@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-read-observation.backend.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/cross-tenant-read-observation.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,4BAA4B,GAE7B,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EAAE,wCAAwC,EAAE,MAAM,uFAAuF,CAAC;AAEjJ;;;;;;;;;;;GAWG;AACH,MAAM,wBAAwB,GAAqC;IACjE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kCAAkC,GAA8C;IACpF,8BAA8B,CAAC,4BAA4B;IAC3D,8BAA8B,CAAC,gBAAgB;CAChD,CAAC;AA8BF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAKzC;IACC,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,kCAAkC,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACrG,4FAA4F;IAC5F,0FAA0F;IAC1F,IAAI,MAAM,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrF,kGAAkG;IAClG,IAAI,MAAM,CAAC,qBAAqB,CAAC,oBAAoB,KAAK,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAM/C;IACC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAElD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAiD,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,wCAAwC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,iGAAiG;QACjG,wFAAwF;QACxF,IAAI,CAAC,iBAAiB;YAAE,SAAS;QACjC,IAAI,qBAAqB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAAE,SAAS;QAE3D,MAAM,KAAK,GAAG,MAAM,CAAE,MAA4B,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,oBAAoB;QACpB,iBAAiB;KAClB,CAAC,CAAC,CAAC;AACN,CAAC","sourcesContent":["/**\n * # Cross-tenant READ observation — the half `authorizeOrganizations` structurally cannot see\n *\n * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a declared read across the tenant\n * boundary leaves evidence, per tenant reached.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n *\n * ## The gap this closes\n *\n * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is emitted from `authorizeOrganizations`, which runs on\n * ORGANIZATIONS-scoped resources: it fetches a row, resolves the tenant that row belongs to, and\n * records the crossing when the caller holds no organization-wide entry for it.\n *\n * An APPLICATION-scoped resource never traverses that path — there is no organization in its route\n * and no per-row tenant gate — so a door that returns rows CARRYING an `organizationId` reaches\n * every tenant with nothing written down. That is the same invariant applied at some of its sites\n * (`.claude/rules/invariant-call-site-enumeration.md`), and the missing site is the one that hurts\n * most: `APPLICATION_AUDIT_LOGS` is the operator's cross-tenant view of the audit trail itself, and\n * the trail is the worst possible surface on which to make an operator read invisible\n * (`.claude/rules/administrative-continuity-floors.md`).\n *\n * Measured 2026-09-09 over the real core registry: exactly FIVE resources are APPLICATION-scoped and\n * declare a top-level `organizationId` — `applicationAuditLogs`, `auditLogs`, `consumableTokens`,\n * `files` and `jobExecutions`. This is a small, enumerable population, not a framework-wide sweep.\n *\n * ## Why only a DECLARED crossing is observed\n *\n * `admissionDeclared: false` on that event means an ATTEMPTED crossing that no variant asked for,\n * **and which was refused** — that is what its own field JSDoc says, and what a reviewer reads it\n * as. A read here SUCCEEDS, so emitting `false` for an undeclared door would put a false sentence in\n * the trail: it would describe a completed disclosure as a blocked attempt. Deriving the field from\n * anywhere other than the variant's own flag would be a second derivation of one predicate, which is\n * how a gate and its trail start disagreeing.\n *\n * So the enrolment rule is exact, and it is one act: **declaring\n * `admitsCrossTenantPlatformAdministration` on a read variant is what puts that read in the trail.**\n * The four sibling resources declare no crossing and are therefore unchanged. An UNDECLARED\n * application-scoped door that returns foreign rows is a different defect — an undeclared crossing —\n * and the answer to it is a declaration or a confinement, never an audit row that misdescribes\n * itself.\n *\n * ## Why ORGANIZATIONS-scoped resources are excluded\n *\n * They already emit, from `authorizeOrganizations`, on the same event. Observing them here as well\n * would double-record every declared crossing on `organizations` and `platformAccessGrants` — and a\n * duplicated crossing is worse than a missing one, because a reviewer counting operator reaches\n * would over-count without any way to tell.\n *\n * ## Why membership comes from ROLE ENTRIES\n *\n * The same reason its three siblings give: `initiatorIds.organizationId` names the one tenant the\n * request is acting in, which cannot answer \"is this caller a member of the tenant THIS ROW belongs\n * to\" for a result set spanning many. Role entries are the one input a request cannot author for\n * itself. {@link resolveCallerOrganizationIds} is reused rather than re-derived so this observation\n * and the confinement authorities can never disagree about who is a member.\n */\n\nimport {\n  CoreResourceOperation,\n  ExecutionContext_ExecutionType,\n  ResourcePrimaryScope,\n} from '@wildo-ai/saas-models';\n\nimport {\n  resolveCallerOrganizationIds,\n  type ScopeRootCollectionConfinementSignal,\n} from '~wildo-backend-lib/security/authorizations/scope-root-collection-confinement.backend';\nimport { INITIATOR_ORGANIZATION_CONFINEMENT_FIELD } from '~wildo-backend-lib/security/authorizations/initiator-organization-confinement.backend';\n\n/**\n * The read operations this observation covers.\n *\n * All three of the audit door's operations, deliberately. A per-instance READ is included even\n * though it names one row: reading ONE tenant's audit row from a cross-tenant door is exactly the\n * access the event exists to show, and covering only the collection verbs would leave the cheapest\n * crossing — fetch by id — unrecorded.\n *\n * COUNT is absent because it returns no rows, so it discloses no tenant's data and this authority\n * has nothing to attribute. That is a decision, not an omission: if a count is ever considered a\n * disclosure, it needs a different event carrying a number, the way `PLATFORM_DIRECTORY_ACCESS` does.\n */\nconst OBSERVED_READ_OPERATIONS: readonly CoreResourceOperation[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n];\n\n/**\n * Execution types that carry no operator to attribute.\n *\n * Mirrors {@link SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES} and is exempt for the same reason:\n * `INTERNALLY_INITIATED_REQUEST` is the framework's context-free system actor (batch, cron, cascade,\n * bootstrap, and the audit writer's own synthesised temp context) and `WEBHOOK_CALLBACK` is trusted\n * after signature verification. Recording framework machinery as operator browsing would bury the\n * signal this event exists to carry — and for the audit resources specifically it would make the\n * retention scrub and the archive batch emit a crossing per tenant on every run.\n */\nconst OBSERVATION_EXEMPT_EXECUTION_TYPES: readonly ExecutionContext_ExecutionType[] = [\n  ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n  ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,\n];\n\n/**\n * The EXECUTED operation variant — the one whose declaration decides enrolment.\n *\n * Passed explicitly rather than read off `executionContext.operation`, and that is a correctness\n * requirement rather than a style choice. A resource authors ONE variant per operation and the\n * config factory derives `summary` and `context` variants from it, so \"the operation\" is ambiguous\n * unless the executed one is named; `authorizations.backend.service` already hedges by consulting\n * BOTH the passed operation and the context's, which is the tell that the context's copy cannot be\n * relied on. Taking it here means the enrolment decision and the `admissionDeclared` the emitter\n * writes are read from the SAME object and cannot disagree — the failure this repository keeps\n * paying for when one predicate is derived twice.\n */\nexport interface CrossTenantReadObservationOperation {\n  readonly admitsCrossTenantPlatformAdministration?: boolean;\n}\n\n/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */\nexport interface CrossTenantReadObservationResource {\n  readonly resourceIdentifier?: string;\n  readonly resourcePrimaryScope?: string;\n}\n\n/** One tenant reached by a single read, with the rows of that tenant it returned. */\nexport interface CrossTenantReadCrossing {\n  readonly targetOrganizationId: string;\n  readonly targetResourceIds: string[];\n}\n\n/**\n * Is this read enrolled in the crossing trail at all?\n *\n * Separated from the row walk so the decision can be pinned on its own, and so a caller pays nothing\n * for a read that is not enrolled — which is every read of all but a handful of resources.\n */\nexport function isObservedCrossTenantRead(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: CrossTenantReadObservationResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  if (!params.executedCoreOperation) return false;\n  if (!OBSERVED_READ_OPERATIONS.includes(params.executedCoreOperation)) return false;\n  if (OBSERVATION_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType)) return false;\n  // Only a DECLARED crossing — see the module JSDoc. This is also what keeps the enrolled set\n  // enumerable: `rg admitsCrossTenantPlatformAdministration` names every door in the trail.\n  if (params.operation?.admitsCrossTenantPlatformAdministration !== true) return false;\n  // Already emitted by `authorizeOrganizations` for this scope; observing again would double-count.\n  if (params.resourceConfiguration.resourcePrimaryScope === String(ResourcePrimaryScope.ORGANIZATIONS)) return false;\n  return true;\n}\n\n/**\n * The distinct tenants a read reached into, and which of their rows it returned.\n *\n * Returns EMPTY when the read is not enrolled, when no returned row carries a tenant, or when every\n * tenant reached is one the caller belongs to. Grouping by tenant rather than emitting per row is\n * what bounds the trail: one operator read produces one row per TENANT reached, not one per record,\n * and the audit row's own `organizationId` is then that tenant's — which is what makes the crossing\n * visible in the reached tenant's own organization-scoped viewer, rather than only to the operator.\n *\n * `rows` accepts whatever the read returned — one object, an array, or nothing — because the three\n * seams that call this differ in shape and normalising at each of them is how one of them would come\n * to normalise differently.\n */\nexport function collectCrossTenantReadCrossings(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: CrossTenantReadObservationResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n  readonly rows: unknown;\n}): CrossTenantReadCrossing[] {\n  if (!isObservedCrossTenantRead(params)) return [];\n\n  const rows = Array.isArray(params.rows)\n    ? params.rows\n    : params.rows && typeof params.rows === 'object' ? [params.rows] : [];\n  if (rows.length === 0) return [];\n\n  const callerOrganizationIds = new Set(resolveCallerOrganizationIds(params.executionContext));\n\n  const byTenant = new Map<string, string[]>();\n  for (const row of rows) {\n    const record = row as Record<string, unknown> | null | undefined;\n    if (!record || typeof record !== 'object') continue;\n    const rowOrganizationId = String(record[INITIATOR_ORGANIZATION_CONFINEMENT_FIELD] ?? '');\n    // A row with no tenant is not a crossing — it is application-wide data, which is the majority of\n    // the audit trail (94 of 127 rows on the dogfood application that motivated this door).\n    if (!rowOrganizationId) continue;\n    if (callerOrganizationIds.has(rowOrganizationId)) continue;\n\n    const rowId = String((record as { _id?: unknown })._id ?? '');\n    const ids = byTenant.get(rowOrganizationId);\n    if (ids) {\n      if (rowId) ids.push(rowId);\n    } else {\n      byTenant.set(rowOrganizationId, rowId ? [rowId] : []);\n    }\n  }\n\n  return [...byTenant.entries()].map(([targetOrganizationId, targetResourceIds]) => ({\n    targetOrganizationId,\n    targetResourceIds,\n  }));\n}\n"]}
+{"version":3,"file":"cross-tenant-read-observation.backend.js","sourceRoot":"","sources":["../../../../src/security/authorizations/cross-tenant-read-observation.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,4BAA4B,GAE7B,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EAAE,wCAAwC,EAAE,MAAM,uFAAuF,CAAC;AAEjJ;;;;;;;;;;;GAWG;AACH,MAAM,wBAAwB,GAAqC;IACjE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kCAAkC,GAA8C;IACpF,8BAA8B,CAAC,4BAA4B;IAC3D,8BAA8B,CAAC,gBAAgB;CAChD,CAAC;AA8BF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAKzC;IACC,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,kCAAkC,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACrG,4FAA4F;IAC5F,0FAA0F;IAC1F,IAAI,MAAM,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrF,kGAAkG;IAClG,IAAI,MAAM,CAAC,qBAAqB,CAAC,oBAAoB,KAAK,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAM/C;IACC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAElD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAiD,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,wCAAwC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,iGAAiG;QACjG,wFAAwF;QACxF,IAAI,CAAC,iBAAiB;YAAE,SAAS;QACjC,IAAI,qBAAqB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAAE,SAAS;QAE3D,MAAM,KAAK,GAAG,MAAM,CAAE,MAA4B,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,oBAAoB;QACpB,iBAAiB;KAClB,CAAC,CAAC,CAAC;AACN,CAAC","sourcesContent":["/**\n * # Cross-tenant READ observation — the half `authorizeOrganizations` structurally cannot see\n *\n * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a declared read across the tenant\n * boundary leaves evidence, per tenant reached.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n *\n * ## The gap this closes\n *\n * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is emitted from `authorizeOrganizations`, which runs on\n * ORGANIZATIONS-scoped resources: it fetches a row, resolves the tenant that row belongs to, and\n * records the crossing when the caller holds no organization-wide entry for it.\n *\n * An APPLICATION-scoped resource never traverses that path — there is no organization in its route\n * and no per-row tenant gate — so a door that returns rows CARRYING an `organizationId` reaches\n * every tenant with nothing written down. That is the same invariant applied at some of its sites\n * (`.claude/rules/invariant-call-site-enumeration.md`), and the missing site is the one that hurts\n * most: `APPLICATION_AUDIT_LOGS` is the operator's cross-tenant view of the audit trail itself, and\n * the trail is the worst possible surface on which to make an operator read invisible\n * (`.claude/rules/administrative-continuity-floors.md`).\n *\n * Measured 2026-09-09 over the real core registry: exactly FIVE resources are APPLICATION-scoped and\n * declare a top-level `organizationId` — `applicationAuditLogs`, `auditLogs`, `consumableTokens`,\n * `files` and `jobExecutions`. This is a small, enumerable population, not a framework-wide sweep.\n *\n * ## Why only a DECLARED crossing is observed\n *\n * `admissionDeclared: false` on that event means an ATTEMPTED crossing that no variant asked for,\n * **and which was refused** — that is what its own field JSDoc says, and what a reviewer reads it\n * as. A read here SUCCEEDS, so emitting `false` for an undeclared door would put a false sentence in\n * the trail: it would describe a completed disclosure as a blocked attempt. Deriving the field from\n * anywhere other than the variant's own flag would be a second derivation of one predicate, which is\n * how a gate and its trail start disagreeing.\n *\n * So the enrolment rule is exact, and it is one act: **declaring\n * `admitsCrossTenantPlatformAdministration` on a read variant is what puts that read in the trail.**\n * The four sibling resources declare no crossing and are therefore unchanged. An UNDECLARED\n * application-scoped door that returns foreign rows is a different defect — an undeclared crossing —\n * and the answer to it is a declaration or a confinement, never an audit row that misdescribes\n * itself.\n *\n * ## Why ORGANIZATIONS-scoped resources are excluded\n *\n * They already emit, from `authorizeOrganizations`, on the same event. Observing them here as well\n * would double-record every declared crossing on `organizations` and `platformAccessGrants` — and a\n * duplicated crossing is worse than a missing one, because a reviewer counting operator reaches\n * would over-count without any way to tell.\n *\n * ## Why membership comes from ROLE ENTRIES\n *\n * The same reason its three siblings give: `initiatorIds.organizationId` names the one tenant the\n * request is acting in, which cannot answer \"is this caller a member of the tenant THIS ROW belongs\n * to\" for a result set spanning many. Role entries are the one input a request cannot author for\n * itself. {@link resolveCallerOrganizationIds} is reused rather than re-derived so this observation\n * and the confinement authorities can never disagree about who is a member.\n */\n\nimport {\n  CoreResourceOperation,\n  ExecutionContext_ExecutionType,\n  ResourcePrimaryScope,\n} from '@wildo-ai/saas-models';\n\nimport {\n  resolveCallerOrganizationIds,\n  type ScopeRootCollectionConfinementSignal,\n} from '~wildo-backend-lib/security/authorizations/scope-root-collection-confinement.backend';\nimport { INITIATOR_ORGANIZATION_CONFINEMENT_FIELD } from '~wildo-backend-lib/security/authorizations/initiator-organization-confinement.backend';\n\n/**\n * The read operations this observation covers.\n *\n * All three of the audit door's operations, deliberately. A per-instance READ is included even\n * though it names one row: reading ONE tenant's audit row from a cross-tenant door is exactly the\n * access the event exists to show, and covering only the collection verbs would leave the cheapest\n * crossing — fetch by id — unrecorded.\n *\n * COUNT is absent because it returns no rows, so it discloses no tenant's data and this authority\n * has nothing to attribute. That is a decision, not an omission: if a count is ever considered a\n * disclosure, it needs a different event carrying a number, the way `PLATFORM_DIRECTORY_ACCESS` does.\n */\nconst OBSERVED_READ_OPERATIONS: readonly CoreResourceOperation[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n];\n\n/**\n * Execution types that carry no operator to attribute.\n *\n * Mirrors {@link SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES} and is exempt for the same reason:\n * `INTERNALLY_INITIATED_REQUEST` is the framework's context-free system actor (batch, cron, cascade,\n * bootstrap, and the audit writer's own synthesised temp context) and `WEBHOOK_CALLBACK` is trusted\n * after signature verification. Recording framework machinery as operator browsing would bury the\n * signal this event exists to carry — and for the audit resources specifically it would make the\n * retention scrub and the archive batch emit a crossing per tenant on every run.\n */\nconst OBSERVATION_EXEMPT_EXECUTION_TYPES: readonly ExecutionContext_ExecutionType[] = [\n  ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n  ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,\n];\n\n/**\n * The EXECUTED operation variant — the one whose declaration decides enrolment.\n *\n * Passed explicitly rather than read off `executionContext.operation`, and that is a correctness\n * requirement rather than a style choice. A resource authors ONE variant per operation and the\n * config factory derives `summary` and `context` variants from it, so \"the operation\" is ambiguous\n * unless the executed one is named; `authorizations.backend.service` already hedges by consulting\n * BOTH the passed operation and the context's, which is the tell that the context's copy cannot be\n * relied on. Taking it here means the enrolment decision and the `admissionDeclared` the emitter\n * writes are read from the SAME object and cannot disagree — the failure this repository keeps\n * paying for when one predicate is derived twice.\n */\nexport interface CrossTenantReadObservationOperation {\n  readonly admitsCrossTenantPlatformAdministration?: boolean;\n}\n\n/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */\nexport interface CrossTenantReadObservationResource {\n  readonly resourceIdentifier?: string;\n  readonly resourcePrimaryScope?: string;\n}\n\n/** One tenant reached by a single read, with the rows of that tenant it returned. */\nexport interface CrossTenantReadCrossing {\n  readonly targetOrganizationId: string;\n  readonly targetResourceIds: string[];\n}\n\n/**\n * Is this read enrolled in the crossing trail at all?\n *\n * Separated from the row walk so the decision can be pinned on its own, and so a caller pays nothing\n * for a read that is not enrolled — which is every read of all but a handful of resources.\n */\nexport function isObservedCrossTenantRead(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: CrossTenantReadObservationResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  if (!params.executedCoreOperation) return false;\n  if (!OBSERVED_READ_OPERATIONS.includes(params.executedCoreOperation)) return false;\n  if (OBSERVATION_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType)) return false;\n  // Only a DECLARED crossing — see the module JSDoc. This is also what keeps the enrolled set\n  // enumerable: `rg admitsCrossTenantPlatformAdministration` names every door in the trail.\n  if (params.operation?.admitsCrossTenantPlatformAdministration !== true) return false;\n  // Already emitted by `authorizeOrganizations` for this scope; observing again would double-count.\n  if (params.resourceConfiguration.resourcePrimaryScope === String(ResourcePrimaryScope.ORGANIZATIONS)) return false;\n  return true;\n}\n\n/**\n * The distinct tenants a read reached into, and which of their rows it returned.\n *\n * Returns EMPTY when the read is not enrolled, when no returned row carries a tenant, or when every\n * tenant reached is one the caller belongs to. Grouping by tenant rather than emitting per row is\n * what bounds the trail: one operator read produces one row per TENANT reached, not one per record,\n * and the audit row's own `organizationId` is then that tenant's — which is what makes the crossing\n * visible in the reached tenant's own organization-scoped viewer, rather than only to the operator.\n *\n * `rows` accepts whatever the read returned — one object, an array, or nothing — because the three\n * seams that call this differ in shape and normalising at each of them is how one of them would come\n * to normalise differently.\n */\nexport function collectCrossTenantReadCrossings(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: CrossTenantReadObservationResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n  readonly rows: unknown;\n}): CrossTenantReadCrossing[] {\n  if (!isObservedCrossTenantRead(params)) return [];\n\n  const rows = Array.isArray(params.rows)\n    ? params.rows\n    : params.rows && typeof params.rows === 'object' ? [params.rows] : [];\n  if (rows.length === 0) return [];\n\n  const callerOrganizationIds = new Set(resolveCallerOrganizationIds(params.executionContext));\n\n  const byTenant = new Map<string, string[]>();\n  for (const row of rows) {\n    const record = row as Record<string, unknown> | null | undefined;\n    if (!record || typeof record !== 'object') continue;\n    const rowOrganizationId = String(record[INITIATOR_ORGANIZATION_CONFINEMENT_FIELD] ?? '');\n    // A row with no tenant is not a crossing — it is application-wide data, which is the majority of\n    // the audit trail (94 of 127 rows on the dogfood application that motivated this door).\n    if (!rowOrganizationId) continue;\n    if (callerOrganizationIds.has(rowOrganizationId)) continue;\n\n    const rowId = String((record as { _id?: unknown })._id ?? '');\n    const ids = byTenant.get(rowOrganizationId);\n    if (ids) {\n      if (rowId) ids.push(rowId);\n    } else {\n      byTenant.set(rowOrganizationId, rowId ? [rowId] : []);\n    }\n  }\n\n  return [...byTenant.entries()].map(([targetOrganizationId, targetResourceIds]) => ({\n    targetOrganizationId,\n    targetResourceIds,\n  }));\n}\n"]}

