@open-mercato/core 0.5.1-develop.2672.g2128128275 → 0.5.1-develop.2683.4878a05b8e

package/dist/modules/audit_logs/services/actionLogService.js

@@ -3,64 +3,120 @@ import {
   actionLogCreateSchema,
   actionLogListSchema
 } from "@open-mercato/core/modules/audit_logs/data/validators";
+import { isRecord } from "@open-mercato/core/modules/audit_logs/lib/changeRows";
+import {
+  ACTION_LOG_FILTER_TYPES,
+  deriveActionLogProjection
+} from "@open-mercato/core/modules/audit_logs/lib/projections";
 import { decryptWithAesGcm } from "@open-mercato/shared/lib/encryption/aes";
 import { toOptionalString } from "@open-mercato/shared/lib/string/coerce";
 let validationWarningLogged = false;
 let runtimeValidationAvailable = null;
 let decryptionWarningLogged = false;
 const isZodRuntimeMissing = (err) => err instanceof TypeError && typeof err.message === "string" && err.message.includes("_zod");
+const SORT_FIELDS = {
+  createdAt: "action_logs.created_at"
+};
+function readString(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return null;
+}
+function readRecord(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (isRecord(value)) return value;
+  }
+  return null;
+}
+function readValue(record, ...keys) {
+  for (const key of keys) {
+    if (Object.prototype.hasOwnProperty.call(record, key)) return record[key];
+  }
+  return void 0;
+}
+function readStringArray(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (Array.isArray(value)) {
+      return value.filter((entry) => typeof entry === "string");
+    }
+  }
+  return null;
+}
+function stringArraysEqual(left, right) {
+  if (!Array.isArray(left)) return false;
+  if (left.length !== right.length) return false;
+  return left.every((value, index) => value === right[index]);
+}
 class ActionLogService {
   constructor(em, tenantEncryptionService) {
     this.em = em;
     this.tenantEncryptionService = tenantEncryptionService;
   }
-  async decryptEntries(entries) {
-    if (!entries) return;
-    if (!this.tenantEncryptionService?.isEnabled()) return;
-    const list = Array.isArray(entries) ? entries : [entries];
-    for (const entry of list) {
-      try {
-        const dek = await this.tenantEncryptionService.getDek(entry.tenantId ?? null);
-        const deepDecrypt = (value) => {
-          if (!dek) return value;
-          if (typeof value === "string" && value.split(":").length === 4 && value.endsWith(":v1")) {
-            const decrypted2 = decryptWithAesGcm(value, dek.key);
-            if (decrypted2 === null) return value;
-            try {
-              return JSON.parse(decrypted2);
-            } catch {
-              return decrypted2;
-            }
+  async decryptEntryPayload(entry) {
+    if (!this.tenantEncryptionService?.isEnabled()) return entry;
+    try {
+      const tenantId = readString(entry, "tenantId", "tenant_id");
+      const organizationId = readString(entry, "organizationId", "organization_id");
+      const dek = await this.tenantEncryptionService.getDek(tenantId);
+      const deepDecrypt = (value) => {
+        if (!dek) return value;
+        if (typeof value === "string" && value.split(":").length === 4 && value.endsWith(":v1")) {
+          const decrypted2 = decryptWithAesGcm(value, dek.key);
+          if (decrypted2 === null) return value;
+          try {
+            return JSON.parse(decrypted2);
+          } catch {
+            return decrypted2;
           }
-          if (Array.isArray(value)) return value.map((item) => deepDecrypt(item));
-          if (value && typeof value === "object") {
-            const copy = {};
-            for (const [k, v] of Object.entries(value)) {
-              copy[k] = deepDecrypt(v);
-            }
-            return copy;
+        }
+        if (Array.isArray(value)) return value.map((item) => deepDecrypt(item));
+        if (value && typeof value === "object") {
+          const copy = {};
+          for (const [key, item] of Object.entries(value)) {
+            copy[key] = deepDecrypt(item);
           }
-          return value;
-        };
-        const decrypted = await this.tenantEncryptionService.decryptEntityPayload(
-          "audit_logs:action_log",
-          entry,
-          entry.tenantId ?? null,
-          entry.organizationId ?? null
-        );
-        const merged = { ...decrypted };
-        merged.changesJson = deepDecrypt(merged.changesJson ?? entry?.changesJson);
-        merged.snapshotBefore = deepDecrypt(merged.snapshotBefore ?? entry?.snapshotBefore);
-        merged.snapshotAfter = deepDecrypt(merged.snapshotAfter ?? entry?.snapshotAfter);
-        merged.commandPayload = deepDecrypt(merged.commandPayload ?? entry?.commandPayload);
-        merged.contextJson = deepDecrypt(merged.contextJson ?? entry?.contextJson);
-        Object.assign(entry, merged);
-      } catch (err) {
-        if (!decryptionWarningLogged) {
-          decryptionWarningLogged = true;
-          console.warn("[audit_logs] failed to decrypt action log entry", err);
+          return copy;
         }
+        return value;
+      };
+      const decrypted = await this.tenantEncryptionService.decryptEntityPayload(
+        "audit_logs:action_log",
+        entry,
+        tenantId,
+        organizationId
+      );
+      const merged = {
+        ...entry,
+        ...decrypted
+      };
+      merged.changesJson = deepDecrypt(merged.changesJson ?? merged.changes_json ?? entry.changesJson ?? entry.changes_json);
+      merged.changes_json = merged.changesJson;
+      merged.snapshotBefore = deepDecrypt(merged.snapshotBefore ?? merged.snapshot_before ?? entry.snapshotBefore ?? entry.snapshot_before);
+      merged.snapshot_before = merged.snapshotBefore;
+      merged.snapshotAfter = deepDecrypt(merged.snapshotAfter ?? merged.snapshot_after ?? entry.snapshotAfter ?? entry.snapshot_after);
+      merged.snapshot_after = merged.snapshotAfter;
+      merged.commandPayload = deepDecrypt(merged.commandPayload ?? merged.command_payload ?? entry.commandPayload ?? entry.command_payload);
+      merged.command_payload = merged.commandPayload;
+      merged.contextJson = deepDecrypt(merged.contextJson ?? merged.context_json ?? entry.contextJson ?? entry.context_json);
+      merged.context_json = merged.contextJson;
+      return merged;
+    } catch (err) {
+      if (!decryptionWarningLogged) {
+        decryptionWarningLogged = true;
+        console.warn("[audit_logs] failed to decrypt action log entry", err);
       }
+      return entry;
+    }
+  }
+  async decryptEntries(entries) {
+    if (!entries) return;
+    const list = Array.isArray(entries) ? entries : [entries];
+    for (const entry of list) {
+      Object.assign(entry, await this.decryptEntryPayload(entry));
     }
   }
   async log(input) {
@@ -94,12 +150,21 @@ class ActionLogService {
     return data;
   }
   createLogEntity(fork, data) {
+    const projection = deriveActionLogProjection({
+      actorUserId: data.actorUserId ?? null,
+      actionLabel: data.actionLabel ?? null,
+      changes: isRecord(data.changes) ? data.changes : null,
+      commandId: data.commandId,
+      context: isRecord(data.context) ? data.context : null,
+      snapshotBefore: data.snapshotBefore
+    });
     return fork.create(ActionLog, {
       tenantId: data.tenantId ?? null,
       organizationId: data.organizationId ?? null,
       actorUserId: data.actorUserId ?? null,
       commandId: data.commandId,
       actionLabel: data.actionLabel ?? null,
+      actionType: projection.actionType,
       resourceKind: data.resourceKind ?? null,
       resourceId: data.resourceId ?? null,
       parentResourceKind: data.parentResourceKind ?? null,
@@ -109,8 +174,11 @@ class ActionLogService {
       commandPayload: data.commandPayload ?? null,
       snapshotBefore: data.snapshotBefore ?? null,
       snapshotAfter: data.snapshotAfter ?? null,
-      changesJson: data.changes ?? null,
-      contextJson: data.context ?? null,
+      changesJson: isRecord(data.changes) ? data.changes : null,
+      changedFields: projection.changedFields,
+      primaryChangedField: projection.primaryChangedField,
+      contextJson: isRecord(data.context) ? data.context : null,
+      sourceKey: projection.sourceKey,
       createdAt: /* @__PURE__ */ new Date(),
       updatedAt: /* @__PURE__ */ new Date()
     });
@@ -136,9 +204,7 @@ class ActionLogService {
     }
     const toNullableUuid = (value) => {
       if (typeof value !== "string" || value.length === 0) return null;
-      if (value.startsWith("api_key:")) {
-        return value.slice("api_key:".length);
-      }
+      if (value.startsWith("api_key:")) return value.slice("api_key:".length);
       return value;
     };
     const normalizeRecordLike = (value) => {
@@ -167,39 +233,125 @@ class ActionLogService {
       context: normalizeContext(input.context)
     };
   }
-  async list(query) {
-    const parsed = actionLogListSchema.parse({
+  parseListQuery(query) {
+    return actionLogListSchema.parse({
       ...query
     });
-    const where = { deletedAt: null };
-    if (parsed.tenantId) where.tenantId = parsed.tenantId;
