@open-mercato/core 0.10.1-develop.7736.1.88e07906bf → 0.10.1-develop.7748.1.d745ba61aa

package/dist/helpers/integration/attachmentAccessFixtures.js

@@ -0,0 +1,144 @@
+import { randomUUID } from "node:crypto";
+import { expect } from "@playwright/test";
+import { apiRequest, clearAuthTokenCache, getAuthToken, withCredentialIsolatedRequest } from "./api.js";
+import { createRoleFixture, createUserFixture, deleteRoleIfExists, deleteUserIfExists, setRoleAclFeatures } from "./authFixtures.js";
+import { deleteAttachmentIfExists, uploadAttachmentFixture } from "./attachmentsFixtures.js";
+import { expectId, getTokenContext, readJsonSafe } from "./generalFixtures.js";
+const OWNER_ACCESS_FEATURES = [
+  "documents.view",
+  "documents.edit",
+  "documents.create",
+  "documents.share",
+  "documents.delete",
+  "attachments.view",
+  "attachments.manage"
+];
+const OWNER_ACCESS_PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAYAAABytg0kAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEUlEQVQImWMwSpn2H4QZYAwASOwIrfM45AsAAAAASUVORK5CYII=",
+  "base64"
+);
+async function ownerPolicyRequest(method, path, token, data, scheme = "Bearer") {
+  return withCredentialIsolatedRequest(async (isolated) => {
+    const response = await isolated.fetch(path, {
+      method,
+      headers: { Authorization: `${scheme} ${token}`, "Content-Type": "application/json" },
+      ...data === void 0 ? {} : { data }
+    });
+    return {
+      status: response.status(),
+      headers: response.headers(),
+      body: await readJsonSafe(response),
+      bytes: await response.body()
+    };
+  });
+}
+async function withAttachmentOwnerFixture(request, run) {
+  const admin = await getAuthToken(request, "admin");
+  const scope = getTokenContext(admin);
+  const prefix = `attachment-owner-${randomUUID()}`;
+  const users = [], documents = [], attachments = [], keys = [];
+  let roleId = null;
+  try {
+    roleId = await createRoleFixture(request, admin, { name: prefix, tenantId: scope.tenantId });
+    await setRoleAclFeatures(request, admin, { roleId, features: OWNER_ACCESS_FEATURES });
+    const actor = async (label) => {
+      const email = `${prefix}-${label}@example.com`, password = `Owner1!${randomUUID()}`;
+      const id = await createUserFixture(request, admin, {
+        email,
+        password,
+        organizationId: scope.organizationId,
+        roles: [roleId],
+        name: label
+      });
+      users.push(id);
+      return { id, token: await getAuthToken(request, email, password), refreshToken: async () => {
+        clearAuthTokenCache();
+        return getAuthToken(request, email, password);
+      } };
+    };
+    const recipient = await actor("recipient"), unshared = await actor("unshared");
+    const document = async (label, token = admin) => {
+      const response = await apiRequest(request, "POST", "/api/documents", { token, data: { title: `${prefix}-${label}`, folderId: null } });
+      expect(response.status()).toBe(201);
+      const body = await readJsonSafe(response);
+      const id = expectId(body?.id, "Fixture response must include id");
+      documents.push(id);
+      return id;
+    };
+    const share = async (documentId, permission, principalType = "user", principalId = recipient.id, token = admin) => {
+      const response = await apiRequest(request, "POST", `/api/documents/${documentId}/shares`, {
+        token,
+        data: { principalType, principalId, permission }
+      });
+      expect(response.status()).toBe(201);
+      const body = await readJsonSafe(response);
+      expect(body?.updatedAt).toBeTruthy();
+      return { id: expectId(body?.id, "Fixture response must include id"), updatedAt: body.updatedAt };
+    };
+    const upload = async (documentId, label, options = {}) => {
+      const file = await uploadAttachmentFixture(request, admin, {
+        entityId: options.entityId ?? "documents:document",
+        recordId: documentId,
+        fileName: `${prefix}-${label}.txt`,
+        mimeType: "text/plain",
+        buffer: Buffer.from(`${prefix}-${label}-content`),
+        assignments: options.assignments,
+        tags: options.tags
+      });
+      attachments.push(file.id);
+      return file.id;
+    };
+    const uploadProxy = async (documentId) => {
+      const route = `/api/documents/${documentId}/attachments`;
+      const response = await request.fetch(process.env.BASE_URL?.trim() ? `${process.env.BASE_URL.trim()}${route}` : route, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${admin}` },
+        multipart: { file: { name: `${prefix}-proxy.png`, mimeType: "image/png", buffer: OWNER_ACCESS_PNG } }
+      });
+      expect(response.status()).toBe(201);
+      const body = await readJsonSafe(response);
+      return { attachmentId: expectId(body?.attachmentId, "Document upload must include attachmentId"), url: String(body?.url) };
+    };
+    const key = async () => {
+      const response = await apiRequest(request, "POST", "/api/api_keys/keys", {
+        token: admin,
+        data: { name: prefix, tenantId: scope.tenantId, organizationId: scope.organizationId, roles: [roleId] }
+      });
+      expect(response.status()).toBe(201);
+      const body = await readJsonSafe(response);
+      const id = expectId(body?.id, "Fixture response must include id");
+      keys.push(id);
+      expect(body?.secret).toMatch(/^omk_/);
+      return { id, secret: body.secret };
+    };
+    const uploadPublicImage = async (documentId) => {
+      const file = await uploadAttachmentFixture(request, admin, {
+        entityId: "catalog:catalog_product",
+        recordId: randomUUID(),
+        fileName: `${prefix}-public.png`,
+        mimeType: "image/png",
+        buffer: OWNER_ACCESS_PNG,
+        assignments: [{ type: "documents:document", id: documentId }]
+      });
+      attachments.push(file.id);
+      expect(file.partitionCode).toBe("productsMedia");
+      return file.id;
+    };
+    const visible = await document("visible"), hidden = await document("hidden"), destination = await document("destination");
+    await share(visible, "viewer");
+    await run({ admin, roleId, prefix, recipient, unshared, visible, hidden, destination, document, share, upload, uploadProxy, uploadPublicImage, key });
+  } finally {
+    for (const id of keys) await apiRequest(request, "DELETE", `/api/api_keys/keys?id=${id}`, { token: admin }).catch(() => void 0);
+    for (const id of attachments) await deleteAttachmentIfExists(request, admin, id);
+    for (const id of documents.reverse()) await apiRequest(request, "DELETE", `/api/documents/${id}`, { token: admin }).catch(() => void 0);
+    for (const id of users) await deleteUserIfExists(request, admin, id);
+    await deleteRoleIfExists(request, admin, roleId);
+  }
+}
+export {
+  OWNER_ACCESS_FEATURES,
+  OWNER_ACCESS_PNG,
+  ownerPolicyRequest,
+  withAttachmentOwnerFixture
+};
+//# sourceMappingURL=attachmentAccessFixtures.js.map

package/dist/helpers/integration/attachmentAccessFixtures.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/attachmentAccessFixtures.ts"],
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { expect, type APIRequestContext } from '@playwright/test'\nimport { apiRequest, clearAuthTokenCache, getAuthToken, withCredentialIsolatedRequest } from './api'\nimport { createRoleFixture, createUserFixture, deleteRoleIfExists, deleteUserIfExists, setRoleAclFeatures } from './authFixtures'\nimport { deleteAttachmentIfExists, uploadAttachmentFixture } from './attachmentsFixtures'\nimport { expectId, getTokenContext, readJsonSafe } from './generalFixtures'\n\nexport const OWNER_ACCESS_FEATURES = [\n  'documents.view', 'documents.edit', 'documents.create', 'documents.share', 'documents.delete',\n  'attachments.view', 'attachments.manage',\n]\nexport const OWNER_ACCESS_PNG = Buffer.from(\n  'iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAYAAABytg0kAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEUlEQVQImWMwSpn2H4QZYAwASOwIrfM45AsAAAAASUVORK5CYII=',\n  'base64',\n)\n\nexport type OwnerAccessItem = { id: string; tags?: string[]; assignments?: Array<{ type: string; id: string; label?: string | null }> }\nexport type OwnerAccessList = { items: OwnerAccessItem[]; total?: number; availableTags?: string[] }\nexport type OwnerAccessActor = { id: string; token: string; refreshToken: () => Promise<string> }\ntype Assignment = { type: string; id: string; label?: string }\ntype Share = { id: string; updatedAt: string }\n\nexport async function ownerPolicyRequest<Body = { error?: string }>(\n  method: string, path: string, token: string, data?: unknown, scheme: 'Bearer' | 'ApiKey' = 'Bearer',\n) {\n  return withCredentialIsolatedRequest(async (isolated) => {\n    const response = await isolated.fetch(path, {\n      method, headers: { Authorization: `${scheme} ${token}`, 'Content-Type': 'application/json' },\n      ...(data === undefined ? {} : { data }),\n    })\n    return {\n      status: response.status(), headers: response.headers(),\n      body: await readJsonSafe<Body>(response), bytes: await response.body(),\n    }\n  })\n}\n\nexport type AttachmentOwnerFixture = {\n  admin: string\n  roleId: string\n  prefix: string\n  recipient: OwnerAccessActor\n  unshared: OwnerAccessActor\n  visible: string\n  hidden: string\n  destination: string\n  document: (label: string, token?: string) => Promise<string>\n  share: (documentId: string, permission: 'viewer' | 'editor', principalType?: 'user' | 'role', principalId?: string, token?: string) => Promise<Share>\n  upload: (documentId: string, label: string, options?: { entityId?: string; assignments?: Assignment[]; tags?: string[] }) => Promise<string>\n  uploadProxy: (documentId: string) => Promise<{ attachmentId: string; url: string }>\n  uploadPublicImage: (documentId: string) => Promise<string>\n  key: () => Promise<{ id: string; secret: string }>\n}\n\nexport async function withAttachmentOwnerFixture(\n  request: APIRequestContext, run: (fixture: AttachmentOwnerFixture) => Promise<void>,\n): Promise<void> {\n  const admin = await getAuthToken(request, 'admin')\n  const scope = getTokenContext(admin)\n  const prefix = `attachment-owner-${randomUUID()}`\n  const users: string[] = [], documents: string[] = [], attachments: string[] = [], keys: string[] = []\n  let roleId: string | null = null\n  try {\n    roleId = await createRoleFixture(request, admin, { name: prefix, tenantId: scope.tenantId })\n    await setRoleAclFeatures(request, admin, { roleId, features: OWNER_ACCESS_FEATURES })\n    const actor = async (label: string): Promise<OwnerAccessActor> => {\n      const email = `${prefix}-${label}@example.com`, password = `Owner1!${randomUUID()}`\n      const id = await createUserFixture(request, admin, {\n        email, password, organizationId: scope.organizationId, roles: [roleId!], name: label,\n      })\n      users.push(id)\n      return { id, token: await getAuthToken(request, email, password), refreshToken: async () => {\n        clearAuthTokenCache()\n        return getAuthToken(request, email, password)\n      } }\n    }\n    const recipient = await actor('recipient'), unshared = await actor('unshared')\n    const document = async (label: string, token = admin): Promise<string> => {\n      const response = await apiRequest(request, 'POST', '/api/documents', { token, data: { title: `${prefix}-${label}`, folderId: null } })\n      expect(response.status()).toBe(201)\n      const body = await readJsonSafe<{ id: string }>(response)\n      const id = expectId(body?.id, 'Fixture response must include id'); documents.push(id); return id\n    }\n    const share: AttachmentOwnerFixture['share'] = async (documentId, permission, principalType = 'user', principalId = recipient.id, token = admin) => {\n      const response = await apiRequest(request, 'POST', `/api/documents/${documentId}/shares`, {\n        token, data: { principalType, principalId, permission },\n      })\n      expect(response.status()).toBe(201)\n      const body = await readJsonSafe<Share>(response)\n      expect(body?.updatedAt).toBeTruthy()\n      return { id: expectId(body?.id, 'Fixture response must include id'), updatedAt: body!.updatedAt }\n    }\n    const upload: AttachmentOwnerFixture['upload'] = async (documentId, label, options = {}) => {\n      const file = await uploadAttachmentFixture(request, admin, {\n        entityId: options.entityId ?? 'documents:document', recordId: documentId,\n        fileName: `${prefix}-${label}.txt`, mimeType: 'text/plain', buffer: Buffer.from(`${prefix}-${label}-content`),\n        assignments: options.assignments, tags: options.tags,\n      })\n      attachments.push(file.id); return file.id\n    }\n    const uploadProxy = async (documentId: string) => {\n      const route = `/api/documents/${documentId}/attachments`\n      const response = await request.fetch(process.env.BASE_URL?.trim() ? `${process.env.BASE_URL.trim()}${route}` : route, {\n        method: 'POST', headers: { Authorization: `Bearer ${admin}` },\n        multipart: { file: { name: `${prefix}-proxy.png`, mimeType: 'image/png', buffer: OWNER_ACCESS_PNG } },\n      })\n      expect(response.status()).toBe(201)\n      const body = await readJsonSafe<{ attachmentId: string; url: string }>(response)\n      return { attachmentId: expectId(body?.attachmentId, 'Document upload must include attachmentId'), url: String(body?.url) }\n    }\n    const key = async () => {\n      const response = await apiRequest(request, 'POST', '/api/api_keys/keys', {\n        token: admin, data: { name: prefix, tenantId: scope.tenantId, organizationId: scope.organizationId, roles: [roleId] },\n      })\n      expect(response.status()).toBe(201)\n      const body = await readJsonSafe<{ id: string; secret: string }>(response)\n      const id = expectId(body?.id, 'Fixture response must include id'); keys.push(id)\n      expect(body?.secret).toMatch(/^omk_/)\n      return { id, secret: body!.secret }\n    }\n    const uploadPublicImage = async (documentId: string) => {\n      const file = await uploadAttachmentFixture(request, admin, {\n        entityId: 'catalog:catalog_product', recordId: randomUUID(),\n        fileName: `${prefix}-public.png`, mimeType: 'image/png', buffer: OWNER_ACCESS_PNG,\n        assignments: [{ type: 'documents:document', id: documentId }],\n      })\n      attachments.push(file.id)\n      expect(file.partitionCode).toBe('productsMedia')\n      return file.id\n    }\n    const visible = await document('visible'), hidden = await document('hidden'), destination = await document('destination')\n    await share(visible, 'viewer')\n    await run({ admin, roleId, prefix, recipient, unshared, visible, hidden, destination, document, share, upload, uploadProxy, uploadPublicImage, key })\n  } finally {\n    for (const id of keys) await apiRequest(request, 'DELETE', `/api/api_keys/keys?id=${id}`, { token: admin }).catch(() => undefined)\n    for (const id of attachments) await deleteAttachmentIfExists(request, admin, id)\n    for (const id of documents.reverse()) await apiRequest(request, 'DELETE', `/api/documents/${id}`, { token: admin }).catch(() => undefined)\n    for (const id of users) await deleteUserIfExists(request, admin, id)\n    await deleteRoleIfExists(request, admin, roleId)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,cAAsC;AAC/C,SAAS,YAAY,qBAAqB,cAAc,qCAAqC;AAC7F,SAAS,mBAAmB,mBAAmB,oBAAoB,oBAAoB,0BAA0B;AACjH,SAAS,0BAA0B,+BAA+B;AAClE,SAAS,UAAU,iBAAiB,oBAAoB;AAEjD,MAAM,wBAAwB;AAAA,EACnC;AAAA,EAAkB;AAAA,EAAkB;AAAA,EAAoB;AAAA,EAAmB;AAAA,EAC3E;AAAA,EAAoB;AACtB;AACO,MAAM,mBAAmB,OAAO;AAAA,EACrC;AAAA,EACA;AACF;AAQA,eAAsB,mBACpB,QAAgB,MAAc,OAAe,MAAgB,SAA8B,UAC3F;AACA,SAAO,8BAA8B,OAAO,aAAa;AACvD,UAAM,WAAW,MAAM,SAAS,MAAM,MAAM;AAAA,MAC1C;AAAA,MAAQ,SAAS,EAAE,eAAe,GAAG,MAAM,IAAI,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,MAC3F,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACvC,CAAC;AACD,WAAO;AAAA,MACL,QAAQ,SAAS,OAAO;AAAA,MAAG,SAAS,SAAS,QAAQ;AAAA,MACrD,MAAM,MAAM,aAAmB,QAAQ;AAAA,MAAG,OAAO,MAAM,SAAS,KAAK;AAAA,IACvE;AAAA,EACF,CAAC;AACH;AAmBA,eAAsB,2BACpB,SAA4B,KACb;AACf,QAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AACjD,QAAM,QAAQ,gBAAgB,KAAK;AACnC,QAAM,SAAS,oBAAoB,WAAW,CAAC;AAC/C,QAAM,QAAkB,CAAC,GAAG,YAAsB,CAAC,GAAG,cAAwB,CAAC,GAAG,OAAiB,CAAC;AACpG,MAAI,SAAwB;AAC5B,MAAI;AACF,aAAS,MAAM,kBAAkB,SAAS,OAAO,EAAE,MAAM,QAAQ,UAAU,MAAM,SAAS,CAAC;AAC3F,UAAM,mBAAmB,SAAS,OAAO,EAAE,QAAQ,UAAU,sBAAsB,CAAC;AACpF,UAAM,QAAQ,OAAO,UAA6C;AAChE,YAAM,QAAQ,GAAG,MAAM,IAAI,KAAK,gBAAgB,WAAW,UAAU,WAAW,CAAC;AACjF,YAAM,KAAK,MAAM,kBAAkB,SAAS,OAAO;AAAA,QACjD;AAAA,QAAO;AAAA,QAAU,gBAAgB,MAAM;AAAA,QAAgB,OAAO,CAAC,MAAO;AAAA,QAAG,MAAM;AAAA,MACjF,CAAC;AACD,YAAM,KAAK,EAAE;AACb,aAAO,EAAE,IAAI,OAAO,MAAM,aAAa,SAAS,OAAO,QAAQ,GAAG,cAAc,YAAY;AAC1F,4BAAoB;AACpB,eAAO,aAAa,SAAS,OAAO,QAAQ;AAAA,MAC9C,EAAE;AAAA,IACJ;AACA,UAAM,YAAY,MAAM,MAAM,WAAW,GAAG,WAAW,MAAM,MAAM,UAAU;AAC7E,UAAM,WAAW,OAAO,OAAe,QAAQ,UAA2B;AACxE,YAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,kBAAkB,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,KAAK,IAAI,UAAU,KAAK,EAAE,CAAC;AACrI,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,YAAM,OAAO,MAAM,aAA6B,QAAQ;AACxD,YAAM,KAAK,SAAS,MAAM,IAAI,kCAAkC;AAAG,gBAAU,KAAK,EAAE;AAAG,aAAO;AAAA,IAChG;AACA,UAAM,QAAyC,OAAO,YAAY,YAAY,gBAAgB,QAAQ,cAAc,UAAU,IAAI,QAAQ,UAAU;AAClJ,YAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,kBAAkB,UAAU,WAAW;AAAA,QACxF;AAAA,QAAO,MAAM,EAAE,eAAe,aAAa,WAAW;AAAA,MACxD,CAAC;AACD,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,YAAM,OAAO,MAAM,aAAoB,QAAQ;AAC/C,aAAO,MAAM,SAAS,EAAE,WAAW;AACnC,aAAO,EAAE,IAAI,SAAS,MAAM,IAAI,kCAAkC,GAAG,WAAW,KAAM,UAAU;AAAA,IAClG;AACA,UAAM,SAA2C,OAAO,YAAY,OAAO,UAAU,CAAC,MAAM;AAC1F,YAAM,OAAO,MAAM,wBAAwB,SAAS,OAAO;AAAA,QACzD,UAAU,QAAQ,YAAY;AAAA,QAAsB,UAAU;AAAA,QAC9D,UAAU,GAAG,MAAM,IAAI,KAAK;AAAA,QAAQ,UAAU;AAAA,QAAc,QAAQ,OAAO,KAAK,GAAG,MAAM,IAAI,KAAK,UAAU;AAAA,QAC5G,aAAa,QAAQ;AAAA,QAAa,MAAM,QAAQ;AAAA,MAClD,CAAC;AACD,kBAAY,KAAK,KAAK,EAAE;AAAG,aAAO,KAAK;AAAA,IACzC;AACA,UAAM,cAAc,OAAO,eAAuB;AAChD,YAAM,QAAQ,kBAAkB,UAAU;AAC1C,YAAM,WAAW,MAAM,QAAQ,MAAM,QAAQ,IAAI,UAAU,KAAK,IAAI,GAAG,QAAQ,IAAI,SAAS,KAAK,CAAC,GAAG,KAAK,KAAK,OAAO;AAAA,QACpH,QAAQ;AAAA,QAAQ,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,QAC5D,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,cAAc,UAAU,aAAa,QAAQ,iBAAiB,EAAE;AAAA,MACtG,CAAC;AACD,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,YAAM,OAAO,MAAM,aAAoD,QAAQ;AAC/E,aAAO,EAAE,cAAc,SAAS,MAAM,cAAc,2CAA2C,GAAG,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,IAC3H;AACA,UAAM,MAAM,YAAY;AACtB,YAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,sBAAsB;AAAA,QACvE,OAAO;AAAA,QAAO,MAAM,EAAE,MAAM,QAAQ,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,OAAO,CAAC,MAAM,EAAE;AAAA,MACtH,CAAC;AACD,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,YAAM,OAAO,MAAM,aAA6C,QAAQ;AACxE,YAAM,KAAK,SAAS,MAAM,IAAI,kCAAkC;AAAG,WAAK,KAAK,EAAE;AAC/E,aAAO,MAAM,MAAM,EAAE,QAAQ,OAAO;AACpC,aAAO,EAAE,IAAI,QAAQ,KAAM,OAAO;AAAA,IACpC;AACA,UAAM,oBAAoB,OAAO,eAAuB;AACtD,YAAM,OAAO,MAAM,wBAAwB,SAAS,OAAO;AAAA,QACzD,UAAU;AAAA,QAA2B,UAAU,WAAW;AAAA,QAC1D,UAAU,GAAG,MAAM;AAAA,QAAe,UAAU;AAAA,QAAa,QAAQ;AAAA,QACjE,aAAa,CAAC,EAAE,MAAM,sBAAsB,IAAI,WAAW,CAAC;AAAA,MAC9D,CAAC;AACD,kBAAY,KAAK,KAAK,EAAE;AACxB,aAAO,KAAK,aAAa,EAAE,KAAK,eAAe;AAC/C,aAAO,KAAK;AAAA,IACd;AACA,UAAM,UAAU,MAAM,SAAS,SAAS,GAAG,SAAS,MAAM,SAAS,QAAQ,GAAG,cAAc,MAAM,SAAS,aAAa;AACxH,UAAM,MAAM,SAAS,QAAQ;AAC7B,UAAM,IAAI,EAAE,OAAO,QAAQ,QAAQ,WAAW,UAAU,SAAS,QAAQ,aAAa,UAAU,OAAO,QAAQ,aAAa,mBAAmB,IAAI,CAAC;AAAA,EACtJ,UAAE;AACA,eAAW,MAAM,KAAM,OAAM,WAAW,SAAS,UAAU,yBAAyB,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AACjI,eAAW,MAAM,YAAa,OAAM,yBAAyB,SAAS,OAAO,EAAE;AAC/E,eAAW,MAAM,UAAU,QAAQ,EAAG,OAAM,WAAW,SAAS,UAAU,kBAAkB,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AACzI,eAAW,MAAM,MAAO,OAAM,mBAAmB,SAAS,OAAO,EAAE;AACnE,UAAM,mBAAmB,SAAS,OAAO,MAAM;AAAA,EACjD;AACF;",
+  "names": []
+}

package/dist/modules/api_keys/data/entities.js

@@ -41,6 +41,9 @@ __decorateClass([
 __decorateClass([
   Property({ name: "created_by", type: "uuid", nullable: true })
 ], ApiKey.prototype, "createdBy", 2);
+__decorateClass([
+  Property({ name: "session_token_hash", type: "text", nullable: true })
+], ApiKey.prototype, "sessionTokenHash", 2);
 __decorateClass([
   Property({ name: "session_token", type: "text", nullable: true })
 ], ApiKey.prototype, "sessionToken", 2);
@@ -74,6 +77,10 @@ ApiKey = __decorateClass([
   Index({
     name: "api_keys_opencode_session_id_uq",
     expression: 'create unique index "api_keys_opencode_session_id_uq" on "api_keys" ("opencode_session_id") where "opencode_session_id" is not null and "deleted_at" is null'
+  }),
+  Index({
+    name: "api_keys_session_token_hash_uq",
+    expression: 'create unique index "api_keys_session_token_hash_uq" on "api_keys" ("session_token_hash") where "session_token_hash" is not null and "deleted_at" is null'
   })
 ], ApiKey);
 export {

package/dist/modules/api_keys/data/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/api_keys/data/entities.ts"],
-  "sourcesContent": ["import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\n@Entity({ tableName: 'api_keys' })\n// The unique keyPrefix bounds the bcrypt candidate loop in findApiKeyBySecret to at\n// most one live row. Do not drop this constraint or widen the prefix space without\n// re-evaluating that loop's per-request cost (see #3812).\n@Unique({ properties: ['keyPrefix'] })\n@Index({\n  name: 'api_keys_opencode_session_id_uq',\n  expression:\n    'create unique index \"api_keys_opencode_session_id_uq\" on \"api_keys\" (\"opencode_session_id\") where \"opencode_session_id\" is not null and \"deleted_at\" is null',\n})\nexport class ApiKey {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ name: 'description', type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'key_hash', type: 'text' })\n  keyHash!: string\n\n  @Property({ name: 'key_prefix', type: 'text' })\n  keyPrefix!: string\n\n  @Property({ name: 'roles_json', type: 'json', nullable: true })\n  rolesJson?: string[] | null\n\n  @Property({ name: 'created_by', type: 'uuid', nullable: true })\n  createdBy?: string | null\n\n  /** Session token for ephemeral session-scoped keys (used by AI chat) */\n  @Property({ name: 'session_token', type: 'text', nullable: true })\n  sessionToken?: string | null\n\n  /** User ID who owns this session (for ephemeral keys) */\n  @Property({ name: 'session_user_id', type: 'uuid', nullable: true })\n  sessionUserId?: string | null\n\n  /** Encrypted API key secret for session keys (recoverable for API calls) */\n  @Property({ name: 'session_secret_encrypted', type: 'text', nullable: true })\n  sessionSecretEncrypted?: string | null\n\n  /**\n   * OpenCode session id bound to this api_key row. Set the first time the\n   * chat dispatcher receives a `done` event after minting a session token,\n   * then asserted on every subsequent resume to prevent cross-user session\n   * continuation (see security fix 2026-05-23).\n   */\n  @Property({ name: 'opencode_session_id', type: 'text', nullable: true })\n  opencodeSessionId?: string | null\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date | null\n\n  @Property({ name: 'expires_at', type: Date, nullable: true })\n  expiresAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAYrD,IAAM,SAAN,MAAa;AAAA,EAAb;AAwDL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AA7DE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,OAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,OAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPpD,OAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVlD,OAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbxD,OAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,YAAY,MAAM,OAAO,CAAC;AAAA,GAhBjC,OAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAnBnC,OAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtBnD,OAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBnD,OA0BX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA7BtD,OA8BX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjCxD,OAkCX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,4BAA4B,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GArCjE,OAsCX;AASA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA9C5D,OA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAjDnD,OAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GApDjD,OAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAvD7D,OAwDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA1D7E,OA2DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA7DjD,OA8DX;AA9DW,SAAN;AAAA,EAVN,OAAO,EAAE,WAAW,WAAW,CAAC;AAAA,EAIhC,OAAO,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC;AAAA,EACpC,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,GACY;",
+  "sourcesContent": ["import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\n@Entity({ tableName: 'api_keys' })\n// The unique keyPrefix bounds the bcrypt candidate loop in findApiKeyBySecret to at\n// most one live row. Do not drop this constraint or widen the prefix space without\n// re-evaluating that loop's per-request cost (see #3812).\n@Unique({ properties: ['keyPrefix'] })\n@Index({\n  name: 'api_keys_opencode_session_id_uq',\n  expression:\n    'create unique index \"api_keys_opencode_session_id_uq\" on \"api_keys\" (\"opencode_session_id\") where \"opencode_session_id\" is not null and \"deleted_at\" is null',\n})\n@Index({\n  name: 'api_keys_session_token_hash_uq',\n  expression:\n    'create unique index \"api_keys_session_token_hash_uq\" on \"api_keys\" (\"session_token_hash\") where \"session_token_hash\" is not null and \"deleted_at\" is null',\n})\nexport class ApiKey {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  name!: string\n\n  @Property({ name: 'description', type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'key_hash', type: 'text' })\n  keyHash!: string\n\n  @Property({ name: 'key_prefix', type: 'text' })\n  keyPrefix!: string\n\n  @Property({ name: 'roles_json', type: 'json', nullable: true })\n  rolesJson?: string[] | null\n\n  @Property({ name: 'created_by', type: 'uuid', nullable: true })\n  createdBy?: string | null\n\n  /**\n   * SHA-256 hash of the session token for ephemeral session-scoped keys (used by AI chat).\n   * The raw token is a bearer credential \u2014 the same one that unlocks the decrypted API key\n   * secret and the user's ACL on the MCP server \u2014 so, like `customer_accounts` session\n   * tokens, only its hash is persisted. It is returned to the caller once, at issuance, and\n   * never stored or logged in the clear (see #2254).\n   */\n  @Property({ name: 'session_token_hash', type: 'text', nullable: true })\n  sessionTokenHash?: string | null\n\n  /**\n   * @deprecated Superseded by `sessionTokenHash` (#2254) \u2014 nothing reads or writes this\n   * anymore and `Migration20261012202110_api_keys` nulls out every existing value as part of\n   * scrubbing the plaintext token. Kept, not dropped, per the \"renamed/removed DB column\" rule in\n   * `.ai/review-checklist.md` (keep old column, add new one, backfill, deprecate old) \u2014 chat\n   * sessions in flight across the deploy carry a 2-hour TTL and only mint once per\n   * conversation (`ai_assistant`'s chat route, `!sessionId` branch), so the column must survive\n   * long enough for every session minted before this ships to expire naturally. Safe to drop in\n   * a later migration once that window has passed.\n   */\n  @Property({ name: 'session_token', type: 'text', nullable: true })\n  sessionToken?: string | null\n\n  /** User ID who owns this session (for ephemeral keys) */\n  @Property({ name: 'session_user_id', type: 'uuid', nullable: true })\n  sessionUserId?: string | null\n\n  /** Encrypted API key secret for session keys (recoverable for API calls) */\n  @Property({ name: 'session_secret_encrypted', type: 'text', nullable: true })\n  sessionSecretEncrypted?: string | null\n\n  /**\n   * OpenCode session id bound to this api_key row. Set the first time the\n   * chat dispatcher receives a `done` event after minting a session token,\n   * then asserted on every subsequent resume to prevent cross-user session\n   * continuation (see security fix 2026-05-23).\n   */\n  @Property({ name: 'opencode_session_id', type: 'text', nullable: true })\n  opencodeSessionId?: string | null\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date | null\n\n  @Property({ name: 'expires_at', type: Date, nullable: true })\n  expiresAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })\n  updatedAt?: Date\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAiBrD,IAAM,SAAN,MAAa;AAAA,EAAb;AA2EL,qBAAkB,oBAAI,KAAK;AAAA;AAO7B;AAhFE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,OAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,OAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPpD,OAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVlD,OAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbxD,OAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,YAAY,MAAM,OAAO,CAAC;AAAA,GAhBjC,OAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAnBnC,OAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtBnD,OAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBnD,OA0BX;AAUA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnC3D,OAoCX;AAaA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhDtD,OAiDX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GApDxD,OAqDX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,4BAA4B,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAxDjE,OAyDX;AASA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjE5D,OAkEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GApEnD,OAqEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAvEjD,OAwEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA1E7D,OA2EX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,GA7E7E,OA8EX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhFjD,OAiFX;AAjFW,SAAN;AAAA,EAfN,OAAO,EAAE,WAAW,WAAW,CAAC;AAAA,EAIhC,OAAO,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC;AAAA,EACpC,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YACE;AAAA,EACJ,CAAC;AAAA,GACY;",
   "names": []
 }

package/dist/modules/api_keys/migrations/Migration20261012202110_api_keys.js

@@ -0,0 +1,30 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20261012202110_api_keys extends Migration {
+  constructor() {
+    super(...arguments);
+    this.name = "Migration20261012202110";
+  }
+  async up() {
+    this.addSql(`alter table "api_keys" add "session_token_hash" text null;`);
+    this.addSql(`
+      update "api_keys"
+      set "session_token_hash" = encode(sha256("session_token"::bytea), 'hex')
+      where "session_token" is not null and "session_token_hash" is null;
+    `);
+    this.addSql(`
+      update "api_keys"
+      set "name" = '__session_' || substr("session_token_hash", 1, 12) || '__'
+      where "session_token" is not null and "name" = '__session_' || "session_token" || '__';
+    `);
+    this.addSql(`update "api_keys" set "session_token" = null where "session_token" is not null;`);
+    this.addSql(`create unique index "api_keys_session_token_hash_uq" on "api_keys" ("session_token_hash") where "session_token_hash" is not null and "deleted_at" is null;`);
+  }
+  down() {
+    this.addSql(`drop index "api_keys_session_token_hash_uq";`);
+    this.addSql(`alter table "api_keys" drop column "session_token_hash";`);
+  }
+}
+export {
+  Migration20261012202110_api_keys
+};
+//# sourceMappingURL=Migration20261012202110_api_keys.js.map

package/dist/modules/api_keys/migrations/Migration20261012202110_api_keys.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/api_keys/migrations/Migration20261012202110_api_keys.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20261012202110_api_keys extends Migration {\n\n  override name = 'Migration20261012202110';\n\n  override async up(): Promise<void> {\n    this.addSql(`alter table \"api_keys\" add \"session_token_hash\" text null;`);\n\n    // Backfill before switching any lookup to the hash column (#2254). AI-chat session keys\n    // carry a 2-hour TTL and mint once per conversation (ai_assistant chat route, `!sessionId`\n    // branch) \u2014 a session already in flight when this deploys must keep resolving, or the\n    // conversation silently loses its MCP tool-call auth with no automatic re-mint. `sha256()`\n    // is a PostgreSQL 13+ built-in (no pgcrypto dependency) and matches\n    // `hashSessionToken`'s `createHash('sha256').update(token).digest('hex')` byte for byte.\n    this.addSql(`\n      update \"api_keys\"\n      set \"session_token_hash\" = encode(sha256(\"session_token\"::bytea), 'hex')\n      where \"session_token\" is not null and \"session_token_hash\" is null;\n    `);\n\n    // Legacy rows embedded the raw token in `name` (`__session_<token>__`, for operator\n    // visibility in an admin listing) \u2014 the same credential leaking a second way. Replace it\n    // with a hash-derived, non-secret label before the token itself is cleared below.\n    this.addSql(`\n      update \"api_keys\"\n      set \"name\" = '__session_' || substr(\"session_token_hash\", 1, 12) || '__'\n      where \"session_token\" is not null and \"name\" = '__session_' || \"session_token\" || '__';\n    `);\n\n    // Stop storing the plaintext bearer credential. The column is kept, not dropped, per the\n    // \"renamed/removed DB column\" rule in `.ai/review-checklist.md` (keep old column, add new\n    // one, backfill, deprecate old) \u2014 see `ApiKey.sessionToken`'s `@deprecated` doc comment for\n    // the removal criteria for a later migration.\n    this.addSql(`update \"api_keys\" set \"session_token\" = null where \"session_token\" is not null;`);\n\n    this.addSql(`create unique index \"api_keys_session_token_hash_uq\" on \"api_keys\" (\"session_token_hash\") where \"session_token_hash\" is not null and \"deleted_at\" is null;`);\n  }\n\n  override down(): void | Promise<void> {\n    // Schema-only reversal. The plaintext `session_token` values cleared above cannot be\n    // restored \u2014 that data loss is the point of the migration, not an oversight.\n    this.addSql(`drop index \"api_keys_session_token_hash_uq\";`);\n    this.addSql(`alter table \"api_keys\" drop column \"session_token_hash\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,yCAAyC,UAAU;AAAA,EAAzD;AAAA;AAEL,SAAS,OAAO;AAAA;AAAA,EAEhB,MAAe,KAAoB;AACjC,SAAK,OAAO,4DAA4D;AAQxE,SAAK,OAAO;AAAA;AAAA;AAAA;AAAA,KAIX;AAKD,SAAK,OAAO;AAAA;AAAA;AAAA;AAAA,KAIX;AAMD,SAAK,OAAO,iFAAiF;AAE7F,SAAK,OAAO,4JAA4J;AAAA,EAC1K;AAAA,EAES,OAA6B;AAGpC,SAAK,OAAO,8CAA8C;AAC1D,SAAK,OAAO,0DAA0D;AAAA,EACxE;AAEF;",
+  "names": []
+}

package/dist/modules/api_keys/services/apiKeyService.js

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { randomBytes, createHash } from "node:crypto";
 import { hash, compare } from "bcryptjs";
 import { ApiKey } from "../data/entities.js";
 import { createKmsService, resolveEncryptionMode } from "@open-mercato/shared/lib/encryption/kms";
@@ -123,18 +123,22 @@ async function findApiKeyBySecret(em, secret) {
 function generateSessionToken() {
   return `sess_${randomBytes(16).toString("hex")}`;
 }
+function hashSessionToken(sessionToken) {
+  return createHash("sha256").update(sessionToken).digest("hex");
+}
 async function createSessionApiKey(em, input) {
   const { secret, prefix } = generateApiKeySecret();
   const ttl = input.ttlMinutes ?? 30;
   const expiresAt = new Date(Date.now() + ttl * 60 * 1e3);
   const keyHash = await hashApiKey(secret);
   const encryptedSecret = await encryptSessionSecret(secret, input.tenantId ?? null);
+  const sessionTokenHash = hashSessionToken(input.sessionToken);
   const roleIds = Array.from(new Set(input.userRoles.filter(Boolean))).sort((left, right) => left.localeCompare(right));
   let record;
   await withAtomicFlush(em, [async () => {
     await lockRoleWriterAuthorizationState(em, roleIds);
     record = em.create(ApiKey, {
-      name: `__session_${input.sessionToken}__`,
+      name: `__session_${sessionTokenHash.slice(0, 12)}__`,
       description: "Ephemeral session API key for AI chat",
       tenantId: input.tenantId ?? null,
       organizationId: input.organizationId ?? null,
@@ -142,7 +146,7 @@ async function createSessionApiKey(em, input) {
       keyPrefix: prefix,
       rolesJson: roleIds,
       createdBy: input.userId,
-      sessionToken: input.sessionToken,
+      sessionTokenHash,
       sessionUserId: input.userId,
       sessionSecretEncrypted: encryptedSecret,
       expiresAt,
@@ -158,10 +162,17 @@ async function createSessionApiKey(em, input) {
 }
 async function findApiKeyBySessionToken(em, sessionToken) {
   if (!sessionToken) return null;
-  const record = await em.findOne(ApiKey, {
-    sessionToken,
-    deletedAt: null
-  });
+  const sessionTokenHash = hashSessionToken(sessionToken);
+  let record = await em.findOne(ApiKey, { sessionTokenHash, deletedAt: null });
+  if (!record) {
+    const legacyRecord = await em.findOne(ApiKey, { sessionToken, deletedAt: null });
+    if (legacyRecord) {
+      legacyRecord.sessionTokenHash = sessionTokenHash;
+      legacyRecord.sessionToken = null;
+      await em.persist(legacyRecord).flush();
+      record = legacyRecord;
+    }
+  }
   if (!record) return null;
   if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null;
   return record;
@@ -204,12 +215,22 @@ async function findSessionApiKeyWithSecret(em, sessionToken) {
   return { key: record, secret };
 }
 async function deleteSessionApiKey(em, sessionToken) {
-  const candidate = await em.findOne(ApiKey, { sessionToken, deletedAt: null });
+  const sessionTokenHash = hashSessionToken(sessionToken);
+  let candidate = await em.findOne(ApiKey, { sessionTokenHash, deletedAt: null });
+  if (!candidate) {
+    const legacyCandidate = await em.findOne(ApiKey, { sessionToken, deletedAt: null });
+    if (legacyCandidate) {
+      legacyCandidate.sessionTokenHash = sessionTokenHash;
+      legacyCandidate.sessionToken = null;
+      await em.persist(legacyCandidate).flush();
+      candidate = legacyCandidate;
+    }
+  }
   if (!candidate) return;
   let deletedId = null;
   await withAtomicFlush(em, [async () => {
     const records = await lockAuthorizationApiKeyRows(em, [String(candidate.id)]);
-    const record = records.find((entry) => String(entry.id) === String(candidate.id) && entry.sessionToken === sessionToken && !entry.deletedAt);
+    const record = records.find((entry) => String(entry.id) === String(candidate.id) && entry.sessionTokenHash === sessionTokenHash && !entry.deletedAt);
     if (!record) return;
     record.deletedAt = /* @__PURE__ */ new Date();
     await em.persist(record).flush();
@@ -251,6 +272,7 @@ export {
   generateApiKeySecret,
   generateSessionToken,
   hashApiKey,
+  hashSessionToken,
   verifyApiKey,
   withOnetimeApiKey
 };

