npm - @open-mercato/core - Versions diffs - 0.5.1-develop.2691.d8a0934b37 → 0.5.1-develop.2694.732417c5ec - Mend

@open-mercato/core 0.5.1-develop.2691.d8a0934b37 → 0.5.1-develop.2694.732417c5ec

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (414) hide show

package/dist/modules/audit_logs/services/actionLogService.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { sql } from "kysely";
 import { ActionLog } from "@open-mercato/core/modules/audit_logs/data/entities";
 import {
   actionLogCreateSchema,
@@ -123,7 +124,7 @@ class ActionLogService {
     const data = this.parseCreateInput(input);
     const fork = this.em.fork();
     const log = this.createLogEntity(fork, data);
-    await fork.persistAndFlush(log);
+    await fork.persist(log).flush();
     await this.decryptEntries(log);
     return log;
   }
@@ -260,12 +261,12 @@ class ActionLogService {
     return { page, pageSize, offset, limit: pageSize };
   }
   async loadEntries(parsed, options) {
-    const query = this.buildListQuery(parsed).select("action_logs.id as id");
+    let query = this.buildListQuery(parsed).select("action_logs.id as id");
     if (options?.paginate !== false) {
       const { limit, offset } = this.resolvePagination(parsed);
-      query.limit(limit).offset(offset);
+      query = query.limit(limit).offset(offset);
     }
-    const rows = await query;
+    const rows = await query.execute();
     const ids = rows.map((row) => row.id).filter(Boolean);
     if (ids.length === 0) return [];
     const results = await this.em.find(ActionLog, {
@@ -277,70 +278,68 @@ class ActionLogService {
     return ids.map((id) => byId.get(id)).filter((entry) => Boolean(entry));
   }
   buildListQuery(parsed) {
-    const query = this.em.getKnex()("action_logs").whereNull("action_logs.deleted_at");
-    if (parsed.tenantId) query.andWhere("action_logs.tenant_id", parsed.tenantId);
-    if (parsed.organizationId) query.andWhere("action_logs.organization_id", parsed.organizationId);
+    let query = this.em.getKysely().selectFrom("action_logs").selectAll().where("action_logs.deleted_at", "is", null);
+    if (parsed.tenantId) query = query.where("action_logs.tenant_id", "=", parsed.tenantId);
+    if (parsed.organizationId) query = query.where("action_logs.organization_id", "=", parsed.organizationId);
     const actorUserIds = this.resolveActorUserIds(parsed);
-    if (actorUserIds.length === 1) query.andWhere("action_logs.actor_user_id", actorUserIds[0]);
-    if (actorUserIds.length > 1) query.whereIn("action_logs.actor_user_id", actorUserIds);
+    if (actorUserIds.length === 1) query = query.where("action_logs.actor_user_id", "=", actorUserIds[0]);
+    if (actorUserIds.length > 1) query = query.where("action_logs.actor_user_id", "in", actorUserIds);
     if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {
-      query.andWhere(function applyRelatedScope() {
-        this.where({
-          "action_logs.resource_kind": parsed.resourceKind,
-          "action_logs.resource_id": parsed.resourceId
-        }).orWhere({
-          "action_logs.parent_resource_kind": parsed.resourceKind,
-          "action_logs.parent_resource_id": parsed.resourceId
-        });
-      });
+      query = query.where(
+        (eb) => eb.or([
+          eb.and([
+            eb("action_logs.resource_kind", "=", parsed.resourceKind),
+            eb("action_logs.resource_id", "=", parsed.resourceId)
+          ]),
+          eb.and([
+            eb("action_logs.parent_resource_kind", "=", parsed.resourceKind),
+            eb("action_logs.parent_resource_id", "=", parsed.resourceId)
+          ])
+        ])
+      );
     } else {
-      if (parsed.resourceKind) query.andWhere("action_logs.resource_kind", parsed.resourceKind);
-      if (parsed.resourceId) query.andWhere("action_logs.resource_id", parsed.resourceId);
+      if (parsed.resourceKind) query = query.where("action_logs.resource_kind", "=", parsed.resourceKind);
+      if (parsed.resourceId) query = query.where("action_logs.resource_id", "=", parsed.resourceId);
     }
-    if (parsed.undoableOnly) query.whereNotNull("action_logs.undo_token");
-    if (parsed.before) query.andWhere("action_logs.created_at", "<", parsed.before);
-    if (parsed.after) query.andWhere("action_logs.created_at", ">", parsed.after);
+    if (parsed.undoableOnly) query = query.where("action_logs.undo_token", "is not", null);
+    if (parsed.before) query = query.where("action_logs.created_at", "<", parsed.before);
+    if (parsed.after) query = query.where("action_logs.created_at", ">", parsed.after);
     const fieldNames = this.resolveFieldNames(parsed);
-    if (fieldNames.length > 0) {
-      const placeholders = fieldNames.map(() => "?").join(", ");
-      query.andWhereRaw(
-        `coalesce(action_logs.changed_fields, ARRAY[]::text[]) && ARRAY[${placeholders}]::text[]`,
-        fieldNames
-      );
-    }
+    if (fieldNames.length === 1) query = query.where("action_logs.primary_changed_field", "=", fieldNames[0]);
+    if (fieldNames.length > 1) query = query.where("action_logs.primary_changed_field", "in", fieldNames);
     const actionTypes = this.resolveActionTypes(parsed);
-    if (actionTypes.length === 1) query.andWhere("action_logs.action_type", actionTypes[0]);
-    if (actionTypes.length > 1) query.whereIn("action_logs.action_type", actionTypes);
+    if (actionTypes.length === 1) query = query.where("action_logs.action_type", "=", actionTypes[0]);
+    if (actionTypes.length > 1) query = query.where("action_logs.action_type", "in", actionTypes);
     if (parsed.sortField === "user") {
-      query.leftJoin("users as audit_actor", "audit_actor.id", "action_logs.actor_user_id");
+      query = query.leftJoin("users as audit_actor", "audit_actor.id", "action_logs.actor_user_id");
     }
     const sortDir = parsed.sortDir === "asc" ? "asc" : "desc";
     switch (parsed.sortField) {
       case "user":
-        query.orderByRaw(`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '') ${sortDir}`);
+        query = query.orderBy(sql`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '')`, sortDir);
         break;
       case "action":
-        query.orderByRaw(`coalesce(action_logs.action_type, '') ${sortDir}`);
+        query = query.orderBy(sql`coalesce(action_logs.action_type, '')`, sortDir);
         break;
       case "field":
-        query.orderByRaw(`coalesce(action_logs.primary_changed_field, '') ${sortDir}`);
+        query = query.orderBy(sql`coalesce(action_logs.primary_changed_field, '')`, sortDir);
         break;
       case "source":
-        query.orderByRaw(`coalesce(action_logs.source_key, '') ${sortDir}`);
+        query = query.orderBy(sql`coalesce(action_logs.source_key, '')`, sortDir);
         break;
       case "createdAt":
       default:
-        query.orderBy(SORT_FIELDS.createdAt, sortDir);
-        query.orderBy("action_logs.id", sortDir);
+        query = query.orderBy(SORT_FIELDS.createdAt, sortDir);
+        query = query.orderBy("action_logs.id", sortDir);
         return query;
     }
-    query.orderBy("action_logs.created_at", "desc");
-    query.orderBy("action_logs.id", "desc");
+    query = query.orderBy("action_logs.created_at", "desc");
+    query = query.orderBy("action_logs.id", "desc");
     return query;
   }
   async count(query) {
     const parsed = this.parseListQuery(query);
-    const row = await this.buildListQuery(parsed).clearOrder().count({ count: "*" }).first();
+    const row = await this.buildListQuery(parsed).clearSelect().clearOrderBy().select(sql`count(*)`.as("count")).executeTakeFirst();
     if (!row) return 0;
     const rawCount = row.count ?? 0;
     return typeof rawCount === "number" ? rawCount : Number.parseInt(rawCount, 10) || 0;
@@ -441,35 +440,43 @@ class ActionLogService {
     let cursorCreatedAt = null;
     let cursorId = null;
     while (true) {
-      const rowsQuery = this.em.getKnex()("action_logs").select(
-        "id",
-        "tenant_id",
-        "organization_id",
-        "actor_user_id",
-        "command_id",
-        "action_label",
-        "snapshot_before",
-        "changes_json",
-        "context_json",
-        "action_type",
-        "source_key",
-        "changed_fields",
-        "primary_changed_field",
-        "created_at"
-      ).whereNull("deleted_at");
-      if (options.tenantId) rowsQuery.andWhere("tenant_id", options.tenantId);
-      if (options.organizationId) rowsQuery.andWhere("organization_id", options.organizationId);
+      const rowsQuery = this.em.getKysely().selectFrom("action_logs").select([
+        "action_logs.id",
+        "action_logs.tenant_id",
+        "action_logs.organization_id",
+        "action_logs.actor_user_id",
+        "action_logs.command_id",
+        "action_logs.action_label",
+        "action_logs.snapshot_before",
+        "action_logs.changes_json",
+        "action_logs.context_json",
+        "action_logs.action_type",
+        "action_logs.source_key",
+        "action_logs.changed_fields",
+        "action_logs.primary_changed_field",
+        "action_logs.created_at"
+      ]).where("action_logs.deleted_at", "is", null);