package/dist/esm/security/authorizations/initiator-organization-confinement.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initiator-organization-confinement.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,oGAAoG;AACpG,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC5F;AAED,qFAAqF;AACrF,MAAM,WAAW,4CAA4C;IAC3D,iCAAiC,CAAC,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACrD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,sFAAsF;AACtF,eAAO,MAAM,wCAAwC,mBAAmB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8CAA8C,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE;IAC7F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;IAClE,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,4CAA4C,CAAC;IACnE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3D,GAAG,OAAO,CAyDV"}
+{"version":3,"file":"initiator-organization-confinement.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,oGAAoG;AACpG,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC5F;AAED,qFAAqF;AACrF,MAAM,WAAW,4CAA4C;IAC3D,iCAAiC,CAAC,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACrD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,sFAAsF;AACtF,eAAO,MAAM,wCAAwC,mBAAmB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8CAA8C,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE;IAC7F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;IAClE,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,4CAA4C,CAAC;IACnE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3D,GAAG,OAAO,CAyDV"}

package/dist/esm/security/authorizations/junction-scope-resolution.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"junction-scope-resolution.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/junction-scope-resolution.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kEAAkE;AAClE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,YAAY,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,4EAA4E;AAC5E,MAAM,WAAW,2BAA2B;IAC1C,yBAAyB,CACvB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtB;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAOD;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE;IAC5D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iCAAiC,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CAC7F,GAAG,GAAG,CAAC,MAAM,CAAC,CAcd;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE;IAC1F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iCAAiC,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,GAAG,SAAS,CAAC;IAC7F,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,oBAAoB,EAAE,YAAY,KAC/B,2BAA2B,GAAG,SAAS,CAAC;CAC9C,GAAG,OAAO,CAAC,OAAO,CAAC,CAqCnB"}
+{"version":3,"file":"junction-scope-resolution.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/junction-scope-resolution.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kEAAkE;AAClE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,YAAY,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,4EAA4E;AAC5E,MAAM,WAAW,2BAA2B;IAC1C,yBAAyB,CACvB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtB;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAOD;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE;IAC5D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iCAAiC,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CAC7F,GAAG,GAAG,CAAC,MAAM,CAAC,CAcd;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE;IAC1F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iCAAiC,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,GAAG,SAAS,CAAC;IAC7F,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,oBAAoB,EAAE,YAAY,KAC/B,2BAA2B,GAAG,SAAS,CAAC;CAC9C,GAAG,OAAO,CAAC,OAAO,CAAC,CAqCnB"}

package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-owner-floor.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/organization-owner-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAML,wBAAwB,EACxB,kBAAkB,EAElB,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIrK;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oDAAoD,EAAE,SAAS,wBAAwB,EAEnG,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2CAA2C,EAAE,SAAS,UAAU,EAAwB,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,kBAAkB,CAGpF,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,sGACyD,CAAC;AAEtG;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,kCAAkC,CAAC;AAEvF;;;GAGG;AACH,oBAAY,oCAAoC;IAC9C,6DAA6D;IAC7D,YAAY,iBAAiB;IAC7B,0EAA0E;IAC1E,wBAAwB,6BAA6B;IACrD,6CAA6C;IAC7C,kBAAkB,uBAAuB;IACzC,mGAAmG;IACnG,eAAe,oBAAoB;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kCAAkC,GAAG,MAAM,MAAM,EAAE,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,qBAAqB,EAAE,IAAI,CAAC,4BAA4B,EAAE,aAAa,GAAG,kBAAkB,CAAC,GAC5F,MAAM,EAAE,CAOV;AAED;;;;;;;;;GASG;AACH,wBAAgB,wCAAwC,CAAC,SAAS,EAAE,SAAS,GAAG,kCAAkC,CAMjH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,6CAA6C,CACjE,2BAA2B,EAAE,yCAAyC,GACrE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAIhC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIxG;AAED,wHAAwH;AACxH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEjF;AAED,6HAA6H;AAC7H,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEhF;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,EACvE,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAIT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,qBAAqB,CAAC,GAAG,SAAS,GAAG,IAAI,GACpF,OAAO,CAST;AAED,6CAA6C;AAC7C,KAAK,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,QAAQ,GAAG,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC,CAAC;AA+B7G;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoCpB;AAED,yDAAyD;AACzD,MAAM,MAAM,4BAA4B,GAAG;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4DAA4D;IAC5D,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CA2DpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE;IACzD,QAAQ,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAClD,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,KAAK,CAmCR;AAED;;;GAGG;AACH,wBAAsB,qCAAqC,CAAC,MAAM,EAAE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE;IAC5D,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CASV;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kDAAkD,CAAC,MAAM,EAAE;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;AAED;;;;;;;;;GASG;AACH,wBAAsB,+CAA+C,CAAC,MAAM,EAAE;IAC5E,WAAW,EAAE,SAAS,CAAC,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;IAChE,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wDAAwD,EAAE,SAAS,MAAM,EAGrF,CAAC;AAEF,oGAAoG;AACpG,wBAAgB,+CAA+C,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAE9F;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yDAAyD,EAAE,SAAS,MAAM,EAEtF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gDAAgD,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAE/F;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAchC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,6CAA6C,CAAC,MAAM,EAAE;IAC1E,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,mGAAmG;IACnG,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACvF,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED;;;;;GAKG;AACH,eAAO,MAAM,8CAA8C,EAAE,MAAmC,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,6CAA6C,CAAC,MAAM,EAAE;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzE,GAAG,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAsB1C;AA6CD,wBAAsB,sCAAsC,CAAC,MAAM,EAAE;IACnE;;;;;OAKG;IACH,2BAA2B,EAAE,yCAAyC,CAAC;IACvE,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC;IACV,0BAA0B,EAAE,MAAM,CAAC;IACnC,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;IAChD,2FAA2F;IAC3F,wBAAwB,EAAE,qBAAqB,EAAE,CAAC;CACnD,CAAC,CA+FD"}
+{"version":3,"file":"organization-owner-floor.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/organization-owner-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAML,wBAAwB,EACxB,kBAAkB,EAElB,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIrK;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oDAAoD,EAAE,SAAS,wBAAwB,EAEnG,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2CAA2C,EAAE,SAAS,UAAU,EAAwB,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,kBAAkB,CAGpF,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,sGACyD,CAAC;AAEtG;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,kCAAkC,CAAC;AAEvF;;;GAGG;AACH,oBAAY,oCAAoC;IAC9C,6DAA6D;IAC7D,YAAY,iBAAiB;IAC7B,0EAA0E;IAC1E,wBAAwB,6BAA6B;IACrD,6CAA6C;IAC7C,kBAAkB,uBAAuB;IACzC,mGAAmG;IACnG,eAAe,oBAAoB;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kCAAkC,GAAG,MAAM,MAAM,EAAE,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,qBAAqB,EAAE,IAAI,CAAC,4BAA4B,EAAE,aAAa,GAAG,kBAAkB,CAAC,GAC5F,MAAM,EAAE,CAOV;AAED;;;;;;;;;GASG;AACH,wBAAgB,wCAAwC,CAAC,SAAS,EAAE,SAAS,GAAG,kCAAkC,CAMjH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,6CAA6C,CACjE,2BAA2B,EAAE,yCAAyC,GACrE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAIhC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIxG;AAED,wHAAwH;AACxH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEjF;AAED,6HAA6H;AAC7H,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEhF;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,EACvE,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAIT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,qBAAqB,CAAC,GAAG,SAAS,GAAG,IAAI,GACpF,OAAO,CAST;AAED,6CAA6C;AAC7C,KAAK,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,QAAQ,GAAG,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC,CAAC;AA+B7G;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoCpB;AAED,yDAAyD;AACzD,MAAM,MAAM,4BAA4B,GAAG;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4DAA4D;IAC5D,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CA2DpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE;IACzD,QAAQ,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAClD,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,KAAK,CAmCR;AAED;;;GAGG;AACH,wBAAsB,qCAAqC,CAAC,MAAM,EAAE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE;IAC5D,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CASV;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kDAAkD,CAAC,MAAM,EAAE;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;AAED;;;;;;;;;GASG;AACH,wBAAsB,+CAA+C,CAAC,MAAM,EAAE;IAC5E,WAAW,EAAE,SAAS,CAAC,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;IAChE,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wDAAwD,EAAE,SAAS,MAAM,EAGrF,CAAC;AAEF,oGAAoG;AACpG,wBAAgB,+CAA+C,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAE9F;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yDAAyD,EAAE,SAAS,MAAM,EAEtF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gDAAgD,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAE/F;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAchC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,6CAA6C,CAAC,MAAM,EAAE;IAC1E,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,mGAAmG;IACnG,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACvF,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED;;;;;GAKG;AACH,eAAO,MAAM,8CAA8C,EAAE,MAAmC,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,6CAA6C,CAAC,MAAM,EAAE;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzE,GAAG,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAsB1C;AA6CD,wBAAsB,sCAAsC,CAAC,MAAM,EAAE;IACnE;;;;;OAKG;IACH,2BAA2B,EAAE,yCAAyC,CAAC;IACvE,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC;IACV,0BAA0B,EAAE,MAAM,CAAC;IACnC,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;IAChD,2FAA2F;IAC3F,wBAAwB,EAAE,qBAAqB,EAAE,CAAC;CACnD,CAAC,CA+FD"}

package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-owner-floor.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/organization-owner-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EACL,iCAAiC,EACjC,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,GAIX,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,yEAAyE,CAAC;AAEvH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAwC;IACvG,wBAAwB,CAAC,MAAM;CAChC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAoC,IAAI,GAAG,CAAC;IAChG,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,OAAO;CAC3B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,mGAAmG,CAAC;AAEtG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,+BAA+B,CAAC;AAEvF;;;GAGG;AACH,MAAM,CAAN,IAAY,oCASX;AATD,WAAY,oCAAoC;IAC9C,6DAA6D;IAC7D,qEAA6B,CAAA;IAC7B,0EAA0E;IAC1E,6FAAqD,CAAA;IACrD,6CAA6C;IAC7C,iFAAyC,CAAA;IACzC,mGAAmG;IACnG,2EAAmC,CAAA;AACrC,CAAC,EATW,oCAAoC,KAApC,oCAAoC,QAS/C;AAWD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uCAAuC,CACrD,qBAA6F;IAE7F,OAAO,4BAA4B,CAAC;QAClC,UAAU,EAAE,cAAc,CAAC,SAAS;QACpC,KAAK,EAAE,oBAAoB,CAAC,aAAa;QACzC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACxE,qBAAqB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,OAAc,EAAE,KAAK,CAAC;KACzG,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wCAAwC,CAAC,SAAoB;IAC3E,IAAI,qBAA+D,CAAC;IACpE,OAAO,GAAG,EAAE;QACV,qBAAqB,KAAK,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QAChH,OAAO,uCAAuC,CAAC,qBAAqB,CAAC,CAAC;IACxE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,2BAAsE;IAEtE,OAAO,2BAA2B,CAAC,4BAA4B,CAC7D,2BAA2B,CAAC,yBAAyB,EAAE,CACxD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc,EAAE,eAAkC;IAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,wCAAwC,CAAC,MAAe;IACtE,OAAO,oDAAoD,CAAC,QAAQ,CAAC,MAAkC,CAAC,CAAC;AAC3G,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,uCAAuC,CAAC,MAAe;IACrE,OAAO,2CAA2C,CAAC,QAAQ,CAAC,MAAoB,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAuE,EACvE,eAAkC;IAElC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,4BAA4B,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;WAC7D,wCAAwC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,8BAA8B,CAC5C,YAAqF;IAErF,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,YAAY,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACnD,gGAAgG;IAChG,mEAAmE;IACnE,qGAAqG;IACrG,4FAA4F;IAC5F,2FAA2F;IAC3F,OAAO,CAAC,yCAAyC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAMD,+EAA+E;AAC/E,SAAS,iBAAiB,CACxB,YAA8B,EAC9B,MAKC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAE3E,mGAAmG;IACnG,iGAAiG;IACjG,yCAAyC;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE;YACrF,OAAO,EAAE;gBACP,OAAO,EAAE,uFAAuF;gBAChG,YAAY;gBACZ,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;aAChD;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,MAOrD;IACC,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAErE,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAE9F,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAqB,gBAAgB,EAAE;QACvF,cAAc;QACd,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE;QACpC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,oDAAoD,CAAC,EAAE;KAC3E,CAAC,CAAC;IAEH,MAAM,cAAc,GAAyB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,8FAA8F;IAC9F,0FAA0F;IAC1F,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAC9B,cAAc;aACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACxE,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CACnF,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,cAAc,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAe,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAmB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,QAAQ;SACL,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uCAAuC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;SACrE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAClC,CAAC;IAEF,OAAO,cAAc;SAClB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;SAC7D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MAWpD;IACC,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;IAEtE,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,IAAI,CACpD,gBAAgB,EAChB,cAAc,CACf,CAAC;IAEF,IAAI,CAAC,8BAA8B,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAEpE,+FAA+F;IAC/F,EAAE;IACF,+FAA+F;IAC/F,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,EAAE;IACF,mGAAmG;IACnG,kGAAkG;IAClG,iFAAiF;IACjF,2FAA2F;IAC3F,EAAE;IACF,mGAAmG;IACnG,sCAAsC;IACtC,6FAA6F;IAC7F,8FAA8F;IAC9F,6FAA6F;IAC7F,2BAA2B;IAC3B,EAAE;IACF,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,+DAA+D;IAC/D,MAAM,sBAAsB,CAAC,MAAM,CACjC,gBAAgB,EAChB,cAAc,EACd,EAAE,4BAA4B,EAAE,CAAE,YAAiE,EAAE,4BAA4B,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,EAC7I;QACE,GAAG,CAAE,MAAuD,CAAC,cAAc,IAAI,EAAE,CAAC;QAClF,4BAA4B,EAAE,CAAC,8BAA8B,CAAC;KACtD,CACX,CAAC;IAEF,MAAM,oBAAoB,GAAG,MAAM,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAE3E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE3G,6FAA6F;IAC7F,gGAAgG;IAChG,iEAAiE;IACjE,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC;IAC1F,IAAI,qBAAqB,IAAI,gCAAgC;QAAE,OAAO,SAAS,CAAC;IAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAOlD;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAEzG,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAExE,+FAA+F;IAC/F,gGAAgG;IAChG,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,iCAAiC;IACjC,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;QAClE,OAAO,EAAE;YACP,yFAAyF;YACzF,6FAA6F;YAC7F,uEAAuE;YACvE,IAAI,EAAE,iCAAiC,CAAC,uBAAuB;YAC/D,MAAM,EAAE,uCAAuC;YAC/C,OAAO,EACL,6BAA6B,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,gBAAgB,GAAG;kBAC1H,wBAAwB,GAAG,+BAA+B;YAC9D,KAAK;YACL,mBAAmB;YACnB,eAAe;YACf,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAClC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC9C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;aACpD,CAAC,CAAC;YACH,oBAAoB,EAAE,gCAAgC;YACtD,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,wBAAwB,EAAE,CAAC,GAAG,oDAAoD,CAAC;YACnF,uBAAuB,EAAE,CAAC,GAAG,2CAA2C,CAAC;SAC1E;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,MAS3D;IACC,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,kCAAkC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAMrD;IACC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEzF,MAAM,eAAe,GAAG,4BAA4B,CAAC,aAAa,EAAE,eAAe,CAAC;WAC/E,wCAAwC,CAAC,cAAc,CAAC,CAAC;IAC9D,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IAEnC,OAAO,CAAC,CAAC,4BAA4B,CAAC,SAAS,EAAE,eAAe,CAAC;WAC5D,wCAAwC,CAAC,UAAU,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kDAAkD,CAAC,MAYxE;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAExD,IAAI,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAAE,OAAO;IAE3D,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAElF,MAAM,qCAAqC,CAAC;QAC1C,GAAG,MAAM;QACT,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,iGAAiG;QACjG,6FAA6F;QAC7F,KAAK,EAAE,CAAC,gBAAgB;YACtB,CAAC,CAAC,oCAAoC,CAAC,YAAY;YACnD,CAAC,CAAC,oCAAoC,CAAC,wBAAwB;KAClE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,MAQrE;IACC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEhD,iGAAiG;IACjG,0EAA0E;IAC1E,MAAM,8BAA8B,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,eAAe,CAAC;YAAE,SAAS;QACxE,MAAM,cAAc,GAAG,OAAO,UAAW,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAW,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/G,iGAAiG;QACjG,6FAA6F;QAC7F,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAClF,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,8BAA8B,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,8BAA8B,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAEtD,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,IAAI,8BAA8B,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrG,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,kCAAkC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAsB;IACzF,gBAAgB,CAAC,KAAK;IACtB,gBAAgB,CAAC,SAAS;CAC3B,CAAC;AAEF,oGAAoG;AACpG,MAAM,UAAU,+CAA+C,CAAC,YAAqB;IACnF,OAAO,wDAAwD,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAsB;IAC1F,gBAAgB,CAAC,oBAAoB;CACtC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gDAAgD,CAAC,YAAqB;IACpF,OAAO,yDAAyD,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,MAOrD;IACC,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAErE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAE9F,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAqB,gBAAgB,EAAE;QACxF,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE;QACpC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE;QACpC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,oDAAoD,CAAC,EAAE;KAC3E,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CAAC,MAkBnE;IACC,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAErC,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QACxC,MAAM,+CAA+C,CAAC;YACpD,GAAG,MAAM;YACT,WAAW;YACX,KAAK,EAAE,oCAAoC,CAAC,eAAe;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,iGAAiG;IACjG,0FAA0F;IAC1F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,MAAM,CAAC,eAAe,CAAC;YAAE,SAAS;QAC/E,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,sBAAsB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrG,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAW,qBAAqB,CAAC,IAAI,CAAC;AAKjG;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CAAC,MAUnE;IACC,oGAAoG;IACpG,2EAA2E;IAC3E,IAAI,uCAAuC,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1E,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACjH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,OAAO,UAAU,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAClD,GAAG,MAAM;YACT,cAAc;YACd,gBAAgB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ;QAAE,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,YAAY,CACnB,MAAe,EACf,MAAc,EACd,MAA6F;IAE7F,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAgB,CAAC;IACnD,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,SAAS,CAAmC,CAAC;IACzE,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAc,CAAC;IAE7E,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE;QACrF,OAAO,EAAE;YACP,MAAM,EAAE,2CAA2C;YACnD,OAAO,EACL,0DAA0D,MAAM,2BAA2B;kBACzF,uFAAuF;kBACvF,sDAAsD;YAC1D,MAAM;YACN,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM;SACvD;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,MAW5D;IAMC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IACnC,MAAM,mBAAmB,GAAG,8CAA8C,CAAC;IAE3E,kGAAkG;IAClG,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,oGAAoG;IACpG,kGAAkG;IAClG,qGAAqG;IACrG,sGAAsG;IACtG,sGAAsG;IACtG,MAAM,gBAAgB,GAAG,MAAM,6CAA6C,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG;QACZ,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,gBAAgB;QAChB,mBAAmB;KACpB,CAAC;IAEF,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACxF,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAE7F,6FAA6F;IAC7F,+FAA+F;IAC/F,mGAAmG;IACnG,oGAAoG;IACpG,iGAAiG;IACjG,6FAA6F;IAC7F,sGAAsG;IACtG,2DAA2D;IAC3D,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,IAAI,CACrD,gBAAgB,EAChB,EAAE,CACH,CAAC;IACF,MAAM,sBAAsB,GAAG,YAAY,CACzC,aAAa,EAAE,eAAe,EAAE,KAAK,CACtC,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC;IAEzE,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,0BAA0B,EAAE,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAqB,gBAAgB,EAAE;QACxF,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE;QACpC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,oDAAoD,CAAC,EAAE;KAC3E,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAyB,YAAY,CAAqB,WAAW,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAE5H,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAC9B,gBAAgB;aACb,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACxE,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CACnF,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAe,gBAAgB,EAAE,YAAY,CAAC,CAAC;QACtF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAe,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACrE,IAAI,uCAAuC,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,4FAA4F;IAC5F,MAAM,8BAA8B,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,SAAS;QAC5D,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClD,8BAA8B,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,8BAA8B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,YAA+C,EAAyB,EAAE,CAAC,CAAC;QAC5F,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC;QACxC,GAAG,CAAC,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC,CAAC;IAEH,OAAO;QACL,0BAA0B,EAAE,sBAAsB,CAAC,MAAM;QACzD,sBAAsB,EAAE,sBAAsB;aAC3C,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;aACnG,GAAG,CAAC,QAAQ,CAAC;QAChB,wBAAwB,EAAE,sBAAsB;aAC7C,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;aAC5F,GAAG,CAAC,QAAQ,CAAC;KACjB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * THE last-organization-owner floor — one semantic authority, consumed by every reducing path.