@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-status-transition.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAGH,OAAO,EACL,uCAAuC,EAEvC,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAIpH,OAAO,EACL,2CAA2C,EAC3C,iCAAiC,EACjC,wCAAwC,GACzC,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,kDAAkD,EAClD,wCAAwC,EACxC,6CAA6C,EAC7C,gDAAgD,EAChD,+CAA+C,EAC/C,6CAA6C,EAC7C,qCAAqC,GACtC,MAAM,mFAAmF,CAAC;AAG3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAEnH,4EAA4E;AAC5E,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B;;;;;;;;GAQG;AACH,SAAS,+BAA+B,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAyD,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,0FAA0F;IAC1F,iEAA+B,CAAA;IAC/B;;;;OAIG;IACH,uEAAqC,CAAA;AACvC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,4BASX;AATD,WAAY,4BAA4B;IACtC,qDAAqD;IACrD,2CAAW,CAAA;IACX;;;;OAIG;IACH,+CAAe,CAAA;AACjB,CAAC,EATW,4BAA4B,KAA5B,4BAA4B,QASvC;AAED,+FAA+F;AAC/F,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwEjD;;;;;;;;GAQG;AACH,SAAS,8BAA8B,CACrC,KAAc,EACd,cAAiC,EACjC,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO;IAExE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAC1E,OAAO,EAAE;YACP,OAAO,EACL,QAAQ,UAAU,CAAC,mBAAmB,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;kBAC5F,2BAA2B;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,YAAY,EAAE,UAAU,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YACnD,eAAe,EAAE,SAAS;SAC3B;KACF,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,SAAS,4BAA4B,CACnC,UAA8C,EAC9C,KAAc,EACd,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,8FAA8F;IAC9F,iEAAiE;IACjE,IAAI,UAAU,CAAC,IAAI,KAAK,4BAA4B,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExE,MAAM,QAAQ,GAAI,KAA6C,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,UAAU,CAAC,MAAM,KAAK,8BAA8B,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,OAAO,EAAE;oBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,sBAAsB;oBACzD,MAAM,EAAE,6CAA6C;oBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;oBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;iBACpD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,OAAO,EAAE;gBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,oCAAoC;gBACvE,MAAM,EAAE,6CAA6C;gBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,QAAQ;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,OAAO,UAAU,CAAC,UAAU;QAC1B,CAAC,CAAC,CAAC,YAAY,EAAE,4BAA4B,CAAC;QAC9C,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAM1C;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAE1E,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;YACvF,OAAO,EAAE;gBACP,MAAM,EAAE,8DAA8D;gBACtE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;gBAC1B,aAAa,EAAE,UAAU,CAAC,MAAM,IAAI,IAAI;gBACxC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,mBAAmB,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC;aACzD;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;IAEnF,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,CAAC,4BAA4B,CAAC,GAAG,4BAA4B,CAChE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAAC,MAQpE;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEhG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,8FAA8F;sBAC5F,uFAAuF;gBAC3F,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,2CAA2C,CAAC;QAChD,aAAa,EAAE,UAAU,CAAC,GAAG;QAC7B,aAAa,EAAE,UAAU,CAAC,QAAQ;QAClC,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,8CAA8C;QAC9C,SAAS,EAAE,UAAU,CAAC,QAAQ;QAC9B,UAAU;QACV,gBAAgB;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,qDAAqD,CAAC,MAU3E;IACC,MAAM,EACJ,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAC5E,kCAAkC,GACnC,GAAG,MAAM,CAAC;IAEX,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACxD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,6FAA6F;sBAC3F,6FAA6F;sBAC7F,eAAe;gBACnB,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,aAAa,EAAE,UAAU,CAAC,KAAK;QAC/B,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,+FAA+F;QAC/F,SAAS,EAAE,UAAU,CAAC,KAAK;QAC3B,UAAU;QACV,eAAe;KAChB,CAAC;IAEF,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC;QAAE,OAAO;IAE/D,MAAM,kDAAkD,CAAC;QACvD,GAAG,UAAU;QACb,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,cAAc;QACd,gBAAgB,EAAE,MAAM,6CAA6C,CAAC,kCAAkC,EAAE,CAAC;QAC3G,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;KACpD,CAAC,CAAC;AACL,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,SAAS,kCAAkC,CACzC,UAA8C,EAC9C,SAAoB;IAEpB,MAAM,MAAM,GAAiC,EAAE,CAAC;IAEhD,IAAI,wCAAwC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5E,MAAM,2BAA2B,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,8CAA8C,CAAC;YAC7C,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,2BAA2B,EAAE;SAC/C,CAAC,CAAC,CAAC;IACR,CAAC;IAED,8FAA8F;IAC9F,gGAAgG;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,kFAAkF;IAClF,IAAI,+CAA+C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnF,MAAM,0BAA0B,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE;YACxE,MAAM,6CAA6C,CAAC;gBAClD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBACrC,UAAU;gBACV,gBAAgB;gBAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,0BAA0B,EAAE;gBAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACvB,yFAAyF;oBACzF,mFAAmF;oBACnF,uFAAuF;oBACvF,wEAAwE;oBACxE,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;yBAC9E,iCAAiC,CAAC;wBACjC,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,oFAAoF;wBACpF,yDAAyD;wBACzD,UAAU,EAAE,uCAAuC,CAAC,wBAAwB;wBAC5E,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;wBACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;wBACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;wBACnD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBACrC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC;qBACtC,EAAE,gBAAgB,CAAC,CAAC;oBAEvB,uFAAuF;oBACvF,wEAAwE;oBACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CACnB,wFAAwF,EACxF;wBACE,MAAM,EAAE,wDAAwD;wBAChE,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBACrC,MAAM,EAAE,uEAAuE;qBAChF,CACF,CAAC;gBACJ,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,gDAAgD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpF,MAAM,sBAAsB,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,2BAAkF,CAAC;QACvF,MAAM,kCAAkC,GAAG,GAA8C,EAAE,CACzF,CAAC,2BAA2B,KAAK,SAAS,CAAC,GAAG,CAC5C,kBAAkB,CAAC,2BAA2B,CAC/C,CAAC,CAAC;QAEL,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,qDAAqD,CAAC;YACpD,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,sBAAsB,EAAE;YACzC,kCAAkC;SACnC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,MAAM,cAAc,GAAG,qCAAqC,CAAC,UAAU,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE;QACnG,MAAM,WAAW,GAAG,kCAAkC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE9E,OAAO,yCAAyC,CAAC;YAC/C,aAAa,EAAE;gBACb,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB,EAAE,IAAI;aACwB;YAClD,UAAU,EACR,UAAU,CAAC,UAAU;mBAClB,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,mBAAmB,oBAAoB;YACnG,2FAA2F;YAC3F,2FAA2F;YAC3F,6FAA6F;YAC7F,4DAA4D;YAC5D,mBAAmB,EAAE,cAAc;YACnC,wFAAwF;YACxF,yFAAyF;YACzF,6DAA6D;YAC7D,EAAE;YACF,2FAA2F;YAC3F,0FAA0F;YAC1F,2FAA2F;YAC3F,wCAAwC;YACxC,EAAE;YACF,qFAAqF;YACrF,0EAA0E;YAC1E,sFAAsF;YACtF,2FAA2F;YAC3F,uFAAuF;YACvF,2FAA2F;YAC3F,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,EAAE;YAC3B,QAAQ,EAAE;gBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBAClF,0FAA0F;oBAC1F,uFAAuF;oBACvF,sFAAsF;oBACtF,EAAE;oBACF,8FAA8F;oBAC9F,4FAA4F;oBAC5F,yFAAyF;oBACzF,0DAA0D;oBAC1D,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;oBACtD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;wBACpC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;4BAC1E,OAAO,EAAE;gCACP,OAAO,EACL,GAAG,UAAU,CAAC,mBAAmB,oDAAoD;sCACnF,uBAAuB;gCAC3B,MAAM,EAAE,wCAAwC;gCAChD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,kBAAkB,EAAE,0BAA0B,CAAC,GAAG,CAAC;6BACpD;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,8BAA8B,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;oBAE3F,0FAA0F;oBAC1F,yFAAyF;oBACzF,4DAA4D;oBAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,aAA6C,CAAC;oBACvE,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;4BAC7D,OAAO,EAAE;gCACP,MAAM,EAAE,6CAA6C;gCACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,iBAAiB;6BAC9B;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,KAAK,GAAG,0BAA0B,CAAC;wBACvC,UAAU;wBACV,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;wBACrD,KAAK;wBACL,gBAAgB;wBAChB,KAAK;qBACN,CAAC,CAAC;oBAEH,uFAAuF;oBACvF,qFAAqF;oBACrF,8EAA8E;oBAC9E,KAAK,MAAM,oBAAoB,IAAI,WAAW,EAAE,CAAC;wBAC/C,MAAM,oBAAoB,CAAC;4BACzB,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;4BACrD,kFAAkF;4BAClF,6DAA6D;4BAC7D,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;4BAC/B,gBAAgB;4BAChB,KAAK;yBACN,CAAC,CAAC;oBACL,CAAC;oBAED,mFAAmF;oBACnF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,0FAA0F;oBAC1F,sFAAsF;oBACtF,wFAAwF;oBACxF,yFAAyF;oBACzF,wFAAwF;oBACxF,gFAAgF;oBAChF,0FAA0F;oBAC1F,+DAA+D;oBAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;oBACtD,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;4BAC7E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;4BACjE,OAAO,EAAE;gCACP,OAAO,EACL,6EAA6E;sCAC3E,uCAAuC;gCAC3C,MAAM,EAAE,uDAAuD;gCAC/D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;gCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;6BAC5D;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,mCAAmC,CAAC,WAAW,EAAE;wBAC/C,GAAG,EAAE,8BAA8B,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;8BACtE,IAAI,UAAU,CAAC,mBAAmB,IAAI,iBAAiB,EAAE;wBAC7D,OAAO,EAAE,KAAK,IAAI,EAAE;4BAClB,IAAI,CAAC;gCACH,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;qCAC9E,oCAAoC,CAAC;oCACpC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;oCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;oCAC3D,SAAS,EAAE,iBAAiB;oCAC5B,WAAW,EAAE,MAAM,CAAC,gBAAgB,EAAE,YAAY,EAAE,MAAM,IAAI,QAAQ,CAAC;oCACvE,cAAc,EAAE,MAAM,CAAE,UAAmC,CAAC,MAAM,IAAI,EAAE,CAAC;oCACzE,SAAS,EAAE,UAAU,CAAC,YAAY;oCAClC,aAAa,EAAE,UAAU,CAAC,eAAe;oCACzC,2EAA2E;oCAC3E,4EAA4E;oCAC5E,qBAAqB;oCACrB,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;oCAC9C,uBAAuB,EACrB,KAAK,CAAC,4BAA4B,CAAC,YAAY,IAAI;wCACjD,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAS;wCAC7C,CAAC,CAAC,SAAS;oCACf,cAAc,EACV,UAA2C,CAAC,cAAqC;2CAChF,gBAAgB,EAAE,YAAY,EAAE,cAAc;iCACpD,EAAE,gBAAgB,CAAC,CAAC;4BACzB,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,mFAAmF;gCACnF,wEAAwE;gCACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kDAAkD,EAAE;oCACxE,MAAM,EAAE,kDAAkD;oCAC1D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;oCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;oCAC3D,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iCAClC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;qBACF,CAAC,CAAC;oBAEH,OAAO,KAAK,CAAC;gBACf,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uCAAuC,CACrD,WAA0D;IAE1D,OAAO,WAAW,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["/**\n * The shared implementation behind every account/entity lifecycle verb.\n *\n * ## What these verbs have in common\n *\n * SUSPEND, ACTIVATE, REACTIVATE, DEACTIVATE_ACCOUNT and their siblings differ only in which status\n * they write and which statuses they accept as a starting point. Each one validates a transition,\n * then writes `{status}` plus at most a scheduling date. Hand-rolling that per verb is how the\n * catalogue drifted in the first place: on 2026-08-01 a sweep found thirteen routed lifecycle\n * variants that declared a request contract, persisted nothing, and answered HTTP 200 — an operator\n * told a CRITICAL suspension had taken effect while the tenant kept serving.\n *\n * One factory, one place where the rules live.\n *\n * ## Why the transition is re-checked here, when `enabledCondition` already gates it\n *\n * It is a fail-closed backstop, NOT a duplicated rule. A custom implementation is addressed by an\n * EXACT operation-path key, so it runs for that path regardless of how the path was reached, while\n * `enabledCondition` is evaluated by the URL-facing dispatch. The organization-members config\n * records the same reasoning for why a role-change verb would not inherit UPDATE's ceiling gate.\n * The two also read different things: the gate sees the pre-fetched object, this sees the row the\n * write is actually about to land on.\n *\n * The rule itself is not duplicated — `allowedFromStatuses` is declared once per registration, and\n * the operation's `enabledCondition` is authored from the same set.\n *\n * ## Why `authoritativeFields` is mandatory here\n *\n * Every status field these verbs write is `.excludeFromUpdate()` — that is the whole reason the\n * verbs exist rather than letting a client PATCH the field. The repository re-parses every write\n * against the operation's `requestDto`, which names no status, so without an explicit declaration\n * the value survives only by being inferred as \"a key the hook added\". That inference is defeated\n * by any caller who reaches the service tier with the key already in the payload, and the write\n * silently becomes empty. See `resolveServerInjectedFieldAllowList` for the full mechanism.\n *\n * ## The trail is registered in the PREFIX and executes on COMMIT\n *\n * Both halves of that matter, and neither works alone:\n *\n *  - **Registered in the prefix**, because that is the only phase that can see the caller's\n *    `reason` / `suspensionReason`. The POSTFIX input is typed `z.infer<TOutput>` — the persisted\n *    row — and these are not schema columns, so they appear on neither. Decision D2 named the trail\n *    as their home; this is what actually puts them there.\n *  - **Executed on commit**, because the prefix runs BEFORE persistence. Emitting there directly\n *    would leave an audit row asserting a suspension that never happened whenever the write failed\n *    — evidence of a state change nobody made, which is worse than no record.\n *\n * `registerTransactionPostCommitEffect` gives both, which is why this factory declares\n * `transactionalCore`. Note this changes NO deployment's transaction posture: the core engine\n * already declares transaction-requiring boundaries unconditionally (organization\n * activate/suspend/request_deletion/restore, organization-units MOVE, platform-access grants,\n * organization-member writes), so `validateInitializedRuntimeTransactionReadiness` already probes\n * every adapter at startup and a store that cannot commit already fails there. An earlier revision\n * of this comment claimed the opposite and used it to defer the fix — that was wrong, and it is\n * recorded here so the claim is not made a second time.\n *\n * `targetStatus` is the persisted FACT once the effect runs, not merely the intent: `status` is\n * declared in `authoritativeFields`, so the strict re-parse cannot strip the patch, and the startup\n * guard proves every declared name is a real persisted field of the resource.\n *\n * ## Why the administrative floors are enforced HERE and not per verb\n *\n * `status` is one of the two axes that decide whether a principal is an administratively usable\n * administrator — of the APPLICATION (with `appRoles`) or of ONE ORGANIZATION (with a membership's\n * `roles`) — and every verb served by this factory writes it. Both floors were originally wired onto\n * their resource's core `UPDATE`, but a custom implementation resolves by an EXACT operation-path\n * key, so neither extended to anything else:\n *\n *  - `PUT /users/{id}/suspend-user` reached the same `status` field through this registration and\n *    returned 200 on the LAST usable super-administrator, leaving an application with no principal\n *    able to administer it and no in-product recovery door (every one is gated on the role now\n *    unusable). Proven end-to-end before it was fixed.\n *  - `organizationMembers | suspend` was the exact sibling: it strands ONE tenant, and\n *    `ORGANIZATION_MEMBERS` declares no super-admin variant, so a platform administrator who is not\n *    a member cannot re-own the stranded organization afterwards. Recovery exists, but only from\n *    OUTSIDE the tenant: `organizationMembers.grantOwnership` is platform-tier.\n *\n * Placing the calls in the SHARED implementation rather than on each verb covers every current and\n * future status verb on every governed resource at once, which is the only version of this fix that\n * cannot be re-opened by the next lifecycle verb somebody adds. Each floor is gated on the subject\n * resource because the floors are scoped invariants while this factory is generic — see\n * {@link resolveStatusTransitionFloorGuards}.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — access-affecting lifecycle\n * changes run through one guarded authority that records what happened, rather than a generic field\n * write, and may not retire the last accountable administrative principal of an application or of a\n * tenant.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  AdministrativeContinuityBreachDetection,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ResourceOperationVariantType,\n  type ResourceConfiguration_OperationPath,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  assertSuperAdminFloorPreservedForTransition,\n  createSuperAdminConferralResolver,\n  isSuperAdminFloorGovernedSubjectResource,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n  assertOrganizationOwnerFloorPreservedForTransition,\n  createOrganizationOwnerConferralResolver,\n  createOrganizationOwnerFloorPopulationContext,\n  isOrganizationOwnerFloorAuthorityBearingResource,\n  isOrganizationOwnerFloorGovernedSubjectResource,\n  reportOrganizationsStrandedByUserDeactivation,\n  membershipTransitionCouldReduceOwners,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n  describeUnaddressableShape,\n  resolveSingleSubjectId,\n} from '~wildo-backend-lib/base-classes/utils/single-subject-addressing.backend.utils';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/** The status field every lifecycle-bearing resource in the engine uses. */\nconst STATUS_FIELD = 'status';\n\n/**\n * The caller's justification for a transition, under whichever name its verb gives it.\n *\n * `suspend` calls it `suspensionReason`; the others call it `reason`. Both spellings are read here\n * rather than threaded through each definition, because the value has ONE destination — the audit\n * row — and the request-contract vocabulary is a per-verb surface detail, not a semantic difference.\n * It is never persisted on the row: a suspension reason is a compliance artefact nothing reads back,\n * so a schema column would only create something an erasure would later have to scrub.\n */\nfunction resolveAuthoredTransitionReason(input: unknown): string | undefined {\n  if (!input || typeof input !== 'object') return undefined;\n  const payload = input as { reason?: unknown; suspensionReason?: unknown };\n  const authored = payload.suspensionReason ?? payload.reason;\n  return typeof authored === 'string' && authored.length > 0 ? authored : undefined;\n}\n\n/**\n * How a verb's request contract expresses \"and automatically undo this later\".\n *\n * The persisted field is always `scheduledReactivationAt` — named for the effect so one field and\n * one sweep serve every verb — but the caller-facing vocabulary differs per verb, and one of them\n * is not even an instant. Translating here keeps each request contract in its own natural terms\n * while the row stays uniform, the same split `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in,\n * `parentUnitId` + `path` persisted).\n */\nexport enum StatusTransitionScheduleSource {\n  /** The contract carries an absolute instant (`suspensionEndDate`, `reactivationDate`). */\n  ABSOLUTE_DATE = 'absolute_date',\n  /**\n   * The contract carries a whole number of DAYS (`suspensionDuration`), resolved to an instant at\n   * write time. A duration is meaningless without the moment it is measured from, and the row\n   * records no such moment — so resolving it later would be guesswork.\n   */\n  DURATION_IN_DAYS = 'duration_in_days',\n}\n\n/**\n * What a verb DOES to the pending schedule — the discriminator of\n * {@link ResourceStatusTransitionScheduling}.\n *\n * A named vocabulary rather than an inline `'set' | 'clear'` union, for the same reason\n * {@link StatusTransitionScheduleSource} is one: it is a closed set with exactly one runtime source,\n * so every definition, every narrow, and every test fixture derives from here instead of re-spelling\n * the literal. The two axes are independent — `source` says how the caller EXPRESSES a schedule,\n * this says whether the verb writes one at all.\n */\nexport enum StatusTransitionScheduleMode {\n  /** Carry a caller-supplied schedule onto the row. */\n  SET = 'set',\n  /**\n   * Clear any pending schedule. Every \"undo\" verb uses this: a membership reactivated by hand must\n   * not still carry the date at which a sweep would have reactivated it anyway, or a later\n   * suspension would inherit a stale deadline.\n   */\n  CLEAR = 'clear',\n}\n\n/** The field the reactivation sweep reads. Declared once; every verb writes this same name. */\nconst SCHEDULED_REACTIVATION_FIELD = 'scheduledReactivationAt';\n\nconst MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;\n\nexport type ResourceStatusTransitionScheduling =\n  | {\n      mode: StatusTransitionScheduleMode.SET;\n      /** The key in the operation's `requestDto` that carries it. */\n      requestField: string;\n      source: StatusTransitionScheduleSource;\n    }\n  | {\n      mode: StatusTransitionScheduleMode.CLEAR;\n    };\n\nexport interface ResourceStatusTransitionDefinition {\n  resourceIdentifier: CoreResourceType;\n  /** The custom verb this implements, e.g. `suspend`. */\n  operationIdentifier: string;\n  /** Written to `status` when the transition is legal. */\n  targetStatus: string;\n  /**\n   * The ONLY statuses this verb may run from. Anything else is a `CONFLICT`.\n   *\n   * Fail-closed by construction: an unlisted status is refused rather than allowed. Keep it\n   * identical to the operation's `enabledCondition` — the gate is the fast, user-facing rejection,\n   * this is the backstop that cannot be routed around.\n   */\n  allowedFromStatuses: readonly string[];\n  /** Optional time-boxing. Omit for a verb whose contract offers the caller no window. */\n  scheduling?: ResourceStatusTransitionScheduling;\n  /**\n   * Whether this transition REMOVES access rather than restoring it.\n   *\n   * Declared, not inferred. The obvious proxies are both wrong: \"sets a schedule\" happens to\n   * correlate today (you time-box a restriction) but is a coincidence of the current verbs, and\n   * \"target is not ACTIVE\" cannot be evaluated generically because each resource has its own\n   * status vocabulary. It only feeds the audit event's risk grading, where getting it backwards\n   * would file suspensions among routine reinstatements — so it is worth one explicit word per\n   * definition.\n   */\n  restrictsAccess: boolean;\n  /** Overrides the generated debug label when a resource needs a clearer one. */\n  debugLabel?: string;\n}\n\n/**\n * A NARROW VIEW of the pre-operation snapshot — NOT a description of what the row contains.