC,CAAC,UAAU,CAAC;gBAAE,OAAO;YAChE,MAAM,6CAA6C,CAAC;gBAClD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBACrC,UAAU;gBACV,6FAA6F;gBAC7F,iEAAiE;gBACjE,2BAA2B,EAAE,kCAAkC,EAAE;gBACjE,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW;gBAC9C,oBAAoB,EAAE,0BAA0B,CAAC,KAAK,CAAC;gBACvD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,0BAA0B,EAAE;gBAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACvB,yFAAyF;oBACzF,mFAAmF;oBACnF,uFAAuF;oBACvF,wEAAwE;oBACxE,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;wBAC7C,IAAI,CAAC;4BACH,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;iCAC9E,iCAAiC,CAAC;gCACjC,cAAc,EAAE,MAAM,CAAC,cAAc;gCACrC,oFAAoF;gCACpF,yDAAyD;gCACzD,UAAU,EAAE,uCAAuC,CAAC,wBAAwB;gCAC5E,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gCACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;gCACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gCACrC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC;6BACtC,EAAE,gBAAgB,CAAC,CAAC;wBACzB,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,yEAAyE;4BACzE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,iEAAiE,EAAE;gCACvF,MAAM,EAAE,uDAAuD;gCAC/D,cAAc,EAAE,MAAM,CAAC,cAAc;gCACrC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gCACrC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;6BAClC,CAAC,CAAC;wBACL,CAAC;wBAED,uFAAuF;wBACvF,wEAAwE;wBACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CACnB,wFAAwF,EACxF;4BACE,MAAM,EAAE,wDAAwD;4BAChE,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;4BACrC,MAAM,EAAE,uEAAuE;yBAChF,CACF,CAAC;oBACJ,CAAC,CAAC;oBAEF,yFAAyF;oBACzF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,0FAA0F;oBAC1F,0FAA0F;oBAC1F,2FAA2F;oBAC3F,gFAAgF;oBAChF,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;oBACtD,IAAI,WAAW,EAAE,CAAC;wBAChB,mCAAmC,CAAC,WAAW,EAAE;4BAC/C,GAAG,EAAE,mDAAmD,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;kCAC3F,IAAI,UAAU,CAAC,mBAAmB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE;4BAC3F,OAAO,EAAE,YAAY;yBACtB,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBACD,MAAM,YAAY,EAAE,CAAC;gBACvB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,gDAAgD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpF,MAAM,sBAAsB,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,qDAAqD,CAAC;YACpD,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,sBAAsB,EAAE;YACzC,kCAAkC;SACnC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8CAA8C,CAC5D,UAAiJ;IAEjJ,MAAM,+BAA+B,GAAG,+CAA+C,CAAC,UAAU,CAAC,kBAAkB,CAAC;WACjH,gDAAgD,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACrF,MAAM,YAAY,GAA2B;QAC3C,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,UAAU,CAAC,oCAAoC,IAAI,EAAE,CAAC;QAC1D,0GAA0G;QAC1G,GAAG,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,IAAI,YAAY,KAAK,UAAU,CAAC,kBAAkB;YAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,MAAM,cAAc,GAAG,qCAAqC,CAAC,UAAU,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE;QACnG,MAAM,WAAW,GAAG,kCAAkC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE9E,OAAO,yCAAyC,CAAC;YAC/C;;;;;;eAMG;YACH,GAAG,CAAC,UAAU,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,oBAAoB;gBACzE,CAAC,CAAC;oBACA,eAAe,EAAE,KAAK,EAAE,MAA+B,EAAE,gBAAuC,EAAE,KAAmD,EAAE,EAAE;wBACvJ,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;wBACvG,MAAM,6CAA6C,CAAC;4BAClD,gBAAgB;4BAChB,YAAY,EAAE,KAAK,CAAC,YAAY;4BAChC,MAAM,EAAE,MAAe;4BACvB,cAAc,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CACnE,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAW,CAC3I;4BACD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;yBACpD,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,CAAC,CAAC,EAAE,CAAC;YACP,aAAa,EAAE;gBACb,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB,EAAE,IAAI;aACwB;YAClD,UAAU,EACR,UAAU,CAAC,UAAU;mBAClB,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,mBAAmB,oBAAoB;YACnG,2FAA2F;YAC3F,2FAA2F;YAC3F,6FAA6F;YAC7F,4DAA4D;YAC5D,mBAAmB,EAAE,cAAc;YACnC,wFAAwF;YACxF,yFAAyF;YACzF,6DAA6D;YAC7D,EAAE;YACF,6GAA6G;YAC7G,gHAAgH;YAChH,yGAAyG;YACzG,4GAA4G;YAC5G,wCAAwC;YACxC,EAAE;YACF,qFAAqF;YACrF,0EAA0E;YAC1E,sFAAsF;YACtF,2FAA2F;YAC3F,uFAAuF;YACvF,2FAA2F;YAC3F,gHAAgH;YAChH,kHAAkH;YAClH,0GAA0G;YAC1G,oHAAoH;YACpH,iDAAiD;YACjD,qBAAqB,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC,EAAE;YAC9E,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,8CAA8C,CAAC,UAAU,CAAC;YACnF,QAAQ,EAAE;gBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBAClF,0FAA0F;oBAC1F,uFAAuF;oBACvF,sFAAsF;oBACtF,EAAE;oBACF,6GAA6G;oBAC7G,+GAA+G;oBAC/G,gHAAgH;oBAChH,gHAAgH;oBAChH,iDAAiD;oBACjD,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;oBACtD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;wBACpC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;4BAC1E,OAAO,EAAE;gCACP,OAAO,EACL,GAAG,UAAU,CAAC,mBAAmB,oDAAoD;sCACnF,uBAAuB;gCAC3B,MAAM,EAAE,wCAAwC;gCAChD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,kBAAkB,EAAE,0BAA0B,CAAC,GAAG,CAAC;6BACpD;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,8BAA8B,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;oBAE3F,0FAA0F;oBAC1F,yFAAyF;oBACzF,4DAA4D;oBAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,aAA6C,CAAC;oBACvE,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,wGAAwG;wBACxG,2GAA2G;wBAC3G,wGAAwG;wBACxG,oGAAoG;wBACpG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,6BAA6B,CAAC,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;4BAC3H,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;gCACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gCACvF,OAAO,EAAE;oCACP,MAAM,EAAE,kDAAkD;oCAC1D,YAAY,EAAE,UAAU,CAAC,kBAAkB;oCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;oCACnD,UAAU,EAAE,iBAAiB;iCAC9B;6BACF,CAAC,CAAC;wBACL,CAAC;wBACD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;4BAC7D,OAAO,EAAE;gCACP,MAAM,EAAE,6CAA6C;gCACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,iBAAiB;6BAC9B;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,KAAK,GAAG,0BAA0B,CAAC;wBACvC,UAAU;wBACV,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;wBACrD,KAAK;wBACL,gBAAgB;wBAChB,KAAK;qBACN,CAAC,CAAC;oBACH,oGAAoG;oBACpG,IAAI,UAAU,CAAC,oBAAoB,EAAE,CAAC;wBACpC,KAAK,CAAC,YAAY,CAAC,GAAG,MAAM,UAAU,CAAC,oBAAoB,CAAC;4BAC1D,UAAU,EAAE,EAAE,GAAI,UAAsC,EAAE,GAAG,EAAE,iBAAiB,EAAE;4BAClF,KAAK;4BACL,SAAS;yBACV,CAAC,CAAC;oBACL,CAAC;oBAED,uFAAuF;oBACvF,qFAAqF;oBACrF,8EAA8E;oBAC9E,KAAK,MAAM,oBAAoB,IAAI,WAAW,EAAE,CAAC;wBAC/C,MAAM,oBAAoB,CAAC;4BACzB,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;4BACrD,kFAAkF;4BAClF,6DAA6D;4BAC7D,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;4BAC/B,gBAAgB;4BAChB,KAAK;yBACN,CAAC,CAAC;oBACL,CAAC;oBAED,mFAAmF;oBACnF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,8FAA8F;oBAC9F,sFAAsF;oBACtF,2FAA2F;oBAC3F,sFAAsF;oBACtF,yFAAyF;oBACzF,wFAAwF;oBACxF,gFAAgF;oBAChF,0FAA0F;oBAC1F,+DAA+D;oBAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;oBACtD,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;4BAC7E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;4BACjE,OAAO,EAAE;gCACP,OAAO,EACL,6EAA6E;sCAC3E,uCAAuC;gCAC3C,MAAM,EAAE,uDAAuD;gCAC/D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;gCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;6BAC5D;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,8FAA8F;oBAC9F,MAAM,gBAAgB,GAAG,CAAC,gBAAyC,EAAiB,EAAE;wBAChF,MAAM,WAAW,GAAG,KAAK,CAAC,sCAAsC,CAAC,CAAC;wBAClE,OAAO,gBAAgB;6BACpB,oCAAoC,CAAC,8BAA8B,CAAC;4BACnE,UAAU;4BACV,SAAS,EAAE,iBAAiB;4BAC5B,gBAAgB;4BAChB,cAAc,EAAE,MAAM,CAAE,UAAmC,CAAC,MAAM,IAAI,EAAE,CAAC;4BACzE,8FAA8F;4BAC9F,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;4BACtC,2EAA2E;4BAC3E,4EAA4E;4BAC5E,qBAAqB;4BACrB,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;4BAC9C,uBAAuB,EACrB,KAAK,CAAC,4BAA4B,CAAC,YAAY,IAAI;gCACjD,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAS;gCAC7C,CAAC,CAAC,SAAS;4BACf,iBAAiB,EAAG,UAA2C,CAAC,cAAoC;yBACrG,CAAC,EAAE,gBAAgB;wBACpB,wGAAwG;wBACxG,wGAAwG;wBACxG,WAAW,YAAY,IAAI;4BACzB,CAAC,CAAC,EAAE,OAAO,EAAE,2CAA2C,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE;4BACzK,CAAC,CAAC,SAAS,CAAC,CAAC;oBACvB,CAAC,CAAC;oBACF,mFAAmF;oBACnF,wEAAwE;oBACxE,MAAM,4BAA4B,GAAG,CAAC,KAAc,EAAQ,EAAE;wBAC5D,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kDAAkD,EAAE;4BACxE,MAAM,EAAE,kDAAkD;4BAC1D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;4BACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;4BAC3D,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;yBAClC,CAAC,CAAC;oBACL,CAAC,CAAC;oBACF,kHAAkH;oBAClH,8GAA8G;oBAC9G,mCAAmC,CAAC,WAAW,EAAE,0BAA0B,CAAC;wBAC1E,GAAG,EAAE,8BAA8B,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;8BACtE,IAAI,UAAU,CAAC,mBAAmB,IAAI,iBAAiB,EAAE;wBAC7D,OAAO,EAAE,KAAK,IAAI,EAAE;4BAClB,IAAI,CAAC;gCACH,MAAM,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC;4BACtG,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,4BAA4B,CAAC,KAAK,CAAC,CAAC;4BACtC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,qBAAqB,CAAC;4BAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,aAAa;4BACvG,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;4BAC5F,MAAM,EAAE,gBAAgB;4BACxB,SAAS,EAAE,iBAAiB;4BAC5B,SAAS,EAAE,4BAA4B;yBACxC,CAAC;qBACH,CAAC,CAAC,CAAC;oBAEJ,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,2GAA2G;gBAC3G,+GAA+G;gBAC/G,wGAAwG;gBACxG,yGAAyG;gBACzG,2GAA2G;gBAC3G,+GAA+G;gBAC/G,2DAA2D;gBAC3D,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBACvF,IAAI,SAAS,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBACjD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;4BAC7D,OAAO,EAAE;gCACP,MAAM,EAAE,6CAA6C;gCACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,GAAG;6BAChB;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;wBACtB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;4BACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;4BACvF,OAAO,EAAE;gCACP,MAAM,EAAE,kDAAkD;gCAC1D,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,sBAAsB,CAAC,GAAG,CAAC;6BACxC;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,SAAS,CAAC;gBACnB,CAAC;aACF;YACD;;;;;;;;;;;;;;;;eAgBG;YACH,sCAAsC,EAAE,qCAAqC,CAAC;gBAC5E,MAAM,EAAE,4CAA4C;gBACpD,IAAI,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,CAAC,6CAA6C,CACxF,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAC1D;gBACD,kBAAkB,EAAE,yBAAyB;aAC9C,CAAC;SACH,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,6CAA6C,CAC1D,UAA8C,EAC9C,iBAAyB,EACzB,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAClG,IAAI,CAAC,UAAU,IAAI,OAAQ,UAAiC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,gDAAgD,CAAC,CAAC;IAC5I,CAAC;IACD,MAAM,GAAG,GAAG,MAAO,UAAwF;SACxG,IAAI,CAA8C,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC1F,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,6BAA6B,CAC1C,UAA8C,EAC9C,iBAAyB,EACzB,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAClG,IAAI,CAAC,UAAU,IAAI,OAAQ,UAAiC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC/F,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;IACtD,MAAM,GAAG,GAAG,MAAO,UAAuG;SACvH,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,OAAO,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAU9C;IACC,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAC1D,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAClE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,iGAAiG;QACjG,+FAA+F;QAC/F,wDAAwD;QACxD,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACzD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,eAAe;QAChD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,cAAc,EAAE,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,gBAAgB,EAAE,YAAY,EAAE,cAAc;KAClG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,SAAiE,EACjE,UAAkG,EAClG,SAAiB,EACjB,WAAiB;IAEjB,OAAO,SAAS,CAAC,qBAAqB,CACpC,2CAA2C,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,CACnJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,MAAM,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA6F,EAC7F,GAA4B,EAC5B,WAAiB;IAEjB,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1I,MAAM,cAAc,GAAG,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;WAC/E,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,IAAI,8CAA8C,CAAC;IAC7G,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,IAAI,cAAc,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC1D,OAAO,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,MAO3D;IACC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAChD,IAAI,UAAU,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,UAAU,UAAU,CAAC,mBAAmB,CAAC,MAAM,kEAAkE,CAAC,CAAC;IAClM,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,CAAC,SAAS,CAAC,oCAAoC,CAAC,8BAA8B,CAAC;QACzF,UAAU;QACV,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAE;QAClD,SAAS,EAAE,MAAM,CAAC,aAAa;QAC/B,iBAAiB,EAAE,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE;QAC3B,OAAO,EAAE,2CAA2C,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC;KAC5J,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uCAAuC,CACrD,WAA0D;IAE1D,OAAO,WAAW,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["/**\n * The shared implementation behind every account/entity lifecycle verb.\n *\n * ## What these verbs have in common\n *\n * SUSPEND, ACTIVATE, REACTIVATE, DEACTIVATE_ACCOUNT and their siblings differ only in which status\n * they write and which statuses they accept as a starting point. Each one validates a transition,\n * then writes `{status}` plus at most a scheduling date. Hand-rolling that per verb is how the\n * catalogue drifted in the first place: on 2026-08-01 a sweep found thirteen routed lifecycle\n * variants that declared a request contract, persisted nothing, and answered HTTP 200 — an operator\n * told a CRITICAL suspension had taken effect while the tenant kept serving.\n *\n * One factory, one place where the rules live.\n *\n * ## Why the transition is re-checked here, when `enabledCondition` already gates it\n *\n * It is a fail-closed backstop, NOT a duplicated rule. A custom implementation is addressed by an\n * EXACT operation-path key, so it runs for that path regardless of how the path was reached, while\n * `enabledCondition` is evaluated by the URL-facing dispatch. The organization-members config\n * records the same reasoning for why a role-change verb would not inherit UPDATE's ceiling gate.\n * The two also read different things: the gate sees the pre-fetched object, this sees the row the\n * write is actually about to land on.\n *\n * The rule itself is not duplicated — `allowedFromStatuses` is declared once per registration, and\n * the operation's `enabledCondition` is authored from the same set.\n *\n * ## Why `authoritativeFields` is mandatory here\n *\n * Every status field these verbs write is `.excludeFromUpdate()` — that is the whole reason the\n * verbs exist rather than letting a client PATCH the field. The repository re-parses every write\n * against the operation's `requestDto`, which names no status, so without an explicit declaration\n * the value survives only by being inferred as \"a key the hook added\". That inference is defeated\n * by any caller who reaches the service tier with the key already in the payload, and the write\n * silently becomes empty. See `resolveServerInjectedFieldAllowList` for the full mechanism.\n *\n * ## The trail is registered in the PREFIX and executes on COMMIT\n *\n * Both halves of that matter, and neither works alone:\n *\n *  - **Registered in the prefix**, because that is the only phase that can see the caller's\n *    `reason` / `suspensionReason`. The POSTFIX input is typed `z.infer<TOutput>` — the persisted\n *    row — and these are not schema columns, so they appear on neither. Decision D2 named the trail\n *    as their home; this is what actually puts them there.\n *  - **Executed on commit**, because the prefix runs BEFORE persistence. Emitting there directly\n *    would leave an audit row asserting a suspension that never happened whenever the write failed\n *    — evidence of a state change nobody made, which is worse than no record.\n *\n * `registerTransactionPostCommitEffect` gives both, which is why this factory declares\n * `transactionalCore`. Note this changes NO deployment's transaction posture: the core engine\n * already declares transaction-requiring boundaries unconditionally (organization\n * activate/suspend/request_deletion/restore, organization-units MOVE, platform-access grants,\n * organization-member writes), so `validateInitializedRuntimeTransactionReadiness` already probes\n * every adapter at startup and a store that cannot commit already fails there. An earlier revision\n * of this comment claimed the opposite and used it to defer the fix — that was wrong, and it is\n * recorded here so the claim is not made a second time.\n *\n * The status the patch carries is the persisted FACT once the effect runs, not merely the intent: `status` is\n * declared in `authoritativeFields`, so the strict re-parse cannot strip the patch, and the startup\n * guard proves every declared name is a real persisted field of the resource. That status is `targetStatus`,\n * unless the definition declares `resolveLandingStatus` — then it is the resolved landing status (#1597).\n *\n * ## Why the administrative floors are enforced HERE and not per verb\n *\n * `status` is one of the two axes that decide whether a principal is an administratively usable\n * administrator — of the APPLICATION (with `appRoles`) or of ONE ORGANIZATION (with a membership's\n * `roles`) — and every verb served by this factory writes it. Both floors were originally wired onto\n * their resource's core `UPDATE`, but a custom implementation resolves by an EXACT operation-path\n * key, so neither extended to anything else:\n *\n *  - `PUT /users/{id}/suspend-user` reached the same `status` field through this registration and\n *    returned 200 on the LAST usable super-administrator, leaving an application with no principal\n *    able to administer it and no in-product recovery door (every one is gated on the role now\n *    unusable). Proven end-to-end before it was fixed.\n *  - `organizationMembers | suspend` was the exact sibling: it strands ONE tenant, and\n *    `ORGANIZATION_MEMBERS` declares no super-admin variant, so a platform administrator who is not\n *    a member cannot re-own the stranded organization afterwards. Recovery exists, but only from\n *    OUTSIDE the tenant: `organizationMembers.grantOwnership` is platform-tier.\n *\n * Placing the calls in the SHARED implementation rather than on each verb covers every current and\n * future status verb on every governed resource at once, which is the only version of this fix that\n * cannot be re-opened by the next lifecycle verb somebody adds. Each floor is gated on the subject\n * resource because the floors are scoped invariants while this factory is generic — see\n * {@link resolveStatusTransitionFloorGuards}.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — access-affecting lifecycle\n * changes run through one guarded authority that records what happened, rather than a generic field\n * write, and may not retire the last accountable administrative principal of an application or of a\n * tenant.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  AdministrativeContinuityBreachDetection,\n  CoreAuditableEventType,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ExecutionContext_ExecutionType,\n  ResourceOperationVariantType,\n  type ResourceConfiguration_OperationPath,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  assertSuperAdminFloorPreservedForTransition,\n  createSuperAdminConferralResolver,\n  isSuperAdminFloorGovernedSubjectResource,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n  assertOrganizationOwnerFloorPreservedForTransition,\n  createOrganizationOwnerConferralResolver,\n  createOrganizationOwnerFloorPopulationContext,\n  isOrganizationOwnerFloorAuthorityBearingResource,\n  isOrganizationOwnerFloorGovernedSubjectResource,\n  reportOrganizationsStrandedByUserDeactivation,\n  isAdministrativelyUsableOwnerUserStatus,\n  membershipTransitionCouldReduceOwners,\n  ORGANIZATION_OWNER_FLOOR_TRANSACTION_PARTICIPANTS,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\nimport { deriveDeterministicAuditEventId, type AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { assertManageRelationshipRepresentativesTarget } from '~wildo-backend-lib/organizations/organization-relationships/relationship-capability-target.backend.utils';\nimport {\n  CONDITIONAL_ADDRESSING_PRECONDITION_NOT_MET_REASON,\n  describeUnaddressableShape,\n  resolveSingleSubjectId,\n} from '~wildo-backend-lib/base-classes/utils/single-subject-addressing.backend.utils';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport { auditRecordingCapture, capturablePostCommitEffect } from '~wildo-backend-lib/base-classes/services/services/post-commit-effect-capture.backend';\nimport { POST_COMMIT_EFFECT_CAPTURE_PARTICIPANTS } from '~wildo-backend-lib/base-classes/services/services/resource-operation-transaction-persistence.backend.utils';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  carriesAttemptUpdateStamp,\n  createTransactionalCoreCommitReadBack,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-commit-outcome.backend.utils';\nimport { resolveAuditActorId } from '~wildo-backend-lib/compliance/audit-trails/utils/audit-actor.backend.utils';\nimport { engineRepositoriesRegistry } from '~wildo-backend-lib/base-classes/services/services/engine-repositories-registry.backend.utils';\n\n/** The status field every lifecycle-bearing resource in the engine uses. */\nconst STATUS_FIELD = 'status';\n\n/**\n * The caller's justification for a transition, under whichever name its verb gives it.\n *\n * `suspend` calls it `suspensionReason`; the others call it `reason`. Both spellings are read here\n * rather than threaded through each definition, because the value has ONE destination — the audit\n * row — and the request-contract vocabulary is a per-verb surface detail, not a semantic difference.\n * It is never persisted on the row: a suspension reason is a compliance artefact nothing reads back,\n * so a schema column would only create something an erasure would later have to scrub.\n */\nfunction resolveAuthoredTransitionReason(input: unknown): string | undefined {\n  if (!input || typeof input !== 'object') return undefined;\n  const payload = input as { reason?: unknown; suspensionReason?: unknown };\n  const authored = payload.suspensionReason ?? payload.reason;\n  return typeof authored === 'string' && authored.length > 0 ? authored : undefined;\n}\n\n/**\n * How a verb's request contract expresses \"and automatically undo this later\".\n *\n * The persisted field is always `scheduledReactivationAt` — named for the effect so one field and\n * one sweep serve every verb — but the caller-facing vocabulary differs per verb, and one of them\n * is not even an instant. Translating here keeps each request contract in its own natural terms\n * while the row stays uniform, the same split `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in,\n * `parentUnitId` + `path` persisted).\n */\nexport enum StatusTransitionScheduleSource {\n  /** The contract carries an absolute instant (`suspensionEndDate`, `reactivationDate`). */\n  ABSOLUTE_DATE = 'absolute_date',\n  /**\n   * The contract carries a whole number of DAYS (`suspensionDuration`), resolved to an instant at\n   * write time. A duration is meaningless without the moment it is measured from, and the row\n   * records no such moment — so resolving it later would be guesswork.\n   */\n  DURATION_IN_DAYS = 'duration_in_days',\n}\n\n/**\n * What a verb DOES to the pending schedule — the discriminator of\n * {@link ResourceStatusTransitionScheduling}.\n *\n * A named vocabulary rather than an inline `'set' | 'clear'` union, for the same reason\n * {@link StatusTransitionScheduleSource} is one: it is a closed set with exactly one runtime source,\n * so every definition, every narrow, and every test fixture derives from here instead of re-spelling\n * the literal. The two axes are independent — `source` says how the caller EXPRESSES a schedule,\n * this says whether the verb writes one at all.\n */\nexport enum StatusTransitionScheduleMode {\n  /** Carry a caller-supplied schedule onto the row. */\n  SET = 'set',\n  /**\n   * Clear any pending schedule. Every \"undo\" verb uses this: a membership reactivated by hand must\n   * not still carry the date at which a sweep would have reactivated it anyway, or a later\n   * suspension would inherit a stale deadline.\n   */\n  CLEAR = 'clear',\n}\n\n/** The field the reactivation sweep reads. Declared once; every verb writes this same name. */\nconst SCHEDULED_REACTIVATION_FIELD = 'scheduledReactivationAt';\n\n/**\n * The stamp a scheduled lift leaves (#2881): when the SYSTEM performed the reactivation because the row's\n * {@link SCHEDULED_REACTIVATION_FIELD} had passed. Written only by a definition that declares\n * `recordsScheduledReactivation`, and only for that case (see {@link isScheduledReactivationBySystem}).\n */\nexport const SCHEDULED_REACTIVATION_PERFORMED_FIELD = 'scheduledReactivationPerformedAt';\n\nconst MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;\n\nexport type ResourceStatusTransitionScheduling =\n  | {\n      mode: StatusTransitionScheduleMode.SET;\n      /** The key in the operation's `requestDto` that carries it. */\n      requestField: string;\n      source: StatusTransitionScheduleSource;\n    }\n  | {\n      mode: StatusTransitionScheduleMode.CLEAR;\n    };\n\nexport interface ResourceStatusTransitionDefinition {\n  resourceIdentifier: CoreResourceType;\n  /** The custom verb this implements, e.g. `suspend`. */\n  operationIdentifier: string;\n  /** Written to `status` when the transition is legal. */\n  targetStatus: string;\n  /**\n   * The ONLY statuses this verb may run from. Anything else is a `CONFLICT`.\n   *\n   * Fail-closed by construction: an unlisted status is refused rather than allowed. Keep it\n   * identical to the operation's `enabledCondition` — the gate is the fast, user-facing rejection,\n   * this is the backstop that cannot be routed around.\n   */\n  allowedFromStatuses: readonly string[];\n  /** Optional time-boxing. Omit for a verb whose contract offers the caller no window. */\n  scheduling?: ResourceStatusTransitionScheduling;\n  /**\n   * Whether this transition REMOVES access rather than restoring it.\n   *\n   * Declared, not inferred. The obvious proxies are both wrong: \"sets a schedule\" happens to\n   * correlate today (you time-box a restriction) but is a coincidence of the current verbs, and\n   * \"target is not ACTIVE\" cannot be evaluated generically because each resource has its own\n   * status vocabulary. It only feeds the audit event's risk grading, where getting it backwards\n   * would file suspensions among routine reinstatements — so it is worth one explicit word per\n   * definition.\n   */\n  restrictsAccess: boolean;\n  /** Overrides the generated debug label when a resource needs a clearer one. */\n  debugLabel?: string;\n  /**\n   * The status this transition LANDS on for one row, when that can legitimately differ from `targetStatus`.\n   *\n   * Absent for every verb but one: reactivating a REPRESENTATIVE membership whose relationship has since ended, or whose\n   * person is no longer assigned, lands INACTIVE rather than ACTIVE (#1597) — see\n   * `resolveRepresentativeMembershipReactivationStatus`. The landing status is what is written, what the floor guards\n   * measure and what the audit row records. `allowedFromStatuses` still decides whether the verb may run at all.\n   */\n  resolveLandingStatus?: (params: {\n    currentRow: Record<string, unknown>;\n    utils: ResourceOperation_CustomImplementation_Utils;\n    container: Container;\n  }) => Promise<string>;\n  /** The resources `resolveLandingStatus` reads inside the transition's transaction. */\n  landingStatusTransactionParticipants?: Readonly<Record<string, CoreResourceType>>;\n  /**\n   * This verb is the one the reactivation sweep dispatches (#2881). When the system runs it on schedule, the patch also\n   * stamps {@link SCHEDULED_REACTIVATION_PERFORMED_FIELD}, and the transition's audit row is recorded under an id derived\n   * from that stamp (`scheduledReactivationTransitionAuditEventId`), so the sweep's repair of a lift whose commit outcome\n   * was unknown can find the lift and write its row exactly once. Only for a resource that declares the field.\n   *\n   * Why a stamp at all: the lift CLEARS `scheduledReactivationAt`, and nothing else on the row says that a lift happened\n   * or when, while `updatedAt` moves with every later write, so a key read from it would change under the repair and the\n   * row would be written twice. The stamp is written only by the scheduled lift, so it stays the lift's own.\n   */\n  recordsScheduledReactivation?: boolean;\n  /**\n   * #2886: a caller may ask for this verb's attempts to be CAPTURED (`postCommitEffectCaptureRequested`): the reactivation\n   * sweep does, for the lifts it dispatches. The verb then declares the post-commit effect outbox as a participant of its\n   * transaction, which is what startup validates and what lets the capture's rows commit with the lift. Declared, never\n   * inferred from `recordsScheduledReactivation`: the two are separate facts (a stamp the repair keys by, a caller that\n   * captures), and a verb could gain one without the other.\n   */\n  capturesPostCommitEffects?: boolean;\n}\n\n/**\n * A NARROW VIEW of the pre-operation snapshot — NOT a description of what the row contains.\n *\n * `utils.currentObject` comes from `fetchCurrentObjectForOperation`, which performs a full\n * `repository.read` on the addressed id, so the snapshot carries EVERY readable field of the row.\n * This type lists only what this implementation reads, and the authority fields are optional because\n * they exist on SOME governed resources and not others — not because a live row is expected to be\n * sparse. Test doubles for `currentObject` should mirror a persisted row, not this projection.\n *\n * The authority axes are read only by the floor guards (see {@link resolveStatusTransitionFloorGuards}):\n *\n * - `appRoles` — the APPLICATION axis, on `USERS` / `USER_SELF`. Those are two resource\n *   configurations over the SAME collection sharing `UserSchema` as their `mainSchema`, so the field\n *   is present through either door.\n * - `roles` + `organizationId` — the ORGANIZATIONS axis, on `ORGANIZATION_MEMBERS`. The first decides\n *   whether the row is an owner grant; the second names the population to measure.\n *\n * All three are typed `unknown` rather than `string[]`/`string` on purpose: this is the raw snapshot,\n * and each floor's own helpers are the authority on what a valid value is.\n */\ntype StatusBearingRow = {\n  _id: string;\n  status?: string;\n  appRoles?: unknown;\n  roles?: unknown;\n  organizationId?: unknown;\n};\n\n/**\n * Refuse a payload that already carries a field this verb owns.\n *\n * Defence in depth for the same hole `authoritativeFields` closes. With the declaration in place\n * such a payload is harmless — the hook's value wins — but the request is still malformed: passing\n * `status` to `suspend` asks the verb to do something other than suspend. A loud 400 beats\n * honouring one of two contradictory instructions, and it surfaces a caller who believes the field\n * is theirs to set.\n */\nfunction assertNoAuthoredFieldInRequest(\n  input: unknown,\n  authoredFields: readonly string[],\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): void {\n  if (!input || typeof input !== 'object' || Array.isArray(input)) return;\n\n  const offending = authoredFields.filter((field) =>\n    Object.prototype.hasOwnProperty.call(input, field));\n  if (offending.length === 0) return;\n\n  throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n    context: {\n      message:\n        `The '${definition.operationIdentifier}' operation owns ${offending.join(', ')} and does not `\n        + 'accept it from the caller',\n      reason: 'resource_status_transition_authored_field_in_request',\n      resourceType: definition.resourceIdentifier,\n      operationIdentifier: definition.operationIdentifier,\n      offendingFields: offending,\n    },\n  });\n}\n\n/** Resolve the caller's scheduling input to the absolute instant the sweep compares against. */\nfunction resolveScheduledReactivation(\n  scheduling: ResourceStatusTransitionScheduling,\n  input: unknown,\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Date | null {\n  // `null`, not `undefined`: the patch must actively CLEAR a stale deadline, and an `undefined`\n  // value is dropped by the write rather than unsetting the field.\n  if (scheduling.mode === StatusTransitionScheduleMode.CLEAR) return null;\n\n  const authored = (input as Record<string, unknown> | undefined)?.[scheduling.requestField];\n  if (authored === undefined || authored === null) return null;\n\n  if (scheduling.source === StatusTransitionScheduleSource.ABSOLUTE_DATE) {\n    const asDate = authored instanceof Date ? authored : new Date(String(authored));\n    if (Number.isNaN(asDate.getTime())) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        context: {\n          message: `${scheduling.requestField} is not a valid date`,\n          reason: 'resource_status_transition_invalid_schedule',\n          resourceType: definition.resourceIdentifier,\n          operationIdentifier: definition.operationIdentifier,\n        },\n      });\n    }\n    return asDate;\n  }\n\n  // DURATION_IN_DAYS — resolve against now, because the row records no other reference moment.\n  const days = typeof authored === 'number' ? authored : Number(authored);\n  if (!Number.isFinite(days) || days <= 0) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      context: {\n        message: `${scheduling.requestField} must be a positive number of days`,\n        reason: 'resource_status_transition_invalid_schedule',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        received: authored,\n      },\n    });\n  }\n  return new Date(Date.now() + days * MILLISECONDS_PER_DAY);\n}\n\n/**\n * The fields a definition writes — and therefore exactly what it must declare as authoritative.\n *\n * Derived rather than authored so the declaration cannot drift from the patch. A verb that gains a\n * schedule gains the declaration in the same edit.\n */\nexport function resolveStatusTransitionAuthoredFields(\n  definition: ResourceStatusTransitionDefinition,\n): string[] {\n  const fields = definition.scheduling\n    ? [STATUS_FIELD, SCHEDULED_REACTIVATION_FIELD]\n    : [STATUS_FIELD];\n  return definition.recordsScheduledReactivation ? [...fields, SCHEDULED_REACTIVATION_PERFORMED_FIELD] : fields;\n}\n\n/**\n * Whether this transition is the SYSTEM performing a scheduled reactivation (#2881): an internally initiated call (the\n * reactivation sweep's context) on a row whose `scheduledReactivationAt` has passed. An internally initiated context\n * names no person and no machine by construction (`ExecutionContext` refuses identity fields for that type), so the\n * execution type alone says the system acted; a lift an administrator, a machine or an inbound handler performs is a\n * decision with an actor and is never stamped. That matters because the stamp keys a trail row whose repair names the\n * system as the actor, so it may only mark lifts the system made.\n */\nexport function isScheduledReactivationBySystem(\n  currentRow: Record<string, unknown>,\n  executionContext: Pick<ExecutionContext<any>, 'executionType'>,\n  now: Date,\n): boolean {\n  const deadline = currentRow[SCHEDULED_REACTIVATION_FIELD];\n  const due = deadline instanceof Date ? deadline : typeof deadline === 'string' ? new Date(deadline) : undefined;\n  return executionContext.executionType === ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST\n    && due !== undefined && !Number.isNaN(due.getTime()) && due.getTime() <= now.getTime();\n}\n\n/**\n * The audit `eventId` of a scheduled lift's `RESOURCE_STATUS_TRANSITION_PERFORMED` row (#2881): derived from the row,\n * the verb and the instant the lift stamped, so the verb's own recording and the reactivation sweep's repair of a lift\n * whose commit outcome was unknown write ONE row between them. The instant is part of the key because a row is suspended\n * and lifted on schedule many times over its life, each lift its own occurrence.\n */\nexport function scheduledReactivationTransitionAuditEventId(\n  resourceIdentifier: string,\n  operationIdentifier: string,\n  subjectId: string,\n  performedAt: Date,\n): string {\n  return deriveDeterministicAuditEventId(\n    `${CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED}:${resourceIdentifier}:${operationIdentifier}:${subjectId}:${performedAt.toISOString()}`,\n  );\n}\n\n/**\n * Build the `prefixCoreOperations` patch for one transition.\n *\n * Exported for testing: it is the whole decision, and it is pure apart from the row it is handed.\n */\nexport function buildStatusTransitionPatch(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  input: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}): Record<string, unknown> {\n  const { definition, currentRow, input, executionContext, utils } = params;\n\n  if (!definition.allowedFromStatuses.includes(currentRow.status ?? '')) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n      context: {\n        reason: 'resource_status_transition_not_permitted_from_current_status',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n        currentStatus: currentRow.status ?? null,\n        targetStatus: definition.targetStatus,\n        allowedFromStatuses: [...definition.allowedFromStatuses],\n      },\n    });\n  }\n\n  const patch: Record<string, unknown> = { [STATUS_FIELD]: definition.targetStatus };\n\n  if (definition.scheduling) {\n    patch[SCHEDULED_REACTIVATION_FIELD] = resolveScheduledReactivation(\n      definition.scheduling, input, definition, executionContext, utils,\n    );\n  }\n\n  // #2881: a scheduled lift by the system leaves its stamp, which keys its trail row (see `recordsScheduledReactivation`).\n  const now = new Date();\n  if (definition.recordsScheduledReactivation && isScheduledReactivationBySystem(currentRow as unknown as Record<string, unknown>, executionContext, now)) {\n    patch[SCHEDULED_REACTIVATION_PERFORMED_FIELD] = now;\n  }\n\n  return patch;\n}\n\n/**\n * Refuse a transition that would leave the application with no administratively usable\n * super-administrator.\n *\n * ## Only the status axis moves\n *\n * These verbs write `status` and at most a schedule — never `appRoles`. So the roles are passed as\n * BOTH the previous and the next value: the transition check needs the authority axis to decide\n * whether the subject counted at all, and stating it unchanged is what makes \"this write cannot\n * touch conferral\" explicit rather than implied by omission.\n *\n * ## Cost\n *\n * `assertSuperAdminFloorPreservedForTransition` short-circuits before issuing any query unless the\n * subject counted toward the floor BEFORE the write and would stop counting after it. So an\n * ordinary user suspension, and every transition INTO the authenticable set (`unsuspend_user`,\n * whose subject was by definition not usable beforehand), pay two set-membership tests and nothing\n * else. Only the genuinely dangerous case reaches the population query.\n *\n * ## Fail closed on a snapshot without the authority axis\n *\n * `appRoles` is what the whole decision turns on. A snapshot that lacks it cannot answer whether\n * this subject is an administrator, and answering \"not an administrator\" would fail OPEN on exactly\n * the input the guard exists for. Refusing instead mirrors the sibling `users | DELETE` guard, and\n * costs nothing in practice: the field carries a `.default([APP_USER])` and both floor-governed\n * resources read the same `UserSchema`, so a live snapshot always carries it.\n *\n * Exported for testing: like {@link buildStatusTransitionPatch} it is the whole decision, and it is\n * pure apart from the row and the collaborators it is handed.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an account-lifecycle change\n * must not retire the last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesSuperAdminFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n  /**\n   * Resolved only once the subject is shown to be a counting super-administrator. The population is\n   * measured under the floor's SYSTEM context, never the caller's: `user_self | deactivate_account`\n   * carries the person's own context, which confines a USERS list to their own row and would count no\n   * other administrator at all. See {@link assertStatusTransitionPreservesOrganizationOwnerFloor},\n   * whose measurement made the same choice first.\n   */\n  resolveAuthExecutionContextFactory: () => AuthExecutionContextFactoryBackendService;\n}): Promise<void> {\n  const { definition, currentRow, nextStatus, executionContext, utils, conferringRoles } = params;\n\n  if (!Array.isArray(currentRow.appRoles)) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the application roles of the account being changed could not be read, so it cannot '\n          + 'be proven that this transition would not disable the last usable super-administrator.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  await assertSuperAdminFloorPreservedForTransition({\n    subjectUserId: currentRow._id,\n    previousRoles: currentRow.appRoles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction — see the header.\n    nextRoles: currentRow.appRoles,\n    nextStatus,\n    executionContext,\n    resolvePopulationExecutionContext: () => createOrganizationOwnerFloorPopulationContext(params.resolveAuthExecutionContextFactory()),\n    repositoriesRegistry: engineRepositoriesRegistry(utils),\n    errorBuilder: utils.errorBuilder,\n    conferringRoles,\n    operationIdentifier: definition.operationIdentifier,\n  });\n}\n\n/**\n * Refuse a transition that would leave an organization with no administratively usable owner.\n *\n * The ORGANIZATION-scope twin of {@link assertStatusTransitionPreservesSuperAdminFloor}, and the\n * differences are all consequences of the population being per-tenant rather than per-application:\n *\n * - **The subject names its own population.** `organizationId` selects which tenant to measure, so a\n *   snapshot without it cannot be evaluated at all — unlike the application floor, where there is\n *   only ever one population.\n * - **The measurement runs under a SYSTEM context, not the caller's.** The floor must see every owner\n *   membership AND the `status` of every one of those owners' `User` rows, and the `ORG_ADMIN`s who\n *   reach these verbs cannot list `USERS` at all. The authority owns that decision — see\n *   {@link createOrganizationOwnerFloorPopulationContext}.\n * - **The short-circuit is asked HERE, before the context is built.** Constructing the system context\n *   is a registry lookup plus a possible application-id resolution, and suspending an ordinary member\n *   — the overwhelmingly common case — must not pay for it. This is not a second copy of the rule:\n *   {@link membershipTransitionCouldReduceOwners} is the authority's own predicate, and the assertion\n *   below calls it again.\n *\n * Fails closed on a snapshot that carries no `roles` or no `organizationId`, for the reason the\n * application twin does: answering \"not an owner\" would fail OPEN on exactly the input the guard\n * exists for, and a suspended last owner cannot be reactivated by anyone — `ORGANIZATION_MEMBERS`\n * declares exactly one cross-tenant variant — `grantOwnership` — so recovery from a stranded state\n * is a platform-operator action, never a tenant one. That is why the in-tenant refusal still stands.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a membership-lifecycle change\n * must not retire a tenant's last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesOrganizationOwnerFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n  /** Resolved lazily and only once a reduction is established — see the header. */\n  resolveAuthExecutionContextFactory: () => AuthExecutionContextFactoryBackendService;\n}): Promise<void> {\n  const {\n    definition, currentRow, nextStatus, executionContext, utils, conferringRoles,\n    resolveAuthExecutionContextFactory,\n  } = params;\n\n  const organizationId = typeof currentRow.organizationId === 'string' ? currentRow.organizationId : undefined;\n\n  if (!Array.isArray(currentRow.roles) || !organizationId) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the roles or the owning organization of the membership being changed could not be '\n          + \"read, so it cannot be proven that this transition would not retire the organization's last \"\n          + 'usable owner.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  const transition = {\n    previousRoles: currentRow.roles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction: these verbs write `status` and at most a schedule, never `roles`.\n    nextRoles: currentRow.roles,\n    nextStatus,\n    conferringRoles,\n  };\n\n  if (!membershipTransitionCouldReduceOwners(transition)) return;\n\n  await assertOrganizationOwnerFloorPreservedForTransition({\n    ...transition,\n    memberId: currentRow._id,\n    organizationId,\n    executionContext: await createOrganizationOwnerFloorPopulationContext(resolveAuthExecutionContextFactory()),\n    // The refusal names the request, not the system read that measured the population (#3131).\n    requestExecutionContext: executionContext,\n    repositoriesRegistry: engineRepositoriesRegistry(utils),\n    errorBuilder: utils.errorBuilder,\n    operationIdentifier: definition.operationIdentifier,\n    // The transition's own transaction: the floor serializes concurrent reductions only inside it.\n    transaction: utils.serviceOptions?.transaction,\n  });\n}\n\n/**\n * One administrative floor a status transition must not breach, bound to a single definition.\n *\n * A list rather than a chain of `if`s inside the hook, because the set of floors that govern a row is\n * a property of the RESOURCE and is therefore decidable once, at factory construction, from static\n * data. Adding the next authority is one entry here — and, more to the point, a lifecycle verb added\n * to a governed resource inherits every floor automatically instead of depending on somebody\n * remembering to wire it. That omission is the whole defect class this file now closes.\n */\ntype StatusTransitionFloorGuard = (params: {\n  currentRow: StatusBearingRow;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}) => Promise<void>;\n\n/**\n * The floors that govern one definition's resource, resolved once when the factory is built.