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a tenant must retain an\n * accountable administrative principal; losing the last one is simultaneously an access-control\n * failure and an availability failure for that tenant, with no in-product remedy.\n *\n * ## The invariant, stated once\n *\n * Every organization the floor protects retains at least one **administratively usable owner**. Any\n * write that would reduce that population below {@link ORGANIZATION_OWNER_FLOOR_MINIMUM} is refused.\n *\n * ONE deliberate exception, added 2026-08-05: a data-subject ERASURE may proceed when the controller\n * explicitly acknowledges the consequence, because refusing it indefinitely on availability grounds\n * is not a ground GDPR Art. 17(3) recognises. Refusal remains the default and every administrative\n * door refuses unconditionally — see {@link assertOrganizationOwnerFloorForSubjectErasure}.\n *\n * This is the ORGANIZATION-scope twin of `super-admin-floor.backend.utils.ts`. The shape is\n * deliberately the same — resolve the conferring role set from the live table, measure the\n * population, refuse with `CONFLICT` — and the differences are all consequences of the population\n * being per-tenant rather than per-application. Read that module's header for the reasoning this one\n * does not repeat (why `CONFLICT` and not `403`/`400`, why it is a population rule rather than a\n * self-demotion check, why there is no system/internal bypass).\n *\n * ## Why this cannot be left to the operation gates\n *\n * Every path that can remove organization authority is gated on `ORG_ADMIN`, which `ORG_OWNER`\n * confers — so the gates are satisfied precisely by the principal capable of causing the lockout.\n * And unlike a resource with an admin escape hatch, `ORGANIZATION_MEMBERS` declares NO\n * super-admin variant: `validateParentScopeAccess` requires an organization-wide role entry for that\n * specific organization, so a platform super-administrator who is not a member cannot reach any\n * membership row of the stranded tenant. A super-admin can observe and destroy an ownerless\n * organization; they cannot re-own it. That is what makes this fail-closed rather than advisory.\n *\n * ## \"Administratively usable\" — three axes, all resolved toward the SMALLER count\n *\n * 1. **The roles must CONFER `ORG_OWNER`.** Organization roles are application-configurable, so an\n *    app may register a role with `inheritFrom: ORG_OWNER` whose holder passes every owner gate —\n *    `authorize` admits any role whose `inheritFrom` chain CONTAINS the required one. The conferring\n *    set is resolved from the live ORGANIZATIONS role table at call time; see\n *    {@link resolveOrganizationOwnerConferringRoles}.\n * 2. **The MEMBERSHIP must be `ACTIVE`.** This is the exact analogue of the application twin's\n *    `UserStatus.ACTIVE`: `execution-context-creator` builds `initiatorRoles` from memberships\n *    listed with `status: OrganizationMemberStatus.ACTIVE`, so an `INVITED`, `INACTIVE` or\n *    `SUSPENDED` row confers no authority at all. See\n *    {@link ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES}.\n * 3. **The linked USER must be `ACTIVE`.** A second, independent axis with no application-scope\n *    twin, because there the subject and the authority live on one row. Here they do not: the same\n *    context builder throws `AUTHENTICATION_USER_NOT_ACTIVE` before it ever reaches memberships, so\n *    an `ACTIVE` membership owned by a `SUSPENDED` user is not a live owner. See\n *    {@link ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES}.\n *\n * A fourth condition — the row must not be retention-hidden — needs no code, exactly as in the\n * application twin: both population queries go through the repository chokepoint, which applies the\n * hide to LIST. It is stated because the absence of an explicit filter is otherwise\n * indistinguishable from having forgotten the case.\n *\n * ## ORGANIZATION-WIDE GRANTS ONLY\n *\n * `ORGANIZATION_UNIT_MEMBERS` rows are role grants too, and they are deliberately NOT counted. A\n * unit assignment reaches `initiatorRoles` as a NARROWED entry carrying `organizationUnitId`, and\n * every authorization gate partitions on that discriminator first (`isOrganizationWideRoleInfo` in\n * `validateOperationRoles`, `validateParentScopeAccess`, and the role-ceiling gate). A unit-scoped\n * `ORG_OWNER` therefore confers authority inside ONE unit and none across the tenant — counting it\n * would satisfy the floor with a principal who cannot administer the organization, which is the\n * lockout this module exists to prevent arriving through the guard itself. The floor reads\n * `organizationMembers.roles` and nothing else.\n */\n\nimport {\n  AdministrativeContinuityErrorCode,\n  CORE_ORG_ROLES,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorType,\n  OrganizationMemberStatus,\n  OrganizationStatus,\n  ResourcePrimaryScope,\n  UserStatus,\n  type Organization,\n  type OrganizationMember,\n  type User,\n} from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { resolveRolesConferringAnchor } from '~wildo-backend-lib/security/authorizations/role-conferral.backend.utils';\n\n/**\n * The minimum number of administratively usable owners a protected organization must retain.\n *\n * Named rather than inlined as `> 0` so the several call sites state the same rule, and so a product\n * that ever requires two (a four-eyes tenant-administration policy) has one place to change.\n */\nexport const ORGANIZATION_OWNER_FLOOR_MINIMUM = 1;\n\n/**\n * The membership statuses that confer authority, and therefore the only ones that count.\n *\n * Derived from `ExecutionContextCreator`, which lists a principal's memberships with\n * `status: OrganizationMemberStatus.ACTIVE` — every other status contributes no `initiatorRoles`\n * entry, so its `roles` array is inert.\n *\n * `INVITED` is excluded even though acceptance flips it to `ACTIVE` on the same row: a recoverable\n * owner is not a usable one, and the invitee may never accept. Kept as an explicit list rather than\n * `!== ACTIVE` so that adding a member to {@link OrganizationMemberStatus} forces a decision here\n * instead of silently inheriting \"usable\".\n */\nexport const ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES: readonly OrganizationMemberStatus[] = [\n  OrganizationMemberStatus.ACTIVE,\n];\n\n/**\n * The user statuses in which an owner can actually authenticate.\n *\n * The second usability axis, and the one with no application-scope twin. There, authority and\n * subject are the same row; here the membership carries the authority while the ability to present\n * it lives on the linked `User`. `ExecutionContextCreator` throws\n * `AUTHENTICATION_USER_NOT_ACTIVE` for any non-`ACTIVE` user BEFORE it reads a single membership, so\n * a `SUSPENDED` owner satisfies a membership-only count while being unable to log in.\n *\n * Same list-not-negation discipline as {@link ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES}.\n */\nexport const ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES: readonly UserStatus[] = [UserStatus.ACTIVE];\n\n/**\n * The organization statuses that DO NOT require an owner — terminal tenants that are over.\n *\n * A `CANCELLED` or `DELETED` tenant is finished: refusing to remove its last owner would be friction\n * with no lockout to prevent, and would block ordinary offboarding cleanup.\n *\n * ## Why a deny-list of TERMINAL statuses, not an allow-list of protected ones\n *\n * The floor must fail CLOSED: a status nobody classified must keep its tenant GUARDED (an\n * over-refusal, recoverable) in preference to silently dropping the floor (a lockout, not\n * recoverable). A deny-list delivers exactly that — {@link organizationRequiresOwnerFloor} returns\n * `!has(status)`, so any value NOT known to be terminal (a future {@link OrganizationStatus} member,\n * OR a value outside the enum entirely) is protected by construction, with no cast.\n *\n * This REPLACED an allow-list of protected statuses whose doc claimed the same fail-closed default and\n * delivered the opposite: `.includes(status as OrganizationStatus)` on an unclassified value returns\n * false → NOT protected → fail-OPEN. The platform bootstrap seed wrote a lowercase `'active'` (outside\n * the enum, whose member is `'ACTIVE'`); the allow-list dropped the floor for it AND the boot report's\n * own `{ status: { $in: <allow> } }` query excluded it, so the platform's own organization sat both\n * unprotected and invisible to the backstop. The cast was the enabler; inverting to a deny-list\n * removes the cast and the asymmetry at once. The known protected set is unchanged — it is exactly the\n * complement within the 6-member enum: ACTIVE, SUSPENDED, TRIAL, TRIAL_EXPIRED.\n *\n * NOTE the deliberate divergence from {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} ({DELETED,\n * SUSPENDED, CANCELLED}): SUSPENDED REQUIRES an owner (someone must be able to sign in and pay to\n * reactivate) while its memberships confer NO authority. The two partitions are different and must\n * not be merged into one.\n */\nexport const ORGANIZATION_STATUSES_WITHOUT_OWNER_FLOOR: ReadonlySet<OrganizationStatus> = new Set([\n  OrganizationStatus.CANCELLED,\n  OrganizationStatus.DELETED,\n]);\n\n/**\n * The remedy every refusal names.\n *\n * A guard that only says \"no\" on an operation the caller is authorized to perform reads as a defect.\n * Stating the one action that unblocks it is what makes the refusal actionable, and it is the same\n * remedy for a role change, a membership removal and a subject erasure blocked by the floor.\n */\nexport const ORGANIZATION_OWNER_FLOOR_REMEDY =\n  'Grant an organization owner role to another active member of this organization first, then retry.';\n\n/**\n * The reason code every floor refusal carries, so one filter finds them across the trail.\n *\n * INTERNAL. Not the wire contract — `sanitizeErrorForClient` strips `reason` from a CONFLICT and\n * allow-lists `code`, which carries {@link AdministrativeContinuityErrorCode}. Keep them distinct:\n * this one is free to stay richer than the client-facing code. Mirrors the note on the application\n * twin's `SUPER_ADMIN_FLOOR_REFUSAL_REASON`.\n */\nexport const ORGANIZATION_OWNER_FLOOR_REFUSAL_REASON = 'last_organization_owner_floor';\n\n/**\n * Why a membership would stop counting toward the floor. Rides the refusal so an operator reading\n * the error (or the audit trail) knows which axis the blocked write was about to change.\n */\nexport enum OrganizationOwnerFloorReductionCause {\n  /** The membership's `roles` would no longer confer owner. */\n  ROLE_REMOVAL = 'role_removal',\n  /** The membership's `status` would leave the authority-conferring set. */\n  MEMBERSHIP_STATUS_CHANGE = 'membership_status_change',\n  /** The membership row would be destroyed. */\n  MEMBERSHIP_REMOVAL = 'membership_removal',\n  /** The owning user would be scrubbed and retention-hidden, retiring every membership they hold. */\n  SUBJECT_ERASURE = 'subject_erasure',\n}\n\n/**\n * Resolves the role keys that confer organization ownership, from the LIVE role table.\n *\n * Injected rather than imported for the same reason `RoleHierarchyResolver` is: the effective\n * hierarchy is application-configurable, so a statically-derived set would silently disagree with\n * the roles the authorization layer actually honours.\n */\nexport type OrganizationOwnerConferralResolver = () => string[];\n\n/**\n * Every ORGANIZATIONS-scope role key whose `inheritFrom` chain reaches `ORG_OWNER` — i.e. every role\n * whose holder passes an owner gate.\n *\n * This floor's BINDING of the shared conferral derivation. The derivation itself — and the reasoning\n * that used to be restated here and in the super-admin floor in two different sets of words — lives\n * in {@link resolveRolesConferringAnchor}, including why the anchor is seeded unconditionally.\n *\n * Membership `roles` is the ORGANIZATIONS authority axis, so APPLICATION-scope roles are never\n * consulted. That safety comes from RESOLUTION rather than from the field's type: membership `roles`\n * is a free-form string on purpose (an application declares its own org roles), and what makes an\n * app-scoped string written onto a membership row confer nothing is that `getRoleHierarchy` reads it\n * against the ORGANIZATIONS table only. The role-ceiling gate relies on the same partition (see its\n * `holdsPlatformSuperAdmin` scope qualifier); this module must not be the weaker link.\n */\nexport function resolveOrganizationOwnerConferringRoles(\n  authorizationsService: Pick<AuthorizationsBackendService, 'getOrgRoles' | 'getRoleHierarchy'>,\n): string[] {\n  return resolveRolesConferringAnchor({\n    anchorRole: CORE_ORG_ROLES.ORG_OWNER,\n    scope: ResourcePrimaryScope.ORGANIZATIONS,\n    declaredRoleKeys: Object.keys(authorizationsService.getOrgRoles() ?? {}),\n    roleHierarchyResolver: (roleKey, scope) => authorizationsService.getRoleHierarchy(roleKey as any, scope),\n  });\n}\n\n/**\n * Bind an {@link OrganizationOwnerConferralResolver} to the container's live\n * `AuthorizationsBackendService`.\n *\n * Resolution is LAZY then per-call, exactly like `createRoleHierarchyResolver`:\n * custom-implementation factories are constructed during module registration, which can run before\n * the authorization service is bound (an eager `container.get` would turn this into a startup\n * crash), and the role table is mutated in place by `initializeRolesWithCustom`, so the conferring\n * set is recomputed per call rather than memoized.\n */\nexport function createOrganizationOwnerConferralResolver(container: Container): OrganizationOwnerConferralResolver {\n  let authorizationsService: AuthorizationsBackendService | undefined;\n  return () => {\n    authorizationsService ??= container.get<AuthorizationsBackendService>(SAAS_SERVICE_TYPES.AuthorizationsService);\n    return resolveOrganizationOwnerConferringRoles(authorizationsService);\n  };\n}\n\n/**\n * The execution context this floor measures its population through.\n *\n * NOT the caller's. The invariant must observe every owner membership of the organization AND the\n * `status` of every one of those owners' `User` rows — and the callers that reach these paths are\n * `ORG_ADMIN`s whose context cannot list `USERS` at all (the contextual filter would try to apply an\n * `organizationId` scope to a resource that has no such field). The outer operation remains the audit\n * and authorization boundary; the invariant reads the whole truth.\n *\n * The retention hide is NOT bypassed by this: it is suppressed only by an explicit `seeRetainedData`\n * flag, which defaults to false and is not set here — so an erased-and-retained owner stays invisible\n * to the count.\n *\n * Owned by the authority rather than by any one call site: WHICH context may measure this population\n * is a property of the invariant, and the membership guards and the lifecycle-verb guard must not be\n * able to disagree about it.\n *\n * Callers should build it LAZILY, and only once a subject has actually been shown to reduce the\n * population — construction is a registry lookup plus a possible application-id resolution, and the\n * overwhelmingly common write changes no authority at all.\n */\nexport async function createOrganizationOwnerFloorPopulationContext(\n  authExecutionContextFactory: AuthExecutionContextFactoryBackendService,\n): Promise<ExecutionContext<any>> {\n  return authExecutionContextFactory.createForSystemAuthOperation(\n    authExecutionContextFactory.getUsersReadOperationPath(),\n  );\n}\n\n/**\n * Whether a role array confers organization ownership.\n *\n * Defensive on the array itself: this runs on values read from unparsed caller input as well as on\n * persisted rows, and a non-array is treated as conferring nothing — which can only ever make the\n * count smaller, the safe direction.\n */\nexport function rolesConferOrganizationOwner(roles: unknown, conferringRoles: readonly string[]): boolean {\n  if (!Array.isArray(roles)) return false;\n  const conferringRoleSet = new Set(conferringRoles);\n  return roles.some((role) => typeof role === 'string' && conferringRoleSet.has(role));\n}\n\n/** Whether a membership status confers authority — see {@link ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES}. */\nexport function isAdministrativelyUsableMembershipStatus(status: unknown): boolean {\n  return ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES.includes(status as OrganizationMemberStatus);\n}\n\n/** Whether a user status leaves the owner able to authenticate — see {@link ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES}. */\nexport function isAdministrativelyUsableOwnerUserStatus(status: unknown): boolean {\n  return ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES.includes(status as UserStatus);\n}\n\n/**\n * Whether a membership row, on its OWN two axes, is an owner grant.\n *\n * Deliberately does NOT consult the linked user: that axis needs I/O and is resolved inside\n * {@link measureUsableOrganizationOwners}. This predicate exists for the zero-cost short-circuit on\n * the write paths — a membership that fails it cannot possibly be reducing the population, so no\n * query is issued.\n */\nexport function isOwnerConferringMembership(\n  member: Pick<OrganizationMember, 'roles' | 'status'> | undefined | null,\n  conferringRoles: readonly string[],\n): boolean {\n  if (!member) return false;\n  return rolesConferOrganizationOwner(member.roles, conferringRoles)\n    && isAdministrativelyUsableMembershipStatus(member.status);\n}\n\n/**\n * Whether this organization is one the floor protects — see\n * {@link ORGANIZATION_STATUSES_WITHOUT_OWNER_FLOOR}.\n *\n * A tenant marked for deletion (`deletionRequestedAt` set) is over whatever its `status` says.\n *\n * ⚠️ The two markers are no longer INDEPENDENT axes, which is what an earlier revision of this\n * doc claimed while the field was called `deletedAt` and nothing ever wrote it. Since the WS-A\n * teardown split they move together in one transaction: `request_deletion` writes\n * `status: DELETED` alongside `deletionRequestedAt`, and `restore` clears both. So the marker\n * check below is now genuinely redundant with the `DELETED` status — it is KEPT as a fail-closed\n * belt-and-braces, because the failure it guards against (a half-written mark leaving a tenant\n * both dying and owner-floor-protected) blocks offboarding cleanup, and reading one extra field\n * costs nothing.\n */\nexport function organizationRequiresOwnerFloor(\n  organization: Pick<Organization, 'status' | 'deletionRequestedAt'> | undefined | null,\n): boolean {\n  if (!organization) return false;\n  if (organization.deletionRequestedAt) return false;\n  // Fail-CLOSED, and cast-free: a status the enum does not contain is not in the terminal set, so\n  // `.has` returns false and the tenant stays GUARDED. This replaced\n  // `ORGANIZATION_STATUSES_REQUIRING_OWNER_FLOOR.includes(organization.status as OrganizationStatus)`,\n  // whose cast turned an out-of-vocabulary value (the platform seed's 'active') into a silent\n  // fail-OPEN. See {@link ORGANIZATION_STATUSES_WITHOUT_OWNER_FLOOR} for the full reasoning.\n  return !ORGANIZATION_STATUSES_WITHOUT_OWNER_FLOOR.has(organization.status);\n}\n\n/** The narrow row shapes the floor reads. */\ntype OwnerMembershipRow = Pick<OrganizationMember, '_id' | 'userId' | 'organizationId' | 'roles' | 'status'>;\ntype OwnerUserRow = Pick<User, '_id' | 'status'>;\n\n/** A repository read that fails closed when the resource is not registered. */\nfunction requireRepository(\n  resourceType: CoreResourceType,\n  params: {\n    repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n    errorBuilder: ErrorBuilderBackendService;\n    executionContext: ExecutionContext<any>;\n    operationIdentifier: string;\n  },\n): ReturnType<RepositoriesRegistryHandlerBackendService['getRepository']> {\n  const repository = params.repositoriesRegistry.getRepository(resourceType);\n\n  // Fail closed. Without the repository the population is unknowable, and answering \"0\" would refuse\n  // every removal while answering \"many\" would permit the lockout. Neither is a guess worth making\n  // on an invariant with no recovery path.\n  if (!repository) {\n    throw params.errorBuilder.buildError(ErrorType.CONFIGURATION, params.executionContext, {\n      context: {\n        message: 'Cannot evaluate the organization-owner floor: a required repository is not registered',\n        resourceType,\n        operationIdentifier: params.operationIdentifier,\n      },\n    });\n  }\n\n  return repository;\n}\n\n/**\n * The membership ids that currently count as administratively usable owners of one organization.\n *\n * ## Why it returns the SET rather than a count\n *\n * The caller needs two answers from one measurement: how many owners the organization has, and\n * whether the rows it is about to change were among them. Returning the set answers both exactly.\n * A bare count would force the caller to decide separately whether its subject was counting — and\n * that second decision cannot see the user-status axis without repeating the same I/O, which is how\n * an erasure of a long-suspended ex-owner would come to be refused for a reduction it does not\n * actually cause.\n *\n * ## Why two LISTs and not a join\n *\n * The framework's repository contract is adapter-agnostic and has no cross-resource join. The first\n * query is bounded by the organization's owner-conferring `ACTIVE` memberships (`roles` and `status`\n * are both `.isDBIndexed()`), which is a handful of rows in any real tenant; the second reads\n * exactly those users by id. Materialising both costs nothing worth engineering around, and it keeps\n * every predicate expressible on both adapters.\n *\n * ## Retention\n *\n * No retention fragment is built here on purpose. `buildContextualFilter` applies the hide at the\n * repository chokepoint for LIST, and it is suppressed only by an explicit `seeRetainedData` context\n * flag that no system-context factory sets. Re-stating the rule here would be a second copy of\n * something the retention authority owns — the precise duplication that produced the G-AGG defect.\n */\nexport async function measureUsableOrganizationOwners(params: {\n  organizationId: string;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<string[]> {\n  const { organizationId, executionContext, conferringRoles } = params;\n\n  const membershipRepository = requireRepository(CoreResourceType.ORGANIZATION_MEMBERS, params);\n\n  const candidates = await membershipRepository.list<OwnerMembershipRow>(executionContext, {\n    organizationId,\n    roles: { $in: [...conferringRoles] },\n    status: { $in: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES] },\n  });\n\n  const membershipRows: OwnerMembershipRow[] = Array.isArray(candidates) ? candidates : [];\n  if (membershipRows.length === 0) return [];\n\n  // A membership whose `userId` did not survive the projection cannot be proven to belong to an\n  // authenticable user, so it is dropped rather than counted — the smaller-count direction.\n  const ownerUserIds = [...new Set(\n    membershipRows\n      .map((row) => (typeof row?.userId === 'string' ? row.userId : undefined))\n      .filter((userId): userId is string => userId !== undefined && userId.length > 0),\n  )];\n  if (ownerUserIds.length === 0) return [];\n\n  const userRepository = requireRepository(CoreResourceType.USERS, params);\n  const users = await userRepository.list<OwnerUserRow>(executionContext, ownerUserIds);\n  const userRows: OwnerUserRow[] = Array.isArray(users) ? users : [];\n\n  const authenticableUserIds = new Set(\n    userRows\n      .filter((row) => isAdministrativelyUsableOwnerUserStatus(row?.status))\n      .map((row) => String(row?._id)),\n  );\n\n  return membershipRows\n    .filter((row) => authenticableUserIds.has(String(row.userId)))\n    .map((row) => String(row._id));\n}\n\n/** One organization whose floor a write would breach. */\nexport type OrganizationOwnerFloorBreach = {\n  organizationId: string;\n  /** The usable-owner memberships the write removes from this organization's population. */\n  reducedMemberIds: string[];\n  remainingUsableOwners: number;\n};\n\n/**\n * Evaluate the floor for ONE organization without throwing.\n *\n * Returns the breach when the write would drop the organization below the minimum, and `undefined`\n * when it would not — including every case where the floor does not apply at all: an organization in\n * a terminal state, and a write whose subjects were not counting toward the population anyway.\n *\n * An organization that reads back as `null` is treated as unprotected: there is no tenant left to\n * leave ownerless, and refusing would block the cleanup of orphaned memberships. A read that THROWS\n * propagates instead — an unresolvable organization is not evidence that the write is safe.\n */\nexport async function evaluateOrganizationOwnerFloor(params: {\n  organizationId: string;\n  /** Threaded so the serialization bump joins the caller's transaction rather than racing it. */\n  serviceOptions?: unknown;\n  /** The membership rows about to stop counting, by `_id`. */\n  reducedMemberIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<OrganizationOwnerFloorBreach | undefined> {\n  const { organizationId, reducedMemberIds, executionContext } = params;\n\n  const organizationRepository = requireRepository(CoreResourceType.ORGANIZATIONS, params);\n  const organization = await organizationRepository.read<Pick<Organization, 'status' | 'deletionRequestedAt' | 'ownerFloorSerializationToken'>>(\n    executionContext,\n    organizationId,\n  );\n\n  if (!organizationRequiresOwnerFloor(organization)) return undefined;\n\n  // ── Serialize this decision against every other owner-reducing decision on the same tenant ──\n  //\n  // Bumped BEFORE the measurement, so the conflict window covers the whole check-then-act rather\n  // than just the write at the end. Two concurrent transactions that both reach this line touch the\n  // same organization document, and the storage engine aborts the loser — which is the only way to\n  // stop the write skew that a count-based guard is otherwise open to (two callers each removing a\n  // DIFFERENT owner, each observing the other still present, both committing, zero owners left).\n  //\n  // Deliberately not conditional on `serviceOptions.transaction`: the write is harmless without one,\n  // and making it conditional would mean the protection silently disappears on any path that forgot\n  // to open a transaction — exactly the class of gap this floor keeps finding. See\n  // `ownerFloorSerializationToken` on the organization schema for the rejected alternatives.\n  //\n  // assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — serialize concurrent reductions of a\n  // tenant's administrative population.\n  // A read-modify-write rather than `$inc`: the repository tier takes a field payload, not raw\n  // storage operators. The VALUE is irrelevant — nothing reads it — so a lost update here costs\n  // nothing. What matters is that the document is written at all, which is what two concurrent\n  // transactions collide on.\n  //\n  // `preserveServerInjectedFields` is required, not optional: the field is `.excludeFromUpdate()`\n  // and `.isBackendOnly()`, so the repository's strict request-DTO re-parse strips it and the write\n  // silently becomes a no-op — the serialization would look wired and protect nothing. (It did,\n  // first attempt: the token stayed at 0 and the pin caught it.)\n  await organizationRepository.update(\n    executionContext,\n    organizationId,\n    { ownerFloorSerializationToken: ((organization as { ownerFloorSerializationToken?: number } | null)?.ownerFloorSerializationToken ?? 0) + 1 },\n    {\n      ...((params as { serviceOptions?: Record<string, unknown> }).serviceOptions ?? {}),\n      preserveServerInjectedFields: ['ownerFloorSerializationToken'],\n    } as never,\n  );\n\n  const usableOwnerMemberIds = await measureUsableOrganizationOwners(params);\n\n  const reducedMemberIdSet = new Set(reducedMemberIds.map((memberId) => String(memberId)));\n  const reducedUsableMemberIds = usableOwnerMemberIds.filter((memberId) => reducedMemberIdSet.has(memberId));\n\n  // The subjects contribute nothing to this organization's population — most often because the\n  // linked user cannot authenticate, which the cheap short-circuits upstream cannot see. Removing\n  // them reduces nothing, so there is no floor question to answer.\n  if (reducedUsableMemberIds.length === 0) return undefined;\n\n  const remainingUsableOwners = usableOwnerMemberIds.length - reducedUsableMemberIds.length;\n  if (remainingUsableOwners >= ORGANIZATION_OWNER_FLOOR_MINIMUM) return undefined;\n\n  return { organizationId, reducedMemberIds: reducedUsableMemberIds, remainingUsableOwners };\n}\n\n/**\n * Refuse a write that would leave one or more organizations without an administratively usable\n * owner.\n *\n * Takes every breach at once rather than throwing on the first: a single subject erasure can strand\n * several tenants, and an operator who has to discover them one failed attempt at a time cannot plan\n * the remediation. The refusal names all of them.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — refuse the removal of a\n * tenant's last accountable administrative principal; the denial is an access-control decision and\n * is recorded as one by the operation's own error path.\n */\nexport function throwOrganizationOwnerFloorRefusal(params: {\n  breaches: readonly OrganizationOwnerFloorBreach[];\n  cause: OrganizationOwnerFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): never {\n  const { breaches, cause, executionContext, errorBuilder, conferringRoles, operationIdentifier } = params;\n\n  const organizationIds = breaches.map((breach) => breach.organizationId);\n\n  // CONFLICT, not AUTHORIZATION and not VALIDATION. The request is well-formed and the caller IS\n  // authorized — every one of these operations is gated on a role the protected one confers. What\n  // forbids the write is the current STATE of the organization, which is what CONFLICT means. A 403\n  // would tell an administrator to acquire authority they already hold (and none exists that lifts\n  // this floor, since `ORGANIZATION_MEMBERS` has no super-admin variant); a 400 would tell them to\n  // fix a payload that is correct.\n  throw errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n    context: {\n      // The WIRE contract — allow-listed by `sanitizeErrorForClient`, so this is what a client\n      // switches on. `reason` below is the internal audit/log filter handle and is stripped at the\n      // boundary; the two are different contracts and must not be conflated.\n      code: AdministrativeContinuityErrorCode.LAST_ORGANIZATION_OWNER,\n      reason: ORGANIZATION_OWNER_FLOOR_REFUSAL_REASON,\n      message:\n        `Refused: this would leave ${organizationIds.length === 1 ? 'an organization' : `${organizationIds.length} organizations`} `\n        + 'with no usable owner. ' + ORGANIZATION_OWNER_FLOOR_REMEDY,\n      cause,\n      operationIdentifier,\n      organizationIds,\n      breaches: breaches.map((breach) => ({\n        organizationId: breach.organizationId,\n        reducedMemberIds: [...breach.reducedMemberIds],\n        remainingUsableOwners: breach.remainingUsableOwners,\n      })),\n      requiredUsableOwners: ORGANIZATION_OWNER_FLOOR_MINIMUM,\n      conferringRoles: [...conferringRoles],\n      usableMembershipStatuses: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES],\n      usableOwnerUserStatuses: [...ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES],\n    },\n  });\n}\n\n/**\n * The floor check for a write that removes one organization's memberships from the population —\n * a membership DELETE, or a role/status transition that has already been shown to reduce.\n */\nexport async function assertOrganizationOwnerFloorPreserved(params: {\n  organizationId: string;\n  reducedMemberIds: readonly string[];\n  cause: OrganizationOwnerFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const breach = await evaluateOrganizationOwnerFloor(params);\n  if (!breach) return;\n\n  throwOrganizationOwnerFloorRefusal({ ...params, breaches: [breach] });\n}\n\n/**\n * Whether a role/status transition could possibly reduce the owner population.\n *\n * The short-circuit of {@link assertOrganizationOwnerFloorPreservedForTransition}, extracted so a\n * caller can ask the question BEFORE paying for the machinery the assertion needs — building a\n * system execution context is a registry lookup plus a possible application-id resolution, and the\n * common membership edit is one that changes no authority at all.\n *\n * Exported for that reason ONLY, and consumed by the assertion itself so there is exactly one\n * implementation of the rule. A caller that re-derived this test would be the drift.\n *\n * Reads only the two axes carried on the membership row. The linked user's status is deliberately\n * NOT consulted: it costs the very query this predicate exists to avoid, and a membership whose user\n * cannot authenticate simply reaches the measurement, which then correctly finds it was never\n * counting. Answering \"could reduce\" too generously is the safe direction — it buys a query, not a\n * wrong verdict.\n */\nexport function membershipTransitionCouldReduceOwners(params: {\n  previousRoles: unknown;\n  previousStatus: unknown;\n  nextRoles: unknown;\n  nextStatus: unknown;\n  conferringRoles: readonly string[];\n}): boolean {\n  const { previousRoles, previousStatus, nextRoles, nextStatus, conferringRoles } = params;\n\n  const conferredBefore = rolesConferOrganizationOwner(previousRoles, conferringRoles)\n    && isAdministrativelyUsableMembershipStatus(previousStatus);\n  if (!conferredBefore) return false;\n\n  return !(rolesConferOrganizationOwner(nextRoles, conferringRoles)\n    && isAdministrativelyUsableMembershipStatus(nextStatus));\n}\n\n/**\n * The floor check for a role/status TRANSITION on a single membership.\n *\n * Encapsulates the short-circuit that keeps the population queries off the hot path: the floor can\n * only be threatened when the membership conferred ownership BEFORE the write and would not AFTER\n * it. An ordinary member edit, or an edit that leaves the owner grant intact, costs two set\n * membership tests and no I/O.\n *\n * That shape is also why a purely additive caller can invoke this unconditionally — a write that\n * still confers owner always short-circuits — which removes the standing invitation for a future\n * change to the set algebra to bypass the floor unnoticed.\n *\n * Note the deliberate asymmetry with {@link evaluateOrganizationOwnerFloor}: the short-circuit here\n * reads only the two axes carried on the membership row, because consulting the linked user's status\n * would cost the very query the short-circuit exists to avoid. A membership whose user cannot\n * authenticate therefore reaches the measurement, which then correctly finds it was never counting\n * and returns no breach.\n */\nexport async function assertOrganizationOwnerFloorPreservedForTransition(params: {\n  memberId: string;\n  organizationId: string;\n  previousRoles: unknown;\n  previousStatus: unknown;\n  nextRoles: unknown;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const { memberId, nextRoles, conferringRoles } = params;\n\n  if (!membershipTransitionCouldReduceOwners(params)) return;\n\n  const stillConfersRole = rolesConferOrganizationOwner(nextRoles, conferringRoles);\n\n  await assertOrganizationOwnerFloorPreserved({\n    ...params,\n    reducedMemberIds: [memberId],\n    // Which axis actually broke it. Role removal is named first when BOTH change in one write: it is\n    // the axis the operator authored against the authority field, and the more specific finding.\n    cause: !stillConfersRole\n      ? OrganizationOwnerFloorReductionCause.ROLE_REMOVAL\n      : OrganizationOwnerFloorReductionCause.MEMBERSHIP_STATUS_CHANGE,\n  });\n}\n\n/**\n * The floor check for a write that removes membership rows wholesale.\n *\n * Takes the memberships' CURRENT rows rather than a transition: there is no \"after\" state to\n * compare, the rows simply stop counting. Memberships that confer no ownership are filtered out\n * first, so removing a hundred ordinary members never touches the population queries.\n *\n * Generic over several organizations because the erasure path needs that; a membership DELETE passes\n * a single row and pays for exactly one organization.\n */\nexport async function assertOrganizationOwnerFloorPreservedForRemoval(params: {\n  memberships: readonly (OwnerMembershipRow | undefined | null)[];\n  cause: OrganizationOwnerFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const { memberships, conferringRoles } = params;\n\n  // Group the owner-conferring rows by tenant: one organization's population is measured once even\n  // when an erasure retires several of its memberships at the same instant.\n  const reducedMemberIdsByOrganization = new Map<string, string[]>();\n  for (const membership of memberships) {\n    if (!isOwnerConferringMembership(membership, conferringRoles)) continue;\n    const organizationId = typeof membership!.organizationId === 'string' ? membership!.organizationId : undefined;\n    // A membership with no resolvable tenant cannot be attributed to a population, and inventing one\n    // would measure the wrong organization. It contributes nothing rather than being guessed at.\n    if (!organizationId) continue;\n\n    const reducedMemberIds = reducedMemberIdsByOrganization.get(organizationId) ?? [];\n    reducedMemberIds.push(String(membership!._id));\n    reducedMemberIdsByOrganization.set(organizationId, reducedMemberIds);\n  }\n\n  if (reducedMemberIdsByOrganization.size === 0) return;\n\n  const breaches: OrganizationOwnerFloorBreach[] = [];\n  for (const [organizationId, reducedMemberIds] of reducedMemberIdsByOrganization) {\n    const breach = await evaluateOrganizationOwnerFloor({ ...params, organizationId, reducedMemberIds });\n    if (breach) breaches.push(breach);\n  }\n\n  if (breaches.length === 0) return;\n\n  throwOrganizationOwnerFloorRefusal({ ...params, breaches });\n}\n\n/**\n * The resource types whose erasure retires a principal's organization memberships, and therefore the\n * subject types whose erasure can breach the floor.\n *\n * `USERS` and `USER_SELF` are two resource configurations over the SAME collection (see\n * `getCollectionNameForResource`), both declaring `RETAIN_AND_IMPERSONALIZE`, so an erasure\n * addressed through either door scrubs and hides the same principal.\n *\n * `ORGANIZATION_MEMBERS` is deliberately absent: it declares no `retentionPolicy`, so there is no\n * subject-erasure door onto a membership row. Should it ever gain one, this list is where that\n * becomes a floor question.\n */\nexport const ORGANIZATION_OWNER_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES: readonly string[] = [\n  CoreResourceType.USERS,\n  CoreResourceType.USER_SELF,\n];\n\n/** Whether an erasure of this subject resource type can reduce an organization-owner population. */\nexport function isOrganizationOwnerFloorGovernedSubjectResource(resourceType: unknown): boolean {\n  return ORGANIZATION_OWNER_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES.includes(String(resourceType));\n}\n\n/**\n * The resource types whose rows CARRY the organization authority axis — i.e. the rows a direct\n * `roles` or `status` write can move in or out of the owner population.\n *\n * A DIFFERENT question from {@link ORGANIZATION_OWNER_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES}, and the\n * two lists are deliberately disjoint. That one names the ERASURE SUBJECTS whose scrub retires the\n * memberships they hold (`USERS` / `USER_SELF`); this one names the rows that hold the authority\n * itself. Conflating them would ask a generic write path to guard the wrong population.\n *\n * `ORGANIZATION_UNIT_MEMBERS` is absent for the reason the module header gives: a unit assignment\n * reaches `initiatorRoles` as a NARROWED entry and confers authority inside one unit only, so it\n * never counted toward this population and moving it cannot reduce it.\n */\nexport const ORGANIZATION_OWNER_FLOOR_AUTHORITY_BEARING_RESOURCE_TYPES: readonly string[] = [\n  CoreResourceType.ORGANIZATION_MEMBERS,\n];\n\n/**\n * Whether a direct `roles`/`status` write on this resource type can reduce an organization-owner\n * population — the question a GENERIC write path (a shared lifecycle-verb implementation) must ask\n * before deciding whether this floor governs the row it is about to change.\n */\nexport function isOrganizationOwnerFloorAuthorityBearingResource(resourceType: unknown): boolean {\n  return ORGANIZATION_OWNER_FLOOR_AUTHORITY_BEARING_RESOURCE_TYPES.includes(String(resourceType));\n}\n\n/**\n * Read the owner-conferring memberships held by the users an erasure is about to scrub.\n *\n * Reads through the repository so the retention hide applies: a subject ALREADY erased contributes\n * no visible membership here, which is correct — it stopped counting at its own erasure, and a\n * re-run must not be refused on account of authority that no longer exists.\n *\n * The filter selects only owner-conferring `ACTIVE` memberships, so a user who belongs to fifty\n * organizations as an ordinary member costs one indexed query returning nothing.\n */\nexport async function readOwnerMembershipsForSubjects(params: {\n  subjectUserIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<OwnerMembershipRow[]> {\n  const { subjectUserIds, executionContext, conferringRoles } = params;\n\n  if (subjectUserIds.length === 0) return [];\n\n  const membershipRepository = requireRepository(CoreResourceType.ORGANIZATION_MEMBERS, params);\n\n  const memberships = await membershipRepository.list<OwnerMembershipRow>(executionContext, {\n    userId: { $in: [...subjectUserIds] },\n    roles: { $in: [...conferringRoles] },\n    status: { $in: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES] },\n  });\n\n  return Array.isArray(memberships) ? memberships : [];\n}\n\n/**\n * Refuse a subject erasure that would leave any protected organization without a usable owner.\n *\n * The cross-scope case, and the one with no application-scope analogue: erasing ONE user can strand\n * SEVERAL tenants at once, so the check fans out over every organization the subject owns and the\n * refusal names all of them.\n *\n * No `INTERNALLY_INITIATED_REQUEST` bypass, deliberately — a system write strands a tenant exactly\n * as a human one does. The remedy the refusal names (appoint another owner, then erase) satisfies\n * both obligations at once, and is the path the caller should normally take.\n *\n * ## Why the refusal is DEFEASIBLE here, unlike every other door this floor guards\n *\n * Revised 2026-08-05 after checking the invariant against external standards. The administrative\n * doors (role change, membership removal, suspension) refuse unconditionally, and that matches the\n * industry norm exactly — Slack will not let the Primary Owner be deactivated, GitHub will not let\n * the last owner leave. Nobody has a *right* to have their membership removed.\n *\n * A data-subject ERASURE is not that. GDPR Art. 17(3) lists the grounds on which erasure may be\n * refused — legal obligation, public interest, public health, archiving/research, legal claims — and\n * \"the tenant would become unadministrable\" is not among them; Art. 12(3) additionally requires an\n * answer without undue delay (read as one month). An indefinite refusal on availability grounds is\n * therefore a posture the framework must not impose on every application built on it, because the\n * application is the controller that owes the data subject that answer.\n *\n * Hence: refuse BY DEFAULT (so the safe path is the default and stranding is never accidental), but\n * let the controller proceed deliberately via {@link acknowledgeOwnerFloorBreach}, which records a\n * CRITICAL event per stranded tenant instead of throwing. That shape is also what NIST SP 800-53\n * asks of an emergency path: AC-2 contemplates emergency access that bypasses normal authorization\n * *with management oversight*, and AC-2(7) requires privileged changes to be monitored — an audited,\n * per-request, non-default override is precisely that, and precisely not a standing bypass.\n *\n * The industry pattern is two-part — block at the tenant tier, repair from a higher one (GitHub: an\n * Enterprise owner re-owns the org; otherwise Support). Wildo has BOTH halves: the block is here, and\n * the repair door is `organizationMembers.grantOwnership`, a platform-tier verb that promotes an\n * existing member, writes only `roles`, additively, and is audited at CRITICAL with a mandatory\n * justification. An acknowledged breach therefore leaves a tenant that cannot administer ITSELF, and\n * that a platform operator can repair without an out-of-band write.\n *\n * ⚠️ The default still stays refuse. A repair door is an escalation someone has to notice and\n * perform; it is not a reason to strand a tenant casually, and the tenant-tier answer remains\n * \"transfer ownership first\".\n */\nexport async function assertOrganizationOwnerFloorForSubjectErasure(params: {\n  subjectUserIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n  /**\n   * The CONTROLLER's explicit decision to complete an erasure that strands a tenant.\n   *\n   * Absent (the default), a stranding erasure is refused and the refusal names the remedy. Present,\n   * the erasure proceeds and every breached tenant is reported to {@link onAcknowledgedBreach} for a\n   * CRITICAL audit record. It is deliberately a parameter and not a config flag: this is a per-request\n   * decision by the party that owes the data subject an answer, not a deployment-wide posture.\n   */\n  acknowledgeOwnerFloorBreach?: boolean;\n  /** Invoked once per stranded tenant when the breach is acknowledged. Never on the refusal path. */\n  onAcknowledgedBreach?: (breach: OrganizationOwnerFloorBreach) => Promise<void> | void;\n}): Promise<void> {\n  const memberships = await readOwnerMembershipsForSubjects(params);\n  if (memberships.length === 0) return;\n\n  if (!params.acknowledgeOwnerFloorBreach) {\n    await assertOrganizationOwnerFloorPreservedForRemoval({\n      ...params,\n      memberships,\n      cause: OrganizationOwnerFloorReductionCause.SUBJECT_ERASURE,\n    });\n    return;\n  }\n\n  // ── Acknowledged: proceed, but make the consequence loud and attributable ──\n  // Nothing is refused here, so the only obligation left is that the resulting ownerless tenant is\n  // never silent. The same evaluation runs; its verdicts become records instead of a throw.\n  const breachesByOrganization = new Map<string, string[]>();\n  for (const membership of memberships) {\n    if (!isOwnerConferringMembership(membership, params.conferringRoles)) continue;\n    const organizationId = typeof membership.organizationId === 'string' ? membership.organizationId : undefined;\n    if (!organizationId) continue;\n    const reduced = breachesByOrganization.get(organizationId) ?? [];\n    reduced.push(String(membership._id));\n    breachesByOrganization.set(organizationId, reduced);\n  }\n\n  for (const [organizationId, reducedMemberIds] of breachesByOrganization) {\n    const breach = await evaluateOrganizationOwnerFloor({ ...params, organizationId, reducedMemberIds });\n    if (breach) await params.onAcknowledgedBreach?.(breach);\n  }\n}\n\n/**\n * The operation identifier the floor reports when it is measuring rather than guarding a named verb.\n *\n * Exported so call sites that have no verb of their own (the erasure guard) share one spelling with\n * the tests that pin it.\n */\nexport const ORGANIZATION_OWNER_FLOOR_MEASUREMENT_OPERATION: string = CoreResourceOperation.LIST;\n\n/** One protected organization that has no administratively usable owner. */\nexport type OwnerlessOrganization = { organizationId: string; organizationName?: string };\n\n/**\n * Measure — without refusing anything — which protected organizations have NO usable owner.\n *\n * The boot-time report, and the only surface that observes states no write guard ever saw: a direct\n * database edit, a restore from a backup taken mid-erasure, a seed that authored no owner, or a\n * role-table reconfiguration that changed which roles confer ownership out from under an existing\n * population.\n *\n * ## Cost, stated rather than hidden\n *\n * THREE queries total, independent of tenant count — not one per organization. Owner-conferring\n * ACTIVE memberships are listed once across all tenants, their users are read once by id, and the\n * protected organizations are listed once; the join happens in memory. The only unavoidable\n * O(tenants) part is materialising the organization list, because an organization with ZERO owner\n * rows is exactly the case being looked for and cannot be found from the membership side.\n *\n * That asymmetry is why this ships as a report and not as a write guard: it answers a question about\n * every tenant at once, which no per-write path should ever pay for.\n */\n/**\n * Which organizations would lose their last usable owner because THIS USER stops being usable.\n *\n * ## Reports. Never refuses. That asymmetry is the decision, not an oversight.\n *\n * Every other surface of this floor refuses, and the rule that governs them says administrative\n * doors refuse unconditionally. Deactivating a USER is the one case where that answer is wrong.\n *\n * The membership doors take away authority someone HAS; refusing costs the caller a transfer step\n * and nothing else. Suspending a user account is overwhelmingly an INCIDENT RESPONSE — the account\n * is compromised, or the person has just left — and refusing it would mean an operator cannot lock\n * out a hostile owner without first performing an ownership transfer, in the middle of an incident,\n * using the very tenant the attacker controls. That trade is backwards: a stranded tenant is\n * recoverable (the boot report finds it, `organizationMembers.grantOwnership` repairs it), while a\n * live compromised owner is not recoverable at all.\n *\n * So the containment action always proceeds and the consequence is made LOUD instead of prevented —\n * the same shape the erasure path uses for its acknowledged breach, and what NIST SP 800-53 `AC-2`\n * asks of emergency access: not blocked, but monitored.\n *\n * The caller supplies the reporter, so this module owns the MEASUREMENT and the call site owns the\n * channel (audit, SIEM, log). Passing no reporter makes this a pure measurement, which is what the\n * tests use.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — record, without blocking, a\n * containment action that leaves a tenant unadministrable.\n */\nexport async function reportOrganizationsStrandedByUserDeactivation(params: {\n  subjectUserId: string;\n  /** The status the account is moving to. A still-usable status strands nobody and short-circuits. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n  report?: (breach: OrganizationOwnerFloorBreach) => Promise<void> | void;\n}): Promise<OrganizationOwnerFloorBreach[]> {\n  // Costs nothing on the overwhelmingly common path: reactivations and any transition that leaves the\n  // account usable cannot reduce an owner population, so no query is issued.\n  if (isAdministrativelyUsableOwnerUserStatus(params.nextStatus)) return [];\n\n  const memberships = await readOwnerMembershipsForSubjects({ ...params, subjectUserIds: [params.subjectUserId] });\n  if (memberships.length === 0) return [];\n\n  const breaches: OrganizationOwnerFloorBreach[] = [];\n  for (const membership of memberships) {\n    const organizationId = typeof membership?.organizationId === 'string' ? membership.organizationId : undefined;\n    if (!organizationId) continue;\n    const breach = await evaluateOrganizationOwnerFloor({\n      ...params,\n      organizationId,\n      reducedMemberIds: [String(membership._id)],\n    });\n    if (breach) breaches.push(breach);\n  }\n\n  for (const breach of breaches) await params.report?.(breach);\n  return breaches;\n}\n\n/**\n * The rows of a repository LIST, whatever shape it returned — and a LOUD refusal if it returned\n * neither.\n *\n * This replaces `Array.isArray(result) ? result : []`, which appeared at THREE reads inside the boot\n * report and was a silent shape-assumption at each. `list` answers a bare array on the\n * non-paginated path and a `{ data, pagination }` envelope otherwise, so the guard was one\n * pagination decision away from being wrong — and the three sites failed in DIFFERENT directions,\n * which is why nobody noticed:\n *\n * - **organizations** → `[]` means \"no protected tenants\", so the report returns\n *   `ownerlessOrganizations: []` and declares the estate healthy. **Fail-OPEN, in the one function\n *   whose entire purpose is to catch what the write guards missed.** That is the worst possible\n *   wrong answer here: silence is indistinguishable from a clean bill of health.\n * - **memberships** / **users** → `[]` makes every tenant look ownerless. Noisy, but fail-CLOSED.\n *\n * A diagnostic that cannot parse its own read must say so. `administrative-continuity-floors.md`\n * documents this report as \"the backstop for exactly the ordering and wrong-resource gaps the\n * guards structurally cannot cover\"; a backstop that answers \"nothing to see\" when it did not\n * understand the answer is not a backstop, and the failure is invisible by construction.\n */\nfunction readListRows<TRow>(\n  result: unknown,\n  source: string,\n  params: { errorBuilder: ErrorBuilderBackendService; executionContext: ExecutionContext<any> },\n): TRow[] {\n  if (Array.isArray(result)) return result as TRow[];\n  const envelope = (result ?? undefined) as { data?: unknown } | undefined;\n  if (envelope && Array.isArray(envelope.data)) return envelope.data as TRow[];\n\n  throw params.errorBuilder.buildError(ErrorType.CONFIGURATION, params.executionContext, {\n    context: {\n      reason: 'owner_floor_report_unreadable_list_result',\n      message:\n        `The organization-owner floor report could not read its ${source} query result. It is the `\n        + 'backstop for states no write guard evaluated, so an unreadable read must fail loudly '\n        + 'rather than report an empty, healthy-looking estate.',\n      source,\n      receivedType: result === null ? 'null' : typeof result,\n    },\n  });\n}\n\nexport async function measureOrganizationsMissingUsableOwner(params: {\n  /**\n   * The report OWNS the context it measures through — it does not accept a caller's. Building it from\n   * the factory (super-admin @ APPLICATION, `INTERNALLY_INITIATED_REQUEST`) is what makes this a\n   * backstop nobody has to remember to configure. See the block comment below for the failure this\n   * removes.\n   */\n  authExecutionContextFactory: AuthExecutionContextFactoryBackendService;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n}): Promise<{\n  protectedOrganizationCount: number;\n  ownerlessOrganizations: OwnerlessOrganization[];\n  /** Tenants one lifecycle event away from being unadministrable — the preventive signal. */\n  singleOwnerOrganizations: OwnerlessOrganization[];\n}> {\n  const { conferringRoles } = params;\n  const operationIdentifier = ORGANIZATION_OWNER_FLOOR_MEASUREMENT_OPERATION;\n\n  // ── The report builds and OWNS its measuring context; it never trusts a caller's. ──────────────\n  //\n  // A whole-estate backstop must read EVERY tenant system-wide, which is not a caller-tunable scope.\n  // The `INTERNALLY_INITIATED_REQUEST` context this builds is EXEMPT from scope-root collection\n  // confinement (`assignScopeRootCollectionConfinementToFilter`'s exempt execution types), so the\n  // ORGANIZATIONS scope-root LIST returns every tenant rather than only the caller's own.\n  //\n  // A caller-supplied context defeated exactly this. A role-less context, OR one carrying the wrong\n  // execution-type string (the integration harness passed `'internal_call'`, which is NOT the enum\n  // value `'internally_initiated_request'`), is not recognised as internal, so the scope-root read is\n  // confined to the caller's org ids — none — and compiles to `{_id: {$in: []}}`. The backstop then\n  // returned `ownerlessOrganizations: []`, indistinguishable from a healthy estate. Owning the context\n  // removes the whole class of caller error, and brings the report into line with the invariant its own\n  // {@link createOrganizationOwnerFloorPopulationContext} doc already states for the write-path guards.\n  const executionContext = await createOrganizationOwnerFloorPopulationContext(params.authExecutionContextFactory);\n  const reads = {\n    repositoriesRegistry: params.repositoriesRegistry,\n    errorBuilder: params.errorBuilder,\n    executionContext,\n    operationIdentifier,\n  };\n\n  const organizationRepository = requireRepository(CoreResourceType.ORGANIZATIONS, reads);\n  const membershipRepository = requireRepository(CoreResourceType.ORGANIZATION_MEMBERS, reads);\n\n  // Fetch EVERY organization and classify in memory with the fail-closed predicate. The former\n  // `{ status: { $in: <protected> } }` query was the SECOND way an ownerless tenant escaped this\n  // backstop: an out-of-vocabulary status (the platform seed's 'active') matched no `$in` member and\n  // was dropped before {@link organizationRequiresOwnerFloor} could protect it. Materialising the org\n  // list is the report's one unavoidable O(tenants) cost (reasoned about on the type doc above); a\n  // terminal row is discarded by the predicate, never by a query a wrong status can slip past.\n  // `deletionRequestedAt` is likewise filtered in memory — \"field absent\" has no portable cross-adapter\n  // spelling, and the authority already owns that predicate.\n  const organizations = await organizationRepository.list<Pick<Organization, '_id' | 'name' | 'status' | 'deletionRequestedAt'>>(\n    executionContext,\n    {},\n  );\n  const protectedOrganizations = readListRows<Pick<Organization, '_id' | 'name' | 'status' | 'deletionRequestedAt'>>(\n    organizations, 'organizations', reads,\n  ).filter((organization) => organizationRequiresOwnerFloor(organization));\n\n  if (protectedOrganizations.length === 0) {\n    return { protectedOrganizationCount: 0, ownerlessOrganizations: [], singleOwnerOrganizations: [] };\n  }\n\n  const memberships = await membershipRepository.list<OwnerMembershipRow>(executionContext, {\n    roles: { $in: [...conferringRoles] },\n    status: { $in: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES] },\n  });\n  const ownerMemberships: OwnerMembershipRow[] = readListRows<OwnerMembershipRow>(memberships, 'organization-members', reads);\n\n  const ownerUserIds = [...new Set(\n    ownerMemberships\n      .map((row) => (typeof row?.userId === 'string' ? row.userId : undefined))\n      .filter((userId): userId is string => userId !== undefined && userId.length > 0),\n  )];\n\n  const authenticableUserIds = new Set<string>();\n  if (ownerUserIds.length > 0) {\n    const userRepository = requireRepository(CoreResourceType.USERS, reads);\n    const users = await userRepository.list<OwnerUserRow>(executionContext, ownerUserIds);\n    for (const user of readListRows<OwnerUserRow>(users, 'users', reads)) {\n      if (isAdministrativelyUsableOwnerUserStatus(user?.status)) authenticableUserIds.add(String(user?._id));\n    }\n  }\n\n  // Counted, not just set-membership: a tenant with exactly ONE usable owner is one resignation, one\n  // suspension, or one lost password away from being unadministrable, and it is the population the\n  // floor will REFUSE to help — every removal there returns 409 until someone grants a second owner.\n  // Surfacing it at boot is the only PREVENTIVE half this floor has; everything else is cure.\n  const usableOwnerCountByOrganization = new Map<string, number>();\n  for (const row of ownerMemberships) {\n    if (!authenticableUserIds.has(String(row.userId))) continue;\n    const organizationId = String(row.organizationId);\n    usableOwnerCountByOrganization.set(organizationId, (usableOwnerCountByOrganization.get(organizationId) ?? 0) + 1);\n  }\n\n  const describe = (organization: { _id?: unknown; name?: unknown }): OwnerlessOrganization => ({\n    organizationId: String(organization._id),\n    ...(typeof organization.name === 'string' ? { organizationName: organization.name } : {}),\n  });\n\n  return {\n    protectedOrganizationCount: protectedOrganizations.length,\n    ownerlessOrganizations: protectedOrganizations\n      .filter((organization) => (usableOwnerCountByOrganization.get(String(organization._id)) ?? 0) === 0)\n      .map(describe),\n    singleOwnerOrganizations: protectedOrganizations\n      .filter((organization) => usableOwnerCountByOrganization.get(String(organization._id)) === 1)\n      .map(describe),\n  };\n}\n"]}
+{"version":3,"file":"organization-owner-floor.backend.utils.js","sourceRoot":"","sources":["../../../../src/security/authorizations/organization-owner-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EACL,iCAAiC,EACjC,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,GAIX,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,yEAAyE,CAAC;AAEvH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAwC;IACvG,wBAAwB,CAAC,MAAM;CAChC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAoC,IAAI,GAAG,CAAC;IAChG,kBAAkB,CAAC,SAAS;IAC5B,kBAAkB,CAAC,OAAO;CAC3B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,mGAAmG,CAAC;AAEtG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,+BAA+B,CAAC;AAEvF;;;GAGG;AACH,MAAM,CAAN,IAAY,oCASX;AATD,WAAY,oCAAoC;IAC9C,6DAA6D;IAC7D,qEAA6B,CAAA;IAC7B,0EAA0E;IAC1E,6FAAqD,CAAA;IACrD,6CAA6C;IAC7C,iFAAyC,CAAA;IACzC,mGAAmG;IACnG,2EAAmC,CAAA;AACrC,CAAC,EATW,oCAAoC,KAApC,oCAAoC,QAS/C;AAWD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uCAAuC,CACrD,qBAA6F;IAE7F,OAAO,4BAA4B,CAAC;QAClC,UAAU,EAAE,cAAc,CAAC,SAAS;QACpC,KAAK,EAAE,oBAAoB,CAAC,aAAa;QACzC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACxE,qBAAqB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,OAAc,EAAE,KAAK,CAAC;KACzG,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wCAAwC,CAAC,SAAoB;IAC3E,IAAI,qBAA+D,CAAC;IACpE,OAAO,GAAG,EAAE;QACV,qBAAqB,KAAK,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QAChH,OAAO,uCAAuC,CAAC,qBAAqB,CAAC,CAAC;IACxE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,2BAAsE;IAEtE,OAAO,2BAA2B,CAAC,4BAA4B,CAC7D,2BAA2B,CAAC,yBAAyB,EAAE,CACxD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc,EAAE,eAAkC;IAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,wCAAwC,CAAC,MAAe;IACtE,OAAO,oDAAoD,CAAC,QAAQ,CAAC,MAAkC,CAAC,CAAC;AAC3G,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,uCAAuC,CAAC,MAAe;IACrE,OAAO,2CAA2C,CAAC,QAAQ,CAAC,MAAoB,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAuE,EACvE,eAAkC;IAElC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,4BAA4B,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;WAC7D,wCAAwC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,8BAA8B,CAC5C,YAAqF;IAErF,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,YAAY,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACnD,gGAAgG;IAChG,mEAAmE;IACnE,qGAAqG;IACrG,4FAA4F;IAC5F,2FAA2F;IAC3F,OAAO,CAAC,yCAAyC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAMD,+EAA+E;AAC/E,SAAS,iBAAiB,CACxB,YAA8B,EAC9B,MAKC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAE3E,mGAAmG;IACnG,iGAAiG;IACjG,yCAAyC;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE;YACrF,OAAO,EAAE;gBACP,OAAO,EAAE,uFAAuF;gBAChG,YAAY;gBACZ,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;aAChD;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,MAOrD;IACC,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAErE,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAE9F,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAqB,gBAAgB,EAAE;QACvF,cAAc;QACd,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE;QACpC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,oDAAoD,CAAC,EAAE;KAC3E,CAAC,CAAC;IAEH,MAAM,cAAc,GAAyB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,8FAA8F;IAC9F,0FAA0F;IAC1F,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAC9B,cAAc;aACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACxE,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CACnF,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,cAAc,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAe,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAmB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,QAAQ;SACL,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uCAAuC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;SACrE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAClC,CAAC;IAEF,OAAO,cAAc;SAClB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;SAC7D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MAWpD;IACC,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;IAEtE,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,IAAI,CACpD,gBAAgB,EAChB,cAAc,CACf,CAAC;IAEF,IAAI,CAAC,8BAA8B,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAEpE,+FAA+F;IAC/F,EAAE;IACF,+FAA+F;IAC/F,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,EAAE;IACF,mGAAmG;IACnG,kGAAkG;IAClG,iFAAiF;IACjF,2FAA2F;IAC3F,EAAE;IACF,mGAAmG;IACnG,sCAAsC;IACtC,6FAA6F;IAC7F,8FAA8F;IAC9F,6FAA6F;IAC7F,2BAA2B;IAC3B,EAAE;IACF,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,+DAA+D;IAC/D,MAAM,sBAAsB,CAAC,MAAM,CACjC,gBAAgB,EAChB,cAAc,EACd,EAAE,4BAA4B,EAAE,CAAE,YAAiE,EAAE,4BAA4B,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,EAC7I;QACE,GAAG,CAAE,MAAuD,CAAC,cAAc,IAAI,EAAE,CAAC;QAClF,4BAA4B,EAAE,CAAC,8BAA8B,CAAC;KACtD,CACX,CAAC;IAEF,MAAM,oBAAoB,GAAG,MAAM,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAE3E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE3G,6FAA6F;IAC7F,gGAAgG;IAChG,iEAAiE;IACjE,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC;IAC1F,IAAI,qBAAqB,IAAI,gCAAgC;QAAE,OAAO,SAAS,CAAC;IAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAOlD;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAEzG,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAExE,+FAA+F;IAC/F,gGAAgG;IAChG,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,iCAAiC;IACjC,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;QAClE,OAAO,EAAE;YACP,yFAAyF;YACzF,6FAA6F;YAC7F,uEAAuE;YACvE,IAAI,EAAE,iCAAiC,CAAC,uBAAuB;YAC/D,MAAM,EAAE,uCAAuC;YAC/C,OAAO,EACL,6BAA6B,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,gBAAgB,GAAG;kBAC1H,wBAAwB,GAAG,+BAA+B;YAC9D,KAAK;YACL,mBAAmB;YACnB,eAAe;YACf,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAClC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC9C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;aACpD,CAAC,CAAC;YACH,oBAAoB,EAAE,gCAAgC;YACtD,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,wBAAwB,EAAE,CAAC,GAAG,oDAAoD,CAAC;YACnF,uBAAuB,EAAE,CAAC,GAAG,2CAA2C,CAAC;SAC1E;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,MAS3D;IACC,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,kCAAkC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAMrD;IACC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEzF,MAAM,eAAe,GAAG,4BAA4B,CAAC,aAAa,EAAE,eAAe,CAAC;WAC/E,wCAAwC,CAAC,cAAc,CAAC,CAAC;IAC9D,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IAEnC,OAAO,CAAC,CAAC,4BAA4B,CAAC,SAAS,EAAE,eAAe,CAAC;WAC5D,wCAAwC,CAAC,UAAU,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kDAAkD,CAAC,MAYxE;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAExD,IAAI,CAAC,qCAAqC,CAAC,MAAM,CAAC;QAAE,OAAO;IAE3D,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAElF,MAAM,qCAAqC,CAAC;QAC1C,GAAG,MAAM;QACT,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,iGAAiG;QACjG,6FAA6F;QAC7F,KAAK,EAAE,CAAC,gBAAgB;YACtB,CAAC,CAAC,oCAAoC,CAAC,YAAY;YACnD,CAAC,CAAC,oCAAoC,CAAC,wBAAwB;KAClE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,MAQrE;IACC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEhD,iGAAiG;IACjG,0EAA0E;IAC1E,MAAM,8BAA8B,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,eAAe,CAAC;YAAE,SAAS;QACxE,MAAM,cAAc,GAAG,OAAO,UAAW,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAW,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/G,iGAAiG;QACjG,6FAA6F;QAC7F,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAClF,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,8BAA8B,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,8BAA8B,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAEtD,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,IAAI,8BAA8B,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrG,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,kCAAkC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wDAAwD,GAAsB;IACzF,gBAAgB,CAAC,KAAK;IACtB,gBAAgB,CAAC,SAAS;CAC3B,CAAC;AAEF,oGAAoG;AACpG,MAAM,UAAU,+CAA+C,CAAC,YAAqB;IACnF,OAAO,wDAAwD,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yDAAyD,GAAsB;IAC1F,gBAAgB,CAAC,oBAAoB;CACtC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gDAAgD,CAAC,YAAqB;IACpF,OAAO,yDAAyD,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,MAOrD;IACC,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAErE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAE9F,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAqB,gBAAgB,EAAE;QACxF,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE;QACpC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE;QACpC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,oDAAoD,CAAC,EAAE;KAC3E,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CAAC,MAkBnE;IACC,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAErC,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QACxC,MAAM,+CAA+C,CAAC;YACpD,GAAG,MAAM;YACT,WAAW;YACX,KAAK,EAAE,oCAAoC,CAAC,eAAe;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,iGAAiG;IACjG,0FAA0F;IAC1F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,MAAM,CAAC,eAAe,CAAC;YAAE,SAAS;QAC/E,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,sBAAsB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrG,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAW,qBAAqB,CAAC,IAAI,CAAC;AAKjG;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CAAC,MAUnE;IACC,oGAAoG;IACpG,2EAA2E;IAC3E,IAAI,uCAAuC,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1E,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACjH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,OAAO,UAAU,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAClD,GAAG,MAAM;YACT,cAAc;YACd,gBAAgB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ;QAAE,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,YAAY,CACnB,MAAe,EACf,MAAc,EACd,MAA6F;IAE7F,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAgB,CAAC;IACnD,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,SAAS,CAAmC,CAAC;IACzE,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAc,CAAC;IAE7E,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE;QACrF,OAAO,EAAE;YACP,MAAM,EAAE,2CAA2C;YACnD,OAAO,EACL,0DAA0D,MAAM,2BAA2B;kBACzF,uFAAuF;kBACvF,sDAAsD;YAC1D,MAAM;YACN,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM;SACvD;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,MAW5D;IAMC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IACnC,MAAM,mBAAmB,GAAG,8CAA8C,CAAC;IAE3E,kGAAkG;IAClG,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,oGAAoG;IACpG,kGAAkG;IAClG,qGAAqG;IACrG,sGAAsG;IACtG,sGAAsG;IACtG,MAAM,gBAAgB,GAAG,MAAM,6CAA6C,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG;QACZ,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,gBAAgB;QAChB,mBAAmB;KACpB,CAAC;IAEF,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACxF,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAE7F,6FAA6F;IAC7F,+FAA+F;IAC/F,mGAAmG;IACnG,oGAAoG;IACpG,iGAAiG;IACjG,6FAA6F;IAC7F,sGAAsG;IACtG,2DAA2D;IAC3D,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,IAAI,CACrD,gBAAgB,EAChB,EAAE,CACH,CAAC;IACF,MAAM,sBAAsB,GAAG,YAAY,CACzC,aAAa,EAAE,eAAe,EAAE,KAAK,CACtC,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC;IAEzE,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,0BAA0B,EAAE,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAqB,gBAAgB,EAAE;QACxF,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE;QACpC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,oDAAoD,CAAC,EAAE;KAC3E,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAyB,YAAY,CAAqB,WAAW,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAE5H,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAC9B,gBAAgB;aACb,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACxE,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CACnF,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAe,gBAAgB,EAAE,YAAY,CAAC,CAAC;QACtF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAe,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACrE,IAAI,uCAAuC,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,4FAA4F;IAC5F,MAAM,8BAA8B,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,SAAS;QAC5D,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClD,8BAA8B,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,8BAA8B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,YAA+C,EAAyB,EAAE,CAAC,CAAC;QAC5F,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC;QACxC,GAAG,CAAC,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC,CAAC;IAEH,OAAO;QACL,0BAA0B,EAAE,sBAAsB,CAAC,MAAM;QACzD,sBAAsB,EAAE,sBAAsB;aAC3C,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;aACnG,GAAG,CAAC,QAAQ,CAAC;QAChB,wBAAwB,EAAE,sBAAsB;aAC7C,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;aAC5F,GAAG,CAAC,QAAQ,CAAC;KACjB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * THE last-organization-owner floor — one semantic authority, consumed by every reducing path.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a tenant must retain an\n * accountable administrative principal; losing the last one is simultaneously an access-control\n * failure and an availability failure for that tenant, with no in-product remedy.\n *\n * ## The invariant, stated once\n *\n * Every organization the floor protects retains at least one **administratively usable owner**. Any\n * write that would reduce that population below {@link ORGANIZATION_OWNER_FLOOR_MINIMUM} is refused.\n *\n * ONE deliberate exception, added 2026-08-05: a data-subject ERASURE may proceed when the controller\n * explicitly acknowledges the consequence, because refusing it indefinitely on availability grounds\n * is not a ground GDPR Art. 17(3) recognises. Refusal remains the default and every administrative\n * door refuses unconditionally — see {@link assertOrganizationOwnerFloorForSubjectErasure}.\n *\n * This is the ORGANIZATION-scope twin of `super-admin-floor.backend.utils.ts`. The shape is\n * deliberately the same — resolve the conferring role set from the live table, measure the\n * population, refuse with `CONFLICT` — and the differences are all consequences of the population\n * being per-tenant rather than per-application. Read that module's header for the reasoning this one\n * does not repeat (why `CONFLICT` and not `403`/`400`, why it is a population rule rather than a\n * self-demotion check, why there is no system/internal bypass).\n *\n * ## Why this cannot be left to the operation gates\n *\n * Every path that can remove organization authority is gated on `ORG_ADMIN`, which `ORG_OWNER`\n * confers — so the gates are satisfied precisely by the principal capable of causing the lockout.\n * And unlike a resource with an admin escape hatch, `ORGANIZATION_MEMBERS` declares NO\n * super-admin variant: `validateParentScopeAccess` requires an organization-wide role entry for that\n * specific organization, so a platform super-administrator who is not a member cannot reach any\n * membership row of the stranded tenant. A super-admin can observe and destroy an ownerless\n * organization; they cannot re-own it. That is what makes this fail-closed rather than advisory.\n *\n * ## \"Administratively usable\" — three axes, all resolved toward the SMALLER count\n *\n * 1. **The roles must CONFER `ORG_OWNER`.** Organization roles are application-configurable, so an\n *    app may register a role with `inheritFrom: ORG_OWNER` whose holder passes every owner gate —\n *    `authorize` admits any role whose `inheritFrom` chain CONTAINS the required one. The conferring\n *    set is resolved from the live ORGANIZATIONS role table at call time; see\n *    {@link resolveOrganizationOwnerConferringRoles}.\n * 2. **The MEMBERSHIP must be `ACTIVE`.** This is the exact analogue of the application twin's\n *    `UserStatus.ACTIVE`: `execution-context-creator` builds `initiatorRoles` from memberships\n *    listed with `status: OrganizationMemberStatus.ACTIVE`, so an `INVITED`, `INACTIVE` or\n *    `SUSPENDED` row confers no authority at all. See\n *    {@link ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES}.\n * 3. **The linked USER must be `ACTIVE`.** A second, independent axis with no application-scope\n *    twin, because there the subject and the authority live on one row. Here they do not: the same\n *    context builder throws `AUTHENTICATION_USER_NOT_ACTIVE` before it ever reaches memberships, so\n *    an `ACTIVE` membership owned by a `SUSPENDED` user is not a live owner. See\n *    {@link ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES}.\n *\n * A fourth condition — the row must not be retention-hidden — needs no code, exactly as in the\n * application twin: both population queries go through the repository chokepoint, which applies the\n * hide to LIST. It is stated because the absence of an explicit filter is otherwise\n * indistinguishable from having forgotten the case.\n *\n * ## ORGANIZATION-WIDE GRANTS ONLY\n *\n * `ORGANIZATION_UNIT_MEMBERS` rows are role grants too, and they are deliberately NOT counted. A\n * unit assignment reaches `initiatorRoles` as a NARROWED entry carrying `organizationUnitId`, and\n * every authorization gate partitions on that discriminator first (`isOrganizationWideRoleInfo` in\n * `validateOperationRoles`, `validateParentScopeAccess`, and the role-ceiling gate). A unit-scoped\n * `ORG_OWNER` therefore confers authority inside ONE unit and none across the tenant — counting it\n * would satisfy the floor with a principal who cannot administer the organization, which is the\n * lockout this module exists to prevent arriving through the guard itself. The floor reads\n * `organizationMembers.roles` and nothing else.\n */\n\nimport {\n  AdministrativeContinuityErrorCode,\n  CORE_ORG_ROLES,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorType,\n  OrganizationMemberStatus,\n  OrganizationStatus,\n  ResourcePrimaryScope,\n  UserStatus,\n  type Organization,\n  type OrganizationMember,\n  type User,\n} from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { resolveRolesConferringAnchor } from '~wildo-backend-lib/security/authorizations/role-conferral.backend.utils';\n\n/**\n * The minimum number of administratively usable owners a protected organization must retain.\n *\n * Named rather than inlined as `> 0` so the several call sites state the same rule, and so a product\n * that ever requires two (a four-eyes tenant-administration policy) has one place to change.\n */\nexport const ORGANIZATION_OWNER_FLOOR_MINIMUM = 1;\n\n/**\n * The membership statuses that confer authority, and therefore the only ones that count.\n *\n * Derived from `ExecutionContextCreator`, which lists a principal's memberships with\n * `status: OrganizationMemberStatus.ACTIVE` — every other status contributes no `initiatorRoles`\n * entry, so its `roles` array is inert.\n *\n * `INVITED` is excluded even though acceptance flips it to `ACTIVE` on the same row: a recoverable\n * owner is not a usable one, and the invitee may never accept. Kept as an explicit list rather than\n * `!== ACTIVE` so that adding a member to {@link OrganizationMemberStatus} forces a decision here\n * instead of silently inheriting \"usable\".\n */\nexport const ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES: readonly OrganizationMemberStatus[] = [\n  OrganizationMemberStatus.ACTIVE,\n];\n\n/**\n * The user statuses in which an owner can actually authenticate.\n *\n * The second usability axis, and the one with no application-scope twin. There, authority and\n * subject are the same row; here the membership carries the authority while the ability to present\n * it lives on the linked `User`. `ExecutionContextCreator` throws\n * `AUTHENTICATION_USER_NOT_ACTIVE` for any non-`ACTIVE` user BEFORE it reads a single membership, so\n * a `SUSPENDED` owner satisfies a membership-only count while being unable to log in.\n *\n * Same list-not-negation discipline as {@link ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES}.\n */\nexport const ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES: readonly UserStatus[] = [UserStatus.ACTIVE];\n\n/**\n * The organization statuses that DO NOT require an owner — terminal tenants that are over.\n *\n * A `CANCELLED` or `DELETED` tenant is finished: refusing to remove its last owner would be friction\n * with no lockout to prevent, and would block ordinary offboarding cleanup.\n *\n * ## Why a deny-list of TERMINAL statuses, not an allow-list of protected ones\n *\n * The floor must fail CLOSED: a status nobody classified must keep its tenant GUARDED (an\n * over-refusal, recoverable) in preference to silently dropping the floor (a lockout, not\n * recoverable). A deny-list delivers exactly that — {@link organizationRequiresOwnerFloor} returns\n * `!has(status)`, so any value NOT known to be terminal (a future {@link OrganizationStatus} member,\n * OR a value outside the enum entirely) is protected by construction, with no cast.\n *\n * This REPLACED an allow-list of protected statuses whose doc claimed the same fail-closed default and\n * delivered the opposite: `.includes(status as OrganizationStatus)` on an unclassified value returns\n * false → NOT protected → fail-OPEN. The platform bootstrap seed wrote a lowercase `'active'` (outside\n * the enum, whose member is `'ACTIVE'`); the allow-list dropped the floor for it AND the boot report's\n * own `{ status: { $in: <allow> } }` query excluded it, so the platform's own organization sat both\n * unprotected and invisible to the backstop. The cast was the enabler; inverting to a deny-list\n * removes the cast and the asymmetry at once. The known protected set is unchanged — it is exactly the\n * complement within the 6-member enum: ACTIVE, SUSPENDED, TRIAL, TRIAL_EXPIRED.\n *\n * NOTE the deliberate divergence from {@link ORGANIZATION_STATUSES_WITHOUT_AUTHORITY} ({DELETED,\n * SUSPENDED, CANCELLED}): SUSPENDED REQUIRES an owner (someone must be able to sign in and pay to\n * reactivate) while its memberships confer NO authority. The two partitions are different and must\n * not be merged into one.\n */\nexport const ORGANIZATION_STATUSES_WITHOUT_OWNER_FLOOR: ReadonlySet<OrganizationStatus> = new Set([\n  OrganizationStatus.CANCELLED,\n  OrganizationStatus.DELETED,\n]);\n\n/**\n * The remedy every refusal names.\n *\n * A guard that only says \"no\" on an operation the caller is authorized to perform reads as a defect.\n * Stating the one action that unblocks it is what makes the refusal actionable, and it is the same\n * remedy for a role change, a membership removal and a subject erasure blocked by the floor.\n */\nexport const ORGANIZATION_OWNER_FLOOR_REMEDY =\n  'Grant an organization owner role to another active member of this organization first, then retry.';\n\n/**\n * The reason code every floor refusal carries, so one filter finds them across the trail.\n *\n * INTERNAL. Not the wire contract — `sanitizeErrorForClient` strips `reason` from a CONFLICT and\n * allow-lists `code`, which carries {@link AdministrativeContinuityErrorCode}. Keep them distinct:\n * this one is free to stay richer than the client-facing code. Mirrors the note on the application\n * twin's `SUPER_ADMIN_FLOOR_REFUSAL_REASON`.\n */\nexport const ORGANIZATION_OWNER_FLOOR_REFUSAL_REASON = 'last_organization_owner_floor';\n\n/**\n * Why a membership would stop counting toward the floor. Rides the refusal so an operator reading\n * the error (or the audit trail) knows which axis the blocked write was about to change.\n */\nexport enum OrganizationOwnerFloorReductionCause {\n  /** The membership's `roles` would no longer confer owner. */\n  ROLE_REMOVAL = 'role_removal',\n  /** The membership's `status` would leave the authority-conferring set. */\n  MEMBERSHIP_STATUS_CHANGE = 'membership_status_change',\n  /** The membership row would be destroyed. */\n  MEMBERSHIP_REMOVAL = 'membership_removal',\n  /** The owning user would be scrubbed and retention-hidden, retiring every membership they hold. */\n  SUBJECT_ERASURE = 'subject_erasure',\n}\n\n/**\n * Resolves the role keys that confer organization ownership, from the LIVE role table.\n *\n * Injected rather than imported for the same reason `RoleHierarchyResolver` is: the effective\n * hierarchy is application-configurable, so a statically-derived set would silently disagree with\n * the roles the authorization layer actually honours.\n */\nexport type OrganizationOwnerConferralResolver = () => string[];\n\n/**\n * Every ORGANIZATIONS-scope role key whose `inheritFrom` chain reaches `ORG_OWNER` — i.e. every role\n * whose holder passes an owner gate.\n *\n * This floor's BINDING of the shared conferral derivation. The derivation itself — and the reasoning\n * that used to be restated here and in the super-admin floor in two different sets of words — lives\n * in {@link resolveRolesConferringAnchor}, including why the anchor is seeded unconditionally.\n *\n * Membership `roles` is the ORGANIZATIONS authority axis, so APPLICATION-scope roles are never\n * consulted. That safety comes from RESOLUTION rather than from the field's type: membership `roles`\n * is a free-form string on purpose (an application declares its own org roles), and what makes an\n * app-scoped string written onto a membership row confer nothing is that `getRoleHierarchy` reads it\n * against the ORGANIZATIONS table only. The role-ceiling gate relies on the same partition (see its\n * `holdsPlatformSuperAdmin` scope qualifier); this module must not be the weaker link.\n */\nexport function resolveOrganizationOwnerConferringRoles(\n  authorizationsService: Pick<AuthorizationsBackendService, 'getOrgRoles' | 'getRoleHierarchy'>,\n): string[] {\n  return resolveRolesConferringAnchor({\n    anchorRole: CORE_ORG_ROLES.ORG_OWNER,\n    scope: ResourcePrimaryScope.ORGANIZATIONS,\n    declaredRoleKeys: Object.keys(authorizationsService.getOrgRoles() ?? {}),\n    roleHierarchyResolver: (roleKey, scope) => authorizationsService.getRoleHierarchy(roleKey as any, scope),\n  });\n}\n\n/**\n * Bind an {@link OrganizationOwnerConferralResolver} to the container's live\n * `AuthorizationsBackendService`.\n *\n * Resolution is LAZY then per-call, exactly like `createRoleHierarchyResolver`:\n * custom-implementation factories are constructed during module registration, which can run before\n * the authorization service is bound (an eager `container.get` would turn this into a startup\n * crash), and the role table is mutated in place by `initializeRolesWithCustom`, so the conferring\n * set is recomputed per call rather than memoized.\n */\nexport function createOrganizationOwnerConferralResolver(container: Container): OrganizationOwnerConferralResolver {\n  let authorizationsService: AuthorizationsBackendService | undefined;\n  return () => {\n    authorizationsService ??= container.get<AuthorizationsBackendService>(SAAS_SERVICE_TYPES.AuthorizationsService);\n    return resolveOrganizationOwnerConferringRoles(authorizationsService);\n  };\n}\n\n/**\n * The execution context this floor measures its population through.\n *\n * NOT the caller's. The invariant must observe every owner membership of the organization AND the\n * `status` of every one of those owners' `User` rows — and the callers that reach these paths are\n * `ORG_ADMIN`s whose context cannot list `USERS` at all (the contextual filter would try to apply an\n * `organizationId` scope to a resource that has no such field). The outer operation remains the audit\n * and authorization boundary; the invariant reads the whole truth.\n *\n * The retention hide is NOT bypassed by this: it is suppressed only by an explicit `seeRetainedData`\n * flag, which defaults to false and is not set here — so an erased-and-retained owner stays invisible\n * to the count.\n *\n * Owned by the authority rather than by any one call site: WHICH context may measure this population\n * is a property of the invariant, and the membership guards and the lifecycle-verb guard must not be\n * able to disagree about it.\n *\n * Callers should build it LAZILY, and only once a subject has actually been shown to reduce the\n * population — construction is a registry lookup plus a possible application-id resolution, and the\n * overwhelmingly common write changes no authority at all.\n */\nexport async function createOrganizationOwnerFloorPopulationContext(\n  authExecutionContextFactory: AuthExecutionContextFactoryBackendService,\n): Promise<ExecutionContext<any>> {\n  return authExecutionContextFactory.createForSystemAuthOperation(\n    authExecutionContextFactory.getUsersReadOperationPath(),\n  );\n}\n\n/**\n * Whether a role array confers organization ownership.\n *\n * Defensive on the array itself: this runs on values read from unparsed caller input as well as on\n * persisted rows, and a non-array is treated as conferring nothing — which can only ever make the\n * count smaller, the safe direction.\n */\nexport function rolesConferOrganizationOwner(roles: unknown, conferringRoles: readonly string[]): boolean {\n  if (!Array.isArray(roles)) return false;\n  const conferringRoleSet = new Set(conferringRoles);\n  return roles.some((role) => typeof role === 'string' && conferringRoleSet.has(role));\n}\n\n/** Whether a membership status confers authority — see {@link ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES}. */\nexport function isAdministrativelyUsableMembershipStatus(status: unknown): boolean {\n  return ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES.includes(status as OrganizationMemberStatus);\n}\n\n/** Whether a user status leaves the owner able to authenticate — see {@link ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES}. */\nexport function isAdministrativelyUsableOwnerUserStatus(status: unknown): boolean {\n  return ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES.includes(status as UserStatus);\n}\n\n/**\n * Whether a membership row, on its OWN two axes, is an owner grant.\n *\n * Deliberately does NOT consult the linked user: that axis needs I/O and is resolved inside\n * {@link measureUsableOrganizationOwners}. This predicate exists for the zero-cost short-circuit on\n * the write paths — a membership that fails it cannot possibly be reducing the population, so no\n * query is issued.\n */\nexport function isOwnerConferringMembership(\n  member: Pick<OrganizationMember, 'roles' | 'status'> | undefined | null,\n  conferringRoles: readonly string[],\n): boolean {\n  if (!member) return false;\n  return rolesConferOrganizationOwner(member.roles, conferringRoles)\n    && isAdministrativelyUsableMembershipStatus(member.status);\n}\n\n/**\n * Whether this organization is one the floor protects — see\n * {@link ORGANIZATION_STATUSES_WITHOUT_OWNER_FLOOR}.\n *\n * A tenant marked for deletion (`deletionRequestedAt` set) is over whatever its `status` says.\n *\n * ⚠️ The two markers are no longer INDEPENDENT axes, which is what an earlier revision of this\n * doc claimed while the field was called `deletedAt` and nothing ever wrote it. Since the WS-A\n * teardown split they move together in one transaction: `request_deletion` writes\n * `status: DELETED` alongside `deletionRequestedAt`, and `restore` clears both. So the marker\n * check below is now genuinely redundant with the `DELETED` status — it is KEPT as a fail-closed\n * belt-and-braces, because the failure it guards against (a half-written mark leaving a tenant\n * both dying and owner-floor-protected) blocks offboarding cleanup, and reading one extra field\n * costs nothing.\n */\nexport function organizationRequiresOwnerFloor(\n  organization: Pick<Organization, 'status' | 'deletionRequestedAt'> | undefined | null,\n): boolean {\n  if (!organization) return false;\n  if (organization.deletionRequestedAt) return false;\n  // Fail-CLOSED, and cast-free: a status the enum does not contain is not in the terminal set, so\n  // `.has` returns false and the tenant stays GUARDED. This replaced\n  // `ORGANIZATION_STATUSES_REQUIRING_OWNER_FLOOR.includes(organization.status as OrganizationStatus)`,\n  // whose cast turned an out-of-vocabulary value (the platform seed's 'active') into a silent\n  // fail-OPEN. See {@link ORGANIZATION_STATUSES_WITHOUT_OWNER_FLOOR} for the full reasoning.\n  return !ORGANIZATION_STATUSES_WITHOUT_OWNER_FLOOR.has(organization.status);\n}\n\n/** The narrow row shapes the floor reads. */\ntype OwnerMembershipRow = Pick<OrganizationMember, '_id' | 'userId' | 'organizationId' | 'roles' | 'status'>;\ntype OwnerUserRow = Pick<User, '_id' | 'status'>;\n\n/** A repository read that fails closed when the resource is not registered. */\nfunction requireRepository(\n  resourceType: CoreResourceType,\n  params: {\n    repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n    errorBuilder: ErrorBuilderBackendService;\n    executionContext: ExecutionContext<any>;\n    operationIdentifier: string;\n  },\n): ReturnType<RepositoriesRegistryHandlerBackendService['getRepository']> {\n  const repository = params.repositoriesRegistry.getRepository(resourceType);\n\n  // Fail closed. Without the repository the population is unknowable, and answering \"0\" would refuse\n  // every removal while answering \"many\" would permit the lockout. Neither is a guess worth making\n  // on an invariant with no recovery path.\n  if (!repository) {\n    throw params.errorBuilder.buildError(ErrorType.CONFIGURATION, params.executionContext, {\n      context: {\n        message: 'Cannot evaluate the organization-owner floor: a required repository is not registered',\n        resourceType,\n        operationIdentifier: params.operationIdentifier,\n      },\n    });\n  }\n\n  return repository;\n}\n\n/**\n * The membership ids that currently count as administratively usable owners of one organization.\n *\n * ## Why it returns the SET rather than a count\n *\n * The caller needs two answers from one measurement: how many owners the organization has, and\n * whether the rows it is about to change were among them. Returning the set answers both exactly.\n * A bare count would force the caller to decide separately whether its subject was counting — and\n * that second decision cannot see the user-status axis without repeating the same I/O, which is how\n * an erasure of a long-suspended ex-owner would come to be refused for a reduction it does not\n * actually cause.\n *\n * ## Why two LISTs and not a join\n *\n * The framework's repository contract is adapter-agnostic and has no cross-resource join. The first\n * query is bounded by the organization's owner-conferring `ACTIVE` memberships (`roles` and `status`\n * are both `.isDBIndexed()`), which is a handful of rows in any real tenant; the second reads\n * exactly those users by id. Materialising both costs nothing worth engineering around, and it keeps\n * every predicate expressible on both adapters.\n *\n * ## Retention\n *\n * No retention fragment is built here on purpose. `buildContextualFilter` applies the hide at the\n * repository chokepoint for LIST, and it is suppressed only by an explicit `seeRetainedData` context\n * flag that no system-context factory sets. Re-stating the rule here would be a second copy of\n * something the retention authority owns — the precise duplication that produced the G-AGG defect.\n */\nexport async function measureUsableOrganizationOwners(params: {\n  organizationId: string;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<string[]> {\n  const { organizationId, executionContext, conferringRoles } = params;\n\n  const membershipRepository = requireRepository(CoreResourceType.ORGANIZATION_MEMBERS, params);\n\n  const candidates = await membershipRepository.list<OwnerMembershipRow>(executionContext, {\n    organizationId,\n    roles: { $in: [...conferringRoles] },\n    status: { $in: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES] },\n  });\n\n  const membershipRows: OwnerMembershipRow[] = Array.isArray(candidates) ? candidates : [];\n  if (membershipRows.length === 0) return [];\n\n  // A membership whose `userId` did not survive the projection cannot be proven to belong to an\n  // authenticable user, so it is dropped rather than counted — the smaller-count direction.\n  const ownerUserIds = [...new Set(\n    membershipRows\n      .map((row) => (typeof row?.userId === 'string' ? row.userId : undefined))\n      .filter((userId): userId is string => userId !== undefined && userId.length > 0),\n  )];\n  if (ownerUserIds.length === 0) return [];\n\n  const userRepository = requireRepository(CoreResourceType.USERS, params);\n  const users = await userRepository.list<OwnerUserRow>(executionContext, ownerUserIds);\n  const userRows: OwnerUserRow[] = Array.isArray(users) ? users : [];\n\n  const authenticableUserIds = new Set(\n    userRows\n      .filter((row) => isAdministrativelyUsableOwnerUserStatus(row?.status))\n      .map((row) => String(row?._id)),\n  );\n\n  return membershipRows\n    .filter((row) => authenticableUserIds.has(String(row.userId)))\n    .map((row) => String(row._id));\n}\n\n/** One organization whose floor a write would breach. */\nexport type OrganizationOwnerFloorBreach = {\n  organizationId: string;\n  /** The usable-owner memberships the write removes from this organization's population. */\n  reducedMemberIds: string[];\n  remainingUsableOwners: number;\n};\n\n/**\n * Evaluate the floor for ONE organization without throwing.\n *\n * Returns the breach when the write would drop the organization below the minimum, and `undefined`\n * when it would not — including every case where the floor does not apply at all: an organization in\n * a terminal state, and a write whose subjects were not counting toward the population anyway.\n *\n * An organization that reads back as `null` is treated as unprotected: there is no tenant left to\n * leave ownerless, and refusing would block the cleanup of orphaned memberships. A read that THROWS\n * propagates instead — an unresolvable organization is not evidence that the write is safe.\n */\nexport async function evaluateOrganizationOwnerFloor(params: {\n  organizationId: string;\n  /** Threaded so the serialization bump joins the caller's transaction rather than racing it. */\n  serviceOptions?: unknown;\n  /** The membership rows about to stop counting, by `_id`. */\n  reducedMemberIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<OrganizationOwnerFloorBreach | undefined> {\n  const { organizationId, reducedMemberIds, executionContext } = params;\n\n  const organizationRepository = requireRepository(CoreResourceType.ORGANIZATIONS, params);\n  const organization = await organizationRepository.read<Pick<Organization, 'status' | 'deletionRequestedAt' | 'ownerFloorSerializationToken'>>(\n    executionContext,\n    organizationId,\n  );\n\n  if (!organizationRequiresOwnerFloor(organization)) return undefined;\n\n  // ── Serialize this decision against every other owner-reducing decision on the same tenant ──\n  //\n  // Bumped BEFORE the measurement, so the conflict window covers the whole check-then-act rather\n  // than just the write at the end. Two concurrent transactions that both reach this line touch the\n  // same organization document, and the storage engine aborts the loser — which is the only way to\n  // stop the write skew that a count-based guard is otherwise open to (two callers each removing a\n  // DIFFERENT owner, each observing the other still present, both committing, zero owners left).\n  //\n  // Deliberately not conditional on `serviceOptions.transaction`: the write is harmless without one,\n  // and making it conditional would mean the protection silently disappears on any path that forgot\n  // to open a transaction — exactly the class of gap this floor keeps finding. See\n  // `ownerFloorSerializationToken` on the organization schema for the rejected alternatives.\n  //\n  // assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — serialize concurrent reductions of a\n  // tenant's administrative population.\n  // A read-modify-write rather than `$inc`: the repository tier takes a field payload, not raw\n  // storage operators. The VALUE is irrelevant — nothing reads it — so a lost update here costs\n  // nothing. What matters is that the document is written at all, which is what two concurrent\n  // transactions collide on.\n  //\n  // `preserveServerInjectedFields` is required, not optional: the field is `.excludeFromUpdate()`\n  // and `.isBackendOnly()`, so the repository's strict request-DTO re-parse strips it and the write\n  // silently becomes a no-op — the serialization would look wired and protect nothing. (It did,\n  // first attempt: the token stayed at 0 and the pin caught it.)\n  await organizationRepository.update(\n    executionContext,\n    organizationId,\n    { ownerFloorSerializationToken: ((organization as { ownerFloorSerializationToken?: number } | null)?.ownerFloorSerializationToken ?? 0) + 1 },\n    {\n      ...((params as { serviceOptions?: Record<string, unknown> }).serviceOptions ?? {}),\n      preserveServerInjectedFields: ['ownerFloorSerializationToken'],\n    } as never,\n  );\n\n  const usableOwnerMemberIds = await measureUsableOrganizationOwners(params);\n\n  const reducedMemberIdSet = new Set(reducedMemberIds.map((memberId) => String(memberId)));\n  const reducedUsableMemberIds = usableOwnerMemberIds.filter((memberId) => reducedMemberIdSet.has(memberId));\n\n  // The subjects contribute nothing to this organization's population — most often because the\n  // linked user cannot authenticate, which the cheap short-circuits upstream cannot see. Removing\n  // them reduces nothing, so there is no floor question to answer.\n  if (reducedUsableMemberIds.length === 0) return undefined;\n\n  const remainingUsableOwners = usableOwnerMemberIds.length - reducedUsableMemberIds.length;\n  if (remainingUsableOwners >= ORGANIZATION_OWNER_FLOOR_MINIMUM) return undefined;\n\n  return { organizationId, reducedMemberIds: reducedUsableMemberIds, remainingUsableOwners };\n}\n\n/**\n * Refuse a write that would leave one or more organizations without an administratively usable\n * owner.\n *\n * Takes every breach at once rather than throwing on the first: a single subject erasure can strand\n * several tenants, and an operator who has to discover them one failed attempt at a time cannot plan\n * the remediation. The refusal names all of them.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — refuse the removal of a\n * tenant's last accountable administrative principal; the denial is an access-control decision and\n * is recorded as one by the operation's own error path.\n */\nexport function throwOrganizationOwnerFloorRefusal(params: {\n  breaches: readonly OrganizationOwnerFloorBreach[];\n  cause: OrganizationOwnerFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): never {\n  const { breaches, cause, executionContext, errorBuilder, conferringRoles, operationIdentifier } = params;\n\n  const organizationIds = breaches.map((breach) => breach.organizationId);\n\n  // CONFLICT, not AUTHORIZATION and not VALIDATION. The request is well-formed and the caller IS\n  // authorized — every one of these operations is gated on a role the protected one confers. What\n  // forbids the write is the current STATE of the organization, which is what CONFLICT means. A 403\n  // would tell an administrator to acquire authority they already hold (and none exists that lifts\n  // this floor, since `ORGANIZATION_MEMBERS` has no super-admin variant); a 400 would tell them to\n  // fix a payload that is correct.\n  throw errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n    context: {\n      // The WIRE contract — allow-listed by `sanitizeErrorForClient`, so this is what a client\n      // switches on. `reason` below is the internal audit/log filter handle and is stripped at the\n      // boundary; the two are different contracts and must not be conflated.\n      code: AdministrativeContinuityErrorCode.LAST_ORGANIZATION_OWNER,\n      reason: ORGANIZATION_OWNER_FLOOR_REFUSAL_REASON,\n      message:\n        `Refused: this would leave ${organizationIds.length === 1 ? 'an organization' : `${organizationIds.length} organizations`} `\n        + 'with no usable owner. ' + ORGANIZATION_OWNER_FLOOR_REMEDY,\n      cause,\n      operationIdentifier,\n      organizationIds,\n      breaches: breaches.map((breach) => ({\n        organizationId: breach.organizationId,\n        reducedMemberIds: [...breach.reducedMemberIds],\n        remainingUsableOwners: breach.remainingUsableOwners,\n      })),\n      requiredUsableOwners: ORGANIZATION_OWNER_FLOOR_MINIMUM,\n      conferringRoles: [...conferringRoles],\n      usableMembershipStatuses: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES],\n      usableOwnerUserStatuses: [...ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES],\n    },\n  });\n}\n\n/**\n * The floor check for a write that removes one organization's memberships from the population —\n * a membership DELETE, or a role/status transition that has already been shown to reduce.\n */\nexport async function assertOrganizationOwnerFloorPreserved(params: {\n  organizationId: string;\n  reducedMemberIds: readonly string[];\n  cause: OrganizationOwnerFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const breach = await evaluateOrganizationOwnerFloor(params);\n  if (!breach) return;\n\n  throwOrganizationOwnerFloorRefusal({ ...params, breaches: [breach] });\n}\n\n/**\n * Whether a role/status transition could possibly reduce the owner population.\n *\n * The short-circuit of {@link assertOrganizationOwnerFloorPreservedForTransition}, extracted so a\n * caller can ask the question BEFORE paying for the machinery the assertion needs — building a\n * system execution context is a registry lookup plus a possible application-id resolution, and the\n * common membership edit is one that changes no authority at all.\n *\n * Exported for that reason ONLY, and consumed by the assertion itself so there is exactly one\n * implementation of the rule. A caller that re-derived this test would be the drift.\n *\n * Reads only the two axes carried on the membership row. The linked user's status is deliberately\n * NOT consulted: it costs the very query this predicate exists to avoid, and a membership whose user\n * cannot authenticate simply reaches the measurement, which then correctly finds it was never\n * counting. Answering \"could reduce\" too generously is the safe direction — it buys a query, not a\n * wrong verdict.\n */\nexport function membershipTransitionCouldReduceOwners(params: {\n  previousRoles: unknown;\n  previousStatus: unknown;\n  nextRoles: unknown;\n  nextStatus: unknown;\n  conferringRoles: readonly string[];\n}): boolean {\n  const { previousRoles, previousStatus, nextRoles, nextStatus, conferringRoles } = params;\n\n  const conferredBefore = rolesConferOrganizationOwner(previousRoles, conferringRoles)\n    && isAdministrativelyUsableMembershipStatus(previousStatus);\n  if (!conferredBefore) return false;\n\n  return !(rolesConferOrganizationOwner(nextRoles, conferringRoles)\n    && isAdministrativelyUsableMembershipStatus(nextStatus));\n}\n\n/**\n * The floor check for a role/status TRANSITION on a single membership.\n *\n * Encapsulates the short-circuit that keeps the population queries off the hot path: the floor can\n * only be threatened when the membership conferred ownership BEFORE the write and would not AFTER\n * it. An ordinary member edit, or an edit that leaves the owner grant intact, costs two set\n * membership tests and no I/O.\n *\n * That shape is also why a purely additive caller can invoke this unconditionally — a write that\n * still confers owner always short-circuits — which removes the standing invitation for a future\n * change to the set algebra to bypass the floor unnoticed.\n *\n * Note the deliberate asymmetry with {@link evaluateOrganizationOwnerFloor}: the short-circuit here\n * reads only the two axes carried on the membership row, because consulting the linked user's status\n * would cost the very query the short-circuit exists to avoid. A membership whose user cannot\n * authenticate therefore reaches the measurement, which then correctly finds it was never counting\n * and returns no breach.\n */\nexport async function assertOrganizationOwnerFloorPreservedForTransition(params: {\n  memberId: string;\n  organizationId: string;\n  previousRoles: unknown;\n  previousStatus: unknown;\n  nextRoles: unknown;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const { memberId, nextRoles, conferringRoles } = params;\n\n  if (!membershipTransitionCouldReduceOwners(params)) return;\n\n  const stillConfersRole = rolesConferOrganizationOwner(nextRoles, conferringRoles);\n\n  await assertOrganizationOwnerFloorPreserved({\n    ...params,\n    reducedMemberIds: [memberId],\n    // Which axis actually broke it. Role removal is named first when BOTH change in one write: it is\n    // the axis the operator authored against the authority field, and the more specific finding.\n    cause: !stillConfersRole\n      ? OrganizationOwnerFloorReductionCause.ROLE_REMOVAL\n      : OrganizationOwnerFloorReductionCause.MEMBERSHIP_STATUS_CHANGE,\n  });\n}\n\n/**\n * The floor check for a write that removes membership rows wholesale.\n *\n * Takes the memberships' CURRENT rows rather than a transition: there is no \"after\" state to\n * compare, the rows simply stop counting. Memberships that confer no ownership are filtered out\n * first, so removing a hundred ordinary members never touches the population queries.\n *\n * Generic over several organizations because the erasure path needs that; a membership DELETE passes\n * a single row and pays for exactly one organization.\n */\nexport async function assertOrganizationOwnerFloorPreservedForRemoval(params: {\n  memberships: readonly (OwnerMembershipRow | undefined | null)[];\n  cause: OrganizationOwnerFloorReductionCause;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<void> {\n  const { memberships, conferringRoles } = params;\n\n  // Group the owner-conferring rows by tenant: one organization's population is measured once even\n  // when an erasure retires several of its memberships at the same instant.\n  const reducedMemberIdsByOrganization = new Map<string, string[]>();\n  for (const membership of memberships) {\n    if (!isOwnerConferringMembership(membership, conferringRoles)) continue;\n    const organizationId = typeof membership!.organizationId === 'string' ? membership!.organizationId : undefined;\n    // A membership with no resolvable tenant cannot be attributed to a population, and inventing one\n    // would measure the wrong organization. It contributes nothing rather than being guessed at.\n    if (!organizationId) continue;\n\n    const reducedMemberIds = reducedMemberIdsByOrganization.get(organizationId) ?? [];\n    reducedMemberIds.push(String(membership!._id));\n    reducedMemberIdsByOrganization.set(organizationId, reducedMemberIds);\n  }\n\n  if (reducedMemberIdsByOrganization.size === 0) return;\n\n  const breaches: OrganizationOwnerFloorBreach[] = [];\n  for (const [organizationId, reducedMemberIds] of reducedMemberIdsByOrganization) {\n    const breach = await evaluateOrganizationOwnerFloor({ ...params, organizationId, reducedMemberIds });\n    if (breach) breaches.push(breach);\n  }\n\n  if (breaches.length === 0) return;\n\n  throwOrganizationOwnerFloorRefusal({ ...params, breaches });\n}\n\n/**\n * The resource types whose erasure retires a principal's organization memberships, and therefore the\n * subject types whose erasure can breach the floor.\n *\n * `USERS` and `USER_SELF` are two resource configurations over the SAME collection (see\n * `getCollectionNameForResource`), both declaring `RETAIN_AND_IMPERSONALIZE`, so an erasure\n * addressed through either door scrubs and hides the same principal.\n *\n * `ORGANIZATION_MEMBERS` is deliberately absent: it declares no `retentionPolicy`, so there is no\n * subject-erasure door onto a membership row. Should it ever gain one, this list is where that\n * becomes a floor question.\n */\nexport const ORGANIZATION_OWNER_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES: readonly string[] = [\n  CoreResourceType.USERS,\n  CoreResourceType.USER_SELF,\n];\n\n/** Whether an erasure of this subject resource type can reduce an organization-owner population. */\nexport function isOrganizationOwnerFloorGovernedSubjectResource(resourceType: unknown): boolean {\n  return ORGANIZATION_OWNER_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES.includes(String(resourceType));\n}\n\n/**\n * The resource types whose rows CARRY the organization authority axis — i.e. the rows a direct\n * `roles` or `status` write can move in or out of the owner population.\n *\n * A DIFFERENT question from {@link ORGANIZATION_OWNER_FLOOR_GOVERNED_SUBJECT_RESOURCE_TYPES}, and the\n * two lists are deliberately disjoint. That one names the ERASURE SUBJECTS whose scrub retires the\n * memberships they hold (`USERS` / `USER_SELF`); this one names the rows that hold the authority\n * itself. Conflating them would ask a generic write path to guard the wrong population.\n *\n * `ORGANIZATION_UNIT_MEMBERS` is absent for the reason the module header gives: a unit assignment\n * reaches `initiatorRoles` as a NARROWED entry and confers authority inside one unit only, so it\n * never counted toward this population and moving it cannot reduce it.\n */\nexport const ORGANIZATION_OWNER_FLOOR_AUTHORITY_BEARING_RESOURCE_TYPES: readonly string[] = [\n  CoreResourceType.ORGANIZATION_MEMBERS,\n];\n\n/**\n * Whether a direct `roles`/`status` write on this resource type can reduce an organization-owner\n * population — the question a GENERIC write path (a shared lifecycle-verb implementation) must ask\n * before deciding whether this floor governs the row it is about to change.\n */\nexport function isOrganizationOwnerFloorAuthorityBearingResource(resourceType: unknown): boolean {\n  return ORGANIZATION_OWNER_FLOOR_AUTHORITY_BEARING_RESOURCE_TYPES.includes(String(resourceType));\n}\n\n/**\n * Read the owner-conferring memberships held by the users an erasure is about to scrub.\n *\n * Reads through the repository so the retention hide applies: a subject ALREADY erased contributes\n * no visible membership here, which is correct — it stopped counting at its own erasure, and a\n * re-run must not be refused on account of authority that no longer exists.\n *\n * The filter selects only owner-conferring `ACTIVE` memberships, so a user who belongs to fifty\n * organizations as an ordinary member costs one indexed query returning nothing.\n */\nexport async function readOwnerMembershipsForSubjects(params: {\n  subjectUserIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n}): Promise<OwnerMembershipRow[]> {\n  const { subjectUserIds, executionContext, conferringRoles } = params;\n\n  if (subjectUserIds.length === 0) return [];\n\n  const membershipRepository = requireRepository(CoreResourceType.ORGANIZATION_MEMBERS, params);\n\n  const memberships = await membershipRepository.list<OwnerMembershipRow>(executionContext, {\n    userId: { $in: [...subjectUserIds] },\n    roles: { $in: [...conferringRoles] },\n    status: { $in: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES] },\n  });\n\n  return Array.isArray(memberships) ? memberships : [];\n}\n\n/**\n * Refuse a subject erasure that would leave any protected organization without a usable owner.\n *\n * The cross-scope case, and the one with no application-scope analogue: erasing ONE user can strand\n * SEVERAL tenants at once, so the check fans out over every organization the subject owns and the\n * refusal names all of them.\n *\n * No `INTERNALLY_INITIATED_REQUEST` bypass, deliberately — a system write strands a tenant exactly\n * as a human one does. The remedy the refusal names (appoint another owner, then erase) satisfies\n * both obligations at once, and is the path the caller should normally take.\n *\n * ## Why the refusal is DEFEASIBLE here, unlike every other door this floor guards\n *\n * Revised 2026-08-05 after checking the invariant against external standards. The administrative\n * doors (role change, membership removal, suspension) refuse unconditionally, and that matches the\n * industry norm exactly — Slack will not let the Primary Owner be deactivated, GitHub will not let\n * the last owner leave. Nobody has a *right* to have their membership removed.