+      if (options.tenantId) rowsQuery.where("action_logs.tenant_id", "=", options.tenantId);
+      if (options.organizationId) rowsQuery.where("action_logs.organization_id", "=", options.organizationId);
       if (!options.force) {
-        rowsQuery.andWhere((builder) => {
-          builder.whereNull("action_type").orWhereNull("source_key").orWhereNull("changed_fields");
-        });
+        rowsQuery.where(
+          (eb) => eb.or([
+            eb("action_logs.action_type", "is", null),
+            eb("action_logs.source_key", "is", null),
+            eb("action_logs.changed_fields", "is", null)
+          ])
+        );
       }
       if (cursorCreatedAt && cursorId) {
-        rowsQuery.andWhere((builder) => {
-          builder.where("created_at", ">", cursorCreatedAt).orWhere((nested) => {
-            nested.where("created_at", cursorCreatedAt).andWhere("id", ">", cursorId);
-          });
-        });
+        rowsQuery.where(
+          (eb) => eb.or([
+            eb("action_logs.created_at", ">", cursorCreatedAt),
+            eb.and([
+              eb("action_logs.created_at", "=", cursorCreatedAt),
+              eb("action_logs.id", ">", cursorId)
+            ])
+          ])
+        );
       }
       const rows = await rowsQuery.orderBy("created_at", "asc").orderBy("id", "asc").limit(batchSize);
       if (rows.length === 0) break;
@@ -490,12 +497,12 @@ class ActionLogService {
             result.skipped += 1;
             continue;
           }
-          await this.em.getKnex()("action_logs").where({ id: row.id }).update({
+          await this.em.getKysely().updateTable("action_logs").set({
             action_type: projection.actionType,
             changed_fields: projection.changedFields,
             primary_changed_field: projection.primaryChangedField,
             source_key: projection.sourceKey
-          });
+          }).where("id", "=", row.id).execute();
           result.updated += 1;
         } catch (err) {
           result.errors += 1;

package/dist/modules/audit_logs/services/actionLogService.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/audit_logs/services/actionLogService.ts"],
-  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  actionLogCreateSchema,\n  actionLogListSchema,\n  type ActionLogCreateInput,\n  type ActionLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { isRecord } from '@open-mercato/core/modules/audit_logs/lib/changeRows'\nimport {\n  ACTION_LOG_FILTER_TYPES,\n  type ActionLogFilterType,\n  deriveActionLogProjection,\n} from '@open-mercato/core/modules/audit_logs/lib/projections'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { toOptionalString } from '@open-mercato/shared/lib/string/coerce'\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\nlet decryptionWarningLogged = false\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\nconst SORT_FIELDS = {\n  createdAt: 'action_logs.created_at',\n} as const\n\ntype ActionLogProjectionBackfillOptions = {\n  batchSize?: number\n  force?: boolean\n  logger?: (message: string) => void\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport type ActionLogProjectionBackfillResult = {\n  errors: number\n  scanned: number\n  skipped: number\n  updated: number\n}\n\ntype BackfillRow = {\n  action_label: string | null\n  action_type: string | null\n  actor_user_id: string | null\n  changed_fields: string[] | null\n  changes_json: Record<string, unknown> | null\n  command_id: string\n  context_json: Record<string, unknown> | null\n  created_at: Date\n  id: string\n  organization_id: string | null\n  primary_changed_field: string | null\n  snapshot_before: unknown | null\n  source_key: string | null\n  tenant_id: string | null\n}\n\nfunction readString(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n\n  return null\n}\n\nfunction readRecord(record: Record<string, unknown>, ...keys: string[]): Record<string, unknown> | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (isRecord(value)) return value\n  }\n\n  return null\n}\n\nfunction readValue(record: Record<string, unknown>, ...keys: string[]): unknown {\n  for (const key of keys) {\n    if (Object.prototype.hasOwnProperty.call(record, key)) return record[key]\n  }\n\n  return undefined\n}\n\nfunction readStringArray(record: Record<string, unknown>, ...keys: string[]): string[] | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (Array.isArray(value)) {\n      return value.filter((entry): entry is string => typeof entry === 'string')\n    }\n  }\n\n  return null\n}\n\nfunction stringArraysEqual(left: string[] | null, right: string[]): boolean {\n  if (!Array.isArray(left)) return false\n  if (left.length !== right.length) return false\n\n  return left.every((value, index) => value === right[index])\n}\n\nexport class ActionLogService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly tenantEncryptionService?: TenantDataEncryptionService,\n  ) {}\n\n  private async decryptEntryPayload<T extends Record<string, unknown>>(entry: T): Promise<T> {\n    if (!this.tenantEncryptionService?.isEnabled()) return entry\n\n    try {\n      const tenantId = readString(entry, 'tenantId', 'tenant_id')\n      const organizationId = readString(entry, 'organizationId', 'organization_id')\n      const dek = await this.tenantEncryptionService.getDek(tenantId)\n      const deepDecrypt = (value: unknown): unknown => {\n        if (!dek) return value\n        if (typeof value === 'string' && value.split(':').length === 4 && value.endsWith(':v1')) {\n          const decrypted = decryptWithAesGcm(value, dek.key)\n          if (decrypted === null) return value\n          try {\n            return JSON.parse(decrypted)\n          } catch {\n            return decrypted\n          }\n        }\n        if (Array.isArray(value)) return value.map((item) => deepDecrypt(item))\n        if (value && typeof value === 'object') {\n          const copy: Record<string, unknown> = {}\n          for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n            copy[key] = deepDecrypt(item)\n          }\n          return copy\n        }\n        return value\n      }\n\n      const decrypted = await this.tenantEncryptionService.decryptEntityPayload(\n        'audit_logs:action_log',\n        entry,\n        tenantId,\n        organizationId,\n      )\n\n      const merged = {\n        ...entry,\n        ...decrypted,\n      } as Record<string, unknown>\n\n      merged.changesJson = deepDecrypt(merged.changesJson ?? merged.changes_json ?? entry.changesJson ?? entry.changes_json)\n      merged.changes_json = merged.changesJson\n      merged.snapshotBefore = deepDecrypt(merged.snapshotBefore ?? merged.snapshot_before ?? entry.snapshotBefore ?? entry.snapshot_before)\n      merged.snapshot_before = merged.snapshotBefore\n      merged.snapshotAfter = deepDecrypt(merged.snapshotAfter ?? merged.snapshot_after ?? entry.snapshotAfter ?? entry.snapshot_after)\n      merged.snapshot_after = merged.snapshotAfter\n      merged.commandPayload = deepDecrypt(merged.commandPayload ?? merged.command_payload ?? entry.commandPayload ?? entry.command_payload)\n      merged.command_payload = merged.commandPayload\n      merged.contextJson = deepDecrypt(merged.contextJson ?? merged.context_json ?? entry.contextJson ?? entry.context_json)\n      merged.context_json = merged.contextJson\n\n      return merged as T\n    } catch (err) {\n      if (!decryptionWarningLogged) {\n        decryptionWarningLogged = true\n        console.warn('[audit_logs] failed to decrypt action log entry', err)\n      }\n      return entry\n    }\n  }\n\n  private async decryptEntries(entries: ActionLog | ActionLog[] | null | undefined): Promise<void> {\n    if (!entries) return\n\n    const list = Array.isArray(entries) ? entries : [entries]\n    for (const entry of list) {\n      Object.assign(entry as unknown as Record<string, unknown>, await this.decryptEntryPayload(entry as unknown as Record<string, unknown>))\n    }\n  }\n\n  async log(input: ActionLogCreateInput): Promise<ActionLog | null> {\n    const data = this.parseCreateInput(input)\n    const fork = this.em.fork()\n    const log = this.createLogEntity(fork, data)\n    await fork.persistAndFlush(log)\n    await this.decryptEntries(log)\n    return log\n  }\n\n  private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {\n    let data: ActionLogCreateInput\n    const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n\n    if (shouldValidate) {\n      try {\n        data = schema.parse(input)\n        runtimeValidationAvailable = true\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          console.warn('[audit_logs] falling back to permissive action log payload parser', err)\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        data = this.normalizeInput(input)\n      }\n    } else {\n      data = this.normalizeInput(input)\n    }\n\n    return data\n  }\n\n  private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {\n    const projection = deriveActionLogProjection({\n      actorUserId: data.actorUserId ?? null,\n      actionLabel: data.actionLabel ?? null,\n      changes: isRecord(data.changes) ? data.changes : null,\n      commandId: data.commandId,\n      context: isRecord(data.context) ? data.context : null,\n      snapshotBefore: data.snapshotBefore,\n    })\n\n    return fork.create(ActionLog, {\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      commandId: data.commandId,\n      actionLabel: data.actionLabel ?? null,\n      actionType: projection.actionType,\n      resourceKind: data.resourceKind ?? null,\n      resourceId: data.resourceId ?? null,\n      parentResourceKind: data.parentResourceKind ?? null,\n      parentResourceId: data.parentResourceId ?? null,\n      executionState: data.executionState ?? 