-    if (parsed.organizationId) where.organizationId = parsed.organizationId;
-    if (parsed.actorUserId) where.actorUserId = parsed.actorUserId;
+  }
+  resolveActorUserIds(parsed) {
+    const values = [...parsed.actorUserIds ?? []];
+    if (parsed.actorUserId) values.push(parsed.actorUserId);
+    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)));
+  }
+  resolveFieldNames(parsed) {
+    const values = [...parsed.fieldNames ?? []];
+    if (parsed.fieldName) values.push(parsed.fieldName);
+    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)));
+  }
+  resolveActionTypes(parsed) {
+    const values = [...parsed.actionTypes ?? []];
+    if (parsed.actionType) values.push(parsed.actionType);
+    return Array.from(new Set(values)).filter((value) => ACTION_LOG_FILTER_TYPES.includes(value));
+  }
+  resolvePagination(parsed) {
+    const pageSize = typeof parsed.pageSize === "number" && parsed.pageSize > 0 ? parsed.pageSize : typeof parsed.limit === "number" && parsed.limit > 0 ? parsed.limit : 50;
+    const page = typeof parsed.page === "number" && parsed.page > 0 ? parsed.page : 1;
+    const offset = typeof parsed.offset === "number" && parsed.offset >= 0 ? parsed.offset : (page - 1) * pageSize;
+    return { page, pageSize, offset, limit: pageSize };
+  }
+  async loadEntries(parsed, options) {
+    const query = this.buildListQuery(parsed).select("action_logs.id as id");
+    if (options?.paginate !== false) {
+      const { limit, offset } = this.resolvePagination(parsed);
+      query.limit(limit).offset(offset);
+    }
+    const rows = await query;
+    const ids = rows.map((row) => row.id).filter(Boolean);
+    if (ids.length === 0) return [];
+    const results = await this.em.find(ActionLog, {
+      id: { $in: ids },
+      deletedAt: null
+    });
+    await this.decryptEntries(results);
+    const byId = new Map(results.map((entry) => [entry.id, entry]));
+    return ids.map((id) => byId.get(id)).filter((entry) => Boolean(entry));
+  }
+  buildListQuery(parsed) {
+    const query = this.em.getKnex()("action_logs").whereNull("action_logs.deleted_at");
+    if (parsed.tenantId) query.andWhere("action_logs.tenant_id", parsed.tenantId);
+    if (parsed.organizationId) query.andWhere("action_logs.organization_id", parsed.organizationId);
+    const actorUserIds = this.resolveActorUserIds(parsed);
+    if (actorUserIds.length === 1) query.andWhere("action_logs.actor_user_id", actorUserIds[0]);
+    if (actorUserIds.length > 1) query.whereIn("action_logs.actor_user_id", actorUserIds);
     if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {
-      where.$or = [
-        { resourceKind: parsed.resourceKind, resourceId: parsed.resourceId },
-        { parentResourceKind: parsed.resourceKind, parentResourceId: parsed.resourceId }
-      ];
+      query.andWhere(function applyRelatedScope() {
+        this.where({
+          "action_logs.resource_kind": parsed.resourceKind,
+          "action_logs.resource_id": parsed.resourceId
+        }).orWhere({
+          "action_logs.parent_resource_kind": parsed.resourceKind,
+          "action_logs.parent_resource_id": parsed.resourceId
+        });
+      });
     } else {
-      if (parsed.resourceKind) where.resourceKind = parsed.resourceKind;
-      if (parsed.resourceId) where.resourceId = parsed.resourceId;
+      if (parsed.resourceKind) query.andWhere("action_logs.resource_kind", parsed.resourceKind);
+      if (parsed.resourceId) query.andWhere("action_logs.resource_id", parsed.resourceId);
     }
-    if (parsed.undoableOnly) where.undoToken = { $ne: null };
-    if (parsed.before) where.createdAt = { ...where.createdAt, $lt: parsed.before };
-    if (parsed.after) where.createdAt = { ...where.createdAt, $gt: parsed.after };
-    const pageSize = parsed.pageSize ?? parsed.limit ?? 50;
-    const page = parsed.page ?? 1;
-    const offset = (page - 1) * pageSize;
-    const [items, total] = await this.em.findAndCount(
-      ActionLog,
-      where,
-      {
-        orderBy: { createdAt: "desc" },
-        limit: pageSize,
-        offset
-      }
-    );
-    await this.decryptEntries(items);
+    if (parsed.undoableOnly) query.whereNotNull("action_logs.undo_token");
+    if (parsed.before) query.andWhere("action_logs.created_at", "<", parsed.before);
+    if (parsed.after) query.andWhere("action_logs.created_at", ">", parsed.after);
+    const fieldNames = this.resolveFieldNames(parsed);
+    if (fieldNames.length > 0) {
+      const placeholders = fieldNames.map(() => "?").join(", ");
+      query.andWhereRaw(
+        `coalesce(action_logs.changed_fields, ARRAY[]::text[]) && ARRAY[${placeholders}]::text[]`,
+        fieldNames
+      );
+    }
+    const actionTypes = this.resolveActionTypes(parsed);
+    if (actionTypes.length === 1) query.andWhere("action_logs.action_type", actionTypes[0]);
+    if (actionTypes.length > 1) query.whereIn("action_logs.action_type", actionTypes);
+    if (parsed.sortField === "user") {
+      query.leftJoin("users as audit_actor", "audit_actor.id", "action_logs.actor_user_id");
+    }
+    const sortDir = parsed.sortDir === "asc" ? "asc" : "desc";
+    switch (parsed.sortField) {
+      case "user":
+        query.orderByRaw(`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '') ${sortDir}`);
+        break;
+      case "action":
+        query.orderByRaw(`coalesce(action_logs.action_type, '') ${sortDir}`);
+        break;
+      case "field":
+        query.orderByRaw(`coalesce(action_logs.primary_changed_field, '') ${sortDir}`);
+        break;
+      case "source":
+        query.orderByRaw(`coalesce(action_logs.source_key, '') ${sortDir}`);
+        break;
+      case "createdAt":
+      default:
+        query.orderBy(SORT_FIELDS.createdAt, sortDir);
+        query.orderBy("action_logs.id", sortDir);
+        return query;
+    }
+    query.orderBy("action_logs.created_at", "desc");
+    query.orderBy("action_logs.id", "desc");
+    return query;
+  }
+  async count(query) {
+    const parsed = this.parseListQuery(query);
+    const row = await this.buildListQuery(parsed).clearOrder().count({ count: "*" }).first();
+    if (!row) return 0;
+    const rawCount = row.count ?? 0;
+    return typeof rawCount === "number" ? rawCount : Number.parseInt(rawCount, 10) || 0;
+  }
+  async list(query) {
+    const parsed = this.parseListQuery(query);
+    const { page, pageSize } = this.resolvePagination(parsed);
+    const [items, total] = await Promise.all([
+      this.loadEntries(parsed),
+      this.count(parsed)
+    ]);
     const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)));
     return { items, total, page, pageSize, totalPages };
   }
@@ -228,9 +380,7 @@ class ActionLogService {
     }
     await fork.flush();
     await this.decryptEntries(log);
-    if (traceLog) {
-      await this.decryptEntries(traceLog);
-    }
+    if (traceLog) await this.decryptEntries(traceLog);
     return log;
   }
   async findByUndoToken(undoToken) {
@@ -278,6 +428,90 @@ class ActionLogService {
     await this.em.flush();
     return log;
   }
+  async backfillProjections(options = {}) {
+    const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1e3);
+    const logger = options.logger ?? (() => {
+    });
+    const result = {
+      errors: 0,
+      scanned: 0,
+      skipped: 0,
+      updated: 0
+    };
+    let cursorCreatedAt = null;
+    let cursorId = null;
+    while (true) {
+      const rowsQuery = this.em.getKnex()("action_logs").select(
+        "id",
+        "tenant_id",
+        "organization_id",
+        "actor_user_id",
+        "command_id",
+        "action_label",
+        "snapshot_before",
+        "changes_json",
+        "context_json",
+        "action_type",
+        "source_key",
+        "changed_fields",
+        "primary_changed_field",
+        "created_at"
+      ).whereNull("deleted_at");
+      if (options.tenantId) rowsQuery.andWhere("tenant_id", options.tenantId);
+      if (options.organizationId) rowsQuery.andWhere("organization_id", options.organizationId);
+      if (!options.force) {
+        rowsQuery.andWhere((builder) => {
+          builder.whereNull("action_type").orWhereNull("source_key").orWhereNull("changed_fields");
+        });
+      }
+      if (cursorCreatedAt && cursorId) {
+        rowsQuery.andWhere((builder) => {
+          builder.where("created_at", ">", cursorCreatedAt).orWhere((nested) => {
+            nested.where("created_at", cursorCreatedAt).andWhere("id", ">", cursorId);
+          });
+        });
+      }
+      const rows = await rowsQuery.orderBy("created_at", "asc").orderBy("id", "asc").limit(batchSize);
+      if (rows.length === 0) break;
+      for (const row of rows) {
+        result.scanned += 1;
+        try {
+          const decrypted = await this.decryptEntryPayload(row);
+          const projection = deriveActionLogProjection({
+            actorUserId: readString(decrypted, "actorUserId", "actor_user_id"),
+            actionLabel: readString(decrypted, "actionLabel", "action_label"),
+            changes: readRecord(decrypted, "changesJson", "changes_json"),
+            commandId: readString(decrypted, "commandId", "command_id") ?? "unknown",
+            context: readRecord(decrypted, "contextJson", "context_json"),
+            snapshotBefore: readValue(decrypted, "snapshotBefore", "snapshot_before")
+          });
+          const needsUpdate = options.force === true || row.action_type !== projection.actionType || row.source_key !== projection.sourceKey || row.primary_changed_field !== projection.primaryChangedField || !stringArraysEqual(row.changed_fields, projection.changedFields);
+          if (!needsUpdate) {
+            result.skipped += 1;
+            continue;
+          }
+          await this.em.getKnex()("action_logs").where({ id: row.id }).update({
+            action_type: projection.actionType,
+            changed_fields: projection.changedFields,
+            primary_changed_field: projection.primaryChangedField,
+            source_key: projection.sourceKey
+          });
+          result.updated += 1;
+        } catch (err) {
+          result.errors += 1;
+          logger(`[backfill] Failed for action log ${row.id}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      const lastRow = rows[rows.length - 1];
+      cursorCreatedAt = lastRow.created_at;
+      cursorId = lastRow.id;
+      logger(
+        `[backfill] Processed ${result.scanned} action logs (updated: ${result.updated}, skipped: ${result.skipped}, errors: ${result.errors})`
+      );
+      if (rows.length < batchSize) break;
+    }
+    return result;
+  }
 }
 export {
   ActionLogService

package/dist/modules/audit_logs/services/actionLogService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/audit_logs/services/actionLogService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  actionLogCreateSchema,\n  actionLogListSchema,\n  type ActionLogCreateInput,\n  type ActionLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { toOptionalString } from '@open-mercato/shared/lib/string/coerce'\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\nlet decryptionWarningLogged = false\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\nexport class ActionLogService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly tenantEncryptionService?: TenantDataEncryptionService,\n  ) {}\n\n  private async decryptEntries(entries: ActionLog | ActionLog[] | null | undefined): Promise<void> {\n    if (!entries) return\n    if (!this.tenantEncryptionService?.isEnabled()) return\n    const list = Array.isArray(entries) ? entries : [entries]\n    for (const entry of list) {\n      try {\n        const dek = await this.tenantEncryptionService.getDek(entry.tenantId ?? null)\n        const deepDecrypt = (value: unknown): unknown => {\n          if (!dek) return value\n          if (typeof value === 'string' && value.split(':').length === 4 && value.endsWith(':v1')) {\n            const decrypted = decryptWithAesGcm(value, dek.key)\n            if (decrypted === null) return value\n            try { return JSON.parse(decrypted) } catch { return decrypted }\n          }\n          if (Array.isArray(value)) return value.map((item) => deepDecrypt(item))\n          if (value && typeof value === 'object') {\n            const copy: Record<string, unknown> = {}\n            for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n              copy[k] = deepDecrypt(v)\n            }\n            return copy\n          }\n          return value\n        }\n        const decrypted = await this.tenantEncryptionService.decryptEntityPayload(\n          'audit_logs:action_log',\n          entry as unknown as Record<string, unknown>,\n          entry.tenantId ?? null,\n          entry.organizationId ?? null,\n        )\n        const merged = { ...decrypted }\n        merged.changesJson = deepDecrypt(merged.changesJson ?? (entry as any)?.changesJson)\n        merged.snapshotBefore = deepDecrypt(merged.snapshotBefore ?? (entry as any)?.snapshotBefore)\n        merged.snapshotAfter = deepDecrypt(merged.snapshotAfter ?? (entry as any)?.snapshotAfter)\n        merged.commandPayload = deepDecrypt(merged.commandPayload ?? (entry as any)?.commandPayload)\n        merged.contextJson = deepDecrypt(merged.contextJson ?? (entry as any)?.contextJson)\n        Object.assign(entry as any, merged)\n      } catch (err) {\n        if (!decryptionWarningLogged) {\n          decryptionWarningLogged = true\n          // eslint-disable-next-line no-console\n          console.warn('[audit_logs] failed to decrypt action log entry', err)\n        }\n      }\n    }\n  }\n\n  async log(input: ActionLogCreateInput): Promise<ActionLog | null> {\n    const data = this.parseCreateInput(input)\n    const fork = this.em.fork()\n    const log = this.createLogEntity(fork, data)\n    await fork.persistAndFlush(log)\n    await this.decryptEntries(log)\n    return log\n  }\n\n  private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {\n    let data: ActionLogCreateInput\n    const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n    if (shouldValidate) {\n      try {\n        data = schema.parse(input)\n        runtimeValidationAvailable = true\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          // eslint-disable-next-line no-console\n          console.warn('[audit_logs] falling back to permissive action log payload parser', err)\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        data = this.normalizeInput(input)\n      }\n    } else {\n      data = this.normalizeInput(input)\n    }\n    return data\n  }\n\n  private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {\n    return fork.create(ActionLog, {\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      commandId: data.commandId,\n      actionLabel: data.actionLabel ?? null,\n      resourceKind: data.resourceKind ?? null,\n      resourceId: data.resourceId ?? null,\n      parentResourceKind: data.parentResourceKind ?? null,\n      parentResourceId: data.parentResourceId ?? null,\n      executionState: data.executionState ?? 'done',\n      undoToken: data.undoToken ?? null,\n      commandPayload: data.commandPayload ?? null,\n      snapshotBefore: data.snapshotBefore ?? null,\n      snapshotAfter: data.snapshotAfter ?? null,\n      changesJson: data.changes ?? null,\n      contextJson: data.context ?? null,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n  }\n\n  private normalizeInput(input: Partial<ActionLogCreateInput> | null | undefined): ActionLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        commandId: 'unknown',\n        actionLabel: undefined,\n        resourceKind: undefined,\n        resourceId: undefined,\n        executionState: 'done',\n        undoToken: undefined,\n        commandPayload: undefined,\n        snapshotBefore: undefined,\n        snapshotAfter: undefined,\n        changes: undefined,\n        context: undefined,\n      }\n    }\n    const toNullableUuid = (value: unknown) => {\n      if (typeof value !== 'string' || value.length === 0) return null\n      // Extract UUID from \"api_key:<uuid>\" format (used by workflow authentication)\n      if (value.startsWith('api_key:')) {\n        return value.slice('api_key:'.length)\n      }\n      return value\n    }\n    const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {\n      if (value === null) return null\n      if (Array.isArray(value)) return value\n      if (typeof value === 'object') return value as Record<string, unknown>\n      return undefined\n    }\n    const normalizeContext = (value: unknown) => (typeof value === 'object' && value !== null && !Array.isArray(value)\n      ? value as Record<string, unknown>\n      : undefined)\n\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: toNullableUuid(input.actorUserId),\n      commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',\n      actionLabel: toOptionalString(input.actionLabel) ?? undefined,\n      resourceKind: toOptionalString(input.resourceKind) ?? undefined,\n      resourceId: toOptionalString(input.resourceId) ?? undefined,\n      parentResourceKind: toOptionalString(input.parentResourceKind) ?? null,\n      parentResourceId: toOptionalString(input.parentResourceId) ?? null,\n      executionState: input.executionState === 'undone' || input.executionState === 'failed' ? input.executionState : 'done',\n      undoToken: toOptionalString(input.undoToken) ?? undefined,\n      commandPayload: input.commandPayload,\n      snapshotBefore: input.snapshotBefore,\n      snapshotAfter: input.snapshotAfter,\n      changes: normalizeRecordLike(input.changes),\n      context: normalizeContext(input.context),\n    }\n  }\n\n  async list(query: Partial<ActionLogListQuery>) {\n    const parsed = actionLogListSchema.parse({\n      ...query,\n    })\n\n    const where: FilterQuery<ActionLog> = { deletedAt: null }\n    if (parsed.tenantId) where.tenantId = parsed.tenantId\n    if (parsed.organizationId) where.organizationId = parsed.organizationId\n    if (parsed.actorUserId) where.actorUserId = parsed.actorUserId\n    if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {\n      where.