package/dist/modules/api_keys/services/apiKeyService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/api_keys/services/apiKeyService.ts"],
-  "sourcesContent": ["import { randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { hash, compare } from 'bcryptjs'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { ApiKey } from '../data/entities'\nimport { createKmsService, resolveEncryptionMode } from '@open-mercato/shared/lib/encryption/kms'\nimport { encryptWithAesGcm, decryptWithAesGcm, looksLikeEncryptedPayload } from '@open-mercato/shared/lib/encryption/aes'\nimport { getSharedApiKeyAuthCache } from '@open-mercato/shared/lib/auth/apiKeyAuthCache'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport {\n  lockAuthorizationApiKeyRows,\n  lockRoleWriterAuthorizationState,\n} from '@open-mercato/core/modules/auth/lib/authorizationStateLocks'\n\nconst logger = createLogger('api_keys').child({ component: 'api-key-service' })\n\nconst BCRYPT_COST = 10\n\n// =============================================================================\n// Session Secret Encryption Helpers\n// =============================================================================\n\n/**\n * Seal an ephemeral session API key secret for storage in `session_secret_encrypted`.\n *\n * Returns null when the secret cannot be stored at all, which costs the caller MCP session-token\n * auth (the secret is unrecoverable and `findSessionApiKeyWithSecret` gives up).\n *\n * Under `TENANT_DATA_ENCRYPTION=no` the secret is stored as-is. That is the same bargain the rest\n * of the system already strikes in that mode -- emails, integration credentials and the search\n * index all sit in plaintext -- and it is what keeps the AI chat working when an operator opts\n * out. A DEK that is merely unreachable is a different situation and still yields null: writing a\n * secret in the clear because Vault happens to be down is not a downgrade anyone asked for.\n */\nasync function encryptSessionSecret(\n  secret: string,\n  tenantId: string | null\n): Promise<string | null> {\n  if (!tenantId) return null\n\n  const kms = createKmsService()\n  const mode = resolveEncryptionMode(kms)\n  if (mode === 'disabled') return secret\n  if (mode === 'unavailable') {\n    logger.warn(\n      'Tenant data encryption is enabled but no DEK is reachable; session secret not stored. '\n        + 'MCP session-token auth will fail until the KMS recovers.',\n      { tenantId },\n    )\n    return null\n  }\n\n  const dek = await kms.getTenantDek(tenantId)\n  if (!dek) {\n    // Try to create a DEK if one doesn't exist\n    const created = await kms.createTenantDek(tenantId)\n    if (!created) return null\n    const encrypted = encryptWithAesGcm(secret, created.key)\n    return encrypted.value\n  }\n\n  const encrypted = encryptWithAesGcm(secret, dek.key)\n  return encrypted.value\n}\n\n/**\n * Recover a session API key secret written by {@link encryptSessionSecret}.\n * Returns null if it cannot be recovered.\n */\nasync function decryptSessionSecret(\n  stored: string,\n  tenantId: string | null\n): Promise<string | null> {\n  if (!tenantId || !stored) return null\n\n  const kms = createKmsService()\n  const mode = resolveEncryptionMode(kms)\n  if (mode === 'disabled') {\n    // Written in the clear by the branch above -- unless it predates the toggle being flipped, in\n    // which case it is a sealed envelope no key can open and null is the honest answer.\n    return looksLikeEncryptedPayload(stored) ? null : stored\n  }\n  if (mode === 'unavailable') {\n    logger.warn('Tenant data encryption is enabled but no DEK is reachable; cannot recover session secret', { tenantId })\n    return null\n  }\n\n  // Mirror of the `disabled` branch: a secret written in the clear while the toggle was off is\n  // still recoverable after it is switched back on. Without this `decryptWithAesGcm` reads the\n  // plaintext as a malformed envelope and returns null, so the flip would silently break every\n  // live session rather than only the ones sealed under the old setting.\n  if (!looksLikeEncryptedPayload(stored)) return stored\n\n  const dek = await kms.getTenantDek(tenantId)\n  if (!dek) return null\n\n  return decryptWithAesGcm(stored, dek.key)\n}\n\nexport type CreateApiKeyInput = {\n  name: string\n  description?: string | null\n  tenantId?: string | null\n  organizationId?: string | null\n  roles?: string[]\n  expiresAt?: Date | null\n  createdBy?: string | null\n}\n\nexport type ApiKeyWithSecret = {\n  record: ApiKey\n  secret: string\n}\n\nexport function generateApiKeySecret(): { secret: string; prefix: string } {\n  const short = randomBytes(4).toString('hex')\n  const body = randomBytes(24).toString('hex')\n  const secret = `omk_${short}.${body}`\n  const prefix = secret.slice(0, 12)\n  return { secret, prefix }\n}\n\nexport async function hashApiKey(secret: string): Promise<string> {\n  return hash(secret, BCRYPT_COST)\n}\n\nexport async function verifyApiKey(secret: string, keyHash: string): Promise<boolean> {\n  return compare(secret, keyHash)\n}\n\nexport async function createApiKey(\n  em: EntityManager,\n  input: CreateApiKeyInput,\n  opts: {\n    rbac?: RbacService\n    authorizeRoles?: (roleIds: readonly string[]) => Promise<void> | void\n  } = {},\n): Promise<ApiKeyWithSecret> {\n  const { secret, prefix } = generateApiKeySecret()\n  const keyHash = await hashApiKey(secret)\n  const roleIds = Array.from(new Set((input.roles ?? []).filter(Boolean))).sort((left, right) => left.localeCompare(right))\n  let record!: ApiKey\n  await withAtomicFlush(em, [async () => {\n    await lockRoleWriterAuthorizationState(em, roleIds)\n    await opts.authorizeRoles?.(roleIds)\n    record = em.create(ApiKey, {\n      name: input.name,\n      description: input.description ?? null,\n      tenantId: input.tenantId ?? null,\n      organizationId: input.organizationId ?? null,\n      keyHash,\n      keyPrefix: prefix,\n      rolesJson: roleIds,\n      createdBy: input.createdBy ?? null,\n      expiresAt: input.expiresAt ?? null,\n      createdAt: new Date(),\n    })\n    em.persist(record)\n  }], { transaction: true, label: 'api_keys.create' })\n  if (opts.rbac) {\n    await opts.rbac.invalidateUserCache(`api_key:${record.id}`)\n  }\n  return { record, secret }\n}\n\nexport async function deleteApiKey(\n  em: EntityManager,\n  id: string,\n  opts: { rbac?: RbacService; authorize?: (record: ApiKey) => Promise<void> | void } = {},\n): Promise<boolean> {\n  let deletedId: string | null = null\n  await withAtomicFlush(em, [async () => {\n    const records = await lockAuthorizationApiKeyRows(em, [id])\n    const record = records.find((candidate) => String(candidate.id) === id)\n    if (!record || record.deletedAt) return\n    await opts.authorize?.(record)\n    record.deletedAt = new Date()\n    await em.persist(record).flush()\n    deletedId = String(record.id)\n  }], { transaction: true, label: 'api_keys.delete' })\n  if (!deletedId) return false\n  getSharedApiKeyAuthCache().invalidateByKeyId(deletedId)\n  if (opts.rbac) {\n    await opts.rbac.invalidateUserCache(`api_key:${deletedId}`)\n  }\n  return true\n}\n\nexport async function findApiKeyBySecret(em: EntityManager, secret: string): Promise<ApiKey | null> {\n  if (!secret) return null\n  // Extract prefix from the secret for fast candidate lookup\n  const prefix = secret.slice(0, 12)\n  // Find candidates by prefix (fast index lookup). Invariant: the unique keyPrefix\n  // constraint plus the deletedAt: null filter keep this to at most one live row, so\n  // the bcrypt loop below stays bounded. Do not widen the prefix space or relax either\n  // filter without re-evaluating that cost (see #3812).\n  const candidates = await em.find(ApiKey, { keyPrefix: prefix, deletedAt: null })\n  // Verify each candidate with bcrypt until we find a match\n  for (const candidate of candidates) {\n    if (candidate.expiresAt && candidate.expiresAt.getTime() < Date.now()) continue\n    const isValid = await verifyApiKey(secret, candidate.keyHash)\n    if (isValid) return candidate\n  }\n  return null\n}\n\n// =============================================================================\n// Session-scoped API Keys (for AI Chat ephemeral authorization)\n// =============================================================================\n\nexport type CreateSessionApiKeyInput = {\n  sessionToken: string\n  userId: string\n  userRoles: string[]\n  tenantId?: string | null\n  organizationId?: string | null\n  ttlMinutes?: number\n}\n\n/**\n * Generate a unique session token for ephemeral API keys.\n * Format: sess_{32 hex chars}\n */\nexport function generateSessionToken(): string {\n  return `sess_${randomBytes(16).toString('hex')}`\n}\n\n/**\n * Create an ephemeral API key scoped to a chat session.\n * The key inherits the user's roles and expires after ttlMinutes (default 30).\n * The API key secret is encrypted and stored so it can be recovered for API calls.\n */\nexport async function createSessionApiKey(\n  em: EntityManager,\n  input: CreateSessionApiKeyInput\n): Promise<{ keyId: string; secret: string; sessionToken: string }> {\n  const { secret, prefix } = generateApiKeySecret()\n  const ttl = input.ttlMinutes ?? 30\n  const expiresAt = new Date(Date.now() + ttl * 60 * 1000)\n  const keyHash = await hashApiKey(secret)\n\n  // Encrypt the secret for later retrieval (used by MCP server for API calls)\n  const encryptedSecret = await encryptSessionSecret(secret, input.tenantId ?? null)\n\n  const roleIds = Array.from(new Set(input.userRoles.filter(Boolean))).sort((left, right) => left.localeCompare(right))\n  let record!: ApiKey\n  await withAtomicFlush(em, [async () => {\n    await lockRoleWriterAuthorizationState(em, roleIds)\n    record = em.create(ApiKey, {\n      name: `__session_${input.sessionToken}__`,\n      description: 'Ephemeral session API key for AI chat',\n      tenantId: input.tenantId ?? null,\n      organizationId: input.organizationId ?? null,\n      keyHash,\n      keyPrefix: prefix,\n      rolesJson: roleIds,\n      createdBy: input.userId,\n      sessionToken: input.sessionToken,\n      sessionUserId: input.userId,\n      sessionSecretEncrypted: encryptedSecret,\n      expiresAt,\n      createdAt: new Date(),\n    })\n    em.persist(record)\n  }], { transaction: true, label: 'api_keys.session.create' })\n\n  return {\n    keyId: record.id,\n    secret,\n    sessionToken: input.sessionToken,\n  }\n}\n\n/**\n * Find an API key by its session token.\n * Returns null if not found, expired, or deleted.\n */\nexport async function findApiKeyBySessionToken(\n  em: EntityManager,\n  sessionToken: string\n): Promise<ApiKey | null> {\n  if (!sessionToken) return null\n\n  const record = await em.findOne(ApiKey, {\n    sessionToken,\n    deletedAt: null,\n  })\n\n  if (!record) return null\n  if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null\n\n  return record\n}\n\n/**\n * Bind an OpenCode session id to the api_key row that owns this chat session.\n *\n * Called by the chat dispatcher the first time we see the `done` event for a\n * freshly minted session token. From that point on,\n * `findApiKeyByOpencodeSessionId(em, opencodeSessionId)` returns the same row,\n * which the ai-assistant runtime uses to assert ownership on every resume.\n *\n * Throws when the session token has been deleted/expired, and when the api_key\n * row is already bound to a DIFFERENT OpenCode session (defensive: this should\n * never happen in practice because each chat mints a new session token, but we\n * fail closed instead of silently overwriting).\n *\n * Idempotent when the row is already bound to the same OpenCode session id.\n */\nexport async function bindOpencodeSessionToApiKey(\n  em: EntityManager,\n  sessionToken: string,\n  opencodeSessionId: string\n): Promise<void> {\n  if (!sessionToken) throw new Error('Session token not found or expired')\n  if (!opencodeSessionId) throw new Error('OpenCode session id is required')\n\n  const row = await findApiKeyBySessionToken(em, sessionToken)\n  if (!row) throw new Error('Session token not found or expired')\n\n  if (row.opencodeSessionId === opencodeSessionId) return\n  if (row.opencodeSessionId && row.opencodeSessionId !