\n *\n * A data-subject ERASURE is not that. GDPR Art. 17(3) lists the grounds on which erasure may be\n * refused — legal obligation, public interest, public health, archiving/research, legal claims — and\n * \"the tenant would become unadministrable\" is not among them; Art. 12(3) additionally requires an\n * answer without undue delay (read as one month). An indefinite refusal on availability grounds is\n * therefore a posture the framework must not impose on every application built on it, because the\n * application is the controller that owes the data subject that answer.\n *\n * Hence: refuse BY DEFAULT (so the safe path is the default and stranding is never accidental), but\n * let the controller proceed deliberately via {@link acknowledgeOwnerFloorBreach}, which records a\n * CRITICAL event per stranded tenant instead of throwing. That shape is also what NIST SP 800-53\n * asks of an emergency path: AC-2 contemplates emergency access that bypasses normal authorization\n * *with management oversight*, and AC-2(7) requires privileged changes to be monitored — an audited,\n * per-request, non-default override is precisely that, and precisely not a standing bypass.\n *\n * The industry pattern is two-part — block at the tenant tier, repair from a higher one (GitHub: an\n * Enterprise owner re-owns the org; otherwise Support). Wildo has BOTH halves: the block is here, and\n * the repair door is `organizationMembers.grantOwnership`, a platform-tier verb that promotes an\n * existing member, writes only `roles`, additively, and is audited at CRITICAL with a mandatory\n * justification. An acknowledged breach therefore leaves a tenant that cannot administer ITSELF, and\n * that a platform operator can repair without an out-of-band write.\n *\n * ⚠️ The default still stays refuse. A repair door is an escalation someone has to notice and\n * perform; it is not a reason to strand a tenant casually, and the tenant-tier answer remains\n * \"transfer ownership first\".\n */\nexport async function assertOrganizationOwnerFloorForSubjectErasure(params: {\n  subjectUserIds: readonly string[];\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n  /**\n   * The CONTROLLER's explicit decision to complete an erasure that strands a tenant.\n   *\n   * Absent (the default), a stranding erasure is refused and the refusal names the remedy. Present,\n   * the erasure proceeds and every breached tenant is reported to {@link onAcknowledgedBreach} for a\n   * CRITICAL audit record. It is deliberately a parameter and not a config flag: this is a per-request\n   * decision by the party that owes the data subject an answer, not a deployment-wide posture.\n   */\n  acknowledgeOwnerFloorBreach?: boolean;\n  /** Invoked once per stranded tenant when the breach is acknowledged. Never on the refusal path. */\n  onAcknowledgedBreach?: (breach: OrganizationOwnerFloorBreach) => Promise<void> | void;\n}): Promise<void> {\n  const memberships = await readOwnerMembershipsForSubjects(params);\n  if (memberships.length === 0) return;\n\n  if (!params.acknowledgeOwnerFloorBreach) {\n    await assertOrganizationOwnerFloorPreservedForRemoval({\n      ...params,\n      memberships,\n      cause: OrganizationOwnerFloorReductionCause.SUBJECT_ERASURE,\n    });\n    return;\n  }\n\n  // ── Acknowledged: proceed, but make the consequence loud and attributable ──\n  // Nothing is refused here, so the only obligation left is that the resulting ownerless tenant is\n  // never silent. The same evaluation runs; its verdicts become records instead of a throw.\n  const breachesByOrganization = new Map<string, string[]>();\n  for (const membership of memberships) {\n    if (!isOwnerConferringMembership(membership, params.conferringRoles)) continue;\n    const organizationId = typeof membership.organizationId === 'string' ? membership.organizationId : undefined;\n    if (!organizationId) continue;\n    const reduced = breachesByOrganization.get(organizationId) ?? [];\n    reduced.push(String(membership._id));\n    breachesByOrganization.set(organizationId, reduced);\n  }\n\n  for (const [organizationId, reducedMemberIds] of breachesByOrganization) {\n    const breach = await evaluateOrganizationOwnerFloor({ ...params, organizationId, reducedMemberIds });\n    if (breach) await params.onAcknowledgedBreach?.(breach);\n  }\n}\n\n/**\n * The operation identifier the floor reports when it is measuring rather than guarding a named verb.\n *\n * Exported so call sites that have no verb of their own (the erasure guard) share one spelling with\n * the tests that pin it.\n */\nexport const ORGANIZATION_OWNER_FLOOR_MEASUREMENT_OPERATION: string = CoreResourceOperation.LIST;\n\n/** One protected organization that has no administratively usable owner. */\nexport type OwnerlessOrganization = { organizationId: string; organizationName?: string };\n\n/**\n * Measure — without refusing anything — which protected organizations have NO usable owner.\n *\n * The boot-time report, and the only surface that observes states no write guard ever saw: a direct\n * database edit, a restore from a backup taken mid-erasure, a seed that authored no owner, or a\n * role-table reconfiguration that changed which roles confer ownership out from under an existing\n * population.\n *\n * ## Cost, stated rather than hidden\n *\n * THREE queries total, independent of tenant count — not one per organization. Owner-conferring\n * ACTIVE memberships are listed once across all tenants, their users are read once by id, and the\n * protected organizations are listed once; the join happens in memory. The only unavoidable\n * O(tenants) part is materialising the organization list, because an organization with ZERO owner\n * rows is exactly the case being looked for and cannot be found from the membership side.\n *\n * That asymmetry is why this ships as a report and not as a write guard: it answers a question about\n * every tenant at once, which no per-write path should ever pay for.\n */\n/**\n * Which organizations would lose their last usable owner because THIS USER stops being usable.\n *\n * ## Reports. Never refuses. That asymmetry is the decision, not an oversight.\n *\n * Every other surface of this floor refuses, and the rule that governs them says administrative\n * doors refuse unconditionally. Deactivating a USER is the one case where that answer is wrong.\n *\n * The membership doors take away authority someone HAS; refusing costs the caller a transfer step\n * and nothing else. Suspending a user account is overwhelmingly an INCIDENT RESPONSE — the account\n * is compromised, or the person has just left — and refusing it would mean an operator cannot lock\n * out a hostile owner without first performing an ownership transfer, in the middle of an incident,\n * using the very tenant the attacker controls. That trade is backwards: a stranded tenant is\n * recoverable (the boot report finds it, `organizationMembers.grantOwnership` repairs it), while a\n * live compromised owner is not recoverable at all.\n *\n * So the containment action always proceeds and the consequence is made LOUD instead of prevented —\n * the same shape the erasure path uses for its acknowledged breach, and what NIST SP 800-53 `AC-2`\n * asks of emergency access: not blocked, but monitored.\n *\n * The caller supplies the reporter, so this module owns the MEASUREMENT and the call site owns the\n * channel (audit, SIEM, log). Passing no reporter makes this a pure measurement, which is what the\n * tests use.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — record, without blocking, a\n * containment action that leaves a tenant unadministrable.\n */\nexport async function reportOrganizationsStrandedByUserDeactivation(params: {\n  subjectUserId: string;\n  /** The status the account is moving to. A still-usable status strands nobody and short-circuits. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n  operationIdentifier: string;\n  report?: (breach: OrganizationOwnerFloorBreach) => Promise<void> | void;\n}): Promise<OrganizationOwnerFloorBreach[]> {\n  // Costs nothing on the overwhelmingly common path: reactivations and any transition that leaves the\n  // account usable cannot reduce an owner population, so no query is issued.\n  if (isAdministrativelyUsableOwnerUserStatus(params.nextStatus)) return [];\n\n  const memberships = await readOwnerMembershipsForSubjects({ ...params, subjectUserIds: [params.subjectUserId] });\n  if (memberships.length === 0) return [];\n\n  const breaches: OrganizationOwnerFloorBreach[] = [];\n  for (const membership of memberships) {\n    const organizationId = typeof membership?.organizationId === 'string' ? membership.organizationId : undefined;\n    if (!organizationId) continue;\n    const breach = await evaluateOrganizationOwnerFloor({\n      ...params,\n      organizationId,\n      reducedMemberIds: [String(membership._id)],\n    });\n    if (breach) breaches.push(breach);\n  }\n\n  for (const breach of breaches) await params.report?.(breach);\n  return breaches;\n}\n\n/**\n * The rows of a repository LIST, whatever shape it returned — and a LOUD refusal if it returned\n * neither.\n *\n * This replaces `Array.isArray(result) ? result : []`, which appeared at THREE reads inside the boot\n * report and was a silent shape-assumption at each. `list` answers a bare array on the\n * non-paginated path and a `{ data, pagination }` envelope otherwise, so the guard was one\n * pagination decision away from being wrong — and the three sites failed in DIFFERENT directions,\n * which is why nobody noticed:\n *\n * - **organizations** → `[]` means \"no protected tenants\", so the report returns\n *   `ownerlessOrganizations: []` and declares the estate healthy. **Fail-OPEN, in the one function\n *   whose entire purpose is to catch what the write guards missed.** That is the worst possible\n *   wrong answer here: silence is indistinguishable from a clean bill of health.\n * - **memberships** / **users** → `[]` makes every tenant look ownerless. Noisy, but fail-CLOSED.\n *\n * A diagnostic that cannot parse its own read must say so. `administrative-continuity-floors.md`\n * documents this report as \"the backstop for exactly the ordering and wrong-resource gaps the\n * guards structurally cannot cover\"; a backstop that answers \"nothing to see\" when it did not\n * understand the answer is not a backstop, and the failure is invisible by construction.\n */\nfunction readListRows<TRow>(\n  result: unknown,\n  source: string,\n  params: { errorBuilder: ErrorBuilderBackendService; executionContext: ExecutionContext<any> },\n): TRow[] {\n  if (Array.isArray(result)) return result as TRow[];\n  const envelope = (result ?? undefined) as { data?: unknown } | undefined;\n  if (envelope && Array.isArray(envelope.data)) return envelope.data as TRow[];\n\n  throw params.errorBuilder.buildError(ErrorType.CONFIGURATION, params.executionContext, {\n    context: {\n      reason: 'owner_floor_report_unreadable_list_result',\n      message:\n        `The organization-owner floor report could not read its ${source} query result. It is the `\n        + 'backstop for states no write guard evaluated, so an unreadable read must fail loudly '\n        + 'rather than report an empty, healthy-looking estate.',\n      source,\n      receivedType: result === null ? 'null' : typeof result,\n    },\n  });\n}\n\nexport async function measureOrganizationsMissingUsableOwner(params: {\n  /**\n   * The report OWNS the context it measures through — it does not accept a caller's. Building it from\n   * the factory (super-admin @ APPLICATION, `INTERNALLY_INITIATED_REQUEST`) is what makes this a\n   * backstop nobody has to remember to configure. See the block comment below for the failure this\n   * removes.\n   */\n  authExecutionContextFactory: AuthExecutionContextFactoryBackendService;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  conferringRoles: readonly string[];\n}): Promise<{\n  protectedOrganizationCount: number;\n  ownerlessOrganizations: OwnerlessOrganization[];\n  /** Tenants one lifecycle event away from being unadministrable — the preventive signal. */\n  singleOwnerOrganizations: OwnerlessOrganization[];\n}> {\n  const { conferringRoles } = params;\n  const operationIdentifier = ORGANIZATION_OWNER_FLOOR_MEASUREMENT_OPERATION;\n\n  // ── The report builds and OWNS its measuring context; it never trusts a caller's. ──────────────\n  //\n  // A whole-estate backstop must read EVERY tenant system-wide, which is not a caller-tunable scope.\n  // The `INTERNALLY_INITIATED_REQUEST` context this builds is EXEMPT from scope-root collection\n  // confinement (`assignScopeRootCollectionConfinementToFilter`'s exempt execution types), so the\n  // ORGANIZATIONS scope-root LIST returns every tenant rather than only the caller's own.\n  //\n  // A caller-supplied context defeated exactly this. A role-less context, OR one carrying the wrong\n  // execution-type string (the integration harness passed `'internal_call'`, which is NOT the enum\n  // value `'internally_initiated_request'`), is not recognised as internal, so the scope-root read is\n  // confined to the caller's org ids — none — and compiles to `{_id: {$in: []}}`. The backstop then\n  // returned `ownerlessOrganizations: []`, indistinguishable from a healthy estate. Owning the context\n  // removes the whole class of caller error, and brings the report into line with the invariant its own\n  // {@link createOrganizationOwnerFloorPopulationContext} doc already states for the write-path guards.\n  const executionContext = await createOrganizationOwnerFloorPopulationContext(params.authExecutionContextFactory);\n  const reads = {\n    repositoriesRegistry: params.repositoriesRegistry,\n    errorBuilder: params.errorBuilder,\n    executionContext,\n    operationIdentifier,\n  };\n\n  const organizationRepository = requireRepository(CoreResourceType.ORGANIZATIONS, reads);\n  const membershipRepository = requireRepository(CoreResourceType.ORGANIZATION_MEMBERS, reads);\n\n  // Fetch EVERY organization and classify in memory with the fail-closed predicate. The former\n  // `{ status: { $in: <protected> } }` query was the SECOND way an ownerless tenant escaped this\n  // backstop: an out-of-vocabulary status (the platform seed's 'active') matched no `$in` member and\n  // was dropped before {@link organizationRequiresOwnerFloor} could protect it. Materialising the org\n  // list is the report's one unavoidable O(tenants) cost (reasoned about on the type doc above); a\n  // terminal row is discarded by the predicate, never by a query a wrong status can slip past.\n  // `deletionRequestedAt` is likewise filtered in memory — \"field absent\" has no portable cross-adapter\n  // spelling, and the authority already owns that predicate.\n  const organizations = await organizationRepository.list<Pick<Organization, '_id' | 'name' | 'status' | 'deletionRequestedAt'>>(\n    executionContext,\n    {},\n  );\n  const protectedOrganizations = readListRows<Pick<Organization, '_id' | 'name' | 'status' | 'deletionRequestedAt'>>(\n    organizations, 'organizations', reads,\n  ).filter((organization) => organizationRequiresOwnerFloor(organization));\n\n  if (protectedOrganizations.length === 0) {\n    return { protectedOrganizationCount: 0, ownerlessOrganizations: [], singleOwnerOrganizations: [] };\n  }\n\n  const memberships = await membershipRepository.list<OwnerMembershipRow>(executionContext, {\n    roles: { $in: [...conferringRoles] },\n    status: { $in: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES] },\n  });\n  const ownerMemberships: OwnerMembershipRow[] = readListRows<OwnerMembershipRow>(memberships, 'organization-members', reads);\n\n  const ownerUserIds = [...new Set(\n    ownerMemberships\n      .map((row) => (typeof row?.userId === 'string' ? row.userId : undefined))\n      .filter((userId): userId is string => userId !== undefined && userId.length > 0),\n  )];\n\n  const authenticableUserIds = new Set<string>();\n  if (ownerUserIds.length > 0) {\n    const userRepository = requireRepository(CoreResourceType.USERS, reads);\n    const users = await userRepository.list<OwnerUserRow>(executionContext, ownerUserIds);\n    for (const user of readListRows<OwnerUserRow>(users, 'users', reads)) {\n      if (isAdministrativelyUsableOwnerUserStatus(user?.status)) authenticableUserIds.add(String(user?._id));\n    }\n  }\n\n  // Counted, not just set-membership: a tenant with exactly ONE usable owner is one resignation, one\n  // suspension, or one lost password away from being unadministrable, and it is the population the\n  // floor will REFUSE to help — every removal there returns 409 until someone grants a second owner.\n  // Surfacing it at boot is the only PREVENTIVE half this floor has; everything else is cure.\n  const usableOwnerCountByOrganization = new Map<string, number>();\n  for (const row of ownerMemberships) {\n    if (!authenticableUserIds.has(String(row.userId))) continue;\n    const organizationId = String(row.organizationId);\n    usableOwnerCountByOrganization.set(organizationId, (usableOwnerCountByOrganization.get(organizationId) ?? 0) + 1);\n  }\n\n  const describe = (organization: { _id?: unknown; name?: unknown }): OwnerlessOrganization => ({\n    organizationId: String(organization._id),\n    ...(typeof organization.name === 'string' ? { organizationName: organization.name } : {}),\n  });\n\n  return {\n    protectedOrganizationCount: protectedOrganizations.length,\n    ownerlessOrganizations: protectedOrganizations\n      .filter((organization) => (usableOwnerCountByOrganization.get(String(organization._id)) ?? 0) === 0)\n      .map(describe),\n    singleOwnerOrganizations: protectedOrganizations\n      .filter((organization) => usableOwnerCountByOrganization.get(String(organization._id)) === 1)\n      .map(describe),\n  };\n}\n"]}

package/dist/esm/security/authorizations/organization-unit-narrowing-enforcement.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-unit-narrowing-enforcement.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/organization-unit-narrowing-enforcement.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAG/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,kDAAkD,EAAE,SAAS,8BAA8B,EAGvG,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mDAAmD,EAAE,SAAS,qBAAqB,EAG/F,CAAC;AAEF,iEAAiE;AACjE,oBAAY,wCAAwC;IAClD,6EAA6E;IAC7E,cAAc,mBAAmB;IACjC;yDACqD;IACrD,YAAY,iBAAiB;IAC7B,6CAA6C;IAC7C,iBAAiB,sBAAsB;IACvC,uCAAuC;IACvC,QAAQ,aAAa;CACtB;AAED,iGAAiG;AACjG,oBAAY,mCAAmC;IAC7C,gGAAgG;IAChG,yBAAyB,8BAA8B;IACvD,oFAAoF;IACpF,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C,sGAAsG;IACtG,mBAAmB,wBAAwB;CAC5C;AAED,MAAM,MAAM,oCAAoC,GAC5C;IAAE,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC,cAAc,CAAA;CAAE,GAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC,YAAY,CAAA;CAAE,GACxE;IACE,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC,iBAAiB,CAAC;IAC1E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC,QAAQ,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC;CACtD,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,aAAa,EAAE,8BAA8B,CAAC;IACvD,iCAAiC,CAAC,YAAY,EAAE,MAAM,GAAG,8BAA8B,GAAG,SAAS,CAAC;CACrG;AAED,gFAAgF;AAChF,wBAAgB,0CAA0C,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAEjH;AAED;;;;;GAKG;AACH,wBAAgB,2CAA2C,CACzD,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAAG,SAAS,EACtG,gBAAgB,EAAE,wCAAwC,GACzD,oCAAoC,CAqDtC;AAOD;;;;;;;;;GASG;AACH,wBAAgB,4CAA4C,CAC1D,aAAa,EAAE,MAAM,EACrB,mBAAmB,EAAE,SAAS,MAAM,EAAE,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uCAAuC,CAAC,OAAO,SAAS,MAAM,EAC5E,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAAG,SAAS,EACtG,gBAAgB,EAAE,wCAAwC,GACzD,oCAAoC,CAmBtC;AAMD,qDAAqD;AACrD,oBAAY,6CAA6C;IACvD,kEAAkE;IAClE,kBAAkB,uBAAuB;IACzC;;;;;;OAMG;IACH,kBAAkB,uBAAuB;IACzC,uEAAuE;IACvE,cAAc,mBAAmB;IACjC;;;;;;;;;;;OAWG;IACH,mBAAmB,wBAAwB;CAC5C;AAED,MAAM,MAAM,uCAAuC,GAAG;IACpD,QAAQ,CAAC,MAAM,EAAE,6CAA6C,CAAC;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,8CAA8C;IAC9C,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,8CAA8C,CAC5D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACnD,qBAAqB,EAAE,qBAAqB,EAC5C,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAAG,SAAS,EACtG,gBAAgB,EAAE,wCAAwC,GACzD,uCAAuC,GAAG,SAAS,CAiErD;AAED;;;;;;;;GAQG;AACH,wBAAgB,+CAA+C,CAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACnD,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAAG,SAAS,GACrG,MAAM,GAAG,SAAS,CAOpB"}
+{"version":3,"file":"organization-unit-narrowing-enforcement.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/organization-unit-narrowing-enforcement.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAG/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,kDAAkD,EAAE,SAAS,8BAA8B,EAGvG,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mDAAmD,EAAE,SAAS,qBAAqB,EAG/F,CAAC;AAEF,iEAAiE;AACjE,oBAAY,wCAAwC;IAClD,6EAA6E;IAC7E,cAAc,mBAAmB;IACjC;yDACqD;IACrD,YAAY,iBAAiB;IAC7B,6CAA6C;IAC7C,iBAAiB,sBAAsB;IACvC,uCAAuC;IACvC,QAAQ,aAAa;CACtB;AAED,iGAAiG;AACjG,oBAAY,mCAAmC;IAC7C,gGAAgG;IAChG,yBAAyB,8BAA8B;IACvD,oFAAoF;IACpF,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C,sGAAsG;IACtG,mBAAmB,wBAAwB;CAC5C;AAED,MAAM,MAAM,oCAAoC,GAC5C;IAAE,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC,cAAc,CAAA;CAAE,GAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC,YAAY,CAAA;CAAE,GACxE;IACE,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC,iBAAiB,CAAC;IAC1E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC,QAAQ,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC;CACtD,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,aAAa,EAAE,8BAA8B,CAAC;IACvD,iCAAiC,CAAC,YAAY,EAAE,MAAM,GAAG,8BAA8B,GAAG,SAAS,CAAC;CACrG;AAED,gFAAgF;AAChF,wBAAgB,0CAA0C,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAEjH;AAED;;;;;GAKG;AACH,wBAAgB,2CAA2C,CACzD,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAAG,SAAS,EACtG,gBAAgB,EAAE,wCAAwC,GACzD,oCAAoC,CAqDtC;AAOD;;;;;;;;;GASG;AACH,wBAAgB,4CAA4C,CAC1D,aAAa,EAAE,MAAM,EACrB,mBAAmB,EAAE,SAAS,MAAM,EAAE,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uCAAuC,CAAC,OAAO,SAAS,MAAM,EAC5E,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAAG,SAAS,EACtG,gBAAgB,EAAE,wCAAwC,GACzD,oCAAoC,CAmBtC;AAMD,qDAAqD;AACrD,oBAAY,6CAA6C;IACvD,kEAAkE;IAClE,kBAAkB,uBAAuB;IACzC;;;;;;OAMG;IACH,kBAAkB,uBAAuB;IACzC,uEAAuE;IACvE,cAAc,mBAAmB;IACjC;;;;;;;;;;;OAWG;IACH,mBAAmB,wBAAwB;CAC5C;AAED,MAAM,MAAM,uCAAuC,GAAG;IACpD,QAAQ,CAAC,MAAM,EAAE,6CAA6C,CAAC;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,8CAA8C;IAC9C,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,8CAA8C,CAC5D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACnD,qBAAqB,EAAE,qBAAqB,EAC5C,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAAG,SAAS,EACtG,gBAAgB,EAAE,wCAAwC,GACzD,uCAAuC,GAAG,SAAS,CAiErD;AAED;;;;;;;;GAQG;AACH,wBAAgB,+CAA+C,CAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACnD,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAAG,SAAS,GACrG,MAAM,GAAG,SAAS,CAOpB"}

package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-access-grant-custom-implementation.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grant-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA6BH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AA+J7K,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CA8PjG"}
+{"version":3,"file":"platform-access-grant-custom-implementation.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/platform-access-grant-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAuBH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AA8D7K,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CA0LjG"}