@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.d.ts

@@ -11,6 +11,7 @@ import type { PlatformMutualizedHandlerBackendService } from '../../../requests/
 import type { ServerlessServicesHandlerBackendService } from '../../../requests/service/serverless-services-handler.backend.service';
 import type { ExecutionContextCreatorBackendService } from '../../../runtime/services/execution-context-creator.backend.service';
 import type { SystemAccessBackendService } from '../../../base-classes/services/services/system-access.backend.service';
+import type { WorkerRemoteClientFactoryBackendService } from '../../../applications/services/worker-remote-client-factory.backend.service';
 import type { ServiceOptions } from '../../../base-classes/models/repositories.backend.schemas';
 type Augment<TAugment extends object | undefined = undefined> = TAugment extends undefined ? {} : TAugment;
 export type ResourceOperationCustomImplementation_InputTypeOf<TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL, TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined, TOutput extends z.ZodSchema = z.ZodAny, TAugment extends object | undefined = undefined> = (TMode extends ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL | ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS ? TInput extends z.ZodSchema ? z.infer<TInput> : never : TMode extends ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS ? TInput extends z.ZodSchema ? z.infer<TInput> & Augment<TAugment> : never : z.infer<TOutput>);
@@ -82,6 +83,27 @@ export type ResourceOperation_CustomImplementation_Utils = {
      * not bind the system-access service still construct.
      */
     systemAccessService?: SystemAccessBackendService;
+    /**
+     * Dispatch to one of the application's declared WORKERS — the sanctioned way to move work off the
+     * request path from application backend code.
+     *
+     * `workerClientFactory.client('<workerName>').post('/route', body)` mints the
+     * `APPLICATION_WORKER_REQUEST` JWT the worker's verifier pins and reaches the worker at the URL
+     * the deploy injected. The factory fails CLOSED on an undeclared worker rather than dispatching to
+     * a guessed address.
+     *
+     * ## Why it had to be added here (#426)
+     *
+     * The factory shipped, was bound in DI, and had NO caller anywhere — and this is why: a custom
+     * implementation is the one place an application writes backend logic, and this bag was the only
+     * thing it receives. There was no handle, so no application COULD call a worker, which is the
+     * deeper half of why the backend-to-worker chain had never run for anyone. Adding the handle is
+     * what turns a shipped mechanism into a reachable one.
+     *
+     * Optional for the same reason `systemAccessService` is: a minimal test container that does not
+     * bind the factory must still construct.
+     */
+    workerClientFactory?: WorkerRemoteClientFactoryBackendService;
     /** SAML metadata service — for DISCOVER_ENDPOINTS (emits SAML_METADATA_PARSED) */
     samlMetadataService?: {
         parseIdPMetadata(metadataXml: string): unknown;

package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-operation-custom-implementation-base.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iDAAiD,EAGlD,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACzG,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC/I,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC/I,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qEAAqE,CAAC;AAE1G,KAAK,OAAO,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAAI,QAAQ,SAAS,SAAS,GAAG,EAAE,GAAG,QAAQ,CAAC;AAEzG,MAAM,MAAM,iDAAiD,CAC3D,KAAK,SAAS,iDAAiD,GAAG,iDAAiD,CAAC,YAAY,EAChI,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,EAC/D,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACtC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAC5C,CACD,KAAK,SAAS,iDAAiD,CAAC,YAAY,GAAG,iDAAiD,CAAC,uBAAuB,GACpJ,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GACf,KAAK,GACT,KAAK,SAAS,iDAAiD,CAAC,wBAAwB,GACtF,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnC,KAAK,GACT,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CACnB,CAAA;AAED,MAAM,MAAM,kDAAkD,CAC1D,KAAK,SAAS,iDAAiD,GAAG,iDAAiD,CAAC,YAAY,EAChI,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,EAC/D,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACtC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAC7C,CACF,KAAK,SAAS,iDAAiD,CAAC,uBAAuB,GACnF,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnC,OAAO,CAAC,QAAQ,CAAC,GACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CACrB,CAAA;AAID,eAAO,MAAM,wDAAwD,GAAI,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,SAAS,EAAE,OAAO,GAAG,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,EACpL,MAAM,iDAAiD,EACvD,eAAe,OAAO,GAAG,QAAQ,EACjC,QAAQ,OAAO,EACf,eAAe,OAAO,EACtB,eAAe,0BAA0B,KACxC,OAuDF,CAAA;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,0BAA0B,CAAC;IACzC,iBAAiB,EAAE,+BAA+B,CAAC;IACnD,gBAAgB,EAAE,qCAAqC,CAAC;IACxD;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,kBAAkB,EAAE,gCAAgC,CAAC;IACrD,yBAAyB,EAAE,uCAAuC,CAAC;IACnE,yBAAyB,EAAE,uCAAuC,CAAC;IACnE;;;;OAIG;IACH,uBAAuB,EAAE,qCAAqC,CAAC;IAC/D;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD,kFAAkF;IAClF,mBAAmB,CAAC,EAAE;QAAE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACzE;;;;OAIG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,CAAC;IAChF;;;OAGG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC;CACrB,CAAC;AAEF,8BAAsB,yCAAyC,CAC7D,MAAM,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACrC,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM;aAGtB,eAAe,IAAI,iDAAiD,EAAE;IAEtF;;;;;;;OAOG;aACa,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CAAC,iDAAiD,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EACzI,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACxD,iDAAiD,CAAC,YAAY,EAC9D,MAAM,EAAE,OAAO,CACjB,CAAC;IAEJ;;;;;;;;;;;;OAYG;aACa,oBAAoB,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,EAChF,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,uBAAuB,EACzE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAC5B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,uBAAuB,EACzE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,CAAC;IAEJ;;;OAGG;aACa,qBAAqB,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,EACjF,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,CAAC;IAEJ;;;;;;;;OAQG;aACa,qBAAqB,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;aACa,sBAAsB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;aACa,QAAQ,CACtB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,UAAU,EAC5D,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,UAAU,EAC5D,MAAM,EAAE,OAAO,CAChB,CAAC;CACL"}
+{"version":3,"file":"resource-operation-custom-implementation-base.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iDAAiD,EAGlD,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACzG,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC/I,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC/I,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,uFAAuF,CAAC;AACrJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qEAAqE,CAAC;AAE1G,KAAK,OAAO,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAAI,QAAQ,SAAS,SAAS,GAAG,EAAE,GAAG,QAAQ,CAAC;AAEzG,MAAM,MAAM,iDAAiD,CAC3D,KAAK,SAAS,iDAAiD,GAAG,iDAAiD,CAAC,YAAY,EAChI,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,EAC/D,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACtC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAC5C,CACD,KAAK,SAAS,iDAAiD,CAAC,YAAY,GAAG,iDAAiD,CAAC,uBAAuB,GACpJ,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GACf,KAAK,GACT,KAAK,SAAS,iDAAiD,CAAC,wBAAwB,GACtF,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnC,KAAK,GACT,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CACnB,CAAA;AAED,MAAM,MAAM,kDAAkD,CAC1D,KAAK,SAAS,iDAAiD,GAAG,iDAAiD,CAAC,YAAY,EAChI,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,EAC/D,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACtC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAC7C,CACF,KAAK,SAAS,iDAAiD,CAAC,uBAAuB,GACnF,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnC,OAAO,CAAC,QAAQ,CAAC,GACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CACrB,CAAA;AAID,eAAO,MAAM,wDAAwD,GAAI,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,SAAS,EAAE,OAAO,GAAG,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,EACpL,MAAM,iDAAiD,EACvD,eAAe,OAAO,GAAG,QAAQ,EACjC,QAAQ,OAAO,EACf,eAAe,OAAO,EACtB,eAAe,0BAA0B,KACxC,OAuDF,CAAA;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,0BAA0B,CAAC;IACzC,iBAAiB,EAAE,+BAA+B,CAAC;IACnD,gBAAgB,EAAE,qCAAqC,CAAC;IACxD;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,kBAAkB,EAAE,gCAAgC,CAAC;IACrD,yBAAyB,EAAE,uCAAuC,CAAC;IACnE,yBAAyB,EAAE,uCAAuC,CAAC;IACnE;;;;OAIG;IACH,uBAAuB,EAAE,qCAAqC,CAAC;IAC/D;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,CAAC,EAAE,uCAAuC,CAAC;IAC9D,kFAAkF;IAClF,mBAAmB,CAAC,EAAE;QAAE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACzE;;;;OAIG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,CAAC;IAChF;;;OAGG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC;CACrB,CAAC;AAEF,8BAAsB,yCAAyC,CAC7D,MAAM,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACrC,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM;aAGtB,eAAe,IAAI,iDAAiD,EAAE;IAEtF;;;;;;;OAOG;aACa,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CAAC,iDAAiD,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EACzI,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACxD,iDAAiD,CAAC,YAAY,EAC9D,MAAM,EAAE,OAAO,CACjB,CAAC;IAEJ;;;;;;;;;;;;OAYG;aACa,oBAAoB,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,EAChF,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,uBAAuB,EACzE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAC5B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,uBAAuB,EACzE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,CAAC;IAEJ;;;OAGG;aACa,qBAAqB,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,EACjF,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,CAAC;IAEJ;;;;;;;;OAQG;aACa,qBAAqB,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;aACa,sBAAsB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;aACa,QAAQ,CACtB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,UAAU,EAC5D,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,UAAU,EAC5D,MAAM,EAAE,OAAO,CAChB,CAAC;CACL"}

package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-operation-custom-implementation-base.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iDAAiD,EACjD,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAgD/B,MAAM,CAAC,MAAM,wDAAwD,GAAG,CACtE,IAAuD,EACvD,aAAiC,EACjC,MAAe,EACf,aAAsB,EACtB,YAAyC,EAChC,EAAE;IAEX,MAAM,KAAK,GAAG,CAAC,MAAgC,EAAE,MAAe,EAAE,QAAiB,KAAK,EAAW,EAAE;QACnG,IAAI,CAAC,MAAM;YACT,OAAO,MAAM,CAAC;QAEhB,IAAG,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,KAAK;gBACP,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,IAAG,MAAM,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,YAAY,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,YAAY,EAAE,CAAC;oBACjB,2HAA2H;oBAC3H,2EAA2E;oBAC3E,6DAA6D;oBAC7D,mEAAmE;oBACnE,0EAA0E;oBAC1E,2EAA2E;oBAC3E,yEAAyE;oBACzE,sEAAsE;oBACtE,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAC7D,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;qBACvF,CAAC,CAAC;oBACH,mEAAmE;gBACrE,CAAC;gBACD,4EAA4E;gBAC5E,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,UAAU,GAAI,MAAmC,CAAC,OAAO,CAAC;YAChE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAA;IAED,IAAG,aAAa,KAAK,OAAO,EAAE,CAAC;QAC7B,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,IAAI,KAAK,iDAAiD,CAAC,wBAAwB;eAClF,IAAI,KAAK,iDAAiD,CAAC,uBAAuB,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAY,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,CAAY,CAAC;IAEjD,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,IAAI,KAAK,iDAAiD,CAAC,uBAAuB,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAY,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,CAAY,CAAC;IACjD,CAAC;AACH,CAAC,CAAA;AA2FD,MAAM,OAAgB,yCAAyC;CAwJ9D","sourcesContent":["import { z } from 'zod';\nimport {\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_OperationPath,\n  ResourceOperation_CustomServiceImplementationMode,\n  ErrorType,\n  ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from './services-registry-handler.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExternalApiHandlerBackendService } from '~wildo-backend-lib/external-providers/services/external-api-handler.backend.service';\nimport type { PlatformMutualizedHandlerBackendService } from '~wildo-backend-lib/requests/service/platform-mutualized-handler.backend.service';\nimport type { ServerlessServicesHandlerBackendService } from '~wildo-backend-lib/requests/service/serverless-services-handler.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\n\ntype Augment<TAugment extends object|undefined = undefined> = TAugment extends undefined ? {} : TAugment;\n\nexport type ResourceOperationCustomImplementation_InputTypeOf<\n  TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n  TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined,\n  TOutput extends z.ZodSchema = z.ZodAny,\n  TAugment extends object|undefined = undefined\n> =(\n  TMode extends ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL | ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput>\n      : never\n  : TMode extends ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput> & Augment<TAugment>\n      : never\n  : z.infer<TOutput>\n)\n\nexport type ResourceOperationCustomImplementation_OutputTypeOf<\n    TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n    TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined,\n    TOutput extends z.ZodSchema = z.ZodAny,\n    TAugment extends object|undefined = undefined\n> = (\n  TMode extends ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput> & Augment<TAugment>\n      : Augment<TAugment>\n    : z.infer<TOutput>\n)\n\n\n\nexport const parseResourceOperation_CustomServiceImplementationSchema = <TSchema extends z.ZodTypeAny | undefined, TReturn = TSchema extends z.ZodTypeAny ? z.infer<TSchema> : unknown>(\n  mode: ResourceOperation_CustomServiceImplementationMode,\n  inputOrOutput: 'input' | 'output',\n  schema: TSchema,\n  objectToParse: unknown,\n  errorBuilder?: ErrorBuilderBackendService,\n): TReturn => {\n\n  const parse = (schema: z.ZodTypeAny | undefined, object: unknown, loose: boolean = false): unknown => {\n    if (!schema)\n      return object;\n\n    if(schema instanceof z.ZodObject) {\n      if (loose)\n        return z.looseObject(schema.shape).parse(object);\n      return schema.parse(object);\n    }\n    if(schema instanceof z.ZodArray) {\n      if (!(object instanceof Array)) {\n        if (errorBuilder) {\n          /** @wildo_source:part:start example.backend.operation.error-throw facet:kind:usage-example facet:audience:app-developer */\n          // Inside a backend custom-operation hook you receive `utils.errorBuilder`.\n          // Throw a WildoError with it — NEVER `throw new Error(...)`:\n          //  • the ErrorType drives the HTTP status (VALIDATION → 400 here);\n          //  • customMessageReference names the localized user message (resolved by\n          //    tErrorMessage → errors_messages.<ref>.msg) — do NOT hardcode English;\n          //  • any dynamic values go in `context` as structured keys (log-only for\n          //    most types), never interpolated into a `context.message` string.\n          throw errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n          });\n          /** @wildo_source:part:end example.backend.operation.error-throw */\n        }\n        // Bootstrap/leaf fallback ONLY — errorBuilder is unavailable here (pre-DI).\n        throw new Error('Input is not an array');\n      }\n      const itemSchema = (schema as z.ZodArray<z.ZodTypeAny>).element;\n      object = object.map((item: unknown) => parse(itemSchema, item, loose));\n      return object;\n    }\n    return schema.parse(object);\n  }\n\n  if(inputOrOutput === 'input') {\n    // PREFIX and REPLACE both receive data that may contain augmented fields\n    // from basicPrefixOperation or prior PREFIX handlers — use loose parse\n    // to preserve those fields while still validating declared schema fields.\n    if (mode === ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS\n      || mode === ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS) {\n      return parse(schema, objectToParse, true) as TReturn;\n    }\n    return parse(schema, objectToParse) as TReturn;\n\n  } else {\n    // PREFIX output may contain augmented fields (TAugment) that the declared\n    // output schema doesn't know about — use loose parse to preserve them.\n    if (mode === ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS) {\n      return parse(schema, objectToParse, true) as TReturn;\n    }\n    return parse(schema, objectToParse) as TReturn;\n  }\n}\n\n\n\n/**\n * Utilities object provided to custom implementation methods.\n *\n * Contains:\n * - Service instances (logger, errorBuilder, registries, handlers)\n * - `executionContextCreator`: Creates child execution contexts for cross-resource sub-calls\n * - Contextual data for the operation:\n *   - `objectContext`: Parent and child resource data (fetched based on resource configuration)\n *   - `initiatorUserContext`: User context of the user/organization/application initiating the operation\n *   - `currentObject`: The current resource object (for UPDATE/DELETE operations) or input data (for CREATE operations)\n *\n * Context fields are populated automatically by the service registry handler based on:\n * - Resource configuration context needs analysis\n * - Operation type (CREATE uses input data, UPDATE/DELETE fetches current object)\n *\n * ### Cross-resource operations\n *\n * For cross-resource calls from custom impls, use `utils.executionContextCreator.createForSubCall()`\n * to create a child context with proper depth tracking and cycle detection, then pass it\n * to `utils.servicesRegistry`. Example:\n *\n * ```ts\n * const subCtx = await utils.executionContextCreator.createForSubCall(\n *   executionContext, targetResourceType, CoreResourceOperation.CREATE\n * );\n * await utils.servicesRegistry.create(targetResourceType, subCtx, data);\n * ```\n *\n * Calling `servicesRegistry` directly with the parent context is functionally safe\n * (doOperation corrects the operation), but skips depth/cycle tracking.\n */\nexport type ResourceOperation_CustomImplementation_Utils = {\n  logger: LoggerService;\n  errorBuilder: ErrorBuilderBackendService;\n  resourcesRegistry: ResourcesRegistryBackendService;\n  servicesRegistry: ServicesRegistryHandlerBackendService;\n  /**\n   * Options of the operation currently executing, including its database\n   * transaction. Cross-resource mutations from a hook must forward these\n   * options when they belong to the same semantic unit of work.\n   */\n  serviceOptions?: ServiceOptions;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  externalApiHandler: ExternalApiHandlerBackendService;\n  platformMutualizedHandler: PlatformMutualizedHandlerBackendService;\n  serverlessServicesHandler: ServerlessServicesHandlerBackendService;\n  /**\n   * Creates child execution contexts for cross-resource sub-calls with proper\n   * depth tracking and cycle detection. Use `createForSubCall()` when calling\n   * `servicesRegistry` methods from a custom implementation.\n   */\n  executionContextCreator: ExecutionContextCreatorBackendService;\n  /**\n   * The SANCTIONED privileged-access path for custom implementations. A custom\n   * impl is a request-triggered elevation site: it runs inside the caller's\n   * (often anonymous / low-privilege) execution context but sometimes must read\n   * or write a resource that context cannot reach (e.g. an anonymous lead-capture\n   * CREATE that needs a users-by-email lookup). Route those through\n   * `systemAccessService.readAsSystem` / `listAsSystem` / `createAsSystem` /\n   * `updateAsSystem` — each is fail-closed on the target's `systemAccessPolicy`\n   * opt-in AND emits a `SYSTEM_CONTEXT_*` audit event. Do NOT hand-build a\n   * super-admin context via `executionContextCreator` for an ACL bypass; that\n   * path is ungated and unaudited. Optional so minimal test containers that do\n   * not bind the system-access service still construct.\n   */\n  systemAccessService?: SystemAccessBackendService;\n  /** SAML metadata service — for DISCOVER_ENDPOINTS (emits SAML_METADATA_PARSED) */\n  samlMetadataService?: { parseIdPMetadata(metadataXml: string): unknown };\n  /**\n   * Contextual data about parent and child resources.\n   * Structure: { parents: Record<string, any>, children: Record<string, any> }\n   * Populated based on resource configuration context needs.\n   */\n  objectContext?: { parents: Record<string, any>; children: Record<string, any> };\n  /**\n   * User context of the initiator (user/organization/application) performing the operation.\n   * Populated from execution context.\n   */\n  initiatorUserContext?: any;\n  /**\n   * Current resource object (for UPDATE/DELETE) or input data (for CREATE).\n   * For UPDATE/DELETE: Fetched from repository before custom implementation execution.\n   * For CREATE: Uses the input data provided to the operation.\n   */\n  currentObject?: any;\n};\n\nexport abstract class ResourceOperationCustomImplementationBase<\n  TInput extends z.ZodSchema = z.ZodAny,\n  TOutput extends z.ZodSchema = z.ZodAny,\n> {\n\n  public abstract getPlaceholders(): ResourceOperation_CustomServiceImplementationMode[];\n\n  /**\n   * Replaces the ENTIRE operation pipeline — no core CRUD, no notifications, no other hooks.\n   * Single-owner mode: if multiple registrations declare this, highest priority wins.\n   *\n   * A registration exposing this mode cannot enable `transactionalCore`: the\n   * override returns before the framework-owned core transaction is entered,\n   * so advertising that atomicity boundary would be false.\n   */\n  public abstract overrideAll(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL, TInput, TOutput>,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n       ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n       TInput, TOutput\n    >>;\n\n  /**\n   * Runs before core CRUD. Augments `data` via spread-merge (`data = { ...data, ...result }`).\n   *\n   * **Multi-registration execution:** handlers run sequentially by ascending priority number\n   * (lower number = higher priority = runs first). Each handler receives the accumulated `data`\n   * from all prior handlers. For field conflicts, **last-writer-wins**: the handler with the\n   * HIGHEST priority number (lowest priority) overwrites fields set by earlier handlers.\n   *\n   * **Array inputs (CREATE_MANY):** handler must return the full transformed array, not a\n   * spread-merged object. Non-array returns are silently dropped with a debug log.\n   *\n   * `utils.currentObject` reflects pre-PREFIX state (original DB record or CREATE input).\n   */\n  public abstract prefixCoreOperations<TAugment extends object|undefined = undefined>(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment>,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >>;\n\n  /**\n   * Replaces the core CRUD **result** — the core DB operation still runs, this overwrites `currentState`.\n   * Receives PREFIX-augmented `data` as input. Single-owner mode: highest priority wins.\n   */\n  public abstract replaceCoreOperations<TAugment extends object|undefined = undefined>(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >>;\n\n  /**\n   * Runs after core CRUD and REPLACE. Input is the core operation result.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   * Handlers must guard against non-object input when destructuring.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   */\n  public abstract postfixCoreOperations(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.POSTFIX_CORE_OPERARTIONS,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.POSTFIX_CORE_OPERARTIONS,\n      TInput, TOutput\n    >>;\n\n  /**\n   * Runs after notification dispatch. Input is the current operation result.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   *\n   * On a framework-owned transactional operation, this hook runs only after\n   * the root commit and framework post-commit effects finish. It receives the\n   * committed callback attempt's context and no completed transaction in\n   * `utils.serviceOptions`. A thrown error therefore rejects the response after\n   * an irreversible commit; this phase is for request-scoped result transforms,\n   * not mutation-owned external work.\n   *\n   * Because the phase transforms the returned value, it is not accepted when\n   * the operation reuses an explicit or ambient caller-owned transaction:\n   * that nested call must return before its caller can commit.\n   */\n  public abstract afterUserNotifications(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AFTER_USER_NOTIFICATIONS,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AFTER_USER_NOTIFICATIONS,\n      TInput, TOutput\n    >>;\n\n  /**\n   * Final hook — runs at the very end of the pipeline, after notifications and lifecycle evaluations.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   *\n   * On a framework-owned transactional operation, this hook runs only after\n   * the root commit and framework post-commit effects finish. It receives the\n   * committed callback attempt's context and no completed transaction in\n   * `utils.serviceOptions`. A thrown error therefore rejects the response after\n   * an irreversible commit; this phase is for request-scoped result transforms,\n   * not mutation-owned external work.\n   *\n   * Because the phase transforms the returned value, it is not accepted when\n   * the operation reuses an explicit or ambient caller-owned transaction:\n   * that nested call must return before its caller can commit.\n   */\n  public abstract atTheEnd(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AT_THE_END,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AT_THE_END,\n      TInput, TOutput\n    >>;\n}\n"]}
+{"version":3,"file":"resource-operation-custom-implementation-base.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iDAAiD,EACjD,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAiD/B,MAAM,CAAC,MAAM,wDAAwD,GAAG,CACtE,IAAuD,EACvD,aAAiC,EACjC,MAAe,EACf,aAAsB,EACtB,YAAyC,EAChC,EAAE;IAEX,MAAM,KAAK,GAAG,CAAC,MAAgC,EAAE,MAAe,EAAE,QAAiB,KAAK,EAAW,EAAE;QACnG,IAAI,CAAC,MAAM;YACT,OAAO,MAAM,CAAC;QAEhB,IAAG,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,KAAK;gBACP,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,IAAG,MAAM,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,YAAY,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,YAAY,EAAE,CAAC;oBACjB,2HAA2H;oBAC3H,2EAA2E;oBAC3E,6DAA6D;oBAC7D,mEAAmE;oBACnE,0EAA0E;oBAC1E,2EAA2E;oBAC3E,yEAAyE;oBACzE,sEAAsE;oBACtE,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAC7D,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;qBACvF,CAAC,CAAC;oBACH,mEAAmE;gBACrE,CAAC;gBACD,4EAA4E;gBAC5E,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,UAAU,GAAI,MAAmC,CAAC,OAAO,CAAC;YAChE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAA;IAED,IAAG,aAAa,KAAK,OAAO,EAAE,CAAC;QAC7B,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,IAAI,KAAK,iDAAiD,CAAC,wBAAwB;eAClF,IAAI,KAAK,iDAAiD,CAAC,uBAAuB,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAY,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,CAAY,CAAC;IAEjD,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,IAAI,KAAK,iDAAiD,CAAC,uBAAuB,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAY,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,CAAY,CAAC;IACjD,CAAC;AACH,CAAC,CAAA;AAgHD,MAAM,OAAgB,yCAAyC;CAwJ9D","sourcesContent":["import { z } from 'zod';\nimport {\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_OperationPath,\n  ResourceOperation_CustomServiceImplementationMode,\n  ErrorType,\n  ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from './services-registry-handler.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExternalApiHandlerBackendService } from '~wildo-backend-lib/external-providers/services/external-api-handler.backend.service';\nimport type { PlatformMutualizedHandlerBackendService } from '~wildo-backend-lib/requests/service/platform-mutualized-handler.backend.service';\nimport type { ServerlessServicesHandlerBackendService } from '~wildo-backend-lib/requests/service/serverless-services-handler.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { WorkerRemoteClientFactoryBackendService } from '~wildo-backend-lib/applications/services/worker-remote-client-factory.backend.service';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\n\ntype Augment<TAugment extends object|undefined = undefined> = TAugment extends undefined ? {} : TAugment;\n\nexport type ResourceOperationCustomImplementation_InputTypeOf<\n  TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n  TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined,\n  TOutput extends z.ZodSchema = z.ZodAny,\n  TAugment extends object|undefined = undefined\n> =(\n  TMode extends ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL | ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput>\n      : never\n  : TMode extends ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput> & Augment<TAugment>\n      : never\n  : z.infer<TOutput>\n)\n\nexport type ResourceOperationCustomImplementation_OutputTypeOf<\n    TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n    TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined,\n    TOutput extends z.ZodSchema = z.ZodAny,\n    TAugment extends object|undefined = undefined\n> = (\n  TMode extends ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput> & Augment<TAugment>\n      : Augment<TAugment>\n    : z.infer<TOutput>\n)\n\n\n\nexport const parseResourceOperation_CustomServiceImplementationSchema = <TSchema extends z.ZodTypeAny | undefined, TReturn = TSchema extends z.ZodTypeAny ? z.infer<TSchema> : unknown>(\n  mode: ResourceOperation_CustomServiceImplementationMode,\n  inputOrOutput: 'input' | 'output',\n  schema: TSchema,\n  objectToParse: unknown,\n  errorBuilder?: ErrorBuilderBackendService,\n): TReturn => {\n\n  const parse = (schema: z.ZodTypeAny | undefined, object: unknown, loose: boolean = false): unknown => {\n    if (!schema)\n      return object;\n\n    if(schema instanceof z.ZodObject) {\n      if (loose)\n        return z.looseObject(schema.shape).parse(object);\n      return schema.parse(object);\n    }\n    if(schema instanceof z.ZodArray) {\n      if (!(object instanceof Array)) {\n        if (errorBuilder) {\n          /** @wildo_source:part:start example.backend.operation.error-throw facet:kind:usage-example facet:audience:app-developer */\n          // Inside a backend custom-operation hook you receive `utils.errorBuilder`.\n          // Throw a WildoError with it — NEVER `throw new Error(...)`:\n          //  • the ErrorType drives the HTTP status (VALIDATION → 400 here);\n          //  • customMessageReference names the localized user message (resolved by\n          //    tErrorMessage → errors_messages.<ref>.msg) — do NOT hardcode English;\n          //  • any dynamic values go in `context` as structured keys (log-only for\n          //    most types), never interpolated into a `context.message` string.\n          throw errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n          });\n          /** @wildo_source:part:end example.backend.operation.error-throw */\n        }\n        // Bootstrap/leaf fallback ONLY — errorBuilder is unavailable here (pre-DI).\n        throw new Error('Input is not an array');\n      }\n      const itemSchema = (schema as z.ZodArray<z.ZodTypeAny>).element;\n      object = object.map((item: unknown) => parse(itemSchema, item, loose));\n      return object;\n    }\n    return schema.parse(object);\n  }\n\n  if(inputOrOutput === 'input') {\n    // PREFIX and REPLACE both receive data that may contain augmented fields\n    // from basicPrefixOperation or prior PREFIX handlers — use loose parse\n    // to preserve those fields while still validating declared schema fields.\n    if (mode === ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS\n      || mode === ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS) {\n      return parse(schema, objectToParse, true) as TReturn;\n    }\n    return parse(schema, objectToParse) as TReturn;\n\n  } else {\n    // PREFIX output may contain augmented fields (TAugment) that the declared\n    // output schema doesn't know about — use loose parse to preserve them.\n    if (mode === ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS) {\n      return parse(schema, objectToParse, true) as TReturn;\n    }\n    return parse(schema, objectToParse) as TReturn;\n  }\n}\n\n\n\n/**\n * Utilities object provided to custom implementation methods.\n *\n * Contains:\n * - Service instances (logger, errorBuilder, registries, handlers)\n * - `executionContextCreator`: Creates child execution contexts for cross-resource sub-calls\n * - Contextual data for the operation:\n *   - `objectContext`: Parent and child resource data (fetched based on resource configuration)\n *   - `initiatorUserContext`: User context of the user/organization/application initiating the operation\n *   - `currentObject`: The current resource object (for UPDATE/DELETE operations) or input data (for CREATE operations)\n *\n * Context fields are populated automatically by the service registry handler based on:\n * - Resource configuration context needs analysis\n * - Operation type (CREATE uses input data, UPDATE/DELETE fetches current object)\n *\n * ### Cross-resource operations\n *\n * For cross-resource calls from custom impls, use `utils.executionContextCreator.createForSubCall()`\n * to create a child context with proper depth tracking and cycle detection, then pass it\n * to `utils.servicesRegistry`. Example:\n *\n * ```ts\n * const subCtx = await utils.executionContextCreator.createForSubCall(\n *   executionContext, targetResourceType, CoreResourceOperation.CREATE\n * );\n * await utils.servicesRegistry.create(targetResourceType, subCtx, data);\n * ```\n *\n * Calling `servicesRegistry` directly with the parent context is functionally safe\n * (doOperation corrects the operation), but skips depth/cycle tracking.\n */\nexport type ResourceOperation_CustomImplementation_Utils = {\n  logger: LoggerService;\n  errorBuilder: ErrorBuilderBackendService;\n  resourcesRegistry: ResourcesRegistryBackendService;\n  servicesRegistry: ServicesRegistryHandlerBackendService;\n  /**\n   * Options of the operation currently executing, including its database\n   * transaction. Cross-resource mutations from a hook must forward these\n   * options when they belong to the same semantic unit of work.\n   */\n  serviceOptions?: ServiceOptions;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  externalApiHandler: ExternalApiHandlerBackendService;\n  platformMutualizedHandler: PlatformMutualizedHandlerBackendService;\n  serverlessServicesHandler: ServerlessServicesHandlerBackendService;\n  /**\n   * Creates child execution contexts for cross-resource sub-calls with proper\n   * depth tracking and cycle detection. Use `createForSubCall()` when calling\n   * `servicesRegistry` methods from a custom implementation.\n   */\n  executionContextCreator: ExecutionContextCreatorBackendService;\n  /**\n   * The SANCTIONED privileged-access path for custom implementations. A custom\n   * impl is a request-triggered elevation site: it runs inside the caller's\n   * (often anonymous / low-privilege) execution context but sometimes must read\n   * or write a resource that context cannot reach (e.g. an anonymous lead-capture\n   * CREATE that needs a users-by-email lookup). Route those through\n   * `systemAccessService.readAsSystem` / `listAsSystem` / `createAsSystem` /\n   * `updateAsSystem` — each is fail-closed on the target's `systemAccessPolicy`\n   * opt-in AND emits a `SYSTEM_CONTEXT_*` audit event. Do NOT hand-build a\n   * super-admin context via `executionContextCreator` for an ACL bypass; that\n   * path is ungated and unaudited. Optional so minimal test containers that do\n   * not bind the system-access service still construct.\n   */\n  systemAccessService?: SystemAccessBackendService;\n  /**\n   * Dispatch to one of the application's declared WORKERS — the sanctioned way to move work off the\n   * request path from application backend code.\n   *\n   * `workerClientFactory.client('<workerName>').post('/route', body)` mints the\n   * `APPLICATION_WORKER_REQUEST` JWT the worker's verifier pins and reaches the worker at the URL\n   * the deploy injected. The factory fails CLOSED on an undeclared worker rather than dispatching to\n   * a guessed address.\n   *\n   * ## Why it had to be added here (#426)\n   *\n   * The factory shipped, was bound in DI, and had NO caller anywhere — and this is why: a custom\n   * implementation is the one place an application writes backend logic, and this bag was the only\n   * thing it receives. There was no handle, so no application COULD call a worker, which is the\n   * deeper half of why the backend-to-worker chain had never run for anyone. Adding the handle is\n   * what turns a shipped mechanism into a reachable one.\n   *\n   * Optional for the same reason `systemAccessService` is: a minimal test container that does not\n   * bind the factory must still construct.\n   */\n  workerClientFactory?: WorkerRemoteClientFactoryBackendService;\n  /** SAML metadata service — for DISCOVER_ENDPOINTS (emits SAML_METADATA_PARSED) */\n  samlMetadataService?: { parseIdPMetadata(metadataXml: string): unknown };\n  /**\n   * Contextual data about parent and child resources.\n   * Structure: { parents: Record<string, any>, children: Record<string, any> }\n   * Populated based on resource configuration context needs.\n   */\n  objectContext?: { parents: Record<string, any>; children: Record<string, any> };\n  /**\n   * User context of the initiator (user/organization/application) performing the operation.\n   * Populated from execution context.\n   */\n  initiatorUserContext?: any;\n  /**\n   * Current resource object (for UPDATE/DELETE) or input data (for CREATE).\n   * For UPDATE/DELETE: Fetched from repository before custom implementation execution.\n   * For CREATE: Uses the input data provided to the operation.\n   */\n  currentObject?: any;\n};\n\nexport abstract class ResourceOperationCustomImplementationBase<\n  TInput extends z.ZodSchema = z.ZodAny,\n  TOutput extends z.ZodSchema = z.ZodAny,\n> {\n\n  public abstract getPlaceholders(): ResourceOperation_CustomServiceImplementationMode[];\n\n  /**\n   * Replaces the ENTIRE operation pipeline — no core CRUD, no notifications, no other hooks.\n   * Single-owner mode: if multiple registrations declare this, highest priority wins.\n   *\n   * A registration exposing this mode cannot enable `transactionalCore`: the\n   * override returns before the framework-owned core transaction is entered,\n   * so advertising that atomicity boundary would be false.\n   */\n  public abstract overrideAll(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL, TInput, TOutput>,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n       ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n       TInput, TOutput\n    >>;\n\n  /**\n   * Runs before core CRUD. Augments `data` via spread-merge (`data = { ...data, ...result }`).\n   *\n   * **Multi-registration execution:** handlers run sequentially by ascending priority number\n   * (lower number = higher priority = runs first). Each handler receives the accumulated `data`\n   * from all prior handlers. For field conflicts, **last-writer-wins**: the handler with the\n   * HIGHEST priority number (lowest priority) overwrites fields set by earlier handlers.\n   *\n   * **Array inputs (CREATE_MANY):** handler must return the full transformed array, not a\n   * spread-merged object. Non-array returns are silently dropped with a debug log.\n   *\n   * `utils.currentObject` reflects pre-PREFIX state (original DB record or CREATE input).\n   */\n  public abstract prefixCoreOperations<TAugment extends object|undefined = undefined>(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment>,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >>;\n\n  /**\n   * Replaces the core CRUD **result** — the core DB operation still runs, this overwrites `currentState`.\n   * Receives PREFIX-augmented `data` as input. Single-owner mode: highest priority wins.\n   */\n  public abstract replaceCoreOperations<TAugment extends object|undefined = undefined>(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >>;\n\n  /**\n   * Runs after core CRUD and REPLACE. Input is the core operation result.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   * Handlers must guard against non-object input when destructuring.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   */\n  public abstract postfixCoreOperations(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.POSTFIX_CORE_OPERARTIONS,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.POSTFIX_CORE_OPERARTIONS,\n      TInput, TOutput\n    >>;\n\n  /**\n   * Runs after notification dispatch. Input is the current operation result.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   *\n   * On a framework-owned transactional operation, this hook runs only after\n   * the root commit and framework post-commit effects finish. It receives the\n   * committed callback attempt's context and no completed transaction in\n   * `utils.serviceOptions`. A thrown error therefore rejects the response after\n   * an irreversible commit; this phase is for request-scoped result transforms,\n   * not mutation-owned external work.\n   *\n   * Because the phase transforms the returned value, it is not accepted when\n   * the operation reuses an explicit or ambient caller-owned transaction:\n   * that nested call must return before its caller can commit.\n   */\n  public abstract afterUserNotifications(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AFTER_USER_NOTIFICATIONS,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AFTER_USER_NOTIFICATIONS,\n      TInput, TOutput\n    >>;\n\n  /**\n   * Final hook — runs at the very end of the pipeline, after notifications and lifecycle evaluations.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   *\n   * On a framework-owned transactional operation, this hook runs only after\n   * the root commit and framework post-commit effects finish. It receives the\n   * committed callback attempt's context and no completed transaction in\n   * `utils.serviceOptions`. A thrown error therefore rejects the response after\n   * an irreversible commit; this phase is for request-scoped result transforms,\n   * not mutation-owned external work.\n   *\n   * Because the phase transforms the returned value, it is not accepted when\n   * the operation reuses an explicit or ambient caller-owned transaction:\n   * that nested call must return before its caller can commit.\n   */\n  public abstract atTheEnd(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AT_THE_END,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AT_THE_END,\n      TInput, TOutput\n    >>;\n}\n"]}

package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-status-transition.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAGH,OAAO,EACL,gBAAgB,EAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAEpH,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,iHAAiH,CAAC;AACpL,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAgB5G,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AA4BrK;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,0FAA0F;IAC1F,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;GASG;AACH,oBAAY,4BAA4B;IACtC,qDAAqD;IACrD,GAAG,QAAQ;IACX;;;;OAIG;IACH,KAAK,UAAU;CAChB;AAOD,MAAM,MAAM,kCAAkC,GAC1C;IACE,IAAI,EAAE,4BAA4B,CAAC,GAAG,CAAC;IACvC,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,8BAA8B,CAAC;CACxC,GACD;IACE,IAAI,EAAE,4BAA4B,CAAC,KAAK,CAAC;CAC1C,CAAC;AAEN,MAAM,WAAW,kCAAkC;IACjD,kBAAkB,EAAE,gBAAgB,CAAC;IACrC,uDAAuD;IACvD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,wFAAwF;IACxF,UAAU,CAAC,EAAE,kCAAkC,CAAC;IAChD;;;;;;;;;OASG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAmFF;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,kCAAkC,GAC7C,MAAM,EAAE,CAIV;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;CACrD,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2B1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,8CAA8C,CAAC,MAAM,EAAE;IAC3E,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;IACpD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,qDAAqD,CAAC,MAAM,EAAE;IAClF,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;IACpD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,iFAAiF;IACjF,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;CACrF,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ChB;AAyHD;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,kCAAkC,GAC7C,0CAA0C,CAoL5C;AAED,6EAA6E;AAC7E,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,SAAS,kCAAkC,EAAE,GACzD,0CAA0C,EAAE,CAE9C"}
+{"version":3,"file":"resource-status-transition.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAGH,OAAO,EAEL,gBAAgB,EAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAEpH,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,iHAAiH,CAAC;AACpL,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAgB5G,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AA4BrK;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,0FAA0F;IAC1F,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;GASG;AACH,oBAAY,4BAA4B;IACtC,qDAAqD;IACrD,GAAG,QAAQ;IACX;;;;OAIG;IACH,KAAK,UAAU;CAChB;AAOD,MAAM,MAAM,kCAAkC,GAC1C;IACE,IAAI,EAAE,4BAA4B,CAAC,GAAG,CAAC;IACvC,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,8BAA8B,CAAC;CACxC,GACD;IACE,IAAI,EAAE,4BAA4B,CAAC,KAAK,CAAC;CAC1C,CAAC;AAEN,MAAM,WAAW,kCAAkC;IACjD,kBAAkB,EAAE,gBAAgB,CAAC;IACrC,uDAAuD;IACvD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,wFAAwF;IACxF,UAAU,CAAC,EAAE,kCAAkC,CAAC;IAChD;;;;;;;;;OASG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAmFF;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,kCAAkC,GAC7C,MAAM,EAAE,CAIV;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;CACrD,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2B1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,8CAA8C,CAAC,MAAM,EAAE;IAC3E,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;IACpD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,qDAAqD,CAAC,MAAM,EAAE;IAClF,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;IACpD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,iFAAiF;IACjF,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;CACrF,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ChB;AA4HD;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,kCAAkC,GAC7C,0CAA0C,CAoL5C;AAED,6EAA6E;AAC7E,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,SAAS,kCAAkC,EAAE,GACzD,0CAA0C,EAAE,CAE9C"}

package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js

@@ -86,7 +86,7 @@
  * write, and may not retire the last accountable administrative principal of an application or of a
  * tenant.
  */
-import { ErrorCustomMessageReference, ErrorType, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
+import { AdministrativeContinuityBreachDetection, ErrorCustomMessageReference, ErrorType, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
 import { createResourceCustomServiceImplementation, } from '../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
 import { assertSuperAdminFloorPreservedForTransition, createSuperAdminConferralResolver, isSuperAdminFloorGovernedSubjectResource, } from '../../../security/authorizations/super-admin-floor.backend.utils.js';
 import { assertOrganizationOwnerFloorPreservedForTransition, createOrganizationOwnerConferralResolver, createOrganizationOwnerFloorPopulationContext, isOrganizationOwnerFloorAuthorityBearingResource, isOrganizationOwnerFloorGovernedSubjectResource, reportOrganizationsStrandedByUserDeactivation, membershipTransitionCouldReduceOwners, } from '../../../security/authorizations/organization-owner-floor.backend.utils.js';
@@ -434,6 +434,9 @@ function resolveStatusTransitionFloorGuards(definition, container) {
                     await container.get(SAAS_SERVICE_TYPES.AuditLogsService)
                         .logOrganizationOwnerFloorBreached({
                         organizationId: breach.organizationId,
+                        // A guard SAW this one and let it through, which is what separates it from the boot
+                        // report's observation of a tenant stranded out-of-band.
+                        detectedBy: AdministrativeContinuityBreachDetection.ALLOWED_LIFECYCLE_ACTION,
                         reducedMemberIds: breach.reducedMemberIds,
                         remainingUsableOwners: breach.remainingUsableOwners,
                         operationIdentifier: definition.operationIdentifier,

package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-status-transition.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAGH,OAAO,EAEL,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAIpH,OAAO,EACL,2CAA2C,EAC3C,iCAAiC,EACjC,wCAAwC,GACzC,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,kDAAkD,EAClD,wCAAwC,EACxC,6CAA6C,EAC7C,gDAAgD,EAChD,+CAA+C,EAC/C,6CAA6C,EAC7C,qCAAqC,GACtC,MAAM,mFAAmF,CAAC;AAG3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAEnH,4EAA4E;AAC5E,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B;;;;;;;;GAQG;AACH,SAAS,+BAA+B,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAyD,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,0FAA0F;IAC1F,iEAA+B,CAAA;IAC/B;;;;OAIG;IACH,uEAAqC,CAAA;AACvC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,4BASX;AATD,WAAY,4BAA4B;IACtC,qDAAqD;IACrD,2CAAW,CAAA;IACX;;;;OAIG;IACH,+CAAe,CAAA;AACjB,CAAC,EATW,4BAA4B,KAA5B,4BAA4B,QASvC;AAED,+FAA+F;AAC/F,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwEjD;;;;;;;;GAQG;AACH,SAAS,8BAA8B,CACrC,KAAc,EACd,cAAiC,EACjC,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO;IAExE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAC1E,OAAO,EAAE;YACP,OAAO,EACL,QAAQ,UAAU,CAAC,mBAAmB,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;kBAC5F,2BAA2B;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,YAAY,EAAE,UAAU,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YACnD,eAAe,EAAE,SAAS;SAC3B;KACF,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,SAAS,4BAA4B,CACnC,UAA8C,EAC9C,KAAc,EACd,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,8FAA8F;IAC9F,iEAAiE;IACjE,IAAI,UAAU,CAAC,IAAI,KAAK,4BAA4B,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExE,MAAM,QAAQ,GAAI,KAA6C,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,UAAU,CAAC,MAAM,KAAK,8BAA8B,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,OAAO,EAAE;oBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,sBAAsB;oBACzD,MAAM,EAAE,6CAA6C;oBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;oBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;iBACpD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,OAAO,EAAE;gBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,oCAAoC;gBACvE,MAAM,EAAE,6CAA6C;gBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,QAAQ;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,OAAO,UAAU,CAAC,UAAU;QAC1B,CAAC,CAAC,CAAC,YAAY,EAAE,4BAA4B,CAAC;QAC9C,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAM1C;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAE1E,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;YACvF,OAAO,EAAE;gBACP,MAAM,EAAE,8DAA8D;gBACtE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;gBAC1B,aAAa,EAAE,UAAU,CAAC,MAAM,IAAI,IAAI;gBACxC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,mBAAmB,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC;aACzD;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;IAEnF,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,CAAC,4BAA4B,CAAC,GAAG,4BAA4B,CAChE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAAC,MAQpE;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEhG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,8FAA8F;sBAC5F,uFAAuF;gBAC3F,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,2CAA2C,CAAC;QAChD,aAAa,EAAE,UAAU,CAAC,GAAG;QAC7B,aAAa,EAAE,UAAU,CAAC,QAAQ;QAClC,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,8CAA8C;QAC9C,SAAS,EAAE,UAAU,CAAC,QAAQ;QAC9B,UAAU;QACV,gBAAgB;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,qDAAqD,CAAC,MAU3E;IACC,MAAM,EACJ,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAC5E,kCAAkC,GACnC,GAAG,MAAM,CAAC;IAEX,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACxD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,6FAA6F;sBAC3F,6FAA6F;sBAC7F,eAAe;gBACnB,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,aAAa,EAAE,UAAU,CAAC,KAAK;QAC/B,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,+FAA+F;QAC/F,SAAS,EAAE,UAAU,CAAC,KAAK;QAC3B,UAAU;QACV,eAAe;KAChB,CAAC;IAEF,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC;QAAE,OAAO;IAE/D,MAAM,kDAAkD,CAAC;QACvD,GAAG,UAAU;QACb,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,cAAc;QACd,gBAAgB,EAAE,MAAM,6CAA6C,CAAC,kCAAkC,EAAE,CAAC;QAC3G,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;KACpD,CAAC,CAAC;AACL,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,SAAS,kCAAkC,CACzC,UAA8C,EAC9C,SAAoB;IAEpB,MAAM,MAAM,GAAiC,EAAE,CAAC;IAEhD,IAAI,wCAAwC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5E,MAAM,2BAA2B,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,8CAA8C,CAAC;YAC7C,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,2BAA2B,EAAE;SAC/C,CAAC,CAAC,CAAC;IACR,CAAC;IAED,8FAA8F;IAC9F,gGAAgG;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,kFAAkF;IAClF,IAAI,+CAA+C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnF,MAAM,0BAA0B,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE;YACxE,MAAM,6CAA6C,CAAC;gBAClD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBACrC,UAAU;gBACV,gBAAgB;gBAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,0BAA0B,EAAE;gBAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACvB,yFAAyF;oBACzF,mFAAmF;oBACnF,uFAAuF;oBACvF,wEAAwE;oBACxE,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;yBAC9E,iCAAiC,CAAC;wBACjC,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;wBACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;wBACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;wBACnD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBACrC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC;qBACtC,EAAE,gBAAgB,CAAC,CAAC;oBAEvB,uFAAuF;oBACvF,wEAAwE;oBACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CACnB,wFAAwF,EACxF;wBACE,MAAM,EAAE,wDAAwD;wBAChE,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBACrC,MAAM,EAAE,uEAAuE;qBAChF,CACF,CAAC;gBACJ,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,gDAAgD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpF,MAAM,sBAAsB,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,2BAAkF,CAAC;QACvF,MAAM,kCAAkC,GAAG,GAA8C,EAAE,CACzF,CAAC,2BAA2B,KAAK,SAAS,CAAC,GAAG,CAC5C,kBAAkB,CAAC,2BAA2B,CAC/C,CAAC,CAAC;QAEL,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,qDAAqD,CAAC;YACpD,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,sBAAsB,EAAE;YACzC,kCAAkC;SACnC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,MAAM,cAAc,GAAG,qCAAqC,CAAC,UAAU,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE;QACnG,MAAM,WAAW,GAAG,kCAAkC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE9E,OAAO,yCAAyC,CAAC;YAC/C,aAAa,EAAE;gBACb,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB,EAAE,IAAI;aACwB;YAClD,UAAU,EACR,UAAU,CAAC,UAAU;mBAClB,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,mBAAmB,oBAAoB;YACnG,2FAA2F;YAC3F,2FAA2F;YAC3F,6FAA6F;YAC7F,4DAA4D;YAC5D,mBAAmB,EAAE,cAAc;YACnC,wFAAwF;YACxF,yFAAyF;YACzF,6DAA6D;YAC7D,EAAE;YACF,2FAA2F;YAC3F,0FAA0F;YAC1F,2FAA2F;YAC3F,wCAAwC;YACxC,EAAE;YACF,qFAAqF;YACrF,0EAA0E;YAC1E,sFAAsF;YACtF,2FAA2F;YAC3F,uFAAuF;YACvF,2FAA2F;YAC3F,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,EAAE;YAC3B,QAAQ,EAAE;gBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBAClF,0FAA0F;oBAC1F,uFAAuF;oBACvF,sFAAsF;oBACtF,EAAE;oBACF,8FAA8F;oBAC9F,4FAA4F;oBAC5F,yFAAyF;oBACzF,0DAA0D;oBAC1D,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;oBACtD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;wBACpC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;4BAC1E,OAAO,EAAE;gCACP,OAAO,EACL,GAAG,UAAU,CAAC,mBAAmB,oDAAoD;sCACnF,uBAAuB;gCAC3B,MAAM,EAAE,wCAAwC;gCAChD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,kBAAkB,EAAE,0BAA0B,CAAC,GAAG,CAAC;6BACpD;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,8BAA8B,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;oBAE3F,0FAA0F;oBAC1F,yFAAyF;oBACzF,4DAA4D;oBAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,aAA6C,CAAC;oBACvE,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;4BAC7D,OAAO,EAAE;gCACP,MAAM,EAAE,6CAA6C;gCACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,iBAAiB;6BAC9B;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,KAAK,GAAG,0BAA0B,CAAC;wBACvC,UAAU;wBACV,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;wBACrD,KAAK;wBACL,gBAAgB;wBAChB,KAAK;qBACN,CAAC,CAAC;oBAEH,uFAAuF;oBACvF,qFAAqF;oBACrF,8EAA8E;oBAC9E,KAAK,MAAM,oBAAoB,IAAI,WAAW,EAAE,CAAC;wBAC/C,MAAM,oBAAoB,CAAC;4BACzB,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;4BACrD,kFAAkF;4BAClF,6DAA6D;4BAC7D,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;4BAC/B,gBAAgB;4BAChB,KAAK;yBACN,CAAC,CAAC;oBACL,CAAC;oBAED,mFAAmF;oBACnF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,0FAA0F;oBAC1F,sFAAsF;oBACtF,wFAAwF;oBACxF,yFAAyF;oBACzF,wFAAwF;oBACxF,gFAAgF;oBAChF,0FAA0F;oBAC1F,+DAA+D;oBAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;oBACtD,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;4BAC7E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;4BACjE,OAAO,EAAE;gCACP,OAAO,EACL,6EAA6E;sCAC3E,uCAAuC;gCAC3C,MAAM,EAAE,uDAAuD;gCAC/D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;gCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;6BAC5D;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,mCAAmC,CAAC,WAAW,EAAE;wBAC/C,GAAG,EAAE,8BAA8B,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;8BACtE,IAAI,UAAU,CAAC,mBAAmB,IAAI,iBAAiB,EAAE;wBAC7D,OAAO,EAAE,KAAK,IAAI,EAAE;4BAClB,IAAI,CAAC;gCACH,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;qCAC9E,oCAAoC,CAAC;oCACpC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;oCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;oCAC3D,SAAS,EAAE,iBAAiB;oCAC5B,WAAW,EAAE,MAAM,CAAC,gBAAgB,EAAE,YAAY,EAAE,MAAM,IAAI,QAAQ,CAAC;oCACvE,cAAc,EAAE,MAAM,CAAE,UAAmC,CAAC,MAAM,IAAI,EAAE,CAAC;oCACzE,SAAS,EAAE,UAAU,CAAC,YAAY;oCAClC,aAAa,EAAE,UAAU,CAAC,eAAe;oCACzC,2EAA2E;oCAC3E,4EAA4E;oCAC5E,qBAAqB;oCACrB,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;oCAC9C,uBAAuB,EACrB,KAAK,CAAC,4BAA4B,CAAC,YAAY,IAAI;wCACjD,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAS;wCAC7C,CAAC,CAAC,SAAS;oCACf,cAAc,EACV,UAA2C,CAAC,cAAqC;2CAChF,gBAAgB,EAAE,YAAY,EAAE,cAAc;iCACpD,EAAE,gBAAgB,CAAC,CAAC;4BACzB,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,mFAAmF;gCACnF,wEAAwE;gCACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kDAAkD,EAAE;oCACxE,MAAM,EAAE,kDAAkD;oCAC1D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;oCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;oCAC3D,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iCAClC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;qBACF,CAAC,CAAC;oBAEH,OAAO,KAAK,CAAC;gBACf,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uCAAuC,CACrD,WAA0D;IAE1D,OAAO,WAAW,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["/**\n * The shared implementation behind every account/entity lifecycle verb.\n *\n * ## What these verbs have in common\n *\n * SUSPEND, ACTIVATE, REACTIVATE, DEACTIVATE_ACCOUNT and their siblings differ only in which status\n * they write and which statuses they accept as a starting point. Each one validates a transition,\n * then writes `{status}` plus at most a scheduling date. Hand-rolling that per verb is how the\n * catalogue drifted in the first place: on 2026-08-01 a sweep found thirteen routed lifecycle\n * variants that declared a request contract, persisted nothing, and answered HTTP 200 — an operator\n * told a CRITICAL suspension had taken effect while the tenant kept serving.\n *\n * One factory, one place where the rules live.\n *\n * ## Why the transition is re-checked here, when `enabledCondition` already gates it\n *\n * It is a fail-closed backstop, NOT a duplicated rule. A custom implementation is addressed by an\n * EXACT operation-path key, so it runs for that path regardless of how the path was reached, while\n * `enabledCondition` is evaluated by the URL-facing dispatch. The organization-members config\n * records the same reasoning for why a role-change verb would not inherit UPDATE's ceiling gate.\n * The two also read different things: the gate sees the pre-fetched object, this sees the row the\n * write is actually about to land on.\n *\n * The rule itself is not duplicated — `allowedFromStatuses` is declared once per registration, and\n * the operation's `enabledCondition` is authored from the same set.\n *\n * ## Why `authoritativeFields` is mandatory here\n *\n * Every status field these verbs write is `.excludeFromUpdate()` — that is the whole reason the\n * verbs exist rather than letting a client PATCH the field. The repository re-parses every write\n * against the operation's `requestDto`, which names no status, so without an explicit declaration\n * the value survives only by being inferred as \"a key the hook added\". That inference is defeated\n * by any caller who reaches the service tier with the key already in the payload, and the write\n * silently becomes empty. See `resolveServerInjectedFieldAllowList` for the full mechanism.\n *\n * ## The trail is registered in the PREFIX and executes on COMMIT\n *\n * Both halves of that matter, and neither works alone:\n *\n *  - **Registered in the prefix**, because that is the only phase that can see the caller's\n *    `reason` / `suspensionReason`. The POSTFIX input is typed `z.infer<TOutput>` — the persisted\n *    row — and these are not schema columns, so they appear on neither. Decision D2 named the trail\n *    as their home; this is what actually puts them there.\n *  - **Executed on commit**, because the prefix runs BEFORE persistence. Emitting there directly\n *    would leave an audit row asserting a suspension that never happened whenever the write failed\n *    — evidence of a state change nobody made, which is worse than no record.\n *\n * `registerTransactionPostCommitEffect` gives both, which is why this factory declares\n * `transactionalCore`. Note this changes NO deployment's transaction posture: the core engine\n * already declares transaction-requiring boundaries unconditionally (organization\n * activate/suspend/request_deletion/restore, organization-units MOVE, platform-access grants,\n * organization-member writes), so `validateInitializedRuntimeTransactionReadiness` already probes\n * every adapter at startup and a store that cannot commit already fails there. An earlier revision\n * of this comment claimed the opposite and used it to defer the fix — that was wrong, and it is\n * recorded here so the claim is not made a second time.\n *\n * `targetStatus` is the persisted FACT once the effect runs, not merely the intent: `status` is\n * declared in `authoritativeFields`, so the strict re-parse cannot strip the patch, and the startup\n * guard proves every declared name is a real persisted field of the resource.\n *\n * ## Why the administrative floors are enforced HERE and not per verb\n *\n * `status` is one of the two axes that decide whether a principal is an administratively usable\n * administrator — of the APPLICATION (with `appRoles`) or of ONE ORGANIZATION (with a membership's\n * `roles`) — and every verb served by this factory writes it. Both floors were originally wired onto\n * their resource's core `UPDATE`, but a custom implementation resolves by an EXACT operation-path\n * key, so neither extended to anything else:\n *\n *  - `PUT /users/{id}/suspend-user` reached the same `status` field through this registration and\n *    returned 200 on the LAST usable super-administrator, leaving an application with no principal\n *    able to administer it and no in-product recovery door (every one is gated on the role now\n *    unusable). Proven end-to-end before it was fixed.\n *  - `organizationMembers | suspend` was the exact sibling: it strands ONE tenant, and\n *    `ORGANIZATION_MEMBERS` declares no super-admin variant, so a platform administrator who is not\n *    a member cannot re-own the stranded organization afterwards. Recovery exists, but only from\n *    OUTSIDE the tenant: `organizationMembers.grantOwnership` is platform-tier.\n *\n * Placing the calls in the SHARED implementation rather than on each verb covers every current and\n * future status verb on every governed resource at once, which is the only version of this fix that\n * cannot be re-opened by the next lifecycle verb somebody adds. Each floor is gated on the subject\n * resource because the floors are scoped invariants while this factory is generic — see\n * {@link resolveStatusTransitionFloorGuards}.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — access-affecting lifecycle\n * changes run through one guarded authority that records what happened, rather than a generic field\n * write, and may not retire the last accountable administrative principal of an application or of a\n * tenant.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ResourceOperationVariantType,\n  type ResourceConfiguration_OperationPath,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  assertSuperAdminFloorPreservedForTransition,\n  createSuperAdminConferralResolver,\n  isSuperAdminFloorGovernedSubjectResource,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n  assertOrganizationOwnerFloorPreservedForTransition,\n  createOrganizationOwnerConferralResolver,\n  createOrganizationOwnerFloorPopulationContext,\n  isOrganizationOwnerFloorAuthorityBearingResource,\n  isOrganizationOwnerFloorGovernedSubjectResource,\n  reportOrganizationsStrandedByUserDeactivation,\n  membershipTransitionCouldReduceOwners,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n  describeUnaddressableShape,\n  resolveSingleSubjectId,\n} from '~wildo-backend-lib/base-classes/utils/single-subject-addressing.backend.utils';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/** The status field every lifecycle-bearing resource in the engine uses. */\nconst STATUS_FIELD = 'status';\n\n/**\n * The caller's justification for a transition, under whichever name its verb gives it.\n *\n * `suspend` calls it `suspensionReason`; the others call it `reason`. Both spellings are read here\n * rather than threaded through each definition, because the value has ONE destination — the audit\n * row — and the request-contract vocabulary is a per-verb surface detail, not a semantic difference.\n * It is never persisted on the row: a suspension reason is a compliance artefact nothing reads back,\n * so a schema column would only create something an erasure would later have to scrub.\n */\nfunction resolveAuthoredTransitionReason(input: unknown): string | undefined {\n  if (!input || typeof input !== 'object') return undefined;\n  const payload = input as { reason?: unknown; suspensionReason?: unknown };\n  const authored = payload.suspensionReason ?? payload.reason;\n  return typeof authored === 'string' && authored.length > 0 ? authored : undefined;\n}\n\n/**\n * How a verb's request contract expresses \"and automatically undo this later\".\n *\n * The persisted field is always `scheduledReactivationAt` — named for the effect so one field and\n * one sweep serve every verb — but the caller-facing vocabulary differs per verb, and one of them\n * is not even an instant. Translating here keeps each request contract in its own natural terms\n * while the row stays uniform, the same split `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in,\n * `parentUnitId` + `path` persisted).\n */\nexport enum StatusTransitionScheduleSource {\n  /** The contract carries an absolute instant (`suspensionEndDate`, `reactivationDate`). */\n  ABSOLUTE_DATE = 'absolute_date',\n  /**\n   * The contract carries a whole number of DAYS (`suspensionDuration`), resolved to an instant at\n   * write time. A duration is meaningless without the moment it is measured from, and the row\n   * records no such moment — so resolving it later would be guesswork.\n   */\n  DURATION_IN_DAYS = 'duration_in_days',\n}\n\n/**\n * What a verb DOES to the pending schedule — the discriminator of\n * {@link ResourceStatusTransitionScheduling}.\n *\n * A named vocabulary rather than an inline `'set' | 'clear'` union, for the same reason\n * {@link StatusTransitionScheduleSource} is one: it is a closed set with exactly one runtime source,\n * so every definition, every narrow, and every test fixture derives from here instead of re-spelling\n * the literal. The two axes are independent — `source` says how the caller EXPRESSES a schedule,\n * this says whether the verb writes one at all.\n */\nexport enum StatusTransitionScheduleMode {\n  /** Carry a caller-supplied schedule onto the row. */\n  SET = 'set',\n  /**\n   * Clear any pending schedule. Every \"undo\" verb uses this: a membership reactivated by hand must\n   * not still carry the date at which a sweep would have reactivated it anyway, or a later\n   * suspension would inherit a stale deadline.\n   */\n  CLEAR = 'clear',\n}\n\n/** The field the reactivation sweep reads. Declared once; every verb writes this same name. */\nconst SCHEDULED_REACTIVATION_FIELD = 'scheduledReactivationAt';\n\nconst MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;\n\nexport type ResourceStatusTransitionScheduling =\n  | {\n      mode: StatusTransitionScheduleMode.SET;\n      /** The key in the operation's `requestDto` that carries it. */\n      requestField: string;\n      source: StatusTransitionScheduleSource;\n    }\n  | {\n      mode: StatusTransitionScheduleMode.CLEAR;\n    };\n\nexport interface ResourceStatusTransitionDefinition {\n  resourceIdentifier: CoreResourceType;\n  /** The custom verb this implements, e.g. `suspend`. */\n  operationIdentifier: string;\n  /** Written to `status` when the transition is legal. */\n  targetStatus: string;\n  /**\n   * The ONLY statuses this verb may run from. Anything else is a `CONFLICT`.\n   *\n   * Fail-closed by construction: an unlisted status is refused rather than allowed. Keep it\n   * identical to the operation's `enabledCondition` — the gate is the fast, user-facing rejection,\n   * this is the backstop that cannot be routed around.\n   */\n  allowedFromStatuses: readonly string[];\n  /** Optional time-boxing. Omit for a verb whose contract offers the caller no window. */\n  scheduling?: ResourceStatusTransitionScheduling;\n  /**\n   * Whether this transition REMOVES access rather than restoring it.\n   *\n   * Declared, not inferred. The obvious proxies are both wrong: \"sets a schedule\" happens to\n   * correlate today (you time-box a restriction) but is a coincidence of the current verbs, and\n   * \"target is not ACTIVE\" cannot be evaluated generically because each resource has its own\n   * status vocabulary. It only feeds the audit event's risk grading, where getting it backwards\n   * would file suspensions among routine reinstatements — so it is worth one explicit word per\n   * definition.\n   */\n  restrictsAccess: boolean;\n  /** Overrides the generated debug label when a resource needs a clearer one. */\n  debugLabel?: string;\n}\n\n/**\n * A NARROW VIEW of the pre-operation snapshot — NOT a description of what the row contains.\n *\n * `utils.currentObject` comes from `fetchCurrentObjectForOperation`, which performs a full\n * `repository.read` on the addressed id, so the snapshot carries EVERY readable field of the row.\n * This type lists only what this implementation reads, and the authority fields are optional because\n * they exist on SOME governed resources and not others — not because a live row is expected to be\n * sparse. Test doubles for `currentObject` should mirror a persisted row, not this projection.\n *\n * The authority axes are read only by the floor guards (see {@link resolveStatusTransitionFloorGuards}):\n *\n * - `appRoles` — the APPLICATION axis, on `USERS` / `USER_SELF`. Those are two resource\n *   configurations over the SAME collection sharing `UserSchema` as their `mainSchema`, so the field\n *   is present through either door.\n * - `roles` + `organizationId` — the ORGANIZATIONS axis, on `ORGANIZATION_MEMBERS`. The first decides\n *   whether the row is an owner grant; the second names the population to measure.\n *\n * All three are typed `unknown` rather than `string[]`/`string` on purpose: this is the raw snapshot,\n * and each floor's own helpers are the authority on what a valid value is.\n */\ntype StatusBearingRow = {\n  _id: string;\n  status?: string;\n  appRoles?: unknown;\n  roles?: unknown;\n  organizationId?: unknown;\n};\n\n/**\n * Refuse a payload that already carries a field this verb owns.\n *\n * Defence in depth for the same hole `authoritativeFields` closes. With the declaration in place\n * such a payload is harmless — the hook's value wins — but the request is still malformed: passing\n * `status` to `suspend` asks the verb to do something other than suspend. A loud 400 beats\n * honouring one of two contradictory instructions, and it surfaces a caller who believes the field\n * is theirs to set.\n */\nfunction assertNoAuthoredFieldInRequest(\n  input: unknown,\n  authoredFields: readonly string[],\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): void {\n  if (!input || typeof input !== 'object' || Array.isArray(input)) return;\n\n  const offending = authoredFields.filter((field) =>\n    Object.prototype.hasOwnProperty.call(input, field));\n  if (offending.length === 0) return;\n\n  throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n    context: {\n      message:\n        `The '${definition.operationIdentifier}' operation owns ${offending.join(', ')} and does not `\n        + 'accept it from the caller',\n      reason: 'resource_status_transition_authored_field_in_request',\n      resourceType: definition.resourceIdentifier,\n      operationIdentifier: definition.operationIdentifier,\n      offendingFields: offending,\n    },\n  });\n}\n\n/** Resolve the caller's scheduling input to the absolute instant the sweep compares against. */\nfunction resolveScheduledReactivation(\n  scheduling: ResourceStatusTransitionScheduling,\n  input: unknown,\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Date | null {\n  // `null`, not `undefined`: the patch must actively CLEAR a stale deadline, and an `undefined`\n  // value is dropped by the write rather than unsetting the field.\n  if (scheduling.mode === StatusTransitionScheduleMode.CLEAR) return null;\n\n  const authored = (input as Record<string, unknown> | undefined)?.[scheduling.requestField];\n  if (authored === undefined || authored === null) return null;\n\n  if (scheduling.source === StatusTransitionScheduleSource.ABSOLUTE_DATE) {\n    const asDate = authored instanceof Date ? authored : new Date(String(authored));\n    if (Number.isNaN(asDate.getTime())) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        context: {\n          message: `${scheduling.requestField} is not a valid date`,\n          reason: 'resource_status_transition_invalid_schedule',\n          resourceType: definition.resourceIdentifier,\n          operationIdentifier: definition.operationIdentifier,\n        },\n      });\n    }\n    return asDate;\n  }\n\n  // DURATION_IN_DAYS — resolve against now, because the row records no other reference moment.\n  const days = typeof authored === 'number' ? authored : Number(authored);\n  if (!Number.isFinite(days) || days <= 0) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      context: {\n        message: `${scheduling.requestField} must be a positive number of days`,\n        reason: 'resource_status_transition_invalid_schedule',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        received: authored,\n      },\n    });\n  }\n  return new Date(Date.now() + days * MILLISECONDS_PER_DAY);\n}\n\n/**\n * The fields a definition writes — and therefore exactly what it must declare as authoritative.\n *\n * Derived rather than authored so the declaration cannot drift from the patch. A verb that gains a\n * schedule gains the declaration in the same edit.\n */\nexport function resolveStatusTransitionAuthoredFields(\n  definition: ResourceStatusTransitionDefinition,\n): string[] {\n  return definition.scheduling\n    ? [STATUS_FIELD, SCHEDULED_REACTIVATION_FIELD]\n    : [STATUS_FIELD];\n}\n\n/**\n * Build the `prefixCoreOperations` patch for one transition.\n *\n * Exported for testing: it is the whole decision, and it is pure apart from the row it is handed.\n */\nexport function buildStatusTransitionPatch(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  input: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}): Record<string, unknown> {\n  const { definition, currentRow, input, executionContext, utils } = params;\n\n  if (!definition.allowedFromStatuses.includes(currentRow.status ?? '')) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n      context: {\n        reason: 'resource_status_transition_not_permitted_from_current_status',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n        currentStatus: currentRow.status ?? null,\n        targetStatus: definition.targetStatus,\n        allowedFromStatuses: [...definition.allowedFromStatuses],\n      },\n    });\n  }\n\n  const patch: Record<string, unknown> = { [STATUS_FIELD]: definition.targetStatus };\n\n  if (definition.scheduling) {\n    patch[SCHEDULED_REACTIVATION_FIELD] = resolveScheduledReactivation(\n      definition.scheduling, input, definition, executionContext, utils,\n    );\n  }\n\n  return patch;\n}\n\n/**\n * Refuse a transition that would leave the application with no administratively usable\n * super-administrator.\n *\n * ## Only the status axis moves\n *\n * These verbs write `status` and at most a schedule — never `appRoles`. So the roles are passed as\n * BOTH the previous and the next value: the transition check needs the authority axis to decide\n * whether the subject counted at all, and stating it unchanged is what makes \"this write cannot\n * touch conferral\" explicit rather than implied by omission.\n *\n * ## Cost\n *\n * `assertSuperAdminFloorPreservedForTransition` short-circuits before issuing any query unless the\n * subject counted toward the floor BEFORE the write and would stop counting after it. So an\n * ordinary user suspension, and every transition INTO the authenticable set (`unsuspend_user`,\n * whose subject was by definition not usable beforehand), pay two set-membership tests and nothing\n * else. Only the genuinely dangerous case reaches the population query.\n *\n * ## Fail closed on a snapshot without the authority axis\n *\n * `appRoles` is what the whole decision turns on. A snapshot that lacks it cannot answer whether\n * this subject is an administrator, and answering \"not an administrator\" would fail OPEN on exactly\n * the input the guard exists for. Refusing instead mirrors the sibling `users | DELETE` guard, and\n * costs nothing in practice: the field carries a `.default([APP_USER])` and both floor-governed\n * resources read the same `UserSchema`, so a live snapshot always carries it.\n *\n * Exported for testing: like {@link buildStatusTransitionPatch} it is the whole decision, and it is\n * pure apart from the row and the collaborators it is handed.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an account-lifecycle change\n * must not retire the last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesSuperAdminFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n}): Promise<void> {\n  const { definition, currentRow, nextStatus, executionContext, utils, conferringRoles } = params;\n\n  if (!Array.isArray(currentRow.appRoles)) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the application roles of the account being changed could not be read, so it cannot '\n          + 'be proven that this transition would not disable the last usable super-administrator.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  await assertSuperAdminFloorPreservedForTransition({\n    subjectUserId: currentRow._id,\n    previousRoles: currentRow.appRoles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction — see the header.\n    nextRoles: currentRow.appRoles,\n    nextStatus,\n    executionContext,\n    repositoriesRegistry: utils.repositoriesRegistry,\n    errorBuilder: utils.errorBuilder,\n    conferringRoles,\n    operationIdentifier: definition.operationIdentifier,\n  });\n}\n\n/**\n * Refuse a transition that would leave an organization with no administratively usable owner.\n *\n * The ORGANIZATION-scope twin of {@link assertStatusTransitionPreservesSuperAdminFloor}, and the\n * differences are all consequences of the population being per-tenant rather than per-application:\n *\n * - **The subject names its own population.** `organizationId` selects which tenant to measure, so a\n *   snapshot without it cannot be evaluated at all — unlike the application floor, where there is\n *   only ever one population.\n * - **The measurement runs under a SYSTEM context, not the caller's.** The floor must see every owner\n *   membership AND the `status` of every one of those owners' `User` rows, and the `ORG_ADMIN`s who\n *   reach these verbs cannot list `USERS` at all. The authority owns that decision — see\n *   {@link createOrganizationOwnerFloorPopulationContext}.\n * - **The short-circuit is asked HERE, before the context is built.** Constructing the system context\n *   is a registry lookup plus a possible application-id resolution, and suspending an ordinary member\n *   — the overwhelmingly common case — must not pay for it. This is not a second copy of the rule:\n *   {@link membershipTransitionCouldReduceOwners} is the authority's own predicate, and the assertion\n *   below calls it again.\n *\n * Fails closed on a snapshot that carries no `roles` or no `organizationId`, for the reason the\n * application twin does: answering \"not an owner\" would fail OPEN on exactly the input the guard\n * exists for, and a suspended last owner cannot be reactivated by anyone — `ORGANIZATION_MEMBERS`\n * declares exactly one cross-tenant variant — `grantOwnership` — so recovery from a stranded state\n * is a platform-operator action, never a tenant one. That is why the in-tenant refusal still stands.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a membership-lifecycle change\n * must not retire a tenant's last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesOrganizationOwnerFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n  /** Resolved lazily and only once a reduction is established — see the header. */\n  resolveAuthExecutionContextFactory: () => AuthExecutionContextFactoryBackendService;\n}): Promise<void> {\n  const {\n    definition, currentRow, nextStatus, executionContext, utils, conferringRoles,\n    resolveAuthExecutionContextFactory,\n  } = params;\n\n  const organizationId = typeof currentRow.organizationId === 'string' ? currentRow.organizationId : undefined;\n\n  if (!Array.isArray(currentRow.roles) || !organizationId) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the roles or the owning organization of the membership being changed could not be '\n          + \"read, so it cannot be proven that this transition would not retire the organization's last \"\n          + 'usable owner.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  const transition = {\n    previousRoles: currentRow.roles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction: these verbs write `status` and at most a schedule, never `roles`.\n    nextRoles: currentRow.roles,\n    nextStatus,\n    conferringRoles,\n  };\n\n  if (!membershipTransitionCouldReduceOwners(transition)) return;\n\n  await assertOrganizationOwnerFloorPreservedForTransition({\n    ...transition,\n    memberId: currentRow._id,\n    organizationId,\n    executionContext: await createOrganizationOwnerFloorPopulationContext(resolveAuthExecutionContextFactory()),\n    repositoriesRegistry: utils.repositoriesRegistry,\n    errorBuilder: utils.errorBuilder,\n    operationIdentifier: definition.operationIdentifier,\n  });\n}\n\n/**\n * One administrative floor a status transition must not breach, bound to a single definition.\n *\n * A list rather than a chain of `if`s inside the hook, because the set of floors that govern a row is\n * a property of the RESOURCE and is therefore decidable once, at factory construction, from static\n * data. Adding the next authority is one entry here — and, more to the point, a lifecycle verb added\n * to a governed resource inherits every floor automatically instead of depending on somebody\n * remembering to wire it. That omission is the whole defect class this file now closes.\n */\ntype StatusTransitionFloorGuard = (params: {\n  currentRow: StatusBearingRow;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}) => Promise<void>;\n\n/**\n * The floors that govern one definition's resource, resolved once when the factory is built.\n *\n * Every collaborator is bound LAZILY. Factories are constructed during module registration, which can\n * run before the authorization and authentication services are bound, so an eager `container.get`\n * would turn a guard into a startup crash. The conferral resolvers additionally re-read the live role\n * table on every call, because `initializeRolesWithCustom` mutates it in place.\n *\n * A resource governed by NO floor gets an empty list and pays nothing at all — not a container\n * lookup, not a closure invocation. That is the common case (organization units, and every\n * application resource that grows a lifecycle verb later).\n */\nfunction resolveStatusTransitionFloorGuards(\n  definition: ResourceStatusTransitionDefinition,\n  container: Container,\n): StatusTransitionFloorGuard[] {\n  const guards: StatusTransitionFloorGuard[] = [];\n\n  if (isSuperAdminFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const superAdminConferralResolver = createSuperAdminConferralResolver(container);\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesSuperAdminFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: superAdminConferralResolver(),\n      }));\n  }\n\n  // ── USERS lifecycle: REPORT, never refuse ──────────────────────────────────────────────────\n  // A deactivated user stops counting as a usable owner, so this transition can strand a tenant —\n  // and unlike every other floor surface it must still be allowed to proceed. Suspension is normally\n  // incident response, and refusing it would mean an operator cannot lock out a compromised owner\n  // without first transferring ownership using the tenant the attacker controls. The stranded tenant\n  // is recoverable (boot report finds it, `grantOwnership` repairs it); the live hostile session is\n  // not. See `reportOrganizationsStrandedByUserDeactivation` for the full argument.\n  if (isOrganizationOwnerFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const strandingConferralResolver = createOrganizationOwnerConferralResolver(container);\n    guards.push(async ({ currentRow, nextStatus, executionContext, utils }) => {\n      await reportOrganizationsStrandedByUserDeactivation({\n        subjectUserId: String(currentRow._id),\n        nextStatus,\n        executionContext,\n        repositoriesRegistry: utils.repositoriesRegistry,\n        errorBuilder: utils.errorBuilder,\n        conferringRoles: strandingConferralResolver(),\n        operationIdentifier: definition.operationIdentifier,\n        report: async (breach) => {\n          // An AUDIT ROW, not a log line — one per stranded tenant. The justification for allowing\n          // this write at all is that the consequence becomes visible, and a log line is not\n          // queryable evidence and never reaches a SIEM. `CRITICAL` + the AUTHORIZATION category\n          // route it through the same export path as every other authority event.\n          await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n            .logOrganizationOwnerFloorBreached({\n              organizationId: breach.organizationId,\n              reducedMemberIds: breach.reducedMemberIds,\n              remainingUsableOwners: breach.remainingUsableOwners,\n              operationIdentifier: definition.operationIdentifier,\n              subjectUserId: String(currentRow._id),\n              subjectNextStatus: String(nextStatus),\n            }, executionContext);\n\n          // The log line stays as the operator-facing half: an audit row is for the auditor, and\n          // whoever is on call during an incident is reading logs, not the trail.\n          utils.logger?.error?.(\n            'Organization left with no administratively usable owner by a user lifecycle transition',\n            {\n              reason: 'organization_owner_floor_stranded_by_user_deactivation',\n              organizationId: breach.organizationId,\n              subjectUserId: String(currentRow._id),\n              remedy: 'organizationMembers.grantOwnership (platform-tier) restores an owner.',\n            },\n          );\n        },\n      });\n    });\n  }\n\n  if (isOrganizationOwnerFloorAuthorityBearingResource(definition.resourceIdentifier)) {\n    const ownerConferralResolver = createOrganizationOwnerConferralResolver(container);\n    let authExecutionContextFactory: AuthExecutionContextFactoryBackendService | undefined;\n    const resolveAuthExecutionContextFactory = (): AuthExecutionContextFactoryBackendService =>\n      (authExecutionContextFactory ??= container.get<AuthExecutionContextFactoryBackendService>(\n        SAAS_SERVICE_TYPES.AuthExecutionContextFactory,\n      ));\n\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesOrganizationOwnerFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: ownerConferralResolver(),\n        resolveAuthExecutionContextFactory,\n      }));\n  }\n\n  return guards;\n}\n\n/**\n * One lifecycle transition, as a registrable custom implementation.\n *\n * Modelled on `createOrganizationUnitStatusTransitionFactory`, which established the pattern for\n * this engine: validate against the loaded row, then RETURN the field patch for the core UPDATE to\n * persist rather than writing directly. The difference is that this one is resource-agnostic and\n * declares `authoritativeFields`, which the org-units original did not need — its `status` is not\n * `.excludeFromUpdate()`, so its patch survived on the introduced-key inference alone.\n */\nexport function createResourceStatusTransitionFactory(\n  definition: ResourceStatusTransitionDefinition,\n): ResourceCustomServiceImplementationFactory {\n  const authoredFields = resolveStatusTransitionAuthoredFields(definition);\n\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) => {\n    const floorGuards = resolveStatusTransitionFloorGuards(definition, container);\n\n    return createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      } as ResourceConfiguration_OperationPath<any, any>,\n      debugLabel:\n        definition.debugLabel\n        ?? `${String(definition.resourceIdentifier)}.${definition.operationIdentifier}.status-transition`,\n      // `status` and `scheduledReactivationAt` are `.excludeFromUpdate()` on every resource this\n      // serves. Without this the repository's strict re-parse drops the patch for any caller who\n      // reached the service tier with the key already present, and the verb answers success having\n      // changed nothing — the exact defect it was written to fix.\n      authoritativeFields: authoredFields,\n      // The audit row is registered from the PREFIX (the only phase that can see the caller's\n      // `reason`) and executes on COMMIT, so it never describes a write that rolled back. That\n      // needs a commit hook to exist, which is what this declares.\n      //\n      // No participants: the transition writes exactly one row, on the operation's own resource,\n      // which the framework includes automatically. Contrast the ORGANIZATIONS lifecycle verbs,\n      // which name ORGANIZATION_MEMBERS + USERS because they reconcile membership-derived global\n      // `userTypes` in the same unit of work.\n      //\n      // This does NOT change any deployment's transaction posture: the core engine already\n      // declares transaction-requiring boundaries unconditionally (organization\n      // activate/suspend/request_deletion/restore, organization-units MOVE, platform-access\n      // grants, organization-member writes), so `validateInitializedRuntimeTransactionReadiness`\n      // already probes every adapter at startup and a store that cannot commit already fails\n      // there — see the `rejects transaction readiness against a standalone MongoDB server` pin.\n      transactionalCore: true,\n      transactionParticipants: {},\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          // Fail closed on anything but a single addressed row. An ids array or a population filter\n          // reaching this path would make the status check evaluate against the wrong thing — or\n          // against nothing — while still returning a patch the core write would happily apply.\n          //\n          // A conditional `{ _id, … }` filter is single-subject and therefore admitted: `_id` names the\n          // row the pre-fetched `currentObject` below describes, and the extra predicates only decide\n          // whether the core write lands. Refusing it used to make status transitions the ONE verb\n          // family that could not be written as a compare-and-swap.\n          const subjectResourceId = resolveSingleSubjectId(_id);\n          if (subjectResourceId === undefined) {\n            throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n              context: {\n                message:\n                  `${definition.operationIdentifier} requires a single addressed resource to validate `\n                  + 'the status transition',\n                reason: 'resource_status_transition_unaddressed',\n                resourceType: definition.resourceIdentifier,\n                receivedAddressing: describeUnaddressableShape(_id),\n              },\n            });\n          }\n\n          assertNoAuthoredFieldInRequest(input, authoredFields, definition, executionContext, utils);\n\n          // The framework pre-fetches the target row for UPDATE-like operations, so this is the row\n          // the write is about to land on. Absent means the transition cannot be validated — which\n          // must never read as \"allowed\" on an access-affecting verb.\n          const currentRow = utils.currentObject as StatusBearingRow | undefined;\n          if (!currentRow) {\n            throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n              context: {\n                reason: 'resource_status_transition_target_not_found',\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: subjectResourceId,\n              },\n            });\n          }\n\n          const patch = buildStatusTransitionPatch({\n            definition,\n            currentRow: { ...currentRow, _id: subjectResourceId },\n            input,\n            executionContext,\n            utils,\n          });\n\n          // AFTER the transition-legality check on purpose: a verb refused because it cannot run\n          // from the current status should say so — the more specific finding — and should not\n          // have issued a floor's population query on the way to being rejected anyway.\n          for (const assertFloorPreserved of floorGuards) {\n            await assertFloorPreserved({\n              currentRow: { ...currentRow, _id: subjectResourceId },\n              // Read from the patch rather than re-derived from the definition, so no guard can\n              // measure a status other than the one about to be persisted.\n              nextStatus: patch[STATUS_FIELD],\n              executionContext,\n              utils,\n            });\n          }\n\n          // Trail the transition. Registered HERE — the only phase that can see the caller's\n          // `reason`, since the POSTFIX input is typed `z.infer<TOutput>` (the persisted row) and\n          // `reason` is not a schema column, so it appears on neither.\n          //\n          // It EXECUTES on commit, so it never describes a write that rolled back. That is why the\n          // registration declares `transactionalCore` above: without a commit hook the choice would\n          // be between emitting early (recording suspensions that later failed) and emitting from a\n          // postfix that cannot see the reason. With one, neither compromise is necessary.\n          //\n          // `targetStatus` is the persisted fact once this commits, not merely the intent: `status`\n          // is declared in `authoritativeFields`, so the patch cannot be stripped by the strict\n          // re-parse, and the startup guard proves every declared name is a real persisted field.\n          // Fail CLOSED on a missing transaction rather than skipping the trail. This registration\n          // declares `transactionalCore`, so the framework guarantees one; its absence means that\n          // contract is broken, and silently proceeding would perform an access-affecting\n          // transition with no record — the outcome the audit exists to make impossible. Same shape\n          // as `registerOrganizationLifecycleAudit` on the tenant verbs.\n          const transaction = utils.serviceOptions?.transaction;\n          if (!transaction) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n              context: {\n                message:\n                  'A status transition cannot be recorded: no transaction is active, but this '\n                  + 'operation declares transactionalCore.',\n                reason: 'resource_status_transition_audit_requires_transaction',\n                resourceType: String(definition.resourceIdentifier),\n                operationIdentifier: String(definition.operationIdentifier),\n              },\n            });\n          }\n\n          registerTransactionPostCommitEffect(transaction, {\n            key: `resource-status-transition:${String(definition.resourceIdentifier)}`\n              + `:${definition.operationIdentifier}:${subjectResourceId}`,\n            execute: async () => {\n              try {\n                await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n                  .logResourceStatusTransitionPerformed({\n                    resourceType: String(definition.resourceIdentifier),\n                    operationIdentifier: String(definition.operationIdentifier),\n                    subjectId: subjectResourceId,\n                    performedBy: String(executionContext?.initiatorIds?.userId ?? 'system'),\n                    previousStatus: String((currentRow as { status?: unknown }).status ?? ''),\n                    newStatus: definition.targetStatus,\n                    isRestricting: definition.restrictsAccess,\n                    // The field decision D2 promised the trail would carry. Both spellings are\n                    // accepted because the verbs differ: `suspend` names it `suspensionReason`,\n                    // the rest `reason`.\n                    reason: resolveAuthoredTransitionReason(input),\n                    scheduledReactivationAt:\n                      patch[SCHEDULED_REACTIVATION_FIELD] instanceof Date\n                        ? patch[SCHEDULED_REACTIVATION_FIELD] as Date\n                        : undefined,\n                    organizationId:\n                      ((currentRow as { organizationId?: unknown }).organizationId as string | undefined)\n                      ?? executionContext?.initiatorIds?.organizationId,\n                  }, executionContext);\n              } catch (error) {\n                // A trail failure must not fail the transition it describes — but it must be loud,\n                // so a dropped record reaches whoever is on call rather than vanishing.\n                utils.logger?.error?.('Failed to record a status-transition audit event', {\n                  reason: 'resource_status_transition_audit_emission_failed',\n                  resourceType: String(definition.resourceIdentifier),\n                  operationIdentifier: String(definition.operationIdentifier),\n                  error: describeCaughtError(error),\n                });\n              }\n            },\n          });\n\n          return patch;\n        },\n      },\n    });\n  };\n\n  return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n/** Build every registration for a resource's lifecycle verbs in one call. */\nexport function createResourceStatusTransitionFactories(\n  definitions: readonly ResourceStatusTransitionDefinition[],\n): ResourceCustomServiceImplementationFactory[] {\n  return definitions.map(createResourceStatusTransitionFactory);\n}\n"]}
+{"version":3,"file":"resource-status-transition.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAGH,OAAO,EACL,uCAAuC,EAEvC,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAIpH,OAAO,EACL,2CAA2C,EAC3C,iCAAiC,EACjC,wCAAwC,GACzC,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,kDAAkD,EAClD,wCAAwC,EACxC,6CAA6C,EAC7C,gDAAgD,EAChD,+CAA+C,EAC/C,6CAA6C,EAC7C,qCAAqC,GACtC,MAAM,mFAAmF,CAAC;AAG3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAEnH,4EAA4E;AAC5E,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B;;;;;;;;GAQG;AACH,SAAS,+BAA+B,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAyD,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,0FAA0F;IAC1F,iEAA+B,CAAA;IAC/B;;;;OAIG;IACH,uEAAqC,CAAA;AACvC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,4BASX;AATD,WAAY,4BAA4B;IACtC,qDAAqD;IACrD,2CAAW,CAAA;IACX;;;;OAIG;IACH,+CAAe,CAAA;AACjB,CAAC,EATW,4BAA4B,KAA5B,4BAA4B,QASvC;AAED,+FAA+F;AAC/F,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwEjD;;;;;;;;GAQG;AACH,SAAS,8BAA8B,CACrC,KAAc,EACd,cAAiC,EACjC,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO;IAExE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAC1E,OAAO,EAAE;YACP,OAAO,EACL,QAAQ,UAAU,CAAC,mBAAmB,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;kBAC5F,2BAA2B;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,YAAY,EAAE,UAAU,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YACnD,eAAe,EAAE,SAAS;SAC3B;KACF,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,SAAS,4BAA4B,CACnC,UAA8C,EAC9C,KAAc,EACd,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,8FAA8F;IAC9F,iEAAiE;IACjE,IAAI,UAAU,CAAC,IAAI,KAAK,4BAA4B,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExE,MAAM,QAAQ,GAAI,KAA6C,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,UAAU,CAAC,MAAM,KAAK,8BAA8B,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,OAAO,EAAE;oBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,sBAAsB;oBACzD,MAAM,EAAE,6CAA6C;oBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;oBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;iBACpD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,OAAO,EAAE;gBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,oCAAoC;gBACvE,MAAM,EAAE,6CAA6C;gBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,QAAQ;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,OAAO,UAAU,CAAC,UAAU;QAC1B,CAAC,CAAC,CAAC,YAAY,EAAE,4BAA4B,CAAC;QAC9C,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAM1C;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAE1E,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;YACvF,OAAO,EAAE;gBACP,MAAM,EAAE,8DAA8D;gBACtE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;gBAC1B,aAAa,EAAE,UAAU,CAAC,MAAM,IAAI,IAAI;gBACxC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,mBAAmB,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC;aACzD;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;IAEnF,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,CAAC,4BAA4B,CAAC,GAAG,4BAA4B,CAChE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAAC,MAQpE;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEhG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,8FAA8F;sBAC5F,uFAAuF;gBAC3F,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,2CAA2C,CAAC;QAChD,aAAa,EAAE,UAAU,CAAC,GAAG;QAC7B,aAAa,EAAE,UAAU,CAAC,QAAQ;QAClC,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,8CAA8C;QAC9C,SAAS,EAAE,UAAU,CAAC,QAAQ;QAC9B,UAAU;QACV,gBAAgB;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,qDAAqD,CAAC,MAU3E;IACC,MAAM,EACJ,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAC5E,kCAAkC,GACnC,GAAG,MAAM,CAAC;IAEX,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACxD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,6FAA6F;sBAC3F,6FAA6F;sBAC7F,eAAe;gBACnB,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,aAAa,EAAE,UAAU,CAAC,KAAK;QAC/B,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,+FAA+F;QAC/F,SAAS,EAAE,UAAU,CAAC,KAAK;QAC3B,UAAU;QACV,eAAe;KAChB,CAAC;IAEF,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC;QAAE,OAAO;IAE/D,MAAM,kDAAkD,CAAC;QACvD,GAAG,UAAU;QACb,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,cAAc;QACd,gBAAgB,EAAE,MAAM,6CAA6C,CAAC,kCAAkC,EAAE,CAAC;QAC3G,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;KACpD,CAAC,CAAC;AACL,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,SAAS,kCAAkC,CACzC,UAA8C,EAC9C,SAAoB;IAEpB,MAAM,MAAM,GAAiC,EAAE,CAAC;IAEhD,IAAI,wCAAwC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5E,MAAM,2BAA2B,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,8CAA8C,CAAC;YAC7C,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,2BAA2B,EAAE;SAC/C,CAAC,CAAC,CAAC;IACR,CAAC;IAED,8FAA8F;IAC9F,gGAAgG;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,kFAAkF;IAClF,IAAI,+CAA+C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnF,MAAM,0BAA0B,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE;YACxE,MAAM,6CAA6C,CAAC;gBAClD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBACrC,UAAU;gBACV,gBAAgB;gBAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,0BAA0B,EAAE;gBAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACvB,yFAAyF;oBACzF,mFAAmF;oBACnF,uFAAuF;oBACvF,wEAAwE;oBACxE,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;yBAC9E,iCAAiC,CAAC;wBACjC,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,oFAAoF;wBACpF,yDAAyD;wBACzD,UAAU,EAAE,uCAAuC,CAAC,wBAAwB;wBAC5E,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;wBACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;wBACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;wBACnD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBACrC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC;qBACtC,EAAE,gBAAgB,CAAC,CAAC;oBAEvB,uFAAuF;oBACvF,wEAAwE;oBACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CACnB,wFAAwF,EACxF;wBACE,MAAM,EAAE,wDAAwD;wBAChE,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBACrC,MAAM,EAAE,uEAAuE;qBAChF,CACF,CAAC;gBACJ,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,gDAAgD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpF,MAAM,sBAAsB,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,2BAAkF,CAAC;QACvF,MAAM,kCAAkC,GAAG,GAA8C,EAAE,CACzF,CAAC,2BAA2B,KAAK,SAAS,CAAC,GAAG,CAC5C,kBAAkB,CAAC,2BAA2B,CAC/C,CAAC,CAAC;QAEL,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,qDAAqD,CAAC;YACpD,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,sBAAsB,EAAE;YACzC,kCAAkC;SACnC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,MAAM,cAAc,GAAG,qCAAqC,CAAC,UAAU,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE;QACnG,MAAM,WAAW,GAAG,kCAAkC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE9E,OAAO,yCAAyC,CAAC;YAC/C,aAAa,EAAE;gBACb,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB,EAAE,IAAI;aACwB;YAClD,UAAU,EACR,UAAU,CAAC,UAAU;mBAClB,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,mBAAmB,oBAAoB;YACnG,2FAA2F;YAC3F,2FAA2F;YAC3F,6FAA6F;YAC7F,4DAA4D;YAC5D,mBAAmB,EAAE,cAAc;YACnC,wFAAwF;YACxF,yFAAyF;YACzF,6DAA6D;YAC7D,EAAE;YACF,2FAA2F;YAC3F,0FAA0F;YAC1F,2FAA2F;YAC3F,wCAAwC;YACxC,EAAE;YACF,qFAAqF;YACrF,0EAA0E;YAC1E,sFAAsF;YACtF,2FAA2F;YAC3F,uFAAuF;YACvF,2FAA2F;YAC3F,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,EAAE;YAC3B,QAAQ,EAAE;gBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBAClF,0FAA0F;oBAC1F,uFAAuF;oBACvF,sFAAsF;oBACtF,EAAE;oBACF,8FAA8F;oBAC9F,4FAA4F;oBAC5F,yFAAyF;oBACzF,0DAA0D;oBAC1D,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;oBACtD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;wBACpC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;4BAC1E,OAAO,EAAE;gCACP,OAAO,EACL,GAAG,UAAU,CAAC,mBAAmB,oDAAoD;sCACnF,uBAAuB;gCAC3B,MAAM,EAAE,wCAAwC;gCAChD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,kBAAkB,EAAE,0BAA0B,CAAC,GAAG,CAAC;6BACpD;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,8BAA8B,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;oBAE3F,0FAA0F;oBAC1F,yFAAyF;oBACzF,4DAA4D;oBAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,aAA6C,CAAC;oBACvE,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;4BAC7D,OAAO,EAAE;gCACP,MAAM,EAAE,6CAA6C;gCACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,iBAAiB;6BAC9B;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,KAAK,GAAG,0BAA0B,CAAC;wBACvC,UAAU;wBACV,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;wBACrD,KAAK;wBACL,gBAAgB;wBAChB,KAAK;qBACN,CAAC,CAAC;oBAEH,uFAAuF;oBACvF,qFAAqF;oBACrF,8EAA8E;oBAC9E,KAAK,MAAM,oBAAoB,IAAI,WAAW,EAAE,CAAC;wBAC/C,MAAM,oBAAoB,CAAC;4BACzB,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;4BACrD,kFAAkF;4BAClF,6DAA6D;4BAC7D,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;4BAC/B,gBAAgB;4BAChB,KAAK;yBACN,CAAC,CAAC;oBACL,CAAC;oBAED,mFAAmF;oBACnF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,0FAA0F;oBAC1F,sFAAsF;oBACtF,wFAAwF;oBACxF,yFAAyF;oBACzF,wFAAwF;oBACxF,gFAAgF;oBAChF,0FAA0F;oBAC1F,+DAA+D;oBAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;oBACtD,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;4BAC7E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;4BACjE,OAAO,EAAE;gCACP,OAAO,EACL,6EAA6E;sCAC3E,uCAAuC;gCAC3C,MAAM,EAAE,uDAAuD;gCAC/D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;gCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;6BAC5D;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,mCAAmC,CAAC,WAAW,EAAE;wBAC/C,GAAG,EAAE,8BAA8B,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;8BACtE,IAAI,UAAU,CAAC,mBAAmB,IAAI,iBAAiB,EAAE;wBAC7D,OAAO,EAAE,KAAK,IAAI,EAAE;4BAClB,IAAI,CAAC;gCACH,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;qCAC9E,oCAAoC,CAAC;oCACpC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;oCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;oCAC3D,SAAS,EAAE,iBAAiB;oCAC5B,WAAW,EAAE,MAAM,CAAC,gBAAgB,EAAE,YAAY,EAAE,MAAM,IAAI,QAAQ,CAAC;oCACvE,cAAc,EAAE,MAAM,CAAE,UAAmC,CAAC,MAAM,IAAI,EAAE,CAAC;oCACzE,SAAS,EAAE,UAAU,CAAC,YAAY;oCAClC,aAAa,EAAE,UAAU,CAAC,eAAe;oCACzC,2EAA2E;oCAC3E,4EAA4E;oCAC5E,qBAAqB;oCACrB,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;oCAC9C,uBAAuB,EACrB,KAAK,CAAC,4BAA4B,CAAC,YAAY,IAAI;wCACjD,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAS;wCAC7C,CAAC,CAAC,SAAS;oCACf,cAAc,EACV,UAA2C,CAAC,cAAqC;2CAChF,gBAAgB,EAAE,YAAY,EAAE,cAAc;iCACpD,EAAE,gBAAgB,CAAC,CAAC;4BACzB,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,mFAAmF;gCACnF,wEAAwE;gCACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kDAAkD,EAAE;oCACxE,MAAM,EAAE,kDAAkD;oCAC1D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;oCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;oCAC3D,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iCAClC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;qBACF,CAAC,CAAC;oBAEH,OAAO,KAAK,CAAC;gBACf,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uCAAuC,CACrD,WAA0D;IAE1D,OAAO,WAAW,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["/**\n * The shared implementation behind every account/entity lifecycle verb.\n *\n * ## What these verbs have in common\n *\n * SUSPEND, ACTIVATE, REACTIVATE, DEACTIVATE_ACCOUNT and their siblings differ only in which status\n * they write and which statuses they accept as a starting point. Each one validates a transition,\n * then writes `{status}` plus at most a scheduling date. Hand-rolling that per verb is how the\n * catalogue drifted in the first place: on 2026-08-01 a sweep found thirteen routed lifecycle\n * variants that declared a request contract, persisted nothing, and answered HTTP 200 — an operator\n * told a CRITICAL suspension had taken effect while the tenant kept serving.\n *\n * One factory, one place where the rules live.\n *\n * ## Why the transition is re-checked here, when `enabledCondition` already gates it\n *\n * It is a fail-closed backstop, NOT a duplicated rule. A custom implementation is addressed by an\n * EXACT operation-path key, so it runs for that path regardless of how the path was reached, while\n * `enabledCondition` is evaluated by the URL-facing dispatch. The organization-members config\n * records the same reasoning for why a role-change verb would not inherit UPDATE's ceiling gate.\n * The two also read different things: the gate sees the pre-fetched object, this sees the row the\n * write is actually about to land on.\n *\n * The rule itself is not duplicated — `allowedFromStatuses` is declared once per registration, and\n * the operation's `enabledCondition` is authored from the same set.\n *\n * ## Why `authoritativeFields` is mandatory here\n *\n * Every status field these verbs write is `.excludeFromUpdate()` — that is the whole reason the\n * verbs exist rather than letting a client PATCH the field. The repository re-parses every write\n * against the operation's `requestDto`, which names no status, so without an explicit declaration\n * the value survives only by being inferred as \"a key the hook added\". That inference is defeated\n * by any caller who reaches the service tier with the key already in the payload, and the write\n * silently becomes empty. See `resolveServerInjectedFieldAllowList` for the full mechanism.\n *\n * ## The trail is registered in the PREFIX and executes on COMMIT\n *\n * Both halves of that matter, and neither works alone:\n *\n *  - **Registered in the prefix**, because that is the only phase that can see the caller's\n *    `reason` / `suspensionReason`. The POSTFIX input is typed `z.infer<TOutput>` — the persisted\n *    row — and these are not schema columns, so they appear on neither. Decision D2 named the trail\n *    as their home; this is what actually puts them there.\n *  - **Executed on commit**, because the prefix runs BEFORE persistence. Emitting there directly\n *    would leave an audit row asserting a suspension that never happened whenever the write failed\n *    — evidence of a state change nobody made, which is worse than no record.\n *\n * `registerTransactionPostCommitEffect` gives both, which is why this factory declares\n * `transactionalCore`. Note this changes NO deployment's transaction posture: the core engine\n * already declares transaction-requiring boundaries unconditionally (organization\n * activate/suspend/request_deletion/restore, organization-units MOVE, platform-access grants,\n * organization-member writes), so `validateInitializedRuntimeTransactionReadiness` already probes\n * every adapter at startup and a store that cannot commit already fails there. An earlier revision\n * of this comment claimed the opposite and used it to defer the fix — that was wrong, and it is\n * recorded here so the claim is not made a second time.\n *\n * `targetStatus` is the persisted FACT once the effect runs, not merely the intent: `status` is\n * declared in `authoritativeFields`, so the strict re-parse cannot strip the patch, and the startup\n * guard proves every declared name is a real persisted field of the resource.\n *\n * ## Why the administrative floors are enforced HERE and not per verb\n *\n * `status` is one of the two axes that decide whether a principal is an administratively usable\n * administrator — of the APPLICATION (with `appRoles`) or of ONE ORGANIZATION (with a membership's\n * `roles`) — and every verb served by this factory writes it. Both floors were originally wired onto\n * their resource's core `UPDATE`, but a custom implementation resolves by an EXACT operation-path\n * key, so neither extended to anything else:\n *\n *  - `PUT /users/{id}/suspend-user` reached the same `status` field through this registration and\n *    returned 200 on the LAST usable super-administrator, leaving an application with no principal\n *    able to administer it and no in-product recovery door (every one is gated on the role now\n *    unusable). Proven end-to-end before it was fixed.\n *  - `organizationMembers | suspend` was the exact sibling: it strands ONE tenant, and\n *    `ORGANIZATION_MEMBERS` declares no super-admin variant, so a platform administrator who is not\n *    a member cannot re-own the stranded organization afterwards. Recovery exists, but only from\n *    OUTSIDE the tenant: `organizationMembers.grantOwnership` is platform-tier.\n *\n * Placing the calls in the SHARED implementation rather than on each verb covers every current and\n * future status verb on every governed resource at once, which is the only version of this fix that\n * cannot be re-opened by the next lifecycle verb somebody adds. Each floor is gated on the subject\n * resource because the floors are scoped invariants while this factory is generic — see\n * {@link resolveStatusTransitionFloorGuards}.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — access-affecting lifecycle\n * changes run through one guarded authority that records what happened, rather than a generic field\n * write, and may not retire the last accountable administrative principal of an application or of a\n * tenant.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  AdministrativeContinuityBreachDetection,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ResourceOperationVariantType,\n  type ResourceConfiguration_OperationPath,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  assertSuperAdminFloorPreservedForTransition,\n  createSuperAdminConferralResolver,\n  isSuperAdminFloorGovernedSubjectResource,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n  assertOrganizationOwnerFloorPreservedForTransition,\n  createOrganizationOwnerConferralResolver,\n  createOrganizationOwnerFloorPopulationContext,\n  isOrganizationOwnerFloorAuthorityBearingResource,\n  isOrganizationOwnerFloorGovernedSubjectResource,\n  reportOrganizationsStrandedByUserDeactivation,\n  membershipTransitionCouldReduceOwners,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n  describeUnaddressableShape,\n  resolveSingleSubjectId,\n} from '~wildo-backend-lib/base-classes/utils/single-subject-addressing.backend.utils';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/** The status field every lifecycle-bearing resource in the engine uses. */\nconst STATUS_FIELD = 'status';\n\n/**\n * The caller's justification for a transition, under whichever name its verb gives it.\n *\n * `suspend` calls it `suspensionReason`; the others call it `reason`. Both spellings are read here\n * rather than threaded through each definition, because the value has ONE destination — the audit\n * row — and the request-contract vocabulary is a per-verb surface detail, not a semantic difference.\n * It is never persisted on the row: a suspension reason is a compliance artefact nothing reads back,\n * so a schema column would only create something an erasure would later have to scrub.\n */\nfunction resolveAuthoredTransitionReason(input: unknown): string | undefined {\n  if (!input || typeof input !== 'object') return undefined;\n  const payload = input as { reason?: unknown; suspensionReason?: unknown };\n  const authored = payload.suspensionReason ?? payload.reason;\n  return typeof authored === 'string' && authored.length > 0 ? authored : undefined;\n}\n\n/**\n * How a verb's request contract expresses \"and automatically undo this later\".\n *\n * The persisted field is always `scheduledReactivationAt` — named for the effect so one field and\n * one sweep serve every verb — but the caller-facing vocabulary differs per verb, and one of them\n * is not even an instant. Translating here keeps each request contract in its own natural terms\n * while the row stays uniform, the same split `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in,\n * `parentUnitId` + `path` persisted).\n */\nexport enum StatusTransitionScheduleSource {\n  /** The contract carries an absolute instant (`suspensionEndDate`, `reactivationDate`). */\n  ABSOLUTE_DATE = 'absolute_date',\n  /**\n   * The contract carries a whole number of DAYS (`suspensionDuration`), resolved to an instant at\n   * write time. A duration is meaningless without the moment it is measured from, and the row\n   * records no such moment — so resolving it later would be guesswork.\n   */\n  DURATION_IN_DAYS = 'duration_in_days',\n}\n\n/**\n * What a verb DOES to the pending schedule — the discriminator of\n * {@link ResourceStatusTransitionScheduling}.\n *\n * A named vocabulary rather than an inline `'set' | 'clear'` union, for the same reason\n * {@link StatusTransitionScheduleSource} is one: it is a closed set with exactly one runtime source,\n * so every definition, every narrow, and every test fixture derives from here instead of re-spelling\n * the literal. The two axes are independent — `source` says how the caller EXPRESSES a schedule,\n * this says whether the verb writes one at all.\n */\nexport enum StatusTransitionScheduleMode {\n  /** Carry a caller-supplied schedule onto the row. */\n  SET = 'set',\n  /**\n   * Clear any pending schedule. Every \"undo\" verb uses this: a membership reactivated by hand must\n   * not still carry the date at which a sweep would have reactivated it anyway, or a later\n   * suspension would inherit a stale deadline.\n   */\n  CLEAR = 'clear',\n}\n\n/** The field the reactivation sweep reads. Declared once; every verb writes this same name. */\nconst SCHEDULED_REACTIVATION_FIELD = 'scheduledReactivationAt';\n\nconst MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;\n\nexport type ResourceStatusTransitionScheduling =\n  | {\n      mode: StatusTransitionScheduleMode.SET;\n      /** The key in the operation's `requestDto` that carries it. */\n      requestField: string;\n      source: StatusTransitionScheduleSource;\n    }\n  | {\n      mode: StatusTransitionScheduleMode.CLEAR;\n    };\n\nexport interface ResourceStatusTransitionDefinition {\n  resourceIdentifier: CoreResourceType;\n  /** The custom verb this implements, e.g. `suspend`. */\n  operationIdentifier: string;\n  /** Written to `status` when the transition is legal. */\n  targetStatus: string;\n  /**\n   * The ONLY statuses this verb may run from. Anything else is a `CONFLICT`.\n   *\n   * Fail-closed by construction: an unlisted status is refused rather than allowed. Keep it\n   * identical to the operation's `enabledCondition` — the gate is the fast, user-facing rejection,\n   * this is the backstop that cannot be routed around.\n   */\n  allowedFromStatuses: readonly string[];\n  /** Optional time-boxing. Omit for a verb whose contract offers the caller no window. */\n  scheduling?: ResourceStatusTransitionScheduling;\n  /**\n   * Whether this transition REMOVES access rather than restoring it.\n   *\n   * Declared, not inferred. The obvious proxies are both wrong: \"sets a schedule\" happens to\n   * correlate today (you time-box a restriction) but is a coincidence of the current verbs, and\n   * \"target is not ACTIVE\" cannot be evaluated generically because each resource has its own\n   * status vocabulary. It only feeds the audit event's risk grading, where getting it backwards\n   * would file suspensions among routine reinstatements — so it is worth one explicit word per\n   * definition.\n   */\n  restrictsAccess: boolean;\n  /** Overrides the generated debug label when a resource needs a clearer one. */\n  debugLabel?: string;\n}\n\n/**\n * A NARROW VIEW of the pre-operation snapshot — NOT a description of what the row contains.\n *\n * `utils.currentObject` comes from `fetchCurrentObjectForOperation`, which performs a full\n * `repository.read` on the addressed id, so the snapshot carries EVERY readable field of the row.\n * This type lists only what this implementation reads, and the authority fields are optional because\n * they exist on SOME governed resources and not others — not because a live row is expected to be\n * sparse. Test doubles for `currentObject` should mirror a persisted row, not this projection.\n *\n * The authority axes are read only by the floor guards (see {@link resolveStatusTransitionFloorGuards}):\n *\n * - `appRoles` — the APPLICATION axis, on `USERS` / `USER_SELF`. Those are two resource\n *   configurations over the SAME collection sharing `UserSchema` as their `mainSchema`, so the field\n *   is present through either door.\n * - `roles` + `organizationId` — the ORGANIZATIONS axis, on `ORGANIZATION_MEMBERS`. The first decides\n *   whether the row is an owner grant; the second names the population to measure.\n *\n * All three are typed `unknown` rather than `string[]`/`string` on purpose: this is the raw snapshot,\n * and each floor's own helpers are the authority on what a valid value is.\n */\ntype StatusBearingRow = {\n  _id: string;\n  status?: string;\n  appRoles?: unknown;\n  roles?: unknown;\n  organizationId?: unknown;\n};\n\n/**\n * Refuse a payload that already carries a field this verb owns.\n *\n * Defence in depth for the same hole `authoritativeFields` closes. With the declaration in place\n * such a payload is harmless — the hook's value wins — but the request is still malformed: passing\n * `status` to `suspend` asks the verb to do something other than suspend. A loud 400 beats\n * honouring one of two contradictory instructions, and it surfaces a caller who believes the field\n * is theirs to set.\n */\nfunction assertNoAuthoredFieldInRequest(\n  input: unknown,\n  authoredFields: readonly string[],\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): void {\n  if (!input || typeof input !== 'object' || Array.isArray(input)) return;\n\n  const offending = authoredFields.filter((field) =>\n    Object.prototype.hasOwnProperty.call(input, field));\n  if (offending.length === 0) return;\n\n  throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n    context: {\n      message:\n        `The '${definition.operationIdentifier}' operation owns ${offending.join(', ')} and does not `\n        + 'accept it from the caller',\n      reason: 'resource_status_transition_authored_field_in_request',\n      resourceType: definition.resourceIdentifier,\n      operationIdentifier: definition.operationIdentifier,\n      offendingFields: offending,\n    },\n  });\n}\n\n/** Resolve the caller's scheduling input to the absolute instant the sweep compares against. */\nfunction resolveScheduledReactivation(\n  scheduling: ResourceStatusTransitionScheduling,\n  input: unknown,\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Date | null {\n  // `null`, not `undefined`: the patch must actively CLEAR a stale deadline, and an `undefined`\n  // value is dropped by the write rather than unsetting the field.\n  if (scheduling.mode === StatusTransitionScheduleMode.CLEAR) return null;\n\n  const authored = (input as Record<string, unknown> | undefined)?.[scheduling.requestField];\n  if (authored === undefined || authored === null) return null;\n\n  if (scheduling.source === StatusTransitionScheduleSource.ABSOLUTE_DATE) {\n    const asDate = authored instanceof Date ? authored : new Date(String(authored));\n    if (Number.isNaN(asDate.getTime())) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        context: {\n          message: `${scheduling.requestField} is not a valid date`,\n          reason: 'resource_status_transition_invalid_schedule',\n          resourceType: definition.resourceIdentifier,\n          operationIdentifier: definition.operationIdentifier,\n        },\n      });\n    }\n    return asDate;\n  }\n\n  // DURATION_IN_DAYS — resolve against now, because the row records no other reference moment.\n  const days = typeof authored === 'number' ? authored : Number(authored);\n  if (!Number.isFinite(days) || days <= 0) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      context: {\n        message: `${scheduling.requestField} must be a positive number of days`,\n        reason: 'resource_status_transition_invalid_schedule',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        received: authored,\n      },\n    });\n  }\n  return new Date(Date.now() + days * MILLISECONDS_PER_DAY);\n}\n\n/**\n * The fields a definition writes — and therefore exactly what it must declare as authoritative.\n *\n * Derived rather than authored so the declaration cannot drift from the patch. A verb that gains a\n * schedule gains the declaration in the same edit.\n */\nexport function resolveStatusTransitionAuthoredFields(\n  definition: ResourceStatusTransitionDefinition,\n): string[] {\n  return definition.scheduling\n    ? [STATUS_FIELD, SCHEDULED_REACTIVATION_FIELD]\n    : [STATUS_FIELD];\n}\n\n/**\n * Build the `prefixCoreOperations` patch for one transition.\n *\n * Exported for testing: it is the whole decision, and it is pure apart from the row it is handed.\n */\nexport function buildStatusTransitionPatch(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  input: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}): Record<string, unknown> {\n  const { definition, currentRow, input, executionContext, utils } = params;\n\n  if (!definition.allowedFromStatuses.includes(currentRow.status ?? '')) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n      context: {\n        reason: 'resource_status_transition_not_permitted_from_current_status',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n        currentStatus: currentRow.status ?? null,\n        targetStatus: definition.targetStatus,\n        allowedFromStatuses: [...definition.allowedFromStatuses],\n      },\n    });\n  }\n\n  const patch: Record<string, unknown> = { [STATUS_FIELD]: definition.targetStatus };\n\n  if (definition.scheduling) {\n    patch[SCHEDULED_REACTIVATION_FIELD] = resolveScheduledReactivation(\n      definition.scheduling, input, definition, executionContext, utils,\n    );\n  }\n\n  return patch;\n}\n\n/**\n * Refuse a transition that would leave the application with no administratively usable\n * super-administrator.\n *\n * ## Only the status axis moves\n *\n * These verbs write `status` and at most a schedule — never `appRoles`. So the roles are passed as\n * BOTH the previous and the next value: the transition check needs the authority axis to decide\n * whether the subject counted at all, and stating it unchanged is what makes \"this write cannot\n * touch conferral\" explicit rather than implied by omission.\n *\n * ## Cost\n *\n * `assertSuperAdminFloorPreservedForTransition` short-circuits before issuing any query unless the\n * subject counted toward the floor BEFORE the write and would stop counting after it. So an\n * ordinary user suspension, and every transition INTO the authenticable set (`unsuspend_user`,\n * whose subject was by definition not usable beforehand), pay two set-membership tests and nothing\n * else. Only the genuinely dangerous case reaches the population query.\n *\n * ## Fail closed on a snapshot without the authority axis\n *\n * `appRoles` is what the whole decision turns on. A snapshot that lacks it cannot answer whether\n * this subject is an administrator, and answering \"not an administrator\" would fail OPEN on exactly\n * the input the guard exists for. Refusing instead mirrors the sibling `users | DELETE` guard, and\n * costs nothing in practice: the field carries a `.default([APP_USER])` and both floor-governed\n * resources read the same `UserSchema`, so a live snapshot always carries it.\n *\n * Exported for testing: like {@link buildStatusTransitionPatch} it is the whole decision, and it is\n * pure apart from the row and the collaborators it is handed.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an account-lifecycle change\n * must not retire the last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesSuperAdminFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n}): Promise<void> {\n  const { definition, currentRow, nextStatus, executionContext, utils, conferringRoles } = params;\n\n  if (!Array.isArray(currentRow.appRoles)) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the application roles of the account being changed could not be read, so it cannot '\n          + 'be proven that this transition would not disable the last usable super-administrator.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  await assertSuperAdminFloorPreservedForTransition({\n    subjectUserId: currentRow._id,\n    previousRoles: currentRow.appRoles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction — see the header.\n    nextRoles: currentRow.appRoles,\n    nextStatus,\n    executionContext,\n    repositoriesRegistry: utils.repositoriesRegistry,\n    errorBuilder: utils.errorBuilder,\n    conferringRoles,\n    operationIdentifier: definition.operationIdentifier,\n  });\n}\n\n/**\n * Refuse a transition that would leave an organization with no administratively usable owner.\n *\n * The ORGANIZATION-scope twin of {@link assertStatusTransitionPreservesSuperAdminFloor}, and the\n * differences are all consequences of the population being per-tenant rather than per-application:\n *\n * - **The subject names its own population.** `organizationId` selects which tenant to measure, so a\n *   snapshot without it cannot be evaluated at all — unlike the application floor, where there is\n *   only ever one population.\n * - **The measurement runs under a SYSTEM context, not the caller's.** The floor must see every owner\n *   membership AND the `status` of every one of those owners' `User` rows, and the `ORG_ADMIN`s who\n *   reach these verbs cannot list `USERS` at all. The authority owns that decision — see\n *   {@link createOrganizationOwnerFloorPopulationContext}.\n * - **The short-circuit is asked HERE, before the context is built.** Constructing the system context\n *   is a registry lookup plus a possible application-id resolution, and suspending an ordinary member\n *   — the overwhelmingly common case — must not pay for it. This is not a second copy of the rule:\n *   {@link membershipTransitionCouldReduceOwners} is the authority's own predicate, and the assertion\n *   below calls it again.\n *\n * Fails closed on a snapshot that carries no `roles` or no `organizationId`, for the reason the\n * application twin does: answering \"not an owner\" would fail OPEN on exactly the input the guard\n * exists for, and a suspended last owner cannot be reactivated by anyone — `ORGANIZATION_MEMBERS`\n * declares exactly one cross-tenant variant — `grantOwnership` — so recovery from a stranded state\n * is a platform-operator action, never a tenant one. That is why the in-tenant refusal still stands.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a membership-lifecycle change\n * must not retire a tenant's last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesOrganizationOwnerFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n  /** Resolved lazily and only once a reduction is established — see the header. */\n  resolveAuthExecutionContextFactory: () => AuthExecutionContextFactoryBackendService;\n}): Promise<void> {\n  const {\n    definition, currentRow, nextStatus, executionContext, utils, conferringRoles,\n    resolveAuthExecutionContextFactory,\n  } = params;\n\n  const organizationId = typeof currentRow.organizationId === 'string' ? currentRow.organizationId : undefined;\n\n  if (!Array.isArray(currentRow.roles) || !organizationId) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the roles or the owning organization of the membership being changed could not be '\n          + \"read, so it cannot be proven that this transition would not retire the organization's last \"\n          + 'usable owner.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  const transition = {\n    previousRoles: currentRow.roles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction: these verbs write `status` and at most a schedule, never `roles`.\n    nextRoles: currentRow.roles,\n    nextStatus,\n    conferringRoles,\n  };\n\n  if (!membershipTransitionCouldReduceOwners(transition)) return;\n\n  await assertOrganizationOwnerFloorPreservedForTransition({\n    ...transition,\n    memberId: currentRow._id,\n    organizationId,\n    executionContext: await createOrganizationOwnerFloorPopulationContext(resolveAuthExecutionContextFactory()),\n    repositoriesRegistry: utils.repositoriesRegistry,\n    errorBuilder: utils.errorBuilder,\n    operationIdentifier: definition.operationIdentifier,\n  });\n}\n\n/**\n * One administrative floor a status transition must not breach, bound to a single definition.\n *\n * A list rather than a chain of `if`s inside the hook, because the set of floors that govern a row is\n * a property of the RESOURCE and is therefore decidable once, at factory construction, from static\n * data. Adding the next authority is one entry here — and, more to the point, a lifecycle verb added\n * to a governed resource inherits every floor automatically instead of depending on somebody\n * remembering to wire it. That omission is the whole defect class this file now closes.\n */\ntype StatusTransitionFloorGuard = (params: {\n  currentRow: StatusBearingRow;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}) => Promise<void>;\n\n/**\n * The floors that govern one definition's resource, resolved once when the factory is built.\n *\n * Every collaborator is bound LAZILY. Factories are constructed during module registration, which can\n * run before the authorization and authentication services are bound, so an eager `container.get`\n * would turn a guard into a startup crash. The conferral resolvers additionally re-read the live role\n * table on every call, because `initializeRolesWithCustom` mutates it in place.\n *\n * A resource governed by NO floor gets an empty list and pays nothing at all — not a container\n * lookup, not a closure invocation. That is the common case (organization units, and every\n * application resource that grows a lifecycle verb later).\n */\nfunction resolveStatusTransitionFloorGuards(\n  definition: ResourceStatusTransitionDefinition,\n  container: Container,\n): StatusTransitionFloorGuard[] {\n  const guards: StatusTransitionFloorGuard[] = [];\n\n  if (isSuperAdminFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const superAdminConferralResolver = createSuperAdminConferralResolver(container);\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesSuperAdminFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: superAdminConferralResolver(),\n      }));\n  }\n\n  // ── USERS lifecycle: REPORT, never refuse ──────────────────────────────────────────────────\n  // A deactivated user stops counting as a usable owner, so this transition can strand a tenant —\n  // and unlike every other floor surface it must still be allowed to proceed. Suspension is normally\n  // incident response, and refusing it would mean an operator cannot lock out a compromised owner\n  // without first transferring ownership using the tenant the attacker controls. The stranded tenant\n  // is recoverable (boot report finds it, `grantOwnership` repairs it); the live hostile session is\n  // not. See `reportOrganizationsStrandedByUserDeactivation` for the full argument.\n  if (isOrganizationOwnerFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const strandingConferralResolver = createOrganizationOwnerConferralResolver(container);\n    guards.push(async ({ currentRow, nextStatus, executionContext, utils }) => {\n      await reportOrganizationsStrandedByUserDeactivation({\n        subjectUserId: String(currentRow._id),\n        nextStatus,\n        executionContext,\n        repositoriesRegistry: utils.repositoriesRegistry,\n        errorBuilder: utils.errorBuilder,\n        conferringRoles: strandingConferralResolver(),\n        operationIdentifier: definition.operationIdentifier,\n        report: async (breach) => {\n          // An AUDIT ROW, not a log line — one per stranded tenant. The justification for allowing\n          // this write at all is that the consequence becomes visible, and a log line is not\n          // queryable evidence and never reaches a SIEM. `CRITICAL` + the AUTHORIZATION category\n          // route it through the same export path as every other authority event.\n          await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n            .logOrganizationOwnerFloorBreached({\n              organizationId: breach.organizationId,\n              // A guard SAW this one and let it through, which is what separates it from the boot\n              // report's observation of a tenant stranded out-of-band.\n              detectedBy: AdministrativeContinuityBreachDetection.ALLOWED_LIFECYCLE_ACTION,\n              reducedMemberIds: breach.reducedMemberIds,\n              remainingUsableOwners: breach.remainingUsableOwners,\n              operationIdentifier: definition.operationIdentifier,\n              subjectUserId: String(currentRow._id),\n              subjectNextStatus: String(nextStatus),\n            }, executionContext);\n\n          // The log line stays as the operator-facing half: an audit row is for the auditor, and\n          // whoever is on call during an incident is reading logs, not the trail.\n          utils.logger?.error?.(\n            'Organization left with no administratively usable owner by a user lifecycle transition',\n            {\n              reason: 'organization_owner_floor_stranded_by_user_deactivation',\n              organizationId: breach.organizationId,\n              subjectUserId: String(currentRow._id),\n              remedy: 'organizationMembers.grantOwnership (platform-tier) restores an owner.',\n            },\n          );\n        },\n      });\n    });\n  }\n\n  if (isOrganizationOwnerFloorAuthorityBearingResource(definition.resourceIdentifier)) {\n    const ownerConferralResolver = createOrganizationOwnerConferralResolver(container);\n    let authExecutionContextFactory: AuthExecutionContextFactoryBackendService | undefined;\n    const resolveAuthExecutionContextFactory = (): AuthExecutionContextFactoryBackendService =>\n      (authExecutionContextFactory ??= container.get<AuthExecutionContextFactoryBackendService>(\n        SAAS_SERVICE_TYPES.AuthExecutionContextFactory,\n      ));\n\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesOrganizationOwnerFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: ownerConferralResolver(),\n        resolveAuthExecutionContextFactory,\n      }));\n  }\n\n  return guards;\n}\n\n/**\n * One lifecycle transition, as a registrable custom implementation.\n *\n * Modelled on `createOrganizationUnitStatusTransitionFactory`, which established the pattern for\n * this engine: validate against the loaded row, then RETURN the field patch for the core UPDATE to\n * persist rather than writing directly. The difference is that this one is resource-agnostic and\n * declares `authoritativeFields`, which the org-units original did not need — its `status` is not\n * `.excludeFromUpdate()`, so its patch survived on the introduced-key inference alone.\n */\nexport function createResourceStatusTransitionFactory(\n  definition: ResourceStatusTransitionDefinition,\n): ResourceCustomServiceImplementationFactory {\n  const authoredFields = resolveStatusTransitionAuthoredFields(definition);\n\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) => {\n    const floorGuards = resolveStatusTransitionFloorGuards(definition, container);\n\n    return createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      } as ResourceConfiguration_OperationPath<any, any>,\n      debugLabel:\n        definition.debugLabel\n        ?? `${String(definition.resourceIdentifier)}.${definition.operationIdentifier}.status-transition`,\n      // `status` and `scheduledReactivationAt` are `.excludeFromUpdate()` on every resource this\n      // serves. Without this the repository's strict re-parse drops the patch for any caller who\n      // reached the service tier with the key already present, and the verb answers success having\n      // changed nothing — the exact defect it was written to fix.\n      authoritativeFields: authoredFields,\n      // The audit row is registered from the PREFIX (the only phase that can see the caller's\n      // `reason`) and executes on COMMIT, so it never describes a write that rolled back. That\n      // needs a commit hook to exist, which is what this declares.\n      //\n      // No participants: the transition writes exactly one row, on the operation's own resource,\n      // which the framework includes automatically. Contrast the ORGANIZATIONS lifecycle verbs,\n      // which name ORGANIZATION_MEMBERS + USERS because they reconcile membership-derived global\n      // `userTypes` in the same unit of work.\n      //\n      // This does NOT change any deployment's transaction posture: the core engine already\n      // declares transaction-requiring boundaries unconditionally (organization\n      // activate/suspend/request_deletion/restore, organization-units MOVE, platform-access\n      // grants, organization-member writes), so `validateInitializedRuntimeTransactionReadiness`\n      // already probes every adapter at startup and a store that cannot commit already fails\n      // there — see the `rejects transaction readiness against a standalone MongoDB server` pin.\n      transactionalCore: true,\n      transactionParticipants: {},\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          // Fail closed on anything but a single addressed row. An ids array or a population filter\n          // reaching this path would make the status check evaluate against the wrong thing — or\n          // against nothing — while still returning a patch the core write would happily apply.\n          //\n          // A conditional `{ _id, … }` filter is single-subject and therefore admitted: `_id` names the\n          // row the pre-fetched `currentObject` below describes, and the extra predicates only decide\n          // whether the core write lands. Refusing it used to make status transitions the ONE verb\n          // family that could not be written as a compare-and-swap.\n          const subjectResourceId = resolveSingleSubjectId(_id);\n          if (subjectResourceId === undefined) {\n            throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n              context: {\n                message:\n                  `${definition.operationIdentifier} requires a single addressed resource to validate `\n                  + 'the status transition',\n                reason: 'resource_status_transition_unaddressed',\n                resourceType: definition.resourceIdentifier,\n                receivedAddressing: describeUnaddressableShape(_id),\n              },\n            });\n          }\n\n          assertNoAuthoredFieldInRequest(input, authoredFields, definition, executionContext, utils);\n\n          // The framework pre-fetches the target row for UPDATE-like operations, so this is the row\n          // the write is about to land on. Absent means the transition cannot be validated — which\n          // must never read as \"allowed\" on an access-affecting verb.\n          const currentRow = utils.currentObject as StatusBearingRow | undefined;\n          if (!currentRow) {\n            throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n              context: {\n                reason: 'resource_status_transition_target_not_found',\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: subjectResourceId,\n              },\n            });\n          }\n\n          const patch = buildStatusTransitionPatch({\n            definition,\n            currentRow: { ...currentRow, _id: subjectResourceId },\n            input,\n            executionContext,\n            utils,\n          });\n\n          // AFTER the transition-legality check on purpose: a verb refused because it cannot run\n          // from the current status should say so — the more specific finding — and should not\n          // have issued a floor's population query on the way to being rejected anyway.\n          for (const assertFloorPreserved of floorGuards) {\n            await assertFloorPreserved({\n              currentRow: { ...currentRow, _id: subjectResourceId },\n              // Read from the patch rather than re-derived from the definition, so no guard can\n              // measure a status other than the one about to be persisted.\n              nextStatus: patch[STATUS_FIELD],\n              executionContext,\n              utils,\n            });\n          }\n\n          // Trail the transition. Registered HERE — the only phase that can see the caller's\n          // `reason`, since the POSTFIX input is typed `z.infer<TOutput>` (the persisted row) and\n          // `reason` is not a schema column, so it appears on neither.\n          //\n          // It EXECUTES on commit, so it never describes a write that rolled back. That is why the\n          // registration declares `transactionalCore` above: without a commit hook the choice would\n          // be between emitting early (recording suspensions that later failed) and emitting from a\n          // postfix that cannot see the reason. With one, neither compromise is necessary.\n          //\n          // `targetStatus` is the persisted fact once this commits, not merely the intent: `status`\n          // is declared in `authoritativeFields`, so the patch cannot be stripped by the strict\n          // re-parse, and the startup guard proves every declared name is a real persisted field.\n          // Fail CLOSED on a missing transaction rather than skipping the trail. This registration\n          // declares `transactionalCore`, so the framework guarantees one; its absence means that\n          // contract is broken, and silently proceeding would perform an access-affecting\n          // transition with no record — the outcome the audit exists to make impossible. Same shape\n          // as `registerOrganizationLifecycleAudit` on the tenant verbs.\n          const transaction = utils.serviceOptions?.transaction;\n          if (!transaction) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n              context: {\n                message:\n                  'A status transition cannot be recorded: no transaction is active, but this '\n                  + 'operation declares transactionalCore.',\n                reason: 'resource_status_transition_audit_requires_transaction',\n                resourceType: String(definition.resourceIdentifier),\n                operationIdentifier: String(definition.operationIdentifier),\n              },\n            });\n          }\n\n          registerTransactionPostCommitEffect(transaction, {\n            key: `resource-status-transition:${String(definition.resourceIdentifier)}`\n              + `:${definition.operationIdentifier}:${subjectResourceId}`,\n            execute: async () => {\n              try {\n                await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n                  .logResourceStatusTransitionPerformed({\n                    resourceType: String(definition.resourceIdentifier),\n                    operationIdentifier: String(definition.operationIdentifier),\n                    subjectId: subjectResourceId,\n                    performedBy: String(executionContext?.initiatorIds?.userId ?? 'system'),\n                    previousStatus: String((currentRow as { status?: unknown }).status ?? ''),\n                    newStatus: definition.targetStatus,\n                    isRestricting: definition.restrictsAccess,\n                    // The field decision D2 promised the trail would carry. Both spellings are\n                    // accepted because the verbs differ: `suspend` names it `suspensionReason`,\n                    // the rest `reason`.\n                    reason: resolveAuthoredTransitionReason(input),\n                    scheduledReactivationAt:\n                      patch[SCHEDULED_REACTIVATION_FIELD] instanceof Date\n                        ? patch[SCHEDULED_REACTIVATION_FIELD] as Date\n                        : undefined,\n                    organizationId:\n                      ((currentRow as { organizationId?: unknown }).organizationId as string | undefined)\n                      ?? executionContext?.initiatorIds?.organizationId,\n                  }, executionContext);\n              } catch (error) {\n                // A trail failure must not fail the transition it describes — but it must be loud,\n                // so a dropped record reaches whoever is on call rather than vanishing.\n                utils.logger?.error?.('Failed to record a status-transition audit event', {\n                  reason: 'resource_status_transition_audit_emission_failed',\n                  resourceType: String(definition.resourceIdentifier),\n                  operationIdentifier: String(definition.operationIdentifier),\n                  error: describeCaughtError(error),\n                });\n              }\n            },\n          });\n\n          return patch;\n        },\n      },\n    });\n  };\n\n  return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n/** Build every registration for a resource's lifecycle verbs in one call. */\nexport function createResourceStatusTransitionFactories(\n  definitions: readonly ResourceStatusTransitionDefinition[],\n): ResourceCustomServiceImplementationFactory[] {\n  return definitions.map(createResourceStatusTransitionFactory);\n}\n"]}

package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.d.ts

@@ -12,6 +12,7 @@
  * operation declares no gate yet, the set here is still authoritative and the gate should be added
  * to match.
  */
+import { type ResourceStatusTransitionDefinition } from '../../../base-classes/services/services/resource-status-transition.custom-impl.backend.service';
 import type { ResourceCustomServiceImplementationFactory } from '../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend';
 /**
  * Every engine lifecycle transition served by the SHARED implementation.
@@ -37,5 +38,15 @@ import type { ResourceCustomServiceImplementationFactory } from '../../../base-c
  * `authoritativeFields`, so their patches survive the repository's strict re-parse for the same
  * reason these do.
  */
+/**
+ * Every engine transition, as DATA.
+ *
+ * Exported so a test can assert a property OF THE SHIPPED TABLE rather than of a fixture it wrote
+ * itself. That distinction is not academic: the first version of the #430 disjointness pin declared
+ * its own two definitions and asserted they did not overlap, which stayed green when the production
+ * `unsuspend_user` was widened to accept `INACTIVE` — the exact change it existed to forbid. A pin
+ * that cannot see the table cannot pin the table.
+ */
+export declare const ENGINE_STATUS_TRANSITION_DEFINITIONS: readonly ResourceStatusTransitionDefinition[];
 export declare function createEngineResourceStatusTransitionFactories(): ResourceCustomServiceImplementationFactory[];
 //# sourceMappingURL=resource-status-transition.definitions.backend.d.ts.map

package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-status-transition.definitions.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.definitions.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAgBH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AAmH7K;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6CAA6C,IAAI,0CAA0C,EAAE,CAM5G"}
+{"version":3,"file":"resource-status-transition.definitions.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.definitions.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,OAAO,EAIL,KAAK,kCAAkC,EACxC,MAAM,0GAA0G,CAAC;AAClH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AA2I7K;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,EAAE,SAAS,kCAAkC,EAI7F,CAAC;AAEF,wBAAgB,6CAA6C,IAAI,0CAA0C,EAAE,CAE5G"}

package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.js

@@ -81,6 +81,30 @@ const USER_TRANSITIONS = [
         restrictsAccess: false,
         scheduling: { mode: StatusTransitionScheduleMode.CLEAR },
     },
+    /*
+     * The administrative door back from a SELF-deactivated account (#430).
+     *
+     * `allowedFromStatuses` is INACTIVE and NOT SUSPENDED, and the pair above is why: an imposed halt
+     * and a chosen departure are lifted by different verbs on purpose, so `reactivate_user` and
+     * `unsuspend_user` have DISJOINT source states. A single verb covering both was the rejected
+     * option — it reads as a simplification and erases the one distinction these two states carry.
+     *
+     * Routing it through this factory is also what makes the write land: `status` is
+     * `.excludeFromUpdate()`, so an operation writing it directly persists nothing and reports
+     * success. The factory is the SYSTEM door, and it is also what emits the transition audit row and
+     * runs the administrative-continuity floors — the three things a config-level status prefix
+     * silently skipped when `REACTIVATE_ACCOUNT` was implemented that way.
+     */
+    {
+        resourceIdentifier: CoreResourceType.USERS,
+        operationIdentifier: Users_Operations.REACTIVATE_USER,
+        targetStatus: UserStatus.ACTIVE,
+        allowedFromStatuses: [UserStatus.INACTIVE],
+        restrictsAccess: false,
+        // Clears any residual deadline, so a reinstated account cannot inherit scheduling state from an
+        // earlier administrative suspension. Same reason as the self-service inverse below.
+        scheduling: { mode: StatusTransitionScheduleMode.CLEAR },
+    },
 ];
 /**
  * SELF-SERVICE account deactivation.
@@ -148,11 +172,21 @@ const USER_SELF_TRANSITIONS = [
  * `authoritativeFields`, so their patches survive the repository's strict re-parse for the same
  * reason these do.
  */
+/**
+ * Every engine transition, as DATA.
+ *
+ * Exported so a test can assert a property OF THE SHIPPED TABLE rather than of a fixture it wrote
+ * itself. That distinction is not academic: the first version of the #430 disjointness pin declared
+ * its own two definitions and asserted they did not overlap, which stayed green when the production
+ * `unsuspend_user` was widened to accept `INACTIVE` — the exact change it existed to forbid. A pin
+ * that cannot see the table cannot pin the table.
+ */
+export const ENGINE_STATUS_TRANSITION_DEFINITIONS = [
+    ...ORGANIZATION_MEMBER_TRANSITIONS,
+    ...USER_TRANSITIONS,
+    ...USER_SELF_TRANSITIONS,
+];
 export function createEngineResourceStatusTransitionFactories() {
-    return createResourceStatusTransitionFactories([
-        ...ORGANIZATION_MEMBER_TRANSITIONS,
-        ...USER_TRANSITIONS,
-        ...USER_SELF_TRANSITIONS,
-    ]);
+    return createResourceStatusTransitionFactories([...ENGINE_STATUS_TRANSITION_DEFINITIONS]);
 }
 //# sourceMappingURL=resource-status-transition.definitions.backend.js.map