$or = [\n        { resourceKind: parsed.resourceKind, resourceId: parsed.resourceId },\n        { parentResourceKind: parsed.resourceKind, parentResourceId: parsed.resourceId },\n      ] as any\n    } else {\n      if (parsed.resourceKind) where.resourceKind = parsed.resourceKind\n      if (parsed.resourceId) where.resourceId = parsed.resourceId\n    }\n    if (parsed.undoableOnly) where.undoToken = { $ne: null } as any\n    if (parsed.before) where.createdAt = { ...(where.createdAt as Record<string, any> | undefined), $lt: parsed.before } as any\n    if (parsed.after) where.createdAt = { ...(where.createdAt as Record<string, any> | undefined), $gt: parsed.after } as any\n\n    const pageSize = parsed.pageSize ?? parsed.limit ?? 50\n    const page = parsed.page ?? 1\n    const offset = (page - 1) * pageSize\n\n    const [items, total] = await this.em.findAndCount(\n      ActionLog,\n      where,\n      {\n        orderBy: { createdAt: 'desc' },\n        limit: pageSize,\n        offset,\n      },\n    )\n    await this.decryptEntries(items)\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  async latestUndoableForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markUndone(id: string, traceInput?: ActionLogCreateInput) {\n    const fork = this.em.fork()\n    const log = await fork.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n    log.executionState = 'undone'\n    log.undoToken = null\n    const traceLog = traceInput ? this.createLogEntity(fork, this.parseCreateInput(traceInput)) : null\n    if (traceLog) {\n      fork.persist(traceLog)\n    }\n    await fork.flush()\n    await this.decryptEntries(log)\n    if (traceLog) {\n      await this.decryptEntries(traceLog)\n    }\n    return log\n  }\n\n  async findByUndoToken(undoToken: string) {\n    const entry = await this.em.findOne(ActionLog, { undoToken, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async findById(id: string) {\n    const entry = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoableForResource(params: {\n    actorUserId: string\n    tenantId?: string | null\n    organizationId?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n  }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId: params.actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (params.tenantId) where.tenantId = params.tenantId\n    if (params.organizationId) where.organizationId = params.organizationId\n    if (params.resourceKind) where.resourceKind = params.resourceKind\n    if (params.resourceId) where.resourceId = params.resourceId\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoneForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      executionState: 'undone',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { updatedAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markRedone(id: string) {\n    const log = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n    log.executionState = 'redone'\n    log.undoToken = null\n    await this.em.flush()\n    return log\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP,SAAS,yBAAyB;AAClC,SAAS,wBAAwB;AAEjC,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AACjD,IAAI,0BAA0B;AAE9B,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAEjI,MAAM,iBAAiB;AAAA,EAC5B,YACmB,IACA,yBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAc,eAAe,SAAoE;AAC/F,QAAI,CAAC,QAAS;AACd,QAAI,CAAC,KAAK,yBAAyB,UAAU,EAAG;AAChD,UAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,eAAW,SAAS,MAAM;AACxB,UAAI;AACF,cAAM,MAAM,MAAM,KAAK,wBAAwB,OAAO,MAAM,YAAY,IAAI;AAC5E,cAAM,cAAc,CAAC,UAA4B;AAC/C,cAAI,CAAC,IAAK,QAAO;AACjB,cAAI,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,EAAE,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AACvF,kBAAMA,aAAY,kBAAkB,OAAO,IAAI,GAAG;AAClD,gBAAIA,eAAc,KAAM,QAAO;AAC/B,gBAAI;AAAE,qBAAO,KAAK,MAAMA,UAAS;AAAA,YAAE,QAAQ;AAAE,qBAAOA;AAAA,YAAU;AAAA,UAChE;AACA,cAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC;AACtE,cAAI,SAAS,OAAO,UAAU,UAAU;AACtC,kBAAM,OAAgC,CAAC;AACvC,uBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACrE,mBAAK,CAAC,IAAI,YAAY,CAAC;AAAA,YACzB;AACA,mBAAO;AAAA,UACT;AACA,iBAAO;AAAA,QACT;AACA,cAAM,YAAY,MAAM,KAAK,wBAAwB;AAAA,UACnD;AAAA,UACA;AAAA,UACA,MAAM,YAAY;AAAA,UAClB,MAAM,kBAAkB;AAAA,QAC1B;AACA,cAAM,SAAS,EAAE,GAAG,UAAU;AAC9B,eAAO,cAAc,YAAY,OAAO,eAAgB,OAAe,WAAW;AAClF,eAAO,iBAAiB,YAAY,OAAO,kBAAmB,OAAe,cAAc;AAC3F,eAAO,gBAAgB,YAAY,OAAO,iBAAkB,OAAe,aAAa;AACxF,eAAO,iBAAiB,YAAY,OAAO,kBAAmB,OAAe,cAAc;AAC3F,eAAO,cAAc,YAAY,OAAO,eAAgB,OAAe,WAAW;AAClF,eAAO,OAAO,OAAc,MAAM;AAAA,MACpC,SAAS,KAAK;AACZ,YAAI,CAAC,yBAAyB;AAC5B,oCAA0B;AAE1B,kBAAQ,KAAK,mDAAmD,GAAG;AAAA,QACrE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,OAAwD;AAChE,UAAM,OAAO,KAAK,iBAAiB,KAAK;AACxC,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AAC3C,UAAM,KAAK,gBAAgB,GAAG;AAC9B,UAAM,KAAK,eAAe,GAAG;AAC7B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,OAAmD;AAC1E,QAAI;AACJ,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AACrE,QAAI,gBAAgB;AAClB,UAAI;AACF,eAAO,OAAO,MAAM,KAAK;AACzB,qCAA6B;AAAA,MAC/B,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAE1B,kBAAQ,KAAK,qEAAqE,GAAG;AAAA,QACvF;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,KAAK;AAAA,MAClC;AAAA,IACF,OAAO;AACL,aAAO,KAAK,eAAe,KAAK;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAqB,MAAuC;AAClF,WAAO,KAAK,OAAO,WAAW;AAAA,MAC5B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,oBAAoB,KAAK,sBAAsB;AAAA,MAC/C,kBAAkB,KAAK,oBAAoB;AAAA,MAC3C,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,WAAW,KAAK,aAAa;AAAA,MAC7B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,KAAK,WAAW;AAAA,MAC7B,aAAa,KAAK,WAAW;AAAA,MAC7B,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM,iBAAiB,CAAC,UAAmB;AACzC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAE5D,UAAI,MAAM,WAAW,UAAU,GAAG;AAChC,eAAO,MAAM,MAAM,WAAW,MAAM;AAAA,MACtC;AACA,aAAO;AAAA,IACT;AACA,UAAM,sBAAsB,CAAC,UAAoD;AAC/E,UAAI,UAAU,KAAM,QAAO;AAC3B,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO;AAAA,IACT;AACA,UAAM,mBAAmB,CAAC,UAAoB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC7G,QACA;AAEJ,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,eAAe,MAAM,WAAW;AAAA,MAC7C,WAAW,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAAI,MAAM,YAAY;AAAA,MACjG,aAAa,iBAAiB,MAAM,WAAW,KAAK;AAAA,MACpD,cAAc,iBAAiB,MAAM,YAAY,KAAK;AAAA,MACtD,YAAY,iBAAiB,MAAM,UAAU,KAAK;AAAA,MAClD,oBAAoB,iBAAiB,MAAM,kBAAkB,KAAK;AAAA,MAClE,kBAAkB,iBAAiB,MAAM,gBAAgB,KAAK;AAAA,MAC9D,gBAAgB,MAAM,mBAAmB,YAAY,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAChH,WAAW,iBAAiB,MAAM,SAAS,KAAK;AAAA,MAChD,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM;AAAA,MACrB,SAAS,oBAAoB,MAAM,OAAO;AAAA,MAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,oBAAoB,MAAM;AAAA,MACvC,GAAG;AAAA,IACL,CAAC;AAED,UAAM,QAAgC,EAAE,WAAW,KAAK;AACxD,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,YAAa,OAAM,cAAc,OAAO;AACnD,QAAI,OAAO,kBAAkB,OAAO,gBAAgB,OAAO,YAAY;AACrE,YAAM,MAAM;AAAA,QACV,EAAE,cAAc,OAAO,cAAc,YAAY,OAAO,WAAW;AAAA,QACnE,EAAE,oBAAoB,OAAO,cAAc,kBAAkB,OAAO,WAAW;AAAA,MACjF;AAAA,IACF,OAAO;AACL,UAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,UAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AAAA,IACnD;AACA,QAAI,OAAO,aAAc,OAAM,YAAY,EAAE,KAAK,KAAK;AACvD,QAAI,OAAO,OAAQ,OAAM,YAAY,EAAE,GAAI,MAAM,WAA+C,KAAK,OAAO,OAAO;AACnH,QAAI,OAAO,MAAO,OAAM,YAAY,EAAE,GAAI,MAAM,WAA+C,KAAK,OAAO,MAAM;AAEjH,UAAM,WAAW,OAAO,YAAY,OAAO,SAAS;AACpD,UAAM,OAAO,OAAO,QAAQ;AAC5B,UAAM,UAAU,OAAO,KAAK;AAE5B,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,KAAK,GAAG;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,eAAe,KAAK;AAC/B,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAM,uBAAuB,aAAqB,OAAqE;AACrH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY,YAAmC;AAC9D,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAChB,UAAM,WAAW,aAAa,KAAK,gBAAgB,MAAM,KAAK,iBAAiB,UAAU,CAAC,IAAI;AAC9F,QAAI,UAAU;AACZ,WAAK,QAAQ,QAAQ;AAAA,IACvB;AACA,UAAM,KAAK,MAAM;AACjB,UAAM,KAAK,eAAe,GAAG;AAC7B,QAAI,UAAU;AACZ,YAAM,KAAK,eAAe,QAAQ;AAAA,IACpC;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,WAAmB;AACvC,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,WAAW,WAAW,KAAK,CAAC;AAC7E,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACtE,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,QAM7B;AACD,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AACjD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBAAqB,aAAqB,OAAqE;AACnH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AACvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY;AAC3B,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACpE,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAChB,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  actionLogCreateSchema,\n  actionLogListSchema,\n  type ActionLogCreateInput,\n  type ActionLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { isRecord } from '@open-mercato/core/modules/audit_logs/lib/changeRows'\nimport {\n  ACTION_LOG_FILTER_TYPES,\n  type ActionLogFilterType,\n  deriveActionLogProjection,\n} from '@open-mercato/core/modules/audit_logs/lib/projections'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { toOptionalString } from '@open-mercato/shared/lib/string/coerce'\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\nlet decryptionWarningLogged = false\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\nconst SORT_FIELDS = {\n  createdAt: 'action_logs.created_at',\n} as const\n\ntype ActionLogProjectionBackfillOptions = {\n  batchSize?: number\n  force?: boolean\n  logger?: (message: string) => void\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport type ActionLogProjectionBackfillResult = {\n  errors: number\n  scanned: number\n  skipped: number\n  updated: number\n}\n\ntype BackfillRow = {\n  action_label: string | null\n  action_type: string | null\n  actor_user_id: string | null\n  changed_fields: string[] | null\n  changes_json: Record<string, unknown> | null\n  command_id: string\n  context_json: Record<string, unknown> | null\n  created_at: Date\n  id: string\n  organization_id: string | null\n  primary_changed_field: string | null\n  snapshot_before: unknown | null\n  source_key: string | null\n  tenant_id: string | null\n}\n\nfunction readString(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n\n  return null\n}\n\nfunction readRecord(record: Record<string, unknown>, ...keys: string[]): Record<string, unknown> | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (isRecord(value)) return value\n  }\n\n  return null\n}\n\nfunction readValue(record: Record<string, unknown>, ...keys: string[]): unknown {\n  for (const key of keys) {\n    if (Object.prototype.hasOwnProperty.call(record, key)) return record[key]\n  }\n\n  return undefined\n}\n\nfunction readStringArray(record: Record<string, unknown>, ...keys: string[]): string[] | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (Array.isArray(value)) {\n      return value.filter((entry): entry is string => typeof entry === 'string')\n    }\n  }\n\n  return null\n}\n\nfunction stringArraysEqual(left: string[] | null, right: string[]): boolean {\n  if (!Array.isArray(left)) return false\n  if (left.length !== right.length) return false\n\n  return left.every((value, index) => value === right[index])\n}\n\nexport class ActionLogService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly tenantEncryptionService?: TenantDataEncryptionService,\n  ) {}\n\n  private async decryptEntryPayload<T extends Record<string, unknown>>(entry: T): Promise<T> {\n    if (!this.tenantEncryptionService?.isEnabled()) return entry\n\n    try {\n      const tenantId = readString(entry, 'tenantId', 'tenant_id')\n      const organizationId = readString(entry, 'organizationId', 'organization_id')\n      const dek = await this.tenantEncryptionService.getDek(tenantId)\n      const deepDecrypt = (value: unknown): unknown => {\n        if (!dek) return value\n        if (typeof value === 'string' && value.split(':').length === 4 && value.endsWith(':v1')) {\n          const decrypted = decryptWithAesGcm(value, dek.key)\n          if (decrypted === null) return value\n          try {\n            return JSON.parse(decrypted)\n          } catch {\n            return decrypted\n          }\n        }\n        if (Array.isArray(value)) return value.map((item) => deepDecrypt(item))\n        if (value && typeof value === 'object') {\n          const copy: Record<string, unknown> = {}\n          for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n            copy[key] = deepDecrypt(item)\n          }\n          return copy\n        }\n        return value\n      }\n\n      const decrypted = await this.tenantEncryptionService.decryptEntityPayload(\n        'audit_logs:action_log',\n        entry,\n        tenantId,\n        organizationId,\n      )\n\n      const merged = {\n        ...entry,\n        ...decrypted,\n      } as Record<string, unknown>\n\n      merged.changesJson = deepDecrypt(merged.changesJson ?? merged.changes_json ?? entry.changesJson ?? entry.changes_json)\n      merged.changes_json = merged.changesJson\n      merged.snapshotBefore = deepDecrypt(merged.snapshotBefore ?? merged.snapshot_before ?? entry.snapshotBefore ?? entry.snapshot_before)\n      merged.snapshot_before = merged.snapshotBefore\n      merged.snapshotAfter = deepDecrypt(merged.snapshotAfter ?? merged.snapshot_after ?? entry.snapshotAfter ?? entry.snapshot_after)\n      merged.snapshot_after = merged.snapshotAfter\n      merged.commandPayload = deepDecrypt(merged.commandPayload ?? merged.command_payload ?? entry.commandPayload ?? entry.command_payload)\n      merged.command_payload = merged.commandPayload\n      merged.contextJson = deepDecrypt(merged.contextJson ?? merged.context_json ?? entry.contextJson ?? entry.context_json)\n      merged.context_json = merged.contextJson\n\n      return merged as T\n    } catch (err) {\n      if (!decryptionWarningLogged) {\n        decryptionWarningLogged = true\n        console.warn('[audit_logs] failed to decrypt action log entry', err)\n      }\n      return entry\n    }\n  }\n\n  private async decryptEntries(entries: ActionLog | ActionLog[] | null | undefined): Promise<void> {\n    if (!entries) return\n\n    const list = Array.isArray(entries) ? entries : [entries]\n    for (const entry of list) {\n      Object.assign(entry as unknown as Record<string, unknown>, await this.decryptEntryPayload(entry as unknown as Record<string, unknown>))\n    }\n  }\n\n  async log(input: ActionLogCreateInput): Promise<ActionLog | null> {\n    const data = this.parseCreateInput(input)\n    const fork = this.em.fork()\n    const log = this.createLogEntity(fork, data)\n    await fork.persistAndFlush(log)\n    await this.decryptEntries(log)\n    return log\n  }\n\n  private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {\n    let data: ActionLogCreateInput\n    const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n\n    if (shouldValidate) {\n      try {\n        data = schema.parse(input)\n        runtimeValidationAvailable = true\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          console.warn('[audit_logs] falling back to permissive action log payload parser', err)\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        data = this.normalizeInput(input)\n      }\n    } else {\n      data = this.normalizeInput(input)\n    }\n\n    return data\n  }\n\n  private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {\n    const projection = deriveActionLogProjection({\n      actorUserId: data.actorUserId ?? null,\n      actionLabel: data.actionLabel ?? null,\n      changes: isRecord(data.changes) ? data.changes : null,\n      commandId: data.commandId,\n      context: isRecord(data.context) ? data.context : null,\n      snapshotBefore: data.snapshotBefore,\n    })\n\n    return fork.create(ActionLog, {\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      commandId: data.commandId,\n      actionLabel: data.actionLabel ?? null,\n      actionType: projection.actionType,\n      resourceKind: data.resourceKind ?? null,\n      resourceId: data.resourceId ?? null,\n      parentResourceKind: data.parentResourceKind ?? null,\n      parentResourceId: data.parentResourceId ?? null,\n      executionState: data.executionState ?? 'done',\n      undoToken: data.undoToken ?? null,\n      commandPayload: data.commandPayload ?? null,\n      snapshotBefore: data.snapshotBefore ?? null,\n      snapshotAfter: data.snapshotAfter ?? null,\n      changesJson: isRecord(data.changes) ? data.changes : null,\n      changedFields: projection.changedFields,\n      primaryChangedField: projection.primaryChangedField,\n      contextJson: isRecord(data.context) ? data.context : null,\n      sourceKey: projection.sourceKey,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n  }\n\n  private normalizeInput(input: Partial<ActionLogCreateInput> | null | undefined): ActionLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        commandId: 'unknown',\n        actionLabel: undefined,\n        resourceKind: undefined,\n        resourceId: undefined,\n        executionState: 'done',\n        undoToken: undefined,\n        commandPayload: undefined,\n        snapshotBefore: undefined,\n        snapshotAfter: undefined,\n        changes: undefined,\n        context: undefined,\n      }\n    }\n\n    const toNullableUuid = (value: unknown) => {\n      if (typeof value !== 'string' || value.length === 0) return null\n      if (value.startsWith('api_key:')) return value.slice('api_key:'.length)\n      return value\n    }\n\n    const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {\n      if (value === null) return null\n      if (Array.isArray(value)) return value\n      if (typeof value === 'object') return value as Record<string, unknown>\n      return undefined\n    }\n\n    const normalizeContext = (value: unknown) => (\n      typeof value === 'object' && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined\n    )\n\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: toNullableUuid(input.actorUserId),\n      commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',\n      actionLabel: toOptionalString(input.actionLabel) ?? undefined,\n      resourceKind: toOptionalString(input.resourceKind) ?? undefined,\n      resourceId: toOptionalString(input.resourceId) ?? undefined,\n      parentResourceKind: toOptionalString(input.parentResourceKind) ?? null,\n      parentResourceId: toOptionalString(input.parentResourceId) ?? null,\n      executionState: input.executionState === 'undone' || input.executionState === 'failed' ? input.executionState : 'done',\n      undoToken: toOptionalString(input.undoToken) ?? undefined,\n      commandPayload: input.commandPayload,\n      snapshotBefore: input.snapshotBefore,\n      snapshotAfter: input.snapshotAfter,\n      changes: normalizeRecordLike(input.changes),\n      context: normalizeContext(input.context),\n    }\n  }\n\n  private parseListQuery(query: Partial<ActionLogListQuery>) {\n    return actionLogListSchema.parse({\n      ...query,\n    })\n  }\n\n  private resolveActorUserIds(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.actorUserIds ?? [])]\n    if (parsed.actorUserId) values.push(parsed.actorUserId)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveFieldNames(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.fieldNames ?? [])]\n    if (parsed.fieldName) values.push(parsed.fieldName)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveActionTypes(parsed: ActionLogListQuery): ActionLogFilterType[] {\n    const values = [...(parsed.actionTypes ?? [])]\n    if (parsed.actionType) values.push(parsed.actionType)\n\n    return Array.from(new Set(values))\n      .filter((value): value is ActionLogFilterType => ACTION_LOG_FILTER_TYPES.includes(value as ActionLogFilterType))\n  }\n\n  private resolvePagination(parsed: ActionLogListQuery): { page: number; pageSize: number; offset: number; limit: number } {\n    const pageSize =\n      typeof parsed.pageSize === 'number' && parsed.pageSize > 0\n        ? parsed.pageSize\n        : typeof parsed.limit === 'number' && parsed.limit > 0\n          ? parsed.limit\n          : 50\n    const page = typeof parsed.page === 'number' && parsed.page > 0 ? parsed.page : 1\n    const offset =\n      typeof parsed.offset === 'number' && parsed.offset >= 0\n        ? parsed.offset\n        : (page - 1) * pageSize\n    return { page, pageSize, offset, limit: pageSize }\n  }\n\n  private async loadEntries(parsed: ActionLogListQuery, options?: { paginate?: boolean }) {\n    const query = this.buildListQuery(parsed).select<{ id: string }[]>('action_logs.id as id')\n\n    if (options?.paginate !== false) {\n      const { limit, offset } = this.resolvePagination(parsed)\n      query.limit(limit).offset(offset)\n    }\n\n    const rows = await query\n    const ids = rows.map((row) => row.id).filter(Boolean)\n    if (ids.length === 0) return []\n\n    const results = await this.em.find(ActionLog, {\n      id: { $in: ids } as any,\n      deletedAt: null,\n    })\n    await this.decryptEntries(results)\n\n    const byId = new Map(results.map((entry) => [entry.id, entry]))\n    return ids\n      .map((id) => byId.get(id))\n      .filter((entry): entry is ActionLog => Boolean(entry))\n  }\n\n  private buildListQuery(parsed: ActionLogListQuery) {\n    const query = this.em.getKnex()('action_logs').whereNull('action_logs.deleted_at')\n\n    if (parsed.tenantId) query.andWhere('action_logs.tenant_id', parsed.tenantId)\n    if (parsed.organizationId) query.andWhere('action_logs.organization_id', parsed.organizationId)\n\n    const actorUserIds = this.resolveActorUserIds(parsed)\n    if (actorUserIds.length === 1) query.andWhere('action_logs.actor_user_id', actorUserIds[0])\n    if (actorUserIds.length > 1) query.whereIn('action_logs.actor_user_id', actorUserIds)\n\n    if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {\n      query.andWhere(function applyRelatedScope() {\n        this.where({\n          'action_logs.resource_kind': parsed.resourceKind,\n          'action_logs.resource_id': parsed.resourceId,\n        }).orWhere({\n          'action_logs.parent_resource_kind': parsed.resourceKind,\n          'action_logs.parent_resource_id': parsed.resourceId,\n        })\n      })\n    } else {\n      if (parsed.resourceKind) query.andWhere('action_logs.resource_kind', parsed.resourceKind)\n      if (parsed.resourceId) query.andWhere('action_logs.resource_id', parsed.resourceId)\n    }\n\n    if (parsed.undoableOnly) query.whereNotNull('action_logs.undo_token')\n    if (parsed.before) query.andWhere('action_logs.created_at', '<', parsed.before)\n    if (parsed.after) query.andWhere('action_logs.created_at', '>', parsed.after)\n\n    const fieldNames = this.resolveFieldNames(parsed)\n    if (fieldNames.length > 0) {\n      const placeholders = fieldNames.map(() => '?').join(', ')\n      query.andWhereRaw(\n        `coalesce(action_logs.changed_fields, ARRAY[]::text[]) && ARRAY[${placeholders}]::text[]`,\n        fieldNames,\n      )\n    }\n\n    const actionTypes = this.resolveActionTypes(parsed)\n    if (actionTypes.length === 1) query.andWhere('action_logs.action_type', actionTypes[0])\n    if (actionTypes.length > 1) query.whereIn('action_logs.action_type', actionTypes)\n\n    if (parsed.sortField === 'user') {\n      query.leftJoin('users as audit_actor', 'audit_actor.id', 'action_logs.actor_user_id')\n    }\n\n    const sortDir = parsed.sortDir === 'asc' ? 'asc' : 'desc'\n    switch (parsed.sortField) {\n      case 'user':\n        query.orderByRaw(`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '') ${sortDir}`)\n        break\n      case 'action':\n        query.orderByRaw(`coalesce(action_logs.action_type, '') ${sortDir}`)\n        break\n      case 'field':\n        query.orderByRaw(`coalesce(action_logs.primary_changed_field, '') ${sortDir}`)\n        break\n      case 'source':\n        query.orderByRaw(`coalesce(action_logs.source_key, '') ${sortDir}`)\n        break\n      case 'createdAt':\n      default:\n        query.orderBy(SORT_FIELDS.createdAt, sortDir)\n        query.orderBy('action_logs.id', sortDir)\n        return query\n    }\n\n    query.orderBy('action_logs.created_at', 'desc')\n    query.orderBy('action_logs.id', 'desc')\n    return query\n  }\n\n  async count(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const row = await this.buildListQuery(parsed)\n      .clearOrder()\n      .count<{ count: string | number }>({ count: '*' })\n      .first()\n\n    if (!row) return 0\n    const rawCount = row.count ?? 0\n    return typeof rawCount === 'number' ? rawCount : Number.parseInt(rawCount, 10) || 0\n  }\n\n  async list(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const { page, pageSize } = this.resolvePagination(parsed)\n    const [items, total] = await Promise.all([\n      this.loadEntries(parsed),\n      this.count(parsed),\n    ])\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  async latestUndoableForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markUndone(id: string, traceInput?: ActionLogCreateInput) {\n    const fork = this.em.fork()\n    const log = await fork.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'undone'\n    log.undoToken = null\n\n    const traceLog = traceInput ? this.createLogEntity(fork, this.parseCreateInput(traceInput)) : null\n    if (traceLog) {\n      fork.persist(traceLog)\n    }\n\n    await fork.flush()\n    await this.decryptEntries(log)\n    if (traceLog) await this.decryptEntries(traceLog)\n\n    return log\n  }\n\n  async findByUndoToken(undoToken: string) {\n    const entry = await this.em.findOne(ActionLog, { undoToken, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async findById(id: string) {\n    const entry = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoableForResource(params: {\n    actorUserId: string\n    tenantId?: string | null\n    organizationId?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n  }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId: params.actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (params.tenantId) where.tenantId = params.tenantId\n    if (params.organizationId) where.organizationId = params.organizationId\n    if (params.resourceKind) where.resourceKind = params.resourceKind\n    if (params.resourceId) where.resourceId = params.resourceId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoneForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      executionState: 'undone',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { updatedAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markRedone(id: string) {\n    const log = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'redone'\n    log.undoToken = null\n    await this.em.flush()\n    return log\n  }\n\n  async backfillProjections(options: ActionLogProjectionBackfillOptions = {}): Promise<ActionLogProjectionBackfillResult> {\n    const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1000)\n    const logger = options.logger ?? (() => {})\n    const result: ActionLogProjectionBackfillResult = {\n      errors: 0,\n      scanned: 0,\n      skipped: 0,\n      updated: 0,\n    }\n\n    let cursorCreatedAt: Date | null = null\n    let cursorId: string | null = null\n\n    while (true) {\n      const rowsQuery = this.em.getKnex()<BackfillRow>('action_logs')\n        .select(\n          'id',\n          'tenant_id',\n          'organization_id',\n          'actor_user_id',\n          'command_id',\n          'action_label',\n          'snapshot_before',\n          'changes_json',\n          'context_json',\n          'action_type',\n          'source_key',\n          'changed_fields',\n          'primary_changed_field',\n          'created_at',\n        )\n        .whereNull('deleted_at')\n\n      if (options.tenantId) rowsQuery.andWhere('tenant_id', options.tenantId)\n      if (options.organizationId) rowsQuery.andWhere('organization_id', options.organizationId)\n\n      if (!options.force) {\n        rowsQuery.andWhere((builder) => {\n          builder\n            .whereNull('action_type')\n            .orWhereNull('source_key')\n            .orWhereNull('changed_fields')\n        })\n      }\n\n      if (cursorCreatedAt && cursorId) {\n        rowsQuery.andWhere((builder) => {\n          builder\n            .where('created_at', '>', cursorCreatedAt)\n            .orWhere((nested) => {\n              nested.where('created_at', cursorCreatedAt).andWhere('id', '>', cursorId)\n            })\n        })\n      }\n\n      const rows = await rowsQuery\n        .orderBy('created_at', 'asc')\n        .orderBy('id', 'asc')\n        .limit(batchSize)\n\n      if (rows.length === 0) break\n\n      for (const row of rows) {\n        result.scanned += 1\n\n        try {\n          const decrypted = await this.decryptEntryPayload(row as unknown as Record<string, unknown>)\n          const projection = deriveActionLogProjection({\n            actorUserId: readString(decrypted, 'actorUserId', 'actor_user_id'),\n            actionLabel: readString(decrypted, 'actionLabel', 'action_label'),\n            changes: readRecord(decrypted, 'changesJson', 'changes_json'),\n            commandId: readString(decrypted, 'commandId', 'command_id') ?? 'unknown',\n            context: readRecord(decrypted, 'contextJson', 'context_json'),\n            snapshotBefore: readValue(decrypted, 'snapshotBefore', 'snapshot_before'),\n          })\n\n          const needsUpdate = options.force === true\n            || row.action_type !== projection.actionType\n            || row.source_key !== projection.sourceKey\n            || row.primary_changed_field !== projection.primaryChangedField\n            || !stringArraysEqual(row.changed_fields, projection.changedFields)\n\n          if (!needsUpdate) {\n            result.skipped += 1\n            continue\n          }\n\n          await this.em.getKnex()('action_logs')\n            .where({ id: row.id })\n            .update({\n              action_type: projection.actionType,\n              changed_fields: projection.changedFields,\n              primary_changed_field: projection.primaryChangedField,\n              source_key: projection.sourceKey,\n            })\n\n          result.updated += 1\n        } catch (err) {\n          result.errors += 1\n          logger(`[backfill] Failed for action log ${row.id}: ${err instanceof Error ? err.message : String(err)}`)\n        }\n      }\n\n      const lastRow = rows[rows.length - 1]\n      cursorCreatedAt = lastRow.created_at\n      cursorId = lastRow.id\n\n      logger(\n        `[backfill] Processed ${result.scanned} action logs (updated: ${result.updated}, skipped: ${result.skipped}, errors: ${result.errors})`,\n      )\n\n      if (rows.length < batchSize) break\n    }\n\n    return result\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AACP,SAAS,yBAAyB;AAElC,SAAS,wBAAwB;AAEjC,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AACjD,IAAI,0BAA0B;AAE9B,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAExI,MAAM,cAAc;AAAA,EAClB,WAAW;AACb;AAkCA,SAAS,WAAW,WAAoC,MAA+B;AACrF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AAEA,SAAO;AACT;AAEA,SAAS,WAAW,WAAoC,MAAgD;AACtG,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,KAAK,EAAG,QAAO;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,UAAU,WAAoC,MAAyB;AAC9E,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,EAAG,QAAO,OAAO,GAAG;AAAA,EAC1E;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,WAAoC,MAAiC;AAC5F,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC3E;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAuB,OAA0B;AAC1E,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AAEzC,SAAO,KAAK,MAAM,CAAC,OAAO,UAAU,UAAU,MAAM,KAAK,CAAC;AAC5D;AAEO,MAAM,iBAAiB;AAAA,EAC5B,YACmB,IACA,yBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAc,oBAAuD,OAAsB;AACzF,QAAI,CAAC,KAAK,yBAAyB,UAAU,EAAG,QAAO;AAEvD,QAAI;AACF,YAAM,WAAW,WAAW,OAAO,YAAY,WAAW;AAC1D,YAAM,iBAAiB,WAAW,OAAO,kBAAkB,iBAAiB;AAC5E,YAAM,MAAM,MAAM,KAAK,wBAAwB,OAAO,QAAQ;AAC9D,YAAM,cAAc,CAAC,UAA4B;AAC/C,YAAI,CAAC,IAAK,QAAO;AACjB,YAAI,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,EAAE,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AACvF,gBAAMA,aAAY,kBAAkB,OAAO,IAAI,GAAG;AAClD,cAAIA,eAAc,KAAM,QAAO;AAC/B,cAAI;AACF,mBAAO,KAAK,MAAMA,UAAS;AAAA,UAC7B,QAAQ;AACN,mBAAOA;AAAA,UACT;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC;AACtE,YAAI,SAAS,OAAO,UAAU,UAAU;AACtC,gBAAM,OAAgC,CAAC;AACvC,qBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC1E,iBAAK,GAAG,IAAI,YAAY,IAAI;AAAA,UAC9B;AACA,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAEA,YAAM,YAAY,MAAM,KAAK,wBAAwB;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,SAAS;AAAA,QACb,GAAG;AAAA,QACH,GAAG;AAAA,MACL;AAEA,aAAO,cAAc,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY;AACrH,aAAO,eAAe,OAAO;AAC7B,aAAO,iBAAiB,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe;AACpI,aAAO,kBAAkB,OAAO;AAChC,aAAO,gBAAgB,YAAY,OAAO,iBAAiB,OAAO,kBAAkB,MAAM,iBAAiB,MAAM,cAAc;AAC/H,aAAO,iBAAiB,OAAO;AAC/B,aAAO,iBAAiB,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe;AACpI,aAAO,kBAAkB,OAAO;AAChC,aAAO,cAAc,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY;AACrH,aAAO,eAAe,OAAO;AAE7B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,CAAC,yBAAyB;AAC5B,kCAA0B;AAC1B,gBAAQ,KAAK,mDAAmD,GAAG;AAAA,MACrE;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,SAAoE;AAC/F,QAAI,CAAC,QAAS;AAEd,UAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,eAAW,SAAS,MAAM;AACxB,aAAO,OAAO,OAA6C,MAAM,KAAK,oBAAoB,KAA2C,CAAC;AAAA,IACxI;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,OAAwD;AAChE,UAAM,OAAO,KAAK,iBAAiB,KAAK;AACxC,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AAC3C,UAAM,KAAK,gBAAgB,GAAG;AAC9B,UAAM,KAAK,eAAe,GAAG;AAC7B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,OAAmD;AAC1E,QAAI;AACJ,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AAErE,QAAI,gBAAgB;AAClB,UAAI;AACF,eAAO,OAAO,MAAM,KAAK;AACzB,qCAA6B;AAAA,MAC/B,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAC1B,kBAAQ,KAAK,qEAAqE,GAAG;AAAA,QACvF;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,KAAK;AAAA,MAClC;AAAA,IACF,OAAO;AACL,aAAO,KAAK,eAAe,KAAK;AAAA,IAClC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAqB,MAAuC;AAClF,UAAM,aAAa,0BAA0B;AAAA,MAC3C,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,MACjC,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,WAAW,KAAK;AAAA,MAChB,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,WAAO,KAAK,OAAO,WAAW;AAAA,MAC5B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,WAAW;AAAA,MACvB,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,oBAAoB,KAAK,sBAAsB;AAAA,MAC/C,kBAAkB,KAAK,oBAAoB;AAAA,MAC3C,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,WAAW,KAAK,aAAa;AAAA,MAC7B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,eAAe,WAAW;AAAA,MAC1B,qBAAqB,WAAW;AAAA,MAChC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,WAAW,WAAW;AAAA,MACtB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,iBAAiB,CAAC,UAAmB;AACzC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,UAAI,MAAM,WAAW,UAAU,EAAG,QAAO,MAAM,MAAM,WAAW,MAAM;AACtE,aAAO;AAAA,IACT;AAEA,UAAM,sBAAsB,CAAC,UAAoD;AAC/E,UAAI,UAAU,KAAM,QAAO;AAC3B,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,QACA;AAGN,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,eAAe,MAAM,WAAW;AAAA,MAC7C,WAAW,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAAI,MAAM,YAAY;AAAA,MACjG,aAAa,iBAAiB,MAAM,WAAW,KAAK;AAAA,MACpD,cAAc,iBAAiB,MAAM,YAAY,KAAK;AAAA,MACtD,YAAY,iBAAiB,MAAM,UAAU,KAAK;AAAA,MAClD,oBAAoB,iBAAiB,MAAM,kBAAkB,KAAK;AAAA,MAClE,kBAAkB,iBAAiB,MAAM,gBAAgB,KAAK;AAAA,MAC9D,gBAAgB,MAAM,mBAAmB,YAAY,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAChH,WAAW,iBAAiB,MAAM,SAAS,KAAK;AAAA,MAChD,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM;AAAA,MACrB,SAAS,oBAAoB,MAAM,OAAO;AAAA,MAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACzC;AAAA,EACF;AAAA,EAEQ,eAAe,OAAoC;AACzD,WAAO,oBAAoB,MAAM;AAAA,MAC/B,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,QAAsC;AAChE,UAAM,SAAS,CAAC,GAAI,OAAO,gBAAgB,CAAC,CAAE;AAC9C,QAAI,OAAO,YAAa,QAAO,KAAK,OAAO,WAAW;AAEtD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,kBAAkB,QAAsC;AAC9D,UAAM,SAAS,CAAC,GAAI,OAAO,cAAc,CAAC,CAAE;AAC5C,QAAI,OAAO,UAAW,QAAO,KAAK,OAAO,SAAS;AAElD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,mBAAmB,QAAmD;AAC5E,UAAM,SAAS,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAC7C,QAAI,OAAO,WAAY,QAAO,KAAK,OAAO,UAAU;AAEpD,WAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,EAC9B,OAAO,CAAC,UAAwC,wBAAwB,SAAS,KAA4B,CAAC;AAAA,EACnH;AAAA,EAEQ,kBAAkB,QAA+F;AACvH,UAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,WAAW,IACrD,OAAO,WACP,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,IACjD,OAAO,QACP;AACR,UAAM,OAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,IAAI,OAAO,OAAO;AAChF,UAAM,SACJ,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,IAClD,OAAO,UACN,OAAO,KAAK;AACnB,WAAO,EAAE,MAAM,UAAU,QAAQ,OAAO,SAAS;AAAA,EACnD;AAAA,EAEA,MAAc,YAAY,QAA4B,SAAkC;AACtF,UAAM,QAAQ,KAAK,eAAe,MAAM,EAAE,OAAyB,sBAAsB;AAEzF,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,EAAE,OAAO,OAAO,IAAI,KAAK,kBAAkB,MAAM;AACvD,YAAM,MAAM,KAAK,EAAE,OAAO,MAAM;AAAA,IAClC;AAEA,UAAM,OAAO,MAAM;AACnB,UAAM,MAAM,KAAK,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,OAAO;AACpD,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAE9B,UAAM,UAAU,MAAM,KAAK,GAAG,KAAK,WAAW;AAAA,MAC5C,IAAI,EAAE,KAAK,IAAI;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,eAAe,OAAO;AAEjC,UAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAC9D,WAAO,IACJ,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,EACxB,OAAO,CAAC,UAA8B,QAAQ,KAAK,CAAC;AAAA,EACzD;AAAA,EAEQ,eAAe,QAA4B;AACjD,UAAM,QAAQ,KAAK,GAAG,QAAQ,EAAE,aAAa,EAAE,UAAU,wBAAwB;AAEjF,QAAI,OAAO,SAAU,OAAM,SAAS,yBAAyB,OAAO,QAAQ;AAC5E,QAAI,OAAO,eAAgB,OAAM,SAAS,+BAA+B,OAAO,cAAc;AAE9F,UAAM,eAAe,KAAK,oBAAoB,MAAM;AACpD,QAAI,aAAa,WAAW,EAAG,OAAM,SAAS,6BAA6B,aAAa,CAAC,CAAC;AAC1F,QAAI,aAAa,SAAS,EAAG,OAAM,QAAQ,6BAA6B,YAAY;AAEpF,QAAI,OAAO,kBAAkB,OAAO,gBAAgB,OAAO,YAAY;AACrE,YAAM,SAAS,SAAS,oBAAoB;AAC1C,aAAK,MAAM;AAAA,UACT,6BAA6B,OAAO;AAAA,UACpC,2BAA2B,OAAO;AAAA,QACpC,CAAC,EAAE,QAAQ;AAAA,UACT,oCAAoC,OAAO;AAAA,UAC3C,kCAAkC,OAAO;AAAA,QAC3C,CAAC;AAAA,MACH,CAAC;AAAA,IACH,OAAO;AACL,UAAI,OAAO,aAAc,OAAM,SAAS,6BAA6B,OAAO,YAAY;AACxF,UAAI,OAAO,WAAY,OAAM,SAAS,2BAA2B,OAAO,UAAU;AAAA,IACpF;AAEA,QAAI,OAAO,aAAc,OAAM,aAAa,wBAAwB;AACpE,QAAI,OAAO,OAAQ,OAAM,SAAS,0BAA0B,KAAK,OAAO,MAAM;AAC9E,QAAI,OAAO,MAAO,OAAM,SAAS,0BAA0B,KAAK,OAAO,KAAK;AAE5E,UAAM,aAAa,KAAK,kBAAkB,MAAM;AAChD,QAAI,WAAW,SAAS,GAAG;AACzB,YAAM,eAAe,WAAW,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI;AACxD,YAAM;AAAA,QACJ,kEAAkE,YAAY;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,KAAK,mBAAmB,MAAM;AAClD,QAAI,YAAY,WAAW,EAAG,OAAM,SAAS,2BAA2B,YAAY,CAAC,CAAC;AACtF,QAAI,YAAY,SAAS,EAAG,OAAM,QAAQ,2BAA2B,WAAW;AAEhF,QAAI,OAAO,cAAc,QAAQ;AAC/B,YAAM,SAAS,wBAAwB,kBAAkB,2BAA2B;AAAA,IACtF;AAEA,UAAM,UAAU,OAAO,YAAY,QAAQ,QAAQ;AACnD,YAAQ,OAAO,WAAW;AAAA,MACxB,KAAK;AACH,cAAM,WAAW,iEAAiE,OAAO,EAAE;AAC3F;AAAA,MACF,KAAK;AACH,cAAM,WAAW,yCAAyC,OAAO,EAAE;AACnE;AAAA,MACF,KAAK;AACH,cAAM,WAAW,mDAAmD,OAAO,EAAE;AAC7E;AAAA,MACF,KAAK;AACH,cAAM,WAAW,wCAAwC,OAAO,EAAE;AAClE;AAAA,MACF,KAAK;AAAA,MACL;AACE,cAAM,QAAQ,YAAY,WAAW,OAAO;AAC5C,cAAM,QAAQ,kBAAkB,OAAO;AACvC,eAAO;AAAA,IACX;AAEA,UAAM,QAAQ,0BAA0B,MAAM;AAC9C,UAAM,QAAQ,kBAAkB,MAAM;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,MAAM,OAAoC;AAC9C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,MAAM,MAAM,KAAK,eAAe,MAAM,EACzC,WAAW,EACX,MAAkC,EAAE,OAAO,IAAI,CAAC,EAChD,MAAM;AAET,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,IAAI,SAAS;AAC9B,WAAO,OAAO,aAAa,WAAW,WAAW,OAAO,SAAS,UAAU,EAAE,KAAK;AAAA,EACpF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,EAAE,MAAM,SAAS,IAAI,KAAK,kBAAkB,MAAM;AACxD,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,KAAK,YAAY,MAAM;AAAA,MACvB,KAAK,MAAM,MAAM;AAAA,IACnB,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAM,uBAAuB,aAAqB,OAAqE;AACrH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY,YAAmC;AAC9D,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAEhB,UAAM,WAAW,aAAa,KAAK,gBAAgB,MAAM,KAAK,iBAAiB,UAAU,CAAC,IAAI;AAC9F,QAAI,UAAU;AACZ,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAEA,UAAM,KAAK,MAAM;AACjB,UAAM,KAAK,eAAe,GAAG;AAC7B,QAAI,SAAU,OAAM,KAAK,eAAe,QAAQ;AAEhD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,WAAmB;AACvC,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,WAAW,WAAW,KAAK,CAAC;AAC7E,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACtE,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,QAM7B;AACD,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AAEjD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBAAqB,aAAqB,OAAqE;AACnH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY;AAC3B,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACpE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAChB,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,UAA8C,CAAC,GAA+C;AACtH,UAAM,YAAY,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,QAAQ,aAAa,GAAG,GAAG,CAAC,GAAG,GAAI;AAClF,UAAM,SAAS,QAAQ,WAAW,MAAM;AAAA,IAAC;AACzC,UAAM,SAA4C;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAEA,QAAI,kBAA+B;AACnC,QAAI,WAA0B;AAE9B,WAAO,MAAM;AACX,YAAM,YAAY,KAAK,GAAG,QAAQ,EAAe,aAAa,EAC3D;AAAA,QACC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EACC,UAAU,YAAY;AAEzB,UAAI,QAAQ,SAAU,WAAU,SAAS,aAAa,QAAQ,QAAQ;AACtE,UAAI,QAAQ,eAAgB,WAAU,SAAS,mBAAmB,QAAQ,cAAc;AAExF,UAAI,CAAC,QAAQ,OAAO;AAClB,kBAAU,SAAS,CAAC,YAAY;AAC9B,kBACG,UAAU,aAAa,EACvB,YAAY,YAAY,EACxB,YAAY,gBAAgB;AAAA,QACjC,CAAC;AAAA,MACH;AAEA,UAAI,mBAAmB,UAAU;AAC/B,kBAAU,SAAS,CAAC,YAAY;AAC9B,kBACG,MAAM,cAAc,KAAK,eAAe,EACxC,QAAQ,CAAC,WAAW;AACnB,mBAAO,MAAM,cAAc,eAAe,EAAE,SAAS,MAAM,KAAK,QAAQ;AAAA,UAC1E,CAAC;AAAA,QACL,CAAC;AAAA,MACH;AAEA,YAAM,OAAO,MAAM,UAChB,QAAQ,cAAc,KAAK,EAC3B,QAAQ,MAAM,KAAK,EACnB,MAAM,SAAS;AAElB,UAAI,KAAK,WAAW,EAAG;AAEvB,iBAAW,OAAO,MAAM;AACtB,eAAO,WAAW;AAElB,YAAI;AACF,gBAAM,YAAY,MAAM,KAAK,oBAAoB,GAAyC;AAC1F,gBAAM,aAAa,0BAA0B;AAAA,YAC3C,aAAa,WAAW,WAAW,eAAe,eAAe;AAAA,YACjE,aAAa,WAAW,WAAW,eAAe,cAAc;AAAA,YAChE,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,WAAW,WAAW,WAAW,aAAa,YAAY,KAAK;AAAA,YAC/D,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,gBAAgB,UAAU,WAAW,kBAAkB,iBAAiB;AAAA,UAC1E,CAAC;AAED,gBAAM,cAAc,QAAQ,UAAU,QACjC,IAAI,gBAAgB,WAAW,cAC/B,IAAI,eAAe,WAAW,aAC9B,IAAI,0BAA0B,WAAW,uBACzC,CAAC,kBAAkB,IAAI,gBAAgB,WAAW,aAAa;AAEpE,cAAI,CAAC,aAAa;AAChB,mBAAO,WAAW;AAClB;AAAA,UACF;AAEA,gBAAM,KAAK,GAAG,QAAQ,EAAE,aAAa,EAClC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,EACpB,OAAO;AAAA,YACN,aAAa,WAAW;AAAA,YACxB,gBAAgB,WAAW;AAAA,YAC3B,uBAAuB,WAAW;AAAA,YAClC,YAAY,WAAW;AAAA,UACzB,CAAC;AAEH,iBAAO,WAAW;AAAA,QACpB,SAAS,KAAK;AACZ,iBAAO,UAAU;AACjB,iBAAO,oCAAoC,IAAI,EAAE,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,QAC1G;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,wBAAkB,QAAQ;AAC1B,iBAAW,QAAQ;AAEnB;AAAA,QACE,wBAAwB,OAAO,OAAO,0BAA0B,OAAO,OAAO,cAAc,OAAO,OAAO,aAAa,OAAO,MAAM;AAAA,MACtI;AAEA,UAAI,KAAK,SAAS,UAAW;AAAA,IAC/B;AAEA,WAAO;AAAA,EACT;AACF;",
   "names": ["decrypted"]
 }

package/dist/modules/auth/frontend/login.js

@@ -13,7 +13,7 @@ import { translateWithFallback } from "@open-mercato/shared/lib/i18n/translate";
 import { clearAllOperations } from "@open-mercato/ui/backend/operations/store";
 import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
 import { X } from "lucide-react";
-import { Notice } from "@open-mercato/ui/primitives/Notice";
+import { Alert, AlertDescription } from "@open-mercato/ui/primitives/alert";
 import { InjectionSpot } from "@open-mercato/ui/backend/injection/InjectionSpot";
 import { useRegisteredComponent } from "@open-mercato/ui/backend/injection/useRegisteredComponent";
 const loginTenantKey = "om_login_tenant";
@@ -263,14 +263,14 @@ function LoginPage() {
     ] }),
     /* @__PURE__ */ jsx(CardContent, { children: /* @__PURE__ */ jsx(LoginFormSection, { children: /* @__PURE__ */ jsxs("form", { className: "grid gap-3", onSubmit, noValidate: true, "data-auth-ready": formReady ? "1" : "0", children: [
       tenantId ? /* @__PURE__ */ jsx("input", { type: "hidden", name: "tenantId", value: tenantId }) : null,
-      !!translatedRoles.length && /* @__PURE__ */ jsx(Notice, { compact: true, className: "text-center", children: translate(
+      !!translatedRoles.length && /* @__PURE__ */ jsx(Alert, { variant: "info", className: "text-center", children: /* @__PURE__ */ jsx(AlertDescription, { children: translate(
         translatedRoles.length > 1 ? "auth.login.requireRolesMessage" : "auth.login.requireRoleMessage",
         translatedRoles.length > 1 ? "Access requires one of the following roles: {roles}" : "Access requires role: {roles}",
         { roles: translatedRoles.join(", ") }
-      ) }),
-      !!translatedFeatures.length && /* @__PURE__ */ jsx(Notice, { compact: true, className: "text-center", children: translate("auth.login.featureDenied", "You don't have access to this feature ({feature}). Please contact your administrator.", {
+      ) }) }),
+      !!translatedFeatures.length && /* @__PURE__ */ jsx(Alert, { variant: "info", className: "text-center", children: /* @__PURE__ */ jsx(AlertDescription, { children: translate("auth.login.featureDenied", "You don't have access to this feature ({feature}). Please contact your administrator.", {
         feature: translatedFeatures.join(", ")
-      }) }),
+      }) }) }),
       showTenantInvalid ? /* @__PURE__ */ jsxs("div", { className: "rounded-md border border-red-200 bg-red-50 px-3 py-2 text-center text-xs text-red-700", children: [
         /* @__PURE__ */ jsx("div", { className: "font-medium", children: translate("auth.login.errors.tenantInvalid", "Tenant not found. Clear the tenant selection and try again.") }),
         /* @__PURE__ */ jsxs(Button, { type: "button", variant: "outline", size: "sm", className: "mt-2 border-red-300 text-red-700", onClick: handleClearTenant, children: [