'done',\n      undoToken: data.undoToken ?? null,\n      commandPayload: data.commandPayload ?? null,\n      snapshotBefore: data.snapshotBefore ?? null,\n      snapshotAfter: data.snapshotAfter ?? null,\n      changesJson: isRecord(data.changes) ? data.changes : null,\n      changedFields: projection.changedFields,\n      primaryChangedField: projection.primaryChangedField,\n      contextJson: isRecord(data.context) ? data.context : null,\n      sourceKey: projection.sourceKey,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n  }\n\n  private normalizeInput(input: Partial<ActionLogCreateInput> | null | undefined): ActionLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        commandId: 'unknown',\n        actionLabel: undefined,\n        resourceKind: undefined,\n        resourceId: undefined,\n        executionState: 'done',\n        undoToken: undefined,\n        commandPayload: undefined,\n        snapshotBefore: undefined,\n        snapshotAfter: undefined,\n        changes: undefined,\n        context: undefined,\n      }\n    }\n\n    const toNullableUuid = (value: unknown) => {\n      if (typeof value !== 'string' || value.length === 0) return null\n      if (value.startsWith('api_key:')) return value.slice('api_key:'.length)\n      return value\n    }\n\n    const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {\n      if (value === null) return null\n      if (Array.isArray(value)) return value\n      if (typeof value === 'object') return value as Record<string, unknown>\n      return undefined\n    }\n\n    const normalizeContext = (value: unknown) => (\n      typeof value === 'object' && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined\n    )\n\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: toNullableUuid(input.actorUserId),\n      commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',\n      actionLabel: toOptionalString(input.actionLabel) ?? undefined,\n      resourceKind: toOptionalString(input.resourceKind) ?? undefined,\n      resourceId: toOptionalString(input.resourceId) ?? undefined,\n      parentResourceKind: toOptionalString(input.parentResourceKind) ?? null,\n      parentResourceId: toOptionalString(input.parentResourceId) ?? null,\n      executionState: input.executionState === 'undone' || input.executionState === 'failed' ? input.executionState : 'done',\n      undoToken: toOptionalString(input.undoToken) ?? undefined,\n      commandPayload: input.commandPayload,\n      snapshotBefore: input.snapshotBefore,\n      snapshotAfter: input.snapshotAfter,\n      changes: normalizeRecordLike(input.changes),\n      context: normalizeContext(input.context),\n    }\n  }\n\n  private parseListQuery(query: Partial<ActionLogListQuery>) {\n    return actionLogListSchema.parse({\n      ...query,\n    })\n  }\n\n  private resolveActorUserIds(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.actorUserIds ?? [])]\n    if (parsed.actorUserId) values.push(parsed.actorUserId)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveFieldNames(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.fieldNames ?? [])]\n    if (parsed.fieldName) values.push(parsed.fieldName)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveActionTypes(parsed: ActionLogListQuery): ActionLogFilterType[] {\n    const values = [...(parsed.actionTypes ?? [])]\n    if (parsed.actionType) values.push(parsed.actionType)\n\n    return Array.from(new Set(values))\n      .filter((value): value is ActionLogFilterType => ACTION_LOG_FILTER_TYPES.includes(value as ActionLogFilterType))\n  }\n\n  private resolvePagination(parsed: ActionLogListQuery): { page: number; pageSize: number; offset: number; limit: number } {\n    const pageSize =\n      typeof parsed.pageSize === 'number' && parsed.pageSize > 0\n        ? parsed.pageSize\n        : typeof parsed.limit === 'number' && parsed.limit > 0\n          ? parsed.limit\n          : 50\n    const page = typeof parsed.page === 'number' && parsed.page > 0 ? parsed.page : 1\n    const offset =\n      typeof parsed.offset === 'number' && parsed.offset >= 0\n        ? parsed.offset\n        : (page - 1) * pageSize\n    return { page, pageSize, offset, limit: pageSize }\n  }\n\n  private async loadEntries(parsed: ActionLogListQuery, options?: { paginate?: boolean }) {\n    const query = this.buildListQuery(parsed).select<{ id: string }[]>('action_logs.id as id')\n\n    if (options?.paginate !== false) {\n      const { limit, offset } = this.resolvePagination(parsed)\n      query.limit(limit).offset(offset)\n    }\n\n    const rows = await query\n    const ids = rows.map((row) => row.id).filter(Boolean)\n    if (ids.length === 0) return []\n\n    const results = await this.em.find(ActionLog, {\n      id: { $in: ids } as any,\n      deletedAt: null,\n    })\n    await this.decryptEntries(results)\n\n    const byId = new Map(results.map((entry) => [entry.id, entry]))\n    return ids\n      .map((id) => byId.get(id))\n      .filter((entry): entry is ActionLog => Boolean(entry))\n  }\n\n  private buildListQuery(parsed: ActionLogListQuery) {\n    const query = this.em.getKnex()('action_logs').whereNull('action_logs.deleted_at')\n\n    if (parsed.tenantId) query.andWhere('action_logs.tenant_id', parsed.tenantId)\n    if (parsed.organizationId) query.andWhere('action_logs.organization_id', parsed.organizationId)\n\n    const actorUserIds = this.resolveActorUserIds(parsed)\n    if (actorUserIds.length === 1) query.andWhere('action_logs.actor_user_id', actorUserIds[0])\n    if (actorUserIds.length > 1) query.whereIn('action_logs.actor_user_id', actorUserIds)\n\n    if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {\n      query.andWhere(function applyRelatedScope() {\n        this.where({\n          'action_logs.resource_kind': parsed.resourceKind,\n          'action_logs.resource_id': parsed.resourceId,\n        }).orWhere({\n          'action_logs.parent_resource_kind': parsed.resourceKind,\n          'action_logs.parent_resource_id': parsed.resourceId,\n        })\n      })\n    } else {\n      if (parsed.resourceKind) query.andWhere('action_logs.resource_kind', parsed.resourceKind)\n      if (parsed.resourceId) query.andWhere('action_logs.resource_id', parsed.resourceId)\n    }\n\n    if (parsed.undoableOnly) query.whereNotNull('action_logs.undo_token')\n    if (parsed.before) query.andWhere('action_logs.created_at', '<', parsed.before)\n    if (parsed.after) query.andWhere('action_logs.created_at', '>', parsed.after)\n\n    const fieldNames = this.resolveFieldNames(parsed)\n    if (fieldNames.length > 0) {\n      const placeholders = fieldNames.map(() => '?').join(', ')\n      query.andWhereRaw(\n        `coalesce(action_logs.changed_fields, ARRAY[]::text[]) && ARRAY[${placeholders}]::text[]`,\n        fieldNames,\n      )\n    }\n\n    const actionTypes = this.resolveActionTypes(parsed)\n    if (actionTypes.length === 1) query.andWhere('action_logs.action_type', actionTypes[0])\n    if (actionTypes.length > 1) query.whereIn('action_logs.action_type', actionTypes)\n\n    if (parsed.sortField === 'user') {\n      query.leftJoin('users as audit_actor', 'audit_actor.id', 'action_logs.actor_user_id')\n    }\n\n    const sortDir = parsed.sortDir === 'asc' ? 'asc' : 'desc'\n    switch (parsed.sortField) {\n      case 'user':\n        query.orderByRaw(`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '') ${sortDir}`)\n        break\n      case 'action':\n        query.orderByRaw(`coalesce(action_logs.action_type, '') ${sortDir}`)\n        break\n      case 'field':\n        query.orderByRaw(`coalesce(action_logs.primary_changed_field, '') ${sortDir}`)\n        break\n      case 'source':\n        query.orderByRaw(`coalesce(action_logs.source_key, '') ${sortDir}`)\n        break\n      case 'createdAt':\n      default:\n        query.orderBy(SORT_FIELDS.createdAt, sortDir)\n        query.orderBy('action_logs.id', sortDir)\n        return query\n    }\n\n    query.orderBy('action_logs.created_at', 'desc')\n    query.orderBy('action_logs.id', 'desc')\n    return query\n  }\n\n  async count(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const row = await this.buildListQuery(parsed)\n      .clearOrder()\n      .count<{ count: string | number }>({ count: '*' })\n      .first()\n\n    if (!row) return 0\n    const rawCount = row.count ?? 0\n    return typeof rawCount === 'number' ? rawCount : Number.parseInt(rawCount, 10) || 0\n  }\n\n  async list(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const { page, pageSize } = this.resolvePagination(parsed)\n    const [items, total] = await Promise.all([\n      this.loadEntries(parsed),\n      this.count(parsed),\n    ])\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  async latestUndoableForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markUndone(id: string, traceInput?: ActionLogCreateInput) {\n    const fork = this.em.fork()\n    const log = await fork.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'undone'\n    log.undoToken = null\n\n    const traceLog = traceInput ? this.createLogEntity(fork, this.parseCreateInput(traceInput)) : null\n    if (traceLog) {\n      fork.persist(traceLog)\n    }\n\n    await fork.flush()\n    await this.decryptEntries(log)\n    if (traceLog) await this.decryptEntries(traceLog)\n\n    return log\n  }\n\n  async findByUndoToken(undoToken: string) {\n    const entry = await this.em.findOne(ActionLog, { undoToken, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async findById(id: string) {\n    const entry = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoableForResource(params: {\n    actorUserId: string\n    tenantId?: string | null\n    organizationId?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n  }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId: params.actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (params.tenantId) where.tenantId = params.tenantId\n    if (params.organizationId) where.organizationId = params.organizationId\n    if (params.resourceKind) where.resourceKind = params.resourceKind\n    if (params.resourceId) where.resourceId = params.resourceId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoneForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      executionState: 'undone',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { updatedAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markRedone(id: string) {\n    const log = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'redone'\n    log.undoToken = null\n    await this.em.flush()\n    return log\n  }\n\n  async backfillProjections(options: ActionLogProjectionBackfillOptions = {}): Promise<ActionLogProjectionBackfillResult> {\n    const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1000)\n    const logger = options.logger ?? (() => {})\n    const result: ActionLogProjectionBackfillResult = {\n      errors: 0,\n      scanned: 0,\n      skipped: 0,\n      updated: 0,\n    }\n\n    let cursorCreatedAt: Date | null = null\n    let cursorId: string | null = null\n\n    while (true) {\n      const rowsQuery = this.em.getKnex()<BackfillRow>('action_logs')\n        .select(\n          'id',\n          'tenant_id',\n          'organization_id',\n          'actor_user_id',\n          'command_id',\n          'action_label',\n          'snapshot_before',\n          'changes_json',\n          'context_json',\n          'action_type',\n          'source_key',\n          'changed_fields',\n          'primary_changed_field',\n          'created_at',\n        )\n        .whereNull('deleted_at')\n\n      if (options.tenantId) rowsQuery.andWhere('tenant_id', options.tenantId)\n      if (options.organizationId) rowsQuery.andWhere('organization_id', options.organizationId)\n\n      if (!options.force) {\n        rowsQuery.andWhere((builder) => {\n          builder\n            .whereNull('action_type')\n            .orWhereNull('source_key')\n            .orWhereNull('changed_fields')\n        })\n      }\n\n      if (cursorCreatedAt && cursorId) {\n        rowsQuery.andWhere((builder) => {\n          builder\n            .where('created_at', '>', cursorCreatedAt)\n            .orWhere((nested) => {\n              nested.where('created_at', cursorCreatedAt).andWhere('id', '>', cursorId)\n            })\n        })\n      }\n\n      const rows = await rowsQuery\n        .orderBy('created_at', 'asc')\n        .orderBy('id', 'asc')\n        .limit(batchSize)\n\n      if (rows.length === 0) break\n\n      for (const row of rows) {\n        result.scanned += 1\n\n        try {\n          const decrypted = await this.decryptEntryPayload(row as unknown as Record<string, unknown>)\n          const projection = deriveActionLogProjection({\n            actorUserId: readString(decrypted, 'actorUserId', 'actor_user_id'),\n            actionLabel: readString(decrypted, 'actionLabel', 'action_label'),\n            changes: readRecord(decrypted, 'changesJson', 'changes_json'),\n            commandId: readString(decrypted, 'commandId', 'command_id') ?? 'unknown',\n            context: readRecord(decrypted, 'contextJson', 'context_json'),\n            snapshotBefore: readValue(decrypted, 'snapshotBefore', 'snapshot_before'),\n          })\n\n          const needsUpdate = options.force === true\n            || row.action_type !== projection.actionType\n            || row.source_key !== projection.sourceKey\n            || row.primary_changed_field !== projection.primaryChangedField\n            || !stringArraysEqual(row.changed_fields, projection.changedFields)\n\n          if (!needsUpdate) {\n            result.skipped += 1\n            continue\n          }\n\n          await this.em.getKnex()('action_logs')\n            .where({ id: row.id })\n            .update({\n              action_type: projection.actionType,\n              changed_fields: projection.changedFields,\n              primary_changed_field: projection.primaryChangedField,\n              source_key: projection.sourceKey,\n            })\n\n          result.updated += 1\n        } catch (err) {\n          result.errors += 1\n          logger(`[backfill] Failed for action log ${row.id}: ${err instanceof Error ? err.message : String(err)}`)\n        }\n      }\n\n      const lastRow = rows[rows.length - 1]\n      cursorCreatedAt = lastRow.created_at\n      cursorId = lastRow.id\n\n      logger(\n        `[backfill] Processed ${result.scanned} action logs (updated: ${result.updated}, skipped: ${result.skipped}, errors: ${result.errors})`,\n      )\n\n      if (rows.length < batchSize) break\n    }\n\n    return result\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AACP,SAAS,yBAAyB;AAElC,SAAS,wBAAwB;AAEjC,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AACjD,IAAI,0BAA0B;AAE9B,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAExI,MAAM,cAAc;AAAA,EAClB,WAAW;AACb;AAkCA,SAAS,WAAW,WAAoC,MAA+B;AACrF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AAEA,SAAO;AACT;AAEA,SAAS,WAAW,WAAoC,MAAgD;AACtG,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,KAAK,EAAG,QAAO;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,UAAU,WAAoC,MAAyB;AAC9E,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,EAAG,QAAO,OAAO,GAAG;AAAA,EAC1E;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,WAAoC,MAAiC;AAC5F,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC3E;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAuB,OAA0B;AAC1E,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AAEzC,SAAO,KAAK,MAAM,CAAC,OAAO,UAAU,UAAU,MAAM,KAAK,CAAC;AAC5D;AAEO,MAAM,iBAAiB;AAAA,EAC5B,YACmB,IACA,yBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAc,oBAAuD,OAAsB;AACzF,QAAI,CAAC,KAAK,yBAAyB,UAAU,EAAG,QAAO;AAEvD,QAAI;AACF,YAAM,WAAW,WAAW,OAAO,YAAY,WAAW;AAC1D,YAAM,iBAAiB,WAAW,OAAO,kBAAkB,iBAAiB;AAC5E,YAAM,MAAM,MAAM,KAAK,wBAAwB,OAAO,QAAQ;AAC9D,YAAM,cAAc,CAAC,UAA4B;AAC/C,YAAI,CAAC,IAAK,QAAO;AACjB,YAAI,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,EAAE,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AACvF,gBAAMA,aAAY,kBAAkB,OAAO,IAAI,GAAG;AAClD,cAAIA,eAAc,KAAM,QAAO;AAC/B,cAAI;AACF,mBAAO,KAAK,MAAMA,UAAS;AAAA,UAC7B,QAAQ;AACN,mBAAOA;AAAA,UACT;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC;AACtE,YAAI,SAAS,OAAO,UAAU,UAAU;AACtC,gBAAM,OAAgC,CAAC;AACvC,qBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC1E,iBAAK,GAAG,IAAI,YAAY,IAAI;AAAA,UAC9B;AACA,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAEA,YAAM,YAAY,MAAM,KAAK,wBAAwB;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,SAAS;AAAA,QACb,GAAG;AAAA,QACH,GAAG;AAAA,MACL;AAEA,aAAO,cAAc,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY;AACrH,aAAO,eAAe,OAAO;AAC7B,aAAO,iBAAiB,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe;AACpI,aAAO,kBAAkB,OAAO;AAChC,aAAO,gBAAgB,YAAY,OAAO,iBAAiB,OAAO,kBAAkB,MAAM,iBAAiB,MAAM,cAAc;AAC/H,aAAO,iBAAiB,OAAO;AAC/B,aAAO,iBAAiB,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe;AACpI,aAAO,kBAAkB,OAAO;AAChC,aAAO,cAAc,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY;AACrH,aAAO,eAAe,OAAO;AAE7B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,CAAC,yBAAyB;AAC5B,kCAA0B;AAC1B,gBAAQ,KAAK,mDAAmD,GAAG;AAAA,MACrE;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,SAAoE;AAC/F,QAAI,CAAC,QAAS;AAEd,UAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,eAAW,SAAS,MAAM;AACxB,aAAO,OAAO,OAA6C,MAAM,KAAK,oBAAoB,KAA2C,CAAC;AAAA,IACxI;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,OAAwD;AAChE,UAAM,OAAO,KAAK,iBAAiB,KAAK;AACxC,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AAC3C,UAAM,KAAK,gBAAgB,GAAG;AAC9B,UAAM,KAAK,eAAe,GAAG;AAC7B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,OAAmD;AAC1E,QAAI;AACJ,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AAErE,QAAI,gBAAgB;AAClB,UAAI;AACF,eAAO,OAAO,MAAM,KAAK;AACzB,qCAA6B;AAAA,MAC/B,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAC1B,kBAAQ,KAAK,qEAAqE,GAAG;AAAA,QACvF;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,KAAK;AAAA,MAClC;AAAA,IACF,OAAO;AACL,aAAO,KAAK,eAAe,KAAK;AAAA,IAClC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAqB,MAAuC;AAClF,UAAM,aAAa,0BAA0B;AAAA,MAC3C,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,MACjC,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,WAAW,KAAK;AAAA,MAChB,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,WAAO,KAAK,OAAO,WAAW;AAAA,MAC5B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,WAAW;AAAA,MACvB,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,oBAAoB,KAAK,sBAAsB;AAAA,MAC/C,kBAAkB,KAAK,oBAAoB;AAAA,MAC3C,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,WAAW,KAAK,aAAa;AAAA,MAC7B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,eAAe,WAAW;AAAA,MAC1B,qBAAqB,WAAW;AAAA,MAChC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,WAAW,WAAW;AAAA,MACtB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,iBAAiB,CAAC,UAAmB;AACzC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,UAAI,MAAM,WAAW,UAAU,EAAG,QAAO,MAAM,MAAM,WAAW,MAAM;AACtE,aAAO;AAAA,IACT;AAEA,UAAM,sBAAsB,CAAC,UAAoD;AAC/E,UAAI,UAAU,KAAM,QAAO;AAC3B,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,QACA;AAGN,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,eAAe,MAAM,WAAW;AAAA,MAC7C,WAAW,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAAI,MAAM,YAAY;AAAA,MACjG,aAAa,iBAAiB,MAAM,WAAW,KAAK;AAAA,MACpD,cAAc,iBAAiB,MAAM,YAAY,KAAK;AAAA,MACtD,YAAY,iBAAiB,MAAM,UAAU,KAAK;AAAA,MAClD,oBAAoB,iBAAiB,MAAM,kBAAkB,KAAK;AAAA,MAClE,kBAAkB,iBAAiB,MAAM,gBAAgB,KAAK;AAAA,MAC9D,gBAAgB,MAAM,mBAAmB,YAAY,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAChH,WAAW,iBAAiB,MAAM,SAAS,KAAK;AAAA,MAChD,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM;AAAA,MACrB,SAAS,oBAAoB,MAAM,OAAO;AAAA,MAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACzC;AAAA,EACF;AAAA,EAEQ,eAAe,OAAoC;AACzD,WAAO,oBAAoB,MAAM;AAAA,MAC/B,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,QAAsC;AAChE,UAAM,SAAS,CAAC,GAAI,OAAO,gBAAgB,CAAC,CAAE;AAC9C,QAAI,OAAO,YAAa,QAAO,KAAK,OAAO,WAAW;AAEtD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,kBAAkB,QAAsC;AAC9D,UAAM,SAAS,CAAC,GAAI,OAAO,cAAc,CAAC,CAAE;AAC5C,QAAI,OAAO,UAAW,QAAO,KAAK,OAAO,SAAS;AAElD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,mBAAmB,QAAmD;AAC5E,UAAM,SAAS,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAC7C,QAAI,OAAO,WAAY,QAAO,KAAK,OAAO,UAAU;AAEpD,WAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,EAC9B,OAAO,CAAC,UAAwC,wBAAwB,SAAS,KAA4B,CAAC;AAAA,EACnH;AAAA,EAEQ,kBAAkB,QAA+F;AACvH,UAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,WAAW,IACrD,OAAO,WACP,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,IACjD,OAAO,QACP;AACR,UAAM,OAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,IAAI,OAAO,OAAO;AAChF,UAAM,SACJ,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,IAClD,OAAO,UACN,OAAO,KAAK;AACnB,WAAO,EAAE,MAAM,UAAU,QAAQ,OAAO,SAAS;AAAA,EACnD;AAAA,EAEA,MAAc,YAAY,QAA4B,SAAkC;AACtF,UAAM,QAAQ,KAAK,eAAe,MAAM,EAAE,OAAyB,sBAAsB;AAEzF,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,EAAE,OAAO,OAAO,IAAI,KAAK,kBAAkB,MAAM;AACvD,YAAM,MAAM,KAAK,EAAE,OAAO,MAAM;AAAA,IAClC;AAEA,UAAM,OAAO,MAAM;AACnB,UAAM,MAAM,KAAK,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,OAAO;AACpD,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAE9B,UAAM,UAAU,MAAM,KAAK,GAAG,KAAK,WAAW;AAAA,MAC5C,IAAI,EAAE,KAAK,IAAI;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,eAAe,OAAO;AAEjC,UAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAC9D,WAAO,IACJ,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,EACxB,OAAO,CAAC,UAA8B,QAAQ,KAAK,CAAC;AAAA,EACzD;AAAA,EAEQ,eAAe,QAA4B;AACjD,UAAM,QAAQ,KAAK,GAAG,QAAQ,EAAE,aAAa,EAAE,UAAU,wBAAwB;AAEjF,QAAI,OAAO,SAAU,OAAM,SAAS,yBAAyB,OAAO,QAAQ;AAC5E,QAAI,OAAO,eAAgB,OAAM,SAAS,+BAA+B,OAAO,cAAc;AAE9F,UAAM,eAAe,KAAK,oBAAoB,MAAM;AACpD,QAAI,aAAa,WAAW,EAAG,OAAM,SAAS,6BAA6B,aAAa,CAAC,CAAC;AAC1F,QAAI,aAAa,SAAS,EAAG,OAAM,QAAQ,6BAA6B,YAAY;AAEpF,QAAI,OAAO,kBAAkB,OAAO,gBAAgB,OAAO,YAAY;AACrE,YAAM,SAAS,SAAS,oBAAoB;AAC1C,aAAK,MAAM;AAAA,UACT,6BAA6B,OAAO;AAAA,UACpC,2BAA2B,OAAO;AAAA,QACpC,CAAC,EAAE,QAAQ;AAAA,UACT,oCAAoC,OAAO;AAAA,UAC3C,kCAAkC,OAAO;AAAA,QAC3C,CAAC;AAAA,MACH,CAAC;AAAA,IACH,OAAO;AACL,UAAI,OAAO,aAAc,OAAM,SAAS,6BAA6B,OAAO,YAAY;AACxF,UAAI,OAAO,WAAY,OAAM,SAAS,2BAA2B,OAAO,UAAU;AAAA,IACpF;AAEA,QAAI,OAAO,aAAc,OAAM,aAAa,wBAAwB;AACpE,QAAI,OAAO,OAAQ,OAAM,SAAS,0BAA0B,KAAK,OAAO,MAAM;AAC9E,QAAI,OAAO,MAAO,OAAM,SAAS,0BAA0B,KAAK,OAAO,KAAK;AAE5E,UAAM,aAAa,KAAK,kBAAkB,MAAM;AAChD,QAAI,WAAW,SAAS,GAAG;AACzB,YAAM,eAAe,WAAW,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI;AACxD,YAAM;AAAA,QACJ,kEAAkE,YAAY;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,KAAK,mBAAmB,MAAM;AAClD,QAAI,YAAY,WAAW,EAAG,OAAM,SAAS,2BAA2B,YAAY,CAAC,CAAC;AACtF,QAAI,YAAY,SAAS,EAAG,OAAM,QAAQ,2BAA2B,WAAW;AAEhF,QAAI,OAAO,cAAc,QAAQ;AAC/B,YAAM,SAAS,wBAAwB,kBAAkB,2BAA2B;AAAA,IACtF;AAEA,UAAM,UAAU,OAAO,YAAY,QAAQ,QAAQ;AACnD,YAAQ,OAAO,WAAW;AAAA,MACxB,KAAK;AACH,cAAM,WAAW,iEAAiE,OAAO,EAAE;AAC3F;AAAA,MACF,KAAK;AACH,cAAM,WAAW,yCAAyC,OAAO,EAAE;AACnE;AAAA,MACF,KAAK;AACH,cAAM,WAAW,mDAAmD,OAAO,EAAE;AAC7E;AAAA,MACF,KAAK;AACH,cAAM,WAAW,wCAAwC,OAAO,EAAE;AAClE;AAAA,MACF,KAAK;AAAA,MACL;AACE,cAAM,QAAQ,YAAY,WAAW,OAAO;AAC5C,cAAM,QAAQ,kBAAkB,OAAO;AACvC,eAAO;AAAA,IACX;AAEA,UAAM,QAAQ,0BAA0B,MAAM;AAC9C,UAAM,QAAQ,kBAAkB,MAAM;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,MAAM,OAAoC;AAC9C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,MAAM,MAAM,KAAK,eAAe,MAAM,EACzC,WAAW,EACX,MAAkC,EAAE,OAAO,IAAI,CAAC,EAChD,MAAM;AAET,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,IAAI,SAAS;AAC9B,WAAO,OAAO,aAAa,WAAW,WAAW,OAAO,SAAS,UAAU,EAAE,KAAK;AAAA,EACpF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,EAAE,MAAM,SAAS,IAAI,KAAK,kBAAkB,MAAM;AACxD,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,KAAK,YAAY,MAAM;AAAA,MACvB,KAAK,MAAM,MAAM;AAAA,IACnB,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAM,uBAAuB,aAAqB,OAAqE;AACrH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY,YAAmC;AAC9D,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAEhB,UAAM,WAAW,aAAa,KAAK,gBAAgB,MAAM,KAAK,iBAAiB,UAAU,CAAC,IAAI;AAC9F,QAAI,UAAU;AACZ,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAEA,UAAM,KAAK,MAAM;AACjB,UAAM,KAAK,eAAe,GAAG;AAC7B,QAAI,SAAU,OAAM,KAAK,eAAe,QAAQ;AAEhD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,WAAmB;AACvC,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,WAAW,WAAW,KAAK,CAAC;AAC7E,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACtE,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,QAM7B;AACD,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AAEjD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBAAqB,aAAqB,OAAqE;AACnH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY;AAC3B,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACpE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAChB,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,UAA8C,CAAC,GAA+C;AACtH,UAAM,YAAY,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,QAAQ,aAAa,GAAG,GAAG,CAAC,GAAG,GAAI;AAClF,UAAM,SAAS,QAAQ,WAAW,MAAM;AAAA,IAAC;AACzC,UAAM,SAA4C;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAEA,QAAI,kBAA+B;AACnC,QAAI,WAA0B;AAE9B,WAAO,MAAM;AACX,YAAM,YAAY,KAAK,GAAG,QAAQ,EAAe,aAAa,EAC3D;AAAA,QACC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EACC,UAAU,YAAY;AAEzB,UAAI,QAAQ,SAAU,WAAU,SAAS,aAAa,QAAQ,QAAQ;AACtE,UAAI,QAAQ,eAAgB,WAAU,SAAS,mBAAmB,QAAQ,cAAc;AAExF,UAAI,CAAC,QAAQ,OAAO;AAClB,kBAAU,SAAS,CAAC,YAAY;AAC9B,kBACG,UAAU,aAAa,EACvB,YAAY,YAAY,EACxB,YAAY,gBAAgB;AAAA,QACjC,CAAC;AAAA,MACH;AAEA,UAAI,mBAAmB,UAAU;AAC/B,kBAAU,SAAS,CAAC,YAAY;AAC9B,kBACG,MAAM,cAAc,KAAK,eAAe,EACxC,QAAQ,CAAC,WAAW;AACnB,mBAAO,MAAM,cAAc,eAAe,EAAE,SAAS,MAAM,KAAK,QAAQ;AAAA,UAC1E,CAAC;AAAA,QACL,CAAC;AAAA,MACH;AAEA,YAAM,OAAO,MAAM,UAChB,QAAQ,cAAc,KAAK,EAC3B,QAAQ,MAAM,KAAK,EACnB,MAAM,SAAS;AAElB,UAAI,KAAK,WAAW,EAAG;AAEvB,iBAAW,OAAO,MAAM;AACtB,eAAO,WAAW;AAElB,YAAI;AACF,gBAAM,YAAY,MAAM,KAAK,oBAAoB,GAAyC;AAC1F,gBAAM,aAAa,0BAA0B;AAAA,YAC3C,aAAa,WAAW,WAAW,eAAe,eAAe;AAAA,YACjE,aAAa,WAAW,WAAW,eAAe,cAAc;AAAA,YAChE,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,WAAW,WAAW,WAAW,aAAa,YAAY,KAAK;AAAA,YAC/D,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,gBAAgB,UAAU,WAAW,kBAAkB,iBAAiB;AAAA,UAC1E,CAAC;AAED,gBAAM,cAAc,QAAQ,UAAU,QACjC,IAAI,gBAAgB,WAAW,cAC/B,IAAI,eAAe,WAAW,aAC9B,IAAI,0BAA0B,WAAW,uBACzC,CAAC,kBAAkB,IAAI,gBAAgB,WAAW,aAAa;AAEpE,cAAI,CAAC,aAAa;AAChB,mBAAO,WAAW;AAClB;AAAA,UACF;AAEA,gBAAM,KAAK,GAAG,QAAQ,EAAE,aAAa,EAClC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,EACpB,OAAO;AAAA,YACN,aAAa,WAAW;AAAA,YACxB,gBAAgB,WAAW;AAAA,YAC3B,uBAAuB,WAAW;AAAA,YAClC,YAAY,WAAW;AAAA,UACzB,CAAC;AAEH,iBAAO,WAAW;AAAA,QACpB,SAAS,KAAK;AACZ,iBAAO,UAAU;AACjB,iBAAO,oCAAoC,IAAI,EAAE,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,QAC1G;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,wBAAkB,QAAQ;AAC1B,iBAAW,QAAQ;AAEnB;AAAA,QACE,wBAAwB,OAAO,OAAO,0BAA0B,OAAO,OAAO,cAAc,OAAO,OAAO,aAAa,OAAO,MAAM;AAAA,MACtI;AAEA,UAAI,KAAK,SAAS,UAAW;AAAA,IAC/B;AAEA,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  actionLogCreateSchema,\n  actionLogListSchema,\n  type ActionLogCreateInput,\n  type ActionLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { isRecord } from '@open-mercato/core/modules/audit_logs/lib/changeRows'\nimport {\n  ACTION_LOG_FILTER_TYPES,\n  type ActionLogFilterType,\n  deriveActionLogProjection,\n} from '@open-mercato/core/modules/audit_logs/lib/projections'\nimport { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { toOptionalString } from '@open-mercato/shared/lib/string/coerce'\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\nlet decryptionWarningLogged = false\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\nconst SORT_FIELDS = {\n  createdAt: 'action_logs.created_at',\n} as const\n\ntype ActionLogProjectionBackfillOptions = {\n  batchSize?: number\n  force?: boolean\n  logger?: (message: string) => void\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport type ActionLogProjectionBackfillResult = {\n  errors: number\n  scanned: number\n  skipped: number\n  updated: number\n}\n\ntype BackfillRow = {\n  action_label: string | null\n  action_type: string | null\n  actor_user_id: string | null\n  changed_fields: string[] | null\n  changes_json: Record<string, unknown> | null\n  command_id: string\n  context_json: Record<string, unknown> | null\n  created_at: Date\n  id: string\n  organization_id: string | null\n  primary_changed_field: string | null\n  snapshot_before: unknown | null\n  source_key: string | null\n  tenant_id: string | null\n}\n\nfunction readString(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n\n  return null\n}\n\nfunction readRecord(record: Record<string, unknown>, ...keys: string[]): Record<string, unknown> | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (isRecord(value)) return value\n  }\n\n  return null\n}\n\nfunction readValue(record: Record<string, unknown>, ...keys: string[]): unknown {\n  for (const key of keys) {\n    if (Object.prototype.hasOwnProperty.call(record, key)) return record[key]\n  }\n\n  return undefined\n}\n\nfunction readStringArray(record: Record<string, unknown>, ...keys: string[]): string[] | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (Array.isArray(value)) {\n      return value.filter((entry): entry is string => typeof entry === 'string')\n    }\n  }\n\n  return null\n}\n\nfunction stringArraysEqual(left: string[] | null, right: string[]): boolean {\n  if (!Array.isArray(left)) return false\n  if (left.length !== right.length) return false\n\n  return left.every((value, index) => value === right[index])\n}\n\nexport class ActionLogService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly tenantEncryptionService?: TenantDataEncryptionService,\n  ) {}\n\n  private async decryptEntryPayload<T extends Record<string, unknown>>(entry: T): Promise<T> {\n    if (!this.tenantEncryptionService?.isEnabled()) return entry\n\n    try {\n      const tenantId = readString(entry, 'tenantId', 'tenant_id')\n      const organizationId = readString(entry, 'organizationId', 'organization_id')\n      const dek = await this.tenantEncryptionService.getDek(tenantId)\n      const deepDecrypt = (value: unknown): unknown => {\n        if (!dek) return value\n        if (typeof value === 'string' && value.split(':').length === 4 && value.endsWith(':v1')) {\n          const decrypted = decryptWithAesGcm(value, dek.key)\n          if (decrypted === null) return value\n          try {\n            return JSON.parse(decrypted)\n          } catch {\n            return decrypted\n          }\n        }\n        if (Array.isArray(value)) return value.map((item) => deepDecrypt(item))\n        if (value && typeof value === 'object') {\n          const copy: Record<string, unknown> = {}\n          for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n            copy[key] = deepDecrypt(item)\n          }\n          return copy\n        }\n        return value\n      }\n\n      const decrypted = await this.tenantEncryptionService.decryptEntityPayload(\n        'audit_logs:action_log',\n        entry,\n        tenantId,\n        organizationId,\n      )\n\n      const merged = {\n        ...entry,\n        ...decrypted,\n      } as Record<string, unknown>\n\n      merged.changesJson = deepDecrypt(merged.changesJson ?? merged.changes_json ?? entry.changesJson ?? entry.changes_json)\n      merged.changes_json = merged.changesJson\n      merged.snapshotBefore = deepDecrypt(merged.snapshotBefore ?? merged.snapshot_before ?? entry.snapshotBefore ?? entry.snapshot_before)\n      merged.snapshot_before = merged.snapshotBefore\n      merged.snapshotAfter = deepDecrypt(merged.snapshotAfter ?? merged.snapshot_after ?? entry.snapshotAfter ?? entry.snapshot_after)\n      merged.snapshot_after = merged.snapshotAfter\n      merged.commandPayload = deepDecrypt(merged.commandPayload ?? merged.command_payload ?? entry.commandPayload ?? entry.command_payload)\n      merged.command_payload = merged.commandPayload\n      merged.contextJson = deepDecrypt(merged.contextJson ?? merged.context_json ?? entry.contextJson ?? entry.context_json)\n      merged.context_json = merged.contextJson\n\n      return merged as T\n    } catch (err) {\n      if (!decryptionWarningLogged) {\n        decryptionWarningLogged = true\n        console.warn('[audit_logs] failed to decrypt action log entry', err)\n      }\n      return entry\n    }\n  }\n\n  private async decryptEntries(entries: ActionLog | ActionLog[] | null | undefined): Promise<void> {\n    if (!entries) return\n\n    const list = Array.isArray(entries) ? entries : [entries]\n    for (const entry of list) {\n      Object.assign(entry as unknown as Record<string, unknown>, await this.decryptEntryPayload(entry as unknown as Record<string, unknown>))\n    }\n  }\n\n  async log(input: ActionLogCreateInput): Promise<ActionLog | null> {\n    const data = this.parseCreateInput(input)\n    const fork = this.em.fork()\n    const log = this.createLogEntity(fork, data)\n    await fork.persist(log).flush()\n    await this.decryptEntries(log)\n    return log\n  }\n\n  private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {\n    let data: ActionLogCreateInput\n    const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n\n    if (shouldValidate) {\n      try {\n        data = schema.parse(input)\n        runtimeValidationAvailable = true\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          console.warn('[audit_logs] falling back to permissive action log payload parser', err)\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        data = this.normalizeInput(input)\n      }\n    } else {\n      data = this.normalizeInput(input)\n    }\n\n    return data\n  }\n\n  private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {\n    const projection = deriveActionLogProjection({\n      actorUserId: data.actorUserId ?? null,\n      actionLabel: data.actionLabel ?? null,\n      changes: isRecord(data.changes) ? data.changes : null,\n      commandId: data.commandId,\n      context: isRecord(data.context) ? data.context : null,\n      snapshotBefore: data.snapshotBefore,\n    })\n\n    return fork.create(ActionLog, {\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      commandId: data.commandId,\n      actionLabel: data.actionLabel ?? null,\n      actionType: projection.actionType,\n      resourceKind: data.resourceKind ?? null,\n      resourceId: data.resourceId ?? null,\n      parentResourceKind: data.parentResourceKind ?? null,\n      parentResourceId: data.parentResourceId ?? null,\n      executionState: data.executionState ?? 'done',\n      undoToken: data.undoToken ?? null,\n      commandPayload: data.commandPayload ?? null,\n      snapshotBefore: data.snapshotBefore ?? null,\n      snapshotAfter: data.snapshotAfter ?? null,\n      changesJson: isRecord(data.changes) ? data.changes : null,\n      changedFields: projection.changedFields,\n      primaryChangedField: projection.primaryChangedField,\n      contextJson: isRecord(data.context) ? data.context : null,\n      sourceKey: projection.sourceKey,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n  }\n\n  private normalizeInput(input: Partial<ActionLogCreateInput> | null | undefined): ActionLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        commandId: 'unknown',\n        actionLabel: undefined,\n        resourceKind: undefined,\n        resourceId: undefined,\n        executionState: 'done',\n        undoToken: undefined,\n        commandPayload: undefined,\n        snapshotBefore: undefined,\n        snapshotAfter: undefined,\n        changes: undefined,\n        context: undefined,\n      }\n    }\n\n    const toNullableUuid = (value: unknown) => {\n      if (typeof value !== 'string' || value.length === 0) return null\n      if (value.startsWith('api_key:')) return value.slice('api_key:'.length)\n      return value\n    }\n\n    const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {\n      if (value === null) return null\n      if (Array.isArray(value)) return value\n      if (typeof value === 'object') return value as Record<string, unknown>\n      return undefined\n    }\n\n    const normalizeContext = (value: unknown) => (\n      typeof value === 'object' && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined\n    )\n\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: toNullableUuid(input.actorUserId),\n      commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',\n      actionLabel: toOptionalString(input.actionLabel) ?? undefined,\n      resourceKind: toOptionalString(input.resourceKind) ?? undefined,\n      resourceId: toOptionalString(input.resourceId) ?? undefined,\n      parentResourceKind: toOptionalString(input.parentResourceKind) ?? null,\n      parentResourceId: toOptionalString(input.parentResourceId) ?? null,\n      executionState: input.executionState === 'undone' || input.executionState === 'failed' ? input.executionState : 'done',\n      undoToken: toOptionalString(input.undoToken) ?? undefined,\n      commandPayload: input.commandPayload,\n      snapshotBefore: input.snapshotBefore,\n      snapshotAfter: input.snapshotAfter,\n      changes: normalizeRecordLike(input.changes),\n      context: normalizeContext(input.context),\n    }\n  }\n\n  private parseListQuery(query: Partial<ActionLogListQuery>) {\n    return actionLogListSchema.parse({\n      ...query,\n    })\n  }\n\n  private resolveActorUserIds(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.actorUserIds ?? [])]\n    if (parsed.actorUserId) values.push(parsed.actorUserId)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveFieldNames(parsed: ActionLogListQuery): string[] {\n    const values = [...(parsed.fieldNames ?? [])]\n    if (parsed.fieldName) values.push(parsed.fieldName)\n\n    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))\n  }\n\n  private resolveActionTypes(parsed: ActionLogListQuery): ActionLogFilterType[] {\n    const values = [...(parsed.actionTypes ?? [])]\n    if (parsed.actionType) values.push(parsed.actionType)\n\n    return Array.from(new Set(values))\n      .filter((value): value is ActionLogFilterType => ACTION_LOG_FILTER_TYPES.includes(value as ActionLogFilterType))\n  }\n\n  private resolvePagination(parsed: ActionLogListQuery): { page: number; pageSize: number; offset: number; limit: number } {\n    const pageSize =\n      typeof parsed.pageSize === 'number' && parsed.pageSize > 0\n        ? parsed.pageSize\n        : typeof parsed.limit === 'number' && parsed.limit > 0\n          ? parsed.limit\n          : 50\n    const page = typeof parsed.page === 'number' && parsed.page > 0 ? parsed.page : 1\n    const offset =\n      typeof parsed.offset === 'number' && parsed.offset >= 0\n        ? parsed.offset\n        : (page - 1) * pageSize\n    return { page, pageSize, offset, limit: pageSize }\n  }\n\n  private async loadEntries(parsed: ActionLogListQuery, options?: { paginate?: boolean }) {\n    let query = (this.buildListQuery(parsed) as any).select('action_logs.id as id')\n\n    if (options?.paginate !== false) {\n      const { limit, offset } = this.resolvePagination(parsed)\n      query = query.limit(limit).offset(offset)\n    }\n\n    const rows = await query.execute()\n    const ids = rows.map((row: any) => row.id).filter(Boolean)\n    if (ids.length === 0) return []\n\n    const results = await this.em.find(ActionLog, {\n      id: { $in: ids } as any,\n      deletedAt: null,\n    })\n    await this.decryptEntries(results)\n\n    const byId = new Map(results.map((entry: any) => [entry.id, entry]))\n    return ids\n      .map((id: any) => byId.get(id))\n      .filter((entry: any): entry is ActionLog => Boolean(entry))\n  }\n\n  private buildListQuery(parsed: ActionLogListQuery): any {\n    let query = (this.em.getKysely<any>() as any)\n      .selectFrom('action_logs')\n      .selectAll()\n      .where('action_logs.deleted_at', 'is', null) as any\n\n    if (parsed.tenantId) query = query.where('action_logs.tenant_id', '=', parsed.tenantId)\n    if (parsed.organizationId) query = query.where('action_logs.organization_id', '=', parsed.organizationId)\n\n    const actorUserIds = this.resolveActorUserIds(parsed)\n    if (actorUserIds.length === 1) query = query.where('action_logs.actor_user_id', '=', actorUserIds[0])\n    if (actorUserIds.length > 1) query = query.where('action_logs.actor_user_id', 'in', actorUserIds)\n\n    if (parsed.includeRelated && parsed.resourceKind && parsed.resourceId) {\n      query = query.where((eb: any) =>\n        eb.or([\n          eb.and([\n            eb('action_logs.resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.resource_id', '=', parsed.resourceId),\n          ]),\n          eb.and([\n            eb('action_logs.parent_resource_kind', '=', parsed.resourceKind),\n            eb('action_logs.parent_resource_id', '=', parsed.resourceId),\n          ]),\n        ])\n      )\n    } else {\n      if (parsed.resourceKind) query = query.where('action_logs.resource_kind', '=', parsed.resourceKind)\n      if (parsed.resourceId) query = query.where('action_logs.resource_id', '=', parsed.resourceId)\n    }\n\n    if (parsed.undoableOnly) query = query.where('action_logs.undo_token', 'is not', null)\n    if (parsed.before) query = query.where('action_logs.created_at', '<', parsed.before)\n    if (parsed.after) query = query.where('action_logs.created_at', '>', parsed.after)\n\n    const fieldNames = this.resolveFieldNames(parsed)\n    if (fieldNames.length === 1) query = query.where('action_logs.primary_changed_field', '=', fieldNames[0])\n    if (fieldNames.length > 1) query = query.where('action_logs.primary_changed_field', 'in', fieldNames)\n\n    const actionTypes = this.resolveActionTypes(parsed)\n    if (actionTypes.length === 1) query = query.where('action_logs.action_type', '=', actionTypes[0])\n    if (actionTypes.length > 1) query = query.where('action_logs.action_type', 'in', actionTypes)\n\n    if (parsed.sortField === 'user') {\n      query = query.leftJoin('users as audit_actor', 'audit_actor.id', 'action_logs.actor_user_id')\n    }\n\n    const sortDir = parsed.sortDir === 'asc' ? 'asc' : 'desc'\n    switch (parsed.sortField) {\n      case 'user':\n        query = query.orderBy(sql`coalesce(nullif(audit_actor.name, ''), audit_actor.email, '')`, sortDir)\n        break\n      case 'action':\n        query = query.orderBy(sql`coalesce(action_logs.action_type, '')`, sortDir)\n        break\n      case 'field':\n        query = query.orderBy(sql`coalesce(action_logs.primary_changed_field, '')`, sortDir)\n        break\n      case 'source':\n        query = query.orderBy(sql`coalesce(action_logs.source_key, '')`, sortDir)\n        break\n      case 'createdAt':\n      default:\n        query = query.orderBy(SORT_FIELDS.createdAt, sortDir)\n        query = query.orderBy('action_logs.id', sortDir)\n        return query\n    }\n\n    query = query.orderBy('action_logs.created_at', 'desc')\n    query = query.orderBy('action_logs.id', 'desc')\n    return query\n  }\n\n  async count(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const row = await (this.buildListQuery(parsed) as any)\n      .clearSelect()\n      .clearOrderBy()\n      .select(sql<string>`count(*)`.as('count'))\n      .executeTakeFirst()\n\n    if (!row) return 0\n    const rawCount = row.count ?? 0\n    return typeof rawCount === 'number' ? rawCount : Number.parseInt(rawCount, 10) || 0\n  }\n\n  async list(query: Partial<ActionLogListQuery>) {\n    const parsed = this.parseListQuery(query)\n    const { page, pageSize } = this.resolvePagination(parsed)\n    const [items, total] = await Promise.all([\n      this.loadEntries(parsed),\n      this.count(parsed),\n    ])\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  async latestUndoableForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markUndone(id: string, traceInput?: ActionLogCreateInput) {\n    const fork = this.em.fork()\n    const log = await fork.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'undone'\n    log.undoToken = null\n\n    const traceLog = traceInput ? this.createLogEntity(fork, this.parseCreateInput(traceInput)) : null\n    if (traceLog) {\n      fork.persist(traceLog)\n    }\n\n    await fork.flush()\n    await this.decryptEntries(log)\n    if (traceLog) await this.decryptEntries(traceLog)\n\n    return log\n  }\n\n  async findByUndoToken(undoToken: string) {\n    const entry = await this.em.findOne(ActionLog, { undoToken, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async findById(id: string) {\n    const entry = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoableForResource(params: {\n    actorUserId: string\n    tenantId?: string | null\n    organizationId?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n  }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId: params.actorUserId,\n      undoToken: { $ne: null } as any,\n      executionState: 'done',\n      deletedAt: null,\n    }\n    if (params.tenantId) where.tenantId = params.tenantId\n    if (params.organizationId) where.organizationId = params.organizationId\n    if (params.resourceKind) where.resourceKind = params.resourceKind\n    if (params.resourceId) where.resourceId = params.resourceId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async latestUndoneForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {\n    const where: FilterQuery<ActionLog> = {\n      actorUserId,\n      executionState: 'undone',\n      deletedAt: null,\n    }\n    if (scope.tenantId) where.tenantId = scope.tenantId\n    if (scope.organizationId) where.organizationId = scope.organizationId\n\n    const entry = await this.em.findOne(ActionLog, where, { orderBy: { updatedAt: 'desc' } })\n    await this.decryptEntries(entry)\n    return entry\n  }\n\n  async markRedone(id: string) {\n    const log = await this.em.findOne(ActionLog, { id, deletedAt: null })\n    if (!log) return null\n\n    log.executionState = 'redone'\n    log.undoToken = null\n    await this.em.flush()\n    return log\n  }\n\n  async backfillProjections(options: ActionLogProjectionBackfillOptions = {}): Promise<ActionLogProjectionBackfillResult> {\n    const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1000)\n    const logger = options.logger ?? (() => {})\n    const result: ActionLogProjectionBackfillResult = {\n      errors: 0,\n      scanned: 0,\n      skipped: 0,\n      updated: 0,\n    }\n\n    let cursorCreatedAt: Date | null = null\n    let cursorId: string | null = null\n\n    while (true) {\n      const rowsQuery = (this.em.getKysely<any>() as any)\n        .selectFrom('action_logs')\n        .select([\n          'action_logs.id',\n          'action_logs.tenant_id',\n          'action_logs.organization_id',\n          'action_logs.actor_user_id',\n          'action_logs.command_id',\n          'action_logs.action_label',\n          'action_logs.snapshot_before',\n          'action_logs.changes_json',\n          'action_logs.context_json',\n          'action_logs.action_type',\n          'action_logs.source_key',\n          'action_logs.changed_fields',\n          'action_logs.primary_changed_field',\n          'action_logs.created_at',\n        ])\n        .where('action_logs.deleted_at', 'is', null) as any\n\n      if (options.tenantId) rowsQuery.where('action_logs.tenant_id', '=', options.tenantId)\n      if (options.organizationId) rowsQuery.where('action_logs.organization_id', '=', options.organizationId)\n\n      if (!options.force) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.action_type', 'is', null),\n            eb('action_logs.source_key', 'is', null),\n            eb('action_logs.changed_fields', 'is', null),\n          ])\n        )\n      }\n\n      if (cursorCreatedAt && cursorId) {\n        rowsQuery.where((eb: any) =>\n          eb.or([\n            eb('action_logs.created_at', '>', cursorCreatedAt),\n            eb.and([\n              eb('action_logs.created_at', '=', cursorCreatedAt),\n              eb('action_logs.id', '>', cursorId),\n            ]),\n          ])\n        )\n      }\n\n      const rows = await rowsQuery\n        .orderBy('created_at', 'asc')\n        .orderBy('id', 'asc')\n        .limit(batchSize)\n\n      if (rows.length === 0) break\n\n      for (const row of rows) {\n        result.scanned += 1\n\n        try {\n          const decrypted = await this.decryptEntryPayload(row as unknown as Record<string, unknown>)\n          const projection = deriveActionLogProjection({\n            actorUserId: readString(decrypted, 'actorUserId', 'actor_user_id'),\n            actionLabel: readString(decrypted, 'actionLabel', 'action_label'),\n            changes: readRecord(decrypted, 'changesJson', 'changes_json'),\n            commandId: readString(decrypted, 'commandId', 'command_id') ?? 'unknown',\n            context: readRecord(decrypted, 'contextJson', 'context_json'),\n            snapshotBefore: readValue(decrypted, 'snapshotBefore', 'snapshot_before'),\n          })\n\n          const needsUpdate = options.force === true\n            || row.action_type !== projection.actionType\n            || row.source_key !== projection.sourceKey\n            || row.primary_changed_field !== projection.primaryChangedField\n            || !stringArraysEqual(row.changed_fields, projection.changedFields)\n\n          if (!needsUpdate) {\n            result.skipped += 1\n            continue\n          }\n\n          await (this.em.getKysely<any>() as any)\n            .updateTable('action_logs')\n            .set({\n              action_type: projection.actionType,\n              changed_fields: projection.changedFields,\n              primary_changed_field: projection.primaryChangedField,\n              source_key: projection.sourceKey,\n            })\n            .where('id', '=', row.id)\n            .execute()\n\n          result.updated += 1\n        } catch (err) {\n          result.errors += 1\n          logger(`[backfill] Failed for action log ${row.id}: ${err instanceof Error ? err.message : String(err)}`)\n        }\n      }\n\n      const lastRow = rows[rows.length - 1]\n      cursorCreatedAt = lastRow.created_at\n      cursorId = lastRow.id\n\n      logger(\n        `[backfill] Processed ${result.scanned} action logs (updated: ${result.updated}, skipped: ${result.skipped}, errors: ${result.errors})`,\n      )\n\n      if (rows.length < batchSize) break\n    }\n\n    return result\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,WAAW;AACpB,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AACP,SAAS,yBAAyB;AAElC,SAAS,wBAAwB;AAEjC,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AACjD,IAAI,0BAA0B;AAE9B,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAExI,MAAM,cAAc;AAAA,EAClB,WAAW;AACb;AAkCA,SAAS,WAAW,WAAoC,MAA+B;AACrF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AAEA,SAAO;AACT;AAEA,SAAS,WAAW,WAAoC,MAAgD;AACtG,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,KAAK,EAAG,QAAO;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,UAAU,WAAoC,MAAyB;AAC9E,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,EAAG,QAAO,OAAO,GAAG;AAAA,EAC1E;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,WAAoC,MAAiC;AAC5F,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC3E;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAuB,OAA0B;AAC1E,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AAEzC,SAAO,KAAK,MAAM,CAAC,OAAO,UAAU,UAAU,MAAM,KAAK,CAAC;AAC5D;AAEO,MAAM,iBAAiB;AAAA,EAC5B,YACmB,IACA,yBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAc,oBAAuD,OAAsB;AACzF,QAAI,CAAC,KAAK,yBAAyB,UAAU,EAAG,QAAO;AAEvD,QAAI;AACF,YAAM,WAAW,WAAW,OAAO,YAAY,WAAW;AAC1D,YAAM,iBAAiB,WAAW,OAAO,kBAAkB,iBAAiB;AAC5E,YAAM,MAAM,MAAM,KAAK,wBAAwB,OAAO,QAAQ;AAC9D,YAAM,cAAc,CAAC,UAA4B;AAC/C,YAAI,CAAC,IAAK,QAAO;AACjB,YAAI,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,EAAE,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AACvF,gBAAMA,aAAY,kBAAkB,OAAO,IAAI,GAAG;AAClD,cAAIA,eAAc,KAAM,QAAO;AAC/B,cAAI;AACF,mBAAO,KAAK,MAAMA,UAAS;AAAA,UAC7B,QAAQ;AACN,mBAAOA;AAAA,UACT;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC;AACtE,YAAI,SAAS,OAAO,UAAU,UAAU;AACtC,gBAAM,OAAgC,CAAC;AACvC,qBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC1E,iBAAK,GAAG,IAAI,YAAY,IAAI;AAAA,UAC9B;AACA,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAEA,YAAM,YAAY,MAAM,KAAK,wBAAwB;AAAA,QACnD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,SAAS;AAAA,QACb,GAAG;AAAA,QACH,GAAG;AAAA,MACL;AAEA,aAAO,cAAc,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY;AACrH,aAAO,eAAe,OAAO;AAC7B,aAAO,iBAAiB,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe;AACpI,aAAO,kBAAkB,OAAO;AAChC,aAAO,gBAAgB,YAAY,OAAO,iBAAiB,OAAO,kBAAkB,MAAM,iBAAiB,MAAM,cAAc;AAC/H,aAAO,iBAAiB,OAAO;AAC/B,aAAO,iBAAiB,YAAY,OAAO,kBAAkB,OAAO,mBAAmB,MAAM,kBAAkB,MAAM,eAAe;AACpI,aAAO,kBAAkB,OAAO;AAChC,aAAO,cAAc,YAAY,OAAO,eAAe,OAAO,gBAAgB,MAAM,eAAe,MAAM,YAAY;AACrH,aAAO,eAAe,OAAO;AAE7B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,CAAC,yBAAyB;AAC5B,kCAA0B;AAC1B,gBAAQ,KAAK,mDAAmD,GAAG;AAAA,MACrE;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,SAAoE;AAC/F,QAAI,CAAC,QAAS;AAEd,UAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AACxD,eAAW,SAAS,MAAM;AACxB,aAAO,OAAO,OAA6C,MAAM,KAAK,oBAAoB,KAA2C,CAAC;AAAA,IACxI;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,OAAwD;AAChE,UAAM,OAAO,KAAK,iBAAiB,KAAK;AACxC,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,gBAAgB,MAAM,IAAI;AAC3C,UAAM,KAAK,QAAQ,GAAG,EAAE,MAAM;AAC9B,UAAM,KAAK,eAAe,GAAG;AAC7B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,OAAmD;AAC1E,QAAI;AACJ,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AAErE,QAAI,gBAAgB;AAClB,UAAI;AACF,eAAO,OAAO,MAAM,KAAK;AACzB,qCAA6B;AAAA,MAC/B,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAC1B,kBAAQ,KAAK,qEAAqE,GAAG;AAAA,QACvF;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,KAAK;AAAA,MAClC;AAAA,IACF,OAAO;AACL,aAAO,KAAK,eAAe,KAAK;AAAA,IAClC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,MAAqB,MAAuC;AAClF,UAAM,aAAa,0BAA0B;AAAA,MAC3C,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,MACjC,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,WAAW,KAAK;AAAA,MAChB,SAAS,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACjD,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,WAAO,KAAK,OAAO,WAAW;AAAA,MAC5B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,WAAW;AAAA,MACvB,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,oBAAoB,KAAK,sBAAsB;AAAA,MAC/C,kBAAkB,KAAK,oBAAoB;AