@open-mercato/core 0.10.1-develop.7841.1.af87ac614d → 0.10.1-develop.7857.1.259928eb85

package/dist/modules/auth/api/users/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/users/route.ts"],
-  "sourcesContent": ["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { User, Role, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Organization, Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { E } from '#generated/entities.ids.generated'\nimport { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { userCrudEvents, userCrudIndexer } from '@open-mercato/core/modules/auth/commands/users'\nimport {\n  assertActorCanAccessUserTarget,\n  assertActorCanAssignUserDestination,\n  assertActorCanGrantRoleTokens,\n  assertActorCanModifySuperAdminUserTarget,\n  listSuperAdminUserIds,\n  resolveUserDestinationRoles,\n  throwUserDestinationOrganizationNotFound,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'\nimport { MAX_USER_LOOKUP_IDS, resolveUserIdFilter } from '@open-mercato/core/modules/auth/lib/userIdFilter'\nimport { findEntityIdsBySearchTokensCompat, type SearchTokenDatabase } from '@open-mercato/shared/lib/search/tokenLookup'\nimport { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'\nimport {\n  getSelectedTenantFromRequest,\n  resolveOrganizationScopeForRequest,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'users' })\n\nconst querySchema = z.object({\n  id: z.string().uuid().optional(),\n  ids: z.string().optional().describe('Comma-separated user identifiers, at most 100'),\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n  search: z.string().optional(),\n  name: z.string().optional(),\n  organizationId: z.string().uuid().optional(),\n  scopeToActiveOrganization: z.boolean().optional(),\n  roleIds: z.array(z.string().uuid()).optional(),\n}).passthrough()\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst passwordSchema = buildPasswordSchema()\n\nconst displayNameSchema = z.preprocess(\n  normalizeDisplayNameInput,\n  z.string().trim().min(1).max(120).nullable().optional(),\n)\n\nconst userCreateSchema = z.object({\n  email: z.string().email(),\n  name: displayNameSchema,\n  password: passwordSchema.optional(),\n  sendInviteEmail: z.boolean().optional(),\n  organizationId: z.string().uuid(),\n  roles: z.array(z.string()).optional(),\n}).refine(\n  (data) => data.password || data.sendInviteEmail,\n  { message: 'Either password or sendInviteEmail is required', path: ['password'] },\n)\n\nconst userUpdateSchema = z.object({\n  id: z.string().uuid(),\n  email: z.string().email().optional(),\n  name: displayNameSchema,\n  password: passwordSchema.optional(),\n  organizationId: z.string().uuid().optional(),\n  roles: z.array(z.string()).optional(),\n  isConfirmed: z.boolean().optional(),\n})\n\nconst userListItemSchema = z.object({\n  id: z.string().uuid(),\n  email: z.string().email(),\n  name: z.string().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  organizationName: z.string().nullable(),\n  tenantId: z.string().uuid().nullable(),\n  tenantName: z.string().nullable(),\n  roles: z.array(z.string()),\n  roleIds: z.array(z.string().uuid()).optional(),\n  hasPassword: z.boolean().optional(),\n  isConfirmed: z.boolean(),\n  updatedAt: z.string().nullable().optional(),\n})\n\nconst userListResponseSchema = z.object({\n  items: z.array(userListItemSchema),\n  total: z.number().int().nonnegative(),\n  totalPages: z.number().int().positive(),\n  isSuperAdmin: z.boolean().optional(),\n})\n\nconst okResponseSchema = z.object({ ok: z.literal(true) })\n\nconst errorResponseSchema = z.object({ error: z.string() })\n\ntype CrudInput = Record<string, unknown>\ntype UserListFilter = Record<string, unknown>\n\n// UserRole carries no tenant/organization columns of its own, so the caller's scope has to be\n// expressed as a predicate on the `user` relation \u2014 MikroORM compiles that into a database-side\n// join against `users` with the scope predicates in the WHERE clause, keeping the link lookup\n// bounded to the scope instead of every tenant holding the role.\nfunction buildRoleLinkFilter(\n  roleIdList: string[],\n  userScope: UserListFilter[],\n  candidateUserIds: Set<string> | null,\n): UserListFilter {\n  const scope = candidateUserIds\n    ? [...userScope, { id: { $in: Array.from(candidateUserIds) } }]\n    : userScope\n  return {\n    role: { $in: roleIdList },\n    deletedAt: null,\n    user: scope.length > 1 ? { $and: scope } : scope[0],\n  }\n}\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.users.list'] },\n  POST: { requireAuth: true, requireFeatures: ['auth.users.create'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.users.edit'] },\n  DELETE: { requireAuth: true, requireFeatures: ['auth.users.delete'] },\n}\n\nexport const metadata = routeMetadata\n\nconst crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({\n  metadata: routeMetadata,\n  orm: {\n    entity: User,\n    idField: 'id',\n    orgField: null,\n    tenantField: null,\n    softDeleteField: 'deletedAt',\n  },\n  events: userCrudEvents,\n  indexer: userCrudIndexer,\n  actions: {\n    create: {\n      commandId: 'auth.users.create',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        if (ctx.request) {\n          await assertCanAssignRoles(ctx.request, parsed.roles, parsed)\n        }\n        return parsed\n      },\n      response: ({ result }) => ({\n        id: String(result.user.id),\n        ...(result.warning ? { _warning: result.warning } : {}),\n      }),\n      status: 201,\n    },\n    update: {\n      commandId: 'auth.users.update',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        if (ctx.request) {\n          if (typeof parsed.id === 'string' && parsed.id.length) {\n            await assertCanModifySuperAdminTarget(ctx.request, parsed.id)\n            await assertCanAccessUserTarget(ctx.request, parsed.id)\n          }\n          if (typeof parsed.organizationId === 'string' && parsed.organizationId.length) {\n            const destinationChanged = await assertCanAssignUserDestination(ctx.request, parsed)\n            if (!destinationChanged) {\n              await assertCanAssignRoles(ctx.request, parsed.roles, parsed)\n            }\n          } else {\n            await assertCanAssignRoles(ctx.request, parsed.roles, parsed)\n          }\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'auth.users.delete',\n      mapInput: async ({ parsed, raw, ctx }) => {\n        const targetId = resolveDeleteTargetId(parsed, raw)\n        if (ctx.request && targetId) {\n          await assertCanModifySuperAdminTarget(ctx.request, targetId)\n          await assertCanAccessUserTarget(ctx.request, targetId)\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ items: [], total: 0, totalPages: 1 })\n  const url = new URL(req.url)\n  const rawRoleIds = url.searchParams.getAll('roleId').filter((id): id is string => typeof id === 'string' && id.trim().length > 0)\n  // Accept both the repeated (`?ids=a&ids=b`) and comma-joined (`?ids=a,b`) spellings.\n  const rawIds = url.searchParams.getAll('ids').join(',') || undefined\n  const userIdFilter = resolveUserIdFilter(rawIds, url.searchParams.get('id'))\n  const parsed = querySchema.safeParse({\n    id: url.searchParams.get('id') || undefined,\n    ids: rawIds,\n    page: url.searchParams.get('page') || undefined,\n    // A caller resolving a batch of ids wants all of them; without this the default page of 50\n    // would silently truncate a 100-id lookup.\n    pageSize: url.searchParams.get('pageSize')\n      || (rawIds && userIdFilter.kind === 'ids' ? String(Math.min(userIdFilter.ids.length, MAX_USER_LOOKUP_IDS)) : undefined),\n    search: url.searchParams.get('search') || undefined,\n    name: url.searchParams.get('name') || undefined,\n    organizationId: url.searchParams.get('organizationId') || undefined,\n    scopeToActiveOrganization: parseBooleanFlag(url.searchParams.get('scopeToActiveOrganization') || undefined),\n    roleIds: rawRoleIds.length ? rawRoleIds : undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ items: [], total: 0, totalPages: 1 })\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager)\n  let isSuperAdmin = auth.isSuperAdmin === true\n  try {\n    if (auth.sub) {\n      const rbacService = container.resolve('rbacService') as any\n      const acl = await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n      isSuperAdmin = isSuperAdmin || !!acl?.isSuperAdmin\n    }\n  } catch (err) {\n    logger.error('Failed to resolve rbac', { err })\n  }\n  const { id, page, pageSize, search, name, organizationId, scopeToActiveOrganization, roleIds } = parsed.data\n  if (userIdFilter.kind === 'none') {\n    return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n  }\n  const filters: any[] = [{ deletedAt: null }]\n  const actorTenantId = auth.tenantId ? String(auth.tenantId) : null\n  let effectiveTenantId: string | null = null\n  let effectiveOrganizationIds: string[] | null = null\n  let effectiveSelectedOrganizationId: string | null = null\n  let usesSelectedTenantScope = false\n  if (!isSuperAdmin) {\n    if (!actorTenantId) {\n      return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n    }\n    effectiveTenantId = actorTenantId\n    const superAdminUserIds = await listSuperAdminUserIds(em, actorTenantId)\n    if (superAdminUserIds.size) {\n      filters.push({ id: { $nin: Array.from(superAdminUserIds) as any } })\n    }\n  } else {\n    const selectedTenantId = getSelectedTenantFromRequest(req)\n    if (typeof selectedTenantId === 'string' && selectedTenantId.trim().length > 0) {\n      const scope = await resolveOrganizationScopeForRequest({\n        container,\n        auth,\n        request: req,\n        tenantId: selectedTenantId.trim(),\n      })\n      if (!scope.tenantId) {\n        return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n      }\n      effectiveTenantId = scope.tenantId\n      effectiveSelectedOrganizationId = scope.selectedId\n      usesSelectedTenantScope = true\n      if (Array.isArray(scope.filterIds)) {\n        if (scope.filterIds.length === 0) {\n          return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n        }\n        effectiveOrganizationIds = scope.filterIds\n      }\n    }\n  }\n  if (effectiveTenantId) {\n    filters.push({ tenantId: effectiveTenantId })\n  }\n  if (effectiveOrganizationIds) {\n    filters.push({ organizationId: { $in: effectiveOrganizationIds as any } })\n  }\n  const scopeOrganizationId = usesSelectedTenantScope\n    ? effectiveSelectedOrganizationId\n    : auth.orgId ?? null\n  if (organizationId) filters.push({ organizationId })\n  // Recipient/assignee pickers scope to the caller's active organization so they never\n  // suggest users outside it. A message composed here is stamped with the caller's\n  // active org (auth.orgId), and the message detail endpoint enforces\n  // hasOrganizationAccess(scope.organizationId, message.organizationId); scoping the\n  // suggestions to the same org keeps a picked recipient able to open what they were sent.\n  if (scopeToActiveOrganization) filters.push({ organizationId: auth.orgId ?? null })\n  const trimmedName = typeof name === 'string' ? name.trim() : ''\n  if (trimmedName) {\n    const searchPattern = `%${escapeLikePattern(trimmedName)}%`\n    const displayNameFilters: UserListFilter[] = [{ name: { $ilike: searchPattern } }]\n    const nameTokenScope: string | null | undefined = isSuperAdmin ? (effectiveTenantId ?? undefined) : auth.tenantId ?? null\n    const matchedDisplayNameIds = await findUserIdsBySearchTokens(em, E.auth.user, trimmedName, nameTokenScope, 'name')\n    if (matchedDisplayNameIds && matchedDisplayNameIds.length) {\n      displayNameFilters.push({ id: { $in: matchedDisplayNameIds } })\n    }\n    filters.push(displayNameFilters.length > 1 ? { $or: displayNameFilters } : displayNameFilters[0])\n  }\n  // `?id=` and `?ids=` are already intersected by resolveUserIdFilter.\n  let idFilter: Set<string> | null = userIdFilter.kind === 'ids' ? new Set(userIdFilter.ids) : null\n  if (Array.isArray(roleIds) && roleIds.length > 0) {\n    const uniqueRoleIds = Array.from(new Set(roleIds))\n    const linksForRoles = await em.find(\n      UserRole,\n      buildRoleLinkFilter(uniqueRoleIds, filters, idFilter) as any,\n    )\n    const roleUserIds = new Set<string>()\n    for (const link of linksForRoles) {\n      const uid = String((link as any).user?.id || (link as any).user || '')\n      if (uid) roleUserIds.add(uid)\n    }\n    if (roleUserIds.size === 0) return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n    if (idFilter) {\n      // buildRoleLinkFilter already constrains the lookup to `user.id IN idFilter`, so this\n      // intersection is enforced database-side; the loop stays as an application-level backstop\n      // so the `?id=` + `?roleId=` contract does not depend on that predicate alone.\n      for (const uid of Array.from(idFilter)) {\n        if (!roleUserIds.has(uid)) idFilter.delete(uid)\n      }\n    } else {\n      idFilter = roleUserIds\n    }\n    if (!idFilter || idFilter.size === 0) return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n  }\n  const trimmedSearch = typeof search === 'string' ? search.trim() : ''\n  if (trimmedSearch) {\n    // Email is encrypted at rest, so plaintext search must go through search_tokens.\n    const tenantScope: string | null | undefined = isSuperAdmin ? (effectiveTenantId ?? undefined) : auth.tenantId ?? null\n    const searchFilters: any[] = []\n\n    const matchedIds = await findUserIdsBySearchTokens(em, E.auth.user, trimmedSearch, tenantScope)\n    if (matchedIds && matchedIds.length) {\n      searchFilters.push({ id: { $in: matchedIds as any } })\n    }\n\n    const searchPattern = `%${escapeLikePattern(trimmedSearch)}%`\n    const organizationSearchFilters: any[] = [\n      { deletedAt: null },\n      { name: { $ilike: searchPattern } },\n    ]\n    if (tenantScope) {\n      organizationSearchFilters.push({ tenant: tenantScope })\n    }\n    const matchingOrganizations = await em.find(\n      Organization,\n      organizationSearchFilters.length > 1 ? { $and: organizationSearchFilters } : organizationSearchFilters[0],\n    )\n    const matchingOrganizationIds = matchingOrganizations\n      .map((org) => (org?.id ? String(org.id) : null))\n      .filter((orgId): orgId is string => typeof orgId === 'string' && orgId.length > 0)\n    if (matchingOrganizationIds.length) {\n      searchFilters.push({ organizationId: { $in: matchingOrganizationIds as any } })\n    }\n\n    const roleSearchFilters: any[] = [\n      { deletedAt: null },\n      { name: { $ilike: searchPattern } },\n    ]\n    if (tenantScope) {\n      roleSearchFilters.push({ $or: [{ tenantId: tenantScope }, { tenantId: null }] })\n    }\n    const matchingRoles = await em.find(\n      Role,\n      roleSearchFilters.length > 1 ? { $and: roleSearchFilters } : roleSearchFilters[0],\n    )\n    const matchingRoleIds = matchingRoles\n      .map((role) => (role?.id ? String(role.id) : null))\n      .filter((roleId): roleId is string => typeof roleId === 'string' && roleId.length > 0)\n    if (matchingRoleIds.length) {\n      const roleSearchLinks = await em.find(\n        UserRole,\n        buildRoleLinkFilter(matchingRoleIds, filters, idFilter) as any,\n      )\n      const matchingRoleUserIds = Array.from(new Set(\n        roleSearchLinks\n          .map((link) => {\n            const userRef = (link as any).user\n            const userId = userRef?.id ?? userRef\n            return userId ? String(userId) : null\n          })\n          .filter((userId): userId is string => typeof userId === 'string' && userId.length > 0),\n      ))\n      if (matchingRoleUserIds.length) {\n        searchFilters.push({ id: { $in: matchingRoleUserIds as any } })\n      }\n    }\n\n    if (!searchFilters.length) {\n      return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n    }\n\n    filters.push(searchFilters.length > 1 ? { $or: searchFilters } : searchFilters[0])\n  }\n  // `?id=` has no separate path: resolveUserIdFilter folds it into `idFilter`, and a `kind: 'none'`\n  // outcome already returned above, so `idFilter` is null only when neither param was supplied.\n  if (idFilter && idFilter.size) {\n    filters.push({ id: { $in: Array.from(idFilter) as any } })\n  }\n  const where = filters.length > 1 ? { $and: filters } : filters[0]\n  const [rows, count] = await em.findAndCount(User, where, { limit: pageSize, offset: (page - 1) * pageSize })\n  const userIds = rows.map((u: any) => u.id)\n  const links = userIds.length\n    ? await findWithDecryption(\n        em,\n        UserRole,\n        { user: { $in: userIds as any }, deletedAt: null } as any,\n        { populate: ['role'] },\n        {\n          tenantId: effectiveTenantId,\n          organizationId: scopeOrganizationId,\n        },\n      )\n    : []\n  const roleMap: Record<string, string[]> = {}\n  const roleIdMap: Record<string, string[]> = {}\n  for (const l of links) {\n    const uid = String((l as any).user?.id || (l as any).user)\n    const rname = String((l as any).role?.name || '')\n    const rid = String((l as any).role?.id ?? '')\n    if (!roleMap[uid]) roleMap[uid] = []\n    if (!roleIdMap[uid]) roleIdMap[uid] = []\n    if (rname) roleMap[uid].push(rname)\n    if (rid) roleIdMap[uid].push(rid)\n  }\n  const orgIds = rows\n    .map((u: any) => (u.organizationId ? String(u.organizationId) : null))\n    .filter((id): id is string => !!id)\n  const uniqueOrgIds = Array.from(new Set(orgIds))\n  let orgMap: Record<string, string> = {}\n  if (uniqueOrgIds.length) {\n    const organizations = await em.find(\n      Organization,\n      { id: { $in: uniqueOrgIds as any }, deletedAt: null },\n    )\n    orgMap = organizations.reduce<Record<string, string>>((acc, org) => {\n      const orgId = org?.id ? String(org.id) : null\n      if (!orgId) return acc\n      const rawName = (org as any)?.name\n      const orgName = typeof rawName === 'string' && rawName.length > 0 ? rawName : orgId\n      acc[orgId] = orgName\n      return acc\n    }, {})\n  }\n  const tenantIds = rows\n    .map((u: any) => (u.tenantId ? String(u.tenantId) : null))\n    .filter((id): id is string => !!id)\n  const uniqueTenantIds = Array.from(new Set(tenantIds))\n  let tenantMap: Record<string, string> = {}\n  if (uniqueTenantIds.length) {\n    const tenants = await em.find(\n      Tenant,\n      { id: { $in: uniqueTenantIds as any }, deletedAt: null },\n    )\n    tenantMap = tenants.reduce<Record<string, string>>((acc, tenant) => {\n      const tenantId = tenant?.id ? String(tenant.id) : null\n      if (!tenantId) return acc\n      const rawName = (tenant as any)?.name\n      const tenantName = typeof rawName === 'string' && rawName.length > 0 ? rawName : tenantId\n      acc[tenantId] = tenantName\n      return acc\n    }, {})\n  }\n  const tenantByUser: Record<string, string | null> = {}\n  const organizationByUser: Record<string, string | null> = {}\n  for (const u of rows) {\n    const uid = String(u.id)\n    tenantByUser[uid] = u.tenantId ? String(u.tenantId) : null\n    organizationByUser[uid] = u.organizationId ? String(u.organizationId) : null\n  }\n  const cfByUser = userIds.length\n    ? await loadCustomFieldValues({\n        em,\n        entityId: E.auth.user,\n        recordIds: userIds.map(String),\n        tenantIdByRecord: tenantByUser,\n        organizationIdByRecord: organizationByUser,\n        tenantFallbacks: effectiveTenantId ? [effectiveTenantId] : auth.tenantId ? [auth.tenantId] : [],\n      })\n    : {}\n\n  const items = rows.map((u: any) => {\n    const uid = String(u.id)\n    const orgId = u.organizationId ? String(u.organizationId) : null\n    return {\n      id: uid,\n      email: String(u.email),\n      name: u.name ? String(u.name) : null,\n      organizationId: orgId,\n      organizationName: orgId ? orgMap[orgId] ?? orgId : null,\n      tenantId: u.tenantId ? String(u.tenantId) : null,\n      tenantName: u.tenantId ? tenantMap[String(u.tenantId)] ?? String(u.tenantId) : null,\n      roles: roleMap[uid] || [],\n      roleIds: roleIdMap[uid] || [],\n      ...(id ? { hasPassword: !!u.passwordHash } : {}),\n      isConfirmed: u.isConfirmed !== false,\n      updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : null,\n      ...(cfByUser[uid] || {}),\n    }\n  })\n  const totalPages = Math.max(1, Math.ceil(count / pageSize))\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items,\n    idField: 'id',\n    resourceKind: 'auth.user',\n    organizationId: effectiveSelectedOrganizationId,\n    tenantId: effectiveTenantId ?? auth.tenantId ?? null,\n    query: parsed.data,\n    accessType: id ? 'read:item' : undefined,\n  })\n  return NextResponse.json({ items, total: count, totalPages, isSuperAdmin })\n}\n\nexport const POST = async (req: Request) => {\n  return crud.POST(req)\n}\n\nexport const PUT = async (req: Request) => {\n  return crud.PUT(req)\n}\n\nexport const DELETE = async (req: Request) => {\n  const targetId = new URL(req.url).searchParams.get('id')\n  if (targetId) {\n    try {\n      await assertCanModifySuperAdminTarget(req, targetId)\n      await assertCanAccessUserTarget(req, targetId)\n    } catch (err) {\n      if (err instanceof CrudHttpError) {\n        return NextResponse.json(err.body, { status: err.status })\n      }\n      throw err\n    }\n  }\n  return crud.DELETE(req)\n}\n\nasync function findUserIdsBySearchTokens(\n  em: EntityManager,\n  entityType: string,\n  search: string,\n  tenantScope: string | null | undefined,\n  field?: string,\n): Promise<string[] | null> {\n  return findEntityIdsBySearchTokensCompat({\n    db: em.getKysely<SearchTokenDatabase>(),\n    entityType,\n    query: search,\n    fields: field ? [field] : undefined,\n    scope: { tenantId: tenantScope },\n  })\n}\n\nasync function assertCanModifySuperAdminTarget(req: Request, targetUserId: string) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  await assertActorCanModifySuperAdminUserTarget({\n    em,\n    rbacService: container.resolve('rbacService') as RbacService,\n    actorUserId: auth.sub,\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n    targetUserId,\n  })\n}\n\nasync function assertCanAccessUserTarget(req: Request, targetUserId: string) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const organizationScope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request: req,\n    tenantId: auth.tenantId ?? null,\n  })\n  await assertActorCanAccessUserTarget({\n    em,\n    rbacService: container.resolve('rbacService') as RbacService,\n    actorUserId: auth.sub,\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n    targetUserId,\n    organizationScope,\n  })\n}\n\nfunction resolveDeleteTargetId(parsed: unknown, raw: unknown): string | null {\n  const fromParsed = readId((parsed as Record<string, unknown> | null | undefined))\n  if (fromParsed) return fromParsed\n  const rawRecord = raw as { body?: Record<string, unknown>; query?: Record<string, unknown> } | null | undefined\n  return readId(rawRecord?.query) ?? readId(rawRecord?.body)\n}\n\nfunction readId(record: Record<string, unknown> | null | undefined): string | null {\n  const value = record?.id\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nasync function assertCanAssignRoles(req: Request, roles: unknown, payload: Record<string, unknown>) {\n  if (!Array.isArray(roles)) return\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const tenantId = await resolveTargetTenantIdForRoleGrant(em, payload, auth.tenantId ?? null)\n  await assertActorCanGrantRoleTokens({\n    em,\n    rbacService: container.resolve('rbacService') as RbacService,\n    actorUserId: auth.sub,\n    tenantId,\n    organizationId: auth.orgId ?? null,\n    roleTokens: roles,\n  })\n}\n\nasync function assertCanAssignUserDestination(req: Request, payload: Record<string, unknown>): Promise<boolean> {\n  const organizationId = typeof payload.organizationId === 'string' ? payload.organizationId : null\n  const targetUserId = typeof payload.id === 'string' ? payload.id : null\n  if (!organizationId || !targetUserId) return false\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const targetUser = await findOneWithDecryption(\n    em,\n    User,\n    { id: targetUserId, deletedAt: null },\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  if (!targetUser) return false\n  const organization = await findOneWithDecryption(\n    em,\n    Organization,\n    { id: organizationId },\n    { populate: ['tenant'] },\n    { tenantId: null, organizationId },\n  )\n  if (!organization) return throwUserDestinationOrganizationNotFound(400)\n  const destinationTenantId = organization.tenant?.id ? String(organization.tenant.id) : null\n  if (!destinationTenantId) return throwUserDestinationOrganizationNotFound(400)\n  const currentOrganizationId = targetUser.organizationId ? String(targetUser.organizationId) : null\n  const currentTenantId = targetUser.tenantId ? String(targetUser.tenantId) : null\n  if (currentOrganizationId === organizationId && currentTenantId === destinationTenantId) {\n    return false\n  }\n  const roles = await resolveUserDestinationRoles({\n    em,\n    targetUserId,\n    destinationTenantId,\n    roleTokens: payload.roles,\n  })\n  const organizationScope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request: req,\n    tenantId: destinationTenantId,\n  })\n  await assertActorCanAssignUserDestination({\n    em,\n    rbacService: container.resolve('rbacService') as RbacService,\n    actorUserId: auth.sub,\n    actorIsSuperAdmin: auth.isSuperAdmin === true,\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n    allowedOrganizationIds: organizationScope.allowedIds,\n    destinationTenantId,\n    destinationOrganizationId: organizationId,\n    roles,\n  })\n  return true\n}\n\nasync function resolveTargetTenantIdForRoleGrant(\n  em: EntityManager,\n  payload: Record<string, unknown>,\n  fallbackTenantId: string | null,\n): Promise<string | null> {\n  const organizationId = typeof payload.organizationId === 'string' ? payload.organizationId : null\n  if (organizationId) {\n    const organization = await findOneWithDecryption(\n      em,\n      Organization,\n      { id: organizationId },\n      { populate: ['tenant'] },\n      { tenantId: null, organizationId },\n    )\n    return organization?.tenant?.id ? String(organization.tenant.id) : fallbackTenantId\n  }\n\n  const userId = typeof payload.id === 'string' ? payload.id : null\n  if (userId) {\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: userId, deletedAt: null },\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    return user?.tenantId ? String(user.tenantId) : fallbackTenantId\n  }\n\n  return fallbackTenantId\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'User management',\n  methods: {\n    GET: {\n      summary: 'List users',\n      description:\n        'Non-superadmins with auth.users.list receive a tenant-wide staff directory by default, excluding superadmin accounts. Neither the active organization nor the caller\\'s organization visibility list narrows this default. Directory visibility does not grant access to organization-owned records. Super administrators may scope the response via the topbar tenant and organization selection; without a selected tenant, their list can span tenants. Search matches email, organization name, and role name. Pass organizationId for an exact organization filter, or scopeToActiveOrganization=1 to restrict results to the caller\\'s exact active organization (used by recipient/assignee pickers); when the caller has no active organization, this selects only users with no organization. Both filters apply when supplied together. These are optional list filters, not authorization boundaries. Pass ids=<uuid>,<uuid> (max 100) to resolve a known set of users in one request, for example to label a list of foreign keys; it intersects with id and roleId, and a supplied ids value that contains no valid identifier matches nothing.',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'User collection', schema: userListResponseSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create user',\n      description: 'Creates a new confirmed user within the specified organization, optional display name, and optional roles. The organization must be within the caller\\'s descendant-expanded organization scope, whether or not roles are sent, and the roles must belong to its tenant and be grantable by the caller.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: userCreateSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'User created',\n          schema: z.object({ id: z.string().uuid() }),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or duplicate email', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Attempted to assign privileged roles, or the organization is outside the caller\\'s organization scope', schema: errorResponseSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update user',\n      description:\n        'Updates profile fields including display name, organization assignment, credentials, or role memberships. A destination organization must be within the caller\\'s descendant-expanded organization scope. Retained and newly assigned roles must belong to the destination tenant and be grantable by the caller. Setting isConfirmed=false deactivates the account: the user can no longer sign in and every active session is revoked; isConfirmed=true reactivates it. A tenant cannot drop below a protected role\\'s minimum active holder count, so revoking the role from, deactivating, moving, or deleting the last active administrator is rejected.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: userUpdateSchema,\n      },\n      responses: [\n        { status: 200, description: 'User updated', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload, duplicate email, or the update would remove the last active holder of a protected role', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Destination organization is outside caller scope, or a retained or assigned role is not grantable', schema: errorResponseSchema },\n        { status: 404, description: 'User or destination organization not found in the caller tenant scope', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete user',\n      description: 'Deletes a user by identifier. Rejected when the target is the last active holder of a protected role in the tenant. Undo support is provided via the command bus.',\n      query: z.object({ id: z.string().uuid().describe('User identifier') }),\n      responses: [\n        { status: 200, description: 'User deleted', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'User cannot be deleted, or is the last active holder of a protected role', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 404, description: 'User not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,eAAe,qBAAqB;AAC7C,SAAS,qBAAqB;AAC9B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,MAAM,MAAM,gBAAgB;AAErC,SAAS,cAAc,cAAc;AACrC,SAAS,SAAS;AAClB,SAAS,6BAA6B;AAEtC,SAAS,gBAAgB,uBAAuB;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAClC,SAAS,wBAAwB;AACjC,SAAS,qBAAqB,2BAA2B;AACzD,SAAS,yCAAmE;AAC5E,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEhE,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AAAA,EACnF,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,2BAA2B,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAC/C,CAAC,EAAE,YAAY;AAEf,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,oBAAoB,EAAE;AAAA,EAC1B;AAAA,EACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AACxD;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM;AAAA,EACN,UAAU,eAAe,SAAS;AAAA,EAClC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AACtC,CAAC,EAAE;AAAA,EACD,CAAC,SAAS,KAAK,YAAY,KAAK;AAAA,EAChC,EAAE,SAAS,kDAAkD,MAAM,CAAC,UAAU,EAAE;AAClF;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,UAAU,eAAe,SAAS;AAAA,EAClC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,QAAQ,EAAE,SAAS;AACpC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACzB,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7C,aAAa,EAAE,QAAQ,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,QAAQ;AAAA,EACvB,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC5C,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,MAAM,kBAAkB;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,cAAc,EAAE,QAAQ,EAAE,SAAS;AACrC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEzD,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAS1D,SAAS,oBACP,YACA,WACA,kBACgB;AAChB,QAAM,QAAQ,mBACV,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,gBAAgB,EAAE,EAAE,CAAC,IAC5D;AACJ,SAAO;AAAA,IACL,MAAM,EAAE,KAAK,WAAW;AAAA,IACxB,WAAW;AAAA,IACX,MAAM,MAAM,SAAS,IAAI,EAAE,MAAM,MAAM,IAAI,MAAM,CAAC;AAAA,EACpD;AACF;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EAClE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACtE;AAEO,MAAM,WAAW;AAExB,MAAM,OAAO,cAA6D;AAAA,EACxE,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,YAAI,IAAI,SAAS;AACf,gBAAM,qBAAqB,IAAI,SAAS,OAAO,OAAO,MAAM;AAAA,QAC9D;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO;AAAA,QACzB,IAAI,OAAO,OAAO,KAAK,EAAE;AAAA,QACzB,GAAI,OAAO,UAAU,EAAE,UAAU,OAAO,QAAQ,IAAI,CAAC;AAAA,MACvD;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,YAAI,IAAI,SAAS;AACf,cAAI,OAAO,OAAO,OAAO,YAAY,OAAO,GAAG,QAAQ;AACrD,kBAAM,gCAAgC,IAAI,SAAS,OAAO,EAAE;AAC5D,kBAAM,0BAA0B,IAAI,SAAS,OAAO,EAAE;AAAA,UACxD;AACA,cAAI,OAAO,OAAO,mBAAmB,YAAY,OAAO,eAAe,QAAQ;AAC7E,kBAAM,qBAAqB,MAAM,+BAA+B,IAAI,SAAS,MAAM;AACnF,gBAAI,CAAC,oBAAoB;AACvB,oBAAM,qBAAqB,IAAI,SAAS,OAAO,OAAO,MAAM;AAAA,YAC9D;AAAA,UACF,OAAO;AACL,kBAAM,qBAAqB,IAAI,SAAS,OAAO,OAAO,MAAM;AAAA,UAC9D;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,UAAU,OAAO,EAAE,QAAQ,KAAK,IAAI,MAAM;AACxC,cAAM,WAAW,sBAAsB,QAAQ,GAAG;AAClD,YAAI,IAAI,WAAW,UAAU;AAC3B,gBAAM,gCAAgC,IAAI,SAAS,QAAQ;AAC3D,gBAAM,0BAA0B,IAAI,SAAS,QAAQ;AAAA,QACvD;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE,CAAC;AAC1E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,OAAO,QAAQ,EAAE,OAAO,CAACA,QAAqB,OAAOA,QAAO,YAAYA,IAAG,KAAK,EAAE,SAAS,CAAC;AAEhI,QAAM,SAAS,IAAI,aAAa,OAAO,KAAK,EAAE,KAAK,GAAG,KAAK;AAC3D,QAAM,eAAe,oBAAoB,QAAQ,IAAI,aAAa,IAAI,IAAI,CAAC;AAC3E,QAAM,SAAS,YAAY,UAAU;AAAA,IACnC,IAAI,IAAI,aAAa,IAAI,IAAI,KAAK;AAAA,IAClC,KAAK;AAAA,IACL,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA;AAAA;AAAA,IAGtC,UAAU,IAAI,aAAa,IAAI,UAAU,MACnC,UAAU,aAAa,SAAS,QAAQ,OAAO,KAAK,IAAI,aAAa,IAAI,QAAQ,mBAAmB,CAAC,IAAI;AAAA,IAC/G,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,gBAAgB,IAAI,aAAa,IAAI,gBAAgB,KAAK;AAAA,IAC1D,2BAA2B,iBAAiB,IAAI,aAAa,IAAI,2BAA2B,KAAK,MAAS;AAAA,IAC1G,SAAS,WAAW,SAAS,aAAa;AAAA,EAC5C,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE,CAAC;AACpF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,MAAI,eAAe,KAAK,iBAAiB;AACzC,MAAI;AACF,QAAI,KAAK,KAAK;AACZ,YAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,YAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AACvH,qBAAe,gBAAgB,CAAC,CAAC,KAAK;AAAA,IACxC;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,0BAA0B,EAAE,IAAI,CAAC;AAAA,EAChD;AACA,QAAM,EAAE,IAAI,MAAM,UAAU,QAAQ,MAAM,gBAAgB,2BAA2B,QAAQ,IAAI,OAAO;AACxG,MAAI,aAAa,SAAS,QAAQ;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,EAC/E;AACA,QAAM,UAAiB,CAAC,EAAE,WAAW,KAAK,CAAC;AAC3C,QAAM,gBAAgB,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9D,MAAI,oBAAmC;AACvC,MAAI,2BAA4C;AAChD,MAAI,kCAAiD;AACrD,MAAI,0BAA0B;AAC9B,MAAI,CAAC,cAAc;AACjB,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,IAC/E;AACA,wBAAoB;AACpB,UAAM,oBAAoB,MAAM,sBAAsB,IAAI,aAAa;AACvE,QAAI,kBAAkB,MAAM;AAC1B,cAAQ,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,KAAK,iBAAiB,EAAS,EAAE,CAAC;AAAA,IACrE;AAAA,EACF,OAAO;AACL,UAAM,mBAAmB,6BAA6B,GAAG;AACzD,QAAI,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,GAAG;AAC9E,YAAM,QAAQ,MAAM,mCAAmC;AAAA,QACrD;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,UAAU,iBAAiB,KAAK;AAAA,MAClC,CAAC;AACD,UAAI,CAAC,MAAM,UAAU;AACnB,eAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,MAC/E;AACA,0BAAoB,MAAM;AAC1B,wCAAkC,MAAM;AACxC,gCAA0B;AAC1B,UAAI,MAAM,QAAQ,MAAM,SAAS,GAAG;AAClC,YAAI,MAAM,UAAU,WAAW,GAAG;AAChC,iBAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,QAC/E;AACA,mCAA2B,MAAM;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACA,MAAI,mBAAmB;AACrB,YAAQ,KAAK,EAAE,UAAU,kBAAkB,CAAC;AAAA,EAC9C;AACA,MAAI,0BAA0B;AAC5B,YAAQ,KAAK,EAAE,gBAAgB,EAAE,KAAK,yBAAgC,EAAE,CAAC;AAAA,EAC3E;AACA,QAAM,sBAAsB,0BACxB,kCACA,KAAK,SAAS;AAClB,MAAI,eAAgB,SAAQ,KAAK,EAAE,eAAe,CAAC;AAMnD,MAAI,0BAA2B,SAAQ,KAAK,EAAE,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAClF,QAAM,cAAc,OAAO,SAAS,WAAW,KAAK,KAAK,IAAI;AAC7D,MAAI,aAAa;AACf,UAAM,gBAAgB,IAAI,kBAAkB,WAAW,CAAC;AACxD,UAAM,qBAAuC,CAAC,EAAE,MAAM,EAAE,QAAQ,cAAc,EAAE,CAAC;AACjF,UAAM,iBAA4C,eAAgB,qBAAqB,SAAa,KAAK,YAAY;AACrH,UAAM,wBAAwB,MAAM,0BAA0B,IAAI,EAAE,KAAK,MAAM,aAAa,gBAAgB,MAAM;AAClH,QAAI,yBAAyB,sBAAsB,QAAQ;AACzD,yBAAmB,KAAK,EAAE,IAAI,EAAE,KAAK,sBAAsB,EAAE,CAAC;AAAA,IAChE;AACA,YAAQ,KAAK,mBAAmB,SAAS,IAAI,EAAE,KAAK,mBAAmB,IAAI,mBAAmB,CAAC,CAAC;AAAA,EAClG;AAEA,MAAI,WAA+B,aAAa,SAAS,QAAQ,IAAI,IAAI,aAAa,GAAG,IAAI;AAC7F,MAAI,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,GAAG;AAChD,UAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC;AACjD,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA,oBAAoB,eAAe,SAAS,QAAQ;AAAA,IACtD;AACA,UAAM,cAAc,oBAAI,IAAY;AACpC,eAAW,QAAQ,eAAe;AAChC,YAAM,MAAM,OAAQ,KAAa,MAAM,MAAO,KAAa,QAAQ,EAAE;AACrE,UAAI,IAAK,aAAY,IAAI,GAAG;AAAA,IAC9B;AACA,QAAI,YAAY,SAAS,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AACzG,QAAI,UAAU;AAIZ,iBAAW,OAAO,MAAM,KAAK,QAAQ,GAAG;AACtC,YAAI,CAAC,YAAY,IAAI,GAAG,EAAG,UAAS,OAAO,GAAG;AAAA,MAChD;AAAA,IACF,OAAO;AACL,iBAAW;AAAA,IACb;AACA,QAAI,CAAC,YAAY,SAAS,SAAS,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,EACrH;AACA,QAAM,gBAAgB,OAAO,WAAW,WAAW,OAAO,KAAK,IAAI;AACnE,MAAI,eAAe;AAEjB,UAAM,cAAyC,eAAgB,qBAAqB,SAAa,KAAK,YAAY;AAClH,UAAM,gBAAuB,CAAC;AAE9B,UAAM,aAAa,MAAM,0BAA0B,IAAI,EAAE,KAAK,MAAM,eAAe,WAAW;AAC9F,QAAI,cAAc,WAAW,QAAQ;AACnC,oBAAc,KAAK,EAAE,IAAI,EAAE,KAAK,WAAkB,EAAE,CAAC;AAAA,IACvD;AAEA,UAAM,gBAAgB,IAAI,kBAAkB,aAAa,CAAC;AAC1D,UAAM,4BAAmC;AAAA,MACvC,EAAE,WAAW,KAAK;AAAA,MAClB,EAAE,MAAM,EAAE,QAAQ,cAAc,EAAE;AAAA,IACpC;AACA,QAAI,aAAa;AACf,gCAA0B,KAAK,EAAE,QAAQ,YAAY,CAAC;AAAA,IACxD;AACA,UAAM,wBAAwB,MAAM,GAAG;AAAA,MACrC;AAAA,MACA,0BAA0B,SAAS,IAAI,EAAE,MAAM,0BAA0B,IAAI,0BAA0B,CAAC;AAAA,IAC1G;AACA,UAAM,0BAA0B,sBAC7B,IAAI,CAAC,QAAS,KAAK,KAAK,OAAO,IAAI,EAAE,IAAI,IAAK,EAC9C,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AACnF,QAAI,wBAAwB,QAAQ;AAClC,oBAAc,KAAK,EAAE,gBAAgB,EAAE,KAAK,wBAA+B,EAAE,CAAC;AAAA,IAChF;AAEA,UAAM,oBAA2B;AAAA,MAC/B,EAAE,WAAW,KAAK;AAAA,MAClB,EAAE,MAAM,EAAE,QAAQ,cAAc,EAAE;AAAA,IACpC;AACA,QAAI,aAAa;AACf,wBAAkB,KAAK,EAAE,KAAK,CAAC,EAAE,UAAU,YAAY,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE,CAAC;AAAA,IACjF;AACA,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA,kBAAkB,SAAS,IAAI,EAAE,MAAM,kBAAkB,IAAI,kBAAkB,CAAC;AAAA,IAClF;AACA,UAAM,kBAAkB,cACrB,IAAI,CAAC,SAAU,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI,IAAK,EACjD,OAAO,CAAC,WAA6B,OAAO,WAAW,YAAY,OAAO,SAAS,CAAC;AACvF,QAAI,gBAAgB,QAAQ;AAC1B,YAAM,kBAAkB,MAAM,GAAG;AAAA,QAC/B;AAAA,QACA,oBAAoB,iBAAiB,SAAS,QAAQ;AAAA,MACxD;AACA,YAAM,sBAAsB,MAAM,KAAK,IAAI;AAAA,QACzC,gBACG,IAAI,CAAC,SAAS;AACb,gBAAM,UAAW,KAAa;AAC9B,gBAAM,SAAS,SAAS,MAAM;AAC9B,iBAAO,SAAS,OAAO,MAAM,IAAI;AAAA,QACnC,CAAC,EACA,OAAO,CAAC,WAA6B,OAAO,WAAW,YAAY,OAAO,SAAS,CAAC;AAAA,MACzF,CAAC;AACD,UAAI,oBAAoB,QAAQ;AAC9B,sBAAc,KAAK,EAAE,IAAI,EAAE,KAAK,oBAA2B,EAAE,CAAC;AAAA,MAChE;AAAA,IACF;AAEA,QAAI,CAAC,cAAc,QAAQ;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,IAC/E;AAEA,YAAQ,KAAK,cAAc,SAAS,IAAI,EAAE,KAAK,cAAc,IAAI,cAAc,CAAC,CAAC;AAAA,EACnF;AAGA,MAAI,YAAY,SAAS,MAAM;AAC7B,YAAQ,KAAK,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,QAAQ,EAAS,EAAE,CAAC;AAAA,EAC3D;AACA,QAAM,QAAQ,QAAQ,SAAS,IAAI,EAAE,MAAM,QAAQ,IAAI,QAAQ,CAAC;AAChE,QAAM,CAAC,MAAM,KAAK,IAAI,MAAM,GAAG,aAAa,MAAM,OAAO,EAAE,OAAO,UAAU,SAAS,OAAO,KAAK,SAAS,CAAC;AAC3G,QAAM,UAAU,KAAK,IAAI,CAAC,MAAW,EAAE,EAAE;AACzC,QAAM,QAAQ,QAAQ,SAClB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,QAAe,GAAG,WAAW,KAAK;AAAA,IACjD,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB;AAAA,MACE,UAAU;AAAA,MACV,gBAAgB;AAAA,IAClB;AAAA,EACF,IACA,CAAC;AACL,QAAM,UAAoC,CAAC;AAC3C,QAAM,YAAsC,CAAC;AAC7C,aAAW,KAAK,OAAO;AACrB,UAAM,MAAM,OAAQ,EAAU,MAAM,MAAO,EAAU,IAAI;AACzD,UAAM,QAAQ,OAAQ,EAAU,MAAM,QAAQ,EAAE;AAChD,UAAM,MAAM,OAAQ,EAAU,MAAM,MAAM,EAAE;AAC5C,QAAI,CAAC,QAAQ,GAAG,EAAG,SAAQ,GAAG,IAAI,CAAC;AACnC,QAAI,CAAC,UAAU,GAAG,EAAG,WAAU,GAAG,IAAI,CAAC;AACvC,QAAI,MAAO,SAAQ,GAAG,EAAE,KAAK,KAAK;AAClC,QAAI,IAAK,WAAU,GAAG,EAAE,KAAK,GAAG;AAAA,EAClC;AACA,QAAM,SAAS,KACZ,IAAI,CAAC,MAAY,EAAE,iBAAiB,OAAO,EAAE,cAAc,IAAI,IAAK,EACpE,OAAO,CAACA,QAAqB,CAAC,CAACA,GAAE;AACpC,QAAM,eAAe,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC;AAC/C,MAAI,SAAiC,CAAC;AACtC,MAAI,aAAa,QAAQ;AACvB,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,aAAoB,GAAG,WAAW,KAAK;AAAA,IACtD;AACA,aAAS,cAAc,OAA+B,CAAC,KAAK,QAAQ;AAClE,YAAM,QAAQ,KAAK,KAAK,OAAO,IAAI,EAAE,IAAI;AACzC,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,UAAW,KAAa;AAC9B,YAAM,UAAU,OAAO,YAAY,YAAY,QAAQ,SAAS,IAAI,UAAU;AAC9E,UAAI,KAAK,IAAI;AACb,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AACA,QAAM,YAAY,KACf,IAAI,CAAC,MAAY,EAAE,WAAW,OAAO,EAAE,QAAQ,IAAI,IAAK,EACxD,OAAO,CAACA,QAAqB,CAAC,CAACA,GAAE;AACpC,QAAM,kBAAkB,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC;AACrD,MAAI,YAAoC,CAAC;AACzC,MAAI,gBAAgB,QAAQ;AAC1B,UAAM,UAAU,MAAM,GAAG;AAAA,MACvB;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,gBAAuB,GAAG,WAAW,KAAK;AAAA,IACzD;AACA,gBAAY,QAAQ,OAA+B,CAAC,KAAK,WAAW;AAClE,YAAM,WAAW,QAAQ,KAAK,OAAO,OAAO,EAAE,IAAI;AAClD,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,UAAW,QAAgB;AACjC,YAAM,aAAa,OAAO,YAAY,YAAY,QAAQ,SAAS,IAAI,UAAU;AACjF,UAAI,QAAQ,IAAI;AAChB,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AACA,QAAM,eAA8C,CAAC;AACrD,QAAM,qBAAoD,CAAC;AAC3D,aAAW,KAAK,MAAM;AACpB,UAAM,MAAM,OAAO,EAAE,EAAE;AACvB,iBAAa,GAAG,IAAI,EAAE,WAAW,OAAO,EAAE,QAAQ,IAAI;AACtD,uBAAmB,GAAG,IAAI,EAAE,iBAAiB,OAAO,EAAE,cAAc,IAAI;AAAA,EAC1E;AACA,QAAM,WAAW,QAAQ,SACrB,MAAM,sBAAsB;AAAA,IAC1B;AAAA,IACA,UAAU,EAAE,KAAK;AAAA,IACjB,WAAW,QAAQ,IAAI,MAAM;AAAA,IAC7B,kBAAkB;AAAA,IAClB,wBAAwB;AAAA,IACxB,iBAAiB,oBAAoB,CAAC,iBAAiB,IAAI,KAAK,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,EAChG,CAAC,IACD,CAAC;AAEL,QAAM,QAAQ,KAAK,IAAI,CAAC,MAAW;AACjC,UAAM,MAAM,OAAO,EAAE,EAAE;AACvB,UAAM,QAAQ,EAAE,iBAAiB,OAAO,EAAE,cAAc,IAAI;AAC5D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO,OAAO,EAAE,KAAK;AAAA,MACrB,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,IAAI;AAAA,MAChC,gBAAgB;AAAA,MAChB,kBAAkB,QAAQ,OAAO,KAAK,KAAK,QAAQ;AAAA,MACnD,UAAU,EAAE,WAAW,OAAO,EAAE,QAAQ,IAAI;AAAA,MAC5C,YAAY,EAAE,WAAW,UAAU,OAAO,EAAE,QAAQ,CAAC,KAAK,OAAO,EAAE,QAAQ,IAAI;AAAA,MAC/E,OAAO,QAAQ,GAAG,KAAK,CAAC;AAAA,MACxB,SAAS,UAAU,GAAG,KAAK,CAAC;AAAA,MAC5B,GAAI,KAAK,EAAE,aAAa,CAAC,CAAC,EAAE,aAAa,IAAI,CAAC;AAAA,MAC9C,aAAa,EAAE,gBAAgB;AAAA,MAC/B,WAAW,EAAE,qBAAqB,OAAO,EAAE,UAAU,YAAY,IAAI;AAAA,MACrE,GAAI,SAAS,GAAG,KAAK,CAAC;AAAA,IACxB;AAAA,EACF,CAAC;AACD,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAC1D,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,UAAU,qBAAqB,KAAK,YAAY;AAAA,IAChD,OAAO,OAAO;AAAA,IACd,YAAY,KAAK,cAAc;AAAA,EACjC,CAAC;AACD,SAAO,aAAa,KAAK,EAAE,OAAO,OAAO,OAAO,YAAY,aAAa,CAAC;AAC5E;AAEO,MAAM,OAAO,OAAO,QAAiB;AAC1C,SAAO,KAAK,KAAK,GAAG;AACtB;AAEO,MAAM,MAAM,OAAO,QAAiB;AACzC,SAAO,KAAK,IAAI,GAAG;AACrB;AAEO,MAAM,SAAS,OAAO,QAAiB;AAC5C,QAAM,WAAW,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,IAAI,IAAI;AACvD,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,gCAAgC,KAAK,QAAQ;AACnD,YAAM,0BAA0B,KAAK,QAAQ;AAAA,IAC/C,SAAS,KAAK;AACZ,UAAI,eAAe,eAAe;AAChC,eAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,MAC3D;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO,KAAK,OAAO,GAAG;AACxB;AAEA,eAAe,0BACb,IACA,YACA,QACA,aACA,OAC0B;AAC1B,SAAO,kCAAkC;AAAA,IACvC,IAAI,GAAG,UAA+B;AAAA,IACtC;AAAA,IACA,OAAO;AAAA,IACP,QAAQ,QAAQ,CAAC,KAAK,IAAI;AAAA,IAC1B,OAAO,EAAE,UAAU,YAAY;AAAA,EACjC,CAAC;AACH;AAEA,eAAe,gCAAgC,KAAc,cAAsB;AACjF,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AACtE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,yCAAyC;AAAA,IAC7C;AAAA,IACA,aAAa,UAAU,QAAQ,aAAa;AAAA,IAC5C,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAe,0BAA0B,KAAc,cAAsB;AAC3E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AACtE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,oBAAoB,MAAM,mCAAmC;AAAA,IACjE;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,UAAU,KAAK,YAAY;AAAA,EAC7B,CAAC;AACD,QAAM,+BAA+B;AAAA,IACnC;AAAA,IACA,aAAa,UAAU,QAAQ,aAAa;AAAA,IAC5C,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,IAC9B;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,QAAiB,KAA6B;AAC3E,QAAM,aAAa,OAAQ,MAAqD;AAChF,MAAI,WAAY,QAAO;AACvB,QAAM,YAAY;AAClB,SAAO,OAAO,WAAW,KAAK,KAAK,OAAO,WAAW,IAAI;AAC3D;AAEA,SAAS,OAAO,QAAmE;AACjF,QAAM,QAAQ,QAAQ;AACtB,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,eAAe,qBAAqB,KAAc,OAAgB,SAAkC;AAClG,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG;AAC3B,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AACtE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,WAAW,MAAM,kCAAkC,IAAI,SAAS,KAAK,YAAY,IAAI;AAC3F,QAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,aAAa,UAAU,QAAQ,aAAa;AAAA,IAC5C,aAAa,KAAK;AAAA,IAClB;AAAA,IACA,gBAAgB,KAAK,SAAS;AAAA,IAC9B,YAAY;AAAA,EACd,CAAC;AACH;AAEA,eAAe,+BAA+B,KAAc,SAAoD;AAC9G,QAAM,iBAAiB,OAAO,QAAQ,mBAAmB,WAAW,QAAQ,iBAAiB;AAC7F,QAAM,eAAe,OAAO,QAAQ,OAAO,WAAW,QAAQ,KAAK;AACnE,MAAI,CAAC,kBAAkB,CAAC,aAAc,QAAO;AAE7C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AACtE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,cAAc,WAAW,KAAK;AAAA,IACpC,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,eAAe;AAAA,IACrB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,IACvB,EAAE,UAAU,MAAM,eAAe;AAAA,EACnC;AACA,MAAI,CAAC,aAAc,QAAO,yCAAyC,GAAG;AACtE,QAAM,sBAAsB,aAAa,QAAQ,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI;AACvF,MAAI,CAAC,oBAAqB,QAAO,yCAAyC,GAAG;AAC7E,QAAM,wBAAwB,WAAW,iBAAiB,OAAO,WAAW,cAAc,IAAI;AAC9F,QAAM,kBAAkB,WAAW,WAAW,OAAO,WAAW,QAAQ,IAAI;AAC5E,MAAI,0BAA0B,kBAAkB,oBAAoB,qBAAqB;AACvF,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MAAM,4BAA4B;AAAA,IAC9C;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,QAAQ;AAAA,EACtB,CAAC;AACD,QAAM,oBAAoB,MAAM,mCAAmC;AAAA,IACjE;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,oCAAoC;AAAA,IACxC;AAAA,IACA,aAAa,UAAU,QAAQ,aAAa;AAAA,IAC5C,aAAa,KAAK;AAAA,IAClB,mBAAmB,KAAK,iBAAiB;AAAA,IACzC,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,IAC9B,wBAAwB,kBAAkB;AAAA,IAC1C;AAAA,IACA,2BAA2B;AAAA,IAC3B;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAEA,eAAe,kCACb,IACA,SACA,kBACwB;AACxB,QAAM,iBAAiB,OAAO,QAAQ,mBAAmB,WAAW,QAAQ,iBAAiB;AAC7F,MAAI,gBAAgB;AAClB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,eAAe;AAAA,MACrB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB,EAAE,UAAU,MAAM,eAAe;AAAA,IACnC;AACA,WAAO,cAAc,QAAQ,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI;AAAA,EACrE;AAEA,QAAM,SAAS,OAAO,QAAQ,OAAO,WAAW,QAAQ,KAAK;AAC7D,MAAI,QAAQ;AACV,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,MAC9B,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,WAAO,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,EAClD;AAEA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB;AAAA,MAChF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAC5C;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,oBAAoB;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,wGAAyG,QAAQ,oBAAoB;AAAA,MACnK;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,MACvE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2GAA2G,QAAQ,oBAAoB;AAAA,QACnK,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,qGAAqG,QAAQ,oBAAoB;AAAA,QAC7J,EAAE,QAAQ,KAAK,aAAa,yEAAyE,QAAQ,oBAAoB;AAAA,MACnI;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;AAAA,MACrE,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,MACvE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4EAA4E,QAAQ,oBAAoB;AAAA,QACpI,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,oBAAoB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { User, Role, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { Organization, Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { E } from '#generated/entities.ids.generated'\nimport { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { userCrudEvents, userCrudIndexer } from '@open-mercato/core/modules/auth/commands/users'\nimport {\n  assertActorCanAccessUserTarget,\n  assertActorCanAssignUserDestination,\n  assertActorCanGrantRoleTokens,\n  assertActorCanModifySuperAdminUserTarget,\n  listSuperAdminUserIds,\n  resolveUserDestinationRoles,\n  throwUserDestinationOrganizationNotFound,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'\nimport { MAX_USER_LOOKUP_IDS, resolveUserIdFilter } from '@open-mercato/core/modules/auth/lib/userIdFilter'\nimport { findEntityIdsBySearchTokensCompat, type SearchTokenDatabase } from '@open-mercato/shared/lib/search/tokenLookup'\nimport { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'\nimport {\n  getSelectedTenantFromRequest,\n  resolveOrganizationScopeForRequest,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'users' })\n\nconst querySchema = z.object({\n  id: z.string().uuid().optional(),\n  ids: z.string().optional().describe('Comma-separated user identifiers, at most 100'),\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n  search: z.string().optional(),\n  name: z.string().optional(),\n  organizationId: z.string().uuid().optional(),\n  scopeToActiveOrganization: z.boolean().optional(),\n  roleIds: z.array(z.string().uuid()).optional(),\n}).passthrough()\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst passwordSchema = buildPasswordSchema()\n\nconst displayNameSchema = z.preprocess(\n  normalizeDisplayNameInput,\n  z.string().trim().min(1).max(120).nullable().optional(),\n)\n\nconst userCreateSchema = z.object({\n  email: z.string().email(),\n  name: displayNameSchema,\n  password: passwordSchema.optional(),\n  sendInviteEmail: z.boolean().optional(),\n  organizationId: z.string().uuid(),\n  roles: z.array(z.string()).optional(),\n}).refine(\n  (data) => data.password || data.sendInviteEmail,\n  { message: 'Either password or sendInviteEmail is required', path: ['password'] },\n)\n\nconst userUpdateSchema = z.object({\n  id: z.string().uuid(),\n  email: z.string().email().optional(),\n  name: displayNameSchema,\n  password: passwordSchema.optional(),\n  organizationId: z.string().uuid().optional(),\n  roles: z.array(z.string()).optional(),\n  isConfirmed: z.boolean().optional(),\n})\n\nconst userListItemSchema = z.object({\n  id: z.string().uuid(),\n  email: z.string().email(),\n  name: z.string().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  organizationName: z.string().nullable(),\n  tenantId: z.string().uuid().nullable(),\n  tenantName: z.string().nullable(),\n  roles: z.array(z.string()),\n  roleIds: z.array(z.string().uuid()).optional(),\n  hasPassword: z.boolean().optional(),\n  isConfirmed: z.boolean(),\n  updatedAt: z.string().nullable().optional(),\n})\n\nconst userListResponseSchema = z.object({\n  items: z.array(userListItemSchema),\n  total: z.number().int().nonnegative(),\n  totalPages: z.number().int().positive(),\n  isSuperAdmin: z.boolean().optional(),\n})\n\nconst okResponseSchema = z.object({ ok: z.literal(true) })\n\nconst errorResponseSchema = z.object({ error: z.string() })\n\ntype CrudInput = Record<string, unknown>\ntype UserListFilter = Record<string, unknown>\n\n// UserRole carries no tenant/organization columns of its own, so the caller's scope has to be\n// expressed as a predicate on the `user` relation \u2014 MikroORM compiles that into a database-side\n// join against `users` with the scope predicates in the WHERE clause, keeping the link lookup\n// bounded to the scope instead of every tenant holding the role.\nfunction buildRoleLinkFilter(\n  roleIdList: string[],\n  userScope: UserListFilter[],\n  candidateUserIds: Set<string> | null,\n): UserListFilter {\n  const scope = candidateUserIds\n    ? [...userScope, { id: { $in: Array.from(candidateUserIds) } }]\n    : userScope\n  return {\n    role: { $in: roleIdList },\n    deletedAt: null,\n    user: scope.length > 1 ? { $and: scope } : scope[0],\n  }\n}\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.users.list'] },\n  POST: { requireAuth: true, requireFeatures: ['auth.users.create'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.users.edit'] },\n  DELETE: { requireAuth: true, requireFeatures: ['auth.users.delete'] },\n}\n\nexport const metadata = routeMetadata\n\nconst crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({\n  metadata: routeMetadata,\n  orm: {\n    entity: User,\n    idField: 'id',\n    orgField: null,\n    tenantField: null,\n    softDeleteField: 'deletedAt',\n  },\n  events: userCrudEvents,\n  indexer: userCrudIndexer,\n  actions: {\n    create: {\n      commandId: 'auth.users.create',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        if (ctx.request) {\n          await assertCanAssignRoles(ctx.request, parsed.roles, parsed)\n        }\n        return parsed\n      },\n      response: ({ result }) => ({\n        id: String(result.user.id),\n        ...(result.warning ? { _warning: result.warning } : {}),\n      }),\n      status: 201,\n    },\n    update: {\n      commandId: 'auth.users.update',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        if (ctx.request) {\n          if (typeof parsed.id === 'string' && parsed.id.length) {\n            await assertCanModifySuperAdminTarget(ctx.request, parsed.id)\n            await assertCanAccessUserTarget(ctx.request, parsed.id)\n          }\n          if (typeof parsed.organizationId === 'string' && parsed.organizationId.length) {\n            const destinationChanged = await assertCanAssignUserDestination(ctx.request, parsed)\n            if (!destinationChanged) {\n              await assertCanAssignRoles(ctx.request, parsed.roles, parsed)\n            }\n          } else {\n            await assertCanAssignRoles(ctx.request, parsed.roles, parsed)\n          }\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'auth.users.delete',\n      mapInput: async ({ parsed, raw, ctx }) => {\n        const targetId = resolveDeleteTargetId(parsed, raw)\n        if (ctx.request && targetId) {\n          await assertCanModifySuperAdminTarget(ctx.request, targetId)\n          await assertCanAccessUserTarget(ctx.request, targetId)\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ items: [], total: 0, totalPages: 1 })\n  const url = new URL(req.url)\n  const rawRoleIds = url.searchParams.getAll('roleId').filter((id): id is string => typeof id === 'string' && id.trim().length > 0)\n  // Accept both the repeated (`?ids=a&ids=b`) and comma-joined (`?ids=a,b`) spellings.\n  const rawIds = url.searchParams.getAll('ids').join(',') || undefined\n  const userIdFilter = resolveUserIdFilter(rawIds, url.searchParams.get('id'))\n  const parsed = querySchema.safeParse({\n    id: url.searchParams.get('id') || undefined,\n    ids: rawIds,\n    page: url.searchParams.get('page') || undefined,\n    // A caller resolving a batch of ids wants all of them; without this the default page of 50\n    // would silently truncate a 100-id lookup.\n    pageSize: url.searchParams.get('pageSize')\n      || (rawIds && userIdFilter.kind === 'ids' ? String(Math.min(userIdFilter.ids.length, MAX_USER_LOOKUP_IDS)) : undefined),\n    search: url.searchParams.get('search') || undefined,\n    name: url.searchParams.get('name') || undefined,\n    organizationId: url.searchParams.get('organizationId') || undefined,\n    scopeToActiveOrganization: parseBooleanFlag(url.searchParams.get('scopeToActiveOrganization') || undefined),\n    roleIds: rawRoleIds.length ? rawRoleIds : undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ items: [], total: 0, totalPages: 1 })\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager)\n  let isSuperAdmin = auth.isSuperAdmin === true\n  try {\n    if (auth.sub) {\n      const rbacService = container.resolve('rbacService') as any\n      const acl = await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n      isSuperAdmin = isSuperAdmin || !!acl?.isSuperAdmin\n    }\n  } catch (err) {\n    logger.error('Failed to resolve rbac', { err })\n  }\n  const { id, page, pageSize, search, name, organizationId, scopeToActiveOrganization, roleIds } = parsed.data\n  if (userIdFilter.kind === 'none') {\n    return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n  }\n  const filters: any[] = [{ deletedAt: null }]\n  const actorTenantId = auth.tenantId ? String(auth.tenantId) : null\n  let effectiveTenantId: string | null = null\n  let effectiveOrganizationIds: string[] | null = null\n  let effectiveSelectedOrganizationId: string | null = null\n  let usesSelectedTenantScope = false\n  if (!isSuperAdmin) {\n    if (!actorTenantId) {\n      return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n    }\n    effectiveTenantId = actorTenantId\n    const superAdminUserIds = await listSuperAdminUserIds(em, actorTenantId)\n    if (superAdminUserIds.size) {\n      filters.push({ id: { $nin: Array.from(superAdminUserIds) as any } })\n    }\n    // Browsing follows the topbar organization selection; explicit `?id=`/`?ids=` lookups stay\n    // tenant-wide so callers resolving a known user (author labels, assignee names) keep working.\n    if (userIdFilter.kind !== 'ids') {\n      const scope = await resolveOrganizationScopeForRequest({\n        container,\n        auth,\n        request: req,\n        tenantId: actorTenantId,\n      })\n      effectiveSelectedOrganizationId = scope.selectedId\n      if (Array.isArray(scope.filterIds)) {\n        if (scope.filterIds.length === 0) {\n          return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n        }\n        effectiveOrganizationIds = scope.filterIds\n      }\n    }\n  } else {\n    const selectedTenantId = getSelectedTenantFromRequest(req)\n    if (typeof selectedTenantId === 'string' && selectedTenantId.trim().length > 0) {\n      const scope = await resolveOrganizationScopeForRequest({\n        container,\n        auth,\n        request: req,\n        tenantId: selectedTenantId.trim(),\n      })\n      if (!scope.tenantId) {\n        return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n      }\n      effectiveTenantId = scope.tenantId\n      effectiveSelectedOrganizationId = scope.selectedId\n      usesSelectedTenantScope = true\n      if (Array.isArray(scope.filterIds)) {\n        if (scope.filterIds.length === 0) {\n          return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n        }\n        effectiveOrganizationIds = scope.filterIds\n      }\n    }\n  }\n  if (effectiveTenantId) {\n    filters.push({ tenantId: effectiveTenantId })\n  }\n  if (effectiveOrganizationIds) {\n    filters.push({ organizationId: { $in: effectiveOrganizationIds as any } })\n  }\n  const scopeOrganizationId = usesSelectedTenantScope\n    ? effectiveSelectedOrganizationId\n    : auth.orgId ?? null\n  if (organizationId) filters.push({ organizationId })\n  // Recipient/assignee pickers scope to the caller's active organization so they never\n  // suggest users outside it. A message composed here is stamped with the caller's\n  // active org (auth.orgId), and the message detail endpoint enforces\n  // hasOrganizationAccess(scope.organizationId, message.organizationId); scoping the\n  // suggestions to the same org keeps a picked recipient able to open what they were sent.\n  if (scopeToActiveOrganization) filters.push({ organizationId: auth.orgId ?? null })\n  const trimmedName = typeof name === 'string' ? name.trim() : ''\n  if (trimmedName) {\n    const searchPattern = `%${escapeLikePattern(trimmedName)}%`\n    const displayNameFilters: UserListFilter[] = [{ name: { $ilike: searchPattern } }]\n    const nameTokenScope: string | null | undefined = isSuperAdmin ? (effectiveTenantId ?? undefined) : auth.tenantId ?? null\n    const matchedDisplayNameIds = await findUserIdsBySearchTokens(em, E.auth.user, trimmedName, nameTokenScope, 'name')\n    if (matchedDisplayNameIds && matchedDisplayNameIds.length) {\n      displayNameFilters.push({ id: { $in: matchedDisplayNameIds } })\n    }\n    filters.push(displayNameFilters.length > 1 ? { $or: displayNameFilters } : displayNameFilters[0])\n  }\n  // `?id=` and `?ids=` are already intersected by resolveUserIdFilter.\n  let idFilter: Set<string> | null = userIdFilter.kind === 'ids' ? new Set(userIdFilter.ids) : null\n  if (Array.isArray(roleIds) && roleIds.length > 0) {\n    const uniqueRoleIds = Array.from(new Set(roleIds))\n    const linksForRoles = await em.find(\n      UserRole,\n      buildRoleLinkFilter(uniqueRoleIds, filters, idFilter) as any,\n    )\n    const roleUserIds = new Set<string>()\n    for (const link of linksForRoles) {\n      const uid = String((link as any).user?.id || (link as any).user || '')\n      if (uid) roleUserIds.add(uid)\n    }\n    if (roleUserIds.size === 0) return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n    if (idFilter) {\n      // buildRoleLinkFilter already constrains the lookup to `user.id IN idFilter`, so this\n      // intersection is enforced database-side; the loop stays as an application-level backstop\n      // so the `?id=` + `?roleId=` contract does not depend on that predicate alone.\n      for (const uid of Array.from(idFilter)) {\n        if (!roleUserIds.has(uid)) idFilter.delete(uid)\n      }\n    } else {\n      idFilter = roleUserIds\n    }\n    if (!idFilter || idFilter.size === 0) return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n  }\n  const trimmedSearch = typeof search === 'string' ? search.trim() : ''\n  if (trimmedSearch) {\n    // Email is encrypted at rest, so plaintext search must go through search_tokens.\n    const tenantScope: string | null | undefined = isSuperAdmin ? (effectiveTenantId ?? undefined) : auth.tenantId ?? null\n    const searchFilters: any[] = []\n\n    const matchedIds = await findUserIdsBySearchTokens(em, E.auth.user, trimmedSearch, tenantScope)\n    if (matchedIds && matchedIds.length) {\n      searchFilters.push({ id: { $in: matchedIds as any } })\n    }\n\n    const searchPattern = `%${escapeLikePattern(trimmedSearch)}%`\n    const organizationSearchFilters: any[] = [\n      { deletedAt: null },\n      { name: { $ilike: searchPattern } },\n    ]\n    if (tenantScope) {\n      organizationSearchFilters.push({ tenant: tenantScope })\n    }\n    const matchingOrganizations = await em.find(\n      Organization,\n      organizationSearchFilters.length > 1 ? { $and: organizationSearchFilters } : organizationSearchFilters[0],\n    )\n    const matchingOrganizationIds = matchingOrganizations\n      .map((org) => (org?.id ? String(org.id) : null))\n      .filter((orgId): orgId is string => typeof orgId === 'string' && orgId.length > 0)\n    if (matchingOrganizationIds.length) {\n      searchFilters.push({ organizationId: { $in: matchingOrganizationIds as any } })\n    }\n\n    const roleSearchFilters: any[] = [\n      { deletedAt: null },\n      { name: { $ilike: searchPattern } },\n    ]\n    if (tenantScope) {\n      roleSearchFilters.push({ $or: [{ tenantId: tenantScope }, { tenantId: null }] })\n    }\n    const matchingRoles = await em.find(\n      Role,\n      roleSearchFilters.length > 1 ? { $and: roleSearchFilters } : roleSearchFilters[0],\n    )\n    const matchingRoleIds = matchingRoles\n      .map((role) => (role?.id ? String(role.id) : null))\n      .filter((roleId): roleId is string => typeof roleId === 'string' && roleId.length > 0)\n    if (matchingRoleIds.length) {\n      const roleSearchLinks = await em.find(\n        UserRole,\n        buildRoleLinkFilter(matchingRoleIds, filters, idFilter) as any,\n      )\n      const matchingRoleUserIds = Array.from(new Set(\n        roleSearchLinks\n          .map((link) => {\n            const userRef = (link as any).user\n            const userId = userRef?.id ?? userRef\n            return userId ? String(userId) : null\n          })\n          .filter((userId): userId is string => typeof userId === 'string' && userId.length > 0),\n      ))\n      if (matchingRoleUserIds.length) {\n        searchFilters.push({ id: { $in: matchingRoleUserIds as any } })\n      }\n    }\n\n    if (!searchFilters.length) {\n      return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })\n    }\n\n    filters.push(searchFilters.length > 1 ? { $or: searchFilters } : searchFilters[0])\n  }\n  // `?id=` has no separate path: resolveUserIdFilter folds it into `idFilter`, and a `kind: 'none'`\n  // outcome already returned above, so `idFilter` is null only when neither param was supplied.\n  if (idFilter && idFilter.size) {\n    filters.push({ id: { $in: Array.from(idFilter) as any } })\n  }\n  const where = filters.length > 1 ? { $and: filters } : filters[0]\n  const [rows, count] = await em.findAndCount(User, where, { limit: pageSize, offset: (page - 1) * pageSize })\n  const userIds = rows.map((u: any) => u.id)\n  const links = userIds.length\n    ? await findWithDecryption(\n        em,\n        UserRole,\n        { user: { $in: userIds as any }, deletedAt: null } as any,\n        { populate: ['role'] },\n        {\n          tenantId: effectiveTenantId,\n          organizationId: scopeOrganizationId,\n        },\n      )\n    : []\n  const roleMap: Record<string, string[]> = {}\n  const roleIdMap: Record<string, string[]> = {}\n  for (const l of links) {\n    const uid = String((l as any).user?.id || (l as any).user)\n    const rname = String((l as any).role?.name || '')\n    const rid = String((l as any).role?.id ?? '')\n    if (!roleMap[uid]) roleMap[uid] = []\n    if (!roleIdMap[uid]) roleIdMap[uid] = []\n    if (rname) roleMap[uid].push(rname)\n    if (rid) roleIdMap[uid].push(rid)\n  }\n  const orgIds = rows\n    .map((u: any) => (u.organizationId ? String(u.organizationId) : null))\n    .filter((id): id is string => !!id)\n  const uniqueOrgIds = Array.from(new Set(orgIds))\n  let orgMap: Record<string, string> = {}\n  if (uniqueOrgIds.length) {\n    const organizations = await em.find(\n      Organization,\n      { id: { $in: uniqueOrgIds as any }, deletedAt: null },\n    )\n    orgMap = organizations.reduce<Record<string, string>>((acc, org) => {\n      const orgId = org?.id ? String(org.id) : null\n      if (!orgId) return acc\n      const rawName = (org as any)?.name\n      const orgName = typeof rawName === 'string' && rawName.length > 0 ? rawName : orgId\n      acc[orgId] = orgName\n      return acc\n    }, {})\n  }\n  const tenantIds = rows\n    .map((u: any) => (u.tenantId ? String(u.tenantId) : null))\n    .filter((id): id is string => !!id)\n  const uniqueTenantIds = Array.from(new Set(tenantIds))\n  let tenantMap: Record<string, string> = {}\n  if (uniqueTenantIds.length) {\n    const tenants = await em.find(\n      Tenant,\n      { id: { $in: uniqueTenantIds as any }, deletedAt: null },\n    )\n    tenantMap = tenants.reduce<Record<string, string>>((acc, tenant) => {\n      const tenantId = tenant?.id ? String(tenant.id) : null\n      if (!tenantId) return acc\n      const rawName = (tenant as any)?.name\n      const tenantName = typeof rawName === 'string' && rawName.length > 0 ? rawName : tenantId\n      acc[tenantId] = tenantName\n      return acc\n    }, {})\n  }\n  const tenantByUser: Record<string, string | null> = {}\n  const organizationByUser: Record<string, string | null> = {}\n  for (const u of rows) {\n    const uid = String(u.id)\n    tenantByUser[uid] = u.tenantId ? String(u.tenantId) : null\n    organizationByUser[uid] = u.organizationId ? String(u.organizationId) : null\n  }\n  const cfByUser = userIds.length\n    ? await loadCustomFieldValues({\n        em,\n        entityId: E.auth.user,\n        recordIds: userIds.map(String),\n        tenantIdByRecord: tenantByUser,\n        organizationIdByRecord: organizationByUser,\n        tenantFallbacks: effectiveTenantId ? [effectiveTenantId] : auth.tenantId ? [auth.tenantId] : [],\n      })\n    : {}\n\n  const items = rows.map((u: any) => {\n    const uid = String(u.id)\n    const orgId = u.organizationId ? String(u.organizationId) : null\n    return {\n      id: uid,\n      email: String(u.email),\n      name: u.name ? String(u.name) : null,\n      organizationId: orgId,\n      organizationName: orgId ? orgMap[orgId] ?? orgId : null,\n      tenantId: u.tenantId ? String(u.tenantId) : null,\n      tenantName: u.tenantId ? tenantMap[String(u.tenantId)] ?? String(u.tenantId) : null,\n      roles: roleMap[uid] || [],\n      roleIds: roleIdMap[uid] || [],\n      ...(id ? { hasPassword: !!u.passwordHash } : {}),\n      isConfirmed: u.isConfirmed !== false,\n      updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : null,\n      ...(cfByUser[uid] || {}),\n    }\n  })\n  const totalPages = Math.max(1, Math.ceil(count / pageSize))\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items,\n    idField: 'id',\n    resourceKind: 'auth.user',\n    organizationId: effectiveSelectedOrganizationId,\n    tenantId: effectiveTenantId ?? auth.tenantId ?? null,\n    query: parsed.data,\n    accessType: id ? 'read:item' : undefined,\n  })\n  return NextResponse.json({ items, total: count, totalPages, isSuperAdmin })\n}\n\nexport const POST = async (req: Request) => {\n  return crud.POST(req)\n}\n\nexport const PUT = async (req: Request) => {\n  return crud.PUT(req)\n}\n\nexport const DELETE = async (req: Request) => {\n  const targetId = new URL(req.url).searchParams.get('id')\n  if (targetId) {\n    try {\n      await assertCanModifySuperAdminTarget(req, targetId)\n      await assertCanAccessUserTarget(req, targetId)\n    } catch (err) {\n      if (err instanceof CrudHttpError) {\n        return NextResponse.json(err.body, { status: err.status })\n      }\n      throw err\n    }\n  }\n  return crud.DELETE(req)\n}\n\nasync function findUserIdsBySearchTokens(\n  em: EntityManager,\n  entityType: string,\n  search: string,\n  tenantScope: string | null | undefined,\n  field?: string,\n): Promise<string[] | null> {\n  return findEntityIdsBySearchTokensCompat({\n    db: em.getKysely<SearchTokenDatabase>(),\n    entityType,\n    query: search,\n    fields: field ? [field] : undefined,\n    scope: { tenantId: tenantScope },\n  })\n}\n\nasync function assertCanModifySuperAdminTarget(req: Request, targetUserId: string) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  await assertActorCanModifySuperAdminUserTarget({\n    em,\n    rbacService: container.resolve('rbacService') as RbacService,\n    actorUserId: auth.sub,\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n    targetUserId,\n  })\n}\n\nasync function assertCanAccessUserTarget(req: Request, targetUserId: string) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const organizationScope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request: req,\n    tenantId: auth.tenantId ?? null,\n  })\n  await assertActorCanAccessUserTarget({\n    em,\n    rbacService: container.resolve('rbacService') as RbacService,\n    actorUserId: auth.sub,\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n    targetUserId,\n    organizationScope,\n  })\n}\n\nfunction resolveDeleteTargetId(parsed: unknown, raw: unknown): string | null {\n  const fromParsed = readId((parsed as Record<string, unknown> | null | undefined))\n  if (fromParsed) return fromParsed\n  const rawRecord = raw as { body?: Record<string, unknown>; query?: Record<string, unknown> } | null | undefined\n  return readId(rawRecord?.query) ?? readId(rawRecord?.body)\n}\n\nfunction readId(record: Record<string, unknown> | null | undefined): string | null {\n  const value = record?.id\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nasync function assertCanAssignRoles(req: Request, roles: unknown, payload: Record<string, unknown>) {\n  if (!Array.isArray(roles)) return\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const tenantId = await resolveTargetTenantIdForRoleGrant(em, payload, auth.tenantId ?? null)\n  await assertActorCanGrantRoleTokens({\n    em,\n    rbacService: container.resolve('rbacService') as RbacService,\n    actorUserId: auth.sub,\n    tenantId,\n    organizationId: auth.orgId ?? null,\n    roleTokens: roles,\n  })\n}\n\nasync function assertCanAssignUserDestination(req: Request, payload: Record<string, unknown>): Promise<boolean> {\n  const organizationId = typeof payload.organizationId === 'string' ? payload.organizationId : null\n  const targetUserId = typeof payload.id === 'string' ? payload.id : null\n  if (!organizationId || !targetUserId) return false\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const targetUser = await findOneWithDecryption(\n    em,\n    User,\n    { id: targetUserId, deletedAt: null },\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  if (!targetUser) return false\n  const organization = await findOneWithDecryption(\n    em,\n    Organization,\n    { id: organizationId },\n    { populate: ['tenant'] },\n    { tenantId: null, organizationId },\n  )\n  if (!organization) return throwUserDestinationOrganizationNotFound(400)\n  const destinationTenantId = organization.tenant?.id ? String(organization.tenant.id) : null\n  if (!destinationTenantId) return throwUserDestinationOrganizationNotFound(400)\n  const currentOrganizationId = targetUser.organizationId ? String(targetUser.organizationId) : null\n  const currentTenantId = targetUser.tenantId ? String(targetUser.tenantId) : null\n  if (currentOrganizationId === organizationId && currentTenantId === destinationTenantId) {\n    return false\n  }\n  const roles = await resolveUserDestinationRoles({\n    em,\n    targetUserId,\n    destinationTenantId,\n    roleTokens: payload.roles,\n  })\n  const organizationScope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request: req,\n    tenantId: destinationTenantId,\n  })\n  await assertActorCanAssignUserDestination({\n    em,\n    rbacService: container.resolve('rbacService') as RbacService,\n    actorUserId: auth.sub,\n    actorIsSuperAdmin: auth.isSuperAdmin === true,\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n    allowedOrganizationIds: organizationScope.allowedIds,\n    destinationTenantId,\n    destinationOrganizationId: organizationId,\n    roles,\n  })\n  return true\n}\n\nasync function resolveTargetTenantIdForRoleGrant(\n  em: EntityManager,\n  payload: Record<string, unknown>,\n  fallbackTenantId: string | null,\n): Promise<string | null> {\n  const organizationId = typeof payload.organizationId === 'string' ? payload.organizationId : null\n  if (organizationId) {\n    const organization = await findOneWithDecryption(\n      em,\n      Organization,\n      { id: organizationId },\n      { populate: ['tenant'] },\n      { tenantId: null, organizationId },\n    )\n    return organization?.tenant?.id ? String(organization.tenant.id) : fallbackTenantId\n  }\n\n  const userId = typeof payload.id === 'string' ? payload.id : null\n  if (userId) {\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: userId, deletedAt: null },\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    return user?.tenantId ? String(user.tenantId) : fallbackTenantId\n  }\n\n  return fallbackTenantId\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'User management',\n  methods: {\n    GET: {\n      summary: 'List users',\n      description:\n        'Non-superadmins with auth.users.list browse users in the selected organization and its descendants, bounded by their tenant and organization visibility, excluding superadmin accounts. Selecting all organizations remains bounded by organization visibility. Explicit id/ids lookups retain tenant-wide staff-reference visibility, excluding superadmin accounts. Directory visibility does not grant access to organization-owned records. Super administrators may scope the response via the topbar tenant and organization selection; without a selected tenant, their list can span tenants. Search matches email, organization name, and role name. Pass organizationId for an exact organization filter, or scopeToActiveOrganization=1 to restrict results to the caller\\'s exact active organization (used by recipient/assignee pickers); when the caller has no active organization, this selects only users with no organization. Both filters apply when supplied together. These optional list filters further narrow the effective scope. Pass ids=<uuid>,<uuid> (max 100) to resolve a known set of users in one request, for example to label a list of foreign keys; it intersects with id and roleId, and a supplied ids value that contains no valid identifier matches nothing.',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'User collection', schema: userListResponseSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create user',\n      description: 'Creates a new confirmed user within the specified organization, optional display name, and optional roles. The organization must be within the caller\\'s descendant-expanded organization scope, whether or not roles are sent, and the roles must belong to its tenant and be grantable by the caller.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: userCreateSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'User created',\n          schema: z.object({ id: z.string().uuid() }),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or duplicate email', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Attempted to assign privileged roles, or the organization is outside the caller\\'s organization scope', schema: errorResponseSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update user',\n      description:\n        'Updates profile fields including display name, organization assignment, credentials, or role memberships. A destination organization must be within the caller\\'s descendant-expanded organization scope. Retained and newly assigned roles must belong to the destination tenant and be grantable by the caller. Setting isConfirmed=false deactivates the account: the user can no longer sign in and every active session is revoked; isConfirmed=true reactivates it. A tenant cannot drop below a protected role\\'s minimum active holder count, so revoking the role from, deactivating, moving, or deleting the last active administrator is rejected.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: userUpdateSchema,\n      },\n      responses: [\n        { status: 200, description: 'User updated', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload, duplicate email, or the update would remove the last active holder of a protected role', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Destination organization is outside caller scope, or a retained or assigned role is not grantable', schema: errorResponseSchema },\n        { status: 404, description: 'User or destination organization not found in the caller tenant scope', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete user',\n      description: 'Deletes a user by identifier. Rejected when the target is the last active holder of a protected role in the tenant. Undo support is provided via the command bus.',\n      query: z.object({ id: z.string().uuid().describe('User identifier') }),\n      responses: [\n        { status: 200, description: 'User deleted', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'User cannot be deleted, or is the last active holder of a protected role', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 404, description: 'User