@open-mercato/core 0.10.1-develop.7961.1.d65694a8e6 → 0.10.1-develop.7972.1.03f813eaaf

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 6279 entry points
+[build:core] found 6287 entry points
 [build:core] built successfully
 [build:core:generated] found 271 entry points
 [build:core:generated] built successfully

package/dist/modules/auth/api/logout.js

@@ -41,7 +41,7 @@ function extractAuthTokenClaims(token) {
 async function POST(req) {
   const sessToken = parseCookie(req, "session_token");
   const authToken = parseCookie(req, "auth_token");
-  if (!sessToken && !authToken) return buildSafeRedirectResponse(req, "/login");
+  if (!sessToken && !authToken) return buildSafeRedirectResponse(req, "/login", 303);
   const claims = extractAuthTokenClaims(authToken);
   let sessionRevoked = false;
   if (sessToken || claims.sessionId) {
@@ -69,7 +69,7 @@ async function POST(req) {
       at: (/* @__PURE__ */ new Date()).toISOString()
     }, { persistent: true }).catch(() => void 0);
   }
-  const res = buildSafeRedirectResponse(req, "/login");
+  const res = buildSafeRedirectResponse(req, "/login", 303);
   res.cookies.set("auth_token", "", { path: "/", maxAge: 0 });
   res.cookies.set("session_token", "", { path: "/", maxAge: 0 });
   res.cookies.set("om_selected_org", "", { path: "/", maxAge: 0 });
@@ -87,7 +87,7 @@ const openApi = {
       summary: "Invalidate session and redirect",
       description: "Revokes the session identified by the `auth_token` sid claim and the `session_token` cookie, clears both cookies together with the organization-scope cookies (`om_selected_org`, `om_selected_tenant`), and redirects the browser to the login page. A valid access token is not required, so a logout submitted after the access token expired still revokes the remember-me refresh session. A request that carries neither session cookie is only redirected.",
       responses: [
-        { status: 307, description: "Redirect to login after successful logout", mediaType: "text/html" }
+        { status: 303, description: "See Other: navigate to login with GET after logout", mediaType: "text/html" }
       ]
     }
   }

package/dist/modules/auth/api/logout.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/logout.ts"],
-  "sourcesContent": ["import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { verifyJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { buildSafeRedirectResponse } from '@open-mercato/core/modules/auth/lib/requestRedirect'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\n\ntype AuthTokenClaims = {\n  userId: string | null\n  sessionId: string | null\n  tenantId: string | null\n  organizationId: string | null\n}\n\nconst emptyAuthTokenClaims: AuthTokenClaims = Object.freeze({\n  userId: null,\n  sessionId: null,\n  tenantId: null,\n  organizationId: null,\n})\n\nfunction parseCookie(req: Request, name: string): string | null {\n  const cookie = req.headers.get('cookie') || ''\n  const m = cookie.match(new RegExp('(?:^|;\\\\s*)' + name + '=([^;]+)'))\n  if (!m) return null\n  try {\n    return decodeURIComponent(m[1])\n  } catch {\n    return null\n  }\n}\n\nfunction readStringClaim(payload: Record<string, unknown>, key: string): string | null {\n  const value = payload[key]\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nfunction extractAuthTokenClaims(token: string | null): AuthTokenClaims {\n  if (!token) return emptyAuthTokenClaims\n  try {\n    const payload = verifyJwt(token) as Record<string, unknown> | null\n    if (!payload || payload.type === 'customer') return emptyAuthTokenClaims\n    return {\n      userId: readStringClaim(payload, 'sub'),\n      sessionId: readStringClaim(payload, 'sid'),\n      tenantId: readStringClaim(payload, 'tenantId'),\n      organizationId: readStringClaim(payload, 'orgId'),\n    }\n  } catch {\n    return emptyAuthTokenClaims\n  }\n}\n\nexport async function POST(req: Request) {\n  const sessToken = parseCookie(req, 'session_token')\n  const authToken = parseCookie(req, 'auth_token')\n  if (!sessToken && !authToken) return buildSafeRedirectResponse(req, '/login')\n  const claims = extractAuthTokenClaims(authToken)\n  let sessionRevoked = false\n  if (sessToken || claims.sessionId) {\n    try {\n      const c = await createRequestContainer()\n      const auth = c.resolve<AuthService>('authService')\n      if (claims.sessionId) {\n        await auth.deleteSessionById(claims.sessionId)\n      }\n      if (sessToken) {\n        await auth.deleteSessionByToken(sessToken)\n      }\n      sessionRevoked = true\n    } catch (error) {\n      getTelemetryRuntime()?.reportError(error, { module: 'auth', code: 'auth.logout_revoke_failed' })\n    }\n  }\n  if (claims.userId) {\n    void emitAuthEvent('auth.logout', {\n      id: claims.userId,\n      tenantId: claims.tenantId,\n      organizationId: claims.organizationId,\n      sessionId: claims.sessionId,\n      sessionRevoked,\n      at: new Date().toISOString(),\n    }, { persistent: true }).catch(() => undefined)\n  }\n  const res = buildSafeRedirectResponse(req, '/login')\n  res.cookies.set('auth_token', '', { path: '/', maxAge: 0 })\n  res.cookies.set('session_token', '', { path: '/', maxAge: 0 })\n  res.cookies.set('om_selected_org', '', { path: '/', maxAge: 0 })\n  res.cookies.set('om_selected_tenant', '', { path: '/', maxAge: 0 })\n  return res\n}\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Log out current session',\n  methods: {\n    POST: {\n      summary: 'Invalidate session and redirect',\n      description: 'Revokes the session identified by the `auth_token` sid claim and the `session_token` cookie, clears both cookies together with the organization-scope cookies (`om_selected_org`, `om_selected_tenant`), and redirects the browser to the login page. A valid access token is not required, so a logout submitted after the access token expired still revokes the remember-me refresh session. A request that carries neither session cookie is only redirected.',\n      responses: [\n        { status: 307, description: 'Redirect to login after successful logout', mediaType: 'text/html' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AACA,SAAS,8BAA8B;AAEvC,SAAS,iBAAiB;AAC1B,SAAS,iCAAiC;AAC1C,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AASpC,MAAM,uBAAwC,OAAO,OAAO;AAAA,EAC1D,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,UAAU;AAAA,EACV,gBAAgB;AAClB,CAAC;AAED,SAAS,YAAY,KAAc,MAA6B;AAC9D,QAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAC5C,QAAM,IAAI,OAAO,MAAM,IAAI,OAAO,gBAAgB,OAAO,UAAU,CAAC;AACpE,MAAI,CAAC,EAAG,QAAO;AACf,MAAI;AACF,WAAO,mBAAmB,EAAE,CAAC,CAAC;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,SAAkC,KAA4B;AACrF,QAAM,QAAQ,QAAQ,GAAG;AACzB,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,uBAAuB,OAAuC;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,WAAW,QAAQ,SAAS,WAAY,QAAO;AACpD,WAAO;AAAA,MACL,QAAQ,gBAAgB,SAAS,KAAK;AAAA,MACtC,WAAW,gBAAgB,SAAS,KAAK;AAAA,MACzC,UAAU,gBAAgB,SAAS,UAAU;AAAA,MAC7C,gBAAgB,gBAAgB,SAAS,OAAO;AAAA,IAClD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,YAAY,YAAY,KAAK,eAAe;AAClD,QAAM,YAAY,YAAY,KAAK,YAAY;AAC/C,MAAI,CAAC,aAAa,CAAC,UAAW,QAAO,0BAA0B,KAAK,QAAQ;AAC5E,QAAM,SAAS,uBAAuB,SAAS;AAC/C,MAAI,iBAAiB;AACrB,MAAI,aAAa,OAAO,WAAW;AACjC,QAAI;AACF,YAAM,IAAI,MAAM,uBAAuB;AACvC,YAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,UAAI,OAAO,WAAW;AACpB,cAAM,KAAK,kBAAkB,OAAO,SAAS;AAAA,MAC/C;AACA,UAAI,WAAW;AACb,cAAM,KAAK,qBAAqB,SAAS;AAAA,MAC3C;AACA,uBAAiB;AAAA,IACnB,SAAS,OAAO;AACd,0BAAoB,GAAG,YAAY,OAAO,EAAE,QAAQ,QAAQ,MAAM,4BAA4B,CAAC;AAAA,IACjG;AAAA,EACF;AACA,MAAI,OAAO,QAAQ;AACjB,SAAK,cAAc,eAAe;AAAA,MAChC,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC7B,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAChD;AACA,QAAM,MAAM,0BAA0B,KAAK,QAAQ;AACnD,MAAI,QAAQ,IAAI,cAAc,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAC1D,MAAI,QAAQ,IAAI,iBAAiB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAC7D,MAAI,QAAQ,IAAI,mBAAmB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAC/D,MAAI,QAAQ,IAAI,sBAAsB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAClE,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6CAA6C,WAAW,YAAY;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { verifyJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { buildSafeRedirectResponse } from '@open-mercato/core/modules/auth/lib/requestRedirect'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\n\ntype AuthTokenClaims = {\n  userId: string | null\n  sessionId: string | null\n  tenantId: string | null\n  organizationId: string | null\n}\n\nconst emptyAuthTokenClaims: AuthTokenClaims = Object.freeze({\n  userId: null,\n  sessionId: null,\n  tenantId: null,\n  organizationId: null,\n})\n\nfunction parseCookie(req: Request, name: string): string | null {\n  const cookie = req.headers.get('cookie') || ''\n  const m = cookie.match(new RegExp('(?:^|;\\\\s*)' + name + '=([^;]+)'))\n  if (!m) return null\n  try {\n    return decodeURIComponent(m[1])\n  } catch {\n    return null\n  }\n}\n\nfunction readStringClaim(payload: Record<string, unknown>, key: string): string | null {\n  const value = payload[key]\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nfunction extractAuthTokenClaims(token: string | null): AuthTokenClaims {\n  if (!token) return emptyAuthTokenClaims\n  try {\n    const payload = verifyJwt(token) as Record<string, unknown> | null\n    if (!payload || payload.type === 'customer') return emptyAuthTokenClaims\n    return {\n      userId: readStringClaim(payload, 'sub'),\n      sessionId: readStringClaim(payload, 'sid'),\n      tenantId: readStringClaim(payload, 'tenantId'),\n      organizationId: readStringClaim(payload, 'orgId'),\n    }\n  } catch {\n    return emptyAuthTokenClaims\n  }\n}\n\nexport async function POST(req: Request) {\n  const sessToken = parseCookie(req, 'session_token')\n  const authToken = parseCookie(req, 'auth_token')\n  if (!sessToken && !authToken) return buildSafeRedirectResponse(req, '/login', 303)\n  const claims = extractAuthTokenClaims(authToken)\n  let sessionRevoked = false\n  if (sessToken || claims.sessionId) {\n    try {\n      const c = await createRequestContainer()\n      const auth = c.resolve<AuthService>('authService')\n      if (claims.sessionId) {\n        await auth.deleteSessionById(claims.sessionId)\n      }\n      if (sessToken) {\n        await auth.deleteSessionByToken(sessToken)\n      }\n      sessionRevoked = true\n    } catch (error) {\n      getTelemetryRuntime()?.reportError(error, { module: 'auth', code: 'auth.logout_revoke_failed' })\n    }\n  }\n  if (claims.userId) {\n    void emitAuthEvent('auth.logout', {\n      id: claims.userId,\n      tenantId: claims.tenantId,\n      organizationId: claims.organizationId,\n      sessionId: claims.sessionId,\n      sessionRevoked,\n      at: new Date().toISOString(),\n    }, { persistent: true }).catch(() => undefined)\n  }\n  const res = buildSafeRedirectResponse(req, '/login', 303)\n  res.cookies.set('auth_token', '', { path: '/', maxAge: 0 })\n  res.cookies.set('session_token', '', { path: '/', maxAge: 0 })\n  res.cookies.set('om_selected_org', '', { path: '/', maxAge: 0 })\n  res.cookies.set('om_selected_tenant', '', { path: '/', maxAge: 0 })\n  return res\n}\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Log out current session',\n  methods: {\n    POST: {\n      summary: 'Invalidate session and redirect',\n      description: 'Revokes the session identified by the `auth_token` sid claim and the `session_token` cookie, clears both cookies together with the organization-scope cookies (`om_selected_org`, `om_selected_tenant`), and redirects the browser to the login page. A valid access token is not required, so a logout submitted after the access token expired still revokes the remember-me refresh session. A request that carries neither session cookie is only redirected.',\n      responses: [\n        { status: 303, description: 'See Other: navigate to login with GET after logout', mediaType: 'text/html' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AACA,SAAS,8BAA8B;AAEvC,SAAS,iBAAiB;AAC1B,SAAS,iCAAiC;AAC1C,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AASpC,MAAM,uBAAwC,OAAO,OAAO;AAAA,EAC1D,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,UAAU;AAAA,EACV,gBAAgB;AAClB,CAAC;AAED,SAAS,YAAY,KAAc,MAA6B;AAC9D,QAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAC5C,QAAM,IAAI,OAAO,MAAM,IAAI,OAAO,gBAAgB,OAAO,UAAU,CAAC;AACpE,MAAI,CAAC,EAAG,QAAO;AACf,MAAI;AACF,WAAO,mBAAmB,EAAE,CAAC,CAAC;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,SAAkC,KAA4B;AACrF,QAAM,QAAQ,QAAQ,GAAG;AACzB,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,uBAAuB,OAAuC;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,WAAW,QAAQ,SAAS,WAAY,QAAO;AACpD,WAAO;AAAA,MACL,QAAQ,gBAAgB,SAAS,KAAK;AAAA,MACtC,WAAW,gBAAgB,SAAS,KAAK;AAAA,MACzC,UAAU,gBAAgB,SAAS,UAAU;AAAA,MAC7C,gBAAgB,gBAAgB,SAAS,OAAO;AAAA,IAClD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,YAAY,YAAY,KAAK,eAAe;AAClD,QAAM,YAAY,YAAY,KAAK,YAAY;AAC/C,MAAI,CAAC,aAAa,CAAC,UAAW,QAAO,0BAA0B,KAAK,UAAU,GAAG;AACjF,QAAM,SAAS,uBAAuB,SAAS;AAC/C,MAAI,iBAAiB;AACrB,MAAI,aAAa,OAAO,WAAW;AACjC,QAAI;AACF,YAAM,IAAI,MAAM,uBAAuB;AACvC,YAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,UAAI,OAAO,WAAW;AACpB,cAAM,KAAK,kBAAkB,OAAO,SAAS;AAAA,MAC/C;AACA,UAAI,WAAW;AACb,cAAM,KAAK,qBAAqB,SAAS;AAAA,MAC3C;AACA,uBAAiB;AAAA,IACnB,SAAS,OAAO;AACd,0BAAoB,GAAG,YAAY,OAAO,EAAE,QAAQ,QAAQ,MAAM,4BAA4B,CAAC;AAAA,IACjG;AAAA,EACF;AACA,MAAI,OAAO,QAAQ;AACjB,SAAK,cAAc,eAAe;AAAA,MAChC,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC7B,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAChD;AACA,QAAM,MAAM,0BAA0B,KAAK,UAAU,GAAG;AACxD,MAAI,QAAQ,IAAI,cAAc,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAC1D,MAAI,QAAQ,IAAI,iBAAiB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAC7D,MAAI,QAAQ,IAAI,mBAAmB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAC/D,MAAI,QAAQ,IAAI,sBAAsB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAClE,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sDAAsD,WAAW,YAAY;AAAA,MAC3G;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/communication_channels/setup.js

@@ -17,6 +17,51 @@ function stableScheduleUuid(stableKey) {
 function stablePollTickScheduleId(organizationId) {
   return stableScheduleUuid(`communication_channels:poll-tick:${organizationId}`);
 }
+async function ensureCommunicationChannelSchedules(ctx) {
+  const cradle = ctx.container;
+  if (typeof cradle.hasRegistration !== "function" || !cradle.hasRegistration("schedulerService")) return;
+  const schedulerService = ctx.container.resolve("schedulerService");
+  try {
+    await schedulerService.register({
+      id: stablePollTickScheduleId(ctx.organizationId),
+      name: "Communication channels poll tick",
+      description: `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,
+      scopeType: "organization",
+      organizationId: ctx.organizationId,
+      tenantId: ctx.tenantId,
+      scheduleType: "interval",
+      scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,
+      timezone: "UTC",
+      targetType: "queue",
+      targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,
+      targetPayload: {
+        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId }
+      },
+      sourceType: "module",
+      sourceModule: "communication_channels",
+      isEnabled: true
+    });
+    await schedulerService.register({
+      id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${ctx.organizationId}`),
+      name: "Gmail watch renewal",
+      description: "Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.",
+      scopeType: "organization",
+      organizationId: ctx.organizationId,
+      tenantId: ctx.tenantId,
+      scheduleType: "cron",
+      scheduleValue: "0 4 * * *",
+      timezone: "UTC",
+      targetType: "queue",
+      targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,
+      targetPayload: { scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId } },
+      sourceType: "module",
+      sourceModule: "communication_channels",
+      isEnabled: true
+    });
+  } catch (error) {
+    logger.warn("Failed to register module schedules", { err: error });
+  }
+}
 const setup = {
   defaultRoleFeatures: {
     superadmin: [
@@ -110,51 +155,10 @@ const setup = {
         });
       }
     }
-    const cradle = container;
-    if (typeof cradle.hasRegistration !== "function" || !cradle.hasRegistration("schedulerService")) {
-      return;
-    }
-    const schedulerService = container.resolve("schedulerService");
-    try {
-      await schedulerService.register({
-        id: stablePollTickScheduleId(organizationId),
-        name: "Communication channels poll tick",
-        description: `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,
-        scopeType: "organization",
-        organizationId,
-        tenantId,
-        scheduleType: "interval",
-        scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,
-        timezone: "UTC",
-        targetType: "queue",
-        targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,
-        targetPayload: {
-          scope: { tenantId, organizationId }
-        },
-        sourceType: "module",
-        sourceModule: "communication_channels",
-        isEnabled: true
-      });
-      await schedulerService.register({
-        id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${organizationId}`),
-        name: "Gmail watch renewal",
-        description: "Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.",
-        scopeType: "organization",
-        organizationId,
-        tenantId,
-        scheduleType: "cron",
-        scheduleValue: "0 4 * * *",
-        timezone: "UTC",
-        targetType: "queue",
-        targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,
-        targetPayload: { scope: { tenantId, organizationId } },
-        sourceType: "module",
-        sourceModule: "communication_channels",
-        isEnabled: true
-      });
-    } catch (error) {
-      logger.warn("Failed to register module schedules", { err: error });
-    }
+    await ensureCommunicationChannelSchedules({ container, tenantId, organizationId });
+  },
+  async onOrganizationCreated({ container, tenantId, organizationId }) {
+    await ensureCommunicationChannelSchedules({ container, tenantId, organizationId });
   }
 };
 var setup_default = setup;

package/dist/modules/communication_channels/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/communication_channels/setup.ts"],
-  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { CommunicationChannel } from './data/entities'\nimport { COMMUNICATION_CHANNELS_QUEUES } from './lib/queue'\nimport { isTestChannelSeedingEnabled, TEST_SEED_PROVIDER_KEY } from './lib/test-seed'\n\nconst logger = createLogger('communication_channels')\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    scopeType: 'system' | 'organization' | 'tenant'\n    organizationId?: string\n    tenantId?: string\n    scheduleType: 'cron' | 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue' | 'command'\n    targetQueue?: string\n    targetPayload?: unknown\n    sourceType?: 'user' | 'module'\n    sourceModule?: string\n    isEnabled?: boolean\n    description?: string\n  }) => Promise<void>\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\n/**\n * Sender the test-seed channel presents. Shared by the channel row's\n * `externalIdentifier` and its seeded credentials so both describe one address.\n */\nconst TEST_SEED_FROM_ADDRESS = 'system@test-seed.local'\n\n/**\n * Tick interval in seconds. Default 60s per email integration spec\n * \u00A7 Hub Deltas \u2192 Delta 6 (scheduler mechanism).\n */\nconst POLL_TICK_INTERVAL_SECONDS = Math.max(\n  10,\n  Number.parseInt(process.env.OM_HUB_POLL_SCHEDULER_TICK_SECONDS ?? '60', 10) || 60,\n)\n\n/**\n * `scheduled_jobs.id` is a uuid column, so a module-owned schedule's stable\n * registration key must be hashed into a uuid rather than used verbatim \u2014 this\n * keeps `schedulerService.register()` an idempotent upsert across re-runs of\n * seedDefaults instead of trying to insert a raw string into the uuid PK.\n */\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\nfunction stablePollTickScheduleId(organizationId: string): string {\n  return stableScheduleUuid(`communication_channels:poll-tick:${organizationId}`)\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n      'communication_channels.connect_tenant_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    admin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n      'communication_channels.connect_tenant_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    manager: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n    ],\n    employee: [\n      'communication_channels.view',\n      'communication_channels.react',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n    ],\n  },\n\n  async seedDefaults({ container, organizationId, tenantId }) {\n    if (isTestChannelSeedingEnabled() && process.env.SYSTEM_EMAIL_PROVIDER === TEST_SEED_PROVIDER_KEY) {\n      const em = (container.resolve('em') as EntityManager).fork()\n      const existing = await findOneWithDecryption(\n        em,\n        CommunicationChannel,\n        {\n          providerKey: TEST_SEED_PROVIDER_KEY,\n          channelType: 'email',\n          tenantId,\n          organizationId,\n          userId: null,\n          deletedAt: null,\n        },\n        undefined,\n        { tenantId, organizationId },\n      )\n      if (!existing) {\n        em.persist(em.create(CommunicationChannel, {\n          providerKey: TEST_SEED_PROVIDER_KEY,\n          channelType: 'email',\n          displayName: 'Test Seed System Email',\n          externalIdentifier: TEST_SEED_FROM_ADDRESS,\n          userId: null,\n          isPrimary: false,\n          isActive: true,\n          status: 'connected',\n          tenantId,\n          organizationId,\n        }))\n        await em.flush()\n      }\n\n      /**\n       * Seeding the channel row without credentials is not a neutral state \u2014 it is a\n       * fail-closed one. Once a tenant owns a Hub channel, `resolveTenantCredentials`\n       * deliberately refuses to fall back to instance-wide env credentials, so every\n       * tenant-scoped send throws `SYSTEM_EMAIL_CREDENTIALS_NOT_CONFIGURED`. Callers that\n       * treat a failed send as a failed write (customer invitations roll back and return\n       * 502) then fail outright rather than merely losing the email.\n       *\n       * Seeding credentials alongside the row makes the harness model a tenant that\n       * finished configuring its provider, which is also the only one of the three\n       * credential cases the integration suite would otherwise never exercise.\n       */\n      // Best-effort, like the scheduler registration below: credential storage needs the\n      // integrations module and a usable encryption key, and neither is guaranteed in every\n      // harness. A failure here must not abort tenant initialization for every other module.\n      try {\n        const credentialsService = container.resolve('integrationCredentialsService') as CredentialsServiceLike\n        const testSeedIntegrationId = `channel_${TEST_SEED_PROVIDER_KEY}`\n        const credentialScope = { tenantId, organizationId, userId: null }\n        const existingCredentials = await credentialsService.resolve(testSeedIntegrationId, credentialScope)\n        if (!existingCredentials) {\n          await credentialsService.save(\n            testSeedIntegrationId,\n            { testSeed: true, fromAddress: TEST_SEED_FROM_ADDRESS },\n            credentialScope,\n          )\n        }\n      } catch (error) {\n        logger.warn('Test-seed email credentials could not be stored; tenant-scoped sends will fail closed', {\n          err: error,\n          tenantId,\n          organizationId,\n        })\n      }\n    }\n\n    /**\n     * Register the per-channel polling tick with `@open-mercato/scheduler`.\n     *\n     * Per email integration spec \u00A7 Hub Deltas \u2192 Delta 6: every\n     * `POLL_TICK_INTERVAL_SECONDS` (default 60s), enqueue a single\n     * `communication-channels-poll-tick` job that enumerates due channels and\n     * fans out to the `communication-channels-poll` queue.\n     *\n     * The registration is per-organization (one tick row per org/tenant pair)\n     * so multi-tenant deploys schedule independently. Skipped silently when the\n     * scheduler module isn't enabled \u2014 keeps the hub usable in scheduler-less\n     * test harnesses.\n     */\n    const cradle = container as { hasRegistration?: (name: string) => boolean }\n    if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) {\n      return\n    }\n    const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n    // Best-effort: a scheduler failure must not abort tenant initialization for\n    // every other module (mirrors the ai_assistant setup pattern). The schedule\n    // ids are deterministic uuids so re-runs upsert idempotently.\n    try {\n      await schedulerService.register({\n        id: stablePollTickScheduleId(organizationId),\n        name: 'Communication channels poll tick',\n        description:\n          `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,\n        scopeType: 'organization',\n        organizationId,\n        tenantId,\n        scheduleType: 'interval',\n        scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,\n        timezone: 'UTC',\n        targetType: 'queue',\n        targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,\n        targetPayload: {\n          scope: { tenantId, organizationId },\n        },\n        sourceType: 'module',\n        sourceModule: 'communication_channels',\n        isEnabled: true,\n      })\n\n      // Spec C \u00A7 Phase C4 \u2014 Gmail watch renewal cron, per-org so multi-tenant\n      // deploys schedule independently.\n      await schedulerService.register({\n        id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${organizationId}`),\n        name: 'Gmail watch renewal',\n        description:\n          'Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.',\n        scopeType: 'organization',\n        organizationId,\n        tenantId,\n        scheduleType: 'cron',\n        scheduleValue: '0 4 * * *',\n        timezone: 'UTC',\n        targetType: 'queue',\n        targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,\n        targetPayload: { scope: { tenantId, organizationId } },\n        sourceType: 'module',\n        sourceModule: 'communication_channels',\n        isEnabled: true,\n      })\n    } catch (error) {\n      logger.warn('Failed to register module schedules', { err: error })\n    }\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B,8BAA8B;AAEpE,MAAM,SAAS,aAAa,wBAAwB;AAsCpD,MAAM,yBAAyB;AAM/B,MAAM,6BAA6B,KAAK;AAAA,EACtC;AAAA,EACA,OAAO,SAAS,QAAQ,IAAI,sCAAsC,MAAM,EAAE,KAAK;AACjF;AAQA,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAEA,SAAS,yBAAyB,gBAAgC;AAChE,SAAO,mBAAmB,oCAAoC,cAAc,EAAE;AAChF;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,WAAW,gBAAgB,SAAS,GAAG;AAC1D,QAAI,4BAA4B,KAAK,QAAQ,IAAI,0BAA0B,wBAAwB;AACjG,YAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,UACE,aAAa;AAAA,UACb,aAAa;AAAA,UACb;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA,EAAE,UAAU,eAAe;AAAA,MAC7B;AACA,UAAI,CAAC,UAAU;AACb,WAAG,QAAQ,GAAG,OAAO,sBAAsB;AAAA,UACzC,aAAa;AAAA,UACb,aAAa;AAAA,UACb,aAAa;AAAA,UACb,oBAAoB;AAAA,UACpB,QAAQ;AAAA,UACR,WAAW;AAAA,UACX,UAAU;AAAA,UACV,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC,CAAC;AACF,cAAM,GAAG,MAAM;AAAA,MACjB;AAiBA,UAAI;AACF,cAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,cAAM,wBAAwB,WAAW,sBAAsB;AAC/D,cAAM,kBAAkB,EAAE,UAAU,gBAAgB,QAAQ,KAAK;AACjE,cAAM,sBAAsB,MAAM,mBAAmB,QAAQ,uBAAuB,eAAe;AACnG,YAAI,CAAC,qBAAqB;AACxB,gBAAM,mBAAmB;AAAA,YACvB;AAAA,YACA,EAAE,UAAU,MAAM,aAAa,uBAAuB;AAAA,YACtD;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,eAAO,KAAK,yFAAyF;AAAA,UACnG,KAAK;AAAA,UACL;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAeA,UAAM,SAAS;AACf,QAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,GAAG;AAC/F;AAAA,IACF;AACA,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAI7D,QAAI;AACF,YAAM,iBAAiB,SAAS;AAAA,QAC9B,IAAI,yBAAyB,cAAc;AAAA,QAC3C,MAAM;AAAA,QACN,aACE,4CAA4C,0BAA0B;AAAA,QACxE,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,eAAe,GAAG,0BAA0B;AAAA,QAC5C,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,aAAa,8BAA8B;AAAA,QAC3C,eAAe;AAAA,UACb,OAAO,EAAE,UAAU,eAAe;AAAA,QACpC;AAAA,QACA,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,WAAW;AAAA,MACb,CAAC;AAID,YAAM,iBAAiB,SAAS;AAAA,QAC9B,IAAI,mBAAmB,4CAA4C,cAAc,EAAE;AAAA,QACnF,MAAM;AAAA,QACN,aACE;AAAA,QACF,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,eAAe;AAAA,QACf,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,aAAa,8BAA8B;AAAA,QAC3C,eAAe,EAAE,OAAO,EAAE,UAAU,eAAe,EAAE;AAAA,QACrD,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,KAAK,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,IACnE;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { CommunicationChannel } from './data/entities'\nimport { COMMUNICATION_CHANNELS_QUEUES } from './lib/queue'\nimport { isTestChannelSeedingEnabled, TEST_SEED_PROVIDER_KEY } from './lib/test-seed'\n\nconst logger = createLogger('communication_channels')\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    scopeType: 'system' | 'organization' | 'tenant'\n    organizationId?: string\n    tenantId?: string\n    scheduleType: 'cron' | 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue' | 'command'\n    targetQueue?: string\n    targetPayload?: unknown\n    sourceType?: 'user' | 'module'\n    sourceModule?: string\n    isEnabled?: boolean\n    description?: string\n  }) => Promise<void>\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\n/**\n * Sender the test-seed channel presents. Shared by the channel row's\n * `externalIdentifier` and its seeded credentials so both describe one address.\n */\nconst TEST_SEED_FROM_ADDRESS = 'system@test-seed.local'\n\n/**\n * Tick interval in seconds. Default 60s per email integration spec\n * \u00A7 Hub Deltas \u2192 Delta 6 (scheduler mechanism).\n */\nconst POLL_TICK_INTERVAL_SECONDS = Math.max(\n  10,\n  Number.parseInt(process.env.OM_HUB_POLL_SCHEDULER_TICK_SECONDS ?? '60', 10) || 60,\n)\n\n/**\n * `scheduled_jobs.id` is a uuid column, so a module-owned schedule's stable\n * registration key must be hashed into a uuid rather than used verbatim \u2014 this\n * keeps `schedulerService.register()` an idempotent upsert across re-runs of\n * seedDefaults instead of trying to insert a raw string into the uuid PK.\n */\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\nfunction stablePollTickScheduleId(organizationId: string): string {\n  return stableScheduleUuid(`communication_channels:poll-tick:${organizationId}`)\n}\n\nasync function ensureCommunicationChannelSchedules(ctx: {\n  container: import('awilix').AwilixContainer\n  tenantId: string\n  organizationId: string\n}): Promise<void> {\n  const cradle = ctx.container as { hasRegistration?: (name: string) => boolean }\n  if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) return\n\n  const schedulerService = ctx.container.resolve('schedulerService') as SchedulerServiceLike\n  try {\n    await schedulerService.register({\n      id: stablePollTickScheduleId(ctx.organizationId),\n      name: 'Communication channels poll tick',\n      description:\n        `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,\n      scopeType: 'organization',\n      organizationId: ctx.organizationId,\n      tenantId: ctx.tenantId,\n      scheduleType: 'interval',\n      scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,\n      timezone: 'UTC',\n      targetType: 'queue',\n      targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,\n      targetPayload: {\n        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n      },\n      sourceType: 'module',\n      sourceModule: 'communication_channels',\n      isEnabled: true,\n    })\n\n    await schedulerService.register({\n      id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${ctx.organizationId}`),\n      name: 'Gmail watch renewal',\n      description:\n        'Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.',\n      scopeType: 'organization',\n      organizationId: ctx.organizationId,\n      tenantId: ctx.tenantId,\n      scheduleType: 'cron',\n      scheduleValue: '0 4 * * *',\n      timezone: 'UTC',\n      targetType: 'queue',\n      targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,\n      targetPayload: { scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId } },\n      sourceType: 'module',\n      sourceModule: 'communication_channels',\n      isEnabled: true,\n    })\n  } catch (error) {\n    logger.warn('Failed to register module schedules', { err: error })\n  }\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n      'communication_channels.connect_tenant_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    admin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n      'communication_channels.connect_tenant_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    manager: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n    ],\n    employee: [\n      'communication_channels.view',\n      'communication_channels.react',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n    ],\n  },\n\n  async seedDefaults({ container, organizationId, tenantId }) {\n    if (isTestChannelSeedingEnabled() && process.env.SYSTEM_EMAIL_PROVIDER === TEST_SEED_PROVIDER_KEY) {\n      const em = (container.resolve('em') as EntityManager).fork()\n      const existing = await findOneWithDecryption(\n        em,\n        CommunicationChannel,\n        {\n          providerKey: TEST_SEED_PROVIDER_KEY,\n          channelType: 'email',\n          tenantId,\n          organizationId,\n          userId: null,\n          deletedAt: null,\n        },\n        undefined,\n        { tenantId, organizationId },\n      )\n      if (!existing) {\n        em.persist(em.create(CommunicationChannel, {\n          providerKey: TEST_SEED_PROVIDER_KEY,\n          channelType: 'email',\n          displayName: 'Test Seed System Email',\n          externalIdentifier: TEST_SEED_FROM_ADDRESS,\n          userId: null,\n          isPrimary: false,\n          isActive: true,\n          status: 'connected',\n          tenantId,\n          organizationId,\n        }))\n        await em.flush()\n      }\n\n      /**\n       * Seeding the channel row without credentials is not a neutral state \u2014 it is a\n       * fail-closed one. Once a tenant owns a Hub channel, `resolveTenantCredentials`\n       * deliberately refuses to fall back to instance-wide env credentials, so every\n       * tenant-scoped send throws `SYSTEM_EMAIL_CREDENTIALS_NOT_CONFIGURED`. Callers that\n       * treat a failed send as a failed write (customer invitations roll back and return\n       * 502) then fail outright rather than merely losing the email.\n       *\n       * Seeding credentials alongside the row makes the harness model a tenant that\n       * finished configuring its provider, which is also the only one of the three\n       * credential cases the integration suite would otherwise never exercise.\n       */\n      // Best-effort, like the scheduler registration below: credential storage needs the\n      // integrations module and a usable encryption key, and neither is guaranteed in every\n      // harness. A failure here must not abort tenant initialization for every other module.\n      try {\n        const credentialsService = container.resolve('integrationCredentialsService') as CredentialsServiceLike\n        const testSeedIntegrationId = `channel_${TEST_SEED_PROVIDER_KEY}`\n        const credentialScope = { tenantId, organizationId, userId: null }\n        const existingCredentials = await credentialsService.resolve(testSeedIntegrationId, credentialScope)\n        if (!existingCredentials) {\n          await credentialsService.save(\n            testSeedIntegrationId,\n            { testSeed: true, fromAddress: TEST_SEED_FROM_ADDRESS },\n            credentialScope,\n          )\n        }\n      } catch (error) {\n        logger.warn('Test-seed email credentials could not be stored; tenant-scoped sends will fail closed', {\n          err: error,\n          tenantId,\n          organizationId,\n        })\n      }\n    }\n\n    /**\n     * Register the per-channel polling tick with `@open-mercato/scheduler`.\n     *\n     * Per email integration spec \u00A7 Hub Deltas \u2192 Delta 6: every\n     * `POLL_TICK_INTERVAL_SECONDS` (default 60s), enqueue a single\n     * `communication-channels-poll-tick` job that enumerates due channels and\n     * fans out to the `communication-channels-poll` queue.\n     *\n     * The registration is per-organization (one tick row per org/tenant pair)\n     * so multi-tenant deploys schedule independently. Skipped silently when the\n     * scheduler module isn't enabled \u2014 keeps the hub usable in scheduler-less\n     * test harnesses.\n     */\n    await ensureCommunicationChannelSchedules({ container, tenantId, organizationId })\n  },\n\n  async onOrganizationCreated({ container, tenantId, organizationId }) {\n    await ensureCommunicationChannelSchedules({ container, tenantId, organizationId })\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B,8BAA8B;AAEpE,MAAM,SAAS,aAAa,wBAAwB;AAsCpD,MAAM,yBAAyB;AAM/B,MAAM,6BAA6B,KAAK;AAAA,EACtC;AAAA,EACA,OAAO,SAAS,QAAQ,IAAI,sCAAsC,MAAM,EAAE,KAAK;AACjF;AAQA,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAEA,SAAS,yBAAyB,gBAAgC;AAChE,SAAO,mBAAmB,oCAAoC,cAAc,EAAE;AAChF;AAEA,eAAe,oCAAoC,KAIjC;AAChB,QAAM,SAAS,IAAI;AACnB,MAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,EAAG;AAEjG,QAAM,mBAAmB,IAAI,UAAU,QAAQ,kBAAkB;AACjE,MAAI;AACF,UAAM,iBAAiB,SAAS;AAAA,MAC9B,IAAI,yBAAyB,IAAI,cAAc;AAAA,MAC/C,MAAM;AAAA,MACN,aACE,4CAA4C,0BAA0B;AAAA,MACxE,WAAW;AAAA,MACX,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI;AAAA,MACd,cAAc;AAAA,MACd,eAAe,GAAG,0BAA0B;AAAA,MAC5C,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,aAAa,8BAA8B;AAAA,MAC3C,eAAe;AAAA,QACb,OAAO,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,MACtE;AAAA,MACA,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AAED,UAAM,iBAAiB,SAAS;AAAA,MAC9B,IAAI,mBAAmB,4CAA4C,IAAI,cAAc,EAAE;AAAA,MACvF,MAAM;AAAA,MACN,aACE;AAAA,MACF,WAAW;AAAA,MACX,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI;AAAA,MACd,cAAc;AAAA,MACd,eAAe;AAAA,MACf,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,aAAa,8BAA8B;AAAA,MAC3C,eAAe,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe,EAAE;AAAA,MACvF,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,KAAK,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,EACnE;AACF;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,WAAW,gBAAgB,SAAS,GAAG;AAC1D,QAAI,4BAA4B,KAAK,QAAQ,IAAI,0BAA0B,wBAAwB;AACjG,YAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,UACE,aAAa;AAAA,UACb,aAAa;AAAA,UACb;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA,EAAE,UAAU,eAAe;AAAA,MAC7B;AACA,UAAI,CAAC,UAAU;AACb,WAAG,QAAQ,GAAG,OAAO,sBAAsB;AAAA,UACzC,aAAa;AAAA,UACb,aAAa;AAAA,UACb,aAAa;AAAA,UACb,oBAAoB;AAAA,UACpB,QAAQ;AAAA,UACR,WAAW;AAAA,UACX,UAAU;AAAA,UACV,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC,CAAC;AACF,cAAM,GAAG,MAAM;AAAA,MACjB;AAiBA,UAAI;AACF,cAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,cAAM,wBAAwB,WAAW,sBAAsB;AAC/D,cAAM,kBAAkB,EAAE,UAAU,gBAAgB,QAAQ,KAAK;AACjE,cAAM,sBAAsB,MAAM,mBAAmB,QAAQ,uBAAuB,eAAe;AACnG,YAAI,CAAC,qBAAqB;AACxB,gBAAM,mBAAmB;AAAA,YACvB;AAAA,YACA,EAAE,UAAU,MAAM,aAAa,uBAAuB;AAAA,YACtD;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,eAAO,KAAK,yFAAyF;AAAA,UACnG,KAAK;AAAA,UACL;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAeA,UAAM,oCAAoC,EAAE,WAAW,UAAU,eAAe,CAAC;AAAA,EACnF;AAAA,EAEA,MAAM,sBAAsB,EAAE,WAAW,UAAU,eAAe,GAAG;AACnE,UAAM,oCAAoC,EAAE,WAAW,UAAU,eAAe,CAAC;AAAA,EACnF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/customer_accounts/services/domainMappingService.js

@@ -1,5 +1,7 @@
 import { Resolver, promises as dnsPromises } from "node:dns";
 import { request as httpsRequest } from "node:https";
+import { resolveSafeHostAddress } from "@open-mercato/shared/lib/host-pinning";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
 import { setTimeout as delay } from "node:timers/promises";
 import { runWithCacheTenant } from "@open-mercato/cache";
 import {
@@ -46,36 +48,60 @@ const defaultDnsResolver = {
   }
 };
 const defaultHealthCheck = (hostname, timeoutMs) => new Promise((resolve) => {
-  const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? "X-Open-Mercato-Origin").toLowerCase();
-  const req = httpsRequest(
-    {
-      host: hostname,
-      port: 443,
-      path: "/api/customer_accounts/domain-check",
-      method: "GET",
-      headers: { "X-Domain-Check-Secret": process.env.DOMAIN_CHECK_SECRET ?? "" },
-      timeout: timeoutMs
-    },
-    (res) => {
-      const headerValue = res.headers[headerName];
-      const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue;
-      const originHeaderPresent = typeof originHeader === "string" && originHeader === "1";
-      const status = res.statusCode ?? 0;
-      res.resume();
-      resolve({
-        ok: status >= 200 && status < 400,
-        originHeaderPresent,
-        reason: status >= 200 && status < 400 ? void 0 : `HTTP ${status}`
-      });
-    }
-  );
-  req.on("timeout", () => {
-    req.destroy(new Error("TLS health check timed out"));
-  });
-  req.on("error", (err) => {
-    resolve({ ok: false, originHeaderPresent: false, reason: err.message });
+  let req;
+  let settled = false;
+  const failure = { ok: false, originHeaderPresent: false, reason: "TLS health check failed" };
+  const finish = (result) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(deadline);
+    resolve(result);
+  };
+  const deadline = setTimeout(() => {
+    finish(failure);
+    req?.destroy();
+  }, timeoutMs);
+  void resolveSafeHostAddress(hostname).then(({ host }) => {
+    if (settled) return;
+    const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? "X-Open-Mercato-Origin").toLowerCase();
+    req = httpsRequest(
+      {
+        host,
+        servername: hostname,
+        rejectUnauthorized: true,
+        agent: false,
+        port: 443,
+        path: "/api/customer_accounts/domain-check",
+        method: "GET",
+        headers: { Host: hostname, "X-Domain-Check-Secret": process.env.DOMAIN_CHECK_SECRET ?? "" },
+        timeout: timeoutMs
+      },
+      (res) => {
+        const headerValue = res.headers[headerName];
+        const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+        const originHeaderPresent = typeof originHeader === "string" && originHeader === "1";
+        const status = res.statusCode ?? 0;
+        res.resume();
+        finish({
+          ok: status >= 200 && status < 400,
+          originHeaderPresent,
+          reason: status >= 200 && status < 400 ? void 0 : `HTTP ${status}`
+        });
+      }
+    );
+    req.on("timeout", () => {
+      finish(failure);
+      req?.destroy();
+    });
+    req.on("error", () => finish(failure));
+    req.end();
+  }).catch(() => {
+    getTelemetryRuntime()?.reportError(new Error("[internal] Domain TLS health check failed"), {
+      module: "customer_accounts",
+      code: "customer_accounts.domain_health_check_failed"
+    });
+    finish(failure);
   });
-  req.end();
 });
 class DomainMappingService {
   constructor(em, deps) {

package/dist/modules/customer_accounts/services/domainMappingService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/domainMappingService.ts"],
-  "sourcesContent": ["import { Resolver, promises as dnsPromises } from 'node:dns'\nimport { request as httpsRequest } from 'node:https'\nimport { setTimeout as delay } from 'node:timers/promises'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  DomainMapping,\n  type DomainStatus,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { normalizeHostname, tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { findOrganizationInTenant } from '@open-mercato/core/modules/customer_accounts/lib/organizationLookup'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { detectProxy, isInKnownProxyRange } from '@open-mercato/core/modules/customer_accounts/lib/proxyRanges'\n\nexport class DomainMappingOrgScopeError extends Error {\n  constructor(organizationId: string) {\n    super(`[internal] organizationId ${organizationId} does not belong to the caller's tenant`)\n    this.name = 'DomainMappingOrgScopeError'\n  }\n}\n\nconst DOMAIN_ROUTING_TAG = 'domain_routing'\nconst RESOLVE_KEY_PREFIX = 'domain_routing:resolve'\nconst ACTIVE_BY_ORG_KEY_PREFIX = 'domain_routing:active-by-org'\nconst RESOLVE_TTL_MS = 5 * 60_000\nconst TLS_HEALTH_CHECK_TIMEOUT_MS = 10_000\nconst TLS_HEALTH_CHECK_RETRY_DELAYS_MS = [1_000, 4_000, 16_000]\nconst DEFAULT_DNS_RECHECK_THRESHOLD_MS = 5 * 60_000\nconst DEFAULT_TLS_MAX_RETRIES = 6\n\nexport type ResolveResult = {\n  domainMappingId: string\n  hostname: string\n  tenantId: string\n  organizationId: string\n  orgSlug: string | null\n  status: DomainStatus\n}\n\nexport type DnsDiagnostics = {\n  expectedCnameTarget: string\n  expectedARecordTarget: string | null\n  detectedRecords: Array<{ type: 'CNAME' | 'A'; value: string; proxy?: string }>\n  reverseResolve?: { attempted: boolean; originHeaderPresent: boolean }\n  suggestion: string\n}\n\nexport type VerifyResult = {\n  domainMapping: DomainMapping\n  diagnostics?: DnsDiagnostics\n}\n\nexport type RegisterInput = {\n  hostname: string\n  organizationId: string\n  tenantId: string\n  replacesDomainId?: string\n}\n\ntype CacheService = {\n  get(key: string, options?: unknown): Promise<unknown>\n  set(key: string, value: unknown, options?: { ttl?: number; tags?: string[] }): Promise<void>\n  deleteByTags(tags: string[]): Promise<number>\n}\n\ntype DnsResolverContract = {\n  resolveCname(hostname: string): Promise<string[]>\n  resolve4(hostname: string): Promise<string[]>\n}\n\ntype HealthCheckContract = (hostname: string, timeoutMs: number) => Promise<{\n  ok: boolean\n  originHeaderPresent: boolean\n  reason?: string\n}>\n\nconst defaultDnsResolver: DnsResolverContract = {\n  async resolveCname(hostname) {\n    try {\n      return await dnsPromises.resolveCname(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n  async resolve4(hostname) {\n    try {\n      return await dnsPromises.resolve4(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n}\n\nconst defaultHealthCheck: HealthCheckContract = (hostname, timeoutMs) =>\n  new Promise((resolve) => {\n    const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin').toLowerCase()\n    const req = httpsRequest(\n      {\n        host: hostname,\n        port: 443,\n        path: '/api/customer_accounts/domain-check',\n        method: 'GET',\n        headers: { 'X-Domain-Check-Secret': process.env.DOMAIN_CHECK_SECRET ?? '' },\n        timeout: timeoutMs,\n      },\n      (res) => {\n        const headerValue = res.headers[headerName]\n        const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue\n        const originHeaderPresent = typeof originHeader === 'string' && originHeader === '1'\n        const status = res.statusCode ?? 0\n        res.resume() // discard body\n        resolve({\n          ok: status >= 200 && status < 400,\n          originHeaderPresent,\n          reason: status >= 200 && status < 400 ? undefined : `HTTP ${status}`,\n        })\n      },\n    )\n    req.on('timeout', () => {\n      req.destroy(new Error('TLS health check timed out'))\n    })\n    req.on('error', (err) => {\n      resolve({ ok: false, originHeaderPresent: false, reason: (err as Error).message })\n    })\n    req.end()\n  })\n\nexport class DomainMappingService {\n  private cache: CacheService | null\n  private dns: DnsResolverContract\n  private healthCheckImpl: HealthCheckContract\n\n  constructor(\n    private em: EntityManager,\n    deps?: {\n      cacheService?: CacheService\n      dnsResolver?: DnsResolverContract\n      healthCheck?: HealthCheckContract\n    },\n  ) {\n    this.cache = deps?.cacheService ?? null\n    this.dns = deps?.dnsResolver ?? defaultDnsResolver\n    this.healthCheckImpl = deps?.healthCheck ?? defaultHealthCheck\n  }\n\n  // -------------------------------------------------------------------------\n  // Read paths\n  // -------------------------------------------------------------------------\n\n  async findById(id: string, scope?: { tenantId?: string }): Promise<DomainMapping | null> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.findOne(DomainMapping, where as never)\n  }\n\n  async findByOrganization(\n    organizationId: string,\n    scope?: { tenantId?: string },\n  ): Promise<DomainMapping[]> {\n    const where: Record<string, unknown> = { organizationId }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.find(DomainMapping, where as never, { orderBy: { createdAt: 'asc' } })\n  }\n\n  async resolveByHostname(input: string): Promise<ResolveResult | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n\n    const cacheKey = `${RESOLVE_KEY_PREFIX}:${hostname}`\n    const cache = this.cache\n    if (cache) {\n      const cached = (await runWithCacheTenant(null, () => cache.get(cacheKey))) as ResolveResult | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const result = await this.lookupResolveResult(hostname)\n    if (cache) {\n      await runWithCacheTenant(null, () => cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`],\n      }))\n    }\n    return result\n  }\n\n  async isAllowedForTls(input: string): Promise<{ organizationId: string; status: DomainStatus } | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n    const row = await this.em.findOne(DomainMapping, {\n      hostname,\n      status: { $in: ['active', 'verified'] },\n    } as never)\n    if (!row) return null\n    return { organizationId: row.organizationId, status: row.status }\n  }\n\n  async resolveActiveByOrg(organizationId: string): Promise<{ hostname: string; status: DomainStatus } | null> {\n    const cacheKey = `${ACTIVE_BY_ORG_KEY_PREFIX}:${organizationId}`\n    if (this.cache) {\n      const cached = (await this.cache.get(cacheKey)) as { hostname: string; status: DomainStatus } | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const row = await this.em.findOne(DomainMapping, {\n      organizationId,\n      status: 'active',\n    } as never)\n    const result = row ? { hostname: row.hostname, status: row.status } : null\n\n    if (this.cache) {\n      await this.cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:org:${organizationId}`],\n      })\n    }\n    return result\n  }\n\n  async resolveAll(): Promise<ResolveResult[]> {\n    const rows = await this.em.find(DomainMapping, { status: 'active' } as never)\n    if (rows.length === 0) return []\n    const orgIds = Array.from(new Set(rows.map((r) => r.organizationId)))\n    const orgs = await this.em.find(Organization, { id: { $in: orgIds } } as never)\n    const slugByOrg = new Map<string, string | null>(orgs.map((o) => [o.id, o.slug ?? null]))\n\n    return rows.map<ResolveResult>((row) => ({\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: slugByOrg.get(row.organizationId) ?? null,\n      status: row.status,\n    }))\n  }\n\n  // -------------------------------------------------------------------------\n  // Worker queries\n  // -------------------------------------------------------------------------\n\n  async findPendingVerification(threshold?: { olderThanMs?: number }): Promise<DomainMapping[]> {\n    const olderThan = threshold?.olderThanMs ?? DEFAULT_DNS_RECHECK_THRESHOLD_MS\n    const cutoff = new Date(Date.now() - olderThan)\n    return this.em.find(\n      DomainMapping,\n      {\n        status: { $in: ['pending', 'dns_failed'] },\n        $or: [{ lastDnsCheckAt: null }, { lastDnsCheckAt: { $lt: cutoff } }],\n      } as never,\n      { orderBy: { lastDnsCheckAt: 'asc' } },\n    )\n  }\n\n  async findPendingTls(options?: { maxRetries?: number; batchSize?: number }): Promise<DomainMapping[]> {\n    const maxRetries = options?.maxRetries ?? DEFAULT_TLS_MAX_RETRIES\n    const limit = options?.batchSize ?? 50\n    return this.em.find(\n      DomainMapping,\n      {\n        $or: [\n          { status: 'verified' },\n          { status: 'tls_failed', tlsRetryCount: { $lt: maxRetries } },\n        ],\n      } as never,\n      { orderBy: { updatedAt: 'asc' }, limit },\n    )\n  }\n\n  // -------------------------------------------------------------------------\n  // Write paths\n  // -------------------------------------------------------------------------\n\n  async register(input: RegisterInput): Promise<DomainMapping> {\n    const hostname = normalizeHostname(input.hostname)\n    const organization = await findOrganizationInTenant(this.em, input.organizationId, input.tenantId)\n    if (!organization) throw new DomainMappingOrgScopeError(input.organizationId)\n\n    let replacesDomain: DomainMapping | null = null\n    if (input.replacesDomainId) {\n      replacesDomain = await this.em.findOne(DomainMapping, {\n        id: input.replacesDomainId,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      } as never)\n    }\n\n    const entity = this.em.create(DomainMapping, {\n      hostname,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      replacesDomain: replacesDomain ?? null,\n      provider: 'traefik',\n      status: 'pending',\n      tlsRetryCount: 0,\n      createdAt: new Date(),\n    } as never)\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.created', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      status: entity.status,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n\n    return entity\n  }\n\n  async verify(id: string): Promise<VerifyResult> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n\n    const expectedCname = process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? ''\n    const expectedARecord = process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null\n    const now = new Date()\n    entity.lastDnsCheckAt = now\n\n    const verification = await this.runDnsVerification(entity.hostname, {\n      expectedCname,\n      expectedARecord,\n    })\n\n    if (verification.ok) {\n      entity.status = 'verified'\n      entity.verifiedAt = now\n      entity.dnsFailureReason = null\n      entity.tlsRetryCount = 0\n      entity.tlsFailureReason = null\n      await this.em.persist(entity).flush()\n      await emitCustomerAccountsEvent('customer_accounts.domain_mapping.verified', {\n        id: entity.id,\n        hostname: entity.hostname,\n        organizationId: entity.organizationId,\n        tenantId: entity.tenantId,\n      } as never)\n      await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n      return { domainMapping: entity }\n    }\n\n    entity.status = 'dns_failed'\n    entity.dnsFailureReason = verification.reason\n    await this.em.persist(entity).flush()\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.dns_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: verification.reason,\n      detectedRecords: verification.diagnostics.detectedRecords,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return { domainMapping: entity, diagnostics: verification.diagnostics }\n  }\n\n  async activate(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot transition to active from ${entity.status}`)\n    }\n\n    entity.status = 'active'\n    entity.tlsRetryCount = 0\n    entity.tlsFailureReason = null\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.activated', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n    } as never)\n\n    if (entity.replacesDomain) {\n      const replaced = await this.em.findOne(DomainMapping, {\n        id: (entity.replacesDomain as unknown as { id: string }).id,\n        tenantId: entity.tenantId,\n        organizationId: entity.organizationId,\n      } as never)\n      if (replaced) {\n        const replacedHostname = replaced.hostname\n        const replacedOrg = replaced.organizationId\n        this.em.remove(replaced)\n        await this.em.flush()\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.replaced', {\n          id: entity.id,\n          hostname: entity.hostname,\n          organizationId: entity.organizationId,\n          tenantId: entity.tenantId,\n          replacedDomainId: replaced.id,\n          replacedHostname,\n        } as never)\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n          id: replaced.id,\n          hostname: replacedHostname,\n          organizationId: replacedOrg,\n          tenantId: replaced.tenantId,\n        } as never)\n        await this.invalidateCacheFor(replacedHostname, replacedOrg)\n      }\n    }\n\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  async remove(id: string, scope?: { tenantId?: string }): Promise<void> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    const entity = await this.em.findOne(DomainMapping, where as never)\n    if (!entity) return\n\n    const hostname = entity.hostname\n    const organizationId = entity.organizationId\n    const tenantId = entity.tenantId\n\n    this.em.remove(entity)\n    await this.em.flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n      id,\n      hostname,\n      organizationId,\n      tenantId,\n    } as never)\n    await this.invalidateCacheFor(hostname, organizationId)\n  }\n\n  async healthCheck(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot run health check from status ${entity.status}`)\n    }\n\n    let lastReason: string | null = null\n    for (let attempt = 0; attempt < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length; attempt++) {\n      const result = await this.healthCheckImpl(entity.hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (result.ok) {\n        return this.activate(entity.id)\n      }\n      lastReason = result.reason ?? 'TLS health check failed'\n      if (attempt + 1 < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length) {\n        await delay(TLS_HEALTH_CHECK_RETRY_DELAYS_MS[attempt])\n      }\n    }\n\n    entity.status = 'tls_failed'\n    entity.tlsFailureReason = lastReason ?? 'TLS health check failed'\n    entity.tlsRetryCount = (entity.tlsRetryCount ?? 0) + 1\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.tls_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: entity.tlsFailureReason,\n      retryCount: entity.tlsRetryCount,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  // -------------------------------------------------------------------------\n  // Internals\n  // -------------------------------------------------------------------------\n\n  private async lookupResolveResult(hostname: string): Promise<ResolveResult | null> {\n    const row = await this.em.findOne(DomainMapping, { hostname, status: 'active' } as never)\n    if (!row) return null\n    const org = await this.em.findOne(Organization, { id: row.organizationId } as never)\n    return {\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: org?.slug ?? null,\n      status: row.status,\n    }\n  }\n\n  private async invalidateCacheFor(hostname: string, organizationId: string | null): Promise<void> {\n    const cache = this.cache\n    if (!cache) return\n    const tags = [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`]\n    if (organizationId) tags.push(`${DOMAIN_ROUTING_TAG}:org:${organizationId}`)\n    await Promise.allSettled([\n      cache.deleteByTags(tags),\n      runWithCacheTenant(null, () => cache.deleteByTags([`${DOMAIN_ROUTING_TAG}:${hostname}`])),\n    ])\n  }\n\n  private async runDnsVerification(\n    hostname: string,\n    expected: { expectedCname: string; expectedARecord: string | null },\n  ): Promise<\n    | {\n        ok: true\n        method: 'cname' | 'a-record' | 'reverse-resolve'\n        diagnostics: DnsDiagnostics\n      }\n    | { ok: false; reason: string; diagnostics: DnsDiagnostics }\n  > {\n    const detectedRecords: DnsDiagnostics['detectedRecords'] = []\n    const baseDiag = (overrides?: Partial<DnsDiagnostics>): DnsDiagnostics => ({\n      expectedCnameTarget: expected.expectedCname,\n      expectedARecordTarget: expected.expectedARecord,\n      detectedRecords,\n      suggestion: overrides?.suggestion ?? '',\n      reverseResolve: overrides?.reverseResolve,\n    })\n\n    // Phase 1: CNAME\n    let cnameRecords: string[] = []\n    try {\n      cnameRecords = await this.dns.resolveCname(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (CNAME): ${(err as Error).message}`,\n        diagnostics: baseDiag({\n          suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.',\n        }),\n      }\n    }\n    for (const cname of cnameRecords) detectedRecords.push({ type: 'CNAME', value: cname })\n\n    if (expected.expectedCname && cnameRecords.length > 0) {\n      const expectedCname = tryNormalizeHostname(expected.expectedCname) ?? expected.expectedCname.toLowerCase()\n      const match = cnameRecords.some((c) => (tryNormalizeHostname(c) ?? c.toLowerCase()) === expectedCname)\n      if (match) {\n        return {\n          ok: true,\n          method: 'cname',\n          diagnostics: baseDiag({\n            suggestion: 'CNAME record matches the expected target.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: `CNAME points to ${cnameRecords.join(', ')} instead of ${expected.expectedCname}`,\n        diagnostics: baseDiag({\n          suggestion: `Update your CNAME record to point to ${expected.expectedCname}.`,\n        }),\n      }\n    }\n\n    // Phase 2: A record\n    let aRecords: string[] = []\n    try {\n      aRecords = await this.dns.resolve4(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (A): ${(err as Error).message}`,\n        diagnostics: baseDiag({ suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.' }),\n      }\n    }\n    for (const a of aRecords) {\n      const proxy = detectProxy(a)\n      detectedRecords.push({ type: 'A', value: a, ...(proxy ? { proxy } : {}) })\n    }\n\n    if (aRecords.length === 0) {\n      return {\n        ok: false,\n        reason: `No CNAME or A record found for ${hostname}`,\n        diagnostics: baseDiag({\n          suggestion: expected.expectedARecord\n            ? `For a subdomain, add a CNAME record pointing to ${expected.expectedCname}. For an apex domain, add an A record pointing to ${expected.expectedARecord}. DNS propagation can take up to 48 hours.`\n            : `Add a CNAME record pointing to ${expected.expectedCname}. DNS propagation can take up to 48 hours.`,\n        }),\n      }\n    }\n\n    if (expected.expectedARecord && aRecords.includes(expected.expectedARecord)) {\n      return {\n        ok: true,\n        method: 'a-record',\n        diagnostics: baseDiag({ suggestion: 'A record matches the expected target.' }),\n      }\n    }\n\n    // Phase 3: reverse-resolve through proxy\n    const proxiedRecords = aRecords.filter((ip) => isInKnownProxyRange(ip))\n    if (proxiedRecords.length > 0) {\n      const probe = await this.healthCheckImpl(hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (probe.ok && probe.originHeaderPresent) {\n        return {\n          ok: true,\n          method: 'reverse-resolve',\n          diagnostics: baseDiag({\n            reverseResolve: { attempted: true, originHeaderPresent: true },\n            suggestion: 'Domain is proxied \u2014 reverse-resolve confirmed traffic reaches our origin.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: 'A record points to a known proxy IP, but reverse-resolve over HTTPS did not reach our server',\n        diagnostics: baseDiag({\n          reverseResolve: { attempted: true, originHeaderPresent: false },\n          suggestion: expected.expectedCname\n            ? `Your DNS uses a proxy. Either disable the proxy and add a CNAME \u2192 ${expected.expectedCname}, or configure your proxy to forward traffic to ${expected.expectedCname}.`\n            : 'Disable the DNS proxy or configure it to forward traffic to our platform.',\n        }),\n      }\n    }\n\n    return {\n      ok: false,\n      reason: expected.expectedARecord\n        ? `A record points to ${aRecords.join(', ')} instead of ${expected.expectedARecord}`\n        : `A record points to ${aRecords.join(', ')} but apex-domain registration is not enabled on this deployment`,\n      diagnostics: baseDiag({\n        suggestion: expected.expectedARecord\n          ? `Update your A record to point to ${expected.expectedARecord}.`\n          : `Apex-domain registration is not enabled on this deployment. Use a subdomain (e.g., shop.${hostname}) and add a CNAME pointing to ${expected.expectedCname}.`,\n      }),\n    }\n  }\n}\n\n// Re-exported for tests; allow injection of fakes.\nexport const __testing__ = {\n  DEFAULT_DNS_RECHECK_THRESHOLD_MS,\n  DEFAULT_TLS_MAX_RETRIES,\n  TLS_HEALTH_CHECK_RETRY_DELAYS_MS,\n  RESOLVE_TTL_MS,\n  DOMAIN_ROUTING_TAG,\n  defaultHealthCheck,\n  defaultDnsResolver,\n  Resolver,\n}\n"],
-  "mappings": "AAAA,SAAS,UAAU,YAAY,mBAAmB;AAClD,SAAS,WAAW,oBAAoB;AACxC,SAAS,cAAc,aAAa;AAEpC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,gCAAgC;AACzC,SAAS,uBAAuB;AAChC,SAAS,aAAa,2BAA2B;AAE1C,MAAM,mCAAmC,MAAM;AAAA,EACpD,YAAY,gBAAwB;AAClC,UAAM,6BAA6B,cAAc,yCAAyC;AAC1F,SAAK,OAAO;AAAA,EACd;AACF;AAEA,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iBAAiB,IAAI;AAC3B,MAAM,8BAA8B;AACpC,MAAM,mCAAmC,CAAC,KAAO,KAAO,IAAM;AAC9D,MAAM,mCAAmC,IAAI;AAC7C,MAAM,0BAA0B;AAgDhC,MAAM,qBAA0C;AAAA,EAC9C,MAAM,aAAa,UAAU;AAC3B,QAAI;AACF,aAAO,MAAM,YAAY,aAAa,QAAQ;AAAA,IAChD,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,SAAS,UAAU;AACvB,QAAI;AACF,aAAO,MAAM,YAAY,SAAS,QAAQ;AAAA,IAC5C,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,qBAA0C,CAAC,UAAU,cACzD,IAAI,QAAQ,CAAC,YAAY;AACvB,QAAM,cAAc,QAAQ,IAAI,iCAAiC,yBAAyB,YAAY;AACtG,QAAM,MAAM;AAAA,IACV;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,EAAE,yBAAyB,QAAQ,IAAI,uBAAuB,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX;AAAA,IACA,CAAC,QAAQ;AACP,YAAM,cAAc,IAAI,QAAQ,UAAU;AAC1C,YAAM,eAAe,MAAM,QAAQ,WAAW,IAAI,YAAY,CAAC,IAAI;AACnE,YAAM,sBAAsB,OAAO,iBAAiB,YAAY,iBAAiB;AACjF,YAAM,SAAS,IAAI,cAAc;AACjC,UAAI,OAAO;AACX,cAAQ;AAAA,QACN,IAAI,UAAU,OAAO,SAAS;AAAA,QAC9B;AAAA,QACA,QAAQ,UAAU,OAAO,SAAS,MAAM,SAAY,QAAQ,MAAM;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,GAAG,WAAW,MAAM;AACtB,QAAI,QAAQ,IAAI,MAAM,4BAA4B,CAAC;AAAA,EACrD,CAAC;AACD,MAAI,GAAG,SAAS,CAAC,QAAQ;AACvB,YAAQ,EAAE,IAAI,OAAO,qBAAqB,OAAO,QAAS,IAAc,QAAQ,CAAC;AAAA,EACnF,CAAC;AACD,MAAI,IAAI;AACV,CAAC;AAEI,MAAM,qBAAqB;AAAA,EAKhC,YACU,IACR,MAKA;AANQ;AAOR,SAAK,QAAQ,MAAM,gBAAgB;AACnC,SAAK,MAAM,MAAM,eAAe;AAChC,SAAK,kBAAkB,MAAM,eAAe;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,IAAY,OAA8D;AACvF,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,QAAQ,eAAe,KAAc;AAAA,EACtD;AAAA,EAEA,MAAM,mBACJ,gBACA,OAC0B;AAC1B,UAAM,QAAiC,EAAE,eAAe;AACxD,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,KAAK,eAAe,OAAgB,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,kBAAkB,OAA8C;AACpE,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AAEjD,UAAM,WAAW,GAAG,kBAAkB,IAAI,QAAQ;AAClD,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO;AACT,YAAM,SAAU,MAAM,mBAAmB,MAAM,MAAM,MAAM,IAAI,QAAQ,CAAC;AACxE,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,SAAS,MAAM,KAAK,oBAAoB,QAAQ;AACtD,QAAI,OAAO;AACT,YAAM,mBAAmB,MAAM,MAAM,MAAM,IAAI,UAAU,QAAQ;AAAA,QAC/D,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AAAA,MAChE,CAAC,CAAC;AAAA,IACJ;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,OAAiF;AACrG,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AACjD,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ,EAAE,KAAK,CAAC,UAAU,UAAU,EAAE;AAAA,IACxC,CAAU;AACV,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,EAAE,gBAAgB,IAAI,gBAAgB,QAAQ,IAAI,OAAO;AAAA,EAClE;AAAA,EAEA,MAAM,mBAAmB,gBAAoF;AAC3G,UAAM,WAAW,GAAG,wBAAwB,IAAI,cAAc;AAC9D,QAAI,KAAK,OAAO;AACd,YAAM,SAAU,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC7C,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ;AAAA,IACV,CAAU;AACV,UAAM,SAAS,MAAM,EAAE,UAAU,IAAI,UAAU,QAAQ,IAAI,OAAO,IAAI;AAEtE,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,MAAM,IAAI,UAAU,QAAQ;AAAA,QACrC,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAAA,MAC1E,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAuC;AAC3C,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,eAAe,EAAE,QAAQ,SAAS,CAAU;AAC5E,QAAI,KAAK,WAAW,EAAG,QAAO,CAAC;AAC/B,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACpE,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,cAAc,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,CAAU;AAC9E,UAAM,YAAY,IAAI,IAA2B,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;AAExF,WAAO,KAAK,IAAmB,CAAC,SAAS;AAAA,MACvC,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,UAAU,IAAI,IAAI,cAAc,KAAK;AAAA,MAC9C,QAAQ,IAAI;AAAA,IACd,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,wBAAwB,WAAgE;AAC5F,UAAM,YAAY,WAAW,eAAe;AAC5C,UAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;AAC9C,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,EAAE;AAAA,QACzC,KAAK,CAAC,EAAE,gBAAgB,KAAK,GAAG,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,CAAC;AAAA,MACrE;AAAA,MACA,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAiF;AACpG,UAAM,aAAa,SAAS,cAAc;AAC1C,UAAM,QAAQ,SAAS,aAAa;AACpC,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,KAAK;AAAA,UACH,EAAE,QAAQ,WAAW;AAAA,UACrB,EAAE,QAAQ,cAAc,eAAe,EAAE,KAAK,WAAW,EAAE;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,MAAM,GAAG,MAAM;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,OAA8C;AAC3D,UAAM,WAAW,kBAAkB,MAAM,QAAQ;AACjD,UAAM,eAAe,MAAM,yBAAyB,KAAK,IAAI,MAAM,gBAAgB,MAAM,QAAQ;AACjG,QAAI,CAAC,aAAc,OAAM,IAAI,2BAA2B,MAAM,cAAc;AAE5E,QAAI,iBAAuC;AAC3C,QAAI,MAAM,kBAAkB;AAC1B,uBAAiB,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB,CAAU;AAAA,IACZ;AAEA,UAAM,SAAS,KAAK,GAAG,OAAO,eAAe;AAAA,MAC3C;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAU;AACV,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AAEpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAmC;AAC9C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAE5D,UAAM,gBAAgB,QAAQ,IAAI,8BAA8B;AAChE,UAAM,kBAAkB,QAAQ,IAAI,iCAAiC;AACrE,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,iBAAiB;AAExB,UAAM,eAAe,MAAM,KAAK,mBAAmB,OAAO,UAAU;AAAA,MAClE;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,aAAa,IAAI;AACnB,aAAO,SAAS;AAChB,aAAO,aAAa;AACpB,aAAO,mBAAmB;AAC1B,aAAO,gBAAgB;AACvB,aAAO,mBAAmB;AAC1B,YAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,YAAM,0BAA0B,6CAA6C;AAAA,QAC3E,IAAI,OAAO;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,MACnB,CAAU;AACV,YAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,aAAO,EAAE,eAAe,OAAO;AAAA,IACjC;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,aAAa;AACvC,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,aAAa;AAAA,MACrB,iBAAiB,aAAa,YAAY;AAAA,IAC5C,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO,EAAE,eAAe,QAAQ,aAAa,aAAa,YAAY;AAAA,EACxE;AAAA,EAEA,MAAM,SAAS,IAAoC;AACjD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,qCAAqC,OAAO,MAAM,EAAE;AAAA,IACzF;AAEA,WAAO,SAAS;AAChB,WAAO,gBAAgB;AACvB,WAAO,mBAAmB;AAC1B,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,8CAA8C;AAAA,MAC5E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,IACnB,CAAU;AAEV,QAAI,OAAO,gBAAgB;AACzB,YAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAK,OAAO,eAA6C;AAAA,QACzD,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,MACzB,CAAU;AACV,UAAI,UAAU;AACZ,cAAM,mBAAmB,SAAS;AAClC,cAAM,cAAc,SAAS;AAC7B,aAAK,GAAG,OAAO,QAAQ;AACvB,cAAM,KAAK,GAAG,MAAM;AACpB,cAAM,0BAA0B,6CAA6C;AAAA,UAC3E,IAAI,OAAO;AAAA,UACX,UAAU,OAAO;AAAA,UACjB,gBAAgB,OAAO;AAAA,UACvB,UAAU,OAAO;AAAA,UACjB,kBAAkB,SAAS;AAAA,UAC3B;AAAA,QACF,CAAU;AACV,cAAM,0BAA0B,4CAA4C;AAAA,UAC1E,IAAI,SAAS;AAAA,UACb,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,UAAU,SAAS;AAAA,QACrB,CAAU;AACV,cAAM,KAAK,mBAAmB,kBAAkB,WAAW;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAY,OAA8C;AACrE,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,KAAc;AAClE,QAAI,CAAC,OAAQ;AAEb,UAAM,WAAW,OAAO;AACxB,UAAM,iBAAiB,OAAO;AAC9B,UAAM,WAAW,OAAO;AAExB,SAAK,GAAG,OAAO,MAAM;AACrB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAU;AACV,UAAM,KAAK,mBAAmB,UAAU,cAAc;AAAA,EACxD;AAAA,EAEA,MAAM,YAAY,IAAoC;AACpD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,wCAAwC,OAAO,MAAM,EAAE;AAAA,IAC5F;AAEA,QAAI,aAA4B;AAChC,aAAS,UAAU,GAAG,UAAU,iCAAiC,QAAQ,WAAW;AAClF,YAAM,SAAS,MAAM,KAAK,gBAAgB,OAAO,UAAU,2BAA2B;AACtF,UAAI,OAAO,IAAI;AACb,eAAO,KAAK,SAAS,OAAO,EAAE;AAAA,MAChC;AACA,mBAAa,OAAO,UAAU;AAC9B,UAAI,UAAU,IAAI,iCAAiC,QAAQ;AACzD,cAAM,MAAM,iCAAiC,OAAO,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,cAAc;AACxC,WAAO,iBAAiB,OAAO,iBAAiB,KAAK;AACrD,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO;AAAA,IACrB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBAAoB,UAAiD;AACjF,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,UAAU,QAAQ,SAAS,CAAU;AACxF,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,cAAc,EAAE,IAAI,IAAI,eAAe,CAAU;AACnF,WAAO;AAAA,MACL,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,KAAK,QAAQ;AAAA,MACtB,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,UAAkB,gBAA8C;AAC/F,UAAM,QAAQ,KAAK;AACnB,QAAI,CAAC,MAAO;AACZ,UAAM,OAAO,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AACrE,QAAI,eAAgB,MAAK,KAAK,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAC3E,UAAM,QAAQ,WAAW;AAAA,MACvB,MAAM,aAAa,IAAI;AAAA,MACvB,mBAAmB,MAAM,MAAM,MAAM,aAAa,CAAC,GAAG,kBAAkB,IAAI,QAAQ,EAAE,CAAC,CAAC;AAAA,IAC1F,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,mBACZ,UACA,UAQA;AACA,UAAM,kBAAqD,CAAC;AAC5D,UAAM,WAAW,CAAC,eAAyD;AAAA,MACzE,qBAAqB,SAAS;AAAA,MAC9B,uBAAuB,SAAS;AAAA,MAChC;AAAA,MACA,YAAY,WAAW,cAAc;AAAA,MACrC,gBAAgB,WAAW;AAAA,IAC7B;AAGA,QAAI,eAAyB,CAAC;AAC9B,QAAI;AACF,qBAAe,MAAM,KAAK,IAAI,aAAa,QAAQ;AAAA,IACrD,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,6BAA8B,IAAc,OAAO;AAAA,QAC3D,aAAa,SAAS;AAAA,UACpB,YAAY;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,SAAS,aAAc,iBAAgB,KAAK,EAAE,MAAM,SAAS,OAAO,MAAM,CAAC;AAEtF,QAAI,SAAS,iBAAiB,aAAa,SAAS,GAAG;AACrD,YAAM,gBAAgB,qBAAqB,SAAS,aAAa,KAAK,SAAS,cAAc,YAAY;AACzG,YAAM,QAAQ,aAAa,KAAK,CAAC,OAAO,qBAAqB,CAAC,KAAK,EAAE,YAAY,OAAO,aAAa;AACrG,UAAI,OAAO;AACT,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,mBAAmB,aAAa,KAAK,IAAI,CAAC,eAAe,SAAS,aAAa;AAAA,QACvF,aAAa,SAAS;AAAA,UACpB,YAAY,wCAAwC,SAAS,aAAa;AAAA,QAC5E,CAAC;AAAA,MACH;AAAA,IACF;AAGA,QAAI,WAAqB,CAAC;AAC1B,QAAI;AACF,iBAAW,MAAM,KAAK,IAAI,SAAS,QAAQ;AAAA,IAC7C,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,yBAA0B,IAAc,OAAO;AAAA,QACvD,aAAa,SAAS,EAAE,YAAY,8DAA8D,CAAC;AAAA,MACrG;AAAA,IACF;AACA,eAAW,KAAK,UAAU;AACxB,YAAM,QAAQ,YAAY,CAAC;AAC3B,sBAAgB,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAAA,IAC3E;AAEA,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,kCAAkC,QAAQ;AAAA,QAClD,aAAa,SAAS;AAAA,UACpB,YAAY,SAAS,kBACjB,mDAAmD,SAAS,aAAa,qDAAqD,SAAS,eAAe,+CACtJ,kCAAkC,SAAS,aAAa;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,SAAS,SAAS,SAAS,eAAe,GAAG;AAC3E,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS,EAAE,YAAY,wCAAwC,CAAC;AAAA,MAC/E;AAAA,IACF;AAGA,UAAM,iBAAiB,SAAS,OAAO,CAAC,OAAO,oBAAoB,EAAE,CAAC;AACtE,QAAI,eAAe,SAAS,GAAG;AAC7B,YAAM,QAAQ,MAAM,KAAK,gBAAgB,UAAU,2BAA2B;AAC9E,UAAI,MAAM,MAAM,MAAM,qBAAqB;AACzC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,KAAK;AAAA,YAC7D,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS;AAAA,UACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,MAAM;AAAA,UAC9D,YAAY,SAAS,gBACjB,0EAAqE,SAAS,aAAa,mDAAmD,SAAS,aAAa,MACpK;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,SAAS,kBACb,sBAAsB,SAAS,KAAK,IAAI,CAAC,eAAe,SAAS,eAAe,KAChF,sBAAsB,SAAS,KAAK,IAAI,CAAC;AAAA,MAC7C,aAAa,SAAS;AAAA,QACpB,YAAY,SAAS,kBACjB,oCAAoC,SAAS,eAAe,MAC5D,2FAA2F,QAAQ,iCAAiC,SAAS,aAAa;AAAA,MAChK,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,MAAM,cAAc;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["import { Resolver, promises as dnsPromises } from 'node:dns'\nimport { request as httpsRequest } from 'node:https'\nimport type { ClientRequest } from 'node:http'\nimport { resolveSafeHostAddress } from '@open-mercato/shared/lib/host-pinning'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\nimport { setTimeout as delay } from 'node:timers/promises'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  DomainMapping,\n  type DomainStatus,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { normalizeHostname, tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { findOrganizationInTenant } from '@open-mercato/core/modules/customer_accounts/lib/organizationLookup'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { detectProxy, isInKnownProxyRange } from '@open-mercato/core/modules/customer_accounts/lib/proxyRanges'\n\nexport class DomainMappingOrgScopeError extends Error {\n  constructor(organizationId: string) {\n    super(`[internal] organizationId ${organizationId} does not belong to the caller's tenant`)\n    this.name = 'DomainMappingOrgScopeError'\n  }\n}\n\nconst DOMAIN_ROUTING_TAG = 'domain_routing'\nconst RESOLVE_KEY_PREFIX = 'domain_routing:resolve'\nconst ACTIVE_BY_ORG_KEY_PREFIX = 'domain_routing:active-by-org'\nconst RESOLVE_TTL_MS = 5 * 60_000\nconst TLS_HEALTH_CHECK_TIMEOUT_MS = 10_000\nconst TLS_HEALTH_CHECK_RETRY_DELAYS_MS = [1_000, 4_000, 16_000]\nconst DEFAULT_DNS_RECHECK_THRESHOLD_MS = 5 * 60_000\nconst DEFAULT_TLS_MAX_RETRIES = 6\n\nexport type ResolveResult = {\n  domainMappingId: string\n  hostname: string\n  tenantId: string\n  organizationId: string\n  orgSlug: string | null\n  status: DomainStatus\n}\n\nexport type DnsDiagnostics = {\n  expectedCnameTarget: string\n  expectedARecordTarget: string | null\n  detectedRecords: Array<{ type: 'CNAME' | 'A'; value: string; proxy?: string }>\n  reverseResolve?: { attempted: boolean; originHeaderPresent: boolean }\n  suggestion: string\n}\n\nexport type VerifyResult = {\n  domainMapping: DomainMapping\n  diagnostics?: DnsDiagnostics\n}\n\nexport type RegisterInput = {\n  hostname: string\n  organizationId: string\n  tenantId: string\n  replacesDomainId?: string\n}\n\ntype CacheService = {\n  get(key: string, options?: unknown): Promise<unknown>\n  set(key: string, value: unknown, options?: { ttl?: number; tags?: string[] }): Promise<void>\n  deleteByTags(tags: string[]): Promise<number>\n}\n\ntype DnsResolverContract = {\n  resolveCname(hostname: string): Promise<string[]>\n  resolve4(hostname: string): Promise<string[]>\n}\n\ntype HealthCheckContract = (hostname: string, timeoutMs: number) => Promise<{\n  ok: boolean\n  originHeaderPresent: boolean\n  reason?: string\n}>\n\nconst defaultDnsResolver: DnsResolverContract = {\n  async resolveCname(hostname) {\n    try {\n      return await dnsPromises.resolveCname(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n  async resolve4(hostname) {\n    try {\n      return await dnsPromises.resolve4(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n}\n\nconst defaultHealthCheck: HealthCheckContract = (hostname, timeoutMs) =>\n  new Promise((resolve) => {\n    let req: ClientRequest | undefined\n    let settled = false\n    const failure = { ok: false, originHeaderPresent: false, reason: 'TLS health check failed' }\n    const finish = (result: Awaited<ReturnType<HealthCheckContract>>) => {\n      if (settled) return\n      settled = true\n      clearTimeout(deadline)\n      resolve(result)\n    }\n    const deadline = setTimeout(() => {\n      finish(failure)\n      req?.destroy()\n    }, timeoutMs)\n\n    void resolveSafeHostAddress(hostname).then(({ host }) => {\n      if (settled) return\n      const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin').toLowerCase()\n      req = httpsRequest(\n        {\n          host,\n          servername: hostname,\n          rejectUnauthorized: true,\n          agent: false,\n          port: 443,\n          path: '/api/customer_accounts/domain-check',\n          method: 'GET',\n          headers: { Host: hostname, 'X-Domain-Check-Secret': process.env.DOMAIN_CHECK_SECRET ?? '' },\n          timeout: timeoutMs,\n        },\n        (res) => {\n          const headerValue = res.headers[headerName]\n          const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue\n          const originHeaderPresent = typeof originHeader === 'string' && originHeader === '1'\n          const status = res.statusCode ?? 0\n          res.resume()\n          finish({\n            ok: status >= 200 && status < 400,\n            originHeaderPresent,\n            reason: status >= 200 && status < 400 ? undefined : `HTTP ${status}`,\n          })\n        },\n      )\n      req.on('timeout', () => {\n        finish(failure)\n        req?.destroy()\n      })\n      req.on('error', () => finish(failure))\n      req.end()\n    }).catch(() => {\n      getTelemetryRuntime()?.reportError(new Error('[internal] Domain TLS health check failed'), {\n        module: 'customer_accounts',\n        code: 'customer_accounts.domain_health_check_failed',\n      })\n      finish(failure)\n    })\n  })\n\nexport class DomainMappingService {\n  private cache: CacheService | null\n  private dns: DnsResolverContract\n  private healthCheckImpl: HealthCheckContract\n\n  constructor(\n    private em: EntityManager,\n    deps?: {\n      cacheService?: CacheService\n      dnsResolver?: DnsResolverContract\n      healthCheck?: HealthCheckContract\n    },\n  ) {\n    this.cache = deps?.cacheService ?? null\n    this.dns = deps?.dnsResolver ?? defaultDnsResolver\n    this.healthCheckImpl = deps?.healthCheck ?? defaultHealthCheck\n  }\n\n  // -------------------------------------------------------------------------\n  // Read paths\n  // -------------------------------------------------------------------------\n\n  async findById(id: string, scope?: { tenantId?: string }): Promise<DomainMapping | null> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.findOne(DomainMapping, where as never)\n  }\n\n  async findByOrganization(\n    organizationId: string,\n    scope?: { tenantId?: string },\n  ): Promise<DomainMapping[]> {\n    const where: Record<string, unknown> = { organizationId }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.find(DomainMapping, where as never, { orderBy: { createdAt: 'asc' } })\n  }\n\n  async resolveByHostname(input: string): Promise<ResolveResult | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n\n    const cacheKey = `${RESOLVE_KEY_PREFIX}:${hostname}`\n    const cache = this.cache\n    if (cache) {\n      const cached = (await runWithCacheTenant(null, () => cache.get(cacheKey))) as ResolveResult | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const result = await this.lookupResolveResult(hostname)\n    if (cache) {\n      await runWithCacheTenant(null, () => cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`],\n      }))\n    }\n    return result\n  }\n\n  async isAllowedForTls(input: string): Promise<{ organizationId: string; status: DomainStatus } | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n    const row = await this.em.findOne(DomainMapping, {\n      hostname,\n      status: { $in: ['active', 'verified'] },\n    } as never)\n    if (!row) return null\n    return { organizationId: row.organizationId, status: row.status }\n  }\n\n  async resolveActiveByOrg(organizationId: string): Promise<{ hostname: string; status: DomainStatus } | null> {\n    const cacheKey = `${ACTIVE_BY_ORG_KEY_PREFIX}:${organizationId}`\n    if (this.cache) {\n      const cached = (await this.cache.get(cacheKey)) as { hostname: string; status: DomainStatus } | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const row = await this.em.findOne(DomainMapping, {\n      organizationId,\n      status: 'active',\n    } as never)\n    const result = row ? { hostname: row.hostname, status: row.status } : null\n\n    if (this.cache) {\n      await this.cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:org:${organizationId}`],\n      })\n    }\n    return result\n  }\n\n  async resolveAll(): Promise<ResolveResult[]> {\n    const rows = await this.em.find(DomainMapping, { status: 'active' } as never)\n    if (rows.length === 0) return []\n    const orgIds = Array.from(new Set(rows.map((r) => r.organizationId)))\n    const orgs = await this.em.find(Organization, { id: { $in: orgIds } } as never)\n    const slugByOrg = new Map<string, string | null>(orgs.map((o) => [o.id, o.slug ?? null]))\n\n    return rows.map<ResolveResult>((row) => ({\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: slugByOrg.get(row.organizationId) ?? null,\n      status: row.status,\n    }))\n  }\n\n  // -------------------------------------------------------------------------\n  // Worker queries\n  // -------------------------------------------------------------------------\n\n  async findPendingVerification(threshold?: { olderThanMs?: number }): Promise<DomainMapping[]> {\n    const olderThan = threshold?.olderThanMs ?? DEFAULT_DNS_RECHECK_THRESHOLD_MS\n    const cutoff = new Date(Date.now() - olderThan)\n    return this.em.find(\n      DomainMapping,\n      {\n        status: { $in: ['pending', 'dns_failed'] },\n        $or: [{ lastDnsCheckAt: null }, { lastDnsCheckAt: { $lt: cutoff } }],\n      } as never,\n      { orderBy: { lastDnsCheckAt: 'asc' } },\n    )\n  }\n\n  async findPendingTls(options?: { maxRetries?: number; batchSize?: number }): Promise<DomainMapping[]> {\n    const maxRetries = options?.maxRetries ?? DEFAULT_TLS_MAX_RETRIES\n    const limit = options?.batchSize ?? 50\n    return this.em.find(\n      DomainMapping,\n      {\n        $or: [\n          { status: 'verified' },\n          { status: 'tls_failed', tlsRetryCount: { $lt: maxRetries } },\n        ],\n      } as never,\n      { orderBy: { updatedAt: 'asc' }, limit },\n    )\n  }\n\n  // -------------------------------------------------------------------------\n  // Write paths\n  // -------------------------------------------------------------------------\n\n  async register(input: RegisterInput): Promise<DomainMapping> {\n    const hostname = normalizeHostname(input.hostname)\n    const organization = await findOrganizationInTenant(this.em, input.organizationId, input.tenantId)\n    if (!organization) throw new DomainMappingOrgScopeError(input.organizationId)\n\n    let replacesDomain: DomainMapping | null = null\n    if (input.replacesDomainId) {\n      replacesDomain = await this.em.findOne(DomainMapping, {\n        id: input.replacesDomainId,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      } as never)\n    }\n\n    const entity = this.em.create(DomainMapping, {\n      hostname,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      replacesDomain: replacesDomain ?? null,\n      provider: 'traefik',\n      status: 'pending',\n      tlsRetryCount: 0,\n      createdAt: new Date(),\n    } as never)\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.created', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      status: entity.status,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n\n    return entity\n  }\n\n  async verify(id: string): Promise<VerifyResult> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n\n    const expectedCname = process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? ''\n    const expectedARecord = process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null\n    const now = new Date()\n    entity.lastDnsCheckAt = now\n\n    const verification = await this.runDnsVerification(entity.hostname, {\n      expectedCname,\n      expectedARecord,\n    })\n\n    if (verification.ok) {\n      entity.status = 'verified'\n      entity.verifiedAt = now\n      entity.dnsFailureReason = null\n      entity.tlsRetryCount = 0\n      entity.tlsFailureReason = null\n      await this.em.persist(entity).flush()\n      await emitCustomerAccountsEvent('customer_accounts.domain_mapping.verified', {\n        id: entity.id,\n        hostname: entity.hostname,\n        organizationId: entity.organizationId,\n        tenantId: entity.tenantId,\n      } as never)\n      await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n      return { domainMapping: entity }\n    }\n\n    entity.status = 'dns_failed'\n    entity.dnsFailureReason = verification.reason\n    await this.em.persist(entity).flush()\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.dns_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: verification.reason,\n      detectedRecords: verification.diagnostics.detectedRecords,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return { domainMapping: entity, diagnostics: verification.diagnostics }\n  }\n\n  async activate(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot transition to active from ${entity.status}`)\n    }\n\n    entity.status = 'active'\n    entity.tlsRetryCount = 0\n    entity.tlsFailureReason = null\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.activated', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n    } as never)\n\n    if (entity.replacesDomain) {\n      const replaced = await this.em.findOne(DomainMapping, {\n        id: (entity.replacesDomain as unknown as { id: string }).id,\n        tenantId: entity.tenantId,\n        organizationId: entity.organizationId,\n      } as never)\n      if (replaced) {\n        const replacedHostname = replaced.hostname\n        const replacedOrg = replaced.organizationId\n        this.em.remove(replaced)\n        await this.em.flush()\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.replaced', {\n          id: entity.id,\n          hostname: entity.hostname,\n          organizationId: entity.organizationId,\n          tenantId: entity.tenantId,\n          replacedDomainId: replaced.id,\n          replacedHostname,\n        } as never)\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n          id: replaced.id,\n          hostname: replacedHostname,\n          organizationId: replacedOrg,\n          tenantId: replaced.tenantId,\n        } as never)\n        await this.invalidateCacheFor(replacedHostname, replacedOrg)\n      }\n    }\n\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  async remove(id: string, scope?: { tenantId?: string }): Promise<void> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    const entity = await this.em.findOne(DomainMapping, where as never)\n    if (!entity) return\n\n    const hostname = entity.hostname\n    const organizationId = entity.organizationId\n    const tenantId = entity.tenantId\n\n    this.em.remove(entity)\n    await this.em.flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n      id,\n      hostname,\n      organizationId,\n      tenantId,\n    } as never)\n    await this.invalidateCacheFor(hostname, organizationId)\n  }\n\n  async healthCheck(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot run health check from status ${entity.status}`)\n    }\n\n    let lastReason: string | null = null\n    for (let attempt = 0; attempt < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length; attempt++) {\n      const result = await this.healthCheckImpl(entity.hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (result.ok) {\n        return this.activate(entity.id)\n      }\n      lastReason = result.reason ?? 'TLS health check failed'\n      if (attempt + 1 < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length) {\n        await delay(TLS_HEALTH_CHECK_RETRY_DELAYS_MS[attempt])\n      }\n    }\n\n    entity.status = 'tls_failed'\n    entity.tlsFailureReason = lastReason ?? 'TLS health check failed'\n    entity.tlsRetryCount = (entity.tlsRetryCount ?? 0) + 1\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.tls_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: entity.tlsFailureReason,\n      retryCount: entity.tlsRetryCount,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  // -------------------------------------------------------------------------\n  // Internals\n  // -------------------------------------------------------------------------\n\n  private async lookupResolveResult(hostname: string): Promise<ResolveResult | null> {\n    const row = await this.em.findOne(DomainMapping, { hostname, status: 'active' } as never)\n    if (!row) return null\n    const org = await this.em.findOne(Organization, { id: row.organizationId } as never)\n    return {\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: org?.slug ?? null,\n      status: row.status,\n    }\n  }\n\n  private async invalidateCacheFor(hostname: string, organizationId: string | null): Promise<void> {\n    const cache = this.cache\n    if (!cache) return\n    const tags = [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`]\n    if (organizationId) tags.push(`${DOMAIN_ROUTING_TAG}:org:${organizationId}`)\n    await Promise.allSettled([\n      cache.deleteByTags(tags),\n      runWithCacheTenant(null, () => cache.deleteByTags([`${DOMAIN_ROUTING_TAG}:${hostname}`])),\n    ])\n  }\n\n  private async runDnsVerification(\n    hostname: string,\n    expected: { expectedCname: string; expectedARecord: string | null },\n  ): Promise<\n    | {\n        ok: true\n        method: 'cname' | 'a-record' | 'reverse-resolve'\n        diagnostics: DnsDiagnostics\n      }\n    | { ok: false; reason: string; diagnostics: DnsDiagnostics }\n  > {\n    const detectedRecords: DnsDiagnostics['detectedRecords'] = []\n    const baseDiag = (overrides?: Partial<DnsDiagnostics>): DnsDiagnostics => ({\n      expectedCnameTarget: expected.expectedCname,\n      expectedARecordTarget: expected.expectedARecord,\n      detectedRecords,\n      suggestion: overrides?.suggestion ?? '',\n      reverseResolve: overrides?.reverseResolve,\n    })\n\n    // Phase 1: CNAME\n    let cnameRecords: string[] = []\n    try {\n      cnameRecords = await this.dns.resolveCname(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (CNAME): ${(err as Error).message}`,\n        diagnostics: baseDiag({\n          suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.',\n        }),\n      }\n    }\n    for (const cname of cnameRecords) detectedRecords.push({ type: 'CNAME', value: cname })\n\n    if (expected.expectedCname && cnameRecords.length > 0) {\n      const expectedCname = tryNormalizeHostname(expected.expectedCname) ?? expected.expectedCname.toLowerCase()\n      const match = cnameRecords.some((c) => (tryNormalizeHostname(c) ?? c.toLowerCase()) === expectedCname)\n      if (match) {\n        return {\n          ok: true,\n          method: 'cname',\n          diagnostics: baseDiag({\n            suggestion: 'CNAME record matches the expected target.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: `CNAME points to ${cnameRecords.join(', ')} instead of ${expected.expectedCname}`,\n        diagnostics: baseDiag({\n          suggestion: `Update your CNAME record to point to ${expected.expectedCname}.`,\n        }),\n      }\n    }\n\n    // Phase 2: A record\n    let aRecords: string[] = []\n    try {\n      aRecords = await this.dns.resolve4(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (A): ${(err as Error).message}`,\n        diagnostics: baseDiag({ suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.' }),\n      }\n    }\n    for (const a of aRecords) {\n      const proxy = detectProxy(a)\n      detectedRecords.push({ type: 'A', value: a, ...(proxy ? { proxy } : {}) })\n    }\n\n    if (aRecords.length === 0) {\n      return {\n        ok: false,\n        reason: `No CNAME or A record found for ${hostname}`,\n        diagnostics: baseDiag({\n          suggestion: expected.expectedARecord\n            ? `For a subdomain, add a CNAME record pointing to ${expected.expectedCname}. For an apex domain, add an A record pointing to ${expected.expectedARecord}. DNS propagation can take up to 48 hours.`\n            : `Add a CNAME record pointing to ${expected.expectedCname}. DNS propagation can take up to 48 hours.`,\n        }),\n      }\n    }\n\n    if (expected.expectedARecord && aRecords.includes(expected.expectedARecord)) {\n      return {\n        ok: true,\n        method: 'a-record',\n        diagnostics: baseDiag({ suggestion: 'A record matches the expected target.' }),\n      }\n    }\n\n    // Phase 3: reverse-resolve through proxy\n    const proxiedRecords = aRecords.filter((ip) => isInKnownProxyRange(ip))\n    if (proxiedRecords.length > 0) {\n      const probe = await this.healthCheckImpl(hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (probe.ok && probe.originHeaderPresent) {\n        return {\n          ok: true,\n          method: 'reverse-resolve',\n          diagnostics: baseDiag({\n            reverseResolve: { attempted: true, originHeaderPresent: true },\n            suggestion: 'Domain is proxied \u2014 reverse-resolve confirmed traffic reaches our origin.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: 'A record points to a known proxy IP, but reverse-resolve over HTTPS did not reach our server',\n        diagnostics: baseDiag({\n          reverseResolve: { attempted: true, originHeaderPresent: false },\n          suggestion: expected.expectedCname\n            ? `Your DNS uses a proxy. Either disable the proxy and add a CNAME \u2192 ${expected.expectedCname}, or configure your proxy to forward traffic to ${expected.expectedCname}.`\n            : 'Disable the DNS proxy or configure it to forward traffic to our platform.',\n        }),\n      }\n    }\n\n    return {\n      ok: false,\n      reason: expected.expectedARecord\n        ? `A record points to ${aRecords.join(', ')} instead of ${expected.expectedARecord}`\n        : `A record points to ${aRecords.join(', ')} but apex-domain registration is not enabled on this deployment`,\n      diagnostics: baseDiag({\n        suggestion: expected.expectedARecord\n          ? `Update your A record to point to ${expected.expectedARecord}.`\n          : `Apex-domain registration is not enabled on this deployment. Use a subdomain (e.g., shop.${hostname}) and add a CNAME pointing to ${expected.expectedCname}.`,\n      }),\n    }\n  }\n}\n\n// Re-exported for tests; allow injection of fakes.\nexport const __testing__ = {\n  DEFAULT_DNS_RECHECK_THRESHOLD_MS,\n  DEFAULT_TLS_MAX_RETRIES,\n  TLS_HEALTH_CHECK_RETRY_DELAYS_MS,\n  RESOLVE_TTL_MS,\n  DOMAIN_ROUTING_TAG,\n  defaultHealthCheck,\n  defaultDnsResolver,\n  Resolver,\n}\n"],
+  "mappings": "AAAA,SAAS,UAAU,YAAY,mBAAmB;AAClD,SAAS,WAAW,oBAAoB;AAExC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,cAAc,aAAa;AAEpC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,gCAAgC;AACzC,SAAS,uBAAuB;AAChC,SAAS,aAAa,2BAA2B;AAE1C,MAAM,mCAAmC,MAAM;AAAA,EACpD,YAAY,gBAAwB;AAClC,UAAM,6BAA6B,cAAc,yCAAyC;AAC1F,SAAK,OAAO;AAAA,EACd;AACF;AAEA,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iBAAiB,IAAI;AAC3B,MAAM,8BAA8B;AACpC,MAAM,mCAAmC,CAAC,KAAO,KAAO,IAAM;AAC9D,MAAM,mCAAmC,IAAI;AAC7C,MAAM,0BAA0B;AAgDhC,MAAM,qBAA0C;AAAA,EAC9C,MAAM,aAAa,UAAU;AAC3B,QAAI;AACF,aAAO,MAAM,YAAY,aAAa,QAAQ;AAAA,IAChD,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,SAAS,UAAU;AACvB,QAAI;AACF,aAAO,MAAM,YAAY,SAAS,QAAQ;AAAA,IAC5C,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,qBAA0C,CAAC,UAAU,cACzD,IAAI,QAAQ,CAAC,YAAY;AACvB,MAAI;AACJ,MAAI,UAAU;AACd,QAAM,UAAU,EAAE,IAAI,OAAO,qBAAqB,OAAO,QAAQ,0BAA0B;AAC3F,QAAM,SAAS,CAAC,WAAqD;AACnE,QAAI,QAAS;AACb,cAAU;AACV,iBAAa,QAAQ;AACrB,YAAQ,MAAM;AAAA,EAChB;AACA,QAAM,WAAW,WAAW,MAAM;AAChC,WAAO,OAAO;AACd,SAAK,QAAQ;AAAA,EACf,GAAG,SAAS;AAEZ,OAAK,uBAAuB,QAAQ,EAAE,KAAK,CAAC,EAAE,KAAK,MAAM;AACvD,QAAI,QAAS;AACb,UAAM,cAAc,QAAQ,IAAI,iCAAiC,yBAAyB,YAAY;AACtG,UAAM;AAAA,MACJ;AAAA,QACE;AAAA,QACA,YAAY;AAAA,QACZ,oBAAoB;AAAA,QACpB,OAAO;AAAA,QACP,MAAM;AAAA,QACN,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS,EAAE,MAAM,UAAU,yBAAyB,QAAQ,IAAI,uBAAuB,GAAG;AAAA,QAC1F,SAAS;AAAA,MACX;AAAA,MACA,CAAC,QAAQ;AACP,cAAM,cAAc,IAAI,QAAQ,UAAU;AAC1C,cAAM,eAAe,MAAM,QAAQ,WAAW,IAAI,YAAY,CAAC,IAAI;AACnE,cAAM,sBAAsB,OAAO,iBAAiB,YAAY,iBAAiB;AACjF,cAAM,SAAS,IAAI,cAAc;AACjC,YAAI,OAAO;AACX,eAAO;AAAA,UACL,IAAI,UAAU,OAAO,SAAS;AAAA,UAC9B;AAAA,UACA,QAAQ,UAAU,OAAO,SAAS,MAAM,SAAY,QAAQ,MAAM;AAAA,QACpE,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,GAAG,WAAW,MAAM;AACtB,aAAO,OAAO;AACd,WAAK,QAAQ;AAAA,IACf,CAAC;AACD,QAAI,GAAG,SAAS,MAAM,OAAO,OAAO,CAAC;AACrC,QAAI,IAAI;AAAA,EACV,CAAC,EAAE,MAAM,MAAM;AACb,wBAAoB,GAAG,YAAY,IAAI,MAAM,2CAA2C,GAAG;AAAA,MACzF,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,OAAO;AAAA,EAChB,CAAC;AACH,CAAC;AAEI,MAAM,qBAAqB;AAAA,EAKhC,YACU,IACR,MAKA;AANQ;AAOR,SAAK,QAAQ,MAAM,gBAAgB;AACnC,SAAK,MAAM,MAAM,eAAe;AAChC,SAAK,kBAAkB,MAAM,eAAe;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,IAAY,OAA8D;AACvF,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,QAAQ,eAAe,KAAc;AAAA,EACtD;AAAA,EAEA,MAAM,mBACJ,gBACA,OAC0B;AAC1B,UAAM,QAAiC,EAAE,eAAe;AACxD,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,KAAK,eAAe,OAAgB,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,kBAAkB,OAA8C;AACpE,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AAEjD,UAAM,WAAW,GAAG,kBAAkB,IAAI,QAAQ;AAClD,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO;AACT,YAAM,SAAU,MAAM,mBAAmB,MAAM,MAAM,MAAM,IAAI,QAAQ,CAAC;AACxE,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,SAAS,MAAM,KAAK,oBAAoB,QAAQ;AACtD,QAAI,OAAO;AACT,YAAM,mBAAmB,MAAM,MAAM,MAAM,IAAI,UAAU,QAAQ;AAAA,QAC/D,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AAAA,MAChE,CAAC,CAAC;AAAA,IACJ;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,OAAiF;AACrG,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AACjD,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ,EAAE,KAAK,CAAC,UAAU,UAAU,EAAE;AAAA,IACxC,CAAU;AACV,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,EAAE,gBAAgB,IAAI,gBAAgB,QAAQ,IAAI,OAAO;AAAA,EAClE;AAAA,EAEA,MAAM,mBAAmB,gBAAoF;AAC3G,UAAM,WAAW,GAAG,wBAAwB,IAAI,cAAc;AAC9D,QAAI,KAAK,OAAO;AACd,YAAM,SAAU,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC7C,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ;AAAA,IACV,CAAU;AACV,UAAM,SAAS,MAAM,EAAE,UAAU,IAAI,UAAU,QAAQ,IAAI,OAAO,IAAI;AAEtE,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,MAAM,IAAI,UAAU,QAAQ;AAAA,QACrC,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAAA,MAC1E,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAuC;AAC3C,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,eAAe,EAAE,QAAQ,SAAS,CAAU;AAC5E,QAAI,KAAK,WAAW,EAAG,QAAO,CAAC;AAC/B,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACpE,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,cAAc,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,CAAU;AAC9E,UAAM,YAAY,IAAI,IAA2B,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;AAExF,WAAO,KAAK,IAAmB,CAAC,SAAS;AAAA,MACvC,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,UAAU,IAAI,IAAI,cAAc,KAAK;AAAA,MAC9C,QAAQ,IAAI;AAAA,IACd,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,wBAAwB,WAAgE;AAC5F,UAAM,YAAY,WAAW,eAAe;AAC5C,UAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;AAC9C,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,EAAE;AAAA,QACzC,KAAK,CAAC,EAAE,gBAAgB,KAAK,GAAG,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,CAAC;AAAA,MACrE;AAAA,MACA,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAiF;AACpG,UAAM,aAAa,SAAS,cAAc;AAC1C,UAAM,QAAQ,SAAS,aAAa;AACpC,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,KAAK;AAAA,UACH,EAAE,QAAQ,WAAW;AAAA,UACrB,EAAE,QAAQ,cAAc,eAAe,EAAE,KAAK,WAAW,EAAE;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,MAAM,GAAG,MAAM;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,OAA8C;AAC3D,UAAM,WAAW,kBAAkB,MAAM,QAAQ;AACjD,UAAM,eAAe,MAAM,yBAAyB,KAAK,IAAI,MAAM,gBAAgB,MAAM,QAAQ;AACjG,QAAI,CAAC,aAAc,OAAM,IAAI,2BAA2B,MAAM,cAAc;AAE5E,QAAI,iBAAuC;AAC3C,QAAI,MAAM,kBAAkB;AAC1B,uBAAiB,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB,CAAU;AAAA,IACZ;AAEA,UAAM,SAAS,KAAK,GAAG,OAAO,eAAe;AAAA,MAC3C;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAU;AACV,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AAEpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAmC;AAC9C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAE5D,UAAM,gBAAgB,QAAQ,IAAI,8BAA8B;AAChE,UAAM,kBAAkB,QAAQ,IAAI,iCAAiC;AACrE,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,iBAAiB;AAExB,UAAM,eAAe,MAAM,KAAK,mBAAmB,OAAO,UAAU;AAAA,MAClE;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,aAAa,IAAI;AACnB,aAAO,SAAS;AAChB,aAAO,aAAa;AACpB,aAAO,mBAAmB;AAC1B,aAAO,gBAAgB;AACvB,aAAO,mBAAmB;AAC1B,YAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,YAAM,0BAA0B,6CAA6C;AAAA,QAC3E,IAAI,OAAO;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,MACnB,CAAU;AACV,YAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,aAAO,EAAE,eAAe,OAAO;AAAA,IACjC;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,aAAa;AACvC,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,aAAa;AAAA,MACrB,iBAAiB,aAAa,YAAY;AAAA,IAC5C,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO,EAAE,eAAe,QAAQ,aAAa,aAAa,YAAY;AAAA,EACxE;AAAA,EAEA,MAAM,SAAS,IAAoC;AACjD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,qCAAqC,OAAO,MAAM,EAAE;AAAA,IACzF;AAEA,WAAO,SAAS;AAChB,WAAO,gBAAgB;AACvB,WAAO,mBAAmB;AAC1B,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,8CAA8C;AAAA,MAC5E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,IACnB,CAAU;AAEV,QAAI,OAAO,gBAAgB;AACzB,YAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAK,OAAO,eAA6C;AAAA,QACzD,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,MACzB,CAAU;AACV,UAAI,UAAU;AACZ,cAAM,mBAAmB,SAAS;AAClC,cAAM,cAAc,SAAS;AAC7B,aAAK,GAAG,OAAO,QAAQ;AACvB,cAAM,KAAK,GAAG,MAAM;AACpB,cAAM,0BAA0B,6CAA6C;AAAA,UAC3E,IAAI,OAAO;AAAA,UACX,UAAU,OAAO;AAAA,UACjB,gBAAgB,OAAO;AAAA,UACvB,UAAU,OAAO;AAAA,UACjB,kBAAkB,SAAS;AAAA,UAC3B;AAAA,QACF,CAAU;AACV,cAAM,0BAA0B,4CAA4C;AAAA,UAC1E,IAAI,SAAS;AAAA,UACb,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,UAAU,SAAS;AAAA,QACrB,CAAU;AACV,cAAM,KAAK,mBAAmB,kBAAkB,WAAW;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAY,OAA8C;AACrE,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,KAAc;AAClE,QAAI,CAAC,OAAQ;AAEb,UAAM,WAAW,OAAO;AACxB,UAAM,iBAAiB,OAAO;AAC9B,UAAM,WAAW,OAAO;AAExB,SAAK,GAAG,OAAO,MAAM;AACrB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAU;AACV,UAAM,KAAK,mBAAmB,UAAU,cAAc;AAAA,EACxD;AAAA,EAEA,MAAM,YAAY,IAAoC;AACpD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,wCAAwC,OAAO,MAAM,EAAE;AAAA,IAC5F;AAEA,QAAI,aAA4B;AAChC,aAAS,UAAU,GAAG,UAAU,iCAAiC,QAAQ,WAAW;AAClF,YAAM,SAAS,MAAM,KAAK,gBAAgB,OAAO,UAAU,2BAA2B;AACtF,UAAI,OAAO,IAAI;AACb,eAAO,KAAK,SAAS,OAAO,EAAE;AAAA,MAChC;AACA,mBAAa,OAAO,UAAU;AAC9B,UAAI,UAAU,IAAI,iCAAiC,QAAQ;AACzD,cAAM,MAAM,iCAAiC,OAAO,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,cAAc;AACxC,WAAO,iBAAiB,OAAO,iBAAiB,KAAK;AACrD,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO;AAAA,IACrB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBAAoB,UAAiD;AACjF,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,UAAU,QAAQ,SAAS,CAAU;AACxF,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,cAAc,EAAE,IAAI,IAAI,eAAe,CAAU;AACnF,WAAO;AAAA,MACL,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,KAAK,QAAQ;AAAA,MACtB,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,UAAkB,gBAA8C;AAC/F,UAAM,QAAQ,KAAK;AACnB,QAAI,CAAC,MAAO;AACZ,UAAM,OAAO,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AACrE,QAAI,eAAgB,MAAK,KAAK,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAC3E,UAAM,QAAQ,WAAW;AAAA,MACvB,MAAM,aAAa,IAAI;AAAA,MACvB,mBAAmB,MAAM,MAAM,MAAM,aAAa,CAAC,GAAG,kBAAkB,IAAI,QAAQ,EAAE,CAAC,CAAC;AAAA,IAC1F,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,mBACZ,UACA,UAQA;AACA,UAAM,kBAAqD,CAAC;AAC5D,UAAM,WAAW,CAAC,eAAyD;AAAA,MACzE,qBAAqB,SAAS;AAAA,MAC9B,uBAAuB,SAAS;AAAA,MAChC;AAAA,MACA,YAAY,WAAW,cAAc;AAAA,MACrC,gBAAgB,WAAW;AAAA,IAC7B;AAGA,QAAI,eAAyB,CAAC;AAC9B,QAAI;AACF,qBAAe,MAAM,KAAK,IAAI,aAAa,QAAQ;AAAA,IACrD,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,6BAA8B,IAAc,OAAO;AAAA,QAC3D,aAAa,SAAS;AAAA,UACpB,YAAY;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,SAAS,aAAc,iBAAgB,KAAK,EAAE,MAAM,SAAS,OAAO,MAAM,CAAC;AAEtF,QAAI,SAAS,iBAAiB,aAAa,SAAS,GAAG;AACrD,YAAM,gBAAgB,qBAAqB,SAAS,aAAa,KAAK,SAAS,cAAc,YAAY;AACzG,YAAM,QAAQ,aAAa,KAAK,CAAC,OAAO,qBAAqB,CAAC,KAAK,EAAE,YAAY,OAAO,aAAa;AACrG,UAAI,OAAO;AACT,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,mBAAmB,aAAa,KAAK,IAAI,CAAC,eAAe,SAAS,aAAa;AAAA,QACvF,aAAa,SAAS;AAAA,UACpB,YAAY,wCAAwC,SAAS,aAAa;AAAA,QAC5E,CAAC;AAAA,MACH;AAAA,IACF;AAGA,QAAI,WAAqB,CAAC;AAC1B,QAAI;AACF,iBAAW,MAAM,KAAK,IAAI,SAAS,QAAQ;AAAA,IAC7C,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,yBAA0B,IAAc,OAAO;AAAA,QACvD,aAAa,SAAS,EAAE,YAAY,8DAA8D,CAAC;AAAA,MACrG;AAAA,IACF;AACA,eAAW,KAAK,UAAU;AACxB,YAAM,QAAQ,YAAY,CAAC;AAC3B,sBAAgB,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAAA,IAC3E;AAEA,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,kCAAkC,QAAQ;AAAA,QAClD,aAAa,SAAS;AAAA,UACpB,YAAY,SAAS,kBACjB,mDAAmD,SAAS,aAAa,qDAAqD,SAAS,eAAe,+CACtJ,kCAAkC,SAAS,aAAa;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,SAAS,SAAS,SAAS,eAAe,GAAG;AAC3E,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS,EAAE,YAAY,wCAAwC,CAAC;AAAA,MAC/E;AAAA,IACF;AAGA,UAAM,iBAAiB,SAAS,OAAO,CAAC,OAAO,oBAAoB,EAAE,CAAC;AACtE,QAAI,eAAe,SAAS,GAAG;AAC7B,YAAM,QAAQ,MAAM,KAAK,gBAAgB,UAAU,2BAA2B;AAC9E,UAAI,MAAM,MAAM,MAAM,qBAAqB;AACzC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,KAAK;AAAA,YAC7D,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS;AAAA,UACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,MAAM;AAAA,UAC9D,YAAY,SAAS,gBACjB,0EAAqE,SAAS,aAAa,mDAAmD,SAAS,aAAa,MACpK;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,SAAS,kBACb,sBAAsB,SAAS,KAAK,IAAI,CAAC,eAAe,SAAS,eAAe,KAChF,sBAAsB,SAAS,KAAK,IAAI,CAAC;AAAA,MAC7C,aAAa,SAAS;AAAA,QACpB,YAAY,SAAS,kBACjB,oCAAoC,SAAS,eAAe,MAC5D,2FAA2F,QAAQ,iCAAiC,SAAS,aAAa;AAAA,MAChK,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,MAAM,cAAc;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/modules/customers/components/detail/ActivitiesSection.js

@@ -60,8 +60,12 @@ function sortTimelineActivities(items) {
       if (leftScheduled === rightScheduled) return left.id.localeCompare(right.id);
       return leftScheduled - rightScheduled;
     }
-    const leftTime = left.occurredAt ?? left.createdAt;
-    const rightTime = right.occurredAt ?? right.createdAt;
+    const leftTime = left.occurredAt ?? left.scheduledAt ?? null;
+    const rightTime = right.occurredAt ?? right.scheduledAt ?? null;
+    if (!leftTime || !rightTime) {
+      if (leftTime !== rightTime) return leftTime ? -1 : 1;
+      return right.id.localeCompare(left.id);
+    }
     const compare = rightTime.localeCompare(leftTime);
     if (compare !== 0) return compare;
     return right.id.localeCompare(left.id);
@@ -185,7 +189,8 @@ function ActivitiesSection({
       }
       const legacyFiltered = legacyItems.filter((entry) => {
         if (filterTypes.length > 0 && !filterTypes.includes(entry.interactionType)) return false;
-        const dateOnly = toDateOnly(entry.occurredAt ?? entry.createdAt);
+        const dateOnly = toDateOnly(entry.occurredAt ?? entry.scheduledAt);
+        if ((filterDateFrom || filterDateTo) && !dateOnly) return false;
         if (filterDateFrom && dateOnly < filterDateFrom) return false;
         if (filterDateTo && dateOnly > filterDateTo) return false;
         return true;