\n *\n * `utils.currentObject` comes from `fetchCurrentObjectForOperation`, which performs a full\n * `repository.read` on the addressed id, so the snapshot carries EVERY readable field of the row.\n * This type lists only what this implementation reads, and the authority fields are optional because\n * they exist on SOME governed resources and not others — not because a live row is expected to be\n * sparse. Test doubles for `currentObject` should mirror a persisted row, not this projection.\n *\n * The authority axes are read only by the floor guards (see {@link resolveStatusTransitionFloorGuards}):\n *\n * - `appRoles` — the APPLICATION axis, on `USERS` / `USER_SELF`. Those are two resource\n *   configurations over the SAME collection sharing `UserSchema` as their `mainSchema`, so the field\n *   is present through either door.\n * - `roles` + `organizationId` — the ORGANIZATIONS axis, on `ORGANIZATION_MEMBERS`. The first decides\n *   whether the row is an owner grant; the second names the population to measure.\n *\n * All three are typed `unknown` rather than `string[]`/`string` on purpose: this is the raw snapshot,\n * and each floor's own helpers are the authority on what a valid value is.\n */\ntype StatusBearingRow = {\n  _id: string;\n  status?: string;\n  appRoles?: unknown;\n  roles?: unknown;\n  organizationId?: unknown;\n};\n\n/**\n * Refuse a payload that already carries a field this verb owns.\n *\n * Defence in depth for the same hole `authoritativeFields` closes. With the declaration in place\n * such a payload is harmless — the hook's value wins — but the request is still malformed: passing\n * `status` to `suspend` asks the verb to do something other than suspend. A loud 400 beats\n * honouring one of two contradictory instructions, and it surfaces a caller who believes the field\n * is theirs to set.\n */\nfunction assertNoAuthoredFieldInRequest(\n  input: unknown,\n  authoredFields: readonly string[],\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): void {\n  if (!input || typeof input !== 'object' || Array.isArray(input)) return;\n\n  const offending = authoredFields.filter((field) =>\n    Object.prototype.hasOwnProperty.call(input, field));\n  if (offending.length === 0) return;\n\n  throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n    context: {\n      message:\n        `The '${definition.operationIdentifier}' operation owns ${offending.join(', ')} and does not `\n        + 'accept it from the caller',\n      reason: 'resource_status_transition_authored_field_in_request',\n      resourceType: definition.resourceIdentifier,\n      operationIdentifier: definition.operationIdentifier,\n      offendingFields: offending,\n    },\n  });\n}\n\n/** Resolve the caller's scheduling input to the absolute instant the sweep compares against. */\nfunction resolveScheduledReactivation(\n  scheduling: ResourceStatusTransitionScheduling,\n  input: unknown,\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Date | null {\n  // `null`, not `undefined`: the patch must actively CLEAR a stale deadline, and an `undefined`\n  // value is dropped by the write rather than unsetting the field.\n  if (scheduling.mode === StatusTransitionScheduleMode.CLEAR) return null;\n\n  const authored = (input as Record<string, unknown> | undefined)?.[scheduling.requestField];\n  if (authored === undefined || authored === null) return null;\n\n  if (scheduling.source === StatusTransitionScheduleSource.ABSOLUTE_DATE) {\n    const asDate = authored instanceof Date ? authored : new Date(String(authored));\n    if (Number.isNaN(asDate.getTime())) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        context: {\n          message: `${scheduling.requestField} is not a valid date`,\n          reason: 'resource_status_transition_invalid_schedule',\n          resourceType: definition.resourceIdentifier,\n          operationIdentifier: definition.operationIdentifier,\n        },\n      });\n    }\n    return asDate;\n  }\n\n  // DURATION_IN_DAYS — resolve against now, because the row records no other reference moment.\n  const days = typeof authored === 'number' ? authored : Number(authored);\n  if (!Number.isFinite(days) || days <= 0) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      context: {\n        message: `${scheduling.requestField} must be a positive number of days`,\n        reason: 'resource_status_transition_invalid_schedule',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        received: authored,\n      },\n    });\n  }\n  return new Date(Date.now() + days * MILLISECONDS_PER_DAY);\n}\n\n/**\n * The fields a definition writes — and therefore exactly what it must declare as authoritative.\n *\n * Derived rather than authored so the declaration cannot drift from the patch. A verb that gains a\n * schedule gains the declaration in the same edit.\n */\nexport function resolveStatusTransitionAuthoredFields(\n  definition: ResourceStatusTransitionDefinition,\n): string[] {\n  return definition.scheduling\n    ? [STATUS_FIELD, SCHEDULED_REACTIVATION_FIELD]\n    : [STATUS_FIELD];\n}\n\n/**\n * Build the `prefixCoreOperations` patch for one transition.\n *\n * Exported for testing: it is the whole decision, and it is pure apart from the row it is handed.\n */\nexport function buildStatusTransitionPatch(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  input: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}): Record<string, unknown> {\n  const { definition, currentRow, input, executionContext, utils } = params;\n\n  if (!definition.allowedFromStatuses.includes(currentRow.status ?? '')) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n      context: {\n        reason: 'resource_status_transition_not_permitted_from_current_status',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n        currentStatus: currentRow.status ?? null,\n        targetStatus: definition.targetStatus,\n        allowedFromStatuses: [...definition.allowedFromStatuses],\n      },\n    });\n  }\n\n  const patch: Record<string, unknown> = { [STATUS_FIELD]: definition.targetStatus };\n\n  if (definition.scheduling) {\n    patch[SCHEDULED_REACTIVATION_FIELD] = resolveScheduledReactivation(\n      definition.scheduling, input, definition, executionContext, utils,\n    );\n  }\n\n  return patch;\n}\n\n/**\n * Refuse a transition that would leave the application with no administratively usable\n * super-administrator.\n *\n * ## Only the status axis moves\n *\n * These verbs write `status` and at most a schedule — never `appRoles`. So the roles are passed as\n * BOTH the previous and the next value: the transition check needs the authority axis to decide\n * whether the subject counted at all, and stating it unchanged is what makes \"this write cannot\n * touch conferral\" explicit rather than implied by omission.\n *\n * ## Cost\n *\n * `assertSuperAdminFloorPreservedForTransition` short-circuits before issuing any query unless the\n * subject counted toward the floor BEFORE the write and would stop counting after it. So an\n * ordinary user suspension, and every transition INTO the authenticable set (`unsuspend_user`,\n * whose subject was by definition not usable beforehand), pay two set-membership tests and nothing\n * else. Only the genuinely dangerous case reaches the population query.\n *\n * ## Fail closed on a snapshot without the authority axis\n *\n * `appRoles` is what the whole decision turns on. A snapshot that lacks it cannot answer whether\n * this subject is an administrator, and answering \"not an administrator\" would fail OPEN on exactly\n * the input the guard exists for. Refusing instead mirrors the sibling `users | DELETE` guard, and\n * costs nothing in practice: the field carries a `.default([APP_USER])` and both floor-governed\n * resources read the same `UserSchema`, so a live snapshot always carries it.\n *\n * Exported for testing: like {@link buildStatusTransitionPatch} it is the whole decision, and it is\n * pure apart from the row and the collaborators it is handed.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an account-lifecycle change\n * must not retire the last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesSuperAdminFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n}): Promise<void> {\n  const { definition, currentRow, nextStatus, executionContext, utils, conferringRoles } = params;\n\n  if (!Array.isArray(currentRow.appRoles)) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the application roles of the account being changed could not be read, so it cannot '\n          + 'be proven that this transition would not disable the last usable super-administrator.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  await assertSuperAdminFloorPreservedForTransition({\n    subjectUserId: currentRow._id,\n    previousRoles: currentRow.appRoles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction — see the header.\n    nextRoles: currentRow.appRoles,\n    nextStatus,\n    executionContext,\n    repositoriesRegistry: utils.repositoriesRegistry,\n    errorBuilder: utils.errorBuilder,\n    conferringRoles,\n    operationIdentifier: definition.operationIdentifier,\n  });\n}\n\n/**\n * Refuse a transition that would leave an organization with no administratively usable owner.\n *\n * The ORGANIZATION-scope twin of {@link assertStatusTransitionPreservesSuperAdminFloor}, and the\n * differences are all consequences of the population being per-tenant rather than per-application:\n *\n * - **The subject names its own population.** `organizationId` selects which tenant to measure, so a\n *   snapshot without it cannot be evaluated at all — unlike the application floor, where there is\n *   only ever one population.\n * - **The measurement runs under a SYSTEM context, not the caller's.** The floor must see every owner\n *   membership AND the `status` of every one of those owners' `User` rows, and the `ORG_ADMIN`s who\n *   reach these verbs cannot list `USERS` at all. The authority owns that decision — see\n *   {@link createOrganizationOwnerFloorPopulationContext}.\n * - **The short-circuit is asked HERE, before the context is built.** Constructing the system context\n *   is a registry lookup plus a possible application-id resolution, and suspending an ordinary member\n *   — the overwhelmingly common case — must not pay for it. This is not a second copy of the rule:\n *   {@link membershipTransitionCouldReduceOwners} is the authority's own predicate, and the assertion\n *   below calls it again.\n *\n * Fails closed on a snapshot that carries no `roles` or no `organizationId`, for the reason the\n * application twin does: answering \"not an owner\" would fail OPEN on exactly the input the guard\n * exists for, and a suspended last owner cannot be reactivated by anyone — `ORGANIZATION_MEMBERS`\n * declares exactly one cross-tenant variant — `grantOwnership` — so recovery from a stranded state\n * is a platform-operator action, never a tenant one. That is why the in-tenant refusal still stands.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a membership-lifecycle change\n * must not retire a tenant's last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesOrganizationOwnerFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n  /** Resolved lazily and only once a reduction is established — see the header. */\n  resolveAuthExecutionContextFactory: () => AuthExecutionContextFactoryBackendService;\n}): Promise<void> {\n  const {\n    definition, currentRow, nextStatus, executionContext, utils, conferringRoles,\n    resolveAuthExecutionContextFactory,\n  } = params;\n\n  const organizationId = typeof currentRow.organizationId === 'string' ? currentRow.organizationId : undefined;\n\n  if (!Array.isArray(currentRow.roles) || !organizationId) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the roles or the owning organization of the membership being changed could not be '\n          + \"read, so it cannot be proven that this transition would not retire the organization's last \"\n          + 'usable owner.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  const transition = {\n    previousRoles: currentRow.roles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction: these verbs write `status` and at most a schedule, never `roles`.\n    nextRoles: currentRow.roles,\n    nextStatus,\n    conferringRoles,\n  };\n\n  if (!membershipTransitionCouldReduceOwners(transition)) return;\n\n  await assertOrganizationOwnerFloorPreservedForTransition({\n    ...transition,\n    memberId: currentRow._id,\n    organizationId,\n    executionContext: await createOrganizationOwnerFloorPopulationContext(resolveAuthExecutionContextFactory()),\n    repositoriesRegistry: utils.repositoriesRegistry,\n    errorBuilder: utils.errorBuilder,\n    operationIdentifier: definition.operationIdentifier,\n  });\n}\n\n/**\n * One administrative floor a status transition must not breach, bound to a single definition.\n *\n * A list rather than a chain of `if`s inside the hook, because the set of floors that govern a row is\n * a property of the RESOURCE and is therefore decidable once, at factory construction, from static\n * data. Adding the next authority is one entry here — and, more to the point, a lifecycle verb added\n * to a governed resource inherits every floor automatically instead of depending on somebody\n * remembering to wire it. That omission is the whole defect class this file now closes.\n */\ntype StatusTransitionFloorGuard = (params: {\n  currentRow: StatusBearingRow;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}) => Promise<void>;\n\n/**\n * The floors that govern one definition's resource, resolved once when the factory is built.\n *\n * Every collaborator is bound LAZILY. Factories are constructed during module registration, which can\n * run before the authorization and authentication services are bound, so an eager `container.get`\n * would turn a guard into a startup crash. The conferral resolvers additionally re-read the live role\n * table on every call, because `initializeRolesWithCustom` mutates it in place.\n *\n * A resource governed by NO floor gets an empty list and pays nothing at all — not a container\n * lookup, not a closure invocation. That is the common case (organization units, and every\n * application resource that grows a lifecycle verb later).\n */\nfunction resolveStatusTransitionFloorGuards(\n  definition: ResourceStatusTransitionDefinition,\n  container: Container,\n): StatusTransitionFloorGuard[] {\n  const guards: StatusTransitionFloorGuard[] = [];\n\n  if (isSuperAdminFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const superAdminConferralResolver = createSuperAdminConferralResolver(container);\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesSuperAdminFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: superAdminConferralResolver(),\n      }));\n  }\n\n  // ── USERS lifecycle: REPORT, never refuse ──────────────────────────────────────────────────\n  // A deactivated user stops counting as a usable owner, so this transition can strand a tenant —\n  // and unlike every other floor surface it must still be allowed to proceed. Suspension is normally\n  // incident response, and refusing it would mean an operator cannot lock out a compromised owner\n  // without first transferring ownership using the tenant the attacker controls. The stranded tenant\n  // is recoverable (boot report finds it, `grantOwnership` repairs it); the live hostile session is\n  // not. See `reportOrganizationsStrandedByUserDeactivation` for the full argument.\n  if (isOrganizationOwnerFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const strandingConferralResolver = createOrganizationOwnerConferralResolver(container);\n    guards.push(async ({ currentRow, nextStatus, executionContext, utils }) => {\n      await reportOrganizationsStrandedByUserDeactivation({\n        subjectUserId: String(currentRow._id),\n        nextStatus,\n        executionContext,\n        repositoriesRegistry: utils.repositoriesRegistry,\n        errorBuilder: utils.errorBuilder,\n        conferringRoles: strandingConferralResolver(),\n        operationIdentifier: definition.operationIdentifier,\n        report: async (breach) => {\n          // An AUDIT ROW, not a log line — one per stranded tenant. The justification for allowing\n          // this write at all is that the consequence becomes visible, and a log line is not\n          // queryable evidence and never reaches a SIEM. `CRITICAL` + the AUTHORIZATION category\n          // route it through the same export path as every other authority event.\n          await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n            .logOrganizationOwnerFloorBreached({\n              organizationId: breach.organizationId,\n              // A guard SAW this one and let it through, which is what separates it from the boot\n              // report's observation of a tenant stranded out-of-band.\n              detectedBy: AdministrativeContinuityBreachDetection.ALLOWED_LIFECYCLE_ACTION,\n              reducedMemberIds: breach.reducedMemberIds,\n              remainingUsableOwners: breach.remainingUsableOwners,\n              operationIdentifier: definition.operationIdentifier,\n              subjectUserId: String(currentRow._id),\n              subjectNextStatus: String(nextStatus),\n            }, executionContext);\n\n          // The log line stays as the operator-facing half: an audit row is for the auditor, and\n          // whoever is on call during an incident is reading logs, not the trail.\n          utils.logger?.error?.(\n            'Organization left with no administratively usable owner by a user lifecycle transition',\n            {\n              reason: 'organization_owner_floor_stranded_by_user_deactivation',\n              organizationId: breach.organizationId,\n              subjectUserId: String(currentRow._id),\n              remedy: 'organizationMembers.grantOwnership (platform-tier) restores an owner.',\n            },\n          );\n        },\n      });\n    });\n  }\n\n  if (isOrganizationOwnerFloorAuthorityBearingResource(definition.resourceIdentifier)) {\n    const ownerConferralResolver = createOrganizationOwnerConferralResolver(container);\n    let authExecutionContextFactory: AuthExecutionContextFactoryBackendService | undefined;\n    const resolveAuthExecutionContextFactory = (): AuthExecutionContextFactoryBackendService =>\n      (authExecutionContextFactory ??= container.get<AuthExecutionContextFactoryBackendService>(\n        SAAS_SERVICE_TYPES.AuthExecutionContextFactory,\n      ));\n\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesOrganizationOwnerFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: ownerConferralResolver(),\n        resolveAuthExecutionContextFactory,\n      }));\n  }\n\n  return guards;\n}\n\n/**\n * One lifecycle transition, as a registrable custom implementation.\n *\n * Modelled on `createOrganizationUnitStatusTransitionFactory`, which established the pattern for\n * this engine: validate against the loaded row, then RETURN the field patch for the core UPDATE to\n * persist rather than writing directly. The difference is that this one is resource-agnostic and\n * declares `authoritativeFields`, which the org-units original did not need — its `status` is not\n * `.excludeFromUpdate()`, so its patch survived on the introduced-key inference alone.\n */\nexport function createResourceStatusTransitionFactory(\n  definition: ResourceStatusTransitionDefinition,\n): ResourceCustomServiceImplementationFactory {\n  const authoredFields = resolveStatusTransitionAuthoredFields(definition);\n\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) => {\n    const floorGuards = resolveStatusTransitionFloorGuards(definition, container);\n\n    return createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      } as ResourceConfiguration_OperationPath<any, any>,\n      debugLabel:\n        definition.debugLabel\n        ?? `${String(definition.resourceIdentifier)}.${definition.operationIdentifier}.status-transition`,\n      // `status` and `scheduledReactivationAt` are `.excludeFromUpdate()` on every resource this\n      // serves. Without this the repository's strict re-parse drops the patch for any caller who\n      // reached the service tier with the key already present, and the verb answers success having\n      // changed nothing — the exact defect it was written to fix.\n      authoritativeFields: authoredFields,\n      // The audit row is registered from the PREFIX (the only phase that can see the caller's\n      // `reason`) and executes on COMMIT, so it never describes a write that rolled back. That\n      // needs a commit hook to exist, which is what this declares.\n      //\n      // No participants: the transition writes exactly one row, on the operation's own resource,\n      // which the framework includes automatically. Contrast the ORGANIZATIONS lifecycle verbs,\n      // which name ORGANIZATION_MEMBERS + USERS because they reconcile membership-derived global\n      // `userTypes` in the same unit of work.\n      //\n      // This does NOT change any deployment's transaction posture: the core engine already\n      // declares transaction-requiring boundaries unconditionally (organization\n      // activate/suspend/request_deletion/restore, organization-units MOVE, platform-access\n      // grants, organization-member writes), so `validateInitializedRuntimeTransactionReadiness`\n      // already probes every adapter at startup and a store that cannot commit already fails\n      // there — see the `rejects transaction readiness against a standalone MongoDB server` pin.\n      transactionalCore: true,\n      transactionParticipants: {},\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          // Fail closed on anything but a single addressed row. An ids array or a population filter\n          // reaching this path would make the status check evaluate against the wrong thing — or\n          // against nothing — while still returning a patch the core write would happily apply.\n          //\n          // A conditional `{ _id, … }` filter is single-subject and therefore admitted: `_id` names the\n          // row the pre-fetched `currentObject` below describes, and the extra predicates only decide\n          // whether the core write lands. Refusing it used to make status transitions the ONE verb\n          // family that could not be written as a compare-and-swap.\n          const subjectResourceId = resolveSingleSubjectId(_id);\n          if (subjectResourceId === undefined) {\n            throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n              context: {\n                message:\n                  `${definition.operationIdentifier} requires a single addressed resource to validate `\n                  + 'the status transition',\n                reason: 'resource_status_transition_unaddressed',\n                resourceType: definition.resourceIdentifier,\n                receivedAddressing: describeUnaddressableShape(_id),\n              },\n            });\n          }\n\n          assertNoAuthoredFieldInRequest(input, authoredFields, definition, executionContext, utils);\n\n          // The framework pre-fetches the target row for UPDATE-like operations, so this is the row\n          // the write is about to land on. Absent means the transition cannot be validated — which\n          // must never read as \"allowed\" on an access-affecting verb.\n          const currentRow = utils.currentObject as StatusBearingRow | undefined;\n          if (!currentRow) {\n            throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n              context: {\n                reason: 'resource_status_transition_target_not_found',\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: subjectResourceId,\n              },\n            });\n          }\n\n          const patch = buildStatusTransitionPatch({\n            definition,\n            currentRow: { ...currentRow, _id: subjectResourceId },\n            input,\n            executionContext,\n            utils,\n          });\n\n          // AFTER the transition-legality check on purpose: a verb refused because it cannot run\n          // from the current status should say so — the more specific finding — and should not\n          // have issued a floor's population query on the way to being rejected anyway.\n          for (const assertFloorPreserved of floorGuards) {\n            await assertFloorPreserved({\n              currentRow: { ...currentRow, _id: subjectResourceId },\n              // Read from the patch rather than re-derived from the definition, so no guard can\n              // measure a status other than the one about to be persisted.\n              nextStatus: patch[STATUS_FIELD],\n              executionContext,\n              utils,\n            });\n          }\n\n          // Trail the transition. Registered HERE — the only phase that can see the caller's\n          // `reason`, since the POSTFIX input is typed `z.infer<TOutput>` (the persisted row) and\n          // `reason` is not a schema column, so it appears on neither.\n          //\n          // It EXECUTES on commit, so it never describes a write that rolled back. That is why the\n          // registration declares `transactionalCore` above: without a commit hook the choice would\n          // be between emitting early (recording suspensions that later failed) and emitting from a\n          // postfix that cannot see the reason. With one, neither compromise is necessary.\n          //\n          // `targetStatus` is the persisted fact once this commits, not merely the intent: `status`\n          // is declared in `authoritativeFields`, so the patch cannot be stripped by the strict\n          // re-parse, and the startup guard proves every declared name is a real persisted field.\n          // Fail CLOSED on a missing transaction rather than skipping the trail. This registration\n          // declares `transactionalCore`, so the framework guarantees one; its absence means that\n          // contract is broken, and silently proceeding would perform an access-affecting\n          // transition with no record — the outcome the audit exists to make impossible. Same shape\n          // as `registerOrganizationLifecycleAudit` on the tenant verbs.\n          const transaction = utils.serviceOptions?.transaction;\n          if (!transaction) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n              context: {\n                message:\n                  'A status transition cannot be recorded: no transaction is active, but this '\n                  + 'operation declares transactionalCore.',\n                reason: 'resource_status_transition_audit_requires_transaction',\n                resourceType: String(definition.resourceIdentifier),\n                operationIdentifier: String(definition.operationIdentifier),\n              },\n            });\n          }\n\n          registerTransactionPostCommitEffect(transaction, {\n            key: `resource-status-transition:${String(definition.resourceIdentifier)}`\n              + `:${definition.operationIdentifier}:${subjectResourceId}`,\n            execute: async () => {\n              try {\n                await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n                  .logResourceStatusTransitionPerformed({\n                    resourceType: String(definition.resourceIdentifier),\n                    operationIdentifier: String(definition.operationIdentifier),\n                    subjectId: subjectResourceId,\n                    performedBy: String(executionContext?.initiatorIds?.userId ?? 'system'),\n                    previousStatus: String((currentRow as { status?: unknown }).status ?? ''),\n                    newStatus: definition.targetStatus,\n                    isRestricting: definition.restrictsAccess,\n                    // The field decision D2 promised the trail would carry. Both spellings are\n                    // accepted because the verbs differ: `suspend` names it `suspensionReason`,\n                    // the rest `reason`.\n                    reason: resolveAuthoredTransitionReason(input),\n                    scheduledReactivationAt:\n                      patch[SCHEDULED_REACTIVATION_FIELD] instanceof Date\n                        ? patch[SCHEDULED_REACTIVATION_FIELD] as Date\n                        : undefined,\n                    organizationId:\n                      ((currentRow as { organizationId?: unknown }).organizationId as string | undefined)\n                      ?? executionContext?.initiatorIds?.organizationId,\n                  }, executionContext);\n              } catch (error) {\n                // A trail failure must not fail the transition it describes — but it must be loud,\n                // so a dropped record reaches whoever is on call rather than vanishing.\n                utils.logger?.error?.('Failed to record a status-transition audit event', {\n                  reason: 'resource_status_transition_audit_emission_failed',\n                  resourceType: String(definition.resourceIdentifier),\n                  operationIdentifier: String(definition.operationIdentifier),\n                  error: describeCaughtError(error),\n                });\n              }\n            },\n          });\n\n          return patch;\n        },\n      },\n    });\n  };\n\n  return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n/** Build every registration for a resource's lifecycle verbs in one call. */\nexport function createResourceStatusTransitionFactories(\n  definitions: readonly ResourceStatusTransitionDefinition[],\n): ResourceCustomServiceImplementationFactory[] {\n  return definitions.map(createResourceStatusTransitionFactory);\n}\n"]}
+{"version":3,"file":"resource-status-transition.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAGH,OAAO,EACL,uCAAuC,EAEvC,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAIpH,OAAO,EACL,2CAA2C,EAC3C,iCAAiC,EACjC,wCAAwC,GACzC,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,kDAAkD,EAClD,wCAAwC,EACxC,6CAA6C,EAC7C,gDAAgD,EAChD,+CAA+C,EAC/C,6CAA6C,EAC7C,qCAAqC,GACtC,MAAM,mFAAmF,CAAC;AAG3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,gEAAgE,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAEnH,4EAA4E;AAC5E,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B;;;;;;;;GAQG;AACH,SAAS,+BAA+B,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAyD,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,0FAA0F;IAC1F,iEAA+B,CAAA;IAC/B;;;;OAIG;IACH,uEAAqC,CAAA;AACvC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,4BASX;AATD,WAAY,4BAA4B;IACtC,qDAAqD;IACrD,2CAAW,CAAA;IACX;;;;OAIG;IACH,+CAAe,CAAA;AACjB,CAAC,EATW,4BAA4B,KAA5B,4BAA4B,QASvC;AAED,+FAA+F;AAC/F,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwEjD;;;;;;;;GAQG;AACH,SAAS,8BAA8B,CACrC,KAAc,EACd,cAAiC,EACjC,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO;IAExE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAC1E,OAAO,EAAE;YACP,OAAO,EACL,QAAQ,UAAU,CAAC,mBAAmB,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;kBAC5F,2BAA2B;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,YAAY,EAAE,UAAU,CAAC,kBAAkB;YAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YACnD,eAAe,EAAE,SAAS;SAC3B;KACF,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,SAAS,4BAA4B,CACnC,UAA8C,EAC9C,KAAc,EACd,UAA8C,EAC9C,gBAAuC,EACvC,KAAmD;IAEnD,8FAA8F;IAC9F,iEAAiE;IACjE,IAAI,UAAU,CAAC,IAAI,KAAK,4BAA4B,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExE,MAAM,QAAQ,GAAI,KAA6C,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,UAAU,CAAC,MAAM,KAAK,8BAA8B,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,OAAO,EAAE;oBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,sBAAsB;oBACzD,MAAM,EAAE,6CAA6C;oBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;oBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;iBACpD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,OAAO,EAAE;gBACP,OAAO,EAAE,GAAG,UAAU,CAAC,YAAY,oCAAoC;gBACvE,MAAM,EAAE,6CAA6C;gBACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,QAAQ;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,OAAO,UAAU,CAAC,UAAU;QAC1B,CAAC,CAAC,CAAC,YAAY,EAAE,4BAA4B,CAAC;QAC9C,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAM1C;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAE1E,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;YACvF,OAAO,EAAE;gBACP,MAAM,EAAE,8DAA8D;gBACtE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;gBAC1B,aAAa,EAAE,UAAU,CAAC,MAAM,IAAI,IAAI;gBACxC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,mBAAmB,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC;aACzD;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;IAEnF,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,CAAC,4BAA4B,CAAC,GAAG,4BAA4B,CAChE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAAC,MAQpE;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEhG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,8FAA8F;sBAC5F,uFAAuF;gBAC3F,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,2CAA2C,CAAC;QAChD,aAAa,EAAE,UAAU,CAAC,GAAG;QAC7B,aAAa,EAAE,UAAU,CAAC,QAAQ;QAClC,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,8CAA8C;QAC9C,SAAS,EAAE,UAAU,CAAC,QAAQ;QAC9B,UAAU;QACV,gBAAgB;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,qDAAqD,CAAC,MAU3E;IACC,MAAM,EACJ,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAC5E,kCAAkC,GACnC,GAAG,MAAM,CAAC;IAEX,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACxD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;YACxE,OAAO,EAAE;gBACP,OAAO,EACL,6FAA6F;sBAC3F,6FAA6F;sBAC7F,eAAe;gBACnB,MAAM,EAAE,yDAAyD;gBACjE,YAAY,EAAE,UAAU,CAAC,kBAAkB;gBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,UAAU,EAAE,UAAU,CAAC,GAAG;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,aAAa,EAAE,UAAU,CAAC,KAAK;QAC/B,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,+FAA+F;QAC/F,SAAS,EAAE,UAAU,CAAC,KAAK;QAC3B,UAAU;QACV,eAAe;KAChB,CAAC;IAEF,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC;QAAE,OAAO;IAE/D,MAAM,kDAAkD,CAAC;QACvD,GAAG,UAAU;QACb,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,cAAc;QACd,gBAAgB,EAAE,MAAM,6CAA6C,CAAC,kCAAkC,EAAE,CAAC;QAC3G,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;KACpD,CAAC,CAAC;AACL,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,SAAS,kCAAkC,CACzC,UAA8C,EAC9C,SAAoB;IAEpB,MAAM,MAAM,GAAiC,EAAE,CAAC;IAEhD,IAAI,wCAAwC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5E,MAAM,2BAA2B,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,8CAA8C,CAAC;YAC7C,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,2BAA2B,EAAE;SAC/C,CAAC,CAAC,CAAC;IACR,CAAC;IAED,8FAA8F;IAC9F,gGAAgG;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,kFAAkF;IAClF,IAAI,+CAA+C,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnF,MAAM,0BAA0B,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE;YACxE,MAAM,6CAA6C,CAAC;gBAClD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBACrC,UAAU;gBACV,gBAAgB;gBAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,0BAA0B,EAAE;gBAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACvB,yFAAyF;oBACzF,mFAAmF;oBACnF,uFAAuF;oBACvF,wEAAwE;oBACxE,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;yBAC9E,iCAAiC,CAAC;wBACjC,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,oFAAoF;wBACpF,yDAAyD;wBACzD,UAAU,EAAE,uCAAuC,CAAC,wBAAwB;wBAC5E,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;wBACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;wBACnD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;wBACnD,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBACrC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC;qBACtC,EAAE,gBAAgB,CAAC,CAAC;oBAEvB,uFAAuF;oBACvF,wEAAwE;oBACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CACnB,wFAAwF,EACxF;wBACE,MAAM,EAAE,wDAAwD;wBAChE,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBACrC,MAAM,EAAE,uEAAuE;qBAChF,CACF,CAAC;gBACJ,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,gDAAgD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpF,MAAM,sBAAsB,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,2BAAkF,CAAC;QACvF,MAAM,kCAAkC,GAAG,GAA8C,EAAE,CACzF,CAAC,2BAA2B,KAAK,SAAS,CAAC,GAAG,CAC5C,kBAAkB,CAAC,2BAA2B,CAC/C,CAAC,CAAC;QAEL,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,qDAAqD,CAAC;YACpD,UAAU;YACV,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,KAAK;YACL,eAAe,EAAE,sBAAsB,EAAE;YACzC,kCAAkC;SACnC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAA8C;IAE9C,MAAM,cAAc,GAAG,qCAAqC,CAAC,UAAU,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE;QACnG,MAAM,WAAW,GAAG,kCAAkC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE9E,OAAO,yCAAyC,CAAC;YAC/C,aAAa,EAAE;gBACb,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB,EAAE,IAAI;aACwB;YAClD,UAAU,EACR,UAAU,CAAC,UAAU;mBAClB,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,mBAAmB,oBAAoB;YACnG,2FAA2F;YAC3F,2FAA2F;YAC3F,6FAA6F;YAC7F,4DAA4D;YAC5D,mBAAmB,EAAE,cAAc;YACnC,wFAAwF;YACxF,yFAAyF;YACzF,6DAA6D;YAC7D,EAAE;YACF,2FAA2F;YAC3F,0FAA0F;YAC1F,2FAA2F;YAC3F,wCAAwC;YACxC,EAAE;YACF,qFAAqF;YACrF,0EAA0E;YAC1E,sFAAsF;YACtF,2FAA2F;YAC3F,uFAAuF;YACvF,2FAA2F;YAC3F,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,EAAE;YAC3B,QAAQ,EAAE;gBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;oBAClF,0FAA0F;oBAC1F,uFAAuF;oBACvF,sFAAsF;oBACtF,EAAE;oBACF,8FAA8F;oBAC9F,4FAA4F;oBAC5F,yFAAyF;oBACzF,0DAA0D;oBAC1D,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;oBACtD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;wBACpC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;4BAC1E,OAAO,EAAE;gCACP,OAAO,EACL,GAAG,UAAU,CAAC,mBAAmB,oDAAoD;sCACnF,uBAAuB;gCAC3B,MAAM,EAAE,wCAAwC;gCAChD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,kBAAkB,EAAE,0BAA0B,CAAC,GAAG,CAAC;6BACpD;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,8BAA8B,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;oBAE3F,0FAA0F;oBAC1F,yFAAyF;oBACzF,4DAA4D;oBAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,aAA6C,CAAC;oBACvE,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;4BACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;4BAC7D,OAAO,EAAE;gCACP,MAAM,EAAE,6CAA6C;gCACrD,YAAY,EAAE,UAAU,CAAC,kBAAkB;gCAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gCACnD,UAAU,EAAE,iBAAiB;6BAC9B;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,KAAK,GAAG,0BAA0B,CAAC;wBACvC,UAAU;wBACV,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;wBACrD,KAAK;wBACL,gBAAgB;wBAChB,KAAK;qBACN,CAAC,CAAC;oBAEH,uFAAuF;oBACvF,qFAAqF;oBACrF,8EAA8E;oBAC9E,KAAK,MAAM,oBAAoB,IAAI,WAAW,EAAE,CAAC;wBAC/C,MAAM,oBAAoB,CAAC;4BACzB,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;4BACrD,kFAAkF;4BAClF,6DAA6D;4BAC7D,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;4BAC/B,gBAAgB;4BAChB,KAAK;yBACN,CAAC,CAAC;oBACL,CAAC;oBAED,mFAAmF;oBACnF,wFAAwF;oBACxF,6DAA6D;oBAC7D,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,iFAAiF;oBACjF,EAAE;oBACF,0FAA0F;oBAC1F,sFAAsF;oBACtF,wFAAwF;oBACxF,yFAAyF;oBACzF,wFAAwF;oBACxF,gFAAgF;oBAChF,0FAA0F;oBAC1F,+DAA+D;oBAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;oBACtD,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;4BAC7E,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;4BACjE,OAAO,EAAE;gCACP,OAAO,EACL,6EAA6E;sCAC3E,uCAAuC;gCAC3C,MAAM,EAAE,uDAAuD;gCAC/D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;gCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;6BAC5D;yBACF,CAAC,CAAC;oBACL,CAAC;oBAED,mCAAmC,CAAC,WAAW,EAAE;wBAC/C,GAAG,EAAE,8BAA8B,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;8BACtE,IAAI,UAAU,CAAC,mBAAmB,IAAI,iBAAiB,EAAE;wBAC7D,OAAO,EAAE,KAAK,IAAI,EAAE;4BAClB,IAAI,CAAC;gCACH,MAAM,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;qCAC9E,oCAAoC,CAAC;oCACpC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;oCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;oCAC3D,SAAS,EAAE,iBAAiB;oCAC5B,WAAW,EAAE,MAAM,CAAC,gBAAgB,EAAE,YAAY,EAAE,MAAM,IAAI,QAAQ,CAAC;oCACvE,cAAc,EAAE,MAAM,CAAE,UAAmC,CAAC,MAAM,IAAI,EAAE,CAAC;oCACzE,SAAS,EAAE,UAAU,CAAC,YAAY;oCAClC,aAAa,EAAE,UAAU,CAAC,eAAe;oCACzC,2EAA2E;oCAC3E,4EAA4E;oCAC5E,qBAAqB;oCACrB,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;oCAC9C,uBAAuB,EACrB,KAAK,CAAC,4BAA4B,CAAC,YAAY,IAAI;wCACjD,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAS;wCAC7C,CAAC,CAAC,SAAS;oCACf,cAAc,EACV,UAA2C,CAAC,cAAqC;2CAChF,gBAAgB,EAAE,YAAY,EAAE,cAAc;iCACpD,EAAE,gBAAgB,CAAC,CAAC;4BACzB,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,mFAAmF;gCACnF,wEAAwE;gCACxE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kDAAkD,EAAE;oCACxE,MAAM,EAAE,kDAAkD;oCAC1D,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;oCACnD,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;oCAC3D,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iCAClC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;qBACF,CAAC,CAAC;oBAEH,OAAO,KAAK,CAAC;gBACf,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uCAAuC,CACrD,WAA0D;IAE1D,OAAO,WAAW,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAChE,CAAC","sourcesContent":["/**\n * The shared implementation behind every account/entity lifecycle verb.\n *\n * ## What these verbs have in common\n *\n * SUSPEND, ACTIVATE, REACTIVATE, DEACTIVATE_ACCOUNT and their siblings differ only in which status\n * they write and which statuses they accept as a starting point. Each one validates a transition,\n * then writes `{status}` plus at most a scheduling date. Hand-rolling that per verb is how the\n * catalogue drifted in the first place: on 2026-08-01 a sweep found thirteen routed lifecycle\n * variants that declared a request contract, persisted nothing, and answered HTTP 200 — an operator\n * told a CRITICAL suspension had taken effect while the tenant kept serving.\n *\n * One factory, one place where the rules live.\n *\n * ## Why the transition is re-checked here, when `enabledCondition` already gates it\n *\n * It is a fail-closed backstop, NOT a duplicated rule. A custom implementation is addressed by an\n * EXACT operation-path key, so it runs for that path regardless of how the path was reached, while\n * `enabledCondition` is evaluated by the URL-facing dispatch. The organization-members config\n * records the same reasoning for why a role-change verb would not inherit UPDATE's ceiling gate.\n * The two also read different things: the gate sees the pre-fetched object, this sees the row the\n * write is actually about to land on.\n *\n * The rule itself is not duplicated — `allowedFromStatuses` is declared once per registration, and\n * the operation's `enabledCondition` is authored from the same set.\n *\n * ## Why `authoritativeFields` is mandatory here\n *\n * Every status field these verbs write is `.excludeFromUpdate()` — that is the whole reason the\n * verbs exist rather than letting a client PATCH the field. The repository re-parses every write\n * against the operation's `requestDto`, which names no status, so without an explicit declaration\n * the value survives only by being inferred as \"a key the hook added\". That inference is defeated\n * by any caller who reaches the service tier with the key already in the payload, and the write\n * silently becomes empty. See `resolveServerInjectedFieldAllowList` for the full mechanism.\n *\n * ## The trail is registered in the PREFIX and executes on COMMIT\n *\n * Both halves of that matter, and neither works alone:\n *\n *  - **Registered in the prefix**, because that is the only phase that can see the caller's\n *    `reason` / `suspensionReason`. The POSTFIX input is typed `z.infer<TOutput>` — the persisted\n *    row — and these are not schema columns, so they appear on neither. Decision D2 named the trail\n *    as their home; this is what actually puts them there.\n *  - **Executed on commit**, because the prefix runs BEFORE persistence. Emitting there directly\n *    would leave an audit row asserting a suspension that never happened whenever the write failed\n *    — evidence of a state change nobody made, which is worse than no record.\n *\n * `registerTransactionPostCommitEffect` gives both, which is why this factory declares\n * `transactionalCore`. Note this changes NO deployment's transaction posture: the core engine\n * already declares transaction-requiring boundaries unconditionally (organization\n * activate/suspend/request_deletion/restore, organization-units MOVE, platform-access grants,\n * organization-member writes), so `validateInitializedRuntimeTransactionReadiness` already probes\n * every adapter at startup and a store that cannot commit already fails there. An earlier revision\n * of this comment claimed the opposite and used it to defer the fix — that was wrong, and it is\n * recorded here so the claim is not made a second time.\n *\n * `targetStatus` is the persisted FACT once the effect runs, not merely the intent: `status` is\n * declared in `authoritativeFields`, so the strict re-parse cannot strip the patch, and the startup\n * guard proves every declared name is a real persisted field of the resource.\n *\n * ## Why the administrative floors are enforced HERE and not per verb\n *\n * `status` is one of the two axes that decide whether a principal is an administratively usable\n * administrator — of the APPLICATION (with `appRoles`) or of ONE ORGANIZATION (with a membership's\n * `roles`) — and every verb served by this factory writes it. Both floors were originally wired onto\n * their resource's core `UPDATE`, but a custom implementation resolves by an EXACT operation-path\n * key, so neither extended to anything else:\n *\n *  - `PUT /users/{id}/suspend-user` reached the same `status` field through this registration and\n *    returned 200 on the LAST usable super-administrator, leaving an application with no principal\n *    able to administer it and no in-product recovery door (every one is gated on the role now\n *    unusable). Proven end-to-end before it was fixed.\n *  - `organizationMembers | suspend` was the exact sibling: it strands ONE tenant, and\n *    `ORGANIZATION_MEMBERS` declares no super-admin variant, so a platform administrator who is not\n *    a member cannot re-own the stranded organization afterwards. Recovery exists, but only from\n *    OUTSIDE the tenant: `organizationMembers.grantOwnership` is platform-tier.\n *\n * Placing the calls in the SHARED implementation rather than on each verb covers every current and\n * future status verb on every governed resource at once, which is the only version of this fix that\n * cannot be re-opened by the next lifecycle verb somebody adds. Each floor is gated on the subject\n * resource because the floors are scoped invariants while this factory is generic — see\n * {@link resolveStatusTransitionFloorGuards}.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — access-affecting lifecycle\n * changes run through one guarded authority that records what happened, rather than a generic field\n * write, and may not retire the last accountable administrative principal of an application or of a\n * tenant.\n */\n\nimport type { Container } from 'inversify';\nimport {\n  AdministrativeContinuityBreachDetection,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ResourceOperationVariantType,\n  type ResourceConfiguration_OperationPath,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  assertSuperAdminFloorPreservedForTransition,\n  createSuperAdminConferralResolver,\n  isSuperAdminFloorGovernedSubjectResource,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n  assertOrganizationOwnerFloorPreservedForTransition,\n  createOrganizationOwnerConferralResolver,\n  createOrganizationOwnerFloorPopulationContext,\n  isOrganizationOwnerFloorAuthorityBearingResource,\n  isOrganizationOwnerFloorGovernedSubjectResource,\n  reportOrganizationsStrandedByUserDeactivation,\n  membershipTransitionCouldReduceOwners,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n  describeUnaddressableShape,\n  resolveSingleSubjectId,\n} from '~wildo-backend-lib/base-classes/utils/single-subject-addressing.backend.utils';\nimport { registerTransactionPostCommitEffect } from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/** The status field every lifecycle-bearing resource in the engine uses. */\nconst STATUS_FIELD = 'status';\n\n/**\n * The caller's justification for a transition, under whichever name its verb gives it.\n *\n * `suspend` calls it `suspensionReason`; the others call it `reason`. Both spellings are read here\n * rather than threaded through each definition, because the value has ONE destination — the audit\n * row — and the request-contract vocabulary is a per-verb surface detail, not a semantic difference.\n * It is never persisted on the row: a suspension reason is a compliance artefact nothing reads back,\n * so a schema column would only create something an erasure would later have to scrub.\n */\nfunction resolveAuthoredTransitionReason(input: unknown): string | undefined {\n  if (!input || typeof input !== 'object') return undefined;\n  const payload = input as { reason?: unknown; suspensionReason?: unknown };\n  const authored = payload.suspensionReason ?? payload.reason;\n  return typeof authored === 'string' && authored.length > 0 ? authored : undefined;\n}\n\n/**\n * How a verb's request contract expresses \"and automatically undo this later\".\n *\n * The persisted field is always `scheduledReactivationAt` — named for the effect so one field and\n * one sweep serve every verb — but the caller-facing vocabulary differs per verb, and one of them\n * is not even an instant. Translating here keeps each request contract in its own natural terms\n * while the row stays uniform, the same split `ORGANIZATION_UNITS` MOVE uses (`newParentUnitId` in,\n * `parentUnitId` + `path` persisted).\n */\nexport enum StatusTransitionScheduleSource {\n  /** The contract carries an absolute instant (`suspensionEndDate`, `reactivationDate`). */\n  ABSOLUTE_DATE = 'absolute_date',\n  /**\n   * The contract carries a whole number of DAYS (`suspensionDuration`), resolved to an instant at\n   * write time. A duration is meaningless without the moment it is measured from, and the row\n   * records no such moment — so resolving it later would be guesswork.\n   */\n  DURATION_IN_DAYS = 'duration_in_days',\n}\n\n/**\n * What a verb DOES to the pending schedule — the discriminator of\n * {@link ResourceStatusTransitionScheduling}.\n *\n * A named vocabulary rather than an inline `'set' | 'clear'` union, for the same reason\n * {@link StatusTransitionScheduleSource} is one: it is a closed set with exactly one runtime source,\n * so every definition, every narrow, and every test fixture derives from here instead of re-spelling\n * the literal. The two axes are independent — `source` says how the caller EXPRESSES a schedule,\n * this says whether the verb writes one at all.\n */\nexport enum StatusTransitionScheduleMode {\n  /** Carry a caller-supplied schedule onto the row. */\n  SET = 'set',\n  /**\n   * Clear any pending schedule. Every \"undo\" verb uses this: a membership reactivated by hand must\n   * not still carry the date at which a sweep would have reactivated it anyway, or a later\n   * suspension would inherit a stale deadline.\n   */\n  CLEAR = 'clear',\n}\n\n/** The field the reactivation sweep reads. Declared once; every verb writes this same name. */\nconst SCHEDULED_REACTIVATION_FIELD = 'scheduledReactivationAt';\n\nconst MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;\n\nexport type ResourceStatusTransitionScheduling =\n  | {\n      mode: StatusTransitionScheduleMode.SET;\n      /** The key in the operation's `requestDto` that carries it. */\n      requestField: string;\n      source: StatusTransitionScheduleSource;\n    }\n  | {\n      mode: StatusTransitionScheduleMode.CLEAR;\n    };\n\nexport interface ResourceStatusTransitionDefinition {\n  resourceIdentifier: CoreResourceType;\n  /** The custom verb this implements, e.g. `suspend`. */\n  operationIdentifier: string;\n  /** Written to `status` when the transition is legal. */\n  targetStatus: string;\n  /**\n   * The ONLY statuses this verb may run from. Anything else is a `CONFLICT`.\n   *\n   * Fail-closed by construction: an unlisted status is refused rather than allowed. Keep it\n   * identical to the operation's `enabledCondition` — the gate is the fast, user-facing rejection,\n   * this is the backstop that cannot be routed around.\n   */\n  allowedFromStatuses: readonly string[];\n  /** Optional time-boxing. Omit for a verb whose contract offers the caller no window. */\n  scheduling?: ResourceStatusTransitionScheduling;\n  /**\n   * Whether this transition REMOVES access rather than restoring it.\n   *\n   * Declared, not inferred. The obvious proxies are both wrong: \"sets a schedule\" happens to\n   * correlate today (you time-box a restriction) but is a coincidence of the current verbs, and\n   * \"target is not ACTIVE\" cannot be evaluated generically because each resource has its own\n   * status vocabulary. It only feeds the audit event's risk grading, where getting it backwards\n   * would file suspensions among routine reinstatements — so it is worth one explicit word per\n   * definition.\n   */\n  restrictsAccess: boolean;\n  /** Overrides the generated debug label when a resource needs a clearer one. */\n  debugLabel?: string;\n}\n\n/**\n * A NARROW VIEW of the pre-operation snapshot — NOT a description of what the row contains.\n *\n * `utils.currentObject` comes from `fetchCurrentObjectForOperation`, which performs a full\n * `repository.read` on the addressed id, so the snapshot carries EVERY readable field of the row.\n * This type lists only what this implementation reads, and the authority fields are optional because\n * they exist on SOME governed resources and not others — not because a live row is expected to be\n * sparse. Test doubles for `currentObject` should mirror a persisted row, not this projection.\n *\n * The authority axes are read only by the floor guards (see {@link resolveStatusTransitionFloorGuards}):\n *\n * - `appRoles` — the APPLICATION axis, on `USERS` / `USER_SELF`. Those are two resource\n *   configurations over the SAME collection sharing `UserSchema` as their `mainSchema`, so the field\n *   is present through either door.\n * - `roles` + `organizationId` — the ORGANIZATIONS axis, on `ORGANIZATION_MEMBERS`. The first decides\n *   whether the row is an owner grant; the second names the population to measure.\n *\n * All three are typed `unknown` rather than `string[]`/`string` on purpose: this is the raw snapshot,\n * and each floor's own helpers are the authority on what a valid value is.\n */\ntype StatusBearingRow = {\n  _id: string;\n  status?: string;\n  appRoles?: unknown;\n  roles?: unknown;\n  organizationId?: unknown;\n};\n\n/**\n * Refuse a payload that already carries a field this verb owns.\n *\n * Defence in depth for the same hole `authoritativeFields` closes. With the declaration in place\n * such a payload is harmless — the hook's value wins — but the request is still malformed: passing\n * `status` to `suspend` asks the verb to do something other than suspend. A loud 400 beats\n * honouring one of two contradictory instructions, and it surfaces a caller who believes the field\n * is theirs to set.\n */\nfunction assertNoAuthoredFieldInRequest(\n  input: unknown,\n  authoredFields: readonly string[],\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): void {\n  if (!input || typeof input !== 'object' || Array.isArray(input)) return;\n\n  const offending = authoredFields.filter((field) =>\n    Object.prototype.hasOwnProperty.call(input, field));\n  if (offending.length === 0) return;\n\n  throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n    context: {\n      message:\n        `The '${definition.operationIdentifier}' operation owns ${offending.join(', ')} and does not `\n        + 'accept it from the caller',\n      reason: 'resource_status_transition_authored_field_in_request',\n      resourceType: definition.resourceIdentifier,\n      operationIdentifier: definition.operationIdentifier,\n      offendingFields: offending,\n    },\n  });\n}\n\n/** Resolve the caller's scheduling input to the absolute instant the sweep compares against. */\nfunction resolveScheduledReactivation(\n  scheduling: ResourceStatusTransitionScheduling,\n  input: unknown,\n  definition: ResourceStatusTransitionDefinition,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Date | null {\n  // `null`, not `undefined`: the patch must actively CLEAR a stale deadline, and an `undefined`\n  // value is dropped by the write rather than unsetting the field.\n  if (scheduling.mode === StatusTransitionScheduleMode.CLEAR) return null;\n\n  const authored = (input as Record<string, unknown> | undefined)?.[scheduling.requestField];\n  if (authored === undefined || authored === null) return null;\n\n  if (scheduling.source === StatusTransitionScheduleSource.ABSOLUTE_DATE) {\n    const asDate = authored instanceof Date ? authored : new Date(String(authored));\n    if (Number.isNaN(asDate.getTime())) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        context: {\n          message: `${scheduling.requestField} is not a valid date`,\n          reason: 'resource_status_transition_invalid_schedule',\n          resourceType: definition.resourceIdentifier,\n          operationIdentifier: definition.operationIdentifier,\n        },\n      });\n    }\n    return asDate;\n  }\n\n  // DURATION_IN_DAYS — resolve against now, because the row records no other reference moment.\n  const days = typeof authored === 'number' ? authored : Number(authored);\n  if (!Number.isFinite(days) || days <= 0) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      context: {\n        message: `${scheduling.requestField} must be a positive number of days`,\n        reason: 'resource_status_transition_invalid_schedule',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        received: authored,\n      },\n    });\n  }\n  return new Date(Date.now() + days * MILLISECONDS_PER_DAY);\n}\n\n/**\n * The fields a definition writes — and therefore exactly what it must declare as authoritative.\n *\n * Derived rather than authored so the declaration cannot drift from the patch. A verb that gains a\n * schedule gains the declaration in the same edit.\n */\nexport function resolveStatusTransitionAuthoredFields(\n  definition: ResourceStatusTransitionDefinition,\n): string[] {\n  return definition.scheduling\n    ? [STATUS_FIELD, SCHEDULED_REACTIVATION_FIELD]\n    : [STATUS_FIELD];\n}\n\n/**\n * Build the `prefixCoreOperations` patch for one transition.\n *\n * Exported for testing: it is the whole decision, and it is pure apart from the row it is handed.\n */\nexport function buildStatusTransitionPatch(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  input: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}): Record<string, unknown> {\n  const { definition, currentRow, input, executionContext, utils } = params;\n\n  if (!definition.allowedFromStatuses.includes(currentRow.status ?? '')) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.RESOURCE_STATUS_TRANSITION_CONFLICT,\n      context: {\n        reason: 'resource_status_transition_not_permitted_from_current_status',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n        currentStatus: currentRow.status ?? null,\n        targetStatus: definition.targetStatus,\n        allowedFromStatuses: [...definition.allowedFromStatuses],\n      },\n    });\n  }\n\n  const patch: Record<string, unknown> = { [STATUS_FIELD]: definition.targetStatus };\n\n  if (definition.scheduling) {\n    patch[SCHEDULED_REACTIVATION_FIELD] = resolveScheduledReactivation(\n      definition.scheduling, input, definition, executionContext, utils,\n    );\n  }\n\n  return patch;\n}\n\n/**\n * Refuse a transition that would leave the application with no administratively usable\n * super-administrator.\n *\n * ## Only the status axis moves\n *\n * These verbs write `status` and at most a schedule — never `appRoles`. So the roles are passed as\n * BOTH the previous and the next value: the transition check needs the authority axis to decide\n * whether the subject counted at all, and stating it unchanged is what makes \"this write cannot\n * touch conferral\" explicit rather than implied by omission.\n *\n * ## Cost\n *\n * `assertSuperAdminFloorPreservedForTransition` short-circuits before issuing any query unless the\n * subject counted toward the floor BEFORE the write and would stop counting after it. So an\n * ordinary user suspension, and every transition INTO the authenticable set (`unsuspend_user`,\n * whose subject was by definition not usable beforehand), pay two set-membership tests and nothing\n * else. Only the genuinely dangerous case reaches the population query.\n *\n * ## Fail closed on a snapshot without the authority axis\n *\n * `appRoles` is what the whole decision turns on. A snapshot that lacks it cannot answer whether\n * this subject is an administrator, and answering \"not an administrator\" would fail OPEN on exactly\n * the input the guard exists for. Refusing instead mirrors the sibling `users | DELETE` guard, and\n * costs nothing in practice: the field carries a `.default([APP_USER])` and both floor-governed\n * resources read the same `UserSchema`, so a live snapshot always carries it.\n *\n * Exported for testing: like {@link buildStatusTransitionPatch} it is the whole decision, and it is\n * pure apart from the row and the collaborators it is handed.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an account-lifecycle change\n * must not retire the last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesSuperAdminFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n}): Promise<void> {\n  const { definition, currentRow, nextStatus, executionContext, utils, conferringRoles } = params;\n\n  if (!Array.isArray(currentRow.appRoles)) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the application roles of the account being changed could not be read, so it cannot '\n          + 'be proven that this transition would not disable the last usable super-administrator.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  await assertSuperAdminFloorPreservedForTransition({\n    subjectUserId: currentRow._id,\n    previousRoles: currentRow.appRoles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction — see the header.\n    nextRoles: currentRow.appRoles,\n    nextStatus,\n    executionContext,\n    repositoriesRegistry: utils.repositoriesRegistry,\n    errorBuilder: utils.errorBuilder,\n    conferringRoles,\n    operationIdentifier: definition.operationIdentifier,\n  });\n}\n\n/**\n * Refuse a transition that would leave an organization with no administratively usable owner.\n *\n * The ORGANIZATION-scope twin of {@link assertStatusTransitionPreservesSuperAdminFloor}, and the\n * differences are all consequences of the population being per-tenant rather than per-application:\n *\n * - **The subject names its own population.** `organizationId` selects which tenant to measure, so a\n *   snapshot without it cannot be evaluated at all — unlike the application floor, where there is\n *   only ever one population.\n * - **The measurement runs under a SYSTEM context, not the caller's.** The floor must see every owner\n *   membership AND the `status` of every one of those owners' `User` rows, and the `ORG_ADMIN`s who\n *   reach these verbs cannot list `USERS` at all. The authority owns that decision — see\n *   {@link createOrganizationOwnerFloorPopulationContext}.\n * - **The short-circuit is asked HERE, before the context is built.** Constructing the system context\n *   is a registry lookup plus a possible application-id resolution, and suspending an ordinary member\n *   — the overwhelmingly common case — must not pay for it. This is not a second copy of the rule:\n *   {@link membershipTransitionCouldReduceOwners} is the authority's own predicate, and the assertion\n *   below calls it again.\n *\n * Fails closed on a snapshot that carries no `roles` or no `organizationId`, for the reason the\n * application twin does: answering \"not an owner\" would fail OPEN on exactly the input the guard\n * exists for, and a suspended last owner cannot be reactivated by anyone — `ORGANIZATION_MEMBERS`\n * declares exactly one cross-tenant variant — `grantOwnership` — so recovery from a stranded state\n * is a platform-operator action, never a tenant one. That is why the in-tenant refusal still stands.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — a membership-lifecycle change\n * must not retire a tenant's last accountable administrative principal.\n */\nexport async function assertStatusTransitionPreservesOrganizationOwnerFloor(params: {\n  definition: ResourceStatusTransitionDefinition;\n  currentRow: StatusBearingRow;\n  /** The status the patch is about to write — read from the patch, not re-derived. */\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n  conferringRoles: readonly string[];\n  /** Resolved lazily and only once a reduction is established — see the header. */\n  resolveAuthExecutionContextFactory: () => AuthExecutionContextFactoryBackendService;\n}): Promise<void> {\n  const {\n    definition, currentRow, nextStatus, executionContext, utils, conferringRoles,\n    resolveAuthExecutionContextFactory,\n  } = params;\n\n  const organizationId = typeof currentRow.organizationId === 'string' ? currentRow.organizationId : undefined;\n\n  if (!Array.isArray(currentRow.roles) || !organizationId) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n      context: {\n        message:\n          'Refused: the roles or the owning organization of the membership being changed could not be '\n          + \"read, so it cannot be proven that this transition would not retire the organization's last \"\n          + 'usable owner.',\n        reason: 'resource_status_transition_subject_authority_unreadable',\n        resourceType: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        resourceId: currentRow._id,\n      },\n    });\n  }\n\n  const transition = {\n    previousRoles: currentRow.roles,\n    previousStatus: currentRow.status,\n    // Unchanged by construction: these verbs write `status` and at most a schedule, never `roles`.\n    nextRoles: currentRow.roles,\n    nextStatus,\n    conferringRoles,\n  };\n\n  if (!membershipTransitionCouldReduceOwners(transition)) return;\n\n  await assertOrganizationOwnerFloorPreservedForTransition({\n    ...transition,\n    memberId: currentRow._id,\n    organizationId,\n    executionContext: await createOrganizationOwnerFloorPopulationContext(resolveAuthExecutionContextFactory()),\n    repositoriesRegistry: utils.repositoriesRegistry,\n    errorBuilder: utils.errorBuilder,\n    operationIdentifier: definition.operationIdentifier,\n  });\n}\n\n/**\n * One administrative floor a status transition must not breach, bound to a single definition.\n *\n * A list rather than a chain of `if`s inside the hook, because the set of floors that govern a row is\n * a property of the RESOURCE and is therefore decidable once, at factory construction, from static\n * data. Adding the next authority is one entry here — and, more to the point, a lifecycle verb added\n * to a governed resource inherits every floor automatically instead of depending on somebody\n * remembering to wire it. That omission is the whole defect class this file now closes.\n */\ntype StatusTransitionFloorGuard = (params: {\n  currentRow: StatusBearingRow;\n  nextStatus: unknown;\n  executionContext: ExecutionContext<any>;\n  utils: ResourceOperation_CustomImplementation_Utils;\n}) => Promise<void>;\n\n/**\n * The floors that govern one definition's resource, resolved once when the factory is built.\n *\n * Every collaborator is bound LAZILY. Factories are constructed during module registration, which can\n * run before the authorization and authentication services are bound, so an eager `container.get`\n * would turn a guard into a startup crash. The conferral resolvers additionally re-read the live role\n * table on every call, because `initializeRolesWithCustom` mutates it in place.\n *\n * A resource governed by NO floor gets an empty list and pays nothing at all — not a container\n * lookup, not a closure invocation. That is the common case (organization units, and every\n * application resource that grows a lifecycle verb later).\n */\nfunction resolveStatusTransitionFloorGuards(\n  definition: ResourceStatusTransitionDefinition,\n  container: Container,\n): StatusTransitionFloorGuard[] {\n  const guards: StatusTransitionFloorGuard[] = [];\n\n  if (isSuperAdminFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const superAdminConferralResolver = createSuperAdminConferralResolver(container);\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesSuperAdminFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: superAdminConferralResolver(),\n      }));\n  }\n\n  // ── USERS lifecycle: REPORT, never refuse ──────────────────────────────────────────────────\n  // A deactivated user stops counting as a usable owner, so this transition can strand a tenant —\n  // and unlike every other floor surface it must still be allowed to proceed. Suspension is normally\n  // incident response, and refusing it would mean an operator cannot lock out a compromised owner\n  // without first transferring ownership using the tenant the attacker controls. The stranded tenant\n  // is recoverable (boot report finds it, `grantOwnership` repairs it); the live hostile session is\n  // not. See `reportOrganizationsStrandedByUserDeactivation` for the full argument.\n  if (isOrganizationOwnerFloorGovernedSubjectResource(definition.resourceIdentifier)) {\n    const strandingConferralResolver = createOrganizationOwnerConferralResolver(container);\n    guards.push(async ({ currentRow, nextStatus, executionContext, utils }) => {\n      await reportOrganizationsStrandedByUserDeactivation({\n        subjectUserId: String(currentRow._id),\n        nextStatus,\n        executionContext,\n        repositoriesRegistry: utils.repositoriesRegistry,\n        errorBuilder: utils.errorBuilder,\n        conferringRoles: strandingConferralResolver(),\n        operationIdentifier: definition.operationIdentifier,\n        report: async (breach) => {\n          // An AUDIT ROW, not a log line — one per stranded tenant. The justification for allowing\n          // this write at all is that the consequence becomes visible, and a log line is not\n          // queryable evidence and never reaches a SIEM. `CRITICAL` + the AUTHORIZATION category\n          // route it through the same export path as every other authority event.\n          await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n            .logOrganizationOwnerFloorBreached({\n              organizationId: breach.organizationId,\n              // A guard SAW this one and let it through, which is what separates it from the boot\n              // report's observation of a tenant stranded out-of-band.\n              detectedBy: AdministrativeContinuityBreachDetection.ALLOWED_LIFECYCLE_ACTION,\n              reducedMemberIds: breach.reducedMemberIds,\n              remainingUsableOwners: breach.remainingUsableOwners,\n              operationIdentifier: definition.operationIdentifier,\n              subjectUserId: String(currentRow._id),\n              subjectNextStatus: String(nextStatus),\n            }, executionContext);\n\n          // The log line stays as the operator-facing half: an audit row is for the auditor, and\n          // whoever is on call during an incident is reading logs, not the trail.\n          utils.logger?.error?.(\n            'Organization left with no administratively usable owner by a user lifecycle transition',\n            {\n              reason: 'organization_owner_floor_stranded_by_user_deactivation',\n              organizationId: breach.organizationId,\n              subjectUserId: String(currentRow._id),\n              remedy: 'organizationMembers.grantOwnership (platform-tier) restores an owner.',\n            },\n          );\n        },\n      });\n    });\n  }\n\n  if (isOrganizationOwnerFloorAuthorityBearingResource(definition.resourceIdentifier)) {\n    const ownerConferralResolver = createOrganizationOwnerConferralResolver(container);\n    let authExecutionContextFactory: AuthExecutionContextFactoryBackendService | undefined;\n    const resolveAuthExecutionContextFactory = (): AuthExecutionContextFactoryBackendService =>\n      (authExecutionContextFactory ??= container.get<AuthExecutionContextFactoryBackendService>(\n        SAAS_SERVICE_TYPES.AuthExecutionContextFactory,\n      ));\n\n    guards.push(({ currentRow, nextStatus, executionContext, utils }) =>\n      assertStatusTransitionPreservesOrganizationOwnerFloor({\n        definition,\n        currentRow,\n        nextStatus,\n        executionContext,\n        utils,\n        conferringRoles: ownerConferralResolver(),\n        resolveAuthExecutionContextFactory,\n      }));\n  }\n\n  return guards;\n}\n\n/**\n * One lifecycle transition, as a registrable custom implementation.\n *\n * Modelled on `createOrganizationUnitStatusTransitionFactory`, which established the pattern for\n * this engine: validate against the loaded row, then RETURN the field patch for the core UPDATE to\n * persist rather than writing directly. The difference is that this one is resource-agnostic and\n * declares `authoritativeFields`, which the org-units original did not need — its `status` is not\n * `.excludeFromUpdate()`, so its patch survived on the introduced-key inference alone.\n */\nexport function createResourceStatusTransitionFactory(\n  definition: ResourceStatusTransitionDefinition,\n): ResourceCustomServiceImplementationFactory {\n  const authoredFields = resolveStatusTransitionAuthoredFields(definition);\n\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) => {\n    const floorGuards = resolveStatusTransitionFloorGuards(definition, container);\n\n    return createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: definition.resourceIdentifier,\n        operationIdentifier: definition.operationIdentifier,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      } as ResourceConfiguration_OperationPath<any, any>,\n      debugLabel:\n        definition.debugLabel\n        ?? `${String(definition.resourceIdentifier)}.${definition.operationIdentifier}.status-transition`,\n      // `status` and `scheduledReactivationAt` are `.excludeFromUpdate()` on every resource this\n      // serves. Without this the repository's strict re-parse drops the patch for any caller who\n      // reached the service tier with the key already present, and the verb answers success having\n      // changed nothing — the exact defect it was written to fix.\n      authoritativeFields: authoredFields,\n      // The audit row is registered from the PREFIX (the only phase that can see the caller's\n      // `reason`) and executes on COMMIT, so it never describes a write that rolled back. That\n      // needs a commit hook to exist, which is what this declares.\n      //\n      // No participants: the transition writes exactly one row, on the operation's own resource,\n      // which the framework includes automatically. Contrast the ORGANIZATIONS lifecycle verbs,\n      // which name ORGANIZATION_MEMBERS + USERS because they reconcile membership-derived global\n      // `userTypes` in the same unit of work.\n      //\n      // This does NOT change any deployment's transaction posture: the core engine already\n      // declares transaction-requiring boundaries unconditionally (organization\n      // activate/suspend/request_deletion/restore, organization-units MOVE, platform-access\n      // grants, organization-member writes), so `validateInitializedRuntimeTransactionReadiness`\n      // already probes every adapter at startup and a store that cannot commit already fails\n      // there — see the `rejects transaction readiness against a standalone MongoDB server` pin.\n      transactionalCore: true,\n      transactionParticipants: {},\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          // Fail closed on anything but a single addressed row. An ids array or a population filter\n          // reaching this path would make the status check evaluate against the wrong thing — or\n          // against nothing — while still returning a patch the core write would happily apply.\n          //\n          // A conditional `{ _id, … }` filter is single-subject and therefore admitted: `_id` names the\n          // row the pre-fetched `currentObject` below describes, and the extra predicates only decide\n          // whether the core write lands. Refusing it used to make status transitions the ONE verb\n          // family that could not be written as a compare-and-swap.\n          const subjectResourceId = resolveSingleSubjectId(_id);\n          if (subjectResourceId === undefined) {\n            throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n              context: {\n                message:\n                  `${definition.operationIdentifier} requires a single addressed resource to validate `\n                  + 'the status transition',\n                reason: 'resource_status_transition_unaddressed',\n                resourceType: definition.resourceIdentifier,\n                receivedAddressing: describeUnaddressableShape(_id),\n              },\n            });\n          }\n\n          assertNoAuthoredFieldInRequest(input, authoredFields, definition, executionContext, utils);\n\n          // The framework pre-fetches the target row for UPDATE-like operations, so this is the row\n          // the write is about to land on. Absent means the transition cannot be validated — which\n          // must never read as \"allowed\" on an access-affecting verb.\n          const currentRow = utils.currentObject as StatusBearingRow | undefined;\n          if (!currentRow) {\n            throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n              context: {\n                reason: 'resource_status_transition_target_not_found',\n                resourceType: definition.resourceIdentifier,\n                operationIdentifier: definition.operationIdentifier,\n                resourceId: subjectResourceId,\n              },\n            });\n          }\n\n          const patch = buildStatusTransitionPatch({\n            definition,\n            currentRow: { ...currentRow, _id: subjectResourceId },\n            input,\n            executionContext,\n            utils,\n          });\n\n          // AFTER the transition-legality check on purpose: a verb refused because it cannot run\n          // from the current status should say so — the more specific finding — and should not\n          // have issued a floor's population query on the way to being rejected anyway.\n          for (const assertFloorPreserved of floorGuards) {\n            await assertFloorPreserved({\n              currentRow: { ...currentRow, _id: subjectResourceId },\n              // Read from the patch rather than re-derived from the definition, so no guard can\n              // measure a status other than the one about to be persisted.\n              nextStatus: patch[STATUS_FIELD],\n              executionContext,\n              utils,\n            });\n          }\n\n          // Trail the transition. Registered HERE — the only phase that can see the caller's\n          // `reason`, since the POSTFIX input is typed `z.infer<TOutput>` (the persisted row) and\n          // `reason` is not a schema column, so it appears on neither.\n          //\n          // It EXECUTES on commit, so it never describes a write that rolled back. That is why the\n          // registration declares `transactionalCore` above: without a commit hook the choice would\n          // be between emitting early (recording suspensions that later failed) and emitting from a\n          // postfix that cannot see the reason. With one, neither compromise is necessary.\n          //\n          // `targetStatus` is the persisted fact once this commits, not merely the intent: `status`\n          // is declared in `authoritativeFields`, so the patch cannot be stripped by the strict\n          // re-parse, and the startup guard proves every declared name is a real persisted field.\n          // Fail CLOSED on a missing transaction rather than skipping the trail. This registration\n          // declares `transactionalCore`, so the framework guarantees one; its absence means that\n          // contract is broken, and silently proceeding would perform an access-affecting\n          // transition with no record — the outcome the audit exists to make impossible. Same shape\n          // as `registerOrganizationLifecycleAudit` on the tenant verbs.\n          const transaction = utils.serviceOptions?.transaction;\n          if (!transaction) {\n            throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n              customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n              context: {\n                message:\n                  'A status transition cannot be recorded: no transaction is active, but this '\n                  + 'operation declares transactionalCore.',\n                reason: 'resource_status_transition_audit_requires_transaction',\n                resourceType: String(definition.resourceIdentifier),\n                operationIdentifier: String(definition.operationIdentifier),\n              },\n            });\n          }\n\n          registerTransactionPostCommitEffect(transaction, {\n            key: `resource-status-transition:${String(definition.resourceIdentifier)}`\n              + `:${definition.operationIdentifier}:${subjectResourceId}`,\n            execute: async () => {\n              try {\n                await container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService)\n                  .logResourceStatusTransitionPerformed({\n                    resourceType: String(definition.resourceIdentifier),\n                    operationIdentifier: String(definition.operationIdentifier),\n                    subjectId: subjectResourceId,\n                    performedBy: String(executionContext?.initiatorIds?.userId ?? 'system'),\n                    previousStatus: String((currentRow as { status?: unknown }).status ?? ''),\n                    newStatus: definition.targetStatus,\n                    isRestricting: definition.restrictsAccess,\n                    // The field decision D2 promised the trail would carry. Both spellings are\n                    // accepted because the verbs differ: `suspend` names it `suspensionReason`,\n                    // the rest `reason`.\n                    reason: resolveAuthoredTransitionReason(input),\n                    scheduledReactivationAt:\n                      patch[SCHEDULED_REACTIVATION_FIELD] instanceof Date\n                        ? patch[SCHEDULED_REACTIVATION_FIELD] as Date\n                        : undefined,\n                    organizationId:\n                      ((currentRow as { organizationId?: unknown }).organizationId as string | undefined)\n                      ?? executionContext?.initiatorIds?.organizationId,\n                  }, executionContext);\n              } catch (error) {\n                // A trail failure must not fail the transition it describes — but it must be loud,\n                // so a dropped record reaches whoever is on call rather than vanishing.\n                utils.logger?.error?.('Failed to record a status-transition audit event', {\n                  reason: 'resource_status_transition_audit_emission_failed',\n                  resourceType: String(definition.resourceIdentifier),\n                  operationIdentifier: String(definition.operationIdentifier),\n                  error: describeCaughtError(error),\n                });\n              }\n            },\n          });\n\n          return patch;\n        },\n      },\n    });\n  };\n\n  return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n/** Build every registration for a resource's lifecycle verbs in one call. */\nexport function createResourceStatusTransitionFactories(\n  definitions: readonly ResourceStatusTransitionDefinition[],\n): ResourceCustomServiceImplementationFactory[] {\n  return definitions.map(createResourceStatusTransitionFactory);\n}\n"]}

package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-status-transition.definitions.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.definitions.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,OAAO,EAIL,KAAK,kCAAkC,EACxC,MAAM,0GAA0G,CAAC;AAClH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AA2I7K;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,EAAE,SAAS,kCAAkC,EAI7F,CAAC;AAEF,wBAAgB,6CAA6C,IAAI,0CAA0C,EAAE,CAE5G"}
+{"version":3,"file":"resource-status-transition.definitions.backend.d.ts","sourceRoot":"","sources":["../../../../../src/base-classes/services/services/resource-status-transition.definitions.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,OAAO,EAIL,KAAK,kCAAkC,EACxC,MAAM,0GAA0G,CAAC;AAClH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AA2I7K;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,EAAE,SAAS,kCAAkC,EAI7F,CAAC;AAEF,wBAAgB,6CAA6C,IAAI,0CAA0C,EAAE,CAE5G"}

package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-status-transition.definitions.backend.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.definitions.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,8BAA8B,EAC9B,mBAAmB,EACnB,UAAU,EACV,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,GAExC,MAAM,0GAA0G,CAAC;AAGlH;;;;;;;;;;;;GAYG;AACH,MAAM,+BAA+B,GAAyC;IAC5E;QACE,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;QACzD,mBAAmB,EAAE,8BAA8B,CAAC,OAAO;QAC3D,YAAY,EAAE,wBAAwB,CAAC,SAAS;QAChD,mBAAmB,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC;QACtD,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE;YACV,IAAI,EAAE,4BAA4B,CAAC,GAAG;YACtC,YAAY,EAAE,mBAAmB;YACjC,MAAM,EAAE,8BAA8B,CAAC,aAAa;SACrD;KACF;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;QACzD,mBAAmB,EAAE,8BAA8B,CAAC,UAAU;QAC9D,YAAY,EAAE,wBAAwB,CAAC,MAAM;QAC7C,mBAAmB,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC;QACzD,eAAe,EAAE,KAAK;QACtB,+FAA+F;QAC/F,8EAA8E;QAC9E,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,KAAK,EAAE;KACzD;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAyC;IAC7D;QACE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;QAC1C,mBAAmB,EAAE,gBAAgB,CAAC,YAAY;QAClD,YAAY,EAAE,UAAU,CAAC,SAAS;QAClC,mBAAmB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE;YACV,IAAI,EAAE,4BAA4B,CAAC,GAAG;YACtC,YAAY,EAAE,oBAAoB;YAClC,MAAM,EAAE,8BAA8B,CAAC,gBAAgB;SACxD;KACF;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;QAC1C,mBAAmB,EAAE,gBAAgB,CAAC,cAAc;QACpD,YAAY,EAAE,UAAU,CAAC,MAAM;QAC/B,mBAAmB,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3C,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,KAAK,EAAE;KACzD;IACD;;;;;;;;;;;;;OAaG;IACH;QACE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;QAC1C,mBAAmB,EAAE,gBAAgB,CAAC,eAAe;QACrD,YAAY,EAAE,UAAU,CAAC,MAAM;QAC/B,mBAAmB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,eAAe,EAAE,KAAK;QACtB,gGAAgG;QAChG,oFAAoF;QACpF,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,KAAK,EAAE;KACzD;CACF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,qBAAqB,GAAyC;IAClE;QACE,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;QAC9C,mBAAmB,EAAE,mBAAmB,CAAC,kBAAkB;QAC3D,YAAY,EAAE,UAAU,CAAC,MAAM;QAC/B,yFAAyF;QACzF,kFAAkF;QAClF,mBAAmB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,eAAe,EAAE,KAAK;QACtB,8FAA8F;QAC9F,qEAAqE;QACrE,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,KAAK,EAAE;KACzD;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;QAC9C,mBAAmB,EAAE,mBAAmB,CAAC,kBAAkB;QAC3D,YAAY,EAAE,UAAU,CAAC,QAAQ;QACjC,6FAA6F;QAC7F,uBAAuB;QACvB,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,0FAA0F;QAC1F,+FAA+F;QAC/F,6FAA6F;QAC7F,WAAW;KACZ;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAkD;IACjG,GAAG,+BAA+B;IAClC,GAAG,gBAAgB;IACnB,GAAG,qBAAqB;CACzB,CAAC;AAEF,MAAM,UAAU,6CAA6C;IAC3D,OAAO,uCAAuC,CAAC,CAAC,GAAG,oCAAoC,CAAC,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["/**\n * The engine's account/entity lifecycle transitions, declared as data.\n *\n * Each entry is one verb the 2026-08-01 sweep found ROUTED but unimplemented: it declared a request\n * contract, persisted nothing, and answered HTTP 200. They share one implementation\n * (`createResourceStatusTransitionFactory`) because they differ only in which status they write and\n * which they accept as a starting point — so declaring them as data keeps the whole state machine\n * readable in one place instead of spread across seven hand-rolled hooks.\n *\n * `allowedFromStatuses` MIRRORS each operation's `enabledCondition`. Keep the two in step: the gate\n * is the fast user-facing rejection, this is the backstop that cannot be routed around. Where an\n * operation declares no gate yet, the set here is still authoritative and the gate should be added\n * to match.\n */\n\nimport {\n  CoreResourceType,\n  OrganizationMemberStatus,\n  OrganizationMembers_Operations,\n  UserSelf_Operations,\n  UserStatus,\n  Users_Operations,\n} from '@wildo-ai/saas-models';\nimport {\n  StatusTransitionScheduleMode,\n  StatusTransitionScheduleSource,\n  createResourceStatusTransitionFactories,\n  type ResourceStatusTransitionDefinition,\n} from '~wildo-backend-lib/base-classes/services/services/resource-status-transition.custom-impl.backend.service';\nimport type { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\n\n/**\n * ORGANIZATION MEMBER suspension.\n *\n * The clearest case in the catalogue: `OrganizationMemberSchema.status` is\n * `.excludeFromCreate().excludeFromUpdate()` and its JSDoc has always named these two verbs as the\n * intended mechanism — so unlike the user-side verbs there was never an alternative path, only a\n * missing implementation.\n *\n * SUSPEND runs from ACTIVE only. An INVITED row has not accepted yet (cancel it with REVOKE, which\n * also revokes the accept token), and an INACTIVE one is already out. REACTIVATE runs from\n * SUSPENDED only — reactivating an INVITED row would silently skip acceptance and grant membership\n * nobody agreed to.\n */\nconst ORGANIZATION_MEMBER_TRANSITIONS: ResourceStatusTransitionDefinition[] = [\n  {\n    resourceIdentifier: CoreResourceType.ORGANIZATION_MEMBERS,\n    operationIdentifier: OrganizationMembers_Operations.SUSPEND,\n    targetStatus: OrganizationMemberStatus.SUSPENDED,\n    allowedFromStatuses: [OrganizationMemberStatus.ACTIVE],\n    restrictsAccess: true,\n    scheduling: {\n      mode: StatusTransitionScheduleMode.SET,\n      requestField: 'suspensionEndDate',\n      source: StatusTransitionScheduleSource.ABSOLUTE_DATE,\n    },\n  },\n  {\n    resourceIdentifier: CoreResourceType.ORGANIZATION_MEMBERS,\n    operationIdentifier: OrganizationMembers_Operations.REACTIVATE,\n    targetStatus: OrganizationMemberStatus.ACTIVE,\n    allowedFromStatuses: [OrganizationMemberStatus.SUSPENDED],\n    restrictsAccess: false,\n    // Clearing matters: a membership reactivated by hand must not keep the date at which the sweep\n    // would have reactivated it, or a later suspension inherits a stale deadline.\n    scheduling: { mode: StatusTransitionScheduleMode.CLEAR },\n  },\n];\n\n/**\n * ADMIN USER suspension.\n *\n * `suspend_user` takes its window in DAYS, which is why the shared implementation supports a\n * duration source at all: a duration has no meaning without the moment it is counted from, and the\n * row records no such moment, so it is resolved to an instant at write time.\n *\n * Both verbs already declare a matching `enabledCondition`.\n */\nconst USER_TRANSITIONS: ResourceStatusTransitionDefinition[] = [\n  {\n    resourceIdentifier: CoreResourceType.USERS,\n    operationIdentifier: Users_Operations.SUSPEND_USER,\n    targetStatus: UserStatus.SUSPENDED,\n    allowedFromStatuses: [UserStatus.ACTIVE],\n    restrictsAccess: true,\n    scheduling: {\n      mode: StatusTransitionScheduleMode.SET,\n      requestField: 'suspensionDuration',\n      source: StatusTransitionScheduleSource.DURATION_IN_DAYS,\n    },\n  },\n  {\n    resourceIdentifier: CoreResourceType.USERS,\n    operationIdentifier: Users_Operations.UNSUSPEND_USER,\n    targetStatus: UserStatus.ACTIVE,\n    allowedFromStatuses: [UserStatus.SUSPENDED],\n    restrictsAccess: false,\n    scheduling: { mode: StatusTransitionScheduleMode.CLEAR },\n  },\n  /*\n   * The administrative door back from a SELF-deactivated account (#430).\n   *\n   * `allowedFromStatuses` is INACTIVE and NOT SUSPENDED, and the pair above is why: an imposed halt\n   * and a chosen departure are lifted by different verbs on purpose, so `reactivate_user` and\n   * `unsuspend_user` have DISJOINT source states. A single verb covering both was the rejected\n   * option — it reads as a simplification and erases the one distinction these two states carry.\n   *\n   * Routing it through this factory is also what makes the write land: `status` is\n   * `.excludeFromUpdate()`, so an operation writing it directly persists nothing and reports\n   * success. The factory is the SYSTEM door, and it is also what emits the transition audit row and\n   * runs the administrative-continuity floors — the three things a config-level status prefix\n   * silently skipped when `REACTIVATE_ACCOUNT` was implemented that way.\n   */\n  {\n    resourceIdentifier: CoreResourceType.USERS,\n    operationIdentifier: Users_Operations.REACTIVATE_USER,\n    targetStatus: UserStatus.ACTIVE,\n    allowedFromStatuses: [UserStatus.INACTIVE],\n    restrictsAccess: false,\n    // Clears any residual deadline, so a reinstated account cannot inherit scheduling state from an\n    // earlier administrative suspension. Same reason as the self-service inverse below.\n    scheduling: { mode: StatusTransitionScheduleMode.CLEAR },\n  },\n];\n\n/**\n * SELF-SERVICE account deactivation.\n *\n * The voluntary counterpart to admin suspension, on the other door onto the same rows. It writes\n * INACTIVE rather than SUSPENDED — the distinction is the whole point: SUSPENDED is imposed and\n * only an admin lifts it, INACTIVE is chosen and the user lifts it themselves through\n * REACTIVATE_ACCOUNT.\n *\n * REACTIVATE_ACCOUNT is the inverse, and runs through this factory too. It used to be a\n * config-level `basicPrefixOperation` forcing `{status: ACTIVE}`, which left the pair asymmetric in\n * three ways: the pending `scheduledReactivationAt` was never cleared, no transition audit row was\n * emitted (the departure recorded, the return not), and the administrative-continuity floors did\n * not run. The hook was REPLACED rather than supplemented — two implementations on one operation\n * path is exactly the drift this factory exists to prevent.\n */\nconst USER_SELF_TRANSITIONS: ResourceStatusTransitionDefinition[] = [\n  {\n    resourceIdentifier: CoreResourceType.USER_SELF,\n    operationIdentifier: UserSelf_Operations.REACTIVATE_ACCOUNT,\n    targetStatus: UserStatus.ACTIVE,\n    // From INACTIVE only. A SUSPENDED account was halted by an administrator and must not be\n    // liftable by the subject — that is the whole distinction between the two states.\n    allowedFromStatuses: [UserStatus.INACTIVE],\n    restrictsAccess: false,\n    // Clears a defensive residual deadline, so returning to ACTIVE cannot retain scheduling state\n    // from an earlier administrative suspension or historical row shape.\n    scheduling: { mode: StatusTransitionScheduleMode.CLEAR },\n  },\n  {\n    resourceIdentifier: CoreResourceType.USER_SELF,\n    operationIdentifier: UserSelf_Operations.DEACTIVATE_ACCOUNT,\n    targetStatus: UserStatus.INACTIVE,\n    // Voluntary, but it still removes the subject's own access — the trail grades by EFFECT, not\n    // by who asked for it.\n    restrictsAccess: true,\n    allowedFromStatuses: [UserStatus.ACTIVE],\n    // NO scheduling. The verb's `reactivationDate` was removed rather than left accepted-and-\n    // unhonoured — see the config for why no door exists that a system principal could use to lift\n    // `INACTIVE`. Admin suspension keeps its window; voluntary deactivation is lifted by its own\n    // subject.\n  },\n];\n\n/**\n * Every engine lifecycle transition served by the SHARED implementation.\n *\n * ## `ORGANIZATIONS` is deliberately absent — do NOT add it here\n *\n * The tenant lifecycle verbs (`activate`, `suspend`, `request_deletion`, `restore`) are implemented\n * in `organization-custom-implementation.backend.service.ts` with their own registrations, and that\n * is the correct split rather than an oversight: a tenant transition is `transactionalCore` across\n * THREE resources, because suspending an organization must revoke the membership-derived GLOBAL\n * `userTypes` its members held on its behalf, and activating must re-grant them from configuration.\n * They also carry domain facts this factory has no notion of (`revokedUserTypeCount` /\n * `regrantedUserTypeCount`), and `request_deletion` additionally writes `deletionRequestedAt` +\n * `purgeScheduledAt`.\n *\n * This factory's contract is \"validate the transition, return `{status}` plus at most a schedule\".\n * Nothing about that expresses a multi-resource re-grant, so folding the tenant verbs in would\n * either gut them or turn this into a general-purpose orchestrator — and adding definitions for\n * them HERE while those registrations exist would give one operation path two implementations,\n * which is the drift this factory was written to prevent.\n *\n * The shared mechanism they DO use is the one that matters: every tenant registration declares\n * `authoritativeFields`, so their patches survive the repository's strict re-parse for the same\n * reason these do.\n */\n/**\n * Every engine transition, as DATA.\n *\n * Exported so a test can assert a property OF THE SHIPPED TABLE rather than of a fixture it wrote\n * itself. That distinction is not academic: the first version of the #430 disjointness pin declared\n * its own two definitions and asserted they did not overlap, which stayed green when the production\n * `unsuspend_user` was widened to accept `INACTIVE` — the exact change it existed to forbid. A pin\n * that cannot see the table cannot pin the table.\n */\nexport const ENGINE_STATUS_TRANSITION_DEFINITIONS: readonly ResourceStatusTransitionDefinition[] = [\n  ...ORGANIZATION_MEMBER_TRANSITIONS,\n  ...USER_TRANSITIONS,\n  ...USER_SELF_TRANSITIONS,\n];\n\nexport function createEngineResourceStatusTransitionFactories(): ResourceCustomServiceImplementationFactory[] {\n  return createResourceStatusTransitionFactories([...ENGINE_STATUS_TRANSITION_DEFINITIONS]);\n}\n"]}
+{"version":3,"file":"resource-status-transition.definitions.backend.js","sourceRoot":"","sources":["../../../../../src/base-classes/services/services/resource-status-transition.definitions.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,8BAA8B,EAC9B,mBAAmB,EACnB,UAAU,EACV,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,GAExC,MAAM,0GAA0G,CAAC;AAGlH;;;;;;;;;;;;GAYG;AACH,MAAM,+BAA+B,GAAyC;IAC5E;QACE,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;QACzD,mBAAmB,EAAE,8BAA8B,CAAC,OAAO;QAC3D,YAAY,EAAE,wBAAwB,CAAC,SAAS;QAChD,mBAAmB,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC;QACtD,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE;YACV,IAAI,EAAE,4BAA4B,CAAC,GAAG;YACtC,YAAY,EAAE,mBAAmB;YACjC,MAAM,EAAE,8BAA8B,CAAC,aAAa;SACrD;KACF;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;QACzD,mBAAmB,EAAE,8BAA8B,CAAC,UAAU;QAC9D,YAAY,EAAE,wBAAwB,CAAC,MAAM;QAC7C,mBAAmB,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC;QACzD,eAAe,EAAE,KAAK;QACtB,+FAA+F;QAC/F,8EAA8E;QAC9E,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,KAAK,EAAE;KACzD;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAyC;IAC7D;QACE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;QAC1C,mBAAmB,EAAE,gBAAgB,CAAC,YAAY;QAClD,YAAY,EAAE,UAAU,CAAC,SAAS;QAClC,mBAAmB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE;YACV,IAAI,EAAE,4BAA4B,CAAC,GAAG;YACtC,YAAY,EAAE,oBAAoB;YAClC,MAAM,EAAE,8BAA8B,CAAC,gBAAgB;SACxD;KACF;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;QAC1C,mBAAmB,EAAE,gBAAgB,CAAC,cAAc;QACpD,YAAY,EAAE,UAAU,CAAC,MAAM;QAC/B,mBAAmB,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3C,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,KAAK,EAAE;KACzD;IACD;;;;;;;;;;;;;OAaG;IACH;QACE,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;QAC1C,mBAAmB,EAAE,gBAAgB,CAAC,eAAe;QACrD,YAAY,EAAE,UAAU,CAAC,MAAM;QAC/B,mBAAmB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,eAAe,EAAE,KAAK;QACtB,gGAAgG;QAChG,oFAAoF;QACpF,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,KAAK,EAAE;KACzD;CACF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,qBAAqB,GAAyC;IAClE;QACE,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;QAC9C,mBAAmB,EAAE,mBAAmB,CAAC,kBAAkB;QAC3D,YAAY,EAAE,UAAU,CAAC,MAAM;QAC/B,yFAAyF;QACzF,kFAAkF;QAClF,mBAAmB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,eAAe,EAAE,KAAK;QACtB,8FAA8F;QAC9F,qEAAqE;QACrE,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,KAAK,EAAE;KACzD;IACD;QACE,kBAAkB,EAAE,gBAAgB,CAAC,SAAS;QAC9C,mBAAmB,EAAE,mBAAmB,CAAC,kBAAkB;QAC3D,YAAY,EAAE,UAAU,CAAC,QAAQ;QACjC,6FAA6F;QAC7F,uBAAuB;QACvB,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,0FAA0F;QAC1F,+FAA+F;QAC/F,6FAA6F;QAC7F,WAAW;KACZ;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAkD;IACjG,GAAG,+BAA+B;IAClC,GAAG,gBAAgB;IACnB,GAAG,qBAAqB;CACzB,CAAC;AAEF,MAAM,UAAU,6CAA6C;IAC3D,OAAO,uCAAuC,CAAC,CAAC,GAAG,oCAAoC,CAAC,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["/**\n * The engine's account/entity lifecycle transitions, declared as data.\n *\n * Each entry is one verb the 2026-08-01 sweep found ROUTED but unimplemented: it declared a request\n * contract, persisted nothing, and answered HTTP 200. They share one implementation\n * (`createResourceStatusTransitionFactory`) because they differ only in which status they write and\n * which they accept as a starting point — so declaring them as data keeps the whole state machine\n * readable in one place instead of spread across seven hand-rolled hooks.\n *\n * `allowedFromStatuses` MIRRORS each operation's `enabledCondition`. Keep the two in step: the gate\n * is the fast user-facing rejection, this is the backstop that cannot be routed around. Where an\n * operation declares no gate yet, the set here is still authoritative and the gate should be added\n * to match.\n */\n\nimport {\n  CoreResourceType,\n  OrganizationMemberStatus,\n  OrganizationMembers_Operations,\n  UserSelf_Operations,\n  UserStatus,\n  Users_Operations,\n} from '@wildo-ai/saas-models';\nimport {\n  StatusTransitionScheduleMode,\n  StatusTransitionScheduleSource,\n  createResourceStatusTransitionFactories,\n  type ResourceStatusTransitionDefinition,\n} from '~wildo-backend-lib/base-classes/services/services/resource-status-transition.custom-impl.backend.service';\nimport type { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\n\n/**\n * ORGANIZATION MEMBER suspension.\n *\n * The clearest case in the catalogue: `OrganizationMemberSchema.status` is\n * `.excludeFromCreate().excludeFromUpdate()` and its JSDoc has always named these two verbs as the\n * intended mechanism — so unlike the user-side verbs there was never an alternative path, only a\n * missing implementation.\n *\n * SUSPEND runs from ACTIVE only. An INVITED row has not accepted yet (cancel it with REVOKE, which\n * also revokes the accept token), and an INACTIVE one is already out. REACTIVATE runs from\n * SUSPENDED only — reactivating an INVITED row would silently skip acceptance and grant membership\n * nobody agreed to.\n */\nconst ORGANIZATION_MEMBER_TRANSITIONS: ResourceStatusTransitionDefinition[] = [\n  {\n    resourceIdentifier: CoreResourceType.ORGANIZATION_MEMBERS,\n    operationIdentifier: OrganizationMembers_Operations.SUSPEND,\n    targetStatus: OrganizationMemberStatus.SUSPENDED,\n    allowedFromStatuses: [OrganizationMemberStatus.ACTIVE],\n    restrictsAccess: true,\n    scheduling: {\n      mode: StatusTransitionScheduleMode.SET,\n      requestField: 'suspensionEndDate',\n      source: StatusTransitionScheduleSource.ABSOLUTE_DATE,\n    },\n  },\n  {\n    resourceIdentifier: CoreResourceType.ORGANIZATION_MEMBERS,\n    operationIdentifier: OrganizationMembers_Operations.REACTIVATE,\n    targetStatus: OrganizationMemberStatus.ACTIVE,\n    allowedFromStatuses: [OrganizationMemberStatus.SUSPENDED],\n    restrictsAccess: false,\n    // Clearing matters: a membership reactivated by hand must not keep the date at which the sweep\n    // would have reactivated it, or a later suspension inherits a stale deadline.\n    scheduling: { mode: StatusTransitionScheduleMode.CLEAR },\n  },\n];\n\n/**\n * ADMIN USER suspension.\n *\n * `suspend_user` takes its window in DAYS, which is why the shared implementation supports a\n * duration source at all: a duration has no meaning without the moment it is counted from, and the\n * row records no such moment, so it is resolved to an instant at write time.\n *\n * Both verbs already declare a matching `enabledCondition`.\n */\nconst USER_TRANSITIONS: ResourceStatusTransitionDefinition[] = [\n  {\n    resourceIdentifier: CoreResourceType.USERS,\n    operationIdentifier: Users_Operations.SUSPEND_USER,\n    targetStatus: UserStatus.SUSPENDED,\n    allowedFromStatuses: [UserStatus.ACTIVE],\n    restrictsAccess: true,\n    scheduling: {\n      mode: StatusTransitionScheduleMode.SET,\n      requestField: 'suspensionDuration',\n      source: StatusTransitionScheduleSource.DURATION_IN_DAYS,\n    },\n  },\n  {\n    resourceIdentifier: CoreResourceType.USERS,\n    operationIdentifier: Users_Operations.UNSUSPEND_USER,\n    targetStatus: UserStatus.ACTIVE,\n    allowedFromStatuses: [UserStatus.SUSPENDED],\n    restrictsAccess: false,\n    scheduling: { mode: StatusTransitionScheduleMode.CLEAR },\n  },\n  /*\n   * The administrative door back from a SELF-deactivated account (#430).\n   *\n   * `allowedFromStatuses` is INACTIVE and NOT SUSPENDED, and the pair above is why: an imposed halt\n   * and a chosen departure are lifted by different verbs on purpose, so `reactivate_user` and\n   * `unsuspend_user` have DISJOINT source states. A single verb covering both was the rejected\n   * option — it reads as a simplification and erases the one distinction these two states carry.\n   *\n   * Routing it through this factory is also what makes the write land: `status` is\n   * `.excludeFromUpdate()`, so an operation writing it directly persists nothing and reports\n   * success. The factory is the SYSTEM door, and it is also what emits the transition audit row and\n   * runs the administrative-continuity floors — the three things a config-level status prefix\n   * silently skipped when `REACTIVATE_ACCOUNT` was implemented that way.\n   */\n  {\n    resourceIdentifier: CoreResourceType.USERS,\n    operationIdentifier: Users_Operations.REACTIVATE_USER,\n    targetStatus: UserStatus.ACTIVE,\n    allowedFromStatuses: [UserStatus.INACTIVE],\n    restrictsAccess: false,\n    // Clears any residual deadline, so a reinstated account cannot inherit scheduling state from an\n    // earlier administrative suspension. Same reason as the self-service inverse below.\n    scheduling: { mode: StatusTransitionScheduleMode.CLEAR },\n  },\n];\n\n/**\n * SELF-SERVICE account deactivation.\n *\n * The voluntary counterpart to admin suspension, on the other door onto the same rows. It writes\n * INACTIVE rather than SUSPENDED — the distinction is the whole point: SUSPENDED is imposed and\n * only an admin lifts it, INACTIVE is chosen and the user lifts it themselves through\n * REACTIVATE_ACCOUNT.\n *\n * REACTIVATE_ACCOUNT is the inverse, and runs through this factory too. It used to be a\n * config-level `basicPrefixOperation` forcing `{status: ACTIVE}`, which left the pair asymmetric in\n * three ways: the pending `scheduledReactivationAt` was never cleared, no transition audit row was\n * emitted (the departure recorded, the return not), and the administrative-continuity floors did\n * not run. The hook was REPLACED rather than supplemented — two implementations on one operation\n * path is exactly the drift this factory exists to prevent.\n */\nconst USER_SELF_TRANSITIONS: ResourceStatusTransitionDefinition[] = [\n  {\n    resourceIdentifier: CoreResourceType.USER_SELF,\n    operationIdentifier: UserSelf_Operations.REACTIVATE_ACCOUNT,\n    targetStatus: UserStatus.ACTIVE,\n    // From INACTIVE only. A SUSPENDED account was halted by an administrator and must not be\n    // liftable by the subject — that is the whole distinction between the two states.\n    allowedFromStatuses: [UserStatus.INACTIVE],\n    restrictsAccess: false,\n    // Clears a defensive residual deadline, so returning to ACTIVE cannot retain scheduling state\n    // from an earlier administrative suspension or historical row shape.\n    scheduling: { mode: StatusTransitionScheduleMode.CLEAR },\n  },\n  {\n    resourceIdentifier: CoreResourceType.USER_SELF,\n    operationIdentifier: UserSelf_Operations.DEACTIVATE_ACCOUNT,\n    targetStatus: UserStatus.INACTIVE,\n    // Voluntary, but it still removes the subject's own access — the trail grades by EFFECT, not\n    // by who asked for it.\n    restrictsAccess: true,\n    allowedFromStatuses: [UserStatus.ACTIVE],\n    // NO scheduling. The verb's `reactivationDate` was removed rather than left accepted-and-\n    // unhonoured — see the config for why no door exists that a system principal could use to lift\n    // `INACTIVE`. Admin suspension keeps its window; voluntary deactivation is lifted by its own\n    // subject.\n  },\n];\n\n/**\n * Every engine lifecycle transition served by the SHARED implementation.\n *\n * ## `ORGANIZATIONS` is deliberately absent — do NOT add it here\n *\n * The tenant lifecycle verbs (`activate`, `suspend`, `request_deletion`, `restore`) are implemented\n * in `organization-custom-implementation.backend.service.ts` with their own registrations, and that\n * is the correct split rather than an oversight: a tenant transition is `transactionalCore` across\n * THREE resources, because suspending an organization must revoke the membership-derived GLOBAL\n * `userTypes` its members held on its behalf, and activating must re-grant them from configuration.\n * They also carry domain facts this factory has no notion of (`revokedUserTypeCount` /\n * `regrantedUserTypeCount`), and `request_deletion` additionally writes `deletionRequestedAt` +\n * `purgeScheduledAt`.\n *\n * This factory's contract is \"validate the transition, return `{status}` plus at most a schedule\".\n * Nothing about that expresses a multi-resource re-grant, so folding the tenant verbs in would\n * either gut them or turn this into a general-purpose orchestrator — and adding definitions for\n * them HERE while those registrations exist would give one operation path two implementations,\n * which is the drift this factory was written to prevent.\n *\n * The shared mechanism they DO use is the one that matters: every tenant registration declares\n * `authoritativeFields`, so their patches survive the repository's strict re-parse for the same\n * reason these do.\n */\n/**\n * Every engine transition, as DATA.\n *\n * Exported so a test can assert a property OF THE SHIPPED TABLE rather than of a fixture it wrote\n * itself. That distinction is not academic: the first version of the #430 disjointness pin declared\n * its own two definitions and asserted they did not overlap, which stayed green when the production\n * `unsuspend_user` was widened to accept `INACTIVE` — the exact change it existed to forbid. A pin\n * that cannot see the table cannot pin the table.\n */\nexport const ENGINE_STATUS_TRANSITION_DEFINITIONS: readonly ResourceStatusTransitionDefinition[] = [\n  ...ORGANIZATION_MEMBER_TRANSITIONS,\n  ...USER_TRANSITIONS,\n  ...USER_SELF_TRANSITIONS,\n];\n\nexport function createEngineResourceStatusTransitionFactories(): ResourceCustomServiceImplementationFactory[] {\n  return createResourceStatusTransitionFactories([...ENGINE_STATUS_TRANSITION_DEFINITIONS]);\n}\n"]}

package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"services-registry-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/services-registry-handler.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAEV,+BAA+B,EAC/B,mCAAmC,EAEpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,YAAY,EACZ,qBAAqB,EAerB,QAAQ,EAQR,oBAAoB,EASpB,8EAA8E,EAQ9E,KAAK,qCAAqC,EAE1C,KAAK,oCAAoC,EAiBzC,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAsE,MAAM,0BAA0B,CAAC;AAG5H,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AASzH,OAAO,EAEL,KAAK,mCAAmC,EAEzC,MAAM,gFAAgF,CAAC;AACxF,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,2FAA2F,CAAC;AACxJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC7I,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EAI1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC1I,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,qFAAqF,CAAC;AACvI,OAAO,EACL,2DAA2D,EAE5D,MAAM,qEAAqE,CAAC;AAY7E,OAAO,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAG1I,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EACjC,MAAM,oFAAoF,CAAC;AAC5F,OAAO,EAGL,gCAAgC,EACjC,MAAM,2EAA2E,CAAC;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sEAAsE,CAAC;AACnH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAK7H,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AACjG,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAIvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAGV,oBAAoB,EACpB,mBAAmB,EAIpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kCAAkC,EAAE,MAAM,0EAA0E,CAAC;AAC9H,OAAO,EAAE,gCAAgC,EAA0B,MAAM,wEAAwE,CAAC;AAElJ,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,8DAA8D,CAAC;AACtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+DAA+D,CAAC;AAChH,OAAO,EAKL,KAAK,0BAA0B,EAChC,MAAM,kEAAkE,CAAC;AAC1E,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mEAAmE,CAAC;AAC9G,OAAO,EACL,6BAA6B,EAC9B,MAAM,yFAAyF,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yFAAyF,CAAC;AACrI,OAAO,EAAE,sCAAsC,EAAE,MAAM,iFAAiF,CAAC;AACzI,OAAO,EAAE,gCAAgC,EAAE,MAAM,0EAA0E,CAAC;AAC5H,OAAO,EAAE,gCAAgC,EAAE,MAAM,0EAA0E,CAAC;AAC5H,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iGAAiG,CAAC;AAClJ,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,uFAAuF,CAAC;AACrJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,uCAAuC,EAA4D,MAAM,uFAAuF,CAAC;AAO1M,UAAU,mCAAmC;IAC3C,iCAAiC,CAAC,wBAAwB,SAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC/G,gBAAgB,EAAE,gBAAgB,CAAC,wBAAwB,CAAC,EAC5D,kBAAkB,EAAE,8EAA8E,GACjG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,+BAA+B,CAAC,wBAAwB,SAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC7G,gBAAgB,EAAE,gBAAgB,CAAC,wBAAwB,CAAC,EAC5D,kBAAkB,EAAE,8EAA8E,EAClG,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,UAAU,qCAAqC;IAC7C,sBAAsB,EAAE,mCAAmC,CAAC;IAC5D,iBAAiB,EAAE,IAAI,CAAC,gCAAgC,EAAE,qBAAqB,GAAG,yBAAyB,CAAC,CAAC;IAC7G,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACxE;AA2RD;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,sBAAsB,EAAE,IAAI,CAAC,6BAA6B,EAAE,wBAAwB,CAAC,CAAC;CACvF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uCAAuC,CAC3D,IAAI,EAAE,4BAA4B,EAClC,eAAe,EAAE,qBAAqB,EACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,qBAAqB,EAAE;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,EACD,WAAW,EAAE,kBAAkB,GAC9B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAUvC;AAED,wBAAsB,4CAA4C,CAChE,IAAI,EAAE,qCAAqC,EAC3C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,SAAS,EAAE,GAAG,EACd,aAAa,EAAE,GAAG,EAClB,qBAAqB,CAAC,EAAE,qBAAqB,GAAG,IAAI,EACpD,aAAa,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CAuEf;AAED,qBACa,qCAAqC;IA0CiB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACX,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC5B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC7C,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc;IAClB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACvB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACxB,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC/B,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACjD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACjG;;;;;OAKG;IACsE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAMlD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAMzD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOpB,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAS1F,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IA3G/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkE;IAC3F,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAIlC;IAEH,OAAO,CAAC,aAAa,CAAS;IAC9B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAEjF;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuD;IAE1F;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsD;gBAGN,oBAAoB,EAAE,yCAAyC,EAC3F,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACpC,iBAAiB,EAAE,+BAA+B,EAC3C,gBAAgB,EAAE,qCAAqC,EACjC,kBAAkB,EAAE,2DAA2D,EAC/F,6BAA6B,EAAE,2CAA2C,EACrF,kBAAkB,EAAE,gCAAgC,EAC7C,yBAAyB,EAAE,uCAAuC,EAClE,yBAAyB,EAAE,uCAAuC,EACrE,sBAAsB,EAAE,6BAA6B,EACzD,iBAAiB,EAAE,gCAAgC,EACxD,oBAAoB,EAAE,2BAA2B,EACvD,cAAc,EAAE,cAAc,EACjB,oBAAoB,EAAE,kCAAkC,EAC1D,kBAAkB,EAAE,gCAAgC,EACxC,uBAAuB,EAAE,qCAAqC,EAChF,YAAY,EAAE,mBAAmB,EAClC,WAAW,EAAE,yBAAyB,EAClC,sBAAsB,EAAE,6BAA6B,EAC3D,gBAAgB,EAAE,uBAAuB,EAChC,yBAAyB,EAAE,uCAAuC,EACvD,wBAAwB,CAAC,EAAE,sCAAsC,EACvE,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,kBAAkB,CAAC,EAAE,gCAAgC,EAC9C,yBAAyB,CAAC,EAAE,gCAAgC,EAClE,mBAAmB,CAAC,EAAE,0BAA0B;IAC7H;;;;;OAKG;IACuF,mBAAmB,CAAC,EAAE,uCAAuC,EAM1E,mBAAmB,CAAC,EAAE,0BAA0B,EACpC,wBAAwB,CAAC,EAAE,sCAAsC,EAMhF,gBAAgB,CAAC,EAAE,uBAAuB,EAO5B,uBAAuB,CAAC,EAAE,qCAAqC,EACzE,aAAa,CAAC,EAAE,2BAA2B,EAI5C,YAAY,CAAC,EAAE,0BAA0B,EASrG,2BAA2B,CAAC,EAAE,mCAAmC;IAapF,gFAAgF;IACzE,sBAAsB,IAAI,0BAA0B,GAAG,SAAS;IAIvE;;;;;OAKG;IACI,sBAAsB,IAAI,0BAA0B,GAAG,SAAS;IAIvE;;;;;;;;;;OAUG;IACI,sBAAsB,IAAI,uCAAuC,GAAG,SAAS;IAIpF;;;;;;;OAOG;IACI,kCAAkC,IAAI,sCAAsC,GAAG,SAAS;IAI/F;;;;;;;;;;;;OAYG;IACI,yBAAyB,IAAI,sBAAsB,GAAG,SAAS;IAWtE;;;;;;;;OAQG;IACI,sBAAsB,IAAI,0BAA0B,GAAG,SAAS;IAWvE;;;;;;;;;;;OAWG;IACI,mBAAmB,IAAI,uBAAuB,GAAG,SAAS;IAIjE;;;;;;;;;;;;OAYG;IACI,sCAAsC,IAAI,mCAAmC,GAAG,SAAS;IAQhG;;;;;;;;;;;;;OAaG;IACU,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YA2CtE,aAAa;IA6B3B,OAAO,CAAC,sBAAsB;IA6BvB,UAAU,CACf,oBAAoB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACjE,kBAAkB,SAAS,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAAG,SAAS,EACjF,WAAW,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAE/C,YAAY,EAAE,YAAY,GACzB,6BAA6B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,GAAG,SAAS;IAY5F,iBAAiB,CACtB,oBAAoB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACjE,kBAAkB,SAAS,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAAG,SAAS,EACjF,WAAW,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAE/C,YAAY,EAAE,YAAY,GACzB,6BAA6B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC;IAe1E,iBAAiB,CAAC,CAAC,GAAG,GAAG,EACpC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,EAC5D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,mBAAmB,EACzC,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC;IAeA,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAAG,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAI,OAAO,CAAC,CAAC,CAAC;IA6D7H,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,EAAE,GAAG,EACT,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC;IAMA,UAAU,CAAC,CAAC,GAAG,GAAG,EAC7B,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,EAAE,GAAG,EAAE,EACX,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,EAAE,CAAC;IAMF,IAAI,CAAC,CAAC,GAAG,GAAG,EACvB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IASP,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE,GAAG,EACT,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAMP,UAAU,CAAC,CAAC,GAAG,GAAG,EAC7B,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE,GAAG,EACT,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,EAAE,CAAC;IAMF,MAAM,CACjB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC;IAgBL,UAAU,CACrB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC;IAUpB;;;;;;;;;;;OAWG;IACU,sBAAsB,CAAC,CAAC,GAAG,GAAG,EACzC,YAAY,EAAE,YAAY,EAC1B,yBAAyB,EAAE,MAAM,EACjC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,mBAAmB,EACzC,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC;IAMb;;;;;;;;;OASG;IACU,2BAA2B,CACtC,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,EAAE,qCAAqC,EAC9C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,oCAAoC,CAAC;IAehD;;;;;;OAMG;IACI,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,yBAAyB,GAAG,IAAI;IAOjG;;;;OAIG;IACU,0BAA0B,CACrC,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,GAAG,EACX,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAiBhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACI,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,GAAG,IAAI;IAO/F;;;;;;;;;OASG;IACI,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAK1D;;;;;;;;;;;;OAYG;IACU,yBAAyB,CACpC,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,MAAM,EAC3B,IAAI,EAAE,GAAG,EACT,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAkBhB;;;;;OAKG;IACU,IAAI,CAAC,CAAC,GAAG,GAAG,EACvB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EACzB,UAAU,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,EAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAWjC,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EACzB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAM3B,KAAK,CAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,GAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAWnK,0BAA0B,IAAI,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;IAI7E,UAAU,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO;IAI/C,0BAA0B,IAAI,YAAY,EAAE;IAI5C,eAAe,IAAI,MAAM;IAIzB,YAAY,IAAI;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,YAAY,EAAE,CAAC;QAC9B,aAAa,EAAE,OAAO,CAAC;KACxB;IASD;;;;;;;;;;;;OAYG;IACU,4BAA4B,CACvC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,UAAU,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,GAChD,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;CA4CzC;AAED;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CACtC,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,GAAG,EACX,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,KACpC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,MAAM,EAC3B,IAAI,EAAE,GAAG,EACT,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,KACpC,OAAO,CAAC,IAAI,CAAC,CAAC;AASnB,qBAAa,6BAA6B,CACxC,oBAAoB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACjE,kBAAkB,SAAS,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAAG,SAAS,EACjF,WAAW,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;IAU7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IAC3C,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAjCjD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+E;IACrH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsG;IAEpI,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG/E,YAAY,EAAE,YAAY,EACT,iBAAiB,EAAE,+BAA+B,EAClD,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,gBAAgB,EAAE,qCAAqC,EACvD,kBAAkB,EAAE,2DAA2D,EAC/E,oBAAoB,EAAE,yCAAyC,EAC/D,gBAAgB,EAAE,qCAAqC,EACvD,kBAAkB,EAAE,gCAAgC,EACpD,yBAAyB,EAAE,uCAAuC,EAClE,yBAAyB,EAAE,uCAAuC,EAClE,sBAAsB,EAAE,6BAA6B,EACrD,iBAAiB,EAAE,gCAAgC,EACnD,oBAAoB,EAAE,2BAA2B,EACjD,cAAc,EAAE,cAAc,EAC9B,oBAAoB,EAAE,kCAAkC,EACxD,kBAAkB,EAAE,gCAAgC,EACpD,uBAAuB,EAAE,qCAAqC,EAC9D,YAAY,EAAE,mBAAmB,EACjC,WAAW,EAAE,yBAAyB,EACtC,sBAAsB,EAAE,6BAA6B,EACrD,gBAAgB,EAAE,uBAAuB,EACzC,yBAAyB,EAAE,uCAAuC,EAClE,wBAAwB,CAAC,EAAE,sCAAsC,EACjE,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,yBAAyB,CAAC,EAAE,gCAAgC,EAC5D,6BAA6B,CAAC,EAC7C,2CAA2C;IAiB/C,MAAM,CAAC,cAAc,CACnB,oBAAoB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACjE,kBAAkB,SAAS,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAAG,SAAS,EACjF,WAAW,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAE/C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,oBAAoB,EAAE,yCAAyC,EAC/D,gBAAgB,EAAE,qCAAqC,EACvD,iBAAiB,EAAE,+BAA+B,EAClD,gBAAgB,EAAE,qCAAqC,EACvD,kBAAkB,EAAE,2DAA2D,EAC/E,6BAA6B,EAAE,2CAA2C,EAC1E,kBAAkB,EAAE,gCAAgC,EACpD,yBAAyB,EAAE,uCAAuC,EAClE,yBAAyB,EAAE,uCAAuC,EAClE,sBAAsB,EAAE,6BAA6B,EACrD,iBAAiB,EAAE,gCAAgC,EACnD,oBAAoB,EAAE,2BAA2B,EACjD,cAAc,EAAE,cAAc,EAC9B,oBAAoB,EAAE,kCAAkC,EACxD,kBAAkB,EAAE,gCAAgC,EACpD,uBAAuB,EAAE,qCAAqC,EAC9D,YAAY,EAAE,mBAAmB,EACjC,WAAW,EAAE,yBAAyB,EACtC,sBAAsB,EAAE,6BAA6B,EACrD,gBAAgB,EAAE,uBAAuB,EACzC,yBAAyB,EAAE,uCAAuC,EAClE,wBAAwB,CAAC,EAAE,sCAAsC,EACjE,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,yBAAyB,CAAC,EAAE,gCAAgC,GAC3D,6BAA6B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC;IAuB1E,2BAA2B,CACtC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,EAAE,qCAAqC,EAC9C,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,oCAAoC,CAAC;YAmGlC,yCAAyC;IAoJvD,OAAO,CAAC,8CAA8C;IAwBtD,OAAO,CAAC,wCAAwC;YAuBlC,+CAA+C;IAmF7D,OAAO,CAAC,uBAAuB;IAwC/B,OAAO,CAAC,wBAAwB;YAWlB,+CAA+C;YA2M/C,iDAAiD;IAiO/D,OAAO,CAAC,8CAA8C;IAkBtD,OAAO,CAAC,gDAAgD;IAkBxD,OAAO,CAAC,8BAA8B;IA4BtC,OAAO,CAAC,yCAAyC;IAkCjD,OAAO,CAAC,0BAA0B;IAWlC,OAAO,CAAC,uCAAuC;IAgB/C,OAAO,CAAC,yCAAyC;IA8CjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,oCAAoC;IAoElD;;;;OAIG;IACH,OAAO,CAAC,kCAAkC;IAgB1C,OAAO,CAAC,0CAA0C;IAgKlD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB;IAQjC,OAAO,CAAC,uCAAuC;IAgC/C,OAAO,CAAC,uBAAuB;IA4B/B;;;;;;;;OAQG;IACU,iBAAiB,CAC5B,aAAa,EAAE,mCAAmC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,EAC5F,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,mBAAmB,EACzC,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,GAAG,CAAC;IAmCf;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,gBAAgB,EAAE,gBAAgB,CAAC,+BAA+B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC,EAC1H,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,GAAG,CAAC;IAgBR,2BAA2B,CAChC,SAAS,EAAE,+BAA+B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,EACjG,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC7B,+BAA+B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC;IAQzF;;;;;;;;;OASG;YACW,iCAAiC;IAyD/C;;;;;;;;;OASG;YACW,8BAA8B;IA+C5C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAK9C;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH;;;;;;;;OAQG;IACH,OAAO,CAAC,wCAAwC,CAAkC;IAElF,OAAO,CAAC,sCAAsC;YAiBhC,iBAAiB;IAiG/B;;;;;;;OAOG;YACW,gCAAgC;IAkF9C;;;;;;;;OAQG;YACW,gCAAgC;IAsG9C;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAarC;;;;;OAKG;YACW,+BAA+B;IAwK7C;;;;;;;OAOG;YACW,gBAAgB;IAsT9B,OAAO,CAAC,kCAAkC;IAe1C;;;OAGG;YACW,+BAA+B;IA2F7C;;;;;;;OAOG;YACW,wCAAwC;IAoItD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,0BAA0B;IA4GxC;;;;;;OAMG;YACW,yCAAyC;IA2BvD;;;;;;OAMG;YACW,2BAA2B;IAiEzC;;;;;;;;;;;;;;;;OAgBG;YACW,WAAW;IAk0BzB;;;;;;;;OAQG;YACW,aAAa;IAuB3B;;;;;;;;OAQG;YACW,oBAAoB;IAsBlC,OAAO,CAAC,oCAAoC;IA+B5C;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;YAwBZ,cAAc;YAyBd,MAAM;YAmHN,qCAAqC;YAuHrC,UAAU;IA6MxB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;YAmBjB,IAAI;YAuHJ,MAAM;YA8MN,uCAAuC;YA8GvC,UAAU;YAmMV,MAAM;YAmKN,UAAU;YA2OV,IAAI;IAqIlB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,CAAC,6BAA6B;IAyDrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,OAAO,CAAC,2BAA2B;YAoErB,MAAM;YAuEN,KAAK;IAwBnB;;OAEG;YACW,yBAAyB;YA0DzB,eAAe;IAwK7B,OAAO,CAAC,wBAAwB;IAehC;;OAEG;YACW,uBAAuB;IAiBrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;YACW,wBAAwB;IAoDtC;;OAEG;YACW,yBAAyB;IA2CvC,OAAO,CAAC,0CAA0C;IAQlD,OAAO,CAAC,4BAA4B;YA4BtB,2BAA2B;YA8E3B,6BAA6B;YA6C7B,gCAAgC;YAiGhC,8BAA8B;YA+H9B,gCAAgC;YAiIhC,iCAAiC;IAoJ/C;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,8BAA8B;IActC,OAAO,CAAC,kBAAkB;IAU1B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;YAOnB,qCAAqC;IAyDnD,OAAO,CAAC,8BAA8B;YAoCxB,mCAAmC;YAuCnC,sCAAsC;YAgDtC,+BAA+B;IA2C7C,OAAO,CAAC,+BAA+B;IAOvC,OAAO,CAAC,2BAA2B;IAInC,OAAO,CAAC,kCAAkC;IAI1C,OAAO,CAAC,kCAAkC;IAI1C;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAwBzB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAiC9B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyBhC;;;OAGG;IACH,OAAO,CAAC,iCAAiC;IAyBzC;;;;;;OAMG;IACH,OAAO,CAAC,6BAA6B;IAOrC,OAAO,CAAC,wCAAwC;IAQhD;;;;;;;;OAQG;IACH,OAAO,CAAC,sBAAsB;IAqB9B,OAAO,CAAC,0BAA0B;IASlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwCpC,OAAO,CAAC,0BAA0B;IAYlC,OAAO,CAAC,iCAAiC;YA8B3B,0BAA0B;IA+CxC;;;;;;;;;;;OAWG;YACW,uBAAuB;IAsBrC,OAAO,CAAC,gDAAgD;IA8BxD;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,iCAAiC;IAqCzC,OAAO,CAAC,kBAAkB;IA0B1B,OAAO,CAAC,6BAA6B;IAQrC,OAAO,CAAC,yBAAyB;IAMjC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gDAAgD;IAwCxD;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,kCAAkC;IAiC1C,OAAO,CAAC,mCAAmC;YAe7B,sCAAsC;YAwCtC,kCAAkC;YAkGlC,mCAAmC;IA0BjD,OAAO,CAAC,kCAAkC;IAwC1C,OAAO,CAAC,4BAA4B;IAoBpC,OAAO,CAAC,iCAAiC;IASzC,OAAO,CAAC,wBAAwB;YAsBlB,2BAA2B;YA0D3B,sBAAsB;YAkBtB,uBAAuB;YAwCvB,2BAA2B;IAiEzC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IA6BlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,OAAO,CAAC,2BAA2B;IAanC;;;OAGG;YACW,uBAAuB;IAuPrC;;;;;;;;;;;;OAYG;YACW,2BAA2B;IAuDzC;;OAEG;YACW,iBAAiB;IAyE/B;;;OAGG;YACW,0BAA0B;IAwGxC;;;;;;;;;;;;;;OAcG;IACH;;;;;;;;;;;;OAYG;YACW,uCAAuC;IAkFrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,kCAAkC;IA+KhD;;;;;;;;;;;;;;OAcG;YACW,uBAAuB;IA4OrC;;;;;;;;;;;;;;;;;OAiBG;YACW,uBAAuB;IAoMrC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH;;;;;;;;;;;;;;;OAeG;YACW,6BAA6B;IAwD3C;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAoDzB,wBAAwB,CACnC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,MAAM,EAAE,EAChB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB;IAC3B,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAoHjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,2BAA2B;IAiEzC;;;;;;;;;OASG;YACW,gCAAgC;IAgB9C;;;;;OAKG;IACH,OAAO,CAAC,iCAAiC;IAmBzC;;;;;OAKG;YACW,2BAA2B;IAkBzC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;YAmDtB,8BAA8B;IAkF5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6EG;IACU,mBAAmB,CAC9B,mBAAmB,EAAE,YAAY,EACjC,UAAU,EAAE,MAAM,EAAE,EACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,oBAAoB,CAAC;IAsOhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACU,oBAAoB,CAC/B,mBAAmB,EAAE,YAAY,EACjC,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,mBAAmB,CAAC;IAoK/B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oCAAoC;IAmE5C;;;;;;;OAOG;IACH,OAAO,CAAC,mCAAmC;IAuD3C;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAmB1B,kGAAkG;YACpF,qBAAqB;IAyBnC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,kBAAkB;IAyChC;;;;;;;;;;;;;;;OAeG;IACU,iCAAiC,CAAC,IAAI,EAAE;QACnD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QACtC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;KAClD,GAAG,OAAO,CAAC,OAAO,CAAC;IAuDpB;;OAEG;YACW,mCAAmC;IAsCjD;;OAEG;YACW,qBAAqB;IAgBnC;;OAEG;YACW,mBAAmB;IAcjC;;OAEG;YACW,kBAAkB;IAchC;;OAEG;YACW,2BAA2B;IAkBzC;;;;;;;OAOG;YACW,qBAAqB;IAsBnC;;;;;;;;OAQG;IACH,OAAO,CAAC,0BAA0B;CAkCnC"}
+{"version":3,"file":"services-registry-handler.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/base-classes/services/services/services-registry-handler.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAEV,+BAA+B,EAC/B,mCAAmC,EAEpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,YAAY,EACZ,qBAAqB,EAgBrB,QAAQ,EAQR,oBAAoB,EASpB,8EAA8E,EAQ9E,KAAK,qCAAqC,EAE1C,KAAK,oCAAoC,EAiBzC,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAsE,MAAM,0BAA0B,CAAC;AAG5H,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AASzH,OAAO,EAEL,KAAK,mCAAmC,EAEzC,MAAM,gFAAgF,CAAC;AACxF,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,2FAA2F,CAAC;AACxJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC7I,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EAI1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC1I,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,qFAAqF,CAAC;AACvI,OAAO,EACL,2DAA2D,EAE5D,MAAM,qEAAqE,CAAC;AAY7E,OAAO,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAG1I,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EACjC,MAAM,oFAAoF,CAAC;AAC5F,OAAO,EAGL,gCAAgC,EACjC,MAAM,2EAA2E,CAAC;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sEAAsE,CAAC;AACnH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAK7H,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AACjG,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAIvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAGV,oBAAoB,EACpB,mBAAmB,EAIpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kCAAkC,EAAE,MAAM,0EAA0E,CAAC;AAC9H,OAAO,EAAE,gCAAgC,EAA0B,MAAM,wEAAwE,CAAC;AAElJ,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,8DAA8D,CAAC;AACtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+DAA+D,CAAC;AAChH,OAAO,EAKL,KAAK,0BAA0B,EAChC,MAAM,kEAAkE,CAAC;AAC1E,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mEAAmE,CAAC;AAC9G,OAAO,EACL,6BAA6B,EAC9B,MAAM,yFAAyF,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yFAAyF,CAAC;AACrI,OAAO,EAAE,sCAAsC,EAAE,MAAM,iFAAiF,CAAC;AACzI,OAAO,EAAE,gCAAgC,EAAE,MAAM,0EAA0E,CAAC;AAC5H,OAAO,EAAE,gCAAgC,EAAE,MAAM,0EAA0E,CAAC;AAC5H,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iGAAiG,CAAC;AAClJ,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,uFAAuF,CAAC;AACrJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,uCAAuC,EAA4D,MAAM,uFAAuF,CAAC;AAO1M,UAAU,mCAAmC;IAC3C,iCAAiC,CAAC,wBAAwB,SAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC/G,gBAAgB,EAAE,gBAAgB,CAAC,wBAAwB,CAAC,EAC5D,kBAAkB,EAAE,8EAA8E,GACjG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,+BAA+B,CAAC,wBAAwB,SAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC7G,gBAAgB,EAAE,gBAAgB,CAAC,wBAAwB,CAAC,EAC5D,kBAAkB,EAAE,8EAA8E,EAClG,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,UAAU,qCAAqC;IAC7C,sBAAsB,EAAE,mCAAmC,CAAC;IAC5D,iBAAiB,EAAE,IAAI,CAAC,gCAAgC,EAAE,qBAAqB,GAAG,yBAAyB,CAAC,CAAC;IAC7G,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACxE;AA2RD;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,sBAAsB,EAAE,IAAI,CAAC,6BAA6B,EAAE,wBAAwB,CAAC,CAAC;CACvF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uCAAuC,CAC3D,IAAI,EAAE,4BAA4B,EAClC,eAAe,EAAE,qBAAqB,EACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACjC,qBAAqB,EAAE;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,EACD,WAAW,EAAE,kBAAkB,GAC9B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAUvC;AAED,wBAAsB,4CAA4C,CAChE,IAAI,EAAE,qCAAqC,EAC3C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,SAAS,EAAE,GAAG,EACd,aAAa,EAAE,GAAG,EAClB,qBAAqB,CAAC,EAAE,qBAAqB,GAAG,IAAI,EACpD,aAAa,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CAuEf;AAED,qBACa,qCAAqC;IA0CiB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACX,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC5B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC7C,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc;IAClB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACvB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACxB,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC/B,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACjD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACjG;;;;;OAKG;IACsE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAMlD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAMzD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOpB,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAS1F,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IA3G/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkE;IAC3F,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAIlC;IAEH,OAAO,CAAC,aAAa,CAAS;IAC9B,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAEjF;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuD;IAE1F;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsD;gBAGN,oBAAoB,EAAE,yCAAyC,EAC3F,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACpC,iBAAiB,EAAE,+BAA+B,EAC3C,gBAAgB,EAAE,qCAAqC,EACjC,kBAAkB,EAAE,2DAA2D,EAC/F,6BAA6B,EAAE,2CAA2C,EACrF,kBAAkB,EAAE,gCAAgC,EAC7C,yBAAyB,EAAE,uCAAuC,EAClE,yBAAyB,EAAE,uCAAuC,EACrE,sBAAsB,EAAE,6BAA6B,EACzD,iBAAiB,EAAE,gCAAgC,EACxD,oBAAoB,EAAE,2BAA2B,EACvD,cAAc,EAAE,cAAc,EACjB,oBAAoB,EAAE,kCAAkC,EAC1D,kBAAkB,EAAE,gCAAgC,EACxC,uBAAuB,EAAE,qCAAqC,EAChF,YAAY,EAAE,mBAAmB,EAClC,WAAW,EAAE,yBAAyB,EAClC,sBAAsB,EAAE,6BAA6B,EAC3D,gBAAgB,EAAE,uBAAuB,EAChC,yBAAyB,EAAE,uCAAuC,EACvD,wBAAwB,CAAC,EAAE,sCAAsC,EACvE,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,kBAAkB,CAAC,EAAE,gCAAgC,EAC9C,yBAAyB,CAAC,EAAE,gCAAgC,EAClE,mBAAmB,CAAC,EAAE,0BAA0B;IAC7H;;;;;OAKG;IACuF,mBAAmB,CAAC,EAAE,uCAAuC,EAM1E,mBAAmB,CAAC,EAAE,0BAA0B,EACpC,wBAAwB,CAAC,EAAE,sCAAsC,EAMhF,gBAAgB,CAAC,EAAE,uBAAuB,EAO5B,uBAAuB,CAAC,EAAE,qCAAqC,EACzE,aAAa,CAAC,EAAE,2BAA2B,EAI5C,YAAY,CAAC,EAAE,0BAA0B,EASrG,2BAA2B,CAAC,EAAE,mCAAmC;IAapF,gFAAgF;IACzE,sBAAsB,IAAI,0BAA0B,GAAG,SAAS;IAIvE;;;;;OAKG;IACI,sBAAsB,IAAI,0BAA0B,GAAG,SAAS;IAIvE;;;;;;;;;;OAUG;IACI,sBAAsB,IAAI,uCAAuC,GAAG,SAAS;IAIpF;;;;;;;OAOG;IACI,kCAAkC,IAAI,sCAAsC,GAAG,SAAS;IAI/F;;;;;;;;;;;;OAYG;IACI,yBAAyB,IAAI,sBAAsB,GAAG,SAAS;IAWtE;;;;;;;;OAQG;IACI,sBAAsB,IAAI,0BAA0B,GAAG,SAAS;IAWvE;;;;;;;;;;;OAWG;IACI,mBAAmB,IAAI,uBAAuB,GAAG,SAAS;IAIjE;;;;;;;;;;;;OAYG;IACI,sCAAsC,IAAI,mCAAmC,GAAG,SAAS;IAQhG;;;;;;;;;;;;;OAaG;IACU,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YA2CtE,aAAa;IA6B3B,OAAO,CAAC,sBAAsB;IA6BvB,UAAU,CACf,oBAAoB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACjE,kBAAkB,SAAS,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAAG,SAAS,EACjF,WAAW,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAE/C,YAAY,EAAE,YAAY,GACzB,6BAA6B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,GAAG,SAAS;IAY5F,iBAAiB,CACtB,oBAAoB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACjE,kBAAkB,SAAS,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAAG,SAAS,EACjF,WAAW,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAE/C,YAAY,EAAE,YAAY,GACzB,6BAA6B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC;IAe1E,iBAAiB,CAAC,CAAC,GAAG,GAAG,EACpC,aAAa,EAAE,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,EAC5D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,mBAAmB,EACzC,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC;IAeA,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAAG,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAI,OAAO,CAAC,CAAC,CAAC;IA6D7H,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,EAAE,GAAG,EACT,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC;IAMA,UAAU,CAAC,CAAC,GAAG,GAAG,EAC7B,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,EAAE,GAAG,EAAE,EACX,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,EAAE,CAAC;IAMF,IAAI,CAAC,CAAC,GAAG,GAAG,EACvB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IASP,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE,GAAG,EACT,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAMP,UAAU,CAAC,CAAC,GAAG,GAAG,EAC7B,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE,GAAG,EACT,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,EAAE,CAAC;IAMF,MAAM,CACjB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC;IAgBL,UAAU,CACrB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC;IAUpB;;;;;;;;;;;OAWG;IACU,sBAAsB,CAAC,CAAC,GAAG,GAAG,EACzC,YAAY,EAAE,YAAY,EAC1B,yBAAyB,EAAE,MAAM,EACjC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,mBAAmB,EACzC,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC;IAMb;;;;;;;;;OASG;IACU,2BAA2B,CACtC,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,EAAE,qCAAqC,EAC9C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,oCAAoC,CAAC;IAehD;;;;;;OAMG;IACI,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,yBAAyB,GAAG,IAAI;IAOjG;;;;OAIG;IACU,0BAA0B,CACrC,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,GAAG,EACX,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAiBhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACI,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,GAAG,IAAI;IAO/F;;;;;;;;;OASG;IACI,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAK1D;;;;;;;;;;;;OAYG;IACU,yBAAyB,CACpC,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,MAAM,EAC3B,IAAI,EAAE,GAAG,EACT,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAkBhB;;;;;OAKG;IACU,IAAI,CAAC,CAAC,GAAG,GAAG,EACvB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EACzB,UAAU,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,EAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAWjC,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EACzB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAM3B,KAAK,CAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,GAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAWnK,0BAA0B,IAAI,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;IAI7E,UAAU,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO;IAI/C,0BAA0B,IAAI,YAAY,EAAE;IAI5C,eAAe,IAAI,MAAM;IAIzB,YAAY,IAAI;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,YAAY,EAAE,CAAC;QAC9B,aAAa,EAAE,OAAO,CAAC;KACxB;IASD;;;;;;;;;;;;OAYG;IACU,4BAA4B,CACvC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,UAAU,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,GAChD,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;CA4CzC;AAED;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CACtC,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,GAAG,EACX,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,KACpC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,MAAM,EAC3B,IAAI,EAAE,GAAG,EACT,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,KACpC,OAAO,CAAC,IAAI,CAAC,CAAC;AASnB,qBAAa,6BAA6B,CACxC,oBAAoB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACjE,kBAAkB,SAAS,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAAG,SAAS,EACjF,WAAW,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;IAU7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IAC3C,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAjCjD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+E;IACrH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsG;IAEpI,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG/E,YAAY,EAAE,YAAY,EACT,iBAAiB,EAAE,+BAA+B,EAClD,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,gBAAgB,EAAE,qCAAqC,EACvD,kBAAkB,EAAE,2DAA2D,EAC/E,oBAAoB,EAAE,yCAAyC,EAC/D,gBAAgB,EAAE,qCAAqC,EACvD,kBAAkB,EAAE,gCAAgC,EACpD,yBAAyB,EAAE,uCAAuC,EAClE,yBAAyB,EAAE,uCAAuC,EAClE,sBAAsB,EAAE,6BAA6B,EACrD,iBAAiB,EAAE,gCAAgC,EACnD,oBAAoB,EAAE,2BAA2B,EACjD,cAAc,EAAE,cAAc,EAC9B,oBAAoB,EAAE,kCAAkC,EACxD,kBAAkB,EAAE,gCAAgC,EACpD,uBAAuB,EAAE,qCAAqC,EAC9D,YAAY,EAAE,mBAAmB,EACjC,WAAW,EAAE,yBAAyB,EACtC,sBAAsB,EAAE,6BAA6B,EACrD,gBAAgB,EAAE,uBAAuB,EACzC,yBAAyB,EAAE,uCAAuC,EAClE,wBAAwB,CAAC,EAAE,sCAAsC,EACjE,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,yBAAyB,CAAC,EAAE,gCAAgC,EAC5D,6BAA6B,CAAC,EAC7C,2CAA2C;IAiB/C,MAAM,CAAC,cAAc,CACnB,oBAAoB,SAAS,YAAY,GAAG,SAAS,GAAG,SAAS,EACjE,kBAAkB,SAAS,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,GAAG,SAAS,EACjF,WAAW,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAE/C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,oBAAoB,EAAE,yCAAyC,EAC/D,gBAAgB,EAAE,qCAAqC,EACvD,iBAAiB,EAAE,+BAA+B,EAClD,gBAAgB,EAAE,qCAAqC,EACvD,kBAAkB,EAAE,2DAA2D,EAC/E,6BAA6B,EAAE,2CAA2C,EAC1E,kBAAkB,EAAE,gCAAgC,EACpD,yBAAyB,EAAE,uCAAuC,EAClE,yBAAyB,EAAE,uCAAuC,EAClE,sBAAsB,EAAE,6BAA6B,EACrD,iBAAiB,EAAE,gCAAgC,EACnD,oBAAoB,EAAE,2BAA2B,EACjD,cAAc,EAAE,cAAc,EAC9B,oBAAoB,EAAE,kCAAkC,EACxD,kBAAkB,EAAE,gCAAgC,EACpD,uBAAuB,EAAE,qCAAqC,EAC9D,YAAY,EAAE,mBAAmB,EACjC,WAAW,EAAE,yBAAyB,EACtC,sBAAsB,EAAE,6BAA6B,EACrD,gBAAgB,EAAE,uBAAuB,EACzC,yBAAyB,EAAE,uCAAuC,EAClE,wBAAwB,CAAC,EAAE,sCAAsC,EACjE,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,kBAAkB,CAAC,EAAE,gCAAgC,EACrD,yBAAyB,CAAC,EAAE,gCAAgC,GAC3D,6BAA6B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC;IAuB1E,2BAA2B,CACtC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,EAAE,qCAAqC,EAC9C,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,oCAAoC,CAAC;YAmGlC,yCAAyC;IAoJvD,OAAO,CAAC,8CAA8C;IAwBtD,OAAO,CAAC,wCAAwC;YAuBlC,+CAA+C;IAmF7D,OAAO,CAAC,uBAAuB;IAwC/B,OAAO,CAAC,wBAAwB;YAWlB,+CAA+C;YA2M/C,iDAAiD;IAiO/D,OAAO,CAAC,8CAA8C;IAkBtD,OAAO,CAAC,gDAAgD;IAkBxD,OAAO,CAAC,8BAA8B;IA4BtC,OAAO,CAAC,yCAAyC;IAkCjD,OAAO,CAAC,0BAA0B;IAWlC,OAAO,CAAC,uCAAuC;IAgB/C,OAAO,CAAC,yCAAyC;IA8CjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,oCAAoC;IAoElD;;;;OAIG;IACH,OAAO,CAAC,kCAAkC;IAgB1C,OAAO,CAAC,0CAA0C;IAgKlD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB;IAQjC,OAAO,CAAC,uCAAuC;IAgC/C,OAAO,CAAC,uBAAuB;IA4B/B;;;;;;;;OAQG;IACU,iBAAiB,CAC5B,aAAa,EAAE,mCAAmC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,EAC5F,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,mBAAmB,EACzC,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,GAAG,CAAC;IAmCf;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,gBAAgB,EAAE,gBAAgB,CAAC,+BAA+B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC,EAC1H,IAAI,CAAC,EAAE,GAAG,EACV,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,GAAG,CAAC;IAgBR,2BAA2B,CAChC,SAAS,EAAE,+BAA+B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,EACjG,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC7B,+BAA+B,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC;IAQzF;;;;;;;;;OASG;YACW,iCAAiC;IAyD/C;;;;;;;;;OASG;YACW,8BAA8B;IA+C5C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAK9C;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH;;;;;;;;OAQG;IACH,OAAO,CAAC,wCAAwC,CAAkC;IAElF,OAAO,CAAC,sCAAsC;YAiBhC,iBAAiB;IAiG/B;;;;;;;OAOG;YACW,gCAAgC;IAkF9C;;;;;;;;OAQG;YACW,gCAAgC;IAsG9C;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAarC;;;;;OAKG;YACW,+BAA+B;IAwK7C;;;;;;;OAOG;YACW,gBAAgB;IAsT9B,OAAO,CAAC,kCAAkC;IAe1C;;;OAGG;YACW,+BAA+B;IA2F7C;;;;;;;OAOG;YACW,wCAAwC;IAoItD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,0BAA0B;IA2HxC;;;;;;OAMG;YACW,yCAAyC;IA2BvD;;;;;;OAMG;YACW,2BAA2B;IAiEzC;;;;;;;;;;;;;;;;OAgBG;YACW,WAAW;IAk0BzB;;;;;;;;OAQG;YACW,aAAa;IAuB3B;;;;;;;;OAQG;YACW,oBAAoB;IAsBlC,OAAO,CAAC,oCAAoC;IA+B5C;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;YAwBZ,cAAc;YAyBd,MAAM;YAmHN,qCAAqC;YAuHrC,UAAU;IA6MxB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;YAmBjB,IAAI;YAuHJ,MAAM;YA8MN,uCAAuC;YA8GvC,UAAU;YAmMV,MAAM;YAmKN,UAAU;YA2OV,IAAI;IAqIlB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,CAAC,6BAA6B;IAoErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,OAAO,CAAC,2BAA2B;YA8ErB,MAAM;YAuEN,KAAK;IAwBnB;;OAEG;YACW,yBAAyB;YA0DzB,eAAe;IAwK7B,OAAO,CAAC,wBAAwB;IAehC;;OAEG;YACW,uBAAuB;IAiBrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;YACW,wBAAwB;IAoDtC;;OAEG;YACW,yBAAyB;IA2CvC,OAAO,CAAC,0CAA0C;IAQlD,OAAO,CAAC,4BAA4B;YA4BtB,2BAA2B;YA8E3B,6BAA6B;YA6C7B,gCAAgC;YAiGhC,8BAA8B;YA+H9B,gCAAgC;YAiIhC,iCAAiC;IAoJ/C;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,8BAA8B;IActC,OAAO,CAAC,kBAAkB;IAU1B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;YAOnB,qCAAqC;IAyDnD,OAAO,CAAC,8BAA8B;YAoCxB,mCAAmC;YAuCnC,sCAAsC;YAgDtC,+BAA+B;IA2C7C,OAAO,CAAC,+BAA+B;IAOvC,OAAO,CAAC,2BAA2B;IAInC,OAAO,CAAC,kCAAkC;IAI1C,OAAO,CAAC,kCAAkC;IAI1C;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAwBzB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAiC9B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyBhC;;;OAGG;IACH,OAAO,CAAC,iCAAiC;IAyBzC;;;;;;OAMG;IACH,OAAO,CAAC,6BAA6B;IAOrC,OAAO,CAAC,wCAAwC;IAQhD;;;;;;;;OAQG;IACH,OAAO,CAAC,sBAAsB;IAqB9B,OAAO,CAAC,0BAA0B;IASlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwCpC,OAAO,CAAC,0BAA0B;IAYlC,OAAO,CAAC,iCAAiC;YA8B3B,0BAA0B;IA+CxC;;;;;;;;;;;OAWG;YACW,uBAAuB;IAsBrC,OAAO,CAAC,gDAAgD;IA8BxD;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,iCAAiC;IAqCzC,OAAO,CAAC,kBAAkB;IA0B1B,OAAO,CAAC,6BAA6B;IAQrC,OAAO,CAAC,yBAAyB;IAMjC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gDAAgD;IAwCxD;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,kCAAkC;IAiC1C,OAAO,CAAC,mCAAmC;YAe7B,sCAAsC;YAwCtC,kCAAkC;YAkGlC,mCAAmC;IA0BjD,OAAO,CAAC,kCAAkC;IAwC1C,OAAO,CAAC,4BAA4B;IAoBpC,OAAO,CAAC,iCAAiC;IASzC,OAAO,CAAC,wBAAwB;YAsBlB,2BAA2B;YA0D3B,sBAAsB;YAkBtB,uBAAuB;YAwCvB,2BAA2B;IAiEzC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IA6BlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,OAAO,CAAC,2BAA2B;IAanC;;;OAGG;YACW,uBAAuB;IAuPrC;;;;;;;;;;;;OAYG;YACW,2BAA2B;IAuDzC;;OAEG;YACW,iBAAiB;IAyE/B;;;OAGG;YACW,0BAA0B;IAwGxC;;;;;;;;;;;;;;OAcG;IACH;;;;;;;;;;;;OAYG;YACW,uCAAuC;IAkFrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,kCAAkC;IA+KhD;;;;;;;;;;;;;;OAcG;YACW,uBAAuB;IA4OrC;;;;;;;;;;;;;;;;;OAiBG;YACW,uBAAuB;IAoMrC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH;;;;;;;;;;;;;;;OAeG;YACW,6BAA6B;IAwD3C;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAoDzB,wBAAwB,CACnC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,MAAM,EAAE,EAChB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB;IAC3B,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAoHjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,2BAA2B;IAiEzC;;;;;;;;;OASG;YACW,gCAAgC;IAgB9C;;;;;OAKG;IACH,OAAO,CAAC,iCAAiC;IAmBzC;;;;;OAKG;YACW,2BAA2B;IAkBzC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;YAmDtB,8BAA8B;IAkF5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6EG;IACU,mBAAmB,CAC9B,mBAAmB,EAAE,YAAY,EACjC,UAAU,EAAE,MAAM,EAAE,EACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,oBAAoB,CAAC;IAsOhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACU,oBAAoB,CAC/B,mBAAmB,EAAE,YAAY,EACjC,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,mBAAmB,CAAC;IAoK/B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oCAAoC;IAmE5C;;;;;;;OAOG;IACH,OAAO,CAAC,mCAAmC;IAuD3C;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAmB1B,kGAAkG;YACpF,qBAAqB;IAyBnC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,kBAAkB;IAyChC;;;;;;;;;;;;;;;OAeG;IACU,iCAAiC,CAAC,IAAI,EAAE;QACnD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QACtC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;KAClD,GAAG,OAAO,CAAC,OAAO,CAAC;IAuDpB;;OAEG;YACW,mCAAmC;IAsCjD;;OAEG;YACW,qBAAqB;IAgBnC;;OAEG;YACW,mBAAmB;IAcjC;;OAEG;YACW,kBAAkB;IAchC;;OAEG;YACW,2BAA2B;IAkBzC;;;;;;;OAOG;YACW,qBAAqB;IAsBnC;;;;;;;;OAQG;IACH,OAAO,CAAC,0BAA0B;CAkCnC"}

package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.js

@@ -13,7 +13,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import 'reflect-metadata';
 import { randomUUID } from 'node:crypto';
 import { injectable, inject, optional } from 'inversify';
-import { CoreResourceOperation, CoreResourceType, readBulkOperationSelectorIds, stripBulkOperationSelector, composeDefaultOperationResponse, PersistenceAdapter, selectByPersistenceAdapter, ResourcesConfig_OperationPathUtils, ErrorType, ErrorCustomMessageReference, ResourceOperationVariantType, ResourceOperationRiskLevel, ResourceOperationsUtils, DataMode, OPERATION_VARIANT_KEY, ChildLifecycleMode, ChildLifecycleStrategy, buildImpersonalizeScrubPatch, SubjectErasureDisposition, classifySubjectErasureDisposition, isBlockingSubjectErasureDisposition, SubjectExportPurpose, SubjectExportEdgeDisposition, SubjectExportFieldScope, SubjectExportFieldDecisionBasis, compileSubjectExportFieldDecisions, enumerateSubjectExportRelationshipTraversals, isIncludedSubjectExportEdgeDisposition, ResourceSystemAccessMode, ResourceOperation_ServiceRuntimeMode, ExecutionContext_ExecutionType, CoreConsumableTokenTypes, isWildoBackendError, Resources_SharedUtils, ResourceRelationshipBulkAction, ResourceRelationshipBulkActionRequestSchema, ResourceRelationshipBulkClearOperationRequestSchema, ResourceRelationshipBulkCreateOperationRequestSchema, ResourceRelationshipBulkLinkOperationRequestSchema, ResourceRelationshipBulkReplaceOperationRequestSchema, ResourceRelationshipBulkSetOperationRequestSchema, ResourceRelationshipBulkUnlinkOperationRequestSchema, ResourceGeneratedOperationKind, ResourceDataSubjectKind, resolveAuthConfig, } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, PlatformAccessGrantScope, CoreResourceType, readBulkOperationSelectorIds, stripBulkOperationSelector, composeDefaultOperationResponse, PersistenceAdapter, selectByPersistenceAdapter, ResourcesConfig_OperationPathUtils, ErrorType, ErrorCustomMessageReference, ResourceOperationVariantType, ResourceOperationRiskLevel, ResourceOperationsUtils, DataMode, OPERATION_VARIANT_KEY, ChildLifecycleMode, ChildLifecycleStrategy, buildImpersonalizeScrubPatch, SubjectErasureDisposition, classifySubjectErasureDisposition, isBlockingSubjectErasureDisposition, SubjectExportPurpose, SubjectExportEdgeDisposition, SubjectExportFieldScope, SubjectExportFieldDecisionBasis, compileSubjectExportFieldDecisions, enumerateSubjectExportRelationshipTraversals, isIncludedSubjectExportEdgeDisposition, ResourceSystemAccessMode, ResourceOperation_ServiceRuntimeMode, ExecutionContext_ExecutionType, CoreConsumableTokenTypes, isWildoBackendError, Resources_SharedUtils, ResourceRelationshipBulkAction, ResourceRelationshipBulkActionRequestSchema, ResourceRelationshipBulkClearOperationRequestSchema, ResourceRelationshipBulkCreateOperationRequestSchema, ResourceRelationshipBulkLinkOperationRequestSchema, ResourceRelationshipBulkReplaceOperationRequestSchema, ResourceRelationshipBulkSetOperationRequestSchema, ResourceRelationshipBulkUnlinkOperationRequestSchema, ResourceGeneratedOperationKind, ResourceDataSubjectKind, resolveAuthConfig, } from '@wildo-ai/saas-models';
 import { getZodObjectShape, isAuditEvidenceField, isZodObject, unwrapSchema } from '@wildo-ai/zod-decorators';
 import { isWriteIntegrityExemptExecution } from '../../../base-classes/services/repositories/resource-write-integrity.backend.js';
 import { collectCandidateReadOnlyFields, filterChangedReadOnlyFields, stringifyPersistedValueForCompare } from '../../../base-classes/services/services/read-only-field-change.backend.utils.js';
@@ -2936,9 +2936,26 @@ export class ServiceResourceBackendService {
             // A bulk write names a COUNT rather than an id; a singular write names the row. Reading the
             // id off the post-state (falling back to the pre-image) covers DELETE, whose post-state may
             // not echo the row.
+            //
+            // The fallback is on the ABSENCE OF AN ID, not on the absence of a post-state — and that
+            // distinction is the whole of it. A custom operation may declare a `customResponseDto`, and
+            // its POSTFIX then hands back the RESPONSE rather than the row: a truthy object with no `_id`
+            // at all. `?? preOperationState` never fires for one, so the emitted row named no subject.
+            //
+            // Measured 2026-09-10 against a live application: of 282 `RESOURCE_OPERATION_PERFORMED` rows,
+            // 276 carried `eventData.resourceId` and the SIX that did not were exactly the operations
+            // that reshape their response — all five `organizationSsoConfig` domain-ownership calls, plus
+            // one `organizations` lifecycle verb. Those are privileged, cross-tenant-reaching
+            // configuration changes, and their trail could not say WHICH row moved, so any SIEM rule or
+            // query keyed on `resourceId` silently skipped them (issue #542's own audit claim).
+            //
+            // Still UNDEFINED for a bulk write, deliberately: the fallback is reached only on the
+            // singular path, so a bulk operation cannot start naming one row out of the many it touched.
             const isBulk = Array.isArray(postOperationState);
-            const singularState = (isBulk ? undefined : postOperationState) ?? preOperationState;
-            const resourceId = this.extractPersistedResourceId((singularState ?? {}));
+            const resourceId = isBulk
+                ? undefined
+                : this.extractPersistedResourceId((postOperationState ?? {}))
+                    ?? this.extractPersistedResourceId((preOperationState ?? {}));
             await auditLogsService.logResourceOperationPerformed({
                 riskLevel: operation.riskLevel ?? ResourceOperationRiskLevel.LOW,
                 actorUserId: executionContext.initiatorIds?.userId,
@@ -4818,6 +4835,17 @@ export class ServiceResourceBackendService {
                         executionType: executionContext.executionType,
                         actorUserId: executionContext.initiatorIds?.userId,
                         applicationId: executionContext.initiatorIds?.applicationId,
+                        // The elevation the authorizer admitted this read under, stamped on the context by
+                        // `enforceApplicationWideReadAdmission`. Until 2026-09-09 this event named NO elevation
+                        // because none was required — the directory read was gated on a role alone while the far
+                        // narrower per-row crossing required a grant. Reading it off the context rather than
+                        // re-resolving it is what keeps the evidence and the admission describing the SAME grant.
+                        authorizingGrantId: executionContext
+                            .authorizingApplicationAccessGrantId,
+                        authorizingGrantScope: executionContext
+                            .authorizingApplicationAccessGrantId
+                            ? PlatformAccessGrantScope.APPLICATION_WIDE
+                            : undefined,
                     }, executionContext)
                     : undefined,
                 metricsResolver: () => this.servicesRegistry?.getAuditObservationLossMetricsRecorder?.(),
@@ -4909,7 +4937,17 @@ export class ServiceResourceBackendService {
                             variantType: operation.variantType,
                             variantKey: operation.variantKey,
                             targetResourceIds: crossing.targetResourceIds.length > 0 ? crossing.targetResourceIds : undefined,
-                            authorizingGrantId: executionContext.authorizingPlatformAccessGrantId,
+                            // TWO elevations can authorise a crossing and they live in two collections, so the id
+                            // alone is not resolvable — hence the paired scope. The TENANT grant wins when both are
+                            // present: it is the narrower, customer-approvable authority, and naming the wider one
+                            // beside it would overstate what the read was admitted under.
+                            authorizingGrantId: executionContext.authorizingPlatformAccessGrantId
+                                ?? executionContext.authorizingApplicationAccessGrantId,
+                            authorizingGrantScope: executionContext.authorizingPlatformAccessGrantId
+                                ? PlatformAccessGrantScope.TENANT
+                                : (executionContext.authorizingApplicationAccessGrantId
+                                    ? PlatformAccessGrantScope.APPLICATION_WIDE
+                                    : undefined),
                             // Always true by construction — only a DECLARED crossing is observed, so the trail never
                             // describes a completed read with the token that means "attempted and refused". Read from
                             // the operation rather than hard-coded, so the two can never drift apart.
@@ -5077,7 +5115,7 @@ export class ServiceResourceBackendService {
         this.logDebug('transformOutput - before validation', {
             dataKeys: data && typeof data === 'object' && !Array.isArray(data) ? Object.keys(data) : 'not plain object',
             hasUserSelfProfile: data && typeof data === 'object' ? 'userSelfProfile' in data : false,
-            hasUserSelfPreference: data && typeof data === 'object' ? 'userSelfPreference' in data : false,
+            hasUserSelfPreferences: data && typeof data === 'object' ? 'userSelfPreferences' in data : false,
             hasOrgMembers: data && typeof data === 'object' ? 'organizationMembers' in data : false
         });
         try {
@@ -5146,7 +5184,7 @@ export class ServiceResourceBackendService {
             this.logDebug('transformOutput - after validation', {
                 dataKeys: transformedData && typeof transformedData === 'object' && !Array.isArray(transformedData) ? Object.keys(transformedData) : 'not plain object',
                 hasUserSelfProfile: transformedData && typeof transformedData === 'object' ? 'userSelfProfile' in transformedData : false,
-                hasUserSelfPreference: transformedData && typeof transformedData === 'object' ? 'userSelfPreference' in transformedData : false,
+                hasUserSelfPreferences: transformedData && typeof transformedData === 'object' ? 'userSelfPreferences' in transformedData : false,
                 hasOrgMembers: transformedData && typeof transformedData === 'object' ? 'organizationMembers' in transformedData : false
             });
             this.logDebug('Output transformation successful');