@open-mercato/core 0.5.1-develop.2663.2c29774b5b → 0.5.1-develop.2681.c559bb2bc3

package/dist/modules/audit_logs/lib/projections.js

@@ -0,0 +1,58 @@
+import { extractChangeRows, isRecord } from "./changeRows.js";
+const ACTION_LOG_FILTER_TYPES = ["create", "edit", "delete", "assign"];
+const ACTION_LOG_PROJECTION_TYPES = [...ACTION_LOG_FILTER_TYPES, "system"];
+const ACTION_LOG_SOURCE_KEYS = ["ui", "api", "system"];
+function normalizeText(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function deriveActionLogActionType(input) {
+  const normalizedCommandId = normalizeText(input.commandId);
+  const normalizedLabel = normalizeText(input.actionLabel);
+  if (normalizedCommandId.endsWith(".create") || normalizedCommandId.endsWith(".add") || normalizedLabel.includes("create") || normalizedLabel.includes("add")) {
+    return "create";
+  }
+  if (normalizedCommandId.endsWith(".delete") || normalizedCommandId.endsWith(".remove") || normalizedLabel.includes("delete") || normalizedLabel.includes("remove")) {
+    return "delete";
+  }
+  if (normalizedCommandId.endsWith(".assign") || normalizedCommandId.endsWith(".unassign") || normalizedLabel.includes("assign") || normalizedLabel.includes("unassign")) {
+    return "assign";
+  }
+  if (normalizedCommandId.endsWith(".update") || normalizedCommandId.endsWith(".edit") || normalizedCommandId.endsWith(".upsert") || normalizedLabel.includes("update") || normalizedLabel.includes("edit") || normalizedLabel.includes("upsert")) {
+    return "edit";
+  }
+  return "system";
+}
+function deriveActionLogSource(context, actorUserId) {
+  const rawSource = isRecord(context) ? context.source : void 0;
+  const normalizedSource = typeof rawSource === "string" ? rawSource.trim().toLowerCase() : "";
+  if (normalizedSource === "api") return "api";
+  if (normalizedSource === "system") return "system";
+  if (normalizedSource === "ui") return "ui";
+  return actorUserId ? "ui" : "system";
+}
+function deriveActionLogChangedFields(changes, snapshotBefore) {
+  return Array.from(
+    new Set(
+      extractChangeRows(changes, snapshotBefore).map((entry) => entry.field).filter((value) => typeof value === "string" && value.trim().length > 0)
+    )
+  ).sort((left, right) => left.localeCompare(right));
+}
+function deriveActionLogProjection(input) {
+  const changedFields = deriveActionLogChangedFields(input.changes, input.snapshotBefore);
+  return {
+    actionType: deriveActionLogActionType(input),
+    changedFields,
+    primaryChangedField: changedFields[0] ?? null,
+    sourceKey: deriveActionLogSource(input.context, input.actorUserId)
+  };
+}
+export {
+  ACTION_LOG_FILTER_TYPES,
+  ACTION_LOG_PROJECTION_TYPES,
+  ACTION_LOG_SOURCE_KEYS,
+  deriveActionLogActionType,
+  deriveActionLogChangedFields,
+  deriveActionLogProjection,
+  deriveActionLogSource
+};
+//# sourceMappingURL=projections.js.map

package/dist/modules/audit_logs/lib/projections.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/audit_logs/lib/projections.ts"],
+  "sourcesContent": ["import { extractChangeRows, isRecord } from './changeRows'\n\nexport const ACTION_LOG_FILTER_TYPES = ['create', 'edit', 'delete', 'assign'] as const\nexport const ACTION_LOG_PROJECTION_TYPES = [...ACTION_LOG_FILTER_TYPES, 'system'] as const\nexport const ACTION_LOG_SOURCE_KEYS = ['ui', 'api', 'system'] as const\n\nexport type ActionLogFilterType = (typeof ACTION_LOG_FILTER_TYPES)[number]\nexport type ActionLogProjectionType = (typeof ACTION_LOG_PROJECTION_TYPES)[number]\nexport type ActionLogSourceKey = (typeof ACTION_LOG_SOURCE_KEYS)[number]\n\ntype ProjectionInput = {\n  actorUserId?: string | null\n  actionLabel?: string | null\n  changes?: Record<string, unknown> | null\n  commandId: string\n  context?: Record<string, unknown> | null\n  snapshotBefore?: unknown\n}\n\nfunction normalizeText(value: string | null | undefined): string {\n  return (value ?? '').trim().toLowerCase()\n}\n\nexport function deriveActionLogActionType(input: Pick<ProjectionInput, 'actionLabel' | 'commandId'>): ActionLogProjectionType {\n  const normalizedCommandId = normalizeText(input.commandId)\n  const normalizedLabel = normalizeText(input.actionLabel)\n\n  if (\n    normalizedCommandId.endsWith('.create') ||\n    normalizedCommandId.endsWith('.add') ||\n    normalizedLabel.includes('create') ||\n    normalizedLabel.includes('add')\n  ) {\n    return 'create'\n  }\n\n  if (\n    normalizedCommandId.endsWith('.delete') ||\n    normalizedCommandId.endsWith('.remove') ||\n    normalizedLabel.includes('delete') ||\n    normalizedLabel.includes('remove')\n  ) {\n    return 'delete'\n  }\n\n  if (\n    normalizedCommandId.endsWith('.assign') ||\n    normalizedCommandId.endsWith('.unassign') ||\n    normalizedLabel.includes('assign') ||\n    normalizedLabel.includes('unassign')\n  ) {\n    return 'assign'\n  }\n\n  if (\n    normalizedCommandId.endsWith('.update') ||\n    normalizedCommandId.endsWith('.edit') ||\n    normalizedCommandId.endsWith('.upsert') ||\n    normalizedLabel.includes('update') ||\n    normalizedLabel.includes('edit') ||\n    normalizedLabel.includes('upsert')\n  ) {\n    return 'edit'\n  }\n\n  return 'system'\n}\n\nexport function deriveActionLogSource(\n  context: Record<string, unknown> | null | undefined,\n  actorUserId: string | null | undefined,\n): ActionLogSourceKey {\n  const rawSource = isRecord(context) ? context.source : undefined\n  const normalizedSource = typeof rawSource === 'string' ? rawSource.trim().toLowerCase() : ''\n\n  if (normalizedSource === 'api') return 'api'\n  if (normalizedSource === 'system') return 'system'\n  if (normalizedSource === 'ui') return 'ui'\n\n  return actorUserId ? 'ui' : 'system'\n}\n\nexport function deriveActionLogChangedFields(\n  changes: Record<string, unknown> | null | undefined,\n  snapshotBefore: unknown,\n): string[] {\n  return Array.from(\n    new Set(\n      extractChangeRows(changes, snapshotBefore)\n        .map((entry) => entry.field)\n        .filter((value) => typeof value === 'string' && value.trim().length > 0),\n    ),\n  ).sort((left, right) => left.localeCompare(right))\n}\n\nexport function deriveActionLogProjection(input: ProjectionInput): {\n  actionType: ActionLogProjectionType\n  changedFields: string[]\n  primaryChangedField: string | null\n  sourceKey: ActionLogSourceKey\n} {\n  const changedFields = deriveActionLogChangedFields(input.changes, input.snapshotBefore)\n\n  return {\n    actionType: deriveActionLogActionType(input),\n    changedFields,\n    primaryChangedField: changedFields[0] ?? null,\n    sourceKey: deriveActionLogSource(input.context, input.actorUserId),\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,mBAAmB,gBAAgB;AAErC,MAAM,0BAA0B,CAAC,UAAU,QAAQ,UAAU,QAAQ;AACrE,MAAM,8BAA8B,CAAC,GAAG,yBAAyB,QAAQ;AACzE,MAAM,yBAAyB,CAAC,MAAM,OAAO,QAAQ;AAe5D,SAAS,cAAc,OAA0C;AAC/D,UAAQ,SAAS,IAAI,KAAK,EAAE,YAAY;AAC1C;AAEO,SAAS,0BAA0B,OAAoF;AAC5H,QAAM,sBAAsB,cAAc,MAAM,SAAS;AACzD,QAAM,kBAAkB,cAAc,MAAM,WAAW;AAEvD,MACE,oBAAoB,SAAS,SAAS,KACtC,oBAAoB,SAAS,MAAM,KACnC,gBAAgB,SAAS,QAAQ,KACjC,gBAAgB,SAAS,KAAK,GAC9B;AACA,WAAO;AAAA,EACT;AAEA,MACE,oBAAoB,SAAS,SAAS,KACtC,oBAAoB,SAAS,SAAS,KACtC,gBAAgB,SAAS,QAAQ,KACjC,gBAAgB,SAAS,QAAQ,GACjC;AACA,WAAO;AAAA,EACT;AAEA,MACE,oBAAoB,SAAS,SAAS,KACtC,oBAAoB,SAAS,WAAW,KACxC,gBAAgB,SAAS,QAAQ,KACjC,gBAAgB,SAAS,UAAU,GACnC;AACA,WAAO;AAAA,EACT;AAEA,MACE,oBAAoB,SAAS,SAAS,KACtC,oBAAoB,SAAS,OAAO,KACpC,oBAAoB,SAAS,SAAS,KACtC,gBAAgB,SAAS,QAAQ,KACjC,gBAAgB,SAAS,MAAM,KAC/B,gBAAgB,SAAS,QAAQ,GACjC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,sBACd,SACA,aACoB;AACpB,QAAM,YAAY,SAAS,OAAO,IAAI,QAAQ,SAAS;AACvD,QAAM,mBAAmB,OAAO,cAAc,WAAW,UAAU,KAAK,EAAE,YAAY,IAAI;AAE1F,MAAI,qBAAqB,MAAO,QAAO;AACvC,MAAI,qBAAqB,SAAU,QAAO;AAC1C,MAAI,qBAAqB,KAAM,QAAO;AAEtC,SAAO,cAAc,OAAO;AAC9B;AAEO,SAAS,6BACd,SACA,gBACU;AACV,SAAO,MAAM;AAAA,IACX,IAAI;AAAA,MACF,kBAAkB,SAAS,cAAc,EACtC,IAAI,CAAC,UAAU,MAAM,KAAK,EAC1B,OAAO,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,IAC3E;AAAA,EACF,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACnD;AAEO,SAAS,0BAA0B,OAKxC;AACA,QAAM,gBAAgB,6BAA6B,MAAM,SAAS,MAAM,cAAc;AAEtF,SAAO;AAAA,IACL,YAAY,0BAA0B,KAAK;AAAA,IAC3C;AAAA,IACA,qBAAqB,cAAc,CAAC,KAAK;AAAA,IACzC,WAAW,sBAAsB,MAAM,SAAS,MAAM,WAAW;AAAA,EACnE;AACF;",
+  "names": []
+}

package/dist/modules/audit_logs/migrations/Migration20260412160533.js

@@ -0,0 +1,21 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260412160533 extends Migration {
+  async up() {
+    this.addSql(`alter table "action_logs" add column "action_type" text null, add column "changed_fields" text[] null, add column "primary_changed_field" text null, add column "source_key" text null;`);
+    this.addSql(`create index "action_logs_changed_fields_idx" on "action_logs" using gin ("changed_fields");`);
+    this.addSql(`create index "action_logs_primary_changed_field_idx" on "action_logs" ("tenant_id", "organization_id", "primary_changed_field", "created_at");`);
+    this.addSql(`create index "action_logs_source_key_idx" on "action_logs" ("tenant_id", "organization_id", "source_key", "created_at");`);
+    this.addSql(`create index "action_logs_action_type_idx" on "action_logs" ("tenant_id", "organization_id", "action_type", "created_at");`);
+  }
+  async down() {
+    this.addSql(`drop index "action_logs_changed_fields_idx";`);
+    this.addSql(`drop index "action_logs_primary_changed_field_idx";`);
+    this.addSql(`drop index "action_logs_source_key_idx";`);
+    this.addSql(`drop index "action_logs_action_type_idx";`);
+    this.addSql(`alter table "action_logs" drop column "action_type", drop column "changed_fields", drop column "primary_changed_field", drop column "source_key";`);
+  }
+}
+export {
+  Migration20260412160533
+};
+//# sourceMappingURL=Migration20260412160533.js.map

package/dist/modules/audit_logs/migrations/Migration20260412160533.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/audit_logs/migrations/Migration20260412160533.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260412160533 extends Migration {\n\n  override async up(): Promise<void> {\n    this.addSql(`alter table \"action_logs\" add column \"action_type\" text null, add column \"changed_fields\" text[] null, add column \"primary_changed_field\" text null, add column \"source_key\" text null;`);\n    this.addSql(`create index \"action_logs_changed_fields_idx\" on \"action_logs\" using gin (\"changed_fields\");`);\n    this.addSql(`create index \"action_logs_primary_changed_field_idx\" on \"action_logs\" (\"tenant_id\", \"organization_id\", \"primary_changed_field\", \"created_at\");`);\n    this.addSql(`create index \"action_logs_source_key_idx\" on \"action_logs\" (\"tenant_id\", \"organization_id\", \"source_key\", \"created_at\");`);\n    this.addSql(`create index \"action_logs_action_type_idx\" on \"action_logs\" (\"tenant_id\", \"organization_id\", \"action_type\", \"created_at\");`);\n  }\n\n  override async down(): Promise<void> {\n    this.addSql(`drop index \"action_logs_changed_fields_idx\";`);\n    this.addSql(`drop index \"action_logs_primary_changed_field_idx\";`);\n    this.addSql(`drop index \"action_logs_source_key_idx\";`);\n    this.addSql(`drop index \"action_logs_action_type_idx\";`);\n    this.addSql(`alter table \"action_logs\" drop column \"action_type\", drop column \"changed_fields\", drop column \"primary_changed_field\", drop column \"source_key\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,gCAAgC,UAAU;AAAA,EAErD,MAAe,KAAoB;AACjC,SAAK,OAAO,yLAAyL;AACrM,SAAK,OAAO,8FAA8F;AAC1G,SAAK,OAAO,gJAAgJ;AAC5J,SAAK,OAAO,0HAA0H;AACtI,SAAK,OAAO,4HAA4H;AAAA,EAC1I;AAAA,EAEA,MAAe,OAAsB;AACnC,SAAK,OAAO,8CAA8C;AAC1D,SAAK,OAAO,qDAAqD;AACjE,SAAK,OAAO,0CAA0C;AACtD,SAAK,OAAO,2CAA2C;AACvD,SAAK,OAAO,mJAAmJ;AAAA,EACjK;AAEF;",
+  "names": []
+}

package/dist/modules/audit_logs/services/actionLogService.js

@@ -3,64 +3,120 @@ import {
   actionLogCreateSchema,
   actionLogListSchema
 } from "@open-mercato/core/modules/audit_logs/data/validators";
+import { isRecord } from "@open-mercato/core/modules/audit_logs/lib/changeRows";
+import {
+  ACTION_LOG_FILTER_TYPES,
+  deriveActionLogProjection
+} from "@open-mercato/core/modules/audit_logs/lib/projections";
 import { decryptWithAesGcm } from "@open-mercato/shared/lib/encryption/aes";
 import { toOptionalString } from "@open-mercato/shared/lib/string/coerce";
 let validationWarningLogged = false;
 let runtimeValidationAvailable = null;
 let decryptionWarningLogged = false;
 const isZodRuntimeMissing = (err) => err instanceof TypeError && typeof err.message === "string" && err.message.includes("_zod");
+const SORT_FIELDS = {
+  createdAt: "action_logs.created_at"
+};
+function readString(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return null;
+}
+function readRecord(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (isRecord(value)) return value;
+  }
+  return null;
+}
+function readValue(record, ...keys) {
+  for (const key of keys) {
+    if (Object.prototype.hasOwnProperty.call(record, key)) return record[key];
+  }
+  return void 0;
+}
+function readStringArray(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (Array.isArray(value)) {
+      return value.filter((entry) => typeof entry === "string");
+    }
+  }
+  return null;
+}
+function stringArraysEqual(left, right) {
+  if (!Array.isArray(left)) return false;
+  if (left.length !== right.length) return false;
+  return left.every((value, index) => value === right[index]);
+}
 class ActionLogService {
   constructor(em, tenantEncryptionService) {
     this.em = em;
     this.tenantEncryptionService = tenantEncryptionService;
   }
-  async decryptEntries(entries) {
-    if (!entries) return;
-    if (!this.tenantEncryptionService?.isEnabled()) return;
-    const list = Array.isArray(entries) ? entries : [entries];
-    for (const entry of list) {
-      try {
-        const dek = await this.tenantEncryptionService.getDek(entry.tenantId ?? null);
-        const deepDecrypt = (value) => {
-          if (!dek) return value;
-          if (typeof value === "string" && value.split(":").length === 4 && value.endsWith(":v1")) {
-            const decrypted2 = decryptWithAesGcm(value, dek.key);
-            if (decrypted2 === null) return value;
-            try {
-              return JSON.parse(decrypted2);
-            } catch {
-              return decrypted2;
-            }
+  async decryptEntryPayload(entry) {
+    if (!this.tenantEncryptionService?.isEnabled()) return entry;
+    try {
+      const tenantId = readString(entry, "tenantId", "tenant_id");
+      const organizationId = readString(entry, "organizationId", "organization_id");
+      const dek = await this.tenantEncryptionService.getDek(tenantId);
+      const deepDecrypt = (value) => {
+        if (!dek) return value;
+        if (typeof value === "string" && value.split(":").length === 4 && value.endsWith(":v1")) {
+          const decrypted2 = decryptWithAesGcm(value, dek.key);
+          if (decrypted2 === null) return value;
+          try {
+            return JSON.parse(decrypted2);
+          } catch {
+            return decrypted2;
           }
-          if (Array.isArray(value)) return value.map((item) => deepDecrypt(item));
-          if (value && typeof value === "object") {
-            const copy = {};
-            for (const [k, v] of Object.entries(value)) {
-              copy[k] = deepDecrypt(v);
-            }
-            return copy;
+        }
+        if (Array.isArray(value)) return value.map((item) => deepDecrypt(item));
+        if (value && typeof value === "object") {
+          const copy = {};
+          for (const [key, item] of Object.entries(value)) {
+            copy[key] = deepDecrypt(item);
           }
-          return value;
-        };
-        const decrypted = await this.tenantEncryptionService.decryptEntityPayload(
-          "audit_logs:action_log",
-          entry,
-          entry.tenantId ?? null,
-          entry.organizationId ?? null
-        );
-        const merged = { ...decrypted };
-        merged.changesJson = deepDecrypt(merged.changesJson ?? entry?.changesJson);
-        merged.snapshotBefore = deepDecrypt(merged.snapshotBefore ?? entry?.snapshotBefore);
-        merged.snapshotAfter = deepDecrypt(merged.snapshotAfter ?? entry?.snapshotAfter);
-        merged.commandPayload = deepDecrypt(merged.commandPayload ?? entry?.commandPayload);
-        merged.contextJson = deepDecrypt(merged.contextJson ?? entry?.contextJson);
-        Object.assign(entry, merged);
-      } catch (err) {
-        if (!decryptionWarningLogged) {
-          decryptionWarningLogged = true;
-          console.warn("[audit_logs] failed to decrypt action log entry", err);
+          return copy;
         }
+        return value;
+      };
+      const decrypted = await this.tenantEncryptionService.decryptEntityPayload(
+        "audit_logs:action_log",
+        entry,
+        tenantId,
+        organizationId
+      );
+      const merged = {
+        ...entry,
+        ...decrypted
+      };
+      merged.changesJson = deepDecrypt(merged.changesJson ?? merged.changes_json ?? entry.changesJson ?? entry.changes_json);
+      merged.changes_json = merged.changesJson;
+      merged.snapshotBefore = deepDecrypt(merged.snapshotBefore ?? merged.snapshot_before ?? entry.snapshotBefore ?? entry.snapshot_before);
+      merged.snapshot_before = merged.snapshotBefore;
+      merged.snapshotAfter = deepDecrypt(merged.snapshotAfter ?? merged.snapshot_after ?? entry.snapshotAfter ?? entry.snapshot_after);
+      merged.snapshot_after = merged.snapshotAfter;
+      merged.commandPayload = deepDecrypt(merged.commandPayload ?? merged.command_payload ?? entry.commandPayload ?? entry.command_payload);
+      merged.command_payload = merged.commandPayload;
+      merged.contextJson = deepDecrypt(merged.contextJson ?? merged.context_json ?? entry.contextJson ?? entry.context_json);
+      merged.context_json = merged.contextJson;
+      return merged;
+    } catch (err) {
+      if (!decryptionWarningLogged) {
+        decryptionWarningLogged = true;
+        console.warn("[audit_logs] failed to decrypt action log entry", err);
       }
+      return entry;
+    }
+  }
+  async decryptEntries(entries) {
+    if (!entries) return;
+    const list = Array.isArray(entries) ? entries : [entries];
+    for (const entry of list) {
+      Object.assign(entry, await this.decryptEntryPayload(entry));
     }
   }
   async log(input) {
@@ -94,12 +150,21 @@ class ActionLogService {
     return data;
   }
   createLogEntity(fork, data) {
+    const projection = deriveActionLogProjection({
+      actorUserId: data.actorUserId ?? null,
+      actionLabel: data.actionLabel ?? null,
+      changes: isRecord(data.changes) ? data.changes : null,
+      commandId: data.commandId,
+      context: isRecord(data.context) ? data.context : null,
+      snapshotBefore: data.snapshotBefore
+    });
     return fork.create(ActionLog, {
       tenantId: data.tenantId ?? null,
       organizationId: data.organizationId ?? null,
       actorUserId: data.actorUserId ?? null,
       commandId: data.commandId,
       actionLabel: data.actionLabel ?? null,
+      actionType: projection.actionType,
       resourceKind: data.resourceKind ?? null,
       resourceId: data.resourceId ?? null,
       parentResourceKind: data.parentResourceKind ?? null,
@@ -109,8 +174,11 @@ class ActionLogService {
       commandPayload: data.commandPayload ?? null,
       snapshotBefore: data.snapshotBefore ?? null,
       snapshotAfter: data.snapshotAfter ?? null,
-      changesJson: data.changes ?? null,
-      contextJson: data.context ?? null,
+      changesJson: isRecord(data.changes) ? data.changes : null,
+      changedFields: projection.changedFields,
+      primaryChangedField: projection.primaryChangedField,
+      contextJson: isRecord(data.context) ? data.context : null,
+      sourceKey: projection.sourceKey,
       createdAt: /* @__PURE__ */ new Date(),
       updatedAt: /* @__PURE__ */ new Date()
     });
@@ -136,9 +204,7 @@ class ActionLogService {
     }
     const toNullableUuid = (value) => {
       if (typeof value !== "string" || value.length === 0) return null;
-      if (value.startsWith("api_key:")) {
-        return value.slice("api_key:".length);
-      }
+      if (value.startsWith("api_key:")) return value.slice("api_key:".length);
       return value;
     };
     const normalizeRecordLike = (value) => {
@@ -167,39 +233,125 @@ class ActionLogService {
       context: normalizeContext(input.context)
     };
   }
-  async list(query) {
-    const parsed = actionLogListSchema.parse({
+  parseListQuery(query) {
+    return actionLogListSchema.parse({
       ...query
     });
-    const where = { deletedAt: null };
-    if (parsed.tenantId) where.tenantId = parsed.tenantId;
-    if (parsed.organizationId) where.organizationId = parsed.organizationId;
-    if (parsed.actorUserId) where.actorUserId = parsed.actorUserId;
+  }
+  resolveActorUserIds(parsed) {
+    const values = [...parsed.actorUserIds ?? []];
+    if (parsed.actorUserId) values.push(parsed.actorUserId);
+    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)));
+  }
+  resolveFieldNames(parsed) {
+    const values = [...parsed.fieldNames ?? []];
+    if (parsed.fieldName) values.push(parsed.fieldName);
+    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)));
+  }
+  resolveActionTypes(parsed) {
+    const values = [...parsed.actionTypes ?? []];
+    if (parsed.actionType) values.push(parsed.actionType);
+    return Array.from(new Set(values)).filter((value) => ACTION_LOG_FILTER_TYPES.includes(value));
+  }
+  resolvePagination(parsed) {
+    const pageSize = typeof parsed.pageSize === "number" && parsed.pageSize > 0 ? parsed.pageSize : typeof parsed.limit === "number" && parsed.limit > 0 ? parsed.limit : 50;
+    const page = typeof parsed.page === "number" && parsed.page > 0 ? parsed.page : 1;
+    const offset = typeof parsed.offset === "number" && parsed.offset >= 0 ? parsed.offset : (page - 1) * pageSize;
+    return { page, pageSize, offset, limit: pageSize };
+  }
+  async loadEntries(parsed, options) {
+    const query = this.buildListQuery(parsed).select("action_logs.id as id");
+    if (options?.paginate !== false) {
+      const { limit, offset } = this.resolvePagination(parsed);
+      query.limit(limit).offset(offset);
+    }
+    const rows = await query;
+    const ids = rows.map((row) => row.id).filter(Boolean);
+    if (ids.length === 0) return [];
+    const results = await this.em.find(ActionLog, {
+      id: { $in: ids },
+      deletedAt: null
+    });
+    await this.decryptEntries(results);
+    const byId = new Map(results.map((entry) => [entry.id, entry]));
+    return ids.map((id) => byId.get(id)).filter((entry) => Boolean(entry));
+  }
+  buildListQuery(parsed) {
+    const query = this.em.getKnex()("action_logs").whereNull("action_logs.deleted_at");
+    if (parsed.tenantId) query.andWhere("action_logs.tenant_id", parsed.tenantId);
+    if (parsed.organizationId) query.andWhere("action_logs.organization_id", parsed.organizationId);
+    const actorUserIds = this.resolveActorUserIds(parsed);
+    if (actorUserIds.length === 1) query.andWhere("action_logs.actor_user_id", actorUserIds[0]);
+    if (actorUserIds.length > 1) query.whereIn("action_logs.actor_user_id", actorUserIds);
     if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {
-      where.$or = [
-        { resourceKind: parsed.resourceKind, resourceId: parsed.resourceId },
-        { parentResourceKind: parsed.resourceKind, parentResourceId: parsed.resourceId }
-      ];
+      query.andWhere(function applyRelatedScope() {
+        this.where({
+          "action_logs.resource_kind": parsed.resourceKind,
+          "action_logs.resource_id": parsed.resourceId
+        }).orWhere({
+          "action_logs.parent_resource_kind": parsed.resourceKind,
+          "action_logs.parent_resource_id": parsed.resourceId
+        });
+      });
     } else {
-      if (parsed.resourceKind) where.resourceKind = parsed.resourceKind;
-      if (parsed.resourceId) where.resourceId = parsed.resourceId;
+      if (parsed.resourceKind) query.andWhere("action_logs.resource_kind", parsed.resourceKind);
+      if (parsed.resourceId) query.andWhere("action_logs.resource_id", parsed.resourceId);
     }
-    if (parsed.undoableOnly) where.undoToken = { $ne: null };
-    if (parsed.before) where.createdAt = { ...where.createdAt, $lt: parsed.before };
-    if (parsed.after) where.createdAt = { ...where.createdAt, $gt: parsed.after };
-    const pageSize = parsed.pageSize ?? parsed.limit ?? 50;
-    const page = parsed.page ?? 1;
-    const offset = (page - 1) * pageSize;
-    const [items, total] = await this.em.findAndCount(
-      ActionLog,
-      where,
-      {
-        orderBy: { createdAt: "desc" },
-        limit: pageSize,
-        offset
-      }
-    );
-    await this.decryptEntries(items);
+    if (parsed.undoableOnly) query.whereNotNull("action_logs.undo_token");
+    if (parsed.before) query.andWhere("action_logs.created_at", "<", parsed.before);
+    if (parsed.after) query.andWhere("action_logs.created_at", ">", parsed.after);
+    const fieldNames = this.resolveFieldNames(parsed);
+    if (fieldNames.length > 0) {
+      const placeholders = fieldNames.map(() => "?").join(", ");
+      query.andWhereRaw(
+        `coalesce(action_logs.changed_fields, ARRAY[]::text[]) && ARRAY[${placeholders}]::text[]`,
+        fieldNames
+      );
+    }
+    const actionTypes = this.resolveActionTypes(parsed);
+    if (actionTypes.length === 1) query.andWhere("action_logs.action_type", actionTypes[0]);
+    if (actionTypes.length > 1) query.whereIn("action_logs.action_type", actionTypes);
+    if (parsed.sortField === "user") {
+      query.leftJoin("users as audit_actor", "audit_actor.id", "action_logs.actor_user_id");
+    }
+    const sortDir = parsed.sortDir === "asc" ? "asc" : "desc";
+    switch (parsed.sortField) {
+      case "user":
+        query.orderByRaw(`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '') ${sortDir}`);
+        break;
+      case "action":
+        query.orderByRaw(`coalesce(action_logs.action_type, '') ${sortDir}`);
+        break;
+      case "field":
+        query.orderByRaw(`coalesce(action_logs.primary_changed_field, '') ${sortDir}`);
+        break;
+      case "source":
+        query.orderByRaw(`coalesce(action_logs.source_key, '') ${sortDir}`);
+        break;
+      case "createdAt":
+      default:
+        query.orderBy(SORT_FIELDS.createdAt, sortDir);
+        query.orderBy("action_logs.id", sortDir);
+        return query;
+    }
+    query.orderBy("action_logs.created_at", "desc");
+    query.orderBy("action_logs.id", "desc");
+    return query;
+  }
+  async count(query) {
+    const parsed = this.parseListQuery(query);
+    const row = await this.buildListQuery(parsed).clearOrder().count({ count: "*" }).first();
+    if (!row) return 0;
+    const rawCount = row.count ?? 0;
+    return typeof rawCount === "number" ? rawCount : Number.parseInt(rawCount, 10) || 0;
+  }
+  async list(query) {
+    const parsed = this.parseListQuery(query);
+    const { page, pageSize } = this.resolvePagination(parsed);
+    const [items, total] = await Promise.all([
+      this.loadEntries(parsed),
+      this.count(parsed)
+    ]);
     const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)));
     return { items, total, page, pageSize, totalPages };
   }
@@ -228,9 +380,7 @@ class ActionLogService {
     }
     await fork.flush();
     await this.decryptEntries(log);
-    if (traceLog) {
-      await this.decryptEntries(traceLog);
-    }
+    if (traceLog) await this.decryptEntries(traceLog);
     return log;
   }
   async findByUndoToken(undoToken) {
@@ -278,6 +428,90 @@ class ActionLogService {
     await this.em.flush();
     return log;
   }
+  async backfillProjections(options = {}) {
+    const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1e3);
+    const logger = options.logger ?? (() => {
+    });
+    const result = {
+      errors: 0,
+      scanned: 0,
+      skipped: 0,
+      updated: 0
+    };
+    let cursorCreatedAt = null;
+    let cursorId = null;
+    while (true) {
+      const rowsQuery = this.em.getKnex()("action_logs").select(
+        "id",
+        "tenant_id",
+        "organization_id",
+        "actor_user_id",
+        "command_id",
+        "action_label",
+        "snapshot_before",
+        "changes_json",
+        "context_json",
+        "action_type",
+        "source_key",
+        "changed_fields",
+        "primary_changed_field",
+        "created_at"
+      ).whereNull("deleted_at");
+      if (options.tenantId) rowsQuery.andWhere("tenant_id", options.tenantId);
+      if (options.organizationId) rowsQuery.andWhere("organization_id", options.organizationId);
+      if (!options.force) {
+        rowsQuery.andWhere((builder) => {
+          builder.whereNull("action_type").orWhereNull("source_key").orWhereNull("changed_fields");
+        });
+      }
+      if (cursorCreatedAt && cursorId) {
+        rowsQuery.andWhere((builder) => {
+          builder.where("created_at", ">", cursorCreatedAt).orWhere((nested) => {
+            nested.where("created_at", cursorCreatedAt).andWhere("id", ">", cursorId);
+          });
+        });
+      }
+      const rows = await rowsQuery.orderBy("created_at", "asc").orderBy("id", "asc").limit(batchSize);
+      if (rows.length === 0) break;
+      for (const row of rows) {
+        result.scanned += 1;
+        try {
+          const decrypted = await this.decryptEntryPayload(row);
+          const projection = deriveActionLogProjection({
+            actorUserId: readString(decrypted, "actorUserId", "actor_user_id"),
+            actionLabel: readString(decrypted, "actionLabel", "action_label"),
+            changes: readRecord(decrypted, "changesJson", "changes_json"),
+            commandId: readString(decrypted, "commandId", "command_id") ?? "unknown",
+            context: readRecord(decrypted, "contextJson", "context_json"),
+            snapshotBefore: readValue(decrypted, "snapshotBefore", "snapshot_before")
+          });
+          const needsUpdate = options.force === true || row.action_type !== projection.actionType || row.source_key !== projection.sourceKey || row.primary_changed_field !== projection.primaryChangedField || !stringArraysEqual(row.changed_fields, projection.changedFields);
+          if (!needsUpdate) {
+            result.skipped += 1;
+            continue;
+          }
+          await this.em.getKnex()("action_logs").where({ id: row.id }).update({
+            action_type: projection.actionType,
+            changed_fields: projection.changedFields,
+            primary_changed_field: projection.primaryChangedField,
+            source_key: projection.sourceKey
+          });
+          result.updated += 1;
+        } catch (err) {
+          result.errors += 1;
+          logger(`[backfill] Failed for action log ${row.id}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      const lastRow = rows[rows.length - 1];
+      cursorCreatedAt = lastRow.created_at;
+      cursorId = lastRow.id;
+      logger(
+        `[backfill] Processed ${result.scanned} action logs (updated: ${result.updated}, skipped: ${result.skipped}, errors: ${result.errors})`
+      );
+      if (rows.length < batchSize) break;
+    }
+    return result;
+  }
 }
 export {
   ActionLogService