not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,eAAe,qBAAqB;AAC7C,SAAS,qBAAqB;AAC9B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,MAAM,MAAM,gBAAgB;AAErC,SAAS,cAAc,cAAc;AACrC,SAAS,SAAS;AAClB,SAAS,6BAA6B;AAEtC,SAAS,gBAAgB,uBAAuB;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAClC,SAAS,wBAAwB;AACjC,SAAS,qBAAqB,2BAA2B;AACzD,SAAS,yCAAmE;AAC5E,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEhE,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,+CAA+C;AAAA,EACnF,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,2BAA2B,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAC/C,CAAC,EAAE,YAAY;AAEf,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,oBAAoB,EAAE;AAAA,EAC1B;AAAA,EACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AACxD;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM;AAAA,EACN,UAAU,eAAe,SAAS;AAAA,EAClC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AACtC,CAAC,EAAE;AAAA,EACD,CAAC,SAAS,KAAK,YAAY,KAAK;AAAA,EAChC,EAAE,SAAS,kDAAkD,MAAM,CAAC,UAAU,EAAE;AAClF;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,UAAU,eAAe,SAAS;AAAA,EAClC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,QAAQ,EAAE,SAAS;AACpC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACzB,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7C,aAAa,EAAE,QAAQ,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,QAAQ;AAAA,EACvB,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC5C,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,MAAM,kBAAkB;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,cAAc,EAAE,QAAQ,EAAE,SAAS;AACrC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEzD,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAS1D,SAAS,oBACP,YACA,WACA,kBACgB;AAChB,QAAM,QAAQ,mBACV,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,gBAAgB,EAAE,EAAE,CAAC,IAC5D;AACJ,SAAO;AAAA,IACL,MAAM,EAAE,KAAK,WAAW;AAAA,IACxB,WAAW;AAAA,IACX,MAAM,MAAM,SAAS,IAAI,EAAE,MAAM,MAAM,IAAI,MAAM,CAAC;AAAA,EACpD;AACF;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EAClE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACtE;AAEO,MAAM,WAAW;AAExB,MAAM,OAAO,cAA6D;AAAA,EACxE,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,YAAI,IAAI,SAAS;AACf,gBAAM,qBAAqB,IAAI,SAAS,OAAO,OAAO,MAAM;AAAA,QAC9D;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO;AAAA,QACzB,IAAI,OAAO,OAAO,KAAK,EAAE;AAAA,QACzB,GAAI,OAAO,UAAU,EAAE,UAAU,OAAO,QAAQ,IAAI,CAAC;AAAA,MACvD;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,YAAI,IAAI,SAAS;AACf,cAAI,OAAO,OAAO,OAAO,YAAY,OAAO,GAAG,QAAQ;AACrD,kBAAM,gCAAgC,IAAI,SAAS,OAAO,EAAE;AAC5D,kBAAM,0BAA0B,IAAI,SAAS,OAAO,EAAE;AAAA,UACxD;AACA,cAAI,OAAO,OAAO,mBAAmB,YAAY,OAAO,eAAe,QAAQ;AAC7E,kBAAM,qBAAqB,MAAM,+BAA+B,IAAI,SAAS,MAAM;AACnF,gBAAI,CAAC,oBAAoB;AACvB,oBAAM,qBAAqB,IAAI,SAAS,OAAO,OAAO,MAAM;AAAA,YAC9D;AAAA,UACF,OAAO;AACL,kBAAM,qBAAqB,IAAI,SAAS,OAAO,OAAO,MAAM;AAAA,UAC9D;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,UAAU,OAAO,EAAE,QAAQ,KAAK,IAAI,MAAM;AACxC,cAAM,WAAW,sBAAsB,QAAQ,GAAG;AAClD,YAAI,IAAI,WAAW,UAAU;AAC3B,gBAAM,gCAAgC,IAAI,SAAS,QAAQ;AAC3D,gBAAM,0BAA0B,IAAI,SAAS,QAAQ;AAAA,QACvD;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE,CAAC;AAC1E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,OAAO,QAAQ,EAAE,OAAO,CAACA,QAAqB,OAAOA,QAAO,YAAYA,IAAG,KAAK,EAAE,SAAS,CAAC;AAEhI,QAAM,SAAS,IAAI,aAAa,OAAO,KAAK,EAAE,KAAK,GAAG,KAAK;AAC3D,QAAM,eAAe,oBAAoB,QAAQ,IAAI,aAAa,IAAI,IAAI,CAAC;AAC3E,QAAM,SAAS,YAAY,UAAU;AAAA,IACnC,IAAI,IAAI,aAAa,IAAI,IAAI,KAAK;AAAA,IAClC,KAAK;AAAA,IACL,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA;AAAA;AAAA,IAGtC,UAAU,IAAI,aAAa,IAAI,UAAU,MACnC,UAAU,aAAa,SAAS,QAAQ,OAAO,KAAK,IAAI,aAAa,IAAI,QAAQ,mBAAmB,CAAC,IAAI;AAAA,IAC/G,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,gBAAgB,IAAI,aAAa,IAAI,gBAAgB,KAAK;AAAA,IAC1D,2BAA2B,iBAAiB,IAAI,aAAa,IAAI,2BAA2B,KAAK,MAAS;AAAA,IAC1G,SAAS,WAAW,SAAS,aAAa;AAAA,EAC5C,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE,CAAC;AACpF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,MAAI,eAAe,KAAK,iBAAiB;AACzC,MAAI;AACF,QAAI,KAAK,KAAK;AACZ,YAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,YAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AACvH,qBAAe,gBAAgB,CAAC,CAAC,KAAK;AAAA,IACxC;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,0BAA0B,EAAE,IAAI,CAAC;AAAA,EAChD;AACA,QAAM,EAAE,IAAI,MAAM,UAAU,QAAQ,MAAM,gBAAgB,2BAA2B,QAAQ,IAAI,OAAO;AACxG,MAAI,aAAa,SAAS,QAAQ;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,EAC/E;AACA,QAAM,UAAiB,CAAC,EAAE,WAAW,KAAK,CAAC;AAC3C,QAAM,gBAAgB,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9D,MAAI,oBAAmC;AACvC,MAAI,2BAA4C;AAChD,MAAI,kCAAiD;AACrD,MAAI,0BAA0B;AAC9B,MAAI,CAAC,cAAc;AACjB,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,IAC/E;AACA,wBAAoB;AACpB,UAAM,oBAAoB,MAAM,sBAAsB,IAAI,aAAa;AACvE,QAAI,kBAAkB,MAAM;AAC1B,cAAQ,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,KAAK,iBAAiB,EAAS,EAAE,CAAC;AAAA,IACrE;AAGA,QAAI,aAAa,SAAS,OAAO;AAC/B,YAAM,QAAQ,MAAM,mCAAmC;AAAA,QACrD;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,UAAU;AAAA,MACZ,CAAC;AACD,wCAAkC,MAAM;AACxC,UAAI,MAAM,QAAQ,MAAM,SAAS,GAAG;AAClC,YAAI,MAAM,UAAU,WAAW,GAAG;AAChC,iBAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,QAC/E;AACA,mCAA2B,MAAM;AAAA,MACnC;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,mBAAmB,6BAA6B,GAAG;AACzD,QAAI,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,EAAE,SAAS,GAAG;AAC9E,YAAM,QAAQ,MAAM,mCAAmC;AAAA,QACrD;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,UAAU,iBAAiB,KAAK;AAAA,MAClC,CAAC;AACD,UAAI,CAAC,MAAM,UAAU;AACnB,eAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,MAC/E;AACA,0BAAoB,MAAM;AAC1B,wCAAkC,MAAM;AACxC,gCAA0B;AAC1B,UAAI,MAAM,QAAQ,MAAM,SAAS,GAAG;AAClC,YAAI,MAAM,UAAU,WAAW,GAAG;AAChC,iBAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,QAC/E;AACA,mCAA2B,MAAM;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACA,MAAI,mBAAmB;AACrB,YAAQ,KAAK,EAAE,UAAU,kBAAkB,CAAC;AAAA,EAC9C;AACA,MAAI,0BAA0B;AAC5B,YAAQ,KAAK,EAAE,gBAAgB,EAAE,KAAK,yBAAgC,EAAE,CAAC;AAAA,EAC3E;AACA,QAAM,sBAAsB,0BACxB,kCACA,KAAK,SAAS;AAClB,MAAI,eAAgB,SAAQ,KAAK,EAAE,eAAe,CAAC;AAMnD,MAAI,0BAA2B,SAAQ,KAAK,EAAE,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAClF,QAAM,cAAc,OAAO,SAAS,WAAW,KAAK,KAAK,IAAI;AAC7D,MAAI,aAAa;AACf,UAAM,gBAAgB,IAAI,kBAAkB,WAAW,CAAC;AACxD,UAAM,qBAAuC,CAAC,EAAE,MAAM,EAAE,QAAQ,cAAc,EAAE,CAAC;AACjF,UAAM,iBAA4C,eAAgB,qBAAqB,SAAa,KAAK,YAAY;AACrH,UAAM,wBAAwB,MAAM,0BAA0B,IAAI,EAAE,KAAK,MAAM,aAAa,gBAAgB,MAAM;AAClH,QAAI,yBAAyB,sBAAsB,QAAQ;AACzD,yBAAmB,KAAK,EAAE,IAAI,EAAE,KAAK,sBAAsB,EAAE,CAAC;AAAA,IAChE;AACA,YAAQ,KAAK,mBAAmB,SAAS,IAAI,EAAE,KAAK,mBAAmB,IAAI,mBAAmB,CAAC,CAAC;AAAA,EAClG;AAEA,MAAI,WAA+B,aAAa,SAAS,QAAQ,IAAI,IAAI,aAAa,GAAG,IAAI;AAC7F,MAAI,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,GAAG;AAChD,UAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC;AACjD,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA,oBAAoB,eAAe,SAAS,QAAQ;AAAA,IACtD;AACA,UAAM,cAAc,oBAAI,IAAY;AACpC,eAAW,QAAQ,eAAe;AAChC,YAAM,MAAM,OAAQ,KAAa,MAAM,MAAO,KAAa,QAAQ,EAAE;AACrE,UAAI,IAAK,aAAY,IAAI,GAAG;AAAA,IAC9B;AACA,QAAI,YAAY,SAAS,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AACzG,QAAI,UAAU;AAIZ,iBAAW,OAAO,MAAM,KAAK,QAAQ,GAAG;AACtC,YAAI,CAAC,YAAY,IAAI,GAAG,EAAG,UAAS,OAAO,GAAG;AAAA,MAChD;AAAA,IACF,OAAO;AACL,iBAAW;AAAA,IACb;AACA,QAAI,CAAC,YAAY,SAAS,SAAS,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,EACrH;AACA,QAAM,gBAAgB,OAAO,WAAW,WAAW,OAAO,KAAK,IAAI;AACnE,MAAI,eAAe;AAEjB,UAAM,cAAyC,eAAgB,qBAAqB,SAAa,KAAK,YAAY;AAClH,UAAM,gBAAuB,CAAC;AAE9B,UAAM,aAAa,MAAM,0BAA0B,IAAI,EAAE,KAAK,MAAM,eAAe,WAAW;AAC9F,QAAI,cAAc,WAAW,QAAQ;AACnC,oBAAc,KAAK,EAAE,IAAI,EAAE,KAAK,WAAkB,EAAE,CAAC;AAAA,IACvD;AAEA,UAAM,gBAAgB,IAAI,kBAAkB,aAAa,CAAC;AAC1D,UAAM,4BAAmC;AAAA,MACvC,EAAE,WAAW,KAAK;AAAA,MAClB,EAAE,MAAM,EAAE,QAAQ,cAAc,EAAE;AAAA,IACpC;AACA,QAAI,aAAa;AACf,gCAA0B,KAAK,EAAE,QAAQ,YAAY,CAAC;AAAA,IACxD;AACA,UAAM,wBAAwB,MAAM,GAAG;AAAA,MACrC;AAAA,MACA,0BAA0B,SAAS,IAAI,EAAE,MAAM,0BAA0B,IAAI,0BAA0B,CAAC;AAAA,IAC1G;AACA,UAAM,0BAA0B,sBAC7B,IAAI,CAAC,QAAS,KAAK,KAAK,OAAO,IAAI,EAAE,IAAI,IAAK,EAC9C,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AACnF,QAAI,wBAAwB,QAAQ;AAClC,oBAAc,KAAK,EAAE,gBAAgB,EAAE,KAAK,wBAA+B,EAAE,CAAC;AAAA,IAChF;AAEA,UAAM,oBAA2B;AAAA,MAC/B,EAAE,WAAW,KAAK;AAAA,MAClB,EAAE,MAAM,EAAE,QAAQ,cAAc,EAAE;AAAA,IACpC;AACA,QAAI,aAAa;AACf,wBAAkB,KAAK,EAAE,KAAK,CAAC,EAAE,UAAU,YAAY,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE,CAAC;AAAA,IACjF;AACA,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA,kBAAkB,SAAS,IAAI,EAAE,MAAM,kBAAkB,IAAI,kBAAkB,CAAC;AAAA,IAClF;AACA,UAAM,kBAAkB,cACrB,IAAI,CAAC,SAAU,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI,IAAK,EACjD,OAAO,CAAC,WAA6B,OAAO,WAAW,YAAY,OAAO,SAAS,CAAC;AACvF,QAAI,gBAAgB,QAAQ;AAC1B,YAAM,kBAAkB,MAAM,GAAG;AAAA,QAC/B;AAAA,QACA,oBAAoB,iBAAiB,SAAS,QAAQ;AAAA,MACxD;AACA,YAAM,sBAAsB,MAAM,KAAK,IAAI;AAAA,QACzC,gBACG,IAAI,CAAC,SAAS;AACb,gBAAM,UAAW,KAAa;AAC9B,gBAAM,SAAS,SAAS,MAAM;AAC9B,iBAAO,SAAS,OAAO,MAAM,IAAI;AAAA,QACnC,CAAC,EACA,OAAO,CAAC,WAA6B,OAAO,WAAW,YAAY,OAAO,SAAS,CAAC;AAAA,MACzF,CAAC;AACD,UAAI,oBAAoB,QAAQ;AAC9B,sBAAc,KAAK,EAAE,IAAI,EAAE,KAAK,oBAA2B,EAAE,CAAC;AAAA,MAChE;AAAA,IACF;AAEA,QAAI,CAAC,cAAc,QAAQ;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,aAAa,CAAC;AAAA,IAC/E;AAEA,YAAQ,KAAK,cAAc,SAAS,IAAI,EAAE,KAAK,cAAc,IAAI,cAAc,CAAC,CAAC;AAAA,EACnF;AAGA,MAAI,YAAY,SAAS,MAAM;AAC7B,YAAQ,KAAK,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,QAAQ,EAAS,EAAE,CAAC;AAAA,EAC3D;AACA,QAAM,QAAQ,QAAQ,SAAS,IAAI,EAAE,MAAM,QAAQ,IAAI,QAAQ,CAAC;AAChE,QAAM,CAAC,MAAM,KAAK,IAAI,MAAM,GAAG,aAAa,MAAM,OAAO,EAAE,OAAO,UAAU,SAAS,OAAO,KAAK,SAAS,CAAC;AAC3G,QAAM,UAAU,KAAK,IAAI,CAAC,MAAW,EAAE,EAAE;AACzC,QAAM,QAAQ,QAAQ,SAClB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,QAAe,GAAG,WAAW,KAAK;AAAA,IACjD,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB;AAAA,MACE,UAAU;AAAA,MACV,gBAAgB;AAAA,IAClB;AAAA,EACF,IACA,CAAC;AACL,QAAM,UAAoC,CAAC;AAC3C,QAAM,YAAsC,CAAC;AAC7C,aAAW,KAAK,OAAO;AACrB,UAAM,MAAM,OAAQ,EAAU,MAAM,MAAO,EAAU,IAAI;AACzD,UAAM,QAAQ,OAAQ,EAAU,MAAM,QAAQ,EAAE;AAChD,UAAM,MAAM,OAAQ,EAAU,MAAM,MAAM,EAAE;AAC5C,QAAI,CAAC,QAAQ,GAAG,EAAG,SAAQ,GAAG,IAAI,CAAC;AACnC,QAAI,CAAC,UAAU,GAAG,EAAG,WAAU,GAAG,IAAI,CAAC;AACvC,QAAI,MAAO,SAAQ,GAAG,EAAE,KAAK,KAAK;AAClC,QAAI,IAAK,WAAU,GAAG,EAAE,KAAK,GAAG;AAAA,EAClC;AACA,QAAM,SAAS,KACZ,IAAI,CAAC,MAAY,EAAE,iBAAiB,OAAO,EAAE,cAAc,IAAI,IAAK,EACpE,OAAO,CAACA,QAAqB,CAAC,CAACA,GAAE;AACpC,QAAM,eAAe,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC;AAC/C,MAAI,SAAiC,CAAC;AACtC,MAAI,aAAa,QAAQ;AACvB,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,aAAoB,GAAG,WAAW,KAAK;AAAA,IACtD;AACA,aAAS,cAAc,OAA+B,CAAC,KAAK,QAAQ;AAClE,YAAM,QAAQ,KAAK,KAAK,OAAO,IAAI,EAAE,IAAI;AACzC,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,UAAW,KAAa;AAC9B,YAAM,UAAU,OAAO,YAAY,YAAY,QAAQ,SAAS,IAAI,UAAU;AAC9E,UAAI,KAAK,IAAI;AACb,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AACA,QAAM,YAAY,KACf,IAAI,CAAC,MAAY,EAAE,WAAW,OAAO,EAAE,QAAQ,IAAI,IAAK,EACxD,OAAO,CAACA,QAAqB,CAAC,CAACA,GAAE;AACpC,QAAM,kBAAkB,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC;AACrD,MAAI,YAAoC,CAAC;AACzC,MAAI,gBAAgB,QAAQ;AAC1B,UAAM,UAAU,MAAM,GAAG;AAAA,MACvB;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,gBAAuB,GAAG,WAAW,KAAK;AAAA,IACzD;AACA,gBAAY,QAAQ,OAA+B,CAAC,KAAK,WAAW;AAClE,YAAM,WAAW,QAAQ,KAAK,OAAO,OAAO,EAAE,IAAI;AAClD,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,UAAW,QAAgB;AACjC,YAAM,aAAa,OAAO,YAAY,YAAY,QAAQ,SAAS,IAAI,UAAU;AACjF,UAAI,QAAQ,IAAI;AAChB,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AACA,QAAM,eAA8C,CAAC;AACrD,QAAM,qBAAoD,CAAC;AAC3D,aAAW,KAAK,MAAM;AACpB,UAAM,MAAM,OAAO,EAAE,EAAE;AACvB,iBAAa,GAAG,IAAI,EAAE,WAAW,OAAO,EAAE,QAAQ,IAAI;AACtD,uBAAmB,GAAG,IAAI,EAAE,iBAAiB,OAAO,EAAE,cAAc,IAAI;AAAA,EAC1E;AACA,QAAM,WAAW,QAAQ,SACrB,MAAM,sBAAsB;AAAA,IAC1B;AAAA,IACA,UAAU,EAAE,KAAK;AAAA,IACjB,WAAW,QAAQ,IAAI,MAAM;AAAA,IAC7B,kBAAkB;AAAA,IAClB,wBAAwB;AAAA,IACxB,iBAAiB,oBAAoB,CAAC,iBAAiB,IAAI,KAAK,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,EAChG,CAAC,IACD,CAAC;AAEL,QAAM,QAAQ,KAAK,IAAI,CAAC,MAAW;AACjC,UAAM,MAAM,OAAO,EAAE,EAAE;AACvB,UAAM,QAAQ,EAAE,iBAAiB,OAAO,EAAE,cAAc,IAAI;AAC5D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO,OAAO,EAAE,KAAK;AAAA,MACrB,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,IAAI;AAAA,MAChC,gBAAgB;AAAA,MAChB,kBAAkB,QAAQ,OAAO,KAAK,KAAK,QAAQ;AAAA,MACnD,UAAU,EAAE,WAAW,OAAO,EAAE,QAAQ,IAAI;AAAA,MAC5C,YAAY,EAAE,WAAW,UAAU,OAAO,EAAE,QAAQ,CAAC,KAAK,OAAO,EAAE,QAAQ,IAAI;AAAA,MAC/E,OAAO,QAAQ,GAAG,KAAK,CAAC;AAAA,MACxB,SAAS,UAAU,GAAG,KAAK,CAAC;AAAA,MAC5B,GAAI,KAAK,EAAE,aAAa,CAAC,CAAC,EAAE,aAAa,IAAI,CAAC;AAAA,MAC9C,aAAa,EAAE,gBAAgB;AAAA,MAC/B,WAAW,EAAE,qBAAqB,OAAO,EAAE,UAAU,YAAY,IAAI;AAAA,MACrE,GAAI,SAAS,GAAG,KAAK,CAAC;AAAA,IACxB;AAAA,EACF,CAAC;AACD,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAC1D,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,UAAU,qBAAqB,KAAK,YAAY;AAAA,IAChD,OAAO,OAAO;AAAA,IACd,YAAY,KAAK,cAAc;AAAA,EACjC,CAAC;AACD,SAAO,aAAa,KAAK,EAAE,OAAO,OAAO,OAAO,YAAY,aAAa,CAAC;AAC5E;AAEO,MAAM,OAAO,OAAO,QAAiB;AAC1C,SAAO,KAAK,KAAK,GAAG;AACtB;AAEO,MAAM,MAAM,OAAO,QAAiB;AACzC,SAAO,KAAK,IAAI,GAAG;AACrB;AAEO,MAAM,SAAS,OAAO,QAAiB;AAC5C,QAAM,WAAW,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,IAAI,IAAI;AACvD,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,gCAAgC,KAAK,QAAQ;AACnD,YAAM,0BAA0B,KAAK,QAAQ;AAAA,IAC/C,SAAS,KAAK;AACZ,UAAI,eAAe,eAAe;AAChC,eAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,MAC3D;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO,KAAK,OAAO,GAAG;AACxB;AAEA,eAAe,0BACb,IACA,YACA,QACA,aACA,OAC0B;AAC1B,SAAO,kCAAkC;AAAA,IACvC,IAAI,GAAG,UAA+B;AAAA,IACtC;AAAA,IACA,OAAO;AAAA,IACP,QAAQ,QAAQ,CAAC,KAAK,IAAI;AAAA,IAC1B,OAAO,EAAE,UAAU,YAAY;AAAA,EACjC,CAAC;AACH;AAEA,eAAe,gCAAgC,KAAc,cAAsB;AACjF,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AACtE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,yCAAyC;AAAA,IAC7C;AAAA,IACA,aAAa,UAAU,QAAQ,aAAa;AAAA,IAC5C,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAe,0BAA0B,KAAc,cAAsB;AAC3E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AACtE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,oBAAoB,MAAM,mCAAmC;AAAA,IACjE;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,UAAU,KAAK,YAAY;AAAA,EAC7B,CAAC;AACD,QAAM,+BAA+B;AAAA,IACnC;AAAA,IACA,aAAa,UAAU,QAAQ,aAAa;AAAA,IAC5C,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,IAC9B;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,QAAiB,KAA6B;AAC3E,QAAM,aAAa,OAAQ,MAAqD;AAChF,MAAI,WAAY,QAAO;AACvB,QAAM,YAAY;AAClB,SAAO,OAAO,WAAW,KAAK,KAAK,OAAO,WAAW,IAAI;AAC3D;AAEA,SAAS,OAAO,QAAmE;AACjF,QAAM,QAAQ,QAAQ;AACtB,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,eAAe,qBAAqB,KAAc,OAAgB,SAAkC;AAClG,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG;AAC3B,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AACtE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,WAAW,MAAM,kCAAkC,IAAI,SAAS,KAAK,YAAY,IAAI;AAC3F,QAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,aAAa,UAAU,QAAQ,aAAa;AAAA,IAC5C,aAAa,KAAK;AAAA,IAClB;AAAA,IACA,gBAAgB,KAAK,SAAS;AAAA,IAC9B,YAAY;AAAA,EACd,CAAC;AACH;AAEA,eAAe,+BAA+B,KAAc,SAAoD;AAC9G,QAAM,iBAAiB,OAAO,QAAQ,mBAAmB,WAAW,QAAQ,iBAAiB;AAC7F,QAAM,eAAe,OAAO,QAAQ,OAAO,WAAW,QAAQ,KAAK;AACnE,MAAI,CAAC,kBAAkB,CAAC,aAAc,QAAO;AAE7C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AACtE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,cAAc,WAAW,KAAK;AAAA,IACpC,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,eAAe;AAAA,IACrB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,IACvB,EAAE,UAAU,MAAM,eAAe;AAAA,EACnC;AACA,MAAI,CAAC,aAAc,QAAO,yCAAyC,GAAG;AACtE,QAAM,sBAAsB,aAAa,QAAQ,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI;AACvF,MAAI,CAAC,oBAAqB,QAAO,yCAAyC,GAAG;AAC7E,QAAM,wBAAwB,WAAW,iBAAiB,OAAO,WAAW,cAAc,IAAI;AAC9F,QAAM,kBAAkB,WAAW,WAAW,OAAO,WAAW,QAAQ,IAAI;AAC5E,MAAI,0BAA0B,kBAAkB,oBAAoB,qBAAqB;AACvF,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MAAM,4BAA4B;AAAA,IAC9C;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,QAAQ;AAAA,EACtB,CAAC;AACD,QAAM,oBAAoB,MAAM,mCAAmC;AAAA,IACjE;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,oCAAoC;AAAA,IACxC;AAAA,IACA,aAAa,UAAU,QAAQ,aAAa;AAAA,IAC5C,aAAa,KAAK;AAAA,IAClB,mBAAmB,KAAK,iBAAiB;AAAA,IACzC,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,IAC9B,wBAAwB,kBAAkB;AAAA,IAC1C;AAAA,IACA,2BAA2B;AAAA,IAC3B;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAEA,eAAe,kCACb,IACA,SACA,kBACwB;AACxB,QAAM,iBAAiB,OAAO,QAAQ,mBAAmB,WAAW,QAAQ,iBAAiB;AAC7F,MAAI,gBAAgB;AAClB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,eAAe;AAAA,MACrB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB,EAAE,UAAU,MAAM,eAAe;AAAA,IACnC;AACA,WAAO,cAAc,QAAQ,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI;AAAA,EACrE;AAEA,QAAM,SAAS,OAAO,QAAQ,OAAO,WAAW,QAAQ,KAAK;AAC7D,MAAI,QAAQ;AACV,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,MAC9B,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,WAAO,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,EAClD;AAEA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB;AAAA,MAChF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAC5C;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,oBAAoB;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,wGAAyG,QAAQ,oBAAoB;AAAA,MACnK;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,MACvE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2GAA2G,QAAQ,oBAAoB;AAAA,QACnK,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,qGAAqG,QAAQ,oBAAoB;AAAA,QAC7J,EAAE,QAAQ,KAAK,aAAa,yEAAyE,QAAQ,oBAAoB;AAAA,MACnI;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;AAAA,MACrE,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,MACvE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4EAA4E,QAAQ,oBAAoB;AAAA,QACpI,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,oBAAoB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["id"]
 }

package/dist/modules/auth/backend/users/page.js

@@ -19,6 +19,7 @@ import { useOrganizationScopeVersion } from "@open-mercato/shared/lib/frontend/u
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { useConfirmDialog } from "@open-mercato/ui/backend/confirm-dialog";
 import { ListEmptyState } from "@open-mercato/ui/backend/filters/ListEmptyState";
+import { ErrorMessage } from "@open-mercato/ui/backend/detail";
 async function fetchOrganizationFilterOptions() {
   const search = new URLSearchParams();
   search.set("view", "tree");
@@ -308,7 +309,7 @@ function UsersListPage() {
     }
     return p.toString();
   }, [filterValues.name, page, search, organizationId, normalizedRoleIds]);
-  const { data: usersData, isLoading } = useQuery({
+  const { data: usersData, isLoading, isPending, isFetching, isError, errorUpdatedAt, refetch } = useQuery({
     queryKey: ["users", params, scopeVersion],
     queryFn: async () => {
       const call = await apiCall(
@@ -320,6 +321,7 @@ function UsersListPage() {
       return call.result ?? { items: [], total: 0, totalPages: 1 };
     }
   });
+  const hasLoadError = isError || isPending && errorUpdatedAt > 0;
   const rows = usersData?.items || [];
   const total = usersData?.total || 0;
   const totalPages = usersData?.totalPages || 1;
@@ -409,7 +411,16 @@ function UsersListPage() {
           } }
         ] }),
         pagination: { page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage },
-        isLoading
+        isLoading: isLoading && !hasLoadError,
+        error: hasLoadError ? /* @__PURE__ */ jsx(
+          ErrorMessage,
+          {
+            label: t("auth.users.list.error.load", "Failed to load users"),
+            action: /* @__PURE__ */ jsx(Button, { type: "button", variant: "outline", disabled: isFetching, onClick: () => {
+              void refetch();
+            }, children: t("auth.users.list.actions.retry", "Retry") })
+          }
+        ) : null
       }
     ) }),
     ConfirmDialogElement

package/dist/modules/auth/backend/users/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/backend/users/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/auth/extension-points'\nimport Link from 'next/link'\nimport { useSearchParams } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable, type DataTableExportFormat } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport type { SortingState } from '@tanstack/react-table'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Badge } from '@open-mercato/ui/primitives/badge'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { useQuery, useQueryClient } from '@tanstack/react-query'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { buildOrganizationTreeOptions, formatOrganizationTreeLabel, type OrganizationTreeNode, type OrganizationTreeOption } from '@open-mercato/core/modules/directory/lib/tree'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\n\ntype Row = {\n  id: string\n  email: string\n  name: string | null\n  organizationId: string | null\n  organizationName?: string | null\n  tenantId: string | null\n  tenantName?: string | null\n  roles: string[]\n  isConfirmed?: boolean\n  updatedAt?: string | null\n}\n\ntype FilterOption = { value: string; label: string }\n\nasync function fetchOrganizationFilterOptions(): Promise<FilterOption[]> {\n  const search = new URLSearchParams()\n  search.set('view', 'tree')\n  search.set('status', 'all')\n  try {\n    const call = await apiCall<{ items?: OrganizationTreeNode[] }>(\n      `/api/directory/organizations?${search.toString()}`,\n    )\n    if (!call.ok) return []\n    const nodes = Array.isArray(call.result?.items) ? (call.result!.items as OrganizationTreeNode[]) : []\n    const flattened: OrganizationTreeOption[] = buildOrganizationTreeOptions(nodes)\n    return flattened\n      .filter((opt) => typeof opt.value === 'string' && opt.value.length > 0)\n      .map((opt) => {\n        const baseLabel = opt.name && opt.name.length > 0 ? opt.name : opt.value\n        const depth = typeof opt.depth === 'number' ? opt.depth : 0\n        const label = `${formatOrganizationTreeLabel(baseLabel, depth)}${opt.isActive === false ? ' (inactive)' : ''}`\n        return { value: opt.value, label }\n      })\n  } catch {\n    return []\n  }\n}\n\nasync function fetchRoleFilterOptions(query?: string): Promise<FilterOption[]> {\n  const search = new URLSearchParams()\n  search.set('page', '1')\n  search.set('pageSize', '50')\n  if (query && query.trim()) search.set('search', query.trim())\n  try {\n    const call = await apiCall<{ items?: unknown[] }>(`/api/auth/roles?${search.toString()}`)\n    if (!call.ok) return []\n    const items = Array.isArray(call.result?.items) ? call.result!.items : []\n    return items\n      .map((item: any): FilterOption | null => {\n        const id = typeof item?.id === 'string' ? item.id : null\n        const name = typeof item?.name === 'string' ? item.name : null\n        if (!id || !name) return null\n        return { value: id, label: name }\n      })\n      .filter((opt: FilterOption | null): opt is FilterOption => opt !== null)\n  } catch {\n    return []\n  }\n}\n\nasync function fetchRoleOptionsByIds(ids: string[]): Promise<FilterOption[]> {\n  const unique = Array.from(new Set(ids.filter((id) => typeof id === 'string' && id.trim() !== '')))\n  if (unique.length === 0) return []\n  const results = await Promise.all(unique.map(async (id) => {\n    try {\n      const search = new URLSearchParams()\n      search.set('id', id)\n      search.set('page', '1')\n      search.set('pageSize', '1')\n      const call = await apiCall<{ items?: unknown[] }>(`/api/auth/roles?${search.toString()}`)\n      if (!call.ok) return null\n      const data = call.result\n      const items = Array.isArray(data?.items) ? (data?.items as unknown[]) : []\n      const match = items.find((item) => {\n        if (!item || typeof item !== 'object') return false\n        const entry = item as Record<string, unknown>\n        return typeof entry.id === 'string' && entry.id === id\n      })\n      const record = match && typeof match === 'object' ? (match as Record<string, unknown>) : null\n      const name = typeof record?.name === 'string' ? record.name : null\n      if (!name) return null\n      return { value: id, label: name }\n    } catch {\n      return null\n    }\n  }))\n  return results.filter((opt: FilterOption | null): opt is FilterOption => opt !== null)\n}\n\nfunction mergeOptions(existing: FilterOption[], next: FilterOption[]): FilterOption[] {\n  if (!next.length) return existing\n  const map = new Map<string, FilterOption>()\n  for (const opt of existing) map.set(opt.value, opt)\n  for (const opt of next) map.set(opt.value, opt)\n  return Array.from(map.values()).sort((a, b) => a.label.localeCompare(b.label))\n}\n\nfunction arraysEqual(a: string[], b: string[]): boolean {\n  if (a.length !== b.length) return false\n  for (let i = 0; i < a.length; i += 1) {\n    if (a[i] !== b[i]) return false\n  }\n  return true\n}\n\nexport default function UsersListPage() {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const searchParams = useSearchParams()\n  const scopeVersion = useOrganizationScopeVersion()\n  const queryClient = useQueryClient()\n  const t = useT()\n  const [sorting, setSorting] = React.useState<SortingState>([{ id: 'email', desc: false }])\n  const [page, setPage] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n  const [organizationOptions, setOrganizationOptions] = React.useState<FilterOption[]>([])\n  const [roleOptions, setRoleOptions] = React.useState<FilterOption[]>([])\n  const [roleIdToLabel, setRoleIdToLabel] = React.useState<Record<string, string>>({})\n  const [roleFilterDirty, setRoleFilterDirty] = React.useState(false)\n\n  const roleIdsFromUrl = React.useMemo(() => {\n    if (!searchParams) return [] as string[]\n    const raw = searchParams.getAll('roleId')\n    return raw.filter((id): id is string => typeof id === 'string' && id.trim() !== '')\n  }, [searchParams])\n\n  const roleIdsFromUrlKey = React.useMemo(() => roleIdsFromUrl.join('|'), [roleIdsFromUrl])\n  const organizationId = typeof filterValues.organizationId === 'string' && filterValues.organizationId ? filterValues.organizationId : undefined\n\n  const applyRoleOptions = React.useCallback((opts: FilterOption[]) => {\n    if (!opts.length) return\n    setRoleOptions((prev) => mergeOptions(prev, opts))\n    setRoleIdToLabel((prev) => {\n      if (!opts.length) return prev\n      const next = { ...prev }\n      for (const opt of opts) next[opt.value] = opt.label\n      return next\n    })\n  }, [])\n\n  React.useEffect(() => {\n    let cancelled = false\n    fetchOrganizationFilterOptions().then((opts) => {\n      if (!cancelled) setOrganizationOptions(opts)\n    })\n    return () => { cancelled = true }\n  }, [scopeVersion])\n\n  React.useEffect(() => {\n    let cancelled = false\n    fetchRoleFilterOptions().then((opts) => {\n      if (!cancelled) applyRoleOptions(opts)\n    })\n    return () => { cancelled = true }\n  }, [applyRoleOptions])\n\n  React.useEffect(() => {\n    if (roleFilterDirty) return\n    if (roleIdsFromUrl.length === 0) {\n      setFilterValues((prev) => {\n        if (!Array.isArray(prev.roles) || prev.roles.length === 0) return prev\n        const next = { ...prev }\n        delete (next as any).roles\n        return next\n      })\n      return\n    }\n    const missing = roleIdsFromUrl.filter((id) => !roleIdToLabel[id])\n    if (missing.length === 0) {\n      setFilterValues((prev) => {\n        const current = Array.isArray(prev.roles) ? prev.roles as string[] : []\n        if (arraysEqual(current, roleIdsFromUrl)) return prev\n        return { ...prev, roles: roleIdsFromUrl }\n      })\n      return\n    }\n    let cancelled = false\n    ;(async () => {\n      const fetched = await fetchRoleOptionsByIds(missing)\n      if (cancelled) return\n      if (fetched.length) applyRoleOptions(fetched)\n      setFilterValues((prev) => {\n        const current = Array.isArray(prev.roles) ? prev.roles as string[] : []\n        if (arraysEqual(current, roleIdsFromUrl)) return prev\n        return { ...prev, roles: roleIdsFromUrl }\n      })\n    })()\n    return () => { cancelled = true }\n  }, [roleFilterDirty, roleIdsFromUrlKey, roleIdsFromUrl, roleIdToLabel, applyRoleOptions])\n\n  React.useEffect(() => {\n    setRoleFilterDirty(false)\n  }, [roleIdsFromUrlKey])\n\n  const loadRoleOptions = React.useCallback(async (query?: string) => {\n    const opts = await fetchRoleFilterOptions(query)\n    if (opts.length) applyRoleOptions(opts)\n    return opts\n  }, [applyRoleOptions])\n\n  const filters = React.useMemo<FilterDef[]>(() => [\n    {\n      id: 'name',\n      label: t('auth.users.list.filters.name', 'Display name'),\n      type: 'text',\n      placeholder: t('auth.users.list.filters.namePlaceholder', 'Filter by display name'),\n    },\n    {\n      id: 'organizationId',\n      label: t('auth.users.list.filters.organization', 'Organization'),\n      type: 'select',\n      options: organizationOptions,\n    },\n    {\n      id: 'roles',\n      label: t('auth.users.list.filters.roles', 'Roles'),\n      type: 'tags',\n      placeholder: t('auth.users.list.filters.rolesPlaceholder', 'Filter by roles'),\n      options: roleOptions,\n      loadOptions: loadRoleOptions,\n      formatValue: (val: string) => roleIdToLabel[val] ?? val,\n    },\n  ], [organizationOptions, roleOptions, loadRoleOptions, roleIdToLabel, t])\n\n  const roleIdsFromFilter = React.useMemo(() => {\n    const raw = Array.isArray(filterValues.roles) ? filterValues.roles as string[] : []\n    return raw.filter((id) => typeof id === 'string' && id.length > 0)\n  }, [filterValues.roles])\n\n  const effectiveRoleIds = React.useMemo(() => {\n    if (roleFilterDirty) return roleIdsFromFilter\n    if (roleIdsFromFilter.length > 0) return roleIdsFromFilter\n    return roleIdsFromUrl\n  }, [roleFilterDirty, roleIdsFromFilter, roleIdsFromUrl])\n\n  const normalizedRoleIds = React.useMemo(() => {\n    if (!effectiveRoleIds.length) return [] as string[]\n    const unique = Array.from(new Set(effectiveRoleIds))\n    unique.sort((a, b) => a.localeCompare(b))\n    return unique\n  }, [effectiveRoleIds])\n\n  const handleSearchChange = React.useCallback((value: string) => {\n    setSearch(value)\n    setPage(1)\n  }, [])\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    const next: FilterValues = {}\n    const name = typeof values.name === 'string' ? values.name.trim() : ''\n    if (name) next.name = name\n    const org = typeof values.organizationId === 'string' ? values.organizationId.trim() : ''\n    if (org) next.organizationId = org\n    const rawRoles = Array.isArray(values.roles) ? (values.roles as string[]) : []\n    const sanitizedRoles = rawRoles.map((role) => role.trim()).filter((role) => role.length > 0)\n    if (sanitizedRoles.length) next.roles = sanitizedRoles\n    setFilterValues(next)\n    setRoleFilterDirty(true)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setRoleFilterDirty(true)\n    setPage(1)\n  }, [])\n\n  const exportParams = React.useMemo(() => {\n    const name = typeof filterValues.name === 'string' ? filterValues.name.trim() : ''\n    return {\n      page,\n      pageSize: 50,\n      search,\n      name: name.length ? name : undefined,\n      organizationId,\n      roleIds: normalizedRoleIds,\n    }\n  }, [filterValues.name, normalizedRoleIds, organizationId, page, search])\n\n  const exportConfig = React.useMemo(() => ({\n    view: {\n      getUrl: (format: DataTableExportFormat) => {\n        const params = new URLSearchParams()\n        params.set('page', String(exportParams.page))\n        params.set('pageSize', String(exportParams.pageSize))\n        if (exportParams.search) params.set('search', exportParams.search)\n        if (exportParams.name) params.set('name', exportParams.name)\n        if (exportParams.organizationId) params.set('organizationId', exportParams.organizationId)\n        for (const roleId of exportParams.roleIds) params.append('roleId', roleId)\n        params.set('format', format)\n        params.set('exportScope', 'view')\n        return `/api/auth/users?${params.toString()}`\n      },\n    },\n    full: {\n      getUrl: (format: DataTableExportFormat) => {\n        const params = new URLSearchParams()\n        params.set('page', String(exportParams.page))\n        params.set('pageSize', String(exportParams.pageSize))\n        if (exportParams.search) params.set('search', exportParams.search)\n        if (exportParams.name) params.set('name', exportParams.name)\n        if (exportParams.organizationId) params.set('organizationId', exportParams.organizationId)\n        for (const roleId of exportParams.roleIds) params.append('roleId', roleId)\n        params.set('format', format)\n        params.set('exportScope', 'full')\n        params.set('all', 'true')\n        return `/api/auth/users?${params.toString()}`\n      },\n    },\n  }), [exportParams])\n\n  const params = React.useMemo(() => {\n    const p = new URLSearchParams()\n    p.set('page', String(page))\n    p.set('pageSize', '50')\n    if (search) p.set('search', search)\n    const name = typeof filterValues.name === 'string' ? filterValues.name.trim() : ''\n    if (name) p.set('name', name)\n    if (organizationId) p.set('organizationId', organizationId)\n    if (normalizedRoleIds.length) {\n      for (const id of normalizedRoleIds) p.append('roleId', id)\n    }\n    return p.toString()\n  }, [filterValues.name, page, search, organizationId, normalizedRoleIds])\n\n  const { data: usersData, isLoading } = useQuery({\n    queryKey: ['users', params, scopeVersion],\n    queryFn: async () => {\n      const call = await apiCall<{ items: Row[]; total: number; totalPages: number; totalIsCapped?: boolean; isSuperAdmin?: boolean }>(\n        `/api/auth/users?${params}`,\n      )\n      if (!call.ok) {\n        await raiseCrudError(call.response, t('auth.users.list.error.load', 'Failed to load users'))\n      }\n      return call.result ?? { items: [], total: 0, totalPages: 1 }\n    },\n  })\n\n  const rows = usersData?.items || []\n  const total = usersData?.total || 0\n  const totalPages = usersData?.totalPages || 1\n  const totalIsCapped = usersData?.totalIsCapped === true\n  const isSuperAdmin = !!usersData?.isSuperAdmin\n  const rowsWithOrgNames: Row[] = React.useMemo(() => rows.map(row => ({\n    ...row,\n    organizationName: row.organizationName ?? (row.organizationId ?? undefined),\n    tenantName: row.tenantName ?? (row.tenantId ?? undefined),\n  })), [rows])\n  const showTenantColumn = React.useMemo(\n    () => isSuperAdmin && rowsWithOrgNames.some((row) => row.tenantName),\n    [isSuperAdmin, rowsWithOrgNames],\n  )\n  const columns = React.useMemo<ColumnDef<Row>[]>(() => {\n    const base: ColumnDef<Row>[] = [\n      { accessorKey: 'email', header: t('auth.users.list.columns.email', 'Email') },\n      { accessorKey: 'name', header: t('auth.users.list.columns.name', 'Display name') },\n      { accessorKey: 'organizationName', header: t('auth.users.list.columns.organization', 'Organization') },\n      { accessorKey: 'roles', header: t('auth.users.list.columns.roles', 'Roles'), cell: ({ row }) => (row.original.roles || []).join(', ') },\n      {\n        accessorKey: 'isConfirmed',\n        header: t('auth.users.list.columns.status', 'Status'),\n        cell: ({ row }) => (\n          row.original.isConfirmed === false\n            ? <Badge variant=\"neutral\" dot>{t('auth.users.list.status.deactivated', 'Deactivated')}</Badge>\n            : <Badge variant=\"success\" dot>{t('auth.users.list.status.active', 'Active')}</Badge>\n        ),\n      },\n    ]\n    if (showTenantColumn) {\n      base.splice(1, 0, { accessorKey: 'tenantName', header: t('auth.users.list.columns.tenant', 'Tenant') })\n    }\n    return base\n  }, [showTenantColumn, t])\n\n  const handleDelete = React.useCallback(async (row: Row) => {\n    const confirmed = await confirm({\n      title: t('auth.users.list.confirmDelete', 'Delete user \"{email}\"?', { email: row.email }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    const deleteErrorMessage = t('auth.users.list.error.delete', 'Failed to delete user')\n    try {\n      const call = await withScopedApiRequestHeaders(\n        buildOptimisticLockHeader(row.updatedAt),\n        () => apiCall(`/api/auth/users?id=${encodeURIComponent(row.id)}`, { method: 'DELETE' }),\n      )\n      if (!call.ok) {\n        await raiseCrudError(call.response, deleteErrorMessage)\n      }\n      flash(t('auth.users.flash.deleted', 'User deleted'), 'success')\n      await queryClient.invalidateQueries({ queryKey: ['users'] })\n    } catch (error) {\n      const message = error instanceof Error ? error.message : deleteErrorMessage\n      flash(message, 'error')\n    }\n  }, [confirm, queryClient, t])\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n        title={t('auth.users.list.title', 'Users')}\n        titleHeadingLevel={1}\n          actions={(\n            <Button asChild>\n              <Link href=\"/backend/users/create\">{t('common.create', 'Create')}</Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rowsWithOrgNames}\n          exporter={exportConfig}\n          searchValue={search}\n          onSearchChange={handleSearchChange}\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          sortable\n          sorting={sorting}\n          onSortingChange={setSorting}\n          perspective={{ tableId: extensionPoints.hosts.usersTable.tableId }}\n          emptyState={(\n            <ListEmptyState\n              entityName={t('auth.users.list.title', 'Users')}\n              createHref=\"/backend/users/create\"\n              createLabel={t('common.create', 'Create')}\n            />\n          )}\n          rowActions={(row) => (\n            <RowActions items={[\n              { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/users/${row.id}/edit` },\n              { id: 'show-roles', label: t('auth.users.list.actions.showRoles', 'Show roles'), href: `/backend/roles?userId=${encodeURIComponent(row.id)}` },\n              { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },\n            ]} />\n          )}\n          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}\n          isLoading={isLoading}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAoYc,cAmCV,YAnCU;AAnYd,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,uBAAuB;AAChC,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAA6C;AAItD,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,mCAAmC;AACrD,SAAS,iCAAiC;AAC1C,SAAS,sBAAsB;AAC/B,SAAS,UAAU,sBAAsB;AACzC,SAAS,aAAa;AACtB,SAAS,8BAA8B,mCAA2F;AAClI,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,sBAAsB;AAiB/B,eAAe,iCAA0D;AACvE,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,QAAQ,MAAM;AACzB,SAAO,IAAI,UAAU,KAAK;AAC1B,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB,gCAAgC,OAAO,SAAS,CAAC;AAAA,IACnD;AACA,QAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAK,KAAK,OAAQ,QAAmC,CAAC;AACpG,UAAM,YAAsC,6BAA6B,KAAK;AAC9E,WAAO,UACJ,OAAO,CAAC,QAAQ,OAAO,IAAI,UAAU,YAAY,IAAI,MAAM,SAAS,CAAC,EACrE,IAAI,CAAC,QAAQ;AACZ,YAAM,YAAY,IAAI,QAAQ,IAAI,KAAK,SAAS,IAAI,IAAI,OAAO,IAAI;AACnE,YAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ;AAC1D,YAAM,QAAQ,GAAG,4BAA4B,WAAW,KAAK,CAAC,GAAG,IAAI,aAAa,QAAQ,gBAAgB,EAAE;AAC5G,aAAO,EAAE,OAAO,IAAI,OAAO,MAAM;AAAA,IACnC,CAAC;AAAA,EACL,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,uBAAuB,OAAyC;AAC7E,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,QAAQ,GAAG;AACtB,SAAO,IAAI,YAAY,IAAI;AAC3B,MAAI,SAAS,MAAM,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM,KAAK,CAAC;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,QAA+B,mBAAmB,OAAO,SAAS,CAAC,EAAE;AACxF,QAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,WAAO,MACJ,IAAI,CAAC,SAAmC;AACvC,YAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,KAAK;AACpD,YAAM,OAAO,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AAC1D,UAAI,CAAC,MAAM,CAAC,KAAM,QAAO;AACzB,aAAO,EAAE,OAAO,IAAI,OAAO,KAAK;AAAA,IAClC,CAAC,EACA,OAAO,CAAC,QAAkD,QAAQ,IAAI;AAAA,EAC3E,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,sBAAsB,KAAwC;AAC3E,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC;AACjG,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,QAAM,UAAU,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO;AACzD,QAAI;AACF,YAAM,SAAS,IAAI,gBAAgB;AACnC,aAAO,IAAI,MAAM,EAAE;AACnB,aAAO,IAAI,QAAQ,GAAG;AACtB,aAAO,IAAI,YAAY,GAAG;AAC1B,YAAM,OAAO,MAAM,QAA+B,mBAAmB,OAAO,SAAS,CAAC,EAAE;AACxF,UAAI,CAAC,KAAK,GAAI,QAAO;AACrB,YAAM,OAAO,KAAK;AAClB,YAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,IAAK,MAAM,QAAsB,CAAC;AACzE,YAAM,QAAQ,MAAM,KAAK,CAAC,SAAS;AACjC,YAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,cAAM,QAAQ;AACd,eAAO,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO;AAAA,MACtD,CAAC;AACD,YAAM,SAAS,SAAS,OAAO,UAAU,WAAY,QAAoC;AACzF,YAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AAC9D,UAAI,CAAC,KAAM,QAAO;AAClB,aAAO,EAAE,OAAO,IAAI,OAAO,KAAK;AAAA,IAClC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,CAAC,CAAC;AACF,SAAO,QAAQ,OAAO,CAAC,QAAkD,QAAQ,IAAI;AACvF;AAEA,SAAS,aAAa,UAA0B,MAAsC;AACpF,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,QAAM,MAAM,oBAAI,IAA0B;AAC1C,aAAW,OAAO,SAAU,KAAI,IAAI,IAAI,OAAO,GAAG;AAClD,aAAW,OAAO,KAAM,KAAI,IAAI,IAAI,OAAO,GAAG;AAC9C,SAAO,MAAM,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAC/E;AAEA,SAAS,YAAY,GAAa,GAAsB;AACtD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,GAAG;AACpC,QAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAAA,EAC5B;AACA,SAAO;AACT;AAEe,SAAR,gBAAiC;AACtC,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,eAAe,gBAAgB;AACrC,QAAM,eAAe,4BAA4B;AACjD,QAAM,cAAc,eAAe;AACnC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,EAAE,IAAI,SAAS,MAAM,MAAM,CAAC,CAAC;AACzF,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvE,QAAM,CAAC,qBAAqB,sBAAsB,IAAI,MAAM,SAAyB,CAAC,CAAC;AACvF,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAyB,CAAC,CAAC;AACvE,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAiC,CAAC,CAAC;AACnF,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAElE,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,QAAI,CAAC,aAAc,QAAO,CAAC;AAC3B,UAAM,MAAM,aAAa,OAAO,QAAQ;AACxC,WAAO,IAAI,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,KAAK,MAAM,EAAE;AAAA,EACpF,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,oBAAoB,MAAM,QAAQ,MAAM,eAAe,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC;AACxF,QAAM,iBAAiB,OAAO,aAAa,mBAAmB,YAAY,aAAa,iBAAiB,aAAa,iBAAiB;AAEtI,QAAM,mBAAmB,MAAM,YAAY,CAAC,SAAyB;AACnE,QAAI,CAAC,KAAK,OAAQ;AAClB,mBAAe,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;AACjD,qBAAiB,CAAC,SAAS;AACzB,UAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,YAAM,OAAO,EAAE,GAAG,KAAK;AACvB,iBAAW,OAAO,KAAM,MAAK,IAAI,KAAK,IAAI,IAAI;AAC9C,aAAO;AAAA,IACT,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mCAA+B,EAAE,KAAK,CAAC,SAAS;AAC9C,UAAI,CAAC,UAAW,wBAAuB,IAAI;AAAA,IAC7C,CAAC;AACD,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,2BAAuB,EAAE,KAAK,CAAC,SAAS;AACtC,UAAI,CAAC,UAAW,kBAAiB,IAAI;AAAA,IACvC,CAAC;AACD,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,UAAU,MAAM;AACpB,QAAI,gBAAiB;AACrB,QAAI,eAAe,WAAW,GAAG;AAC/B,sBAAgB,CAAC,SAAS;AACxB,YAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO;AAClE,cAAM,OAAO,EAAE,GAAG,KAAK;AACvB,eAAQ,KAAa;AACrB,eAAO;AAAA,MACT,CAAC;AACD;AAAA,IACF;AACA,UAAM,UAAU,eAAe,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;AAChE,QAAI,QAAQ,WAAW,GAAG;AACxB,sBAAgB,CAAC,SAAS;AACxB,cAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAoB,CAAC;AACtE,YAAI,YAAY,SAAS,cAAc,EAAG,QAAO;AACjD,eAAO,EAAE,GAAG,MAAM,OAAO,eAAe;AAAA,MAC1C,CAAC;AACD;AAAA,IACF;AACA,QAAI,YAAY;AACf,KAAC,YAAY;AACZ,YAAM,UAAU,MAAM,sBAAsB,OAAO;AACnD,UAAI,UAAW;AACf,UAAI,QAAQ,OAAQ,kBAAiB,OAAO;AAC5C,sBAAgB,CAAC,SAAS;AACxB,cAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAoB,CAAC;AACtE,YAAI,YAAY,SAAS,cAAc,EAAG,QAAO;AACjD,eAAO,EAAE,GAAG,MAAM,OAAO,eAAe;AAAA,MAC1C,CAAC;AAAA,IACH,GAAG;AACH,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,iBAAiB,mBAAmB,gBAAgB,eAAe,gBAAgB,CAAC;AAExF,QAAM,UAAU,MAAM;AACpB,uBAAmB,KAAK;AAAA,EAC1B,GAAG,CAAC,iBAAiB,CAAC;AAEtB,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAAmB;AAClE,UAAM,OAAO,MAAM,uBAAuB,KAAK;AAC/C,QAAI,KAAK,OAAQ,kBAAiB,IAAI;AACtC,WAAO;AAAA,EACT,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,UAAU,MAAM,QAAqB,MAAM;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,gCAAgC,cAAc;AAAA,MACvD,MAAM;AAAA,MACN,aAAa,EAAE,2CAA2C,wBAAwB;AAAA,IACpF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,wCAAwC,cAAc;AAAA,MAC/D,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,iCAAiC,OAAO;AAAA,MACjD,MAAM;AAAA,MACN,aAAa,EAAE,4CAA4C,iBAAiB;AAAA,MAC5E,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,CAAC,QAAgB,cAAc,GAAG,KAAK;AAAA,IACtD;AAAA,EACF,GAAG,CAAC,qBAAqB,aAAa,iBAAiB,eAAe,CAAC,CAAC;AAExE,QAAM,oBAAoB,MAAM,QAAQ,MAAM;AAC5C,UAAM,MAAM,MAAM,QAAQ,aAAa,KAAK,IAAI,aAAa,QAAoB,CAAC;AAClF,WAAO,IAAI,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,EACnE,GAAG,CAAC,aAAa,KAAK,CAAC;AAEvB,QAAM,mBAAmB,MAAM,QAAQ,MAAM;AAC3C,QAAI,gBAAiB,QAAO;AAC5B,QAAI,kBAAkB,SAAS,EAAG,QAAO;AACzC,WAAO;AAAA,EACT,GAAG,CAAC,iBAAiB,mBAAmB,cAAc,CAAC;AAEvD,QAAM,oBAAoB,MAAM,QAAQ,MAAM;AAC5C,QAAI,CAAC,iBAAiB,OAAQ,QAAO,CAAC;AACtC,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC;AACnD,WAAO,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACxC,WAAO;AAAA,EACT,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,qBAAqB,MAAM,YAAY,CAAC,UAAkB;AAC9D,cAAU,KAAK;AACf,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,UAAM,OAAqB,CAAC;AAC5B,UAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,KAAK,KAAK,IAAI;AACpE,QAAI,KAAM,MAAK,OAAO;AACtB,UAAM,MAAM,OAAO,OAAO,mBAAmB,WAAW,OAAO,eAAe,KAAK,IAAI;AACvF,QAAI,IAAK,MAAK,iBAAiB;AAC/B,UAAM,WAAW,MAAM,QAAQ,OAAO,KAAK,IAAK,OAAO,QAAqB,CAAC;AAC7E,UAAM,iBAAiB,SAAS,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AAC3F,QAAI,eAAe,OAAQ,MAAK,QAAQ;AACxC,oBAAgB,IAAI;AACpB,uBAAmB,IAAI;AACvB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,uBAAmB,IAAI;AACvB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM,QAAQ,MAAM;AACvC,UAAM,OAAO,OAAO,aAAa,SAAS,WAAW,aAAa,KAAK,KAAK,IAAI;AAChF,WAAO;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV;AAAA,MACA,MAAM,KAAK,SAAS,OAAO;AAAA,MAC3B;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,aAAa,MAAM,mBAAmB,gBAAgB,MAAM,MAAM,CAAC;AAEvE,QAAM,eAAe,MAAM,QAAQ,OAAO;AAAA,IACxC,MAAM;AAAA,MACJ,QAAQ,CAAC,WAAkC;AACzC,cAAMA,UAAS,IAAI,gBAAgB;AACnC,QAAAA,QAAO,IAAI,QAAQ,OAAO,aAAa,IAAI,CAAC;AAC5C,QAAAA,QAAO,IAAI,YAAY,OAAO,aAAa,QAAQ,CAAC;AACpD,YAAI,aAAa,OAAQ,CAAAA,QAAO,IAAI,UAAU,aAAa,MAAM;AACjE,YAAI,aAAa,KAAM,CAAAA,QAAO,IAAI,QAAQ,aAAa,IAAI;AAC3D,YAAI,aAAa,eAAgB,CAAAA,QAAO,IAAI,kBAAkB,aAAa,cAAc;AACzF,mBAAW,UAAU,aAAa,QAAS,CAAAA,QAAO,OAAO,UAAU,MAAM;AACzE,QAAAA,QAAO,IAAI,UAAU,MAAM;AAC3B,QAAAA,QAAO,IAAI,eAAe,MAAM;AAChC,eAAO,mBAAmBA,QAAO,SAAS,CAAC;AAAA,MAC7C;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,QAAQ,CAAC,WAAkC;AACzC,cAAMA,UAAS,IAAI,gBAAgB;AACnC,QAAAA,QAAO,IAAI,QAAQ,OAAO,aAAa,IAAI,CAAC;AAC5C,QAAAA,QAAO,IAAI,YAAY,OAAO,aAAa,QAAQ,CAAC;AACpD,YAAI,aAAa,OAAQ,CAAAA,QAAO,IAAI,UAAU,aAAa,MAAM;AACjE,YAAI,aAAa,KAAM,CAAAA,QAAO,IAAI,QAAQ,aAAa,IAAI;AAC3D,YAAI,aAAa,eAAgB,CAAAA,QAAO,IAAI,kBAAkB,aAAa,cAAc;AACzF,mBAAW,UAAU,aAAa,QAAS,CAAAA,QAAO,OAAO,UAAU,MAAM;AACzE,QAAAA,QAAO,IAAI,UAAU,MAAM;AAC3B,QAAAA,QAAO,IAAI,eAAe,MAAM;AAChC,QAAAA,QAAO,IAAI,OAAO,MAAM;AACxB,eAAO,mBAAmBA,QAAO,SAAS,CAAC;AAAA,MAC7C;AAAA,IACF;AAAA,EACF,IAAI,CAAC,YAAY,CAAC;AAElB,QAAM,SAAS,MAAM,QAAQ,MAAM;AACjC,UAAM,IAAI,IAAI,gBAAgB;AAC9B,MAAE,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC1B,MAAE,IAAI,YAAY,IAAI;AACtB,QAAI,OAAQ,GAAE,IAAI,UAAU,MAAM;AAClC,UAAM,OAAO,OAAO,aAAa,SAAS,WAAW,aAAa,KAAK,KAAK,IAAI;AAChF,QAAI,KAAM,GAAE,IAAI,QAAQ,IAAI;AAC5B,QAAI,eAAgB,GAAE,IAAI,kBAAkB,cAAc;AAC1D,QAAI,kBAAkB,QAAQ;AAC5B,iBAAW,MAAM,kBAAmB,GAAE,OAAO,UAAU,EAAE;AAAA,IAC3D;AACA,WAAO,EAAE,SAAS;AAAA,EACpB,GAAG,CAAC,aAAa,MAAM,MAAM,QAAQ,gBAAgB,iBAAiB,CAAC;AAEvE,QAAM,EAAE,MAAM,WAAW,UAAU,IAAI,SAAS;AAAA,IAC9C,UAAU,CAAC,SAAS,QAAQ,YAAY;AAAA,IACxC,SAAS,YAAY;AACnB,YAAM,OAAO,MAAM;AAAA,QACjB,mBAAmB,MAAM;AAAA,MAC3B;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,eAAe,KAAK,UAAU,EAAE,8BAA8B,sBAAsB,CAAC;AAAA,MAC7F;AACA,aAAO,KAAK,UAAU,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AAAA,IAC7D;AAAA,EACF,CAAC;AAED,QAAM,OAAO,WAAW,SAAS,CAAC;AAClC,QAAM,QAAQ,WAAW,SAAS;AAClC,QAAM,aAAa,WAAW,cAAc;AAC5C,QAAM,gBAAgB,WAAW,kBAAkB;AACnD,QAAM,eAAe,CAAC,CAAC,WAAW;AAClC,QAAM,mBAA0B,MAAM,QAAQ,MAAM,KAAK,IAAI,UAAQ;AAAA,IACnE,GAAG;AAAA,IACH,kBAAkB,IAAI,qBAAqB,IAAI,kBAAkB;AAAA,IACjE,YAAY,IAAI,eAAe,IAAI,YAAY;AAAA,EACjD,EAAE,GAAG,CAAC,IAAI,CAAC;AACX,QAAM,mBAAmB,MAAM;AAAA,IAC7B,MAAM,gBAAgB,iBAAiB,KAAK,CAAC,QAAQ,IAAI,UAAU;AAAA,IACnE,CAAC,cAAc,gBAAgB;AAAA,EACjC;AACA,QAAM,UAAU,MAAM,QAA0B,MAAM;AACpD,UAAM,OAAyB;AAAA,MAC7B,EAAE,aAAa,SAAS,QAAQ,EAAE,iCAAiC,OAAO,EAAE;AAAA,MAC5E,EAAE,aAAa,QAAQ,QAAQ,EAAE,gCAAgC,cAAc,EAAE;AAAA,MACjF,EAAE,aAAa,oBAAoB,QAAQ,EAAE,wCAAwC,cAAc,EAAE;AAAA,MACrG,EAAE,aAAa,SAAS,QAAQ,EAAE,iCAAiC,OAAO,GAAG,MAAM,CAAC,EAAE,IAAI,OAAO,IAAI,SAAS,SAAS,CAAC,GAAG,KAAK,IAAI,EAAE;AAAA,MACtI;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,kCAAkC,QAAQ;AAAA,QACpD,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,gBAAgB,QACzB,oBAAC,SAAM,SAAQ,WAAU,KAAG,MAAE,YAAE,sCAAsC,aAAa,GAAE,IACrF,oBAAC,SAAM,SAAQ,WAAU,KAAG,MAAE,YAAE,iCAAiC,QAAQ,GAAE;AAAA,MAEnF;AAAA,IACF;AACA,QAAI,kBAAkB;AACpB,WAAK,OAAO,GAAG,GAAG,EAAE,aAAa,cAAc,QAAQ,EAAE,kCAAkC,QAAQ,EAAE,CAAC;AAAA,IACxG;AACA,WAAO;AAAA,EACT,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAExB,QAAM,eAAe,MAAM,YAAY,OAAO,QAAa;AACzD,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,iCAAiC,0BAA0B,EAAE,OAAO,IAAI,MAAM,CAAC;AAAA,MACxF,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,UAAM,qBAAqB,EAAE,gCAAgC,uBAAuB;AACpF,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,0BAA0B,IAAI,SAAS;AAAA,QACvC,MAAM,QAAQ,sBAAsB,mBAAmB,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,SAAS,CAAC;AAAA,MACxF;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,eAAe,KAAK,UAAU,kBAAkB;AAAA,MACxD;AACA,YAAM,EAAE,4BAA4B,cAAc,GAAG,SAAS;AAC9D,YAAM,YAAY,kBAAkB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;AAAA,IAC7D,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,aAAa,CAAC,CAAC;AAE5B,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACD,OAAO,EAAE,yBAAyB,OAAO;AAAA,QACzC,mBAAmB;AAAA,QACjB,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,yBAAyB,YAAE,iBAAiB,QAAQ,GAAE,GACnE;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa;AAAA,QACb,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,QACA,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,UAAQ;AAAA,QACR;AAAA,QACA,iBAAiB;AAAA,QACjB,aAAa,EAAE,SAAS,gBAAgB,MAAM,WAAW,QAAQ;AAAA,QACjE,YACE;AAAA,UAAC;AAAA;AAAA,YACC,YAAY,EAAE,yBAAyB,OAAO;AAAA,YAC9C,YAAW;AAAA,YACX,aAAa,EAAE,iBAAiB,QAAQ;AAAA;AAAA,QAC1C;AAAA,QAEF,YAAY,CAAC,QACX,oBAAC,cAAW,OAAO;AAAA,UACjB,EAAE,IAAI,QAAQ,OAAO,EAAE,eAAe,MAAM,GAAG,MAAM,kBAAkB,IAAI,EAAE,QAAQ;AAAA,UACrF,EAAE,IAAI,cAAc,OAAO,EAAE,qCAAqC,YAAY,GAAG,MAAM,yBAAyB,mBAAmB,IAAI,EAAE,CAAC,GAAG;AAAA,UAC7I,EAAE,IAAI,UAAU,OAAO,EAAE,iBAAiB,QAAQ,GAAG,aAAa,MAAM,UAAU,MAAM;AAAE,iBAAK,aAAa,GAAG;AAAA,UAAE,EAAE;AAAA,QACrH,GAAG;AAAA,QAEL,YAAY,EAAE,MAAM,UAAU,IAAI,OAAO,YAAY,eAAe,cAAc,QAAQ;AAAA,QAC1F;AAAA;AAAA,IACF,GACF;AAAA,IACC;AAAA,KACH;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/auth/extension-points'\nimport Link from 'next/link'\nimport { useSearchParams } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable, type DataTableExportFormat } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport type { SortingState } from '@tanstack/react-table'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Badge } from '@open-mercato/ui/primitives/badge'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { useQuery, useQueryClient } from '@tanstack/react-query'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { buildOrganizationTreeOptions, formatOrganizationTreeLabel, type OrganizationTreeNode, type OrganizationTreeOption } from '@open-mercato/core/modules/directory/lib/tree'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\nimport { ErrorMessage } from '@open-mercato/ui/backend/detail'\n\ntype Row = {\n  id: string\n  email: string\n  name: string | null\n  organizationId: string | null\n  organizationName?: string | null\n  tenantId: string | null\n  tenantName?: string | null\n  roles: string[]\n  isConfirmed?: boolean\n  updatedAt?: string | null\n}\n\ntype FilterOption = { value: string; label: string }\n\nasync function fetchOrganizationFilterOptions(): Promise<FilterOption[]> {\n  const search = new URLSearchParams()\n  search.set('view', 'tree')\n  search.set('status', 'all')\n  try {\n    const call = await apiCall<{ items?: OrganizationTreeNode[] }>(\n      `/api/directory/organizations?${search.toString()}`,\n    )\n    if (!call.ok) return []\n    const nodes = Array.isArray(call.result?.items) ? (call.result!.items as OrganizationTreeNode[]) : []\n    const flattened: OrganizationTreeOption[] = buildOrganizationTreeOptions(nodes)\n    return flattened\n      .filter((opt) => typeof opt.value === 'string' && opt.value.length > 0)\n      .map((opt) => {\n        const baseLabel = opt.name && opt.name.length > 0 ? opt.name : opt.value\n        const depth = typeof opt.depth === 'number' ? opt.depth : 0\n        const label = `${formatOrganizationTreeLabel(baseLabel, depth)}${opt.isActive === false ? ' (inactive)' : ''}`\n        return { value: opt.value, label }\n      })\n  } catch {\n    return []\n  }\n}\n\nasync function fetchRoleFilterOptions(query?: string): Promise<FilterOption[]> {\n  const search = new URLSearchParams()\n  search.set('page', '1')\n  search.set('pageSize', '50')\n  if (query && query.trim()) search.set('search', query.trim())\n  try {\n    const call = await apiCall<{ items?: unknown[] }>(`/api/auth/roles?${search.toString()}`)\n    if (!call.ok) return []\n    const items = Array.isArray(call.result?.items) ? call.result!.items : []\n    return items\n      .map((item: any): FilterOption | null => {\n        const id = typeof item?.id === 'string' ? item.id : null\n        const name = typeof item?.name === 'string' ? item.name : null\n        if (!id || !name) return null\n        return { value: id, label: name }\n      })\n      .filter((opt: FilterOption | null): opt is FilterOption => opt !== null)\n  } catch {\n    return []\n  }\n}\n\nasync function fetchRoleOptionsByIds(ids: string[]): Promise<FilterOption[]> {\n  const unique = Array.from(new Set(ids.filter((id) => typeof id === 'string' && id.trim() !== '')))\n  if (unique.length === 0) return []\n  const results = await Promise.all(unique.map(async (id) => {\n    try {\n      const search = new URLSearchParams()\n      search.set('id', id)\n      search.set('page', '1')\n      search.set('pageSize', '1')\n      const call = await apiCall<{ items?: unknown[] }>(`/api/auth/roles?${search.toString()}`)\n      if (!call.ok) return null\n      const data = call.result\n      const items = Array.isArray(data?.items) ? (data?.items as unknown[]) : []\n      const match = items.find((item) => {\n        if (!item || typeof item !== 'object') return false\n        const entry = item as Record<string, unknown>\n        return typeof entry.id === 'string' && entry.id === id\n      })\n      const record = match && typeof match === 'object' ? (match as Record<string, unknown>) : null\n      const name = typeof record?.name === 'string' ? record.name : null\n      if (!name) return null\n      return { value: id, label: name }\n    } catch {\n      return null\n    }\n  }))\n  return results.filter((opt: FilterOption | null): opt is FilterOption => opt !== null)\n}\n\nfunction mergeOptions(existing: FilterOption[], next: FilterOption[]): FilterOption[] {\n  if (!next.length) return existing\n  const map = new Map<string, FilterOption>()\n  for (const opt of existing) map.set(opt.value, opt)\n  for (const opt of next) map.set(opt.value, opt)\n  return Array.from(map.values()).sort((a, b) => a.label.localeCompare(b.label))\n}\n\nfunction arraysEqual(a: string[], b: string[]): boolean {\n  if (a.length !== b.length) return false\n  for (let i = 0; i < a.length; i += 1) {\n    if (a[i] !== b[i]) return false\n  }\n  return true\n}\n\nexport default function UsersListPage() {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const searchParams = useSearchParams()\n  const scopeVersion = useOrganizationScopeVersion()\n  const queryClient = useQueryClient()\n  const t = useT()\n  const [sorting, setSorting] = React.useState<SortingState>([{ id: 'email', desc: false }])\n  const [page, setPage] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n  const [organizationOptions, setOrganizationOptions] = React.useState<FilterOption[]>([])\n  const [roleOptions, setRoleOptions] = React.useState<FilterOption[]>([])\n  const [roleIdToLabel, setRoleIdToLabel] = React.useState<Record<string, string>>({})\n  const [roleFilterDirty, setRoleFilterDirty] = React.useState(false)\n\n  const roleIdsFromUrl = React.useMemo(() => {\n    if (!searchParams) return [] as string[]\n    const raw = searchParams.getAll('roleId')\n    return raw.filter((id): id is string => typeof id === 'string' && id.trim() !== '')\n  }, [searchParams])\n\n  const roleIdsFromUrlKey = React.useMemo(() => roleIdsFromUrl.join('|'), [roleIdsFromUrl])\n  const organizationId = typeof filterValues.organizationId === 'string' && filterValues.organizationId ? filterValues.organizationId : undefined\n\n  const applyRoleOptions = React.useCallback((opts: FilterOption[]) => {\n    if (!opts.length) return\n    setRoleOptions((prev) => mergeOptions(prev, opts))\n    setRoleIdToLabel((prev) => {\n      if (!opts.length) return prev\n      const next = { ...prev }\n      for (const opt of opts) next[opt.value] = opt.label\n      return next\n    })\n  }, [])\n\n  React.useEffect(() => {\n    let cancelled = false\n    fetchOrganizationFilterOptions().then((opts) => {\n      if (!cancelled) setOrganizationOptions(opts)\n    })\n    return () => { cancelled = true }\n  }, [scopeVersion])\n\n  React.useEffect(() => {\n    let cancelled = false\n    fetchRoleFilterOptions().then((opts) => {\n      if (!cancelled) applyRoleOptions(opts)\n    })\n    return () => { cancelled = true }\n  }, [applyRoleOptions])\n\n  React.useEffect(() => {\n    if (roleFilterDirty) return\n    if (roleIdsFromUrl.length === 0) {\n      setFilterValues((prev) => {\n        if (!Array.isArray(prev.roles) || prev.roles.length === 0) return prev\n        const next = { ...prev }\n        delete (next as any).roles\n        return next\n      })\n      return\n    }\n    const missing = roleIdsFromUrl.filter((id) => !roleIdToLabel[id])\n    if (missing.length === 0) {\n      setFilterValues((prev) => {\n        const current = Array.isArray(prev.roles) ? prev.roles as string[] : []\n        if (arraysEqual(current, roleIdsFromUrl)) return prev\n        return { ...prev, roles: roleIdsFromUrl }\n      })\n      return\n    }\n    let cancelled = false\n    ;(async () => {\n      const fetched = await fetchRoleOptionsByIds(missing)\n      if (cancelled) return\n      if (fetched.length) applyRoleOptions(fetched)\n      setFilterValues((prev) => {\n        const current = Array.isArray(prev.roles) ? prev.roles as string[] : []\n        if (arraysEqual(current, roleIdsFromUrl)) return prev\n        return { ...prev, roles: roleIdsFromUrl }\n      })\n    })()\n    return () => { cancelled = true }\n  }, [roleFilterDirty, roleIdsFromUrlKey, roleIdsFromUrl, roleIdToLabel, applyRoleOptions])\n\n  React.useEffect(() => {\n    setRoleFilterDirty(false)\n  }, [roleIdsFromUrlKey])\n\n  const loadRoleOptions = React.useCallback(async (query?: string) => {\n    const opts = await fetchRoleFilterOptions(query)\n    if (opts.length) applyRoleOptions(opts)\n    return opts\n  }, [applyRoleOptions])\n\n  const filters = React.useMemo<FilterDef[]>(() => [\n    {\n      id: 'name',\n      label: t('auth.users.list.filters.name', 'Display name'),\n      type: 'text',\n      placeholder: t('auth.users.list.filters.namePlaceholder', 'Filter by display name'),\n    },\n    {\n      id: 'organizationId',\n      label: t('auth.users.list.filters.organization', 'Organization'),\n      type: 'select',\n      options: organizationOptions,\n    },\n    {\n      id: 'roles',\n      label: t('auth.users.list.filters.roles', 'Roles'),\n      type: 'tags',\n      placeholder: t('auth.users.list.filters.rolesPlaceholder', 'Filter by roles'),\n      options: roleOptions,\n      loadOptions: loadRoleOptions,\n      formatValue: (val: string) => roleIdToLabel[val] ?? val,\n    },\n  ], [organizationOptions, roleOptions, loadRoleOptions, roleIdToLabel, t])\n\n  const roleIdsFromFilter = React.useMemo(() => {\n    const raw = Array.isArray(filterValues.roles) ? filterValues.roles as string[] : []\n    return raw.filter((id) => typeof id === 'string' && id.length > 0)\n  }, [filterValues.roles])\n\n  const effectiveRoleIds = React.useMemo(() => {\n    if (roleFilterDirty) return roleIdsFromFilter\n    if (roleIdsFromFilter.length > 0) return roleIdsFromFilter\n    return roleIdsFromUrl\n  }, [roleFilterDirty, roleIdsFromFilter, roleIdsFromUrl])\n\n  const normalizedRoleIds = React.useMemo(() => {\n    if (!effectiveRoleIds.length) return [] as string[]\n    const unique = Array.from(new Set(effectiveRoleIds))\n    unique.sort((a, b) => a.localeCompare(b))\n    return unique\n  }, [effectiveRoleIds])\n\n  const handleSearchChange = React.useCallback((value: string) => {\n    setSearch(value)\n    setPage(1)\n  }, [])\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    const next: FilterValues = {}\n    const name = typeof values.name === 'string' ? values.name.trim() : ''\n    if (name) next.name = name\n    const org = typeof values.organizationId === 'string' ? values.organizationId.trim() : ''\n    if (org) next.organizationId = org\n    const rawRoles = Array.isArray(values.roles) ? (values.roles as string[]) : []\n    const sanitizedRoles = rawRoles.map((role) => role.trim()).filter((role) => role.length > 0)\n    if (sanitizedRoles.length) next.roles = sanitizedRoles\n    setFilterValues(next)\n    setRoleFilterDirty(true)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setRoleFilterDirty(true)\n    setPage(1)\n  }, [])\n\n  const exportParams = React.useMemo(() => {\n    const name = typeof filterValues.name === 'string' ? filterValues.name.trim() : ''\n    return {\n      page,\n      pageSize: 50,\n      search,\n      name: name.length ? name : undefined,\n      organizationId,\n      roleIds: normalizedRoleIds,\n    }\n  }, [filterValues.name, normalizedRoleIds, organizationId, page, search])\n\n  const exportConfig = React.useMemo(() => ({\n    view: {\n      getUrl: (format: DataTableExportFormat) => {\n        const params = new URLSearchParams()\n        params.set('page', String(exportParams.page))\n        params.set('pageSize', String(exportParams.pageSize))\n        if (exportParams.search) params.set('search', exportParams.search)\n        if (exportParams.name) params.set('name', exportParams.name)\n        if (exportParams.organizationId) params.set('organizationId', exportParams.organizationId)\n        for (const roleId of exportParams.roleIds) params.append('roleId', roleId)\n        params.set('format', format)\n        params.set('exportScope', 'view')\n        return `/api/auth/users?${params.toString()}`\n      },\n    },\n    full: {\n      getUrl: (format: DataTableExportFormat) => {\n        const params = new URLSearchParams()\n        params.set('page', String(exportParams.page))\n        params.set('pageSize', String(exportParams.pageSize))\n        if (exportParams.search) params.set('search', exportParams.search)\n        if (exportParams.name) params.set('name', exportParams.name)\n        if (exportParams.organizationId) params.set('organizationId', exportParams.organizationId)\n        for (const roleId of exportParams.roleIds) params.append('roleId', roleId)\n        params.set('format', format)\n        params.set('exportScope', 'full')\n        params.set('all', 'true')\n        return `/api/auth/users?${params.toString()}`\n      },\n    },\n  }), [exportParams])\n\n  const params = React.useMemo(() => {\n    const p = new URLSearchParams()\n    p.set('page', String(page))\n    p.set('pageSize', '50')\n    if (search) p.set('search', search)\n    const name = typeof filterValues.name === 'string' ? filterValues.name.trim() : ''\n    if (name) p.set('name', name)\n    if (organizationId) p.set('organizationId', organizationId)\n    if (normalizedRoleIds.length) {\n      for (const id of normalizedRoleIds) p.append('roleId', id)\n    }\n    return p.toString()\n  }, [filterValues.name, page, search, organizationId, normalizedRoleIds])\n\n  const { data: usersData, isLoading, isPending, isFetching, isError, errorUpdatedAt, refetch } = useQuery({\n    queryKey: ['users', params, scopeVersion],\n    queryFn: async () => {\n      const call = await apiCall<{ items: Row[]; total: number; totalPages: number; totalIsCapped?: boolean; isSuperAdmin?: boolean }>(\n        `/api/auth/users?${params}`,\n      )\n      if (!call.ok) {\n        await raiseCrudError(call.response, t('auth.users.list.error.load', 'Failed to load users'))\n      }\n      return call.result ?? { items: [], total: 0, totalPages: 1 }\n    },\n  })\n\n  const hasLoadError = isError || (isPending && errorUpdatedAt > 0)\n  const rows = usersData?.items || []\n  const total = usersData?.total || 0\n  const totalPages = usersData?.totalPages || 1\n  const totalIsCapped = usersData?.totalIsCapped === true\n  const isSuperAdmin = !!usersData?.isSuperAdmin\n  const rowsWithOrgNames: Row[] = React.useMemo(() => rows.map(row => ({\n    ...row,\n    organizationName: row.organizationName ?? (row.organizationId ?? undefined),\n    tenantName: row.tenantName ?? (row.tenantId ?? undefined),\n  })), [rows])\n  const showTenantColumn = React.useMemo(\n    () => isSuperAdmin && rowsWithOrgNames.some((row) => row.tenantName),\n    [isSuperAdmin, rowsWithOrgNames],\n  )\n  const columns = React.useMemo<ColumnDef<Row>[]>(() => {\n    const base: ColumnDef<Row>[] = [\n      { accessorKey: 'email', header: t('auth.users.list.columns.email', 'Email') },\n      { accessorKey: 'name', header: t('auth.users.list.columns.name', 'Display name') },\n      { accessorKey: 'organizationName', header: t('auth.users.list.columns.organization', 'Organization') },\n      { accessorKey: 'roles', header: t('auth.users.list.columns.roles', 'Roles'), cell: ({ row }) => (row.original.roles || []).join(', ') },\n      {\n        accessorKey: 'isConfirmed',\n        header: t('auth.users.list.columns.status', 'Status'),\n        cell: ({ row }) => (\n          row.original.isConfirmed === false\n            ? <Badge variant=\"neutral\" dot>{t('auth.users.list.status.deactivated', 'Deactivated')}</Badge>\n            : <Badge variant=\"success\" dot>{t('auth.users.list.status.active', 'Active')}</Badge>\n        ),\n      },\n    ]\n    if (showTenantColumn) {\n      base.splice(1, 0, { accessorKey: 'tenantName', header: t('auth.users.list.columns.tenant', 'Tenant') })\n    }\n    return base\n  }, [showTenantColumn, t])\n\n  const handleDelete = React.useCallback(async (row: Row) => {\n    const confirmed = await confirm({\n      title: t('auth.users.list.confirmDelete', 'Delete user \"{email}\"?', { email: row.email }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    const deleteErrorMessage = t('auth.users.list.error.delete', 'Failed to delete user')\n    try {\n      const call = await withScopedApiRequestHeaders(\n        buildOptimisticLockHeader(row.updatedAt),\n        () => apiCall(`/api/auth/users?id=${encodeURIComponent(row.id)}`, { method: 'DELETE' }),\n      )\n      if (!call.ok) {\n        await raiseCrudError(call.response, deleteErrorMessage)\n      }\n      flash(t('auth.users.flash.deleted', 'User deleted'), 'success')\n      await queryClient.invalidateQueries({ queryKey: ['users'] })\n    } catch (error) {\n      const message = error instanceof Error ? error.message : deleteErrorMessage\n      flash(message, 'error')\n    }\n  }, [confirm, queryClient, t])\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n        title={t('auth.users.list.title', 'Users')}\n        titleHeadingLevel={1}\n          actions={(\n            <Button asChild>\n              <Link href=\"/backend/users/create\">{t('common.create', 'Create')}</Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rowsWithOrgNames}\n          exporter={exportConfig}\n          searchValue={search}\n          onSearchChange={handleSearchChange}\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          sortable\n          sorting={sorting}\n          onSortingChange={setSorting}\n          perspective={{ tableId: extensionPoints.hosts.usersTable.tableId }}\n          emptyState={(\n            <ListEmptyState\n              entityName={t('auth.users.list.title', 'Users')}\n              createHref=\"/backend/users/create\"\n              createLabel={t('common.create', 'Create')}\n            />\n          )}\n          rowActions={(row) => (\n            <RowActions items={[\n              { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/users/${row.id}/edit` },\n              { id: 'show-roles', label: t('auth.users.list.actions.showRoles', 'Show roles'), href: `/backend/roles?userId=${encodeURIComponent(row.id)}` },\n              { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },\n            ]} />\n          )}\n          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}\n          isLoading={isLoading && !hasLoadError}\n          error={hasLoadError ? (\n            <ErrorMessage\n              label={t('auth.users.list.error.load', 'Failed to load users')}\n              action={(\n                <Button type=\"button\" variant=\"outline\" disabled={isFetching} onClick={() => { void refetch() }}>\n                  {t('auth.users.list.actions.retry', 'Retry')}\n                </Button>\n              )}\n            />\n          ) : null}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
+  "mappings": ";AAsYc,cAmCV,YAnCU;AArYd,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,uBAAuB;AAChC,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAA6C;AAItD,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,mCAAmC;AACrD,SAAS,iCAAiC;AAC1C,SAAS,sBAAsB;AAC/B,SAAS,UAAU,sBAAsB;AACzC,SAAS,aAAa;AACtB,SAAS,8BAA8B,mCAA2F;AAClI,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAiB7B,eAAe,iCAA0D;AACvE,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,QAAQ,MAAM;AACzB,SAAO,IAAI,UAAU,KAAK;AAC1B,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB,gCAAgC,OAAO,SAAS,CAAC;AAAA,IACnD;AACA,QAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAK,KAAK,OAAQ,QAAmC,CAAC;AACpG,UAAM,YAAsC,6BAA6B,KAAK;AAC9E,WAAO,UACJ,OAAO,CAAC,QAAQ,OAAO,IAAI,UAAU,YAAY,IAAI,MAAM,SAAS,CAAC,EACrE,IAAI,CAAC,QAAQ;AACZ,YAAM,YAAY,IAAI,QAAQ,IAAI,KAAK,SAAS,IAAI,IAAI,OAAO,IAAI;AACnE,YAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ;AAC1D,YAAM,QAAQ,GAAG,4BAA4B,WAAW,KAAK,CAAC,GAAG,IAAI,aAAa,QAAQ,gBAAgB,EAAE;AAC5G,aAAO,EAAE,OAAO,IAAI,OAAO,MAAM;AAAA,IACnC,CAAC;AAAA,EACL,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,uBAAuB,OAAyC;AAC7E,QAAM,SAAS,IAAI,gBAAgB;AACnC,SAAO,IAAI,QAAQ,GAAG;AACtB,SAAO,IAAI,YAAY,IAAI;AAC3B,MAAI,SAAS,MAAM,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM,KAAK,CAAC;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,QAA+B,mBAAmB,OAAO,SAAS,CAAC,EAAE;AACxF,QAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,WAAO,MACJ,IAAI,CAAC,SAAmC;AACvC,YAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,KAAK;AACpD,YAAM,OAAO,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AAC1D,UAAI,CAAC,MAAM,CAAC,KAAM,QAAO;AACzB,aAAO,EAAE,OAAO,IAAI,OAAO,KAAK;AAAA,IAClC,CAAC,EACA,OAAO,CAAC,QAAkD,QAAQ,IAAI;AAAA,EAC3E,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,sBAAsB,KAAwC;AAC3E,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC;AACjG,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,QAAM,UAAU,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO;AACzD,QAAI;AACF,YAAM,SAAS,IAAI,gBAAgB;AACnC,aAAO,IAAI,MAAM,EAAE;AACnB,aAAO,IAAI,QAAQ,GAAG;AACtB,aAAO,IAAI,YAAY,GAAG;AAC1B,YAAM,OAAO,MAAM,QAA+B,mBAAmB,OAAO,SAAS,CAAC,EAAE;AACxF,UAAI,CAAC,KAAK,GAAI,QAAO;AACrB,YAAM,OAAO,KAAK;AAClB,YAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,IAAK,MAAM,QAAsB,CAAC;AACzE,YAAM,QAAQ,MAAM,KAAK,CAAC,SAAS;AACjC,YAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,cAAM,QAAQ;AACd,eAAO,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO;AAAA,MACtD,CAAC;AACD,YAAM,SAAS,SAAS,OAAO,UAAU,WAAY,QAAoC;AACzF,YAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AAC9D,UAAI,CAAC,KAAM,QAAO;AAClB,aAAO,EAAE,OAAO,IAAI,OAAO,KAAK;AAAA,IAClC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,CAAC,CAAC;AACF,SAAO,QAAQ,OAAO,CAAC,QAAkD,QAAQ,IAAI;AACvF;AAEA,SAAS,aAAa,UAA0B,MAAsC;AACpF,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,QAAM,MAAM,oBAAI,IAA0B;AAC1C,aAAW,OAAO,SAAU,KAAI,IAAI,IAAI,OAAO,GAAG;AAClD,aAAW,OAAO,KAAM,KAAI,IAAI,IAAI,OAAO,GAAG;AAC9C,SAAO,MAAM,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAC/E;AAEA,SAAS,YAAY,GAAa,GAAsB;AACtD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,GAAG;AACpC,QAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAAA,EAC5B;AACA,SAAO;AACT;AAEe,SAAR,gBAAiC;AACtC,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,eAAe,gBAAgB;AACrC,QAAM,eAAe,4BAA4B;AACjD,QAAM,cAAc,eAAe;AACnC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,EAAE,IAAI,SAAS,MAAM,MAAM,CAAC,CAAC;AACzF,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvE,QAAM,CAAC,qBAAqB,sBAAsB,IAAI,MAAM,SAAyB,CAAC,CAAC;AACvF,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAyB,CAAC,CAAC;AACvE,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAiC,CAAC,CAAC;AACnF,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAElE,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,QAAI,CAAC,aAAc,QAAO,CAAC;AAC3B,UAAM,MAAM,aAAa,OAAO,QAAQ;AACxC,WAAO,IAAI,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,KAAK,MAAM,EAAE;AAAA,EACpF,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,oBAAoB,MAAM,QAAQ,MAAM,eAAe,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC;AACxF,QAAM,iBAAiB,OAAO,aAAa,mBAAmB,YAAY,aAAa,iBAAiB,aAAa,iBAAiB;AAEtI,QAAM,mBAAmB,MAAM,YAAY,CAAC,SAAyB;AACnE,QAAI,CAAC,KAAK,OAAQ;AAClB,mBAAe,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;AACjD,qBAAiB,CAAC,SAAS;AACzB,UAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,YAAM,OAAO,EAAE,GAAG,KAAK;AACvB,iBAAW,OAAO,KAAM,MAAK,IAAI,KAAK,IAAI,IAAI;AAC9C,aAAO;AAAA,IACT,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mCAA+B,EAAE,KAAK,CAAC,SAAS;AAC9C,UAAI,CAAC,UAAW,wBAAuB,IAAI;AAAA,IAC7C,CAAC;AACD,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,2BAAuB,EAAE,KAAK,CAAC,SAAS;AACtC,UAAI,CAAC,UAAW,kBAAiB,IAAI;AAAA,IACvC,CAAC;AACD,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,UAAU,MAAM;AACpB,QAAI,gBAAiB;AACrB,QAAI,eAAe,WAAW,GAAG;AAC/B,sBAAgB,CAAC,SAAS;AACxB,YAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO;AAClE,cAAM,OAAO,EAAE,GAAG,KAAK;AACvB,eAAQ,KAAa;AACrB,eAAO;AAAA,MACT,CAAC;AACD;AAAA,IACF;AACA,UAAM,UAAU,eAAe,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;AAChE,QAAI,QAAQ,WAAW,GAAG;AACxB,sBAAgB,CAAC,SAAS;AACxB,cAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAoB,CAAC;AACtE,YAAI,YAAY,SAAS,cAAc,EAAG,QAAO;AACjD,eAAO,EAAE,GAAG,MAAM,OAAO,eAAe;AAAA,MAC1C,CAAC;AACD;AAAA,IACF;AACA,QAAI,YAAY;AACf,KAAC,YAAY;AACZ,YAAM,UAAU,MAAM,sBAAsB,OAAO;AACnD,UAAI,UAAW;AACf,UAAI,QAAQ,OAAQ,kBAAiB,OAAO;AAC5C,sBAAgB,CAAC,SAAS;AACxB,cAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAoB,CAAC;AACtE,YAAI,YAAY,SAAS,cAAc,EAAG,QAAO;AACjD,eAAO,EAAE,GAAG,MAAM,OAAO,eAAe;AAAA,MAC1C,CAAC;AAAA,IACH,GAAG;AACH,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,iBAAiB,mBAAmB,gBAAgB,eAAe,gBAAgB,CAAC;AAExF,QAAM,UAAU,MAAM;AACpB,uBAAmB,KAAK;AAAA,EAC1B,GAAG,CAAC,iBAAiB,CAAC;AAEtB,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAAmB;AAClE,UAAM,OAAO,MAAM,uBAAuB,KAAK;AAC/C,QAAI,KAAK,OAAQ,kBAAiB,IAAI;AACtC,WAAO;AAAA,EACT,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,UAAU,MAAM,QAAqB,MAAM;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,gCAAgC,cAAc;AAAA,MACvD,MAAM;AAAA,MACN,aAAa,EAAE,2CAA2C,wBAAwB;AAAA,IACpF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,wCAAwC,cAAc;AAAA,MAC/D,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,iCAAiC,OAAO;AAAA,MACjD,MAAM;AAAA,MACN,aAAa,EAAE,4CAA4C,iBAAiB;AAAA,MAC5E,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,CAAC,QAAgB,cAAc,GAAG,KAAK;AAAA,IACtD;AAAA,EACF,GAAG,CAAC,qBAAqB,aAAa,iBAAiB,eAAe,CAAC,CAAC;AAExE,QAAM,oBAAoB,MAAM,QAAQ,MAAM;AAC5C,UAAM,MAAM,MAAM,QAAQ,aAAa,KAAK,IAAI,aAAa,QAAoB,CAAC;AAClF,WAAO,IAAI,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,EACnE,GAAG,CAAC,aAAa,KAAK,CAAC;AAEvB,QAAM,mBAAmB,MAAM,QAAQ,MAAM;AAC3C,QAAI,gBAAiB,QAAO;AAC5B,QAAI,kBAAkB,SAAS,EAAG,QAAO;AACzC,WAAO;AAAA,EACT,GAAG,CAAC,iBAAiB,mBAAmB,cAAc,CAAC;AAEvD,QAAM,oBAAoB,MAAM,QAAQ,MAAM;AAC5C,QAAI,CAAC,iBAAiB,OAAQ,QAAO,CAAC;AACtC,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC;AACnD,WAAO,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACxC,WAAO;AAAA,EACT,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,qBAAqB,MAAM,YAAY,CAAC,UAAkB;AAC9D,cAAU,KAAK;AACf,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,UAAM,OAAqB,CAAC;AAC5B,UAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,KAAK,KAAK,IAAI;AACpE,QAAI,KAAM,MAAK,OAAO;AACtB,UAAM,MAAM,OAAO,OAAO,mBAAmB,WAAW,OAAO,eAAe,KAAK,IAAI;AACvF,QAAI,IAAK,MAAK,iBAAiB;AAC/B,UAAM,WAAW,MAAM,QAAQ,OAAO,KAAK,IAAK,OAAO,QAAqB,CAAC;AAC7E,UAAM,iBAAiB,SAAS,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AAC3F,QAAI,eAAe,OAAQ,MAAK,QAAQ;AACxC,oBAAgB,IAAI;AACpB,uBAAmB,IAAI;AACvB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,uBAAmB,IAAI;AACvB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM,QAAQ,MAAM;AACvC,UAAM,OAAO,OAAO,aAAa,SAAS,WAAW,aAAa,KAAK,KAAK,IAAI;AAChF,WAAO;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV;AAAA,MACA,MAAM,KAAK,SAAS,OAAO;AAAA,MAC3B;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,aAAa,MAAM,mBAAmB,gBAAgB,MAAM,MAAM,CAAC;AAEvE,QAAM,eAAe,MAAM,QAAQ,OAAO;AAAA,IACxC,MAAM;AAAA,MACJ,QAAQ,CAAC,WAAkC;AACzC,cAAMA,UAAS,IAAI,gBAAgB;AACnC,QAAAA,QAAO,IAAI,QAAQ,OAAO,aAAa,IAAI,CAAC;AAC5C,QAAAA,QAAO,IAAI,YAAY,OAAO,aAAa,QAAQ,CAAC;AACpD,YAAI,aAAa,OAAQ,CAAAA,QAAO,IAAI,UAAU,aAAa,MAAM;AACjE,YAAI,aAAa,KAAM,CAAAA,QAAO,IAAI,QAAQ,aAAa,IAAI;AAC3D,YAAI,aAAa,eAAgB,CAAAA,QAAO,IAAI,kBAAkB,aAAa,cAAc;AACzF,mBAAW,UAAU,aAAa,QAAS,CAAAA,QAAO,OAAO,UAAU,MAAM;AACzE,QAAAA,QAAO,IAAI,UAAU,MAAM;AAC3B,QAAAA,QAAO,IAAI,eAAe,MAAM;AAChC,eAAO,mBAAmBA,QAAO,SAAS,CAAC;AAAA,MAC7C;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,QAAQ,CAAC,WAAkC;AACzC,cAAMA,UAAS,IAAI,gBAAgB;AACnC,QAAAA,QAAO,IAAI,QAAQ,OAAO,aAAa,IAAI,CAAC;AAC5C,QAAAA,QAAO,IAAI,YAAY,OAAO,aAAa,QAAQ,CAAC;AACpD,YAAI,aAAa,OAAQ,CAAAA,QAAO,IAAI,UAAU,aAAa,MAAM;AACjE,YAAI,aAAa,KAAM,CAAAA,QAAO,IAAI,QAAQ,aAAa,IAAI;AAC3D,YAAI,aAAa,eAAgB,CAAAA,QAAO,IAAI,kBAAkB,aAAa,cAAc;AACzF,mBAAW,UAAU,aAAa,QAAS,CAAAA,QAAO,OAAO,UAAU,MAAM;AACzE,QAAAA,QAAO,IAAI,UAAU,MAAM;AAC3B,QAAAA,QAAO,IAAI,eAAe,MAAM;AAChC,QAAAA,QAAO,IAAI,OAAO,MAAM;AACxB,eAAO,mBAAmBA,QAAO,SAAS,CAAC;AAAA,MAC7C;AAAA,IACF;AAAA,EACF,IAAI,CAAC,YAAY,CAAC;AAElB,QAAM,SAAS,MAAM,QAAQ,MAAM;AACjC,UAAM,IAAI,IAAI,gBAAgB;AAC9B,MAAE,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC1B,MAAE,IAAI,YAAY,IAAI;AACtB,QAAI,OAAQ,GAAE,IAAI,UAAU,MAAM;AAClC,UAAM,OAAO,OAAO,aAAa,SAAS,WAAW,aAAa,KAAK,KAAK,IAAI;AAChF,QAAI,KAAM,GAAE,IAAI,QAAQ,IAAI;AAC5B,QAAI,eAAgB,GAAE,IAAI,kBAAkB,cAAc;AAC1D,QAAI,kBAAkB,QAAQ;AAC5B,iBAAW,MAAM,kBAAmB,GAAE,OAAO,UAAU,EAAE;AAAA,IAC3D;AACA,WAAO,EAAE,SAAS;AAAA,EACpB,GAAG,CAAC,aAAa,MAAM,MAAM,QAAQ,gBAAgB,iBAAiB,CAAC;AAEvE,QAAM,EAAE,MAAM,WAAW,WAAW,WAAW,YAAY,SAAS,gBAAgB,QAAQ,IAAI,SAAS;AAAA,IACvG,UAAU,CAAC,SAAS,QAAQ,YAAY;AAAA,IACxC,SAAS,YAAY;AACnB,YAAM,OAAO,MAAM;AAAA,QACjB,mBAAmB,MAAM;AAAA,MAC3B;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,eAAe,KAAK,UAAU,EAAE,8BAA8B,sBAAsB,CAAC;AAAA,MAC7F;AACA,aAAO,KAAK,UAAU,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AAAA,IAC7D;AAAA,EACF,CAAC;AAED,QAAM,eAAe,WAAY,aAAa,iBAAiB;AAC/D,QAAM,OAAO,WAAW,SAAS,CAAC;AAClC,QAAM,QAAQ,WAAW,SAAS;AAClC,QAAM,aAAa,WAAW,cAAc;AAC5C,QAAM,gBAAgB,WAAW,kBAAkB;AACnD,QAAM,eAAe,CAAC,CAAC,WAAW;AAClC,QAAM,mBAA0B,MAAM,QAAQ,MAAM,KAAK,IAAI,UAAQ;AAAA,IACnE,GAAG;AAAA,IACH,kBAAkB,IAAI,qBAAqB,IAAI,kBAAkB;AAAA,IACjE,YAAY,IAAI,eAAe,IAAI,YAAY;AAAA,EACjD,EAAE,GAAG,CAAC,IAAI,CAAC;AACX,QAAM,mBAAmB,MAAM;AAAA,IAC7B,MAAM,gBAAgB,iBAAiB,KAAK,CAAC,QAAQ,IAAI,UAAU;AAAA,IACnE,CAAC,cAAc,gBAAgB;AAAA,EACjC;AACA,QAAM,UAAU,MAAM,QAA0B,MAAM;AACpD,UAAM,OAAyB;AAAA,MAC7B,EAAE,aAAa,SAAS,QAAQ,EAAE,iCAAiC,OAAO,EAAE;AAAA,MAC5E,EAAE,aAAa,QAAQ,QAAQ,EAAE,gCAAgC,cAAc,EAAE;AAAA,MACjF,EAAE,aAAa,oBAAoB,QAAQ,EAAE,wCAAwC,cAAc,EAAE;AAAA,MACrG,EAAE,aAAa,SAAS,QAAQ,EAAE,iCAAiC,OAAO,GAAG,MAAM,CAAC,EAAE,IAAI,OAAO,IAAI,SAAS,SAAS,CAAC,GAAG,KAAK,IAAI,EAAE;AAAA,MACtI;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,kCAAkC,QAAQ;AAAA,QACpD,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,gBAAgB,QACzB,oBAAC,SAAM,SAAQ,WAAU,KAAG,MAAE,YAAE,sCAAsC,aAAa,GAAE,IACrF,oBAAC,SAAM,SAAQ,WAAU,KAAG,MAAE,YAAE,iCAAiC,QAAQ,GAAE;AAAA,MAEnF;AAAA,IACF;AACA,QAAI,kBAAkB;AACpB,WAAK,OAAO,GAAG,GAAG,EAAE,aAAa,cAAc,QAAQ,EAAE,kCAAkC,QAAQ,EAAE,CAAC;AAAA,IACxG;AACA,WAAO;AAAA,EACT,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAExB,QAAM,eAAe,MAAM,YAAY,OAAO,QAAa;AACzD,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,iCAAiC,0BAA0B,EAAE,OAAO,IAAI,MAAM,CAAC;AAAA,MACxF,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,UAAM,qBAAqB,EAAE,gCAAgC,uBAAuB;AACpF,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,0BAA0B,IAAI,SAAS;AAAA,QACvC,MAAM,QAAQ,sBAAsB,mBAAmB,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,SAAS,CAAC;AAAA,MACxF;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,eAAe,KAAK,UAAU,kBAAkB;AAAA,MACxD;AACA,YAAM,EAAE,4BAA4B,cAAc,GAAG,SAAS;AAC9D,YAAM,YAAY,kBAAkB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;AAAA,IAC7D,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,aAAa,CAAC,CAAC;AAE5B,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACD,OAAO,EAAE,yBAAyB,OAAO;AAAA,QACzC,mBAAmB;AAAA,QACjB,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,yBAAyB,YAAE,iBAAiB,QAAQ,GAAE,GACnE;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa;AAAA,QACb,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,QACA,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,UAAQ;AAAA,QACR;AAAA,QACA,iBAAiB;AAAA,QACjB,aAAa,EAAE,SAAS,gBAAgB,MAAM,WAAW,QAAQ;AAAA,QACjE,YACE;AAAA,UAAC;AAAA;AAAA,YACC,YAAY,EAAE,yBAAyB,OAAO;AAAA,YAC9C,YAAW;AAAA,YACX,aAAa,EAAE,iBAAiB,QAAQ;AAAA;AAAA,QAC1C;AAAA,QAEF,YAAY,CAAC,QACX,oBAAC,cAAW,OAAO;AAAA,UACjB,EAAE,IAAI,QAAQ,OAAO,EAAE,eAAe,MAAM,GAAG,MAAM,kBAAkB,IAAI,EAAE,QAAQ;AAAA,UACrF,EAAE,IAAI,cAAc,OAAO,EAAE,qCAAqC,YAAY,GAAG,MAAM,yBAAyB,mBAAmB,IAAI,EAAE,CAAC,GAAG;AAAA,UAC7I,EAAE,IAAI,UAAU,OAAO,EAAE,iBAAiB,QAAQ,GAAG,aAAa,MAAM,UAAU,MAAM;AAAE,iBAAK,aAAa,GAAG;AAAA,UAAE,EAAE;AAAA,QACrH,GAAG;AAAA,QAEL,YAAY,EAAE,MAAM,UAAU,IAAI,OAAO,YAAY,eAAe,cAAc,QAAQ;AAAA,QAC1F,WAAW,aAAa,CAAC;AAAA,QACzB,OAAO,eACL;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,EAAE,8BAA8B,sBAAsB;AAAA,YAC7D,QACE,oBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,UAAU,YAAY,SAAS,MAAM;AAAE,mBAAK,QAAQ;AAAA,YAAE,GAC3F,YAAE,iCAAiC,OAAO,GAC7C;AAAA;AAAA,QAEJ,IACE;AAAA;AAAA,IACN,GACF;AAAA,IACC;AAAA,KACH;AAEJ;",
   "names": ["params"]
 }

package/dist/modules/catalog/commands/products.js

@@ -379,7 +379,7 @@ function ensureSchemaName(name, fallback) {
   if (fallback && fallback.trim().length) return fallback.trim();
   return "Product option schema";
 }
-async function assignOptionSchemaTemplate(em, product, schema, preferredName) {
+async function assignOptionSchemaTemplate(em, lookupEm, product, schema, preferredName) {
   const resolvedName = ensureSchemaName(
     schema.name,
     preferredName ?? product.title
@@ -391,7 +391,7 @@ async function assignOptionSchemaTemplate(em, product, schema, preferredName) {
   });
   let template = product.optionSchemaTemplate ?? null;
   if (!template) {
-    template = await em.findOne(CatalogOptionSchemaTemplate, {
+    template = await lookupEm.findOne(CatalogOptionSchemaTemplate, {
       organizationId: product.organizationId,
       tenantId: product.tenantId,
       code: templateCode,
@@ -1135,6 +1135,7 @@ const createProductCommand = {
       record.optionSchemaTemplate = optionSchemaTemplate;
     } else if (optionSchemaDefinition) {
       optionSchemaTemplate = await assignOptionSchemaTemplate(
+        em,
         em,
         record,
         optionSchemaDefinition,
@@ -1480,6 +1481,7 @@ const updateProductCommand = {
     if (optionSchemaDefinition) {
       await assignOptionSchemaTemplate(
         em,
+        lookupEm,
         record,
         optionSchemaDefinition,
         optionSchemaDefinition.name ?? parsed.title ?? record.title