== opencodeSessionId) {\n    throw new Error('Session token already bound to a different OpenCode session')\n  }\n\n  row.opencodeSessionId = opencodeSessionId\n  await em.persist(row).flush()\n}\n\n/**\n * Find an api_key row by its bound OpenCode session id.\n *\n * Returns null if no active row matches, or if the matched row is expired\n * (same contract as `findApiKeyBySessionToken`). Uses\n * `findOneWithDecryption` so encrypted-at-rest fields on the row are decrypted\n * before the ai-assistant runtime inspects `sessionUserId` / `tenantId` /\n * `organizationId` for the ownership check.\n */\nexport async function findApiKeyByOpencodeSessionId(\n  em: EntityManager,\n  opencodeSessionId: string\n): Promise<ApiKey | null> {\n  if (!opencodeSessionId) return null\n\n  const record = await findOneWithDecryption(\n    em,\n    ApiKey,\n    { opencodeSessionId, deletedAt: null } as any,\n  )\n\n  if (!record) return null\n  if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null\n\n  return record\n}\n\n/**\n * Find a session API key with its decrypted secret.\n * Returns null if not found, expired, deleted, or decryption fails.\n * This is used by the MCP server to recover the API key secret for making\n * authenticated API calls on behalf of the user.\n */\nexport async function findSessionApiKeyWithSecret(\n  em: EntityManager,\n  sessionToken: string\n): Promise<{ key: ApiKey; secret: string } | null> {\n  const record = await findApiKeyBySessionToken(em, sessionToken)\n  if (!record) return null\n\n  // If no encrypted secret stored, cannot recover\n  if (!record.sessionSecretEncrypted) {\n    logger.warn('Session key has no encrypted secret', { apiKeyId: record.id })\n    return null\n  }\n\n  // Decrypt the secret\n  const secret = await decryptSessionSecret(record.sessionSecretEncrypted, record.tenantId ?? null)\n  if (!secret) {\n    logger.warn('Failed to decrypt session secret', { apiKeyId: record.id })\n    return null\n  }\n\n  return { key: record, secret }\n}\n\n/**\n * Delete an ephemeral API key by its session token.\n */\nexport async function deleteSessionApiKey(\n  em: EntityManager,\n  sessionToken: string\n): Promise<void> {\n  const candidate = await em.findOne(ApiKey, { sessionToken, deletedAt: null })\n  if (!candidate) return\n  let deletedId: string | null = null\n  await withAtomicFlush(em, [async () => {\n    const records = await lockAuthorizationApiKeyRows(em, [String(candidate.id)])\n    const record = records.find((entry) => (\n      String(entry.id) === String(candidate.id)\n      && entry.sessionToken === sessionToken\n      && !entry.deletedAt\n    ))\n    if (!record) return\n    record.deletedAt = new Date()\n    await em.persist(record).flush()\n    deletedId = String(record.id)\n  }], { transaction: true, label: 'api_keys.session.delete' })\n  if (deletedId) getSharedApiKeyAuthCache().invalidateByKeyId(deletedId)\n}\n\n/**\n * Execute a function with a one-time API key\n *\n * Creates a temporary API key, executes the function, and deletes the key.\n * Perfect for workflow activities that need authenticated access without\n * storing long-lived credentials.\n *\n * @param em - Entity manager\n * @param input - API key configuration\n * @param fn - Function to execute with the API key secret\n * @returns Result of the function\n */\nconst ONETIME_KEY_MAX_TTL_MS = 5 * 60 * 1000\n\nexport async function withOnetimeApiKey<T>(\n  em: EntityManager,\n  input: CreateApiKeyInput,\n  fn: (secret: string) => Promise<T>\n): Promise<T> {\n  const maxExpiresAt = new Date(Date.now() + ONETIME_KEY_MAX_TTL_MS)\n  const safeExpiresAt = input.expiresAt && input.expiresAt < maxExpiresAt\n    ? input.expiresAt\n    : maxExpiresAt\n\n  const { record, secret } = await createApiKey(em, {\n    ...input,\n    name: input.name || '__onetime__',\n    description: input.description || 'One-time API key',\n    expiresAt: safeExpiresAt,\n  })\n\n  try {\n    const result = await fn(secret)\n    return result\n  } finally {\n    try {\n      await deleteApiKey(em, String(record.id))\n    } catch (error) {\n      logger.error('Failed to soft-delete one-time API key', { err: error })\n    }\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,mBAAmB;AAE5B,SAAS,MAAM,eAAe;AAE9B,SAAS,cAAc;AACvB,SAAS,kBAAkB,6BAA6B;AACxD,SAAS,mBAAmB,mBAAmB,iCAAiC;AAChF,SAAS,gCAAgC;AACzC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAE9E,MAAM,cAAc;AAkBpB,eAAe,qBACb,QACA,UACwB;AACxB,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,MAAM,iBAAiB;AAC7B,QAAM,OAAO,sBAAsB,GAAG;AACtC,MAAI,SAAS,WAAY,QAAO;AAChC,MAAI,SAAS,eAAe;AAC1B,WAAO;AAAA,MACL;AAAA,MAEA,EAAE,SAAS;AAAA,IACb;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,MAAI,CAAC,KAAK;AAER,UAAM,UAAU,MAAM,IAAI,gBAAgB,QAAQ;AAClD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAMA,aAAY,kBAAkB,QAAQ,QAAQ,GAAG;AACvD,WAAOA,WAAU;AAAA,EACnB;AAEA,QAAM,YAAY,kBAAkB,QAAQ,IAAI,GAAG;AACnD,SAAO,UAAU;AACnB;AAMA,eAAe,qBACb,QACA,UACwB;AACxB,MAAI,CAAC,YAAY,CAAC,OAAQ,QAAO;AAEjC,QAAM,MAAM,iBAAiB;AAC7B,QAAM,OAAO,sBAAsB,GAAG;AACtC,MAAI,SAAS,YAAY;AAGvB,WAAO,0BAA0B,MAAM,IAAI,OAAO;AAAA,EACpD;AACA,MAAI,SAAS,eAAe;AAC1B,WAAO,KAAK,4FAA4F,EAAE,SAAS,CAAC;AACpH,WAAO;AAAA,EACT;AAMA,MAAI,CAAC,0BAA0B,MAAM,EAAG,QAAO;AAE/C,QAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,MAAI,CAAC,IAAK,QAAO;AAEjB,SAAO,kBAAkB,QAAQ,IAAI,GAAG;AAC1C;AAiBO,SAAS,uBAA2D;AACzE,QAAM,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK;AAC3C,QAAM,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAC3C,QAAM,SAAS,OAAO,KAAK,IAAI,IAAI;AACnC,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AACjC,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,WAAW,QAAiC;AAChE,SAAO,KAAK,QAAQ,WAAW;AACjC;AAEA,eAAsB,aAAa,QAAgB,SAAmC;AACpF,SAAO,QAAQ,QAAQ,OAAO;AAChC;AAEA,eAAsB,aACpB,IACA,OACA,OAGI,CAAC,GACsB;AAC3B,QAAM,EAAE,QAAQ,OAAO,IAAI,qBAAqB;AAChD,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,QAAM,UAAU,MAAM,KAAK,IAAI,KAAK,MAAM,SAAS,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACxH,MAAI;AACJ,QAAM,gBAAgB,IAAI,CAAC,YAAY;AACrC,UAAM,iCAAiC,IAAI,OAAO;AAClD,UAAM,KAAK,iBAAiB,OAAO;AACnC,aAAS,GAAG,OAAO,QAAQ;AAAA,MACzB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM,eAAe;AAAA,MAClC,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM,kBAAkB;AAAA,MACxC;AAAA,MACA,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW,MAAM,aAAa;AAAA,MAC9B,WAAW,MAAM,aAAa;AAAA,MAC9B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,CAAC,GAAG,EAAE,aAAa,MAAM,OAAO,kBAAkB,CAAC;AACnD,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,EAC5D;AACA,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,aACpB,IACA,IACA,OAAqF,CAAC,GACpE;AAClB,MAAI,YAA2B;AAC/B,QAAM,gBAAgB,IAAI,CAAC,YAAY;AACrC,UAAM,UAAU,MAAM,4BAA4B,IAAI,CAAC,EAAE,CAAC;AAC1D,UAAM,SAAS,QAAQ,KAAK,CAAC,cAAc,OAAO,UAAU,EAAE,MAAM,EAAE;AACtE,QAAI,CAAC,UAAU,OAAO,UAAW;AACjC,UAAM,KAAK,YAAY,MAAM;AAC7B,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,gBAAY,OAAO,OAAO,EAAE;AAAA,EAC9B,CAAC,GAAG,EAAE,aAAa,MAAM,OAAO,kBAAkB,CAAC;AACnD,MAAI,CAAC,UAAW,QAAO;AACvB,2BAAyB,EAAE,kBAAkB,SAAS;AACtD,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,KAAK,oBAAoB,WAAW,SAAS,EAAE;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,eAAsB,mBAAmB,IAAmB,QAAwC;AAClG,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AAKjC,QAAM,aAAa,MAAM,GAAG,KAAK,QAAQ,EAAE,WAAW,QAAQ,WAAW,KAAK,CAAC;AAE/E,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,aAAa,UAAU,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG;AACvE,UAAM,UAAU,MAAM,aAAa,QAAQ,UAAU,OAAO;AAC5D,QAAI,QAAS,QAAO;AAAA,EACtB;AACA,SAAO;AACT;AAmBO,SAAS,uBAA+B;AAC7C,SAAO,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AAChD;AAOA,eAAsB,oBACpB,IACA,OACkE;AAClE,QAAM,EAAE,QAAQ,OAAO,IAAI,qBAAqB;AAChD,QAAM,MAAM,MAAM,cAAc;AAChC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,GAAI;AACvD,QAAM,UAAU,MAAM,WAAW,MAAM;AAGvC,QAAM,kBAAkB,MAAM,qBAAqB,QAAQ,MAAM,YAAY,IAAI;AAEjF,QAAM,UAAU,MAAM,KAAK,IAAI,IAAI,MAAM,UAAU,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACpH,MAAI;AACJ,QAAM,gBAAgB,IAAI,CAAC,YAAY;AACrC,UAAM,iCAAiC,IAAI,OAAO;AAClD,aAAS,GAAG,OAAO,QAAQ;AAAA,MACzB,MAAM,aAAa,MAAM,YAAY;AAAA,MACrC,aAAa;AAAA,MACb,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM,kBAAkB;AAAA,MACxC;AAAA,MACA,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW,MAAM;AAAA,MACjB,cAAc,MAAM;AAAA,MACpB,eAAe,MAAM;AAAA,MACrB,wBAAwB;AAAA,MACxB;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,CAAC,GAAG,EAAE,aAAa,MAAM,OAAO,0BAA0B,CAAC;AAE3D,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd;AAAA,IACA,cAAc,MAAM;AAAA,EACtB;AACF;AAMA,eAAsB,yBACpB,IACA,cACwB;AACxB,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ;AAAA,IACtC;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAExE,SAAO;AACT;AAiBA,eAAsB,4BACpB,IACA,cACA,mBACe;AACf,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,oCAAoC;AACvE,MAAI,CAAC,kBAAmB,OAAM,IAAI,MAAM,iCAAiC;AAEzE,QAAM,MAAM,MAAM,yBAAyB,IAAI,YAAY;AAC3D,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,oCAAoC;AAE9D,MAAI,IAAI,sBAAsB,kBAAmB;AACjD,MAAI,IAAI,qBAAqB,IAAI,sBAAsB,mBAAmB;AACxE,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,MAAI,oBAAoB;AACxB,QAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC9B;AAWA,eAAsB,8BACpB,IACA,mBACwB;AACxB,MAAI,CAAC,kBAAmB,QAAO;AAE/B,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,mBAAmB,WAAW,KAAK;AAAA,EACvC;AAEA,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAExE,SAAO;AACT;AAQA,eAAsB,4BACpB,IACA,cACiD;AACjD,QAAM,SAAS,MAAM,yBAAyB,IAAI,YAAY;AAC9D,MAAI,CAAC,OAAQ,QAAO;AAGpB,MAAI,CAAC,OAAO,wBAAwB;AAClC,WAAO,KAAK,uCAAuC,EAAE,UAAU,OAAO,GAAG,CAAC;AAC1E,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,MAAM,qBAAqB,OAAO,wBAAwB,OAAO,YAAY,IAAI;AAChG,MAAI,CAAC,QAAQ;AACX,WAAO,KAAK,oCAAoC,EAAE,UAAU,OAAO,GAAG,CAAC;AACvE,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,OAAO;AAC/B;AAKA,eAAsB,oBACpB,IACA,cACe;AACf,QAAM,YAAY,MAAM,GAAG,QAAQ,QAAQ,EAAE,cAAc,WAAW,KAAK,CAAC;AAC5E,MAAI,CAAC,UAAW;AAChB,MAAI,YAA2B;AAC/B,QAAM,gBAAgB,IAAI,CAAC,YAAY;AACrC,UAAM,UAAU,MAAM,4BAA4B,IAAI,CAAC,OAAO,UAAU,EAAE,CAAC,CAAC;AAC5E,UAAM,SAAS,QAAQ,KAAK,CAAC,UAC3B,OAAO,MAAM,EAAE,MAAM,OAAO,UAAU,EAAE,KACrC,MAAM,iBAAiB,gBACvB,CAAC,MAAM,SACX;AACD,QAAI,CAAC,OAAQ;AACb,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,gBAAY,OAAO,OAAO,EAAE;AAAA,EAC9B,CAAC,GAAG,EAAE,aAAa,MAAM,OAAO,0BAA0B,CAAC;AAC3D,MAAI,UAAW,0BAAyB,EAAE,kBAAkB,SAAS;AACvE;AAcA,MAAM,yBAAyB,IAAI,KAAK;AAExC,eAAsB,kBACpB,IACA,OACA,IACY;AACZ,QAAM,eAAe,IAAI,KAAK,KAAK,IAAI,IAAI,sBAAsB;AACjE,QAAM,gBAAgB,MAAM,aAAa,MAAM,YAAY,eACvD,MAAM,YACN;AAEJ,QAAM,EAAE,QAAQ,OAAO,IAAI,MAAM,aAAa,IAAI;AAAA,IAChD,GAAG;AAAA,IACH,MAAM,MAAM,QAAQ;AAAA,IACpB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW;AAAA,EACb,CAAC;AAED,MAAI;AACF,UAAM,SAAS,MAAM,GAAG,MAAM;AAC9B,WAAO;AAAA,EACT,UAAE;AACA,QAAI;AACF,YAAM,aAAa,IAAI,OAAO,OAAO,EAAE,CAAC;AAAA,IAC1C,SAAS,OAAO;AACd,aAAO,MAAM,0CAA0C,EAAE,KAAK,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomBytes, createHash } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { hash, compare } from 'bcryptjs'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { ApiKey } from '../data/entities'\nimport { createKmsService, resolveEncryptionMode } from '@open-mercato/shared/lib/encryption/kms'\nimport { encryptWithAesGcm, decryptWithAesGcm, looksLikeEncryptedPayload } from '@open-mercato/shared/lib/encryption/aes'\nimport { getSharedApiKeyAuthCache } from '@open-mercato/shared/lib/auth/apiKeyAuthCache'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport {\n  lockAuthorizationApiKeyRows,\n  lockRoleWriterAuthorizationState,\n} from '@open-mercato/core/modules/auth/lib/authorizationStateLocks'\n\nconst logger = createLogger('api_keys').child({ component: 'api-key-service' })\n\nconst BCRYPT_COST = 10\n\n// =============================================================================\n// Session Secret Encryption Helpers\n// =============================================================================\n\n/**\n * Seal an ephemeral session API key secret for storage in `session_secret_encrypted`.\n *\n * Returns null when the secret cannot be stored at all, which costs the caller MCP session-token\n * auth (the secret is unrecoverable and `findSessionApiKeyWithSecret` gives up).\n *\n * Under `TENANT_DATA_ENCRYPTION=no` the secret is stored as-is. That is the same bargain the rest\n * of the system already strikes in that mode -- emails, integration credentials and the search\n * index all sit in plaintext -- and it is what keeps the AI chat working when an operator opts\n * out. A DEK that is merely unreachable is a different situation and still yields null: writing a\n * secret in the clear because Vault happens to be down is not a downgrade anyone asked for.\n */\nasync function encryptSessionSecret(\n  secret: string,\n  tenantId: string | null\n): Promise<string | null> {\n  if (!tenantId) return null\n\n  const kms = createKmsService()\n  const mode = resolveEncryptionMode(kms)\n  if (mode === 'disabled') return secret\n  if (mode === 'unavailable') {\n    logger.warn(\n      'Tenant data encryption is enabled but no DEK is reachable; session secret not stored. '\n        + 'MCP session-token auth will fail until the KMS recovers.',\n      { tenantId },\n    )\n    return null\n  }\n\n  const dek = await kms.getTenantDek(tenantId)\n  if (!dek) {\n    // Try to create a DEK if one doesn't exist\n    const created = await kms.createTenantDek(tenantId)\n    if (!created) return null\n    const encrypted = encryptWithAesGcm(secret, created.key)\n    return encrypted.value\n  }\n\n  const encrypted = encryptWithAesGcm(secret, dek.key)\n  return encrypted.value\n}\n\n/**\n * Recover a session API key secret written by {@link encryptSessionSecret}.\n * Returns null if it cannot be recovered.\n */\nasync function decryptSessionSecret(\n  stored: string,\n  tenantId: string | null\n): Promise<string | null> {\n  if (!tenantId || !stored) return null\n\n  const kms = createKmsService()\n  const mode = resolveEncryptionMode(kms)\n  if (mode === 'disabled') {\n    // Written in the clear by the branch above -- unless it predates the toggle being flipped, in\n    // which case it is a sealed envelope no key can open and null is the honest answer.\n    return looksLikeEncryptedPayload(stored) ? null : stored\n  }\n  if (mode === 'unavailable') {\n    logger.warn('Tenant data encryption is enabled but no DEK is reachable; cannot recover session secret', { tenantId })\n    return null\n  }\n\n  // Mirror of the `disabled` branch: a secret written in the clear while the toggle was off is\n  // still recoverable after it is switched back on. Without this `decryptWithAesGcm` reads the\n  // plaintext as a malformed envelope and returns null, so the flip would silently break every\n  // live session rather than only the ones sealed under the old setting.\n  if (!looksLikeEncryptedPayload(stored)) return stored\n\n  const dek = await kms.getTenantDek(tenantId)\n  if (!dek) return null\n\n  return decryptWithAesGcm(stored, dek.key)\n}\n\nexport type CreateApiKeyInput = {\n  name: string\n  description?: string | null\n  tenantId?: string | null\n  organizationId?: string | null\n  roles?: string[]\n  expiresAt?: Date | null\n  createdBy?: string | null\n}\n\nexport type ApiKeyWithSecret = {\n  record: ApiKey\n  secret: string\n}\n\nexport function generateApiKeySecret(): { secret: string; prefix: string } {\n  const short = randomBytes(4).toString('hex')\n  const body = randomBytes(24).toString('hex')\n  const secret = `omk_${short}.${body}`\n  const prefix = secret.slice(0, 12)\n  return { secret, prefix }\n}\n\nexport async function hashApiKey(secret: string): Promise<string> {\n  return hash(secret, BCRYPT_COST)\n}\n\nexport async function verifyApiKey(secret: string, keyHash: string): Promise<boolean> {\n  return compare(secret, keyHash)\n}\n\nexport async function createApiKey(\n  em: EntityManager,\n  input: CreateApiKeyInput,\n  opts: {\n    rbac?: RbacService\n    authorizeRoles?: (roleIds: readonly string[]) => Promise<void> | void\n  } = {},\n): Promise<ApiKeyWithSecret> {\n  const { secret, prefix } = generateApiKeySecret()\n  const keyHash = await hashApiKey(secret)\n  const roleIds = Array.from(new Set((input.roles ?? []).filter(Boolean))).sort((left, right) => left.localeCompare(right))\n  let record!: ApiKey\n  await withAtomicFlush(em, [async () => {\n    await lockRoleWriterAuthorizationState(em, roleIds)\n    await opts.authorizeRoles?.(roleIds)\n    record = em.create(ApiKey, {\n      name: input.name,\n      description: input.description ?? null,\n      tenantId: input.tenantId ?? null,\n      organizationId: input.organizationId ?? null,\n      keyHash,\n      keyPrefix: prefix,\n      rolesJson: roleIds,\n      createdBy: input.createdBy ?? null,\n      expiresAt: input.expiresAt ?? null,\n      createdAt: new Date(),\n    })\n    em.persist(record)\n  }], { transaction: true, label: 'api_keys.create' })\n  if (opts.rbac) {\n    await opts.rbac.invalidateUserCache(`api_key:${record.id}`)\n  }\n  return { record, secret }\n}\n\nexport async function deleteApiKey(\n  em: EntityManager,\n  id: string,\n  opts: { rbac?: RbacService; authorize?: (record: ApiKey) => Promise<void> | void } = {},\n): Promise<boolean> {\n  let deletedId: string | null = null\n  await withAtomicFlush(em, [async () => {\n    const records = await lockAuthorizationApiKeyRows(em, [id])\n    const record = records.find((candidate) => String(candidate.id) === id)\n    if (!record || record.deletedAt) return\n    await opts.authorize?.(record)\n    record.deletedAt = new Date()\n    await em.persist(record).flush()\n    deletedId = String(record.id)\n  }], { transaction: true, label: 'api_keys.delete' })\n  if (!deletedId) return false\n  getSharedApiKeyAuthCache().invalidateByKeyId(deletedId)\n  if (opts.rbac) {\n    await opts.rbac.invalidateUserCache(`api_key:${deletedId}`)\n  }\n  return true\n}\n\nexport async function findApiKeyBySecret(em: EntityManager, secret: string): Promise<ApiKey | null> {\n  if (!secret) return null\n  // Extract prefix from the secret for fast candidate lookup\n  const prefix = secret.slice(0, 12)\n  // Find candidates by prefix (fast index lookup). Invariant: the unique keyPrefix\n  // constraint plus the deletedAt: null filter keep this to at most one live row, so\n  // the bcrypt loop below stays bounded. Do not widen the prefix space or relax either\n  // filter without re-evaluating that cost (see #3812).\n  const candidates = await em.find(ApiKey, { keyPrefix: prefix, deletedAt: null })\n  // Verify each candidate with bcrypt until we find a match\n  for (const candidate of candidates) {\n    if (candidate.expiresAt && candidate.expiresAt.getTime() < Date.now()) continue\n    const isValid = await verifyApiKey(secret, candidate.keyHash)\n    if (isValid) return candidate\n  }\n  return null\n}\n\n// =============================================================================\n// Session-scoped API Keys (for AI Chat ephemeral authorization)\n// =============================================================================\n\nexport type CreateSessionApiKeyInput = {\n  sessionToken: string\n  userId: string\n  userRoles: string[]\n  tenantId?: string | null\n  organizationId?: string | null\n  ttlMinutes?: number\n}\n\n/**\n * Generate a unique session token for ephemeral API keys.\n * Format: sess_{32 hex chars}\n */\nexport function generateSessionToken(): string {\n  return `sess_${randomBytes(16).toString('hex')}`\n}\n\n/**\n * Hash a session token for storage/lookup (#2254). The session token is a bearer credential \u2014\n * it unlocks the decrypted API key secret and the user's ACL on the MCP server \u2014 so, mirroring\n * `customer_accounts`' `hashToken`, only its hash is ever persisted. 128 bits of entropy from\n * `generateSessionToken` is sufficient for a plain SHA-256 (no bcrypt cost needed, and a slow\n * hash would just add latency to every MCP tool call that resolves a session).\n */\nexport function hashSessionToken(sessionToken: string): string {\n  return createHash('sha256').update(sessionToken).digest('hex')\n}\n\n/**\n * Create an ephemeral API key scoped to a chat session.\n * The key inherits the user's roles and expires after ttlMinutes (default 30).\n * The API key secret is encrypted and stored so it can be recovered for API calls.\n */\nexport async function createSessionApiKey(\n  em: EntityManager,\n  input: CreateSessionApiKeyInput\n): Promise<{ keyId: string; secret: string; sessionToken: string }> {\n  const { secret, prefix } = generateApiKeySecret()\n  const ttl = input.ttlMinutes ?? 30\n  const expiresAt = new Date(Date.now() + ttl * 60 * 1000)\n  const keyHash = await hashApiKey(secret)\n\n  // Encrypt the secret for later retrieval (used by MCP server for API calls)\n  const encryptedSecret = await encryptSessionSecret(secret, input.tenantId ?? null)\n\n  // Hash before storage (#2254) \u2014 the row (and its `name` column, previously embedding the raw\n  // token for operator visibility) must never carry the live bearer credential in the clear.\n  const sessionTokenHash = hashSessionToken(input.sessionToken)\n\n  const roleIds = Array.from(new Set(input.userRoles.filter(Boolean))).sort((left, right) => left.localeCompare(right))\n  let record!: ApiKey\n  await withAtomicFlush(em, [async () => {\n    await lockRoleWriterAuthorizationState(em, roleIds)\n    record = em.create(ApiKey, {\n      name: `__session_${sessionTokenHash.slice(0, 12)}__`,\n      description: 'Ephemeral session API key for AI chat',\n      tenantId: input.tenantId ?? null,\n      organizationId: input.organizationId ?? null,\n      keyHash,\n      keyPrefix: prefix,\n      rolesJson: roleIds,\n      createdBy: input.userId,\n      sessionTokenHash,\n      sessionUserId: input.userId,\n      sessionSecretEncrypted: encryptedSecret,\n      expiresAt,\n      createdAt: new Date(),\n    })\n    em.persist(record)\n  }], { transaction: true, label: 'api_keys.session.create' })\n\n  return {\n    keyId: record.id,\n    secret,\n    sessionToken: input.sessionToken,\n  }\n}\n\n/**\n * Find an API key by its session token.\n * Returns null if not found, expired, or deleted.\n */\nexport async function findApiKeyBySessionToken(\n  em: EntityManager,\n  sessionToken: string\n): Promise<ApiKey | null> {\n  if (!sessionToken) return null\n\n  // Looked up by hash, never by the raw token (#2254).\n  const sessionTokenHash = hashSessionToken(sessionToken)\n  let record = await em.findOne(ApiKey, { sessionTokenHash, deletedAt: null })\n\n  if (!record) {\n    // Version-skew fallback (#7304): during a rolling deploy/rollback window the app and the\n    // separate MCP process can briefly run different code versions. A row minted by\n    // pre-#2254 code in that window carries only the plaintext token (sessionTokenHash is\n    // still null) \u2014 fall back to it so the session still resolves instead of answering a\n    // false SESSION_EXPIRED, then self-heal the row onto the hash immediately so this is the\n    // only lookup that ever sees the plaintext, and the window closes as soon as each\n    // outstanding legacy row is touched once.\n    const legacyRecord = await em.findOne(ApiKey, { sessionToken, deletedAt: null })\n    if (legacyRecord) {\n      legacyRecord.sessionTokenHash = sessionTokenHash\n      legacyRecord.sessionToken = null\n      await em.persist(legacyRecord).flush()\n      record = legacyRecord\n    }\n  }\n\n  if (!record) return null\n  if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null\n\n  return record\n}\n\n/**\n * Bind an OpenCode session id to the api_key row that owns this chat session.\n *\n * Called by the chat dispatcher the first time we see the `done` event for a\n * freshly minted session token. From that point on,\n * `findApiKeyByOpencodeSessionId(em, opencodeSessionId)` returns the same row,\n * which the ai-assistant runtime uses to assert ownership on every resume.\n *\n * Throws when the session token has been deleted/expired, and when the api_key\n * row is already bound to a DIFFERENT OpenCode session (defensive: this should\n * never happen in practice because each chat mints a new session token, but we\n * fail closed instead of silently overwriting).\n *\n * Idempotent when the row is already bound to the same OpenCode session id.\n */\nexport async function bindOpencodeSessionToApiKey(\n  em: EntityManager,\n  sessionToken: string,\n  opencodeSessionId: string\n): Promise<void> {\n  if (!sessionToken) throw new Error('Session token not found or expired')\n  if (!opencodeSessionId) throw new Error('OpenCode session id is required')\n\n  const row = await findApiKeyBySessionToken(em, sessionToken)\n  if (!row) throw new Error('Session token not found or expired')\n\n  if (row.opencodeSessionId === opencodeSessionId) return\n  if (row.opencodeSessionId && row.opencodeSessionId !== opencodeSessionId) {\n    throw new Error('Session token already bound to a different OpenCode session')\n  }\n\n  row.opencodeSessionId = opencodeSessionId\n  await em.persist(row).flush()\n}\n\n/**\n * Find an api_key row by its bound OpenCode session id.\n *\n * Returns null if no active row matches, or if the matched row is expired\n * (same contract as `findApiKeyBySessionToken`). Uses\n * `findOneWithDecryption` so encrypted-at-rest fields on the row are decrypted\n * before the ai-assistant runtime inspects `sessionUserId` / `tenantId` /\n * `organizationId` for the ownership check.\n */\nexport async function findApiKeyByOpencodeSessionId(\n  em: EntityManager,\n  opencodeSessionId: string\n): Promise<ApiKey | null> {\n  if (!opencodeSessionId) return null\n\n  const record = await findOneWithDecryption(\n    em,\n    ApiKey,\n    { opencodeSessionId, deletedAt: null } as any,\n  )\n\n  if (!record) return null\n  if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null\n\n  return record\n}\n\n/**\n * Find a session API key with its decrypted secret.\n * Returns null if not found, expired, deleted, or decryption fails.\n * This is used by the MCP server to recover the API key secret for making\n * authenticated API calls on behalf of the user.\n */\nexport async function findSessionApiKeyWithSecret(\n  em: EntityManager,\n  sessionToken: string\n): Promise<{ key: ApiKey; secret: string } | null> {\n  const record = await findApiKeyBySessionToken(em, sessionToken)\n  if (!record) return null\n\n  // If no encrypted secret stored, cannot recover\n  if (!record.sessionSecretEncrypted) {\n    logger.warn('Session key has no encrypted secret', { apiKeyId: record.id })\n    return null\n  }\n\n  // Decrypt the secret\n  const secret = await decryptSessionSecret(record.sessionSecretEncrypted, record.tenantId ?? null)\n  if (!secret) {\n    logger.warn('Failed to decrypt session secret', { apiKeyId: record.id })\n    return null\n  }\n\n  return { key: record, secret }\n}\n\n/**\n * Delete an ephemeral API key by its session token.\n */\nexport async function deleteSessionApiKey(\n  em: EntityManager,\n  sessionToken: string\n): Promise<void> {\n  // Looked up and re-checked by hash, never by the raw token (#2254). Deliberately does not\n  // call findApiKeyBySessionToken: that helper also drops already-expired rows, but deleting\n  // an expired-but-not-yet-cleaned-up row must still work here.\n  const sessionTokenHash = hashSessionToken(sessionToken)\n  let candidate = await em.findOne(ApiKey, { sessionTokenHash, deletedAt: null })\n  if (!candidate) {\n    // Version-skew fallback (#7304): see findApiKeyBySessionToken for the full rationale \u2014 a\n    // row minted by pre-#2254 code during a deploy window is plaintext-only until touched.\n    const legacyCandidate = await em.findOne(ApiKey, { sessionToken, deletedAt: null })\n    if (legacyCandidate) {\n      legacyCandidate.sessionTokenHash = sessionTokenHash\n      legacyCandidate.sessionToken = null\n      await em.persist(legacyCandidate).flush()\n      candidate = legacyCandidate\n    }\n  }\n  if (!candidate) return\n  let deletedId: string | null = null\n  await withAtomicFlush(em, [async () => {\n    const records = await lockAuthorizationApiKeyRows(em, [String(candidate.id)])\n    const record = records.find((entry) => (\n      String(entry.id) === String(candidate.id)\n      && entry.sessionTokenHash === sessionTokenHash\n      && !entry.deletedAt\n    ))\n    if (!record) return\n    record.deletedAt = new Date()\n    await em.persist(record).flush()\n    deletedId = String(record.id)\n  }], { transaction: true, label: 'api_keys.session.delete' })\n  if (deletedId) getSharedApiKeyAuthCache().invalidateByKeyId(deletedId)\n}\n\n/**\n * Execute a function with a one-time API key\n *\n * Creates a temporary API key, executes the function, and deletes the key.\n * Perfect for workflow activities that need authenticated access without\n * storing long-lived credentials.\n *\n * @param em - Entity manager\n * @param input - API key configuration\n * @param fn - Function to execute with the API key secret\n * @returns Result of the function\n */\nconst ONETIME_KEY_MAX_TTL_MS = 5 * 60 * 1000\n\nexport async function withOnetimeApiKey<T>(\n  em: EntityManager,\n  input: CreateApiKeyInput,\n  fn: (secret: string) => Promise<T>\n): Promise<T> {\n  const maxExpiresAt = new Date(Date.now() + ONETIME_KEY_MAX_TTL_MS)\n  const safeExpiresAt = input.expiresAt && input.expiresAt < maxExpiresAt\n    ? input.expiresAt\n    : maxExpiresAt\n\n  const { record, secret } = await createApiKey(em, {\n    ...input,\n    name: input.name || '__onetime__',\n    description: input.description || 'One-time API key',\n    expiresAt: safeExpiresAt,\n  })\n\n  try {\n    const result = await fn(secret)\n    return result\n  } finally {\n    try {\n      await deleteApiKey(em, String(record.id))\n    } catch (error) {\n      logger.error('Failed to soft-delete one-time API key', { err: error })\n    }\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,aAAa,kBAAkB;AAExC,SAAS,MAAM,eAAe;AAE9B,SAAS,cAAc;AACvB,SAAS,kBAAkB,6BAA6B;AACxD,SAAS,mBAAmB,mBAAmB,iCAAiC;AAChF,SAAS,gCAAgC;AACzC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAE9E,MAAM,cAAc;AAkBpB,eAAe,qBACb,QACA,UACwB;AACxB,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,MAAM,iBAAiB;AAC7B,QAAM,OAAO,sBAAsB,GAAG;AACtC,MAAI,SAAS,WAAY,QAAO;AAChC,MAAI,SAAS,eAAe;AAC1B,WAAO;AAAA,MACL;AAAA,MAEA,EAAE,SAAS;AAAA,IACb;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,MAAI,CAAC,KAAK;AAER,UAAM,UAAU,MAAM,IAAI,gBAAgB,QAAQ;AAClD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAMA,aAAY,kBAAkB,QAAQ,QAAQ,GAAG;AACvD,WAAOA,WAAU;AAAA,EACnB;AAEA,QAAM,YAAY,kBAAkB,QAAQ,IAAI,GAAG;AACnD,SAAO,UAAU;AACnB;AAMA,eAAe,qBACb,QACA,UACwB;AACxB,MAAI,CAAC,YAAY,CAAC,OAAQ,QAAO;AAEjC,QAAM,MAAM,iBAAiB;AAC7B,QAAM,OAAO,sBAAsB,GAAG;AACtC,MAAI,SAAS,YAAY;AAGvB,WAAO,0BAA0B,MAAM,IAAI,OAAO;AAAA,EACpD;AACA,MAAI,SAAS,eAAe;AAC1B,WAAO,KAAK,4FAA4F,EAAE,SAAS,CAAC;AACpH,WAAO;AAAA,EACT;AAMA,MAAI,CAAC,0BAA0B,MAAM,EAAG,QAAO;AAE/C,QAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,MAAI,CAAC,IAAK,QAAO;AAEjB,SAAO,kBAAkB,QAAQ,IAAI,GAAG;AAC1C;AAiBO,SAAS,uBAA2D;AACzE,QAAM,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK;AAC3C,QAAM,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAC3C,QAAM,SAAS,OAAO,KAAK,IAAI,IAAI;AACnC,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AACjC,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,WAAW,QAAiC;AAChE,SAAO,KAAK,QAAQ,WAAW;AACjC;AAEA,eAAsB,aAAa,QAAgB,SAAmC;AACpF,SAAO,QAAQ,QAAQ,OAAO;AAChC;AAEA,eAAsB,aACpB,IACA,OACA,OAGI,CAAC,GACsB;AAC3B,QAAM,EAAE,QAAQ,OAAO,IAAI,qBAAqB;AAChD,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,QAAM,UAAU,MAAM,KAAK,IAAI,KAAK,MAAM,SAAS,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACxH,MAAI;AACJ,QAAM,gBAAgB,IAAI,CAAC,YAAY;AACrC,UAAM,iCAAiC,IAAI,OAAO;AAClD,UAAM,KAAK,iBAAiB,OAAO;AACnC,aAAS,GAAG,OAAO,QAAQ;AAAA,MACzB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM,eAAe;AAAA,MAClC,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM,kBAAkB;AAAA,MACxC;AAAA,MACA,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW,MAAM,aAAa;AAAA,MAC9B,WAAW,MAAM,aAAa;AAAA,MAC9B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,CAAC,GAAG,EAAE,aAAa,MAAM,OAAO,kBAAkB,CAAC;AACnD,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,KAAK,oBAAoB,WAAW,OAAO,EAAE,EAAE;AAAA,EAC5D;AACA,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,eAAsB,aACpB,IACA,IACA,OAAqF,CAAC,GACpE;AAClB,MAAI,YAA2B;AAC/B,QAAM,gBAAgB,IAAI,CAAC,YAAY;AACrC,UAAM,UAAU,MAAM,4BAA4B,IAAI,CAAC,EAAE,CAAC;AAC1D,UAAM,SAAS,QAAQ,KAAK,CAAC,cAAc,OAAO,UAAU,EAAE,MAAM,EAAE;AACtE,QAAI,CAAC,UAAU,OAAO,UAAW;AACjC,UAAM,KAAK,YAAY,MAAM;AAC7B,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,gBAAY,OAAO,OAAO,EAAE;AAAA,EAC9B,CAAC,GAAG,EAAE,aAAa,MAAM,OAAO,kBAAkB,CAAC;AACnD,MAAI,CAAC,UAAW,QAAO;AACvB,2BAAyB,EAAE,kBAAkB,SAAS;AACtD,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,KAAK,oBAAoB,WAAW,SAAS,EAAE;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,eAAsB,mBAAmB,IAAmB,QAAwC;AAClG,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AAKjC,QAAM,aAAa,MAAM,GAAG,KAAK,QAAQ,EAAE,WAAW,QAAQ,WAAW,KAAK,CAAC;AAE/E,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,aAAa,UAAU,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG;AACvE,UAAM,UAAU,MAAM,aAAa,QAAQ,UAAU,OAAO;AAC5D,QAAI,QAAS,QAAO;AAAA,EACtB;AACA,SAAO;AACT;AAmBO,SAAS,uBAA+B;AAC7C,SAAO,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AAChD;AASO,SAAS,iBAAiB,cAA8B;AAC7D,SAAO,WAAW,QAAQ,EAAE,OAAO,YAAY,EAAE,OAAO,KAAK;AAC/D;AAOA,eAAsB,oBACpB,IACA,OACkE;AAClE,QAAM,EAAE,QAAQ,OAAO,IAAI,qBAAqB;AAChD,QAAM,MAAM,MAAM,cAAc;AAChC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,GAAI;AACvD,QAAM,UAAU,MAAM,WAAW,MAAM;AAGvC,QAAM,kBAAkB,MAAM,qBAAqB,QAAQ,MAAM,YAAY,IAAI;AAIjF,QAAM,mBAAmB,iBAAiB,MAAM,YAAY;AAE5D,QAAM,UAAU,MAAM,KAAK,IAAI,IAAI,MAAM,UAAU,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACpH,MAAI;AACJ,QAAM,gBAAgB,IAAI,CAAC,YAAY;AACrC,UAAM,iCAAiC,IAAI,OAAO;AAClD,aAAS,GAAG,OAAO,QAAQ;AAAA,MACzB,MAAM,aAAa,iBAAiB,MAAM,GAAG,EAAE,CAAC;AAAA,MAChD,aAAa;AAAA,MACb,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM,kBAAkB;AAAA,MACxC;AAAA,MACA,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,eAAe,MAAM;AAAA,MACrB,wBAAwB;AAAA,MACxB;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,CAAC,GAAG,EAAE,aAAa,MAAM,OAAO,0BAA0B,CAAC;AAE3D,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd;AAAA,IACA,cAAc,MAAM;AAAA,EACtB;AACF;AAMA,eAAsB,yBACpB,IACA,cACwB;AACxB,MAAI,CAAC,aAAc,QAAO;AAG1B,QAAM,mBAAmB,iBAAiB,YAAY;AACtD,MAAI,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,kBAAkB,WAAW,KAAK,CAAC;AAE3E,MAAI,CAAC,QAAQ;AAQX,UAAM,eAAe,MAAM,GAAG,QAAQ,QAAQ,EAAE,cAAc,WAAW,KAAK,CAAC;AAC/E,QAAI,cAAc;AAChB,mBAAa,mBAAmB;AAChC,mBAAa,eAAe;AAC5B,YAAM,GAAG,QAAQ,YAAY,EAAE,MAAM;AACrC,eAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAExE,SAAO;AACT;AAiBA,eAAsB,4BACpB,IACA,cACA,mBACe;AACf,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,oCAAoC;AACvE,MAAI,CAAC,kBAAmB,OAAM,IAAI,MAAM,iCAAiC;AAEzE,QAAM,MAAM,MAAM,yBAAyB,IAAI,YAAY;AAC3D,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,oCAAoC;AAE9D,MAAI,IAAI,sBAAsB,kBAAmB;AACjD,MAAI,IAAI,qBAAqB,IAAI,sBAAsB,mBAAmB;AACxE,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAEA,MAAI,oBAAoB;AACxB,QAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC9B;AAWA,eAAsB,8BACpB,IACA,mBACwB;AACxB,MAAI,CAAC,kBAAmB,QAAO;AAE/B,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,mBAAmB,WAAW,KAAK;AAAA,EACvC;AAEA,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAExE,SAAO;AACT;AAQA,eAAsB,4BACpB,IACA,cACiD;AACjD,QAAM,SAAS,MAAM,yBAAyB,IAAI,YAAY;AAC9D,MAAI,CAAC,OAAQ,QAAO;AAGpB,MAAI,CAAC,OAAO,wBAAwB;AAClC,WAAO,KAAK,uCAAuC,EAAE,UAAU,OAAO,GAAG,CAAC;AAC1E,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,MAAM,qBAAqB,OAAO,wBAAwB,OAAO,YAAY,IAAI;AAChG,MAAI,CAAC,QAAQ;AACX,WAAO,KAAK,oCAAoC,EAAE,UAAU,OAAO,GAAG,CAAC;AACvE,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,KAAK,QAAQ,OAAO;AAC/B;AAKA,eAAsB,oBACpB,IACA,cACe;AAIf,QAAM,mBAAmB,iBAAiB,YAAY;AACtD,MAAI,YAAY,MAAM,GAAG,QAAQ,QAAQ,EAAE,kBAAkB,WAAW,KAAK,CAAC;AAC9E,MAAI,CAAC,WAAW;AAGd,UAAM,kBAAkB,MAAM,GAAG,QAAQ,QAAQ,EAAE,cAAc,WAAW,KAAK,CAAC;AAClF,QAAI,iBAAiB;AACnB,sBAAgB,mBAAmB;AACnC,sBAAgB,eAAe;AAC/B,YAAM,GAAG,QAAQ,eAAe,EAAE,MAAM;AACxC,kBAAY;AAAA,IACd;AAAA,EACF;AACA,MAAI,CAAC,UAAW;AAChB,MAAI,YAA2B;AAC/B,QAAM,gBAAgB,IAAI,CAAC,YAAY;AACrC,UAAM,UAAU,MAAM,4BAA4B,IAAI,CAAC,OAAO,UAAU,EAAE,CAAC,CAAC;AAC5E,UAAM,SAAS,QAAQ,KAAK,CAAC,UAC3B,OAAO,MAAM,EAAE,MAAM,OAAO,UAAU,EAAE,KACrC,MAAM,qBAAqB,oBAC3B,CAAC,MAAM,SACX;AACD,QAAI,CAAC,OAAQ;AACb,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AAC/B,gBAAY,OAAO,OAAO,EAAE;AAAA,EAC9B,CAAC,GAAG,EAAE,aAAa,MAAM,OAAO,0BAA0B,CAAC;AAC3D,MAAI,UAAW,0BAAyB,EAAE,kBAAkB,SAAS;AACvE;AAcA,MAAM,yBAAyB,IAAI,KAAK;AAExC,eAAsB,kBACpB,IACA,OACA,IACY;AACZ,QAAM,eAAe,IAAI,KAAK,KAAK,IAAI,IAAI,sBAAsB;AACjE,QAAM,gBAAgB,MAAM,aAAa,MAAM,YAAY,eACvD,MAAM,YACN;AAEJ,QAAM,EAAE,QAAQ,OAAO,IAAI,MAAM,aAAa,IAAI;AAAA,IAChD,GAAG;AAAA,IACH,MAAM,MAAM,QAAQ;AAAA,IACpB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW;AAAA,EACb,CAAC;AAED,MAAI;AACF,UAAM,SAAS,MAAM,GAAG,MAAM;AAC9B,WAAO;AAAA,EACT,UAAE;AACA,QAAI;AACF,YAAM,aAAa,IAAI,OAAO,OAAO,EAAE,CAAC;AAAA,IAC1C,SAAS,OAAO;AACd,aAAO,MAAM,0CAA0C,EAAE,KAAK,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AACF;",
   "names": ["encrypted"]
 }

package/dist/modules/attachments/api/file/[id]/route.js

@@ -1,3 +1,5 @@
+import { createAttachmentAccessContext, evaluateAttachmentAccess } from "../../../lib/access-runner.js";
+import { attachmentAccessErrorResponse } from "../../../lib/access-errors.js";
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
@@ -58,11 +60,17 @@ async function GET(req, context) {
       { status: 500 }
     );
   }
-  const access = checkAttachmentAccess(scopedAuth, attachment, partition);
-  if (!access.ok) {
-    const message = access.status === 401 ? "Unauthorized" : "Forbidden";
-    return NextResponse.json({ error: message }, { status: access.status });
-  }
+  const url = new URL(req.url);
+  const forceDownload = url.searchParams.get("download") === "1";
+  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);
+  const access = await evaluateAttachmentAccess({
+    auth: scopedAuth,
+    attachment,
+    partition,
+    action: renderInline ? "render" : "read",
+    context: createAttachmentAccessContext(container)
+  });
+  if (!access.ok) return attachmentAccessErrorResponse(access);
   const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {
     tenantId: attachment.tenantId ?? "",
     organizationId: attachment.organizationId ?? ""
@@ -74,11 +82,8 @@ async function GET(req, context) {
   } catch {
     return NextResponse.json({ error: "File not available" }, { status: 404 });
   }
-  const url = new URL(req.url);
-  const forceDownload = url.searchParams.get("download") === "1";
-  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);
   const headers = {
-    "Cache-Control": checkAttachmentAccess(null, attachment, partition).ok ? "public, max-age=86400" : "private, max-age=60",
+    "Cache-Control": access.protected ? "private, no-store" : checkAttachmentAccess(null, attachment, partition).ok ? "public, max-age=86400" : "private, max-age=60",
     "Content-Security-Policy": "default-src 'none'; sandbox",
     "Content-Type": renderInline ? attachment.mimeType || "application/octet-stream" : "application/octet-stream",
     "Content-Disposition": buildAttachmentContentDisposition(
@@ -132,7 +137,8 @@ const openApi = {
           status: 500,
           description: "Partition misconfigured",
           schema: attachmentErrorSchema
-        }
+        },
+        { status: 504, description: "Owner authorization timed out", schema: attachmentErrorSchema }
       ]
     }
   }

package/dist/modules/attachments/api/file/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/attachments/api/file/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextRequest, NextResponse } from \"next/server\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport {\n  Attachment,\n  AttachmentPartition,\n} from \"@open-mercato/core/modules/attachments/data/entities\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { checkAttachmentAccess, isSuperAdminAuth } from \"@open-mercato/core/modules/attachments/lib/access\";\nimport { z } from \"zod\";\nimport { attachmentsTag, attachmentErrorSchema } from \"../../openapi\";\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n} from \"@open-mercato/core/modules/attachments/lib/security\";\nimport { StorageDriverFactory } from '../../../lib/drivers';\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope';\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string }> },\n) {\n  const { id } = await context.params;\n  if (!id) {\n    return NextResponse.json(\n      { error: \"Attachment id is required\" },\n      { status: 400 },\n    );\n  }\n  const auth = await getAuthFromRequest(req);\n  const container = await createRequestContainer();\n  const em = container.resolve(\"em\") as EntityManager;\n  const storageDriverFactory =\n    (container.resolve(\"storageDriverFactory\") as StorageDriverFactory | null) ??\n    new StorageDriverFactory(em);\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req);\n  if (requestScope.denied) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth;\n  const findFilter: Record<string, unknown> = { id };\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;\n  }\n  const attachment = await em.findOne(Attachment, findFilter);\n  if (!attachment) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const partition = await em.findOne(AttachmentPartition, {\n    code: attachment.partitionCode,\n  });\n  if (!partition) {\n    return NextResponse.json(\n      { error: \"Partition misconfigured\" },\n      { status: 500 },\n    );\n  }\n\n  const access = checkAttachmentAccess(scopedAuth, attachment, partition);\n  if (!access.ok) {\n    const message = access.status === 401 ? \"Unauthorized\" : \"Forbidden\";\n    return NextResponse.json({ error: message }, { status: access.status });\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  });\n  let buffer: Buffer;\n  try {\n    const result = await driver.read(attachment.partitionCode, attachment.storagePath);\n    buffer = result.buffer;\n  } catch {\n    return NextResponse.json({ error: \"File not available\" }, { status: 404 });\n  }\n\n  const url = new URL(req.url);\n  const forceDownload = url.searchParams.get(\"download\") === \"1\";\n  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);\n  const headers: Record<string, string> = {\n    \"Cache-Control\": checkAttachmentAccess(null, attachment, partition).ok\n      ? \"public, max-age=86400\"\n      : \"private, max-age=60\",\n    \"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n    \"Content-Type\": renderInline\n      ? attachment.mimeType || \"application/octet-stream\"\n      : \"application/octet-stream\",\n    \"Content-Disposition\": buildAttachmentContentDisposition(\n      attachment.fileName,\n      renderInline ? \"inline\" : \"attachment\",\n    ),\n    \"X-Content-Type-Options\": \"nosniff\",\n  };\n  if (attachment.fileSize > 0) {\n    headers[\"Content-Length\"] = String(attachment.fileSize);\n  }\n\n  const responseBody = new Uint8Array(buffer);\n\n  return new NextResponse(responseBody, { status: 200, headers });\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: \"Download attachment file\",\n  methods: {\n    GET: {\n      summary: \"Download or serve attachment file\",\n      description:\n        \"Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.\",\n      responses: [\n        {\n          status: 200,\n          description: \"File content with appropriate MIME type\",\n          schema: z.any().describe(\"Binary file content\"),\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: \"Missing attachment ID\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 401,\n          description:\n            \"Unauthorized - authentication required for private partitions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 403,\n          description: \"Forbidden - insufficient permissions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 404,\n          description: \"Attachment or file not found\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 500,\n          description: \"Partition misconfigured\",\n          schema: attachmentErrorSchema,\n        },\n      ],\n    },\n  },\n};\n"],
-  "mappings": "AAAA,SAAsB,oBAAoB;AAE1C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB,wBAAwB;AACxD,SAAS,SAAS;AAClB,SAAS,gBAAgB,6BAA6B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAEvC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B;AAAA,MACrC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KACzC,IAAI,qBAAqB,EAAE;AAE7B,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACtD,MAAM,WAAW;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAW;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB,YAAY,YAAY,SAAS;AACtE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AACjF,aAAS,OAAO;AAAA,EAClB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU,MAAM;AAC3D,QAAM,eAAe,CAAC,iBAAiB,0BAA0B,WAAW,QAAQ;AACpF,QAAM,UAAkC;AAAA,IACtC,iBAAiB,sBAAsB,MAAM,YAAY,SAAS,EAAE,KAChE,0BACA;AAAA,IACJ,2BAA2B;AAAA,IAC3B,gBAAgB,eACZ,WAAW,YAAY,6BACvB;AAAA,IACJ,uBAAuB;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,WAAW;AAAA,IAC5B;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,YAAQ,gBAAgB,IAAI,OAAO,WAAW,QAAQ;AAAA,EACxD;AAEA,QAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,SAAO,IAAI,aAAa,cAAc,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,qBAAqB;AAAA,QAChD;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { createAttachmentAccessContext, evaluateAttachmentAccess } from '../../../lib/access-runner'\nimport { attachmentAccessErrorResponse } from '../../../lib/access-errors'\nimport { NextRequest, NextResponse } from \"next/server\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport {\n  Attachment,\n  AttachmentPartition,\n} from \"@open-mercato/core/modules/attachments/data/entities\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { checkAttachmentAccess, isSuperAdminAuth } from \"@open-mercato/core/modules/attachments/lib/access\";\nimport { z } from \"zod\";\nimport { attachmentsTag, attachmentErrorSchema } from \"../../openapi\";\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n} from \"@open-mercato/core/modules/attachments/lib/security\";\nimport { StorageDriverFactory } from '../../../lib/drivers';\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope';\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string }> },\n) {\n  const { id } = await context.params;\n  if (!id) {\n    return NextResponse.json(\n      { error: \"Attachment id is required\" },\n      { status: 400 },\n    );\n  }\n  const auth = await getAuthFromRequest(req);\n  const container = await createRequestContainer();\n  const em = container.resolve(\"em\") as EntityManager;\n  const storageDriverFactory =\n    (container.resolve(\"storageDriverFactory\") as StorageDriverFactory | null) ??\n    new StorageDriverFactory(em);\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req);\n  if (requestScope.denied) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth;\n  const findFilter: Record<string, unknown> = { id };\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;\n  }\n  const attachment = await em.findOne(Attachment, findFilter);\n  if (!attachment) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const partition = await em.findOne(AttachmentPartition, {\n    code: attachment.partitionCode,\n  });\n  if (!partition) {\n    return NextResponse.json(\n      { error: \"Partition misconfigured\" },\n      { status: 500 },\n    );\n  }\n\n  const url = new URL(req.url);\n  const forceDownload = url.searchParams.get(\"download\") === \"1\";\n  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);\n  const access = await evaluateAttachmentAccess({\n    auth: scopedAuth, attachment, partition, action: renderInline ? 'render' : 'read',\n    context: createAttachmentAccessContext(container),\n  });\n  if (!access.ok) return attachmentAccessErrorResponse(access);\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  });\n  let buffer: Buffer;\n  try {\n    const result = await driver.read(attachment.partitionCode, attachment.storagePath);\n    buffer = result.buffer;\n  } catch {\n    return NextResponse.json({ error: \"File not available\" }, { status: 404 });\n  }\n\n  const headers: Record<string, string> = {\n    \"Cache-Control\": access.protected ? \"private, no-store\" : checkAttachmentAccess(null, attachment, partition).ok\n      ? \"public, max-age=86400\"\n      : \"private, max-age=60\",\n    \"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n    \"Content-Type\": renderInline\n      ? attachment.mimeType || \"application/octet-stream\"\n      : \"application/octet-stream\",\n    \"Content-Disposition\": buildAttachmentContentDisposition(\n      attachment.fileName,\n      renderInline ? \"inline\" : \"attachment\",\n    ),\n    \"X-Content-Type-Options\": \"nosniff\",\n  };\n  if (attachment.fileSize > 0) {\n    headers[\"Content-Length\"] = String(attachment.fileSize);\n  }\n\n  const responseBody = new Uint8Array(buffer);\n\n  return new NextResponse(responseBody, { status: 200, headers });\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: \"Download attachment file\",\n  methods: {\n    GET: {\n      summary: \"Download or serve attachment file\",\n      description:\n        \"Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.\",\n      responses: [\n        {\n          status: 200,\n          description: \"File content with appropriate MIME type\",\n          schema: z.any().describe(\"Binary file content\"),\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: \"Missing attachment ID\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 401,\n          description:\n            \"Unauthorized - authentication required for private partitions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 403,\n          description: \"Forbidden - insufficient permissions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 404,\n          description: \"Attachment or file not found\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 500,\n          description: \"Partition misconfigured\",\n          schema: attachmentErrorSchema,\n        },\n        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n};\n"],
+  "mappings": "AAAA,SAAS,+BAA+B,gCAAgC;AACxE,SAAS,qCAAqC;AAC9C,SAAsB,oBAAoB;AAE1C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB,wBAAwB;AACxD,SAAS,SAAS;AAClB,SAAS,gBAAgB,6BAA6B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAEvC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B;AAAA,MACrC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KACzC,IAAI,qBAAqB,EAAE;AAE7B,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACtD,MAAM,WAAW;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAW;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU,MAAM;AAC3D,QAAM,eAAe,CAAC,iBAAiB,0BAA0B,WAAW,QAAQ;AACpF,QAAM,SAAS,MAAM,yBAAyB;AAAA,IAC5C,MAAM;AAAA,IAAY;AAAA,IAAY;AAAA,IAAW,QAAQ,eAAe,WAAW;AAAA,IAC3E,SAAS,8BAA8B,SAAS;AAAA,EAClD,CAAC;AACD,MAAI,CAAC,OAAO,GAAI,QAAO,8BAA8B,MAAM;AAE3D,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AACjF,aAAS,OAAO;AAAA,EAClB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,UAAkC;AAAA,IACtC,iBAAiB,OAAO,YAAY,sBAAsB,sBAAsB,MAAM,YAAY,SAAS,EAAE,KACzG,0BACA;AAAA,IACJ,2BAA2B;AAAA,IAC3B,gBAAgB,eACZ,WAAW,YAAY,6BACvB;AAAA,IACJ,uBAAuB;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,WAAW;AAAA,IAC5B;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,YAAQ,gBAAgB,IAAI,OAAO,WAAW,QAAQ;AAAA,EACxD;AAEA,QAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,SAAO,IAAI,aAAa,cAAc,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,qBAAqB;AAAA,QAChD;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,sBAAsB;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }