ReadonlyserviceStable, human-readable name for the service. Must be set explicitly on each subclass
because this.constructor.name gets mangled by minification in production builds,
which breaks tracing/observability span names.
ProtectedloggerProtectedrunProtectedspanOptional hook for subclasses to attach extra non-PII span attributes derived from params.
The returned attributes appear on the service.${serviceName} span (and, for jobs,
on job.enqueue.* and job.run.* spans too).
Safe ID-like keys on params (e.g. patientId, templateIds, limit, cursor) are
already auto-extracted via toSpanAttributes("service.input", params) — you don't need
to enumerate them here. Use this hook for derived/computed attributes (counts, flags,
computed names) or for fields you've explicitly verified safe but that aren't in the
global allowlist. Hook output overrides auto-extracted attributes on key collision.
Safe by default: returns {} when not overridden. Only declare keys you've confirmed
are non-PII. Never include emails, names, dob, free-text, etc.
ProtectedspanOptional hook for subclasses to attach extra non-PII span attributes derived from the
successful service result. Only called when run resolves successfully; on error, the
span is marked via markSpanError instead.
Safe by default: returns {} when not overridden. Only declare keys you've confirmed
are non-PII (e.g. counts, status flags, computed summaries). Never include emails,
names, dob, free-text, etc.
Superadmin-only transfer of clients between two users of the SAME org. Moves the selected
patientrows, the source user's session notes on them, and the session-note validations (audit_runs) attached to those notes. Nothing else moves.Org safety: both profiles are resolved through
getMemberByProfileId(profileId, entityId), which throws unless the profile is a member of that org — so a transfer can never span orgs, regardless of what the caller passes. The repo re-scopes every update byentity_idon top.