\n *\n * Every collaborator is bound LAZILY. Factories are constructed during module registration, which can\n * run before the authorization and authentication services are bound, so an eager `container.get`\n * would turn a guard into a startup crash. The conferral resolvers additionally re-read the live role\n * table on every call, because `initializeRolesWithCustom` mutates it in place.\n *\n * A resource governed by NO floor gets an empty list and pays nothing at all — not a container\n * lookup, not a closure invocation. That is the common case (organization units, and every\n * application resource that grows a lifecycle verb later).\n */\nfunction resolveStatusTransitionFloorGuards(\n  definition: ResourceStatusTransitionDefinition,\n  container: Container,\n): StatusTransitionFloorGuard[] {\n  const guards: StatusTransitionFloorGuard[] = [];\n\n  // Every floor below measures its population under a SYSTEM context the authority builds, so the\n  // factory that builds it is resolved lazily and once, and only by a guard that needs to measure.\n  let authExecutionContextFactory: AuthExecutionContextFactoryBackendService | undefined;\n  const resolveAuthExecutionContextFactory = (): AuthExecutionContextFactoryBackendService =>\n    (authExecutionContextFactory ??= container.get<AuthExecutionContextFactoryBackendService>(\n      SAAS_SERVICE_TYPES.AuthExecutionContextFactory,\n    ));\n\n  if (isSuperAdminFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const superAdminConferralResolver = createSuperAdminConferralResolver(container);\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesSuperAdminFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: superAdminConferralResolver(),\n        resolveAuthExecutionContextFactory,\n      }));\n  }\n\n  // ── USERS lifecycle: REPORT, never refuse ──────────────────────────────────────────────────\n  // A deactivated user stops counting as a usable owner, so this transition can strand a tenant —\n  // and unlike every other floor surface it must still be allowed to proceed. Suspension is normally\n  // incident response, and refusing it would mean an operator cannot lock out a compromised owner\n  // without first transferring ownership using the tenant the attacker controls. The stranded tenant\n  // is recoverable (boot report finds it, `grantOwnership` repairs it); the live hostile session is\n  // not. See `reportOrganizationsStrandedByUserDeactivation` for the full argument.\n  if (isOrganizationOwnerFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const strandingConferralResolver = createOrganizationOwnerConferralResolver(container);\n    guards.push(async ({ currentRow, nextStatus, executionContext, utils }) => {\n      // Asked here as well, so a reactivation never resolves the context factory. Not a second copy\n      // of the rule: it is the authority's own predicate, and the report asks it again.\n      if (isAdministrativelyUsableOwnerUserStatus(nextStatus)) return;\n      await reportOrganizationsStrandedByUserDeactivation({\n        subjectUserId: String(currentRow._id),\n        nextStatus,\n        // The report builds its own measuring context; `executionContext` stays the caller's for the\n        // audit row below, which must name who performed the transition.\n        authExecutionContextFactory: resolveAuthExecutionContextFactory(),\n        transaction: utils.serviceOptions?.transaction,\n        repositoriesRegistry: engineRepositoriesRegistry(utils),\n        errorBuilder: utils.errorBuilder,\n        conferringRoles: strandingConferralResolver(),\n        operationIdentifier: definition.operationIdentifier,\n        report: async (breach) => {\n          // An AUDIT ROW, not a log line — one per stranded tenant. The justification for allowing\n          // this write at all is that the consequence becomes visible, and a log line is not\n          // queryable evidence and never reaches a SIEM. `CRITICAL` + the AUTHORIZATION category\n          // route it through the same export path as every other authority event.\n          const recordBreach = async (): Promise<void> => {\n            try {\n              await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n                .logOrganizationOwnerFloorBreached({\n                  organizationId: breach.organizationId,\n                  // A guard SAW this one and let it through, which is what separates it from the boot\n                  // report's observation of a tenant stranded out-of-band.\n                  detectedBy: AdministrativeContinuityBreachDetection.ALLOWED_LIFECYCLE_ACTION,\n                  reducedMemberIds: breach.reducedMemberIds,\n                  remainingUsableOwners: breach.remainingUsableOwners,\n                  operationIdentifier: definition.operationIdentifier,\n                  subjectUserId: String(currentRow._id),\n                  subjectNextStatus: String(nextStatus),\n                }, executionContext);\n            } catch (error) {\n              // Loud, never thrown: the transition it describes has already committed.\n              utils.logger?.error?.('Failed to record an organization-owner-floor breach audit event', {\n                reason: 'organization_owner_floor_breach_audit_emission_failed',\n                organizationId: breach.organizationId,\n                subjectUserId: String(currentRow._id),\n                error: describeCaughtError(error),\n              });\n            }\n\n            // The log line stays as the operator-facing half: an audit row is for the auditor, and\n            // whoever is on call during an incident is reading logs, not the trail.\n            utils.logger?.error?.(\n              'Organization left with no administratively usable owner by a user lifecycle transition',\n              {\n                reason: 'organization_owner_floor_stranded_by_user_deactivation',\n                organizationId: breach.organizationId,\n                subjectUserId: String(currentRow._id),\n                remedy: 'organizationMembers.grantOwnership (platform-tier) restores an owner.',\n              },\n            );\n          };\n\n          // Recorded AFTER COMMIT (#2825). The report runs in the prefix, before the transition is\n          // written, and the audit row does not join the transaction: written here, it would survive\n          // a rollback and name a tenant stranded by a deactivation that never happened. Registered\n          // on the transaction, it runs only if the transition commits, and once more when a commit\n          // whose reply was lost is read back as landed (the framework drains it then). One key per\n          // subject and tenant, so the effect of one transition is never registered twice. Without a\n          // transaction (never on this verb, which owns its core) it is recorded at once.\n          const transaction = utils.serviceOptions?.transaction;\n          if (transaction) {\n            registerTransactionPostCommitEffect(transaction, {\n              key: `resource-status-transition:owner-floor-breached:${String(definition.resourceIdentifier)}`\n                + `:${definition.operationIdentifier}:${String(currentRow._id)}:${breach.organizationId}`,\n              execute: recordBreach,\n            });\n            return;\n          }\n          await recordBreach();\n        },\n      });\n    });\n  }\n\n  if (isOrganizationOwnerFloorAuthorityBearingResource(definition.resourceIdentifier)) {\n    const ownerConferralResolver = createOrganizationOwnerConferralResolver(container);\n\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesOrganizationOwnerFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: ownerConferralResolver(),\n        resolveAuthExecutionContextFactory,\n      }));\n  }\n\n  return guards;\n}\n\n/**\n * Every resource this definition's transactional core touches beyond its own: what `resolveLandingStatus` reads, and\n * the organization-owner floor's reads and serialization write when a floor guard forwards the transaction to it\n * (the stranding report on USERS / USER_SELF, the owner floor on ORGANIZATION_MEMBERS).\n *\n * Derived from the same governed-resource predicates that decide which guards run, so a definition that gains a\n * floor gains its participants with it. The operation's own resource is left out, since the framework includes it.\n * The super-admin floor forwards no transaction, so it adds none.\n */\nexport function resolveStatusTransitionTransactionParticipants(\n  definition: Pick<ResourceStatusTransitionDefinition, 'resourceIdentifier' | 'landingStatusTransactionParticipants' | 'capturesPostCommitEffects'>,\n): Readonly<Record<string, string>> {\n  const forwardsTransactionToOwnerFloor = isOrganizationOwnerFloorGovernedSubjectResource(definition.resourceIdentifier)\n    || isOrganizationOwnerFloorAuthorityBearingResource(definition.resourceIdentifier);\n  const participants: Record<string, string> = {\n    ...(forwardsTransactionToOwnerFloor ? ORGANIZATION_OWNER_FLOOR_TRANSACTION_PARTICIPANTS : {}),\n    ...(definition.landingStatusTransactionParticipants ?? {}),\n    // #2886: a verb whose attempts a caller captures keeps its kept effects in the post-commit effect outbox.\n    ...(definition.capturesPostCommitEffects ? POST_COMMIT_EFFECT_CAPTURE_PARTICIPANTS : {}),\n  };\n  for (const [key, resourceType] of Object.entries(participants)) {\n    if (resourceType === definition.resourceIdentifier) delete participants[key];\n  }\n  return Object.freeze(participants);\n}\n\n/**\n * One lifecycle transition, as a registrable custom implementation.\n *\n * Modelled on `createOrganizationUnitStatusTransitionFactory`, which established the pattern for\n * this engine: validate against the loaded row, then RETURN the field patch for the core UPDATE to\n * persist rather than writing directly. The difference is that this one is resource-agnostic and\n * declares `authoritativeFields`, which the org-units original did not need — its `status` is not\n * `.excludeFromUpdate()`, so its patch survived on the introduced-key inference alone.\n */\nexport function createResourceStatusTransitionFactory(\n  definition: ResourceStatusTransitionDefinition,\n): ResourceCustomServiceImplementationFactory {\n  const authoredFields = resolveStatusTransitionAuthoredFields(definition);\n\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) => {\n    const floorGuards = resolveStatusTransitionFloorGuards(definition, container);\n\n    return createResourceCustomServiceImplementation({\n      /*\n       * #1631 invariant 6 — a member suspend / reactivate reached through MANAGE_RELATIONSHIP_REPRESENTATIVES may only touch the\n       * actor's own relationship's representatives. A question of WHO may act on the row, so it is the target authority, answered\n       * before the transition's state is read (its `enabledCondition`, the legality refusal, the floors). As a floor guard\n       * it ran after them, so a representative outside its relationship learned the member's status before being refused\n       * (#2582 re-review F5). An actor without the capability (an administrator, the reactivation sweep) is never asked.\n       */\n      ...(definition.resourceIdentifier === CoreResourceType.ORGANIZATION_MEMBERS\n        ? {\n          authorizeTarget: async (target: Record<string, unknown>, executionContext: ExecutionContext<any>, utils: ResourceOperation_CustomImplementation_Utils) => {\n            const systemAccess = container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n            await assertManageRelationshipRepresentativesTarget({\n              executionContext,\n              errorBuilder: utils.errorBuilder,\n              target: target as never,\n              readMembership: (userId, organizationId) => systemAccess.readAsSystem(\n                CoreResourceType.ORGANIZATION_MEMBERS, { userId, organizationId }, { ...(utils.serviceOptions ?? {}), suppressSystemAudit: true } as never,\n              ),\n              operationIdentifier: definition.operationIdentifier,\n            });\n          },\n        }\n        : {}),\n      operationPath: {\n        resourceIdentifier: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      } as ResourceConfiguration_OperationPath<any, any>,\n      debugLabel:\n        definition.debugLabel\n        ?? `${String(definition.resourceIdentifier)}.${definition.operationIdentifier}.status-transition`,\n      // `status` and `scheduledReactivationAt` are `.excludeFromUpdate()` on every resource this\n      // serves. Without this the repository's strict re-parse drops the patch for any caller who\n      // reached the service tier with the key already present, and the verb answers success having\n      // changed nothing — the exact defect it was written to fix.\n      authoritativeFields: authoredFields,\n      // The audit row is registered from the PREFIX (the only phase that can see the caller's\n      // `reason`) and executes on COMMIT, so it never describes a write that rolled back. That\n      // needs a commit hook to exist, which is what this declares.\n      //\n      // Participants only when a definition resolves its landing status: the transition writes exactly one row, on\n      // the operation's own resource, which the framework includes automatically, and `resolveLandingStatus` may READ\n      // (and serialize on) others inside the same unit of work — it declares those. Contrast the ORGANIZATIONS\n      // lifecycle verbs, which name ORGANIZATION_MEMBERS + USERS because they reconcile membership-derived global\n      // `userTypes` in the same unit of work.\n      //\n      // This does NOT change any deployment's transaction posture: the core engine already\n      // declares transaction-requiring boundaries unconditionally (organization\n      // activate/suspend/request_deletion/restore, organization-units MOVE, platform-access\n      // grants, organization-member writes), so `validateInitializedRuntimeTransactionReadiness`\n      // already probes every adapter at startup and a store that cannot commit already fails\n      // there — see the `rejects transaction readiness against a standalone MongoDB server` pin.\n      // #2543: the starting states are a property of the WRITE, not only of the prefix's check. The prefix judges the\n      // row the transaction re-read (locked on PostgreSQL, a write conflict on MongoDB), which already refuses a second\n      // concurrent transition; this makes the single statement that writes refuse it too, inside a caller-owned\n      // transaction as well, so the guarantee does not rest on the transaction posture. A write it stops answers CONFLICT\n      // `conditional_addressing_precondition_not_met`.\n      coreWritePrecondition: { [STATUS_FIELD]: [...definition.allowedFromStatuses] },\n      transactionalCore: true,\n      transactionParticipants: resolveStatusTransitionTransactionParticipants(definition),\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          // Fail closed on anything but a single addressed row. An ids array or a population filter\n          // reaching this path would make the status check evaluate against the wrong thing — or\n          // against nothing — while still returning a patch the core write would happily apply.\n          //\n          // A conditional `{ _id, … }` filter is single-subject, and this check admits it: that is how a transition is\n          // written as a compare-and-swap (#2681). The core pre-fetches such a filter the way the write reads it, so the\n          // row below is the one the write lands on, and there is none when the other predicates no longer hold (answered\n          // CONFLICT below, not NOT_FOUND). A variant that declares a target authority (`organizationMembers`) judges the\n          // row the `_id` names first, whatever its state.\n          const subjectResourceId = resolveSingleSubjectId(_id);\n          if (subjectResourceId === undefined) {\n            throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n              context: {\n                message:\n                  `${definition.operationIdentifier} requires a single addressed resource to validate `\n                  + 'the status transition',\n                reason: 'resource_status_transition_unaddressed',\n                resourceType: definition.resourceIdentifier,\n                receivedAddressing: describeUnaddressableShape(_id),\n              },\n            });\n          }\n\n          assertNoAuthoredFieldInRequest(input, authoredFields, definition, executionContext, utils);\n\n          // The framework pre-fetches the target row for UPDATE-like operations, so this is the row\n          // the write is about to land on. Absent means the transition cannot be validated — which\n          // must never read as \"allowed\" on an access-affecting verb.\n          const currentRow = utils.currentObject as StatusBearingRow | undefined;\n          if (!currentRow) {\n            // A conditional addressing found no row the write would land on. If the row its `_id` names exists, the\n            // caller's precondition no longer holds: another writer moved it. That is a conflict the caller can act on\n            // (re-read, decide again), never a missing row, so it is told apart here with one read by the id alone.\n            // Nothing is written either way. A bare id was already read by that id, so it needs no second read.\n            if (typeof _id !== 'string' && await statusTransitionSubjectExists(definition, subjectResourceId, executionContext, utils)) {\n              throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n                customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n                context: {\n                  reason: CONDITIONAL_ADDRESSING_PRECONDITION_NOT_MET_REASON,\n                  resourceType: definition.resourceIdentifier,\n                  operationIdentifier: definition.operationIdentifier,\n                  resourceId: subjectResourceId,\n                },\n              });\n            }\n            throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n              context: {\n                reason: 'resource_status_transition_target_not_found',\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: subjectResourceId,\n              },\n            });\n          }\n\n          const patch = buildStatusTransitionPatch({\n            definition,\n            currentRow: { ...currentRow, _id: subjectResourceId },\n            input,\n            executionContext,\n            utils,\n          });\n          // Only after the legality check: a verb that may not run says so first. See `resolveLandingStatus`.\n          if (definition.resolveLandingStatus) {\n            patch[STATUS_FIELD] = await definition.resolveLandingStatus({\n              currentRow: { ...(currentRow as Record<string, unknown>), _id: subjectResourceId },\n              utils,\n              container,\n            });\n          }\n\n          // AFTER the transition-legality check on purpose: a verb refused because it cannot run\n          // from the current status should say so — the more specific finding — and should not\n          // have issued a floor's population query on the way to being rejected anyway.\n          for (const assertFloorPreserved of floorGuards) {\n            await assertFloorPreserved({\n              currentRow: { ...currentRow, _id: subjectResourceId },\n              // Read from the patch rather than re-derived from the definition, so no guard can\n              // measure a status other than the one about to be persisted.\n              nextStatus: patch[STATUS_FIELD],\n              executionContext,\n              utils,\n            });\n          }\n\n          // Trail the transition. Registered HERE — the only phase that can see the caller's\n          // `reason`, since the POSTFIX input is typed `z.infer<TOutput>` (the persisted row) and\n          // `reason` is not a schema column, so it appears on neither.\n          //\n          // It EXECUTES on commit, so it never describes a write that rolled back. That is why the\n          // registration declares `transactionalCore` above: without a commit hook the choice would\n          // be between emitting early (recording suspensions that later failed) and emitting from a\n          // postfix that cannot see the reason. With one, neither compromise is necessary.\n          //\n          // The patch's status is the persisted fact once this commits, not merely the intent: `status`\n          // is declared in `authoritativeFields`, so the patch cannot be stripped by the strict\n          // re-parse, and the startup guard proves every declared name is a real persisted field. It\n          // is `targetStatus`, or the resolved landing status when the definition declares one.\n          // Fail CLOSED on a missing transaction rather than skipping the trail. This registration\n          // declares `transactionalCore`, so the framework guarantees one; its absence means that\n          // contract is broken, and silently proceeding would perform an access-affecting\n          // transition with no record — the outcome the audit exists to make impossible. Same shape\n          // as `registerOrganizationLifecycleAudit` on the tenant verbs.\n          const transaction = utils.serviceOptions?.transaction;\n          if (!transaction) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n              context: {\n                message:\n                  'A status transition cannot be recorded: no transaction is active, but this '\n                  + 'operation declares transactionalCore.',\n                reason: 'resource_status_transition_audit_requires_transaction',\n                resourceType: String(definition.resourceIdentifier),\n                operationIdentifier: String(definition.operationIdentifier),\n              },\n            });\n          }\n\n          // The recording, as one closure the live effect runs and a captured attempt prepares (#2886).\n          const recordTransition = (auditLogsService: AuditLogsBackendService): Promise<void> => {\n                const performedAt = patch[SCHEDULED_REACTIVATION_PERFORMED_FIELD];\n                return auditLogsService\n                  .logResourceStatusTransitionPerformed(statusTransitionAuditEventData({\n                    definition,\n                    subjectId: subjectResourceId,\n                    executionContext,\n                    previousStatus: String((currentRow as { status?: unknown }).status ?? ''),\n                    // What was WRITTEN — equal to `targetStatus` unless the definition resolves a landing status.\n                    newStatus: String(patch[STATUS_FIELD]),\n                    // The field decision D2 promised the trail would carry. Both spellings are\n                    // accepted because the verbs differ: `suspend` names it `suspensionReason`,\n                    // the rest `reason`.\n                    reason: resolveAuthoredTransitionReason(input),\n                    scheduledReactivationAt:\n                      patch[SCHEDULED_REACTIVATION_FIELD] instanceof Date\n                        ? patch[SCHEDULED_REACTIVATION_FIELD] as Date\n                        : undefined,\n                    rowOrganizationId: (currentRow as { organizationId?: unknown }).organizationId as string | undefined,\n                  }), executionContext,\n                  // #2881: a scheduled lift by the system is recorded under the id its stamp derives, so the reactivation\n                  // sweep's repair of a lift whose commit outcome was unknown and this effect write ONE row between them.\n                  performedAt instanceof Date\n                    ? { eventId: scheduledReactivationTransitionAuditEventId(String(definition.resourceIdentifier), String(definition.operationIdentifier), subjectResourceId, performedAt) }\n                    : undefined);\n          };\n          // A trail failure must not fail the transition it describes — but it must be loud,\n          // so a dropped record reaches whoever is on call rather than vanishing.\n          const reportTransitionAuditFailure = (error: unknown): void => {\n            utils.logger?.error?.('Failed to record a status-transition audit event', {\n              reason: 'resource_status_transition_audit_emission_failed',\n              resourceType: String(definition.resourceIdentifier),\n              operationIdentifier: String(definition.operationIdentifier),\n              error: describeCaughtError(error),\n            });\n          };\n          // #2886: capturable. On a lift the reactivation sweep captures, the row is prepared inside the lift's transaction\n          // (under the stamp-derived id when there is one) and written once, by this effect or by the sweep's next run.\n          registerTransactionPostCommitEffect(transaction, capturablePostCommitEffect({\n            key: `resource-status-transition:${String(definition.resourceIdentifier)}`\n              + `:${definition.operationIdentifier}:${subjectResourceId}`,\n            execute: async () => {\n              try {\n                await recordTransition(container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService));\n              } catch (error) {\n                reportTransitionAuditFailure(error);\n              }\n            },\n            capture: auditRecordingCapture({\n              effect: `${String(definition.resourceIdentifier)}.${String(definition.operationIdentifier)} transition`,\n              auditLogs: () => container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService),\n              record: recordTransition,\n              subjectId: subjectResourceId,\n              onFailure: reportTransitionAuditFailure,\n            }),\n          }));\n\n          return patch;\n        },\n        // The audit row above is staged before the write, so it is only true if the write landed on a row. A write\n        // can find the row when it is read and miss it when it is written: on PostgreSQL under READ COMMITTED a writer\n        // that commits between the two moves the row out from under it — a conditional addressing's re-asserted\n        // predicates no longer match (#2681), and a bare id's row may have been deleted. Refusing here rolls the\n        // transaction back, and with it the staged audit row, so the trail never records a transition that did not\n        // happen. The answer names what happened: the row is gone (NOT_FOUND) for a bare id, the caller's precondition\n        // no longer holds (CONFLICT) for a conditional addressing.\n        postfixCoreOperations: async (_id, coreState, executionContext, _operationPath, utils) => {\n          if (coreState == null && typeof _id === 'string') {\n            throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n              context: {\n                reason: 'resource_status_transition_target_not_found',\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: _id,\n              },\n            });\n          }\n          if (coreState == null) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n              context: {\n                reason: CONDITIONAL_ADDRESSING_PRECONDITION_NOT_MET_REASON,\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: resolveSingleSubjectId(_id),\n              },\n            });\n          }\n          return coreState;\n        },\n      },\n      /*\n       * #2825: a transition whose commit threw after its write (the store lost its reply) may have happened. Told\n       * \"failed\", the person repeats it and is refused `not_permitted_from_current_status`, since the row already has\n       * the status they asked for; the reactivation sweep logs it as a failed lift. So the row is read back, outside the\n       * failed transaction, by the `updatedAt` this attempt's write stamped: both adapters stamp it on every update, every\n       * resource this factory serves declares it (organization members, users and the user self door, which reads the same\n       * users table), and nothing later in the attempt writes this row again (the floors write the ORGANIZATION row, the\n       * landing-status resolver only reads). The read is the row read the framework prefetched it with, under the caller's\n       * own execution context, through this resource's repository, so it works for every resource the factory is built for\n       * without a system grant (the user self door has none).\n       * - LANDED: the stored row is the answer, and the framework runs what the attempt registered after commit (the\n       *   transition audit row, any owner-floor breach row, the operation's own framework work), once.\n       * - NOT_LANDED (the row is absent, or carries another stamp because it did not change or a later writer changed it):\n       *   the commit's error stands.\n       * - UNKNOWN (no read succeeded): refused with `ResourceOperationOutcomeErrorCode.OUTCOME_UNKNOWN`, saying the\n       *   transition may have happened.\n       */\n      transactionalCoreCommitOutcomeResolver: createTransactionalCoreCommitReadBack({\n        reason: 'resource_status_transition_outcome_unknown',\n        read: (prepared, executionContext, utils) => readStatusTransitionSubjectOutsideTransaction(\n          definition, String(prepared._id), executionContext, utils,\n        ),\n        carriesThisAttempt: carriesAttemptUpdateStamp,\n      }),\n    });\n  };\n\n  return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n/**\n * The row a status transition wrote, read back OUTSIDE its transaction after the commit threw (#2825): the same\n * repository read the framework prefetched the row with, under the caller's execution context, with no transaction\n * (the failed one cannot answer). Throws when the repository is not registered, so the read-back answers UNKNOWN rather\n * than reading a missing door as an absent row.\n */\nasync function readStatusTransitionSubjectOutsideTransaction(\n  definition: ResourceStatusTransitionDefinition,\n  subjectResourceId: string,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Promise<(Record<string, unknown> & { _id?: unknown }) | null> {\n  const repository = engineRepositoriesRegistry(utils).getRepository(definition.resourceIdentifier);\n  if (!repository || typeof (repository as { read?: unknown }).read !== 'function') {\n    throw new Error(`No repository is registered for ${String(definition.resourceIdentifier)}, so the status transition cannot be read back`);\n  }\n  const row = await (repository as { read: <T>(ec: ExecutionContext<any>, id: string) => Promise<T | null> })\n    .read<Record<string, unknown> & { _id?: unknown }>(executionContext, subjectResourceId);\n  return row && typeof row === 'object' ? row : null;\n}\n\n/**\n * Whether the row a status transition's addressing NAMES exists, read by its id alone in the operation's transaction:\n * what tells a conditional addressing whose precondition no longer holds (CONFLICT) apart from a missing row\n * (NOT_FOUND) (#2681). Read under the caller's execution context, so a row outside the caller's scope reads as absent.\n */\nasync function statusTransitionSubjectExists(\n  definition: ResourceStatusTransitionDefinition,\n  subjectResourceId: string,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Promise<boolean> {\n  const repository = engineRepositoriesRegistry(utils).getRepository(definition.resourceIdentifier);\n  if (!repository || typeof (repository as { read?: unknown }).read !== 'function') return false;\n  const transaction = utils.serviceOptions?.transaction;\n  const row = await (repository as { read: (ec: ExecutionContext<any>, id: string, options?: unknown) => Promise<unknown> })\n    .read(executionContext, subjectResourceId, transaction ? { transaction } : undefined);\n  return row != null && typeof row === 'object';\n}\n\n/**\n * A transition's `RESOURCE_STATUS_TRANSITION_PERFORMED` row data: the one place it is built, so the verb's own recording\n * and the reactivation sweep's repair of a lift whose commit outcome was unknown (#2881) describe a lift alike.\n */\nexport function statusTransitionAuditEventData(params: {\n  definition: Pick<ResourceStatusTransitionDefinition, 'resourceIdentifier' | 'operationIdentifier' | 'restrictsAccess'>;\n  subjectId: string;\n  executionContext: ExecutionContext<any>;\n  previousStatus: string;\n  newStatus: string;\n  reason?: string;\n  scheduledReactivationAt?: Date;\n  /** The row's own organization, when the subject is tenant-scoped; else the initiator's, so the row routes to its SIEM. */\n  rowOrganizationId?: string;\n}): Parameters<AuditLogsBackendService['logResourceStatusTransitionPerformed']>[0] {\n  return {\n    resourceType: String(params.definition.resourceIdentifier),\n    operationIdentifier: String(params.definition.operationIdentifier),\n    subjectId: params.subjectId,\n    // Resolved, never chosen here: a machine principal is MACHINE and an initiator that could not be\n    // resolved is UNATTRIBUTED. A hand-written `?? 'system'` recorded both as the system acting by\n    // design, which hides the one case worth investigating.\n    performedBy: resolveAuditActorId(params.executionContext),\n    previousStatus: params.previousStatus,\n    newStatus: params.newStatus,\n    isRestricting: params.definition.restrictsAccess,\n    reason: params.reason,\n    scheduledReactivationAt: params.scheduledReactivationAt,\n    organizationId: params.rowOrganizationId ?? params.executionContext?.initiatorIds?.organizationId,\n  };\n}\n\n/**\n * Whether a scheduled lift's trail row exists (#2881), by the id its stamp derives. No fallback lookup: the stamp and the\n * derived id were introduced together, so every lift that carries a stamp was recorded under it or not at all. Throws\n * when the audit store cannot answer, so an unreadable store is never read as \"absent\".\n */\nexport async function isScheduledReactivationRecorded(\n  auditLogs: Pick<AuditLogsBackendService, 'hasRecordedAuditEvent'>,\n  definition: Pick<ResourceStatusTransitionDefinition, 'resourceIdentifier' | 'operationIdentifier'>,\n  subjectId: string,\n  performedAt: Date,\n): Promise<boolean> {\n  return auditLogs.hasRecordedAuditEvent(\n    scheduledReactivationTransitionAuditEventId(String(definition.resourceIdentifier), String(definition.operationIdentifier), subjectId, performedAt),\n  );\n}\n\n/**\n * How long after its stamp a scheduled lift's own write may have stamped the row's `updatedAt` (#2881). The stamp is taken\n * in the verb's prefix and the core write stamps `updatedAt` moments later, in the same attempt; a row whose `updatedAt`\n * is further from the stamp than this was written again since, by something other than the lift.\n */\nexport const SCHEDULED_REACTIVATION_LIFT_WRITE_TOLERANCE_MS = 30_000;\n\n/**\n * The status a scheduled lift WROTE, read back from the lifted row (#2881), or `undefined` when the row cannot say.\n *\n * The row's own status is the lift's landing while nothing has written the row since: its `updatedAt` is still the lift's\n * own write ({@link SCHEDULED_REACTIVATION_LIFT_WRITE_TOLERANCE_MS}). Once something has, the status says what that later\n * write did, so it is used only when the definition has ONE possible landing (`targetStatus`, no `resolveLandingStatus`):\n * then the lift wrote that whatever the row says now. A definition that resolves its landing (a representative membership\n * lands ACTIVE or INACTIVE) answers `undefined` for a row written again since, and its trail row is not guessed.\n */\nexport function resolveScheduledLiftLandingStatus(\n  definition: Pick<ResourceStatusTransitionDefinition, 'targetStatus' | 'resolveLandingStatus'>,\n  row: Record<string, unknown>,\n  performedAt: Date,\n): string | undefined {\n  const updatedAt = row.updatedAt instanceof Date ? row.updatedAt : typeof row.updatedAt === 'string' ? new Date(row.updatedAt) : undefined;\n  const untouchedSince = updatedAt !== undefined && !Number.isNaN(updatedAt.getTime())\n    && Math.abs(updatedAt.getTime() - performedAt.getTime()) <= SCHEDULED_REACTIVATION_LIFT_WRITE_TOLERANCE_MS;\n  const status = typeof row[STATUS_FIELD] === 'string' ? row[STATUS_FIELD] as string : undefined;\n  if (untouchedSince && status !== undefined) return status;\n  return definition.resolveLandingStatus ? undefined : definition.targetStatus;\n}\n\n/**\n * Record a scheduled lift's trail row from the lifted row (#2881), under the id its stamp derives: what the verb's own\n * recording writes for the same lift. A scheduled lift has a fixed shape, which is what makes it rebuildable: the system\n * acted (`executionContext` is the sweep's own context, as when it dispatched the verb), the row came from the definition's\n * single source status, the sweep supplies no reason, the schedule was cleared, and the caller names the status it landed\n * on ({@link resolveScheduledLiftLandingStatus}). Throws when the row could not be written, so the caller counts the lift\n * as still owed.\n */\nexport async function recordScheduledReactivationTransition(params: {\n  auditLogs: Pick<AuditLogsBackendService, 'logResourceStatusTransitionPerformed'>;\n  definition: ResourceStatusTransitionDefinition;\n  row: Record<string, unknown> & { _id?: unknown };\n  performedAt: Date;\n  landingStatus: string;\n  executionContext: ExecutionContext<any>;\n}): Promise<void> {\n  const { definition, row, performedAt } = params;\n  if (definition.allowedFromStatuses.length !== 1) {\n    throw new Error(`A scheduled lift of ${String(definition.operationIdentifier)} names ${definition.allowedFromStatuses.length} source statuses, so its trail row cannot say which it came from`);\n  }\n  const subjectId = String(row._id ?? '');\n  await params.auditLogs.logResourceStatusTransitionPerformed(statusTransitionAuditEventData({\n    definition,\n    subjectId,\n    executionContext: params.executionContext,\n    previousStatus: definition.allowedFromStatuses[0]!,\n    newStatus: params.landingStatus,\n    rowOrganizationId: typeof row.organizationId === 'string' ? row.organizationId : undefined,\n  }), params.executionContext, {\n    eventId: scheduledReactivationTransitionAuditEventId(String(definition.resourceIdentifier), String(definition.operationIdentifier), subjectId, performedAt),\n  });\n}\n\n/** Build every registration for a resource's lifecycle verbs in one call. */\nexport function createResourceStatusTransitionFactories(\n  definitions: readonly ResourceStatusTransitionDefinition[],\n): ResourceCustomServiceImplementationFactory[] {\n  return definitions.map(createResourceStatusTransitionFactory);\n}\n"]}
+{"version":3,"file":"resource-status-transition.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAGH,OAAO,EACL,uCAAuC,EACvC,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAIpH,OAAO,EACL,2CAA2C,EAC3C,iCAAiC,EACjC,wCAAwC,EACxC,0CAA0C,GAC3C,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,kDAAkD,EAClD,wCAAwC,EACxC,6CAA6C,EAC7C,gDAAgD,EAChD,+CAA+C,EAC/C,6CAA6C,EAC7C,uCAAuC,EACvC,qCAAqC,EACrC,iDAAiD,GAClD,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAgC,MAAM,gFAAgF,CAAC;AAE/J,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,6CAA6C,EAAE,MAAM,0GAA0G,CAAC;AACzK,OAAO,EACL,kDAAkD,EAClD,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AACrH,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,sFAAsF,CAAC;AACzJ,OAAO,EAAE,uCAAuC,EAAE,MAAM,4GAA4G,CAAC;AACrK,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EACL,yBAAyB,EACzB,qCAAqC,GACtC,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,MAAM,4EAA4E,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,MAAM,8FAA8F,CAAC;AAE1I,4EAA4E;AAC5E,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B;;;;;;;;GAQG;AACH,SAAS,+BAA+B,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAyD,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,0FAA0F;IAC1F,iEAA+B,CAAA;IAC/B;;;;OAIG;IACH,uEAAqC,CAAA;AACvC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,4BASX;AATD,WAAY,4BAA4B;IACtC,qDAAqD;IACrD,2CAAW,CAAA;IACX;;;;OAIG;IACH,+CAAe,CAAA;AACjB,CAAC,EATW,4BAA4B,KAA5B,4BAA4B,QASvC;AAED,+FAA+F;AAC/F,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,kCAAkC,CAAC;AAEzF,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA0GjD;;;;;;;;GAQG;AACH,SAAS,8BAA8B,CACrC,KAAc,EACd,cAAiC,EACjC,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO;IAExE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAC1E,OAAO,EAAE;YACP,OAAO,EACL,QAAQ,UAAU,CAAC,mBAAmB,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;kBAC5F,2BAA2B;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,YAAY,EAAE,UAAU,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YACnD,eAAe,EAAE,SAAS;SAC3B;KACF,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,SAAS,4BAA4B,CACnC,UAA8C,EAC9C,KAAc,EACd,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,8FAA8F;IAC9F,iEAAiE;IACjE,IAAI,UAAU,CAAC,IAAI,KAAK,4BAA4B,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExE,MAAM,QAAQ,GAAI,KAA6C,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,UAAU,CAAC,MAAM,KAAK,8BAA8B,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,OAAO,EAAE;oBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,sBAAsB;oBACzD,MAAM,EAAE,6CAA6C;oBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;oBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;iBACpD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,OAAO,EAAE;gBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,oCAAoC;gBACvE,MAAM,EAAE,6CAA6C;gBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,QAAQ;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU;QAClC,CAAC,CAAC,CAAC,YAAY,EAAE,4BAA4B,CAAC;QAC9C,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACnB,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,sCAAsC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAChH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,UAAmC,EACnC,gBAA8D,EAC9D,GAAS;IAET,MAAM,QAAQ,GAAG,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,OAAO,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,4BAA4B;WAChG,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2CAA2C,CACzD,kBAA0B,EAC1B,mBAA2B,EAC3B,SAAiB,EACjB,WAAiB;IAEjB,OAAO,+BAA+B,CACpC,GAAG,sBAAsB,CAAC,oCAAoC,IAAI,kBAAkB,IAAI,mBAAmB,IAAI,SAAS,IAAI,WAAW,CAAC,WAAW,EAAE,EAAE,CACxJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAM1C;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAE1E,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;YACvF,OAAO,EAAE;gBACP,MAAM,EAAE,8DAA8D;gBACtE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;gBAC1B,aAAa,EAAE,UAAU,CAAC,MAAM,IAAI,IAAI;gBACxC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,mBAAmB,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC;aACzD;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;IAEnF,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,CAAC,4BAA4B,CAAC,GAAG,4BAA4B,CAChE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAClE,CAAC;IACJ,CAAC;IAED,yHAAyH;IACzH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,UAAU,CAAC,4BAA4B,IAAI,+BAA+B,CAAC,UAAgD,EAAE,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;QACxJ,KAAK,CAAC,sCAAsC,CAAC,GAAG,GAAG,CAAC;IACtD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAAC,MAgBpE;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEhG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,8FAA8F;sBAC5F,uFAAuF;gBAC3F,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,2CAA2C,CAAC;QAChD,aAAa,EAAE,UAAU,CAAC,GAAG;QAC7B,aAAa,EAAE,UAAU,CAAC,QAAQ;QAClC,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,8CAA8C;QAC9C,SAAS,EAAE,UAAU,CAAC,QAAQ;QAC9B,UAAU;QACV,gBAAgB;QAChB,iCAAiC,EAAE,GAAG,EAAE,CAAC,6CAA6C,CAAC,MAAM,CAAC,kCAAkC,EAAE,CAAC;QACnI,oBAAoB,EAAE,0BAA0B,CAAC,KAAK,CAAC;QACvD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,sGAAsG;QACtG,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW;KAC/C,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,qDAAqD,CAAC,MAU3E;IACC,MAAM,EACJ,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAC5E,kCAAkC,GACnC,GAAG,MAAM,CAAC;IAEX,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACxD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,6FAA6F;sBAC3F,6FAA6F;sBAC7F,eAAe;gBACnB,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,aAAa,EAAE,UAAU,CAAC,KAAK;QAC/B,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,+FAA+F;QAC/F,SAAS,EAAE,UAAU,CAAC,KAAK;QAC3B,UAAU;QACV,eAAe;KAChB,CAAC;IAEF,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC;QAAE,OAAO;IAE/D,MAAM,kDAAkD,CAAC;QACvD,GAAG,UAAU;QACb,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,cAAc;QACd,gBAAgB,EAAE,MAAM,6CAA6C,CAAC,kCAAkC,EAAE,CAAC;QAC3G,2FAA2F;QAC3F,uBAAuB,EAAE,gBAAgB;QACzC,oBAAoB,EAAE,0BAA0B,CAAC,KAAK,CAAC;QACvD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,+FAA+F;QAC/F,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW;KAC/C,CAAC,CAAC;AACL,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,SAAS,kCAAkC,CACzC,UAA8C,EAC9C,SAAoB;IAEpB,MAAM,MAAM,GAAiC,EAAE,CAAC;IAEhD,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,2BAAkF,CAAC;IACvF,MAAM,kCAAkC,GAAG,GAA8C,EAAE,CACzF,CAAC,2BAA2B,KAAK,SAAS,CAAC,GAAG,CAC5C,kBAAkB,CAAC,2BAA2B,CAC/C,CAAC,CAAC;IAEL,IAAI,wCAAwC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5E,MAAM,2BAA2B,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,8CAA8C,CAAC;YAC7C,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,2BAA2B,EAAE;YAC9C,kCAAkC;SACnC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,8FAA8F;IAC9F,gGAAgG;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,kFAAkF;IAClF,IAAI,+CAA+C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnF,MAAM,0BAA0B,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE;YACxE,8FAA8F;YAC9F,kFAAkF;YAClF,IAAI,uCAAuC,CAAC,UAAU,CAAC;gBAAE,OAAO;YAChE,MAAM,6CAA6C,CAAC;gBAClD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBACrC,UAAU;gBACV,6FAA6F;gBAC7F,iEAAiE;gBACjE,2BAA2B,EAAE,kCAAkC,EAAE;gBACjE,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW;gBAC9C,oBAAoB,EAAE,0BAA0B,CAAC,KAAK,CAAC;gBACvD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,0BAA0B,EAAE;gBAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACvB,yFAAyF;oBACzF,mFAAmF;oBACnF,uFAAuF;oBACvF,wEAAwE;oBACxE,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;wBAC7C,IAAI,CAAC;4BACH,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;iCAC9E,iCAAiC,CAAC;gCACjC,cAAc,EAAE,MAAM,CAAC,cAAc;gCACrC,oFAAoF;gCACpF,yDAAyD;gCACzD,UAAU,EAAE,uCAAuC,CAAC,wBAAwB;gCAC5E,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gCACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;gCACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gCACrC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC;6BACtC,EAAE,gBAAgB,CAAC,CAAC;wBACzB,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,yEAAyE;4BACzE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,iEAAiE,EAAE;gCACvF,MAAM,EAAE,uDAAuD;gCAC/D,cAAc,EAAE,MAAM,CAAC,cAAc;gCACrC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gCACrC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;6BAClC,CAAC,CAAC;wBACL,CAAC;wBAED,uFAAuF;wBACvF,wEAAwE;wBACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CACnB,wFAAwF,EACxF;4BACE,MAAM,EAAE,wDAAwD;4BAChE,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;4BACrC,MAAM,EAAE,uEAAuE;yBAChF,CACF,CAAC;oBACJ,CAAC,CAAC;oBAEF,yFAAyF;oBACzF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,0FAA0F;oBAC1F,0FAA0F;oBAC1F,2FAA2F;oBAC3F,gFAAgF;oBAChF,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;oBACtD,IAAI,WAAW,EAAE,CAAC;wBAChB,mCAAmC,CAAC,WAAW,EAAE;4BAC/C,GAAG,EAAE,mDAAmD,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;kCAC3F,IAAI,UAAU,CAAC,mBAAmB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE;4BAC3F,OAAO,EAAE,YAAY;yBACtB,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBACD,MAAM,YAAY,EAAE,CAAC;gBACvB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,gDAAgD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpF,MAAM,sBAAsB,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,qDAAqD,CAAC;YACpD,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,sBAAsB,EAAE;YACzC,kCAAkC;SACnC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8CAA8C,CAC5D,UAAiJ;IAEjJ,MAAM,+BAA+B,GAAG,+CAA+C,CAAC,UAAU,CAAC,kBAAkB,CAAC;WACjH,gDAAgD,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACrF,MAAM,YAAY,GAA2B;QAC3C,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,wCAAwC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9H,GAAG,CAAC,UAAU,CAAC,oCAAoC,IAAI,EAAE,CAAC;QAC1D,0GAA0G;QAC1G,GAAG,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,IAAI,YAAY,KAAK,UAAU,CAAC,kBAAkB;YAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,MAAM,cAAc,GAAG,qCAAqC,CAAC,UAAU,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE;QACnG,MAAM,WAAW,GAAG,kCAAkC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE9E,OAAO,yCAAyC,CAAC;YAC/C;;;;;;eAMG;YACH,GAAG,CAAC,UAAU,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,oBAAoB;gBACzE,CAAC,CAAC;oBACA,eAAe,EAAE,KAAK,EAAE,MAA+B,EAAE,gBAAuC,EAAE,KAAmD,EAAE,EAAE;wBACvJ,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;wBACvG,MAAM,6CAA6C,CAAC;4BAClD,gBAAgB;4BAChB,YAAY,EAAE,KAAK,CAAC,YAAY;4BAChC,MAAM,EAAE,MAAe;4BACvB,cAAc,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CACnE,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAW,CAC3I;4BACD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;yBACpD,CAAC,CAAC;oBACL,CAAC;iBACF;gBACD,CAAC,CAAC,EAAE,CAAC;YACP,aAAa,EAAE;gBACb,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB,EAAE,IAAI;aACwB;YAClD,UAAU,EACR,UAAU,CAAC,UAAU;mBAClB,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,mBAAmB,oBAAoB;YACnG,2FAA2F;YAC3F,2FAA2F;YAC3F,6FAA6F;YAC7F,4DAA4D;YAC5D,mBAAmB,EAAE,cAAc;YACnC,wFAAwF;YACxF,yFAAyF;YACzF,6DAA6D;YAC7D,EAAE;YACF,6GAA6G;YAC7G,gHAAgH;YAChH,yGAAyG;YACzG,4GAA4G;YAC5G,wCAAwC;YACxC,EAAE;YACF,qFAAqF;YACrF,0EAA0E;YAC1E,sFAAsF;YACtF,2FAA2F;YAC3F,uFAAuF;YACvF,2FAA2F;YAC3F,gHAAgH;YAChH,kHAAkH;YAClH,0GAA0G;YAC1G,oHAAoH;YACpH,iDAAiD;YACjD,qBAAqB,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC,EAAE;YAC9E,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,8CAA8C,CAAC,UAAU,CAAC;YACnF,QAAQ,EAAE;gBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBAClF,0FAA0F;oBAC1F,uFAAuF;oBACvF,sFAAsF;oBACtF,EAAE;oBACF,6GAA6G;oBAC7G,+GAA+G;oBAC/G,gHAAgH;oBAChH,gHAAgH;oBAChH,iDAAiD;oBACjD,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;oBACtD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;wBACpC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;4BAC1E,OAAO,EAAE;gCACP,OAAO,EACL,GAAG,UAAU,CAAC,mBAAmB,oDAAoD;sCACnF,uBAAuB;gCAC3B,MAAM,EAAE,wCAAwC;gCAChD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,kBAAkB,EAAE,0BAA0B,CAAC,GAAG,CAAC;6BACpD;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,8BAA8B,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;oBAE3F,0FAA0F;oBAC1F,yFAAyF;oBACzF,4DAA4D;oBAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,aAA6C,CAAC;oBACvE,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,wGAAwG;wBACxG,2GAA2G;wBAC3G,wGAAwG;wBACxG,oGAAoG;wBACpG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,6BAA6B,CAAC,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;4BAC3H,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;gCACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gCACvF,OAAO,EAAE;oCACP,MAAM,EAAE,kDAAkD;oCAC1D,YAAY,EAAE,UAAU,CAAC,kBAAkB;oCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;oCACnD,UAAU,EAAE,iBAAiB;iCAC9B;6BACF,CAAC,CAAC;wBACL,CAAC;wBACD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;4BAC7D,OAAO,EAAE;gCACP,MAAM,EAAE,6CAA6C;gCACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,iBAAiB;6BAC9B;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,KAAK,GAAG,0BAA0B,CAAC;wBACvC,UAAU;wBACV,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;wBACrD,KAAK;wBACL,gBAAgB;wBAChB,KAAK;qBACN,CAAC,CAAC;oBACH,oGAAoG;oBACpG,IAAI,UAAU,CAAC,oBAAoB,EAAE,CAAC;wBACpC,KAAK,CAAC,YAAY,CAAC,GAAG,MAAM,UAAU,CAAC,oBAAoB,CAAC;4BAC1D,UAAU,EAAE,EAAE,GAAI,UAAsC,EAAE,GAAG,EAAE,iBAAiB,EAAE;4BAClF,KAAK;4BACL,SAAS;yBACV,CAAC,CAAC;oBACL,CAAC;oBAED,uFAAuF;oBACvF,qFAAqF;oBACrF,8EAA8E;oBAC9E,KAAK,MAAM,oBAAoB,IAAI,WAAW,EAAE,CAAC;wBAC/C,MAAM,oBAAoB,CAAC;4BACzB,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;4BACrD,kFAAkF;4BAClF,6DAA6D;4BAC7D,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;4BAC/B,gBAAgB;4BAChB,KAAK;yBACN,CAAC,CAAC;oBACL,CAAC;oBAED,mFAAmF;oBACnF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,8FAA8F;oBAC9F,sFAAsF;oBACtF,2FAA2F;oBAC3F,sFAAsF;oBACtF,yFAAyF;oBACzF,wFAAwF;oBACxF,gFAAgF;oBAChF,0FAA0F;oBAC1F,+DAA+D;oBAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;oBACtD,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;4BAC7E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;4BACjE,OAAO,EAAE;gCACP,OAAO,EACL,6EAA6E;sCAC3E,uCAAuC;gCAC3C,MAAM,EAAE,uDAAuD;gCAC/D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;gCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;6BAC5D;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,8FAA8F;oBAC9F,MAAM,gBAAgB,GAAG,CAAC,gBAAyC,EAAiB,EAAE;wBAChF,MAAM,WAAW,GAAG,KAAK,CAAC,sCAAsC,CAAC,CAAC;wBAClE,OAAO,gBAAgB;6BACpB,oCAAoC,CAAC,8BAA8B,CAAC;4BACnE,UAAU;4BACV,SAAS,EAAE,iBAAiB;4BAC5B,gBAAgB;4BAChB,cAAc,EAAE,MAAM,CAAE,UAAmC,CAAC,MAAM,IAAI,EAAE,CAAC;4BACzE,8FAA8F;4BAC9F,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;4BACtC,2EAA2E;4BAC3E,4EAA4E;4BAC5E,qBAAqB;4BACrB,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;4BAC9C,uBAAuB,EACrB,KAAK,CAAC,4BAA4B,CAAC,YAAY,IAAI;gCACjD,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAS;gCAC7C,CAAC,CAAC,SAAS;4BACf,iBAAiB,EAAG,UAA2C,CAAC,cAAoC;yBACrG,CAAC,EAAE,gBAAgB;wBACpB,wGAAwG;wBACxG,wGAAwG;wBACxG,WAAW,YAAY,IAAI;4BACzB,CAAC,CAAC,EAAE,OAAO,EAAE,2CAA2C,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE;4BACzK,CAAC,CAAC,SAAS,CAAC,CAAC;oBACvB,CAAC,CAAC;oBACF,mFAAmF;oBACnF,wEAAwE;oBACxE,MAAM,4BAA4B,GAAG,CAAC,KAAc,EAAQ,EAAE;wBAC5D,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kDAAkD,EAAE;4BACxE,MAAM,EAAE,kDAAkD;4BAC1D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;4BACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;4BAC3D,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;yBAClC,CAAC,CAAC;oBACL,CAAC,CAAC;oBACF,kHAAkH;oBAClH,8GAA8G;oBAC9G,mCAAmC,CAAC,WAAW,EAAE,0BAA0B,CAAC;wBAC1E,GAAG,EAAE,8BAA8B,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;8BACtE,IAAI,UAAU,CAAC,mBAAmB,IAAI,iBAAiB,EAAE;wBAC7D,OAAO,EAAE,KAAK,IAAI,EAAE;4BAClB,IAAI,CAAC;gCACH,MAAM,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC;4BACtG,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,4BAA4B,CAAC,KAAK,CAAC,CAAC;4BACtC,CAAC;wBACH,CAAC;wBACD,OAAO,EAAE,qBAAqB,CAAC;4BAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,aAAa;4BACvG,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;4BAC5F,MAAM,EAAE,gBAAgB;4BACxB,SAAS,EAAE,iBAAiB;4BAC5B,SAAS,EAAE,4BAA4B;yBACxC,CAAC;qBACH,CAAC,CAAC,CAAC;oBAEJ,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,2GAA2G;gBAC3G,+GAA+G;gBAC/G,wGAAwG;gBACxG,yGAAyG;gBACzG,2GAA2G;gBAC3G,+GAA+G;gBAC/G,2DAA2D;gBAC3D,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBACvF,IAAI,SAAS,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBACjD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;4BAC7D,OAAO,EAAE;gCACP,MAAM,EAAE,6CAA6C;gCACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,GAAG;6BAChB;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;wBACtB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;4BACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;4BACvF,OAAO,EAAE;gCACP,MAAM,EAAE,kDAAkD;gCAC1D,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,sBAAsB,CAAC,GAAG,CAAC;6BACxC;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,SAAS,CAAC;gBACnB,CAAC;aACF;YACD;;;;;;;;;;;;;;;;eAgBG;YACH,sCAAsC,EAAE,qCAAqC,CAAC;gBAC5E,MAAM,EAAE,4CAA4C;gBACpD,IAAI,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,CAAC,6CAA6C,CACxF,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAC1D;gBACD,kBAAkB,EAAE,yBAAyB;aAC9C,CAAC;SACH,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,6CAA6C,CAC1D,UAA8C,EAC9C,iBAAyB,EACzB,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAClG,IAAI,CAAC,UAAU,IAAI,OAAQ,UAAiC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,gDAAgD,CAAC,CAAC;IAC5I,CAAC;IACD,MAAM,GAAG,GAAG,MAAO,UAAwF;SACxG,IAAI,CAA8C,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC1F,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,6BAA6B,CAC1C,UAA8C,EAC9C,iBAAyB,EACzB,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAClG,IAAI,CAAC,UAAU,IAAI,OAAQ,UAAiC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC/F,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;IACtD,MAAM,GAAG,GAAG,MAAO,UAAuG;SACvH,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,OAAO,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAU9C;IACC,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAC1D,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAClE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,iGAAiG;QACjG,+FAA+F;QAC/F,wDAAwD;QACxD,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACzD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,eAAe;QAChD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,cAAc,EAAE,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,gBAAgB,EAAE,YAAY,EAAE,cAAc;KAClG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,SAAiE,EACjE,UAAkG,EAClG,SAAiB,EACjB,WAAiB;IAEjB,OAAO,SAAS,CAAC,qBAAqB,CACpC,2CAA2C,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,CACnJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,MAAM,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA6F,EAC7F,GAA4B,EAC5B,WAAiB;IAEjB,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1I,MAAM,cAAc,GAAG,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;WAC/E,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,IAAI,8CAA8C,CAAC;IAC7G,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,IAAI,cAAc,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC1D,OAAO,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,MAO3D;IACC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAChD,IAAI,UAAU,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,UAAU,UAAU,CAAC,mBAAmB,CAAC,MAAM,kEAAkE,CAAC,CAAC;IAClM,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,CAAC,SAAS,CAAC,oCAAoC,CAAC,8BAA8B,CAAC;QACzF,UAAU;QACV,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAE;QAClD,SAAS,EAAE,MAAM,CAAC,aAAa;QAC/B,iBAAiB,EAAE,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE;QAC3B,OAAO,EAAE,2CAA2C,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC;KAC5J,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uCAAuC,CACrD,WAA0D;IAE1D,OAAO,WAAW,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["/**\n * The shared implementation behind every account/entity lifecycle verb.\n *\n * ## What these verbs have in common\n *\n * SUSPEND, ACTIVATE, REACTIVATE, DEACTIVATE_ACCOUNT and their siblings differ only in which status\n * they write and which statuses they accept as a starting point. Each one validates a transition,\n * then writes `{status}` plus at most a scheduling date. Hand-rolling that per verb is how the\n * catalogue drifted in the first place: on 2026-08-01 a sweep found thirteen routed lifecycle\n * variants that declared a request contract, persisted nothing, and answered HTTP 200 — an operator\n * told a CRITICAL suspension had taken effect while the tenant kept serving.\n *\n * One factory, one place where the rules live.\n *\n * ## Why the transition is re-checked here, when `enabledCondition` already gates it\n *\n * It is a fail-closed backstop, NOT a duplicated rule. A custom implementation is addressed by an\n * EXACT operation-path key, so it runs for that path regardless of how the path was reached, while\n * `enabledCondition` is evaluated by the URL-facing dispatch. The organization-members config\n * records the same reasoning for why a role-change verb would not inherit UPDATE's ceiling gate.\n * The two also read different things: the gate sees the pre-fetched object, this sees the row the\n * write is actually about to land on.\n *\n * The rule itself is not duplicated — `allowedFromStatuses` is declared once per registration, and\n * the operation's `enabledCondition` is authored from the same set.\n *\n * ## Why `authoritativeFields` is mandatory here\n *\n * Every status field these verbs write is `.excludeFromUpdate()` — that is the whole reason the\n * verbs exist rather than letting a client PATCH the field. The repository re-parses every write\n * against the operation's `requestDto`, which names no status, so without an explicit declaration\n * the value survives only by being inferred as \"a key the hook added\". That inference is defeated\n * by any caller who reaches the service tier with the key already in the payload, and the write\n * silently becomes empty. See `resolveServerInjectedFieldAllowList` for the full mechanism.\n *\n * ## The trail is registered in the PREFIX and executes on COMMIT\n *\n * Both halves of that matter, and neither works alone:\n *\n *  - **Registered in the prefix**, because that is the only phase that can see the caller's\n *    `reason` / `suspensionReason`. The POSTFIX input is typed `z.infer<TOutput>` — the persisted\n *    row — and these are not schema columns, so they appear on neither. Decision D2 named the trail\n *    as their home; this is what actually puts them there.\n *  - **Executed on commit**, because the prefix runs BEFORE persistence. Emitting there directly\n *    would leave an audit row asserting a suspension that never happened whenever the write failed\n *    — evidence of a state change nobody made, which is worse than no record.\n *\n * `registerTransactionPostCommitEffect` gives both, which is why this factory declares\n * `transactionalCore`. Note this changes NO deployment's transaction posture: the core engine\n * already declares transaction-requiring boundaries unconditionally (organization\n * activate/suspend/request_deletion/restore, organization-units MOVE, platform-access grants,\n * organization-member writes), so `validateInitializedRuntimeTransactionReadiness` already probes\n * every adapter at startup and a store that cannot commit already fails there. An earlier revision\n * of this comment claimed the opposite and used it to defer the fix — that was wrong, and it is\n * recorded here so the claim is not made a second time.\n *\n * The status the patch carries is the persisted FACT once the effect runs, not merely the intent: `status` is\n * declared in `authoritativeFields`, so the strict re-parse cannot strip the patch, and the startup\n * guard proves every declared name is a real persisted field of the resource. That status is `targetStatus`,\n * unless the definition declares `resolveLandingStatus` — then it is the resolved landing status (#1597).\n *\n * ## Why the administrative floors are enforced HERE and not per verb\n *\n * `status` is one of the two axes that decide whether a principal is an administratively usable\n * administrator — of the APPLICATION (with `appRoles`) or of ONE ORGANIZATION (with a membership's\n * `roles`) — and every verb served by this factory writes it. Both floors were originally wired onto\n * their resource's core `UPDATE`, but a custom implementation resolves by an EXACT operation-path\n * key, so neither extended to anything else:\n *\n *  - `PUT /users/{id}/suspend-user` reached the same `status` field through this registration and\n *    returned 200 on the LAST usable super-administrator, leaving an application with no principal\n *    able to administer it and no in-product recovery door (every one is gated on the role now\n *    unusable). Proven end-to-end before it was fixed.\n *  - `organizationMembers | suspend` was the exact sibling: it strands ONE tenant, and\n *    `ORGANIZATION_MEMBERS` declares no super-admin variant, so a platform administrator who is not\n *    a member cannot re-own the stranded organization afterwards. Recovery exists, but only from\n *    OUTSIDE the tenant: `organizationMembers.grantOwnership` is platform-tier.\n *\n * Placing the calls in the SHARED implementation rather than on each verb covers every current and\n * future status verb on every governed resource at once, which is the only version of this fix that\n * cannot be re-opened by the next lifecycle verb somebody adds. Each floor is gated on the subject\n * resource because the floors are scoped invariants while this factory is generic — see\n * {@link resolveStatusTransitionFloorGuards}.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — access-affecting lifecycle\n * changes run through one guarded authority that records what happened, rather than a generic field\n * write, and may not retire the last accountable administrative principal of an application or of a\n * tenant.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  AdministrativeContinuityBreachDetection,\n  CoreAuditableEventType,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ExecutionContext_ExecutionType,\n  ResourceOperationVariantType,\n  type ResourceConfiguration_OperationPath,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  assertSuperAdminFloorPreservedForTransition,\n  createSuperAdminConferralResolver,\n  isSuperAdminFloorGovernedSubjectResource,\n  SUPER_ADMIN_FLOOR_TRANSACTION_PARTICIPANTS,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n  assertOrganizationOwnerFloorPreservedForTransition,\n  createOrganizationOwnerConferralResolver,\n  createOrganizationOwnerFloorPopulationContext,\n  isOrganizationOwnerFloorAuthorityBearingResource,\n  isOrganizationOwnerFloorGovernedSubjectResource,\n  reportOrganizationsStrandedByUserDeactivation,\n  isAdministrativelyUsableOwnerUserStatus,\n  membershipTransitionCouldReduceOwners,\n  ORGANIZATION_OWNER_FLOOR_TRANSACTION_PARTICIPANTS,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\nimport { deriveDeterministicAuditEventId, type AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { assertManageRelationshipRepresentativesTarget } from '~wildo-backend-lib/organizations/organization-relationships/relationship-capability-target.backend.utils';\nimport {\n  CONDITIONAL_ADDRESSING_PRECONDITION_NOT_MET_REASON,\n  describeUnaddressableShape,\n  resolveSingleSubjectId,\n} from '~wildo-backend-lib/base-classes/utils/single-subject-addressing.backend.utils';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport { auditRecordingCapture, capturablePostCommitEffect } from '~wildo-backend-lib/base-classes/services/services/post-commit-effect-capture.backend';\nimport { POST_COMMIT_EFFECT_CAPTURE_PARTICIPANTS } from '~wildo-backend-lib/base-classes/services/services/resource-operation-transaction-persistence.backend.utils';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  carriesAttemptUpdateStamp,\n  createTransactionalCoreCommitReadBack,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-commit-outcome.backend.utils';\nimport { resolveAuditActorId } from '~wildo-backend-lib/compliance/audit-trails/utils/audit-actor.backend.utils';\nimport { engineRepositoriesRegistry } from '~wildo-backend-lib/base-classes/services/services/engine-repositories-registry.backend.utils';\n\n/** The status field every lifecycle-bearing resource in the engine uses. */\nconst STATUS_FIELD = 'status';\n\n/**\n * The caller's justification for a transition, under whichever name its verb gives it.\n *\n * `suspend` calls it `suspensionReason`; the others call it `reason`. Both spellings are read here\n * rather than threaded through each definition, because the value has ONE destination — the audit\n * row — and the request-contract vocabulary is a per-verb surface detail, not a semantic difference.\n * It is never persisted on the row: a suspension reason is a compliance artefact nothing reads back,\n * so a schema column would only create something an erasure would later have to scrub.\n */\nfunction resolveAuthoredTransitionReason(input: unknown): string | undefined {\n  if (!input || typeof input !== 'object') return undefined;\n  const payload = input as { reason?: unknown; suspensionReason?: unknown };\n  const authored = payload.suspensionReason ?? payload.reason;\n  return typeof authored === 'string' && authored.length > 0 ? authored : undefined;\n}\n\n/**\n * How a verb's request contract expresses \"and automatically undo this later\".\n *\n * The persisted field is always `scheduledReactivationAt` — named for the effect so one field and\n * one sweep serve every verb — but the caller-facing vocabulary differs per verb, and one of them\n * is not even an instant. Translating here keeps each request contract in its own natural terms\n * while the row stays uniform, the same split `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in,\n * `parentUnitId` + `path` persisted).\n */\nexport enum StatusTransitionScheduleSource {\n  /** The contract carries an absolute instant (`suspensionEndDate`, `reactivationDate`). */\n  ABSOLUTE_DATE = 'absolute_date',\n  /**\n   * The contract carries a whole number of DAYS (`suspensionDuration`), resolved to an instant at\n   * write time. A duration is meaningless without the moment it is measured from, and the row\n   * records no such moment — so resolving it later would be guesswork.\n   */\n  DURATION_IN_DAYS = 'duration_in_days',\n}\n\n/**\n * What a verb DOES to the pending schedule — the discriminator of\n * {@link ResourceStatusTransitionScheduling}.\n *\n * A named vocabulary rather than an inline `'set' | 'clear'` union, for the same reason\n * {@link StatusTransitionScheduleSource} is one: it is a closed set with exactly one runtime source,\n * so every definition, every narrow, and every test fixture derives from here instead of re-spelling\n * the literal. The two axes are independent — `source` says how the caller EXPRESSES a schedule,\n * this says whether the verb writes one at all.\n */\nexport enum StatusTransitionScheduleMode {\n  /** Carry a caller-supplied schedule onto the row. */\n  SET = 'set',\n  /**\n   * Clear any pending schedule. Every \"undo\" verb uses this: a membership reactivated by hand must\n   * not still carry the date at which a sweep would have reactivated it anyway, or a later\n   * suspension would inherit a stale deadline.\n   */\n  CLEAR = 'clear',\n}\n\n/** The field the reactivation sweep reads. Declared once; every verb writes this same name. */\nconst SCHEDULED_REACTIVATION_FIELD = 'scheduledReactivationAt';\n\n/**\n * The stamp a scheduled lift leaves (#2881): when the SYSTEM performed the reactivation because the row's\n * {@link SCHEDULED_REACTIVATION_FIELD} had passed. Written only by a definition that declares\n * `recordsScheduledReactivation`, and only for that case (see {@link isScheduledReactivationBySystem}).\n */\nexport const SCHEDULED_REACTIVATION_PERFORMED_FIELD = 'scheduledReactivationPerformedAt';\n\nconst MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;\n\nexport type ResourceStatusTransitionScheduling =\n  | {\n      mode: StatusTransitionScheduleMode.SET;\n      /** The key in the operation's `requestDto` that carries it. */\n      requestField: string;\n      source: StatusTransitionScheduleSource;\n    }\n  | {\n      mode: StatusTransitionScheduleMode.CLEAR;\n    };\n\nexport interface ResourceStatusTransitionDefinition {\n  resourceIdentifier: CoreResourceType;\n  /** The custom verb this implements, e.g. `suspend`. */\n  operationIdentifier: string;\n  /** Written to `status` when the transition is legal. */\n  targetStatus: string;\n  /**\n   * The ONLY statuses this verb may run from. Anything else is a `CONFLICT`.\n   *\n   * Fail-closed by construction: an unlisted status is refused rather than allowed. Keep it\n   * identical to the operation's `enabledCondition` — the gate is the fast, user-facing rejection,\n   * this is the backstop that cannot be routed around.\n   */\n  allowedFromStatuses: readonly string[];\n  /** Optional time-boxing. Omit for a verb whose contract offers the caller no window. */\n  scheduling?: ResourceStatusTransitionScheduling;\n  /**\n   * Whether this transition REMOVES access rather than restoring it.\n   *\n   * Declared, not inferred. The obvious proxies are both wrong: \"sets a schedule\" happens to\n   * correlate today (you time-box a restriction) but is a coincidence of the current verbs, and\n   * \"target is not ACTIVE\" cannot be evaluated generically because each resource has its own\n   * status vocabulary. It only feeds the audit event's risk grading, where getting it backwards\n   * would file suspensions among routine reinstatements — so it is worth one explicit word per\n   * definition.\n   */\n  restrictsAccess: boolean;\n  /** Overrides the generated debug label when a resource needs a clearer one. */\n  debugLabel?: string;\n  /**\n   * The status this transition LANDS on for one row, when that can legitimately differ from `targetStatus`.\n   *\n   * Absent for every verb but one: reactivating a REPRESENTATIVE membership whose relationship has since ended, or whose\n   * person is no longer assigned, lands INACTIVE rather than ACTIVE (#1597) — see\n   * `resolveRepresentativeMembershipReactivationStatus`. The landing status is what is written, what the floor guards\n   * measure and what the audit row records. `allowedFromStatuses` still decides whether the verb may run at all.\n   */\n  resolveLandingStatus?: (params: {\n    currentRow: Record<string, unknown>;\n    utils: ResourceOperation_CustomImplementation_Utils;\n    container: Container;\n  }) => Promise<string>;\n  /** The resources `resolveLandingStatus` reads inside the transition's transaction. */\n  landingStatusTransactionParticipants?: Readonly<Record<string, CoreResourceType>>;\n  /**\n   * This verb is the one the reactivation sweep dispatches (#2881). When the system runs it on schedule, the patch also\n   * stamps {@link SCHEDULED_REACTIVATION_PERFORMED_FIELD}, and the transition's audit row is recorded under an id derived\n   * from that stamp (`scheduledReactivationTransitionAuditEventId`), so the sweep's repair of a lift whose commit outcome\n   * was unknown can find the lift and write its row exactly once. Only for a resource that declares the field.\n   *\n   * Why a stamp at all: the lift CLEARS `scheduledReactivationAt`, and nothing else on the row says that a lift happened\n   * or when, while `updatedAt` moves with every later write, so a key read from it would change under the repair and the\n   * row would be written twice. The stamp is written only by the scheduled lift, so it stays the lift's own.\n   */\n  recordsScheduledReactivation?: boolean;\n  /**\n   * #2886: a caller may ask for this verb's attempts to be CAPTURED (`postCommitEffectCaptureRequested`): the reactivation\n   * sweep does, for the lifts it dispatches. The verb then declares the post-commit effect outbox as a participant of its\n   * transaction, which is what startup validates and what lets the capture's rows commit with the lift. Declared, never\n   * inferred from `recordsScheduledReactivation`: the two are separate facts (a stamp the repair keys by, a caller that\n   * captures), and a verb could gain one without the other.\n   */\n  capturesPostCommitEffects?: boolean;\n}\n\n/**\n * A NARROW VIEW of the pre-operation snapshot — NOT a description of what the row contains.\n *\n * `utils.currentObject` comes from `fetchCurrentObjectForOperation`, which performs a full\n * `repository.read` on the addressed id, so the snapshot carries EVERY readable field of the row.\n * This type lists only what this implementation reads, and the authority fields are optional because\n * they exist on SOME governed resources and not others — not because a live row is expected to be\n * sparse. Test doubles for `currentObject` should mirror a persisted row, not this projection.\n *\n * The authority axes are read only by the floor guards (see {@link resolveStatusTransitionFloorGuards}):\n *\n * - `appRoles` — the APPLICATION axis, on `USERS` / `USER_SELF`. Those are two resource\n *   configurations over the SAME collection sharing `UserSchema` as their `mainSchema`, so the field\n *   is present through either door.\n * - `roles` + `organizationId` — the ORGANIZATIONS axis, on `ORGANIZATION_MEMBERS`. The first decides\n *   whether the row is an owner grant; the second names the population to measure.\n *\n * All three are typed `unknown` rather than `string[]`/`string` on purpose: this is the raw snapshot,\n * and each floor's own helpers are the authority on what a valid value is.\n */\ntype StatusBearingRow = {\n  _id: string;\n  status?: string;\n  appRoles?: unknown;\n  roles?: unknown;\n  organizationId?: unknown;\n};\n\n/**\n * Refuse a payload that already carries a field this verb owns.\n *\n * Defence in depth for the same hole `authoritativeFields` closes. With the declaration in place\n * such a payload is harmless — the hook's value wins — but the request is still malformed: passing\n * `status` to `suspend` asks the verb to do something other than suspend. A loud 400 beats\n * honouring one of two contradictory instructions, and it surfaces a caller who believes the field\n * is theirs to set.\n */\nfunction assertNoAuthoredFieldInRequest(\n  input: unknown,\n  authoredFields: readonly string[],\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): void {\n  if (!input || typeof input !== 'object' || Array.isArray(input)) return;\n\n  const offending = authoredFields.filter((field) =>\n    Object.prototype.hasOwnProperty.call(input, field));\n  if (offending.length === 0) return;\n\n  throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n    context: {\n      message:\n        `The '${definition.operationIdentifier}' operation owns ${offending.join(', ')} and does not `\n        + 'accept it from the caller',\n      reason: 'resource_status_transition_authored_field_in_request',\n      resourceType: definition.resourceIdentifier,\n      operationIdentifier: definition.operationIdentifier,\n      offendingFields: offending,\n    },\n  });\n}\n\n/** Resolve the caller's scheduling input to the absolute instant the sweep compares against. */\nfunction resolveScheduledReactivation(\n  scheduling: ResourceStatusTransitionScheduling,\n  input: unknown,\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Date | null {\n  // `null`, not `undefined`: the patch must actively CLEAR a stale deadline, and an `undefined`\n  // value is dropped by the write rather than unsetting the field.\n  if (scheduling.mode === StatusTransitionScheduleMode.CLEAR) return null;\n\n  const authored = (input as Record<string, unknown> | undefined)?.[scheduling.requestField];\n  if (authored === undefined || authored === null) return null;\n\n  if (scheduling.source === StatusTransitionScheduleSource.ABSOLUTE_DATE) {\n    const asDate = authored instanceof Date ? authored : new Date(String(authored));\n    if (Number.isNaN(asDate.getTime())) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        context: {\n          message: `${scheduling.requestField} is not a valid date`,\n          reason: 'resource_status_transition_invalid_schedule',\n          resourceType: definition.resourceIdentifier,\n          operationIdentifier: definition.operationIdentifier,\n        },\n      });\n    }\n    return asDate;\n  }\n\n  // DURATION_IN_DAYS — resolve against now, because the row records no other reference moment.\n  const days = typeof authored === 'number' ? authored : Number(authored);\n  if (!Number.isFinite(days) || days <= 0) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      context: {\n        message: `${scheduling.requestField} must be a positive number of days`,\n        reason: 'resource_status_transition_invalid_schedule',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        received: authored,\n      },\n    });\n  }\n  return new Date(Date.now() + days * MILLISECONDS_PER_DAY);\n}\n\n/**\n * The fields a definition writes — and therefore exactly what it must declare as authoritative.\n *\n * Derived rather than authored so the declaration cannot drift from the patch. A verb that gains a\n * schedule gains the declaration in the same edit.\n */\nexport function resolveStatusTransitionAuthoredFields(\n  definition: ResourceStatusTransitionDefinition,\n): string[] {\n  const fields = definition.scheduling\n    ? [STATUS_FIELD, SCHEDULED_REACTIVATION_FIELD]\n    : [STATUS_FIELD];\n  return definition.recordsScheduledReactivation ? [...fields, SCHEDULED_REACTIVATION_PERFORMED_FIELD] : fields;\n}\n\n/**\n * Whether this transition is the SYSTEM performing a scheduled reactivation (#2881): an internally initiated call (the\n * reactivation sweep's context) on a row whose `scheduledReactivationAt` has passed. An internally initiated context\n * names no person and no machine by construction (`ExecutionContext` refuses identity fields for that type), so the\n * execution type alone says the system acted; a lift an administrator, a machine or an inbound handler performs is a\n * decision with an actor and is never stamped. That matters because the stamp keys a trail row whose repair names the\n * system as the actor, so it may only mark lifts the system made.\n */\nexport function isScheduledReactivationBySystem(\n  currentRow: Record<string, unknown>,\n  executionContext: Pick<ExecutionContext<any>, 'executionType'>,\n  now: Date,\n): boolean {\n  const deadline = currentRow[SCHEDULED_REACTIVATION_FIELD];\n  const due = deadline instanceof Date ? deadline : typeof deadline === 'string' ? new Date(deadline) : undefined;\n  return executionContext.executionType === ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST\n    && due !== undefined && !Number.isNaN(due.getTime()) && due.getTime() <= now.getTime();\n}\n\n/**\n * The audit `eventId` of a scheduled lift's `RESOURCE_STATUS_TRANSITION_PERFORMED` row (#2881): derived from the row,\n * the verb and the instant the lift stamped, so the verb's own recording and the reactivation sweep's repair of a lift\n * whose commit outcome was unknown write ONE row between them. The instant is part of the key because a row is suspended\n * and lifted on schedule many times over its life, each lift its own occurrence.\n */\nexport function scheduledReactivationTransitionAuditEventId(\n  resourceIdentifier: string,\n  operationIdentifier: string,\n  subjectId: string,\n  performedAt: Date,\n): string {\n  return deriveDeterministicAuditEventId(\n    `${CoreAuditableEventType.RESOURCE_STATUS_TRANSITION_PERFORMED}:${resourceIdentifier}:${operationIdentifier}:${subjectId}:${performedAt.toISOString()}`,\n  );\n}\n\n/**\n * Build the `prefixCoreOperations` patch for one transition.\n *\n * Exported for testing: it is the whole decision, and it is pure apart from the row it is handed.\n */\nexport function buildStatusTransitionPatch(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  input: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}): Record<string, unknown> {\n  const { definition, currentRow, input, executionContext, utils } = params;\n\n  if (!definition.allowedFromStatuses.includes(currentRow.status ?? '')) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n      context: {\n        reason: 'resource_status_transition_not_permitted_from_current_status',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n        currentStatus: currentRow.status ?? null,\n        targetStatus: definition.targetStatus,\n        allowedFromStatuses: [...definition.allowedFromStatuses],\n      },\n    });\n  }\n\n  const patch: Record<string, unknown> = { [STATUS_FIELD]: definition.targetStatus };\n\n  if (definition.scheduling) {\n    patch[SCHEDULED_REACTIVATION_FIELD] = resolveScheduledReactivation(\n      definition.scheduling, input, definition, executionContext, utils,\n    );\n  }\n\n  // #2881: a scheduled lift by the system leaves its stamp, which keys its trail row (see `recordsScheduledReactivation`).\n  const now = new Date();\n  if (definition.recordsScheduledReactivation && isScheduledReactivationBySystem(currentRow as unknown as Record<string, unknown>, executionContext, now)) {\n    patch[SCHEDULED_REACTIVATION_PERFORMED_FIELD] = now;\n  }\n\n  return patch;\n}\n\n/**\n * Refuse a transition that would leave the application with no administratively usable\n * super-administrator.\n *\n * ## Only the status axis moves\n *\n * These verbs write `status` and at most a schedule — never `appRoles`. So the roles are passed as\n * BOTH the previous and the next value: the transition check needs the authority axis to decide\n * whether the subject counted at all, and stating it unchanged is what makes \"this write cannot\n * touch conferral\" explicit rather than implied by omission.\n *\n * ## Cost\n *\n * `assertSuperAdminFloorPreservedForTransition` short-circuits before issuing any query unless the\n * subject counted toward the floor BEFORE the write and would stop counting after it. So an\n * ordinary user suspension, and every transition INTO the authenticable set (`unsuspend_user`,\n * whose subject was by definition not usable beforehand), pay two set-membership tests and nothing\n * else. Only the genuinely dangerous case reaches the population query.\n *\n * ## Fail closed on a snapshot without the authority axis\n *\n * `appRoles` is what the whole decision turns on. A snapshot that lacks it cannot answer whether\n * this subject is an administrator, and answering \"not an administrator\" would fail OPEN on exactly\n * the input the guard exists for. Refusing instead mirrors the sibling `users | DELETE` guard, and\n * costs nothing in practice: the field carries a `.default([APP_USER])` and both floor-governed\n * resources read the same `UserSchema`, so a live snapshot always carries it.\n *\n * Exported for testing: like {@link buildStatusTransitionPatch} it is the whole decision, and it is\n * pure apart from the row and the collaborators it is handed.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an account-lifecycle change\n * must not retire the last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesSuperAdminFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n  /**\n   * Resolved only once the subject is shown to be a counting super-administrator. The population is\n   * measured under the floor's SYSTEM context, never the caller's: `user_self | deactivate_account`\n   * carries the person's own context, which confines a USERS list to their own row and would count no\n   * other administrator at all. See {@link assertStatusTransitionPreservesOrganizationOwnerFloor},\n   * whose measurement made the same choice first.\n   */\n  resolveAuthExecutionContextFactory: () => AuthExecutionContextFactoryBackendService;\n}): Promise<void> {\n  const { definition, currentRow, nextStatus, executionContext, utils, conferringRoles } = params;\n\n  if (!Array.isArray(currentRow.appRoles)) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the application roles of the account being changed could not be read, so it cannot '\n          + 'be proven that this transition would not disable the last usable super-administrator.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  await assertSuperAdminFloorPreservedForTransition({\n    subjectUserId: currentRow._id,\n    previousRoles: currentRow.appRoles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction — see the header.\n    nextRoles: currentRow.appRoles,\n    nextStatus,\n    executionContext,\n    resolvePopulationExecutionContext: () => createOrganizationOwnerFloorPopulationContext(params.resolveAuthExecutionContextFactory()),\n    repositoriesRegistry: engineRepositoriesRegistry(utils),\n    errorBuilder: utils.errorBuilder,\n    conferringRoles,\n    operationIdentifier: definition.operationIdentifier,\n    // #3670: the transition's own transaction: the floor serializes concurrent reductions only inside it.\n    transaction: utils.serviceOptions?.transaction,\n  });\n}\n\n/**\n * Refuse a transition that would leave an organization with no administratively usable owner.\n *\n * The ORGANIZATION-scope twin of {@link assertStatusTransitionPreservesSuperAdminFloor}, and the\n * differences are all consequences of the population being per-tenant rather than per-application:\n *\n * - **The subject names its own population.** `organizationId` selects which tenant to measure, so a\n *   snapshot without it cannot be evaluated at all — unlike the application floor, where there is\n *   only ever one population.\n * - **The measurement runs under a SYSTEM context, not the caller's.** The floor must see every owner\n *   membership AND the `status` of every one of those owners' `User` rows, and the `ORG_ADMIN`s who\n *   reach these verbs cannot list `USERS` at all. The authority owns that decision — see\n *   {@link createOrganizationOwnerFloorPopulationContext}.\n * - **The short-circuit is asked HERE, before the context is built.** Constructing the system context\n *   is a registry lookup plus a possible application-id resolution, and suspending an ordinary member\n *   — the overwhelmingly common case — must not pay for it. This is not a second copy of the rule:\n *   {@link membershipTransitionCouldReduceOwners} is the authority's own predicate, and the assertion\n *   below calls it again.\n *\n * Fails closed on a snapshot that carries no `roles` or no `organizationId`, for the reason the\n * application twin does: answering \"not an owner\" would fail OPEN on exactly the input the guard\n * exists for, and a suspended last owner cannot be reactivated by anyone — `ORGANIZATION_MEMBERS`\n * declares exactly one cross-tenant variant — `grantOwnership` — so recovery from a stranded state\n * is a platform-operator action, never a tenant one. That is why the in-tenant refusal still stands.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a membership-lifecycle change\n * must not retire a tenant's last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesOrganizationOwnerFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n  /** Resolved lazily and only once a reduction is established — see the header. */\n  resolveAuthExecutionContextFactory: () => AuthExecutionContextFactoryBackendService;\n}): Promise<void> {\n  const {\n    definition, currentRow, nextStatus, executionContext, utils, conferringRoles,\n    resolveAuthExecutionContextFactory,\n  } = params;\n\n  const organizationId = typeof currentRow.organizationId === 'string' ? currentRow.organizationId : undefined;\n\n  if (!Array.isArray(currentRow.roles) || !organizationId) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the roles or the owning organization of the membership being changed could not be '\n          + \"read, so it cannot be proven that this transition would not retire the organization's last \"\n          + 'usable owner.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  const transition = {\n    previousRoles: currentRow.roles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction: these verbs write `status` and at most a schedule, never `roles`.\n    nextRoles: currentRow.roles,\n    nextStatus,\n    conferringRoles,\n  };\n\n  if (!membershipTransitionCouldReduceOwners(transition)) return;\n\n  await assertOrganizationOwnerFloorPreservedForTransition({\n    ...transition,\n    memberId: currentRow._id,\n    organizationId,\n    executionContext: await createOrganizationOwnerFloorPopulationContext(resolveAuthExecutionContextFactory()),\n    // The refusal names the request, not the system read that measured the population (#3131).\n    requestExecutionContext: executionContext,\n    repositoriesRegistry: engineRepositoriesRegistry(utils),\n    errorBuilder: utils.errorBuilder,\n    operationIdentifier: definition.operationIdentifier,\n    // The transition's own transaction: the floor serializes concurrent reductions only inside it.\n    transaction: utils.serviceOptions?.transaction,\n  });\n}\n\n/**\n * One administrative floor a status transition must not breach, bound to a single definition.\n *\n * A list rather than a chain of `if`s inside the hook, because the set of floors that govern a row is\n * a property of the RESOURCE and is therefore decidable once, at factory construction, from static\n * data. Adding the next authority is one entry here — and, more to the point, a lifecycle verb added\n * to a governed resource inherits every floor automatically instead of depending on somebody\n * remembering to wire it. That omission is the whole defect class this file now closes.\n */\ntype StatusTransitionFloorGuard = (params: {\n  currentRow: StatusBearingRow;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}) => Promise<void>;\n\n/**\n * The floors that govern one definition's resource, resolved once when the factory is built.\n *\n * Every collaborator is bound LAZILY. Factories are constructed during module registration, which can\n * run before the authorization and authentication services are bound, so an eager `container.get`\n * would turn a guard into a startup crash. The conferral resolvers additionally re-read the live role\n * table on every call, because `initializeRolesWithCustom` mutates it in place.\n *\n * A resource governed by NO floor gets an empty list and pays nothing at all — not a container\n * lookup, not a closure invocation. That is the common case (organization units, and every\n * application resource that grows a lifecycle verb later).\n */\nfunction resolveStatusTransitionFloorGuards(\n  definition: ResourceStatusTransitionDefinition,\n  container: Container,\n): StatusTransitionFloorGuard[] {\n  const guards: StatusTransitionFloorGuard[] = [];\n\n  // Every floor below measures its population under a SYSTEM context the authority builds, so the\n  // factory that builds it is resolved lazily and once, and only by a guard that needs to measure.\n  let authExecutionContextFactory: AuthExecutionContextFactoryBackendService | undefined;\n  const resolveAuthExecutionContextFactory = (): AuthExecutionContextFactoryBackendService =>\n    (authExecutionContextFactory ??= container.get<AuthExecutionContextFactoryBackendService>(\n      SAAS_SERVICE_TYPES.AuthExecutionContextFactory,\n    ));\n\n  if (isSuperAdminFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const superAdminConferralResolver = createSuperAdminConferralResolver(container);\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesSuperAdminFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: superAdminConferralResolver(),\n        resolveAuthExecutionContextFactory,\n      }));\n  }\n\n  // ── USERS lifecycle: REPORT, never refuse ──────────────────────────────────────────────────\n  // A deactivated user stops counting as a usable owner, so this transition can strand a tenant —\n  // and unlike every other floor surface it must still be allowed to proceed. Suspension is normally\n  // incident response, and refusing it would mean an operator cannot lock out a compromised owner\n  // without first transferring ownership using the tenant the attacker controls. The stranded tenant\n  // is recoverable (boot report finds it, `grantOwnership` repairs it); the live hostile session is\n  // not. See `reportOrganizationsStrandedByUserDeactivation` for the full argument.\n  if (isOrganizationOwnerFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const strandingConferralResolver = createOrganizationOwnerConferralResolver(container);\n    guards.push(async ({ currentRow, nextStatus, executionContext, utils }) => {\n      // Asked here as well, so a reactivation never resolves the context factory. Not a second copy\n      // of the rule: it is the authority's own predicate, and the report asks it again.\n      if (isAdministrativelyUsableOwnerUserStatus(nextStatus)) return;\n      await reportOrganizationsStrandedByUserDeactivation({\n        subjectUserId: String(currentRow._id),\n        nextStatus,\n        // The report builds its own measuring context; `executionContext` stays the caller's for the\n        // audit row below, which must name who performed the transition.\n        authExecutionContextFactory: resolveAuthExecutionContextFactory(),\n        transaction: utils.serviceOptions?.transaction,\n        repositoriesRegistry: engineRepositoriesRegistry(utils),\n        errorBuilder: utils.errorBuilder,\n        conferringRoles: strandingConferralResolver(),\n        operationIdentifier: definition.operationIdentifier,\n        report: async (breach) => {\n          // An AUDIT ROW, not a log line — one per stranded tenant. The justification for allowing\n          // this write at all is that the consequence becomes visible, and a log line is not\n          // queryable evidence and never reaches a SIEM. `CRITICAL` + the AUTHORIZATION category\n          // route it through the same export path as every other authority event.\n          const recordBreach = async (): Promise<void> => {\n            try {\n              await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n                .logOrganizationOwnerFloorBreached({\n                  organizationId: breach.organizationId,\n                  // A guard SAW this one and let it through, which is what separates it from the boot\n                  // report's observation of a tenant stranded out-of-band.\n                  detectedBy: AdministrativeContinuityBreachDetection.ALLOWED_LIFECYCLE_ACTION,\n                  reducedMemberIds: breach.reducedMemberIds,\n                  remainingUsableOwners: breach.remainingUsableOwners,\n                  operationIdentifier: definition.operationIdentifier,\n                  subjectUserId: String(currentRow._id),\n                  subjectNextStatus: String(nextStatus),\n                }, executionContext);\n            } catch (error) {\n              // Loud, never thrown: the transition it describes has already committed.\n              utils.logger?.error?.('Failed to record an organization-owner-floor breach audit event', {\n                reason: 'organization_owner_floor_breach_audit_emission_failed',\n                organizationId: breach.organizationId,\n                subjectUserId: String(currentRow._id),\n                error: describeCaughtError(error),\n              });\n            }\n\n            // The log line stays as the operator-facing half: an audit row is for the auditor, and\n            // whoever is on call during an incident is reading logs, not the trail.\n            utils.logger?.error?.(\n              'Organization left with no administratively usable owner by a user lifecycle transition',\n              {\n                reason: 'organization_owner_floor_stranded_by_user_deactivation',\n                organizationId: breach.organizationId,\n                subjectUserId: String(currentRow._id),\n                remedy: 'organizationMembers.grantOwnership (platform-tier) restores an owner.',\n              },\n            );\n          };\n\n          // Recorded AFTER COMMIT (#2825). The report runs in the prefix, before the transition is\n          // written, and the audit row does not join the transaction: written here, it would survive\n          // a rollback and name a tenant stranded by a deactivation that never happened. Registered\n          // on the transaction, it runs only if the transition commits, and once more when a commit\n          // whose reply was lost is read back as landed (the framework drains it then). One key per\n          // subject and tenant, so the effect of one transition is never registered twice. Without a\n          // transaction (never on this verb, which owns its core) it is recorded at once.\n          const transaction = utils.serviceOptions?.transaction;\n          if (transaction) {\n            registerTransactionPostCommitEffect(transaction, {\n              key: `resource-status-transition:owner-floor-breached:${String(definition.resourceIdentifier)}`\n                + `:${definition.operationIdentifier}:${String(currentRow._id)}:${breach.organizationId}`,\n              execute: recordBreach,\n            });\n            return;\n          }\n          await recordBreach();\n        },\n      });\n    });\n  }\n\n  if (isOrganizationOwnerFloorAuthorityBearingResource(definition.resourceIdentifier)) {\n    const ownerConferralResolver = createOrganizationOwnerConferralResolver(container);\n\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesOrganizationOwnerFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: ownerConferralResolver(),\n        resolveAuthExecutionContextFactory,\n      }));\n  }\n\n  return guards;\n}\n\n/**\n * Every resource this definition's transactional core touches beyond its own: what `resolveLandingStatus` reads, and\n * the organization-owner floor's reads and serialization write when a floor guard forwards the transaction to it\n * (the stranding report on USERS / USER_SELF, the owner floor on ORGANIZATION_MEMBERS), and the super-administrator\n * floor's APPLICATION serialization write and USERS measurement on USERS / USER_SELF (#3670).\n *\n * Derived from the same governed-resource predicates that decide which guards run, so a definition that gains a\n * floor gains its participants with it. The operation's own resource is left out, since the framework includes it.\n */\nexport function resolveStatusTransitionTransactionParticipants(\n  definition: Pick<ResourceStatusTransitionDefinition, 'resourceIdentifier' | 'landingStatusTransactionParticipants' | 'capturesPostCommitEffects'>,\n): Readonly<Record<string, string>> {\n  const forwardsTransactionToOwnerFloor = isOrganizationOwnerFloorGovernedSubjectResource(definition.resourceIdentifier)\n    || isOrganizationOwnerFloorAuthorityBearingResource(definition.resourceIdentifier);\n  const participants: Record<string, string> = {\n    ...(forwardsTransactionToOwnerFloor ? ORGANIZATION_OWNER_FLOOR_TRANSACTION_PARTICIPANTS : {}),\n    ...(isSuperAdminFloorGovernedSubjectResource(definition.resourceIdentifier) ? SUPER_ADMIN_FLOOR_TRANSACTION_PARTICIPANTS : {}),\n    ...(definition.landingStatusTransactionParticipants ?? {}),\n    // #2886: a verb whose attempts a caller captures keeps its kept effects in the post-commit effect outbox.\n    ...(definition.capturesPostCommitEffects ? POST_COMMIT_EFFECT_CAPTURE_PARTICIPANTS : {}),\n  };\n  for (const [key, resourceType] of Object.entries(participants)) {\n    if (resourceType === definition.resourceIdentifier) delete participants[key];\n  }\n  return Object.freeze(participants);\n}\n\n/**\n * One lifecycle transition, as a registrable custom implementation.\n *\n * Modelled on `createOrganizationUnitStatusTransitionFactory`, which established the pattern for\n * this engine: validate against the loaded row, then RETURN the field patch for the core UPDATE to\n * persist rather than writing directly. The difference is that this one is resource-agnostic and\n * declares `authoritativeFields`, which the org-units original did not need — its `status` is not\n * `.excludeFromUpdate()`, so its patch survived on the introduced-key inference alone.\n */\nexport function createResourceStatusTransitionFactory(\n  definition: ResourceStatusTransitionDefinition,\n): ResourceCustomServiceImplementationFactory {\n  const authoredFields = resolveStatusTransitionAuthoredFields(definition);\n\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) => {\n    const floorGuards = resolveStatusTransitionFloorGuards(definition, container);\n\n    return createResourceCustomServiceImplementation({\n      /*\n       * #1631 invariant 6 — a member suspend / reactivate reached through MANAGE_RELATIONSHIP_REPRESENTATIVES may only touch the\n       * actor's own relationship's representatives. A question of WHO may act on the row, so it is the target authority, answered\n       * before the transition's state is read (its `enabledCondition`, the legality refusal, the floors). As a floor guard\n       * it ran after them, so a representative outside its relationship learned the member's status before being refused\n       * (#2582 re-review F5). An actor without the capability (an administrator, the reactivation sweep) is never asked.\n       */\n      ...(definition.resourceIdentifier === CoreResourceType.ORGANIZATION_MEMBERS\n        ? {\n          authorizeTarget: async (target: Record<string, unknown>, executionContext: ExecutionContext<any>, utils: ResourceOperation_CustomImplementation_Utils) => {\n            const systemAccess = container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n            await assertManageRelationshipRepresentativesTarget({\n              executionContext,\n              errorBuilder: utils.errorBuilder,\n              target: target as never,\n              readMembership: (userId, organizationId) => systemAccess.readAsSystem(\n                CoreResourceType.ORGANIZATION_MEMBERS, { userId, organizationId }, { ...(utils.serviceOptions ?? {}), suppressSystemAudit: true } as never,\n              ),\n              operationIdentifier: definition.operationIdentifier,\n            });\n          },\n        }\n        : {}),\n      operationPath: {\n        resourceIdentifier: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      } as ResourceConfiguration_OperationPath<any, any>,\n      debugLabel:\n        definition.debugLabel\n        ?? `${String(definition.resourceIdentifier)}.${definition.operationIdentifier}.status-transition`,\n      // `status` and `scheduledReactivationAt` are `.excludeFromUpdate()` on every resource this\n      // serves. Without this the repository's strict re-parse drops the patch for any caller who\n      // reached the service tier with the key already present, and the verb answers success having\n      // changed nothing — the exact defect it was written to fix.\n      authoritativeFields: authoredFields,\n      // The audit row is registered from the PREFIX (the only phase that can see the caller's\n      // `reason`) and executes on COMMIT, so it never describes a write that rolled back. That\n      // needs a commit hook to exist, which is what this declares.\n      //\n      // Participants only when a definition resolves its landing status: the transition writes exactly one row, on\n      // the operation's own resource, which the framework includes automatically, and `resolveLandingStatus` may READ\n      // (and serialize on) others inside the same unit of work — it declares those. Contrast the ORGANIZATIONS\n      // lifecycle verbs, which name ORGANIZATION_MEMBERS + USERS because they reconcile membership-derived global\n      // `userTypes` in the same unit of work.\n      //\n      // This does NOT change any deployment's transaction posture: the core engine already\n      // declares transaction-requiring boundaries unconditionally (organization\n      // activate/suspend/request_deletion/restore, organization-units MOVE, platform-access\n      // grants, organization-member writes), so `validateInitializedRuntimeTransactionReadiness`\n      // already probes every adapter at startup and a store that cannot commit already fails\n      // there — see the `rejects transaction readiness against a standalone MongoDB server` pin.\n      // #2543: the starting states are a property of the WRITE, not only of the prefix's check. The prefix judges the\n      // row the transaction re-read (locked on PostgreSQL, a write conflict on MongoDB), which already refuses a second\n      // concurrent transition; this makes the single statement that writes refuse it too, inside a caller-owned\n      // transaction as well, so the guarantee does not rest on the transaction posture. A write it stops answers CONFLICT\n      // `conditional_addressing_precondition_not_met`.\n      coreWritePrecondition: { [STATUS_FIELD]: [...definition.allowedFromStatuses] },\n      transactionalCore: true,\n      transactionParticipants: resolveStatusTransitionTransactionParticipants(definition),\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          // Fail closed on anything but a single addressed row. An ids array or a population filter\n          // reaching this path would make the status check evaluate against the wrong thing — or\n          // against nothing — while still returning a patch the core write would happily apply.\n          //\n          // A conditional `{ _id, … }` filter is single-subject, and this check admits it: that is how a transition is\n          // written as a compare-and-swap (#2681). The core pre-fetches such a filter the way the write reads it, so the\n          // row below is the one the write lands on, and there is none when the other predicates no longer hold (answered\n          // CONFLICT below, not NOT_FOUND). A variant that declares a target authority (`organizationMembers`) judges the\n          // row the `_id` names first, whatever its state.\n          const subjectResourceId = resolveSingleSubjectId(_id);\n          if (subjectResourceId === undefined) {\n            throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n              context: {\n                message:\n                  `${definition.operationIdentifier} requires a single addressed resource to validate `\n                  + 'the status transition',\n                reason: 'resource_status_transition_unaddressed',\n                resourceType: definition.resourceIdentifier,\n                receivedAddressing: describeUnaddressableShape(_id),\n              },\n            });\n          }\n\n          assertNoAuthoredFieldInRequest(input, authoredFields, definition, executionContext, utils);\n\n          // The framework pre-fetches the target row for UPDATE-like operations, so this is the row\n          // the write is about to land on. Absent means the transition cannot be validated — which\n          // must never read as \"allowed\" on an access-affecting verb.\n          const currentRow = utils.currentObject as StatusBearingRow | undefined;\n          if (!currentRow) {\n            // A conditional addressing found no row the write would land on. If the row its `_id` names exists, the\n            // caller's precondition no longer holds: another writer moved it. That is a conflict the caller can act on\n            // (re-read, decide again), never a missing row, so it is told apart here with one read by the id alone.\n            // Nothing is written either way. A bare id was already read by that id, so it needs no second read.\n            if (typeof _id !== 'string' && await statusTransitionSubjectExists(definition, subjectResourceId, executionContext, utils)) {\n              throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n                customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n                context: {\n                  reason: CONDITIONAL_ADDRESSING_PRECONDITION_NOT_MET_REASON,\n                  resourceType: definition.resourceIdentifier,\n                  operationIdentifier: definition.operationIdentifier,\n                  resourceId: subjectResourceId,\n                },\n              });\n            }\n            throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n              context: {\n                reason: 'resource_status_transition_target_not_found',\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: subjectResourceId,\n              },\n            });\n          }\n\n          const patch = buildStatusTransitionPatch({\n            definition,\n            currentRow: { ...currentRow, _id: subjectResourceId },\n            input,\n            executionContext,\n            utils,\n          });\n          // Only after the legality check: a verb that may not run says so first. See `resolveLandingStatus`.\n          if (definition.resolveLandingStatus) {\n            patch[STATUS_FIELD] = await definition.resolveLandingStatus({\n              currentRow: { ...(currentRow as Record<string, unknown>), _id: subjectResourceId },\n              utils,\n              container,\n            });\n          }\n\n          // AFTER the transition-legality check on purpose: a verb refused because it cannot run\n          // from the current status should say so — the more specific finding — and should not\n          // have issued a floor's population query on the way to being rejected anyway.\n          for (const assertFloorPreserved of floorGuards) {\n            await assertFloorPreserved({\n              currentRow: { ...currentRow, _id: subjectResourceId },\n              // Read from the patch rather than re-derived from the definition, so no guard can\n              // measure a status other than the one about to be persisted.\n              nextStatus: patch[STATUS_FIELD],\n              executionContext,\n              utils,\n            });\n          }\n\n          // Trail the transition. Registered HERE — the only phase that can see the caller's\n          // `reason`, since the POSTFIX input is typed `z.infer<TOutput>` (the persisted row) and\n          // `reason` is not a schema column, so it appears on neither.\n          //\n          // It EXECUTES on commit, so it never describes a write that rolled back. That is why the\n          // registration declares `transactionalCore` above: without a commit hook the choice would\n          // be between emitting early (recording suspensions that later failed) and emitting from a\n          // postfix that cannot see the reason. With one, neither compromise is necessary.\n          //\n          // The patch's status is the persisted fact once this commits, not merely the intent: `status`\n          // is declared in `authoritativeFields`, so the patch cannot be stripped by the strict\n          // re-parse, and the startup guard proves every declared name is a real persisted field. It\n          // is `targetStatus`, or the resolved landing status when the definition declares one.\n          // Fail CLOSED on a missing transaction rather than skipping the trail. This registration\n          // declares `transactionalCore`, so the framework guarantees one; its absence means that\n          // contract is broken, and silently proceeding would perform an access-affecting\n          // transition with no record — the outcome the audit exists to make impossible. Same shape\n          // as `registerOrganizationLifecycleAudit` on the tenant verbs.\n          const transaction = utils.serviceOptions?.transaction;\n          if (!transaction) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n              context: {\n                message:\n                  'A status transition cannot be recorded: no transaction is active, but this '\n                  + 'operation declares transactionalCore.',\n                reason: 'resource_status_transition_audit_requires_transaction',\n                resourceType: String(definition.resourceIdentifier),\n                operationIdentifier: String(definition.operationIdentifier),\n              },\n            });\n          }\n\n          // The recording, as one closure the live effect runs and a captured attempt prepares (#2886).\n          const recordTransition = (auditLogsService: AuditLogsBackendService): Promise<void> => {\n                const performedAt = patch[SCHEDULED_REACTIVATION_PERFORMED_FIELD];\n                return auditLogsService\n                  .logResourceStatusTransitionPerformed(statusTransitionAuditEventData({\n                    definition,\n                    subjectId: subjectResourceId,\n                    executionContext,\n                    previousStatus: String((currentRow as { status?: unknown }).status ?? ''),\n                    // What was WRITTEN — equal to `targetStatus` unless the definition resolves a landing status.\n                    newStatus: String(patch[STATUS_FIELD]),\n                    // The field decision D2 promised the trail would carry. Both spellings are\n                    // accepted because the verbs differ: `suspend` names it `suspensionReason`,\n                    // the rest `reason`.\n                    reason: resolveAuthoredTransitionReason(input),\n                    scheduledReactivationAt:\n                      patch[SCHEDULED_REACTIVATION_FIELD] instanceof Date\n                        ? patch[SCHEDULED_REACTIVATION_FIELD] as Date\n                        : undefined,\n                    rowOrganizationId: (currentRow as { organizationId?: unknown }).organizationId as string | undefined,\n                  }), executionContext,\n                  // #2881: a scheduled lift by the system is recorded under the id its stamp derives, so the reactivation\n                  // sweep's repair of a lift whose commit outcome was unknown and this effect write ONE row between them.\n                  performedAt instanceof Date\n                    ? { eventId: scheduledReactivationTransitionAuditEventId(String(definition.resourceIdentifier), String(definition.operationIdentifier), subjectResourceId, performedAt) }\n                    : undefined);\n          };\n          // A trail failure must not fail the transition it describes — but it must be loud,\n          // so a dropped record reaches whoever is on call rather than vanishing.\n          const reportTransitionAuditFailure = (error: unknown): void => {\n            utils.logger?.error?.('Failed to record a status-transition audit event', {\n              reason: 'resource_status_transition_audit_emission_failed',\n              resourceType: String(definition.resourceIdentifier),\n              operationIdentifier: String(definition.operationIdentifier),\n              error: describeCaughtError(error),\n            });\n          };\n          // #2886: capturable. On a lift the reactivation sweep captures, the row is prepared inside the lift's transaction\n          // (under the stamp-derived id when there is one) and written once, by this effect or by the sweep's next run.\n          registerTransactionPostCommitEffect(transaction, capturablePostCommitEffect({\n            key: `resource-status-transition:${String(definition.resourceIdentifier)}`\n              + `:${definition.operationIdentifier}:${subjectResourceId}`,\n            execute: async () => {\n              try {\n                await recordTransition(container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService));\n              } catch (error) {\n                reportTransitionAuditFailure(error);\n              }\n            },\n            capture: auditRecordingCapture({\n              effect: `${String(definition.resourceIdentifier)}.${String(definition.operationIdentifier)} transition`,\n              auditLogs: () => container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService),\n              record: recordTransition,\n              subjectId: subjectResourceId,\n              onFailure: reportTransitionAuditFailure,\n            }),\n          }));\n\n          return patch;\n        },\n        // The audit row above is staged before the write, so it is only true if the write landed on a row. A write\n        // can find the row when it is read and miss it when it is written: on PostgreSQL under READ COMMITTED a writer\n        // that commits between the two moves the row out from under it — a conditional addressing's re-asserted\n        // predicates no longer match (#2681), and a bare id's row may have been deleted. Refusing here rolls the\n        // transaction back, and with it the staged audit row, so the trail never records a transition that did not\n        // happen. The answer names what happened: the row is gone (NOT_FOUND) for a bare id, the caller's precondition\n        // no longer holds (CONFLICT) for a conditional addressing.\n        postfixCoreOperations: async (_id, coreState, executionContext, _operationPath, utils) => {\n          if (coreState == null && typeof _id === 'string') {\n            throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n              context: {\n                reason: 'resource_status_transition_target_not_found',\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: _id,\n              },\n            });\n          }\n          if (coreState == null) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n              context: {\n                reason: CONDITIONAL_ADDRESSING_PRECONDITION_NOT_MET_REASON,\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: resolveSingleSubjectId(_id),\n              },\n            });\n          }\n          return coreState;\n        },\n      },\n      /*\n       * #2825: a transition whose commit threw after its write (the store lost its reply) may have happened. Told\n       * \"failed\", the person repeats it and is refused `not_permitted_from_current_status`, since the row already has\n       * the status they asked for; the reactivation sweep logs it as a failed lift. So the row is read back, outside the\n       * failed transaction, by the `updatedAt` this attempt's write stamped: both adapters stamp it on every update, every\n       * resource this factory serves declares it (organization members, users and the user self door, which reads the same\n       * users table), and nothing later in the attempt writes this row again (the floors write the ORGANIZATION row, the\n       * landing-status resolver only reads). The read is the row read the framework prefetched it with, under the caller's\n       * own execution context, through this resource's repository, so it works for every resource the factory is built for\n       * without a system grant (the user self door has none).\n       * - LANDED: the stored row is the answer, and the framework runs what the attempt registered after commit (the\n       *   transition audit row, any owner-floor breach row, the operation's own framework work), once.\n       * - NOT_LANDED (the row is absent, or carries another stamp because it did not change or a later writer changed it):\n       *   the commit's error stands.\n       * - UNKNOWN (no read succeeded): refused with `ResourceOperationOutcomeErrorCode.OUTCOME_UNKNOWN`, saying the\n       *   transition may have happened.\n       */\n      transactionalCoreCommitOutcomeResolver: createTransactionalCoreCommitReadBack({\n        reason: 'resource_status_transition_outcome_unknown',\n        read: (prepared, executionContext, utils) => readStatusTransitionSubjectOutsideTransaction(\n          definition, String(prepared._id), executionContext, utils,\n        ),\n        carriesThisAttempt: carriesAttemptUpdateStamp,\n      }),\n    });\n  };\n\n  return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n/**\n * The row a status transition wrote, read back OUTSIDE its transaction after the commit threw (#2825): the same\n * repository read the framework prefetched the row with, under the caller's execution context, with no transaction\n * (the failed one cannot answer). Throws when the repository is not registered, so the read-back answers UNKNOWN rather\n * than reading a missing door as an absent row.\n */\nasync function readStatusTransitionSubjectOutsideTransaction(\n  definition: ResourceStatusTransitionDefinition,\n  subjectResourceId: string,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Promise<(Record<string, unknown> & { _id?: unknown }) | null> {\n  const repository = engineRepositoriesRegistry(utils).getRepository(definition.resourceIdentifier);\n  if (!repository || typeof (repository as { read?: unknown }).read !== 'function') {\n    throw new Error(`No repository is registered for ${String(definition.resourceIdentifier)}, so the status transition cannot be read back`);\n  }\n  const row = await (repository as { read: <T>(ec: ExecutionContext<any>, id: string) => Promise<T | null> })\n    .read<Record<string, unknown> & { _id?: unknown }>(executionContext, subjectResourceId);\n  return row && typeof row === 'object' ? row : null;\n}\n\n/**\n * Whether the row a status transition's addressing NAMES exists, read by its id alone in the operation's transaction:\n * what tells a conditional addressing whose precondition no longer holds (CONFLICT) apart from a missing row\n * (NOT_FOUND) (#2681). Read under the caller's execution context, so a row outside the caller's scope reads as absent.\n */\nasync function statusTransitionSubjectExists(\n  definition: ResourceStatusTransitionDefinition,\n  subjectResourceId: string,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Promise<boolean> {\n  const repository = engineRepositoriesRegistry(utils).getRepository(definition.resourceIdentifier);\n  if (!repository || typeof (repository as { read?: unknown }).read !== 'function') return false;\n  const transaction = utils.serviceOptions?.transaction;\n  const row = await (repository as { read: (ec: ExecutionContext<any>, id: string, options?: unknown) => Promise<unknown> })\n    .read(executionContext, subjectResourceId, transaction ? { transaction } : undefined);\n  return row != null && typeof row === 'object';\n}\n\n/**\n * A transition's `RESOURCE_STATUS_TRANSITION_PERFORMED` row data: the one place it is built, so the verb's own recording\n * and the reactivation sweep's repair of a lift whose commit outcome was unknown (#2881) describe a lift alike.\n */\nexport function statusTransitionAuditEventData(params: {\n  definition: Pick<ResourceStatusTransitionDefinition, 'resourceIdentifier' | 'operationIdentifier' | 'restrictsAccess'>;\n  subjectId: string;\n  executionContext: ExecutionContext<any>;\n  previousStatus: string;\n  newStatus: string;\n  reason?: string;\n  scheduledReactivationAt?: Date;\n  /** The row's own organization, when the subject is tenant-scoped; else the initiator's, so the row routes to its SIEM. */\n  rowOrganizationId?: string;\n}): Parameters<AuditLogsBackendService['logResourceStatusTransitionPerformed']>[0] {\n  return {\n    resourceType: String(params.definition.resourceIdentifier),\n    operationIdentifier: String(params.definition.operationIdentifier),\n    subjectId: params.subjectId,\n    // Resolved, never chosen here: a machine principal is MACHINE and an initiator that could not be\n    // resolved is UNATTRIBUTED. A hand-written `?? 'system'` recorded both as the system acting by\n    // design, which hides the one case worth investigating.\n    performedBy: resolveAuditActorId(params.executionContext),\n    previousStatus: params.previousStatus,\n    newStatus: params.newStatus,\n    isRestricting: params.definition.restrictsAccess,\n    reason: params.reason,\n    scheduledReactivationAt: params.scheduledReactivationAt,\n    organizationId: params.rowOrganizationId ?? params.executionContext?.initiatorIds?.organizationId,\n  };\n}\n\n/**\n * Whether a scheduled lift's trail row exists (#2881), by the id its stamp derives. No fallback lookup: the stamp and the\n * derived id were introduced together, so every lift that carries a stamp was recorded under it or not at all. Throws\n * when the audit store cannot answer, so an unreadable store is never read as \"absent\".\n */\nexport async function isScheduledReactivationRecorded(\n  auditLogs: Pick<AuditLogsBackendService, 'hasRecordedAuditEvent'>,\n  definition: Pick<ResourceStatusTransitionDefinition, 'resourceIdentifier' | 'operationIdentifier'>,\n  subjectId: string,\n  performedAt: Date,\n): Promise<boolean> {\n  return auditLogs.hasRecordedAuditEvent(\n    scheduledReactivationTransitionAuditEventId(String(definition.resourceIdentifier), String(definition.operationIdentifier), subjectId, performedAt),\n  );\n}\n\n/**\n * How long after its stamp a scheduled lift's own write may have stamped the row's `updatedAt` (#2881). The stamp is taken\n * in the verb's prefix and the core write stamps `updatedAt` moments later, in the same attempt; a row whose `updatedAt`\n * is further from the stamp than this was written again since, by something other than the lift.\n */\nexport const SCHEDULED_REACTIVATION_LIFT_WRITE_TOLERANCE_MS = 30_000;\n\n/**\n * The status a scheduled lift WROTE, read back from the lifted row (#2881), or `undefined` when the row cannot say.\n *\n * The row's own status is the lift's landing while nothing has written the row since: its `updatedAt` is still the lift's\n * own write ({@link SCHEDULED_REACTIVATION_LIFT_WRITE_TOLERANCE_MS}). Once something has, the status says what that later\n * write did, so it is used only when the definition has ONE possible landing (`targetStatus`, no `resolveLandingStatus`):\n * then the lift wrote that whatever the row says now. A definition that resolves its landing (a representative membership\n * lands ACTIVE or INACTIVE) answers `undefined` for a row written again since, and its trail row is not guessed.\n */\nexport function resolveScheduledLiftLandingStatus(\n  definition: Pick<ResourceStatusTransitionDefinition, 'targetStatus' | 'resolveLandingStatus'>,\n  row: Record<string, unknown>,\n  performedAt: Date,\n): string | undefined {\n  const updatedAt = row.updatedAt instanceof Date ? row.updatedAt : typeof row.updatedAt === 'string' ? new Date(row.updatedAt) : undefined;\n  const untouchedSince = updatedAt !== undefined && !Number.isNaN(updatedAt.getTime())\n    && Math.abs(updatedAt.getTime() - performedAt.getTime()) <= SCHEDULED_REACTIVATION_LIFT_WRITE_TOLERANCE_MS;\n  const status = typeof row[STATUS_FIELD] === 'string' ? row[STATUS_FIELD] as string : undefined;\n  if (untouchedSince && status !== undefined) return status;\n  return definition.resolveLandingStatus ? undefined : definition.targetStatus;\n}\n\n/**\n * Record a scheduled lift's trail row from the lifted row (#2881), under the id its stamp derives: what the verb's own\n * recording writes for the same lift. A scheduled lift has a fixed shape, which is what makes it rebuildable: the system\n * acted (`executionContext` is the sweep's own context, as when it dispatched the verb), the row came from the definition's\n * single source status, the sweep supplies no reason, the schedule was cleared, and the caller names the status it landed\n * on ({@link resolveScheduledLiftLandingStatus}). Throws when the row could not be written, so the caller counts the lift\n * as still owed.\n */\nexport async function recordScheduledReactivationTransition(params: {\n  auditLogs: Pick<AuditLogsBackendService, 'logResourceStatusTransitionPerformed'>;\n  definition: ResourceStatusTransitionDefinition;\n  row: Record<string, unknown> & { _id?: unknown };\n  performedAt: Date;\n  landingStatus: string;\n  executionContext: ExecutionContext<any>;\n}): Promise<void> {\n  const { definition, row, performedAt } = params;\n  if (definition.allowedFromStatuses.length !== 1) {\n    throw new Error(`A scheduled lift of ${String(definition.operationIdentifier)} names ${definition.allowedFromStatuses.length} source statuses, so its trail row cannot say which it came from`);\n  }\n  const subjectId = String(row._id ?? '');\n  await params.auditLogs.logResourceStatusTransitionPerformed(statusTransitionAuditEventData({\n    definition,\n    subjectId,\n    executionContext: params.executionContext,\n    previousStatus: definition.allowedFromStatuses[0]!,\n    newStatus: params.landingStatus,\n    rowOrganizationId: typeof row.organizationId === 'string' ? row.organizationId : undefined,\n  }), params.executionContext, {\n    eventId: scheduledReactivationTransitionAuditEventId(String(definition.resourceIdentifier), String(definition.operationIdentifier), subjectId, performedAt),\n  });\n}\n\n/** Build every registration for a resource's lifecycle verbs in one call. */\nexport function createResourceStatusTransitionFactories(\n  definitions: readonly ResourceStatusTransitionDefinition[],\n): ResourceCustomServiceImplementationFactory[] {\n  return definitions.map(createResourceStatusTransitionFactory);\n}\n"]}

package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.d.ts

@@ -1687,6 +1687,58 @@ export declare class ServiceResourceBackendService<TCustomOperationEnum extends
      * is durable in a system this process cannot roll back, and a caller told "failed" would retry it.
      */
     private doOperation;
+    /**
+     * # A multi-row write, one bounded transaction at a time (#2297 wave 4)
+     *
+     * A hook-less core `UPDATE_MANY` / `DELETE_MANY` that is made transactional for its audit row
+     * (`PlainAuditedWriteDurability.TRANSACTION_FOR_AUDIT_ROW`) holds at most {@link MULTI_ROW_WRITE_ROWS_PER_TRANSACTION} rows
+     * per transaction. A selection within the bound runs as one ordinary call, unchanged. A selection above it runs as CHUNKS,
+     * each a full call of {@link doOperation} on its own transaction, with its own audit row naming its rows and its own
+     * hooks, notifications and cascade over exactly its rows; the answers are merged into the one the caller asked for.
+     *
+     * - **An explicit id list** is cut into slices; the caller's filter, if any, travels with each slice, so a row that no
+     *   longer matches is left alone exactly as the single write would have left it.
+     * - **A filter** is walked by `_id` in keyset pages of the bound (`findManyForInfrastructure`, which hides retained rows as
+     *   the write does). Each chunk writes `{ id_or_ids: <page>, filter: <the caller's filter> }`, so the write itself still
+     *   applies the caller's filter AND its own scope: the walk only ever NARROWS what the write may touch, never widens it.
+     *   A keyset walk, not an offset one, so an UPDATE whose rows still match after the write is not read twice.
+     *
+     * What chunking changes, stated rather than hidden: the write is no longer one atomic statement across every chunk. A
+     * failure in chunk N leaves chunks 1..N-1 committed (and recorded), and the error propagates to the caller, who reads a
+     * partial write as the same "some rows changed" a crash between two of today's single statements already left. That is
+     * the background lane's documented contract (a partial success above the synchronous bound), and the reason the bound
+     * is the synchronous bulk's own. A row inserted below the walk's position after it passed is not reached, as a row
+     * inserted after a single statement ran is not.
+     *
+     * Not chunked: inside a caller's transaction (the caller's transaction already bounds and captures it), and anything
+     * {@link isFrameworkChunkedMultiRowWrite} refuses (a custom verb, a custom response, a custom registration, a bulk
+     * operation).
+     *
+     * What chunking does NOT change: a chunked DELETE_MANY that one held or restricted row refuses deletes NOTHING. The two
+     * refusals that judge a row alone are run over the WHOLE selection before the first chunk commits
+     * ({@link refuseChunkedDeleteBeforeFirstChunk}); each chunk asks them again for its own rows.
+     */
+    private runMultiRowWriteInChunks;
+    /**
+     * A chunked DELETE_MANY's row refusals, over its WHOLE selection, before the first chunk commits (follow-up to #2297,
+     * #3698). Unchunked, the RESTRICT posture (#1123) and the legal hold (#1634) are judged over every addressed row before
+     * anything is written, so one held or restricted row deletes nothing. Chunked, each chunk judged only its own rows, so a
+     * held row in chunk 2 was refused after chunk 1's rows were already deleted and committed. This reads every target the
+     * chunks will delete (`loadBulkTargetResources`, in the caller's context and scope, with any inherited paging removed,
+     * since this runs before `doOperation` removes it) and asks both refusals in the core's order.
+     *
+     * A row held, or a dependent created, after this check and before its chunk runs is still refused by that chunk, which
+     * asks again: the earlier chunks then stay committed, the partial-write contract of the chunking for a change made while
+     * it runs. An UPDATE_MANY is not judged here: neither refusal governs it.
+     */
+    private refuseChunkedDeleteBeforeFirstChunk;
+    /**
+     * The one answer of a chunked multi-row write (#2297 wave 4), from its chunks' answers: an UPDATE_MANY's rows concatenate;
+     * a DELETE_MANY's `{ deletedIds, deletedCount }` concatenate and add. Only the core operations' own answers reach here
+     * ({@link isFrameworkChunkedMultiRowWrite} refuses a custom response), so any other shape is a defect, refused rather than
+     * guessed.
+     */
+    private mergeMultiRowWriteChunkAnswers;
     /**
      * # Settle the external effects a ROOT operation reserved, now that it ended (#3441)
      *
@@ -3417,6 +3469,11 @@ export declare class ServiceResourceBackendService<TCustomOperationEnum extends
     /** How a subject export names a row of `resourceType`: its declared primary key, else `_id`; undefined when it has neither. */
     private subjectExportRowIdentityOf;
     private readSubjectExportRows;
+    /**
+     * The refusal of a framework read that must see every row and was answered with something that is not a row array
+     * (#3698, {@link listEveryRowOfInternalScan}). INTERNAL: no caller input produces it once paging is removed.
+     */
+    private refuseInternalScanAnsweringNoRowArray;
     /**
      * Drop the fields Art. 20 excluded from a resource's rows.
      *
@@ -3698,5 +3755,31 @@ export declare function resolveServiceInputShape(operation: {
  * - The combined `{ id_or_ids, filter }` has no form in the selector contract, so it is handed over as both and refused.
  */
 export declare function withRelationshipBulkTarget(data: unknown, target: IdOrIdsOrFilterType | undefined): unknown;
+/**
+ * The options a repository read takes from a caller, without a collection read's PAGING (#3698): `paginated` (answer an
+ * envelope) and `listOptions` (page, limit, sort).
+ *
+ * Paging belongs to the LIST or SEARCH call that asked for a page. Inherited by anything else, it reaches reads that must
+ * see EVERY row: the targets of a bulk write, which its RESTRICT and legal-hold refusals judge
+ * (`loadBulkTargetResources`), the children a cascade discovers, the dependents a RESTRICT probe looks for. Each of those
+ * reads a listing with no paging options, which both adapters answer with every row (the internal-call contract, #471).
+ * A hook forwarding a LIST's `utils.serviceOptions` to a nested bulk delete used to hand its page on: the delete's guards
+ * read 100 rows (`listOptions`) or none (`paginated`, whose envelope every such read takes for "no rows") while the write
+ * removed all 250, legally held rows included.
+ */
+export declare function withoutInheritedCollectionPaging<TOptions extends object>(options: TOptions | undefined): TOptions | undefined;
+/**
+ * Whether `operation` is a collection read that answers a PAGE (a LIST or a SEARCH), and so owns the `paginated` /
+ * `listOptions` its caller passes. Every other operation removes them on entry ({@link withoutInheritedCollectionPaging}).
+ */
+export declare function operationReadsACollectionPage(operation: ResourceConfiguration_Operation<any, any, any>): boolean;
+/**
+ * A framework read that must see EVERY row (#3698): the subject export's rows, the RESTRICT probes' children, the
+ * children a cascade discovers. `read` is called with the caller's options less any paging
+ * ({@link withoutInheritedCollectionPaging}), which a listing answers with every row on both adapters (#471); an answer
+ * that is still not a row array is refused through `refuse` rather than read as "no rows", which is how each of these
+ * failed open before: an export missing rows, a refusal finding no blocker, a cascade orphaning children.
+ */
+export declare function listEveryRowOfInternalScan<TRow>(read: (options: RepositoryOptions | undefined) => Promise<unknown>, options: RepositoryOptions | undefined, refuse: () => unknown): Promise<TRow[]>;
 export {};
 //# sourceMappingURL=services-registry-handler.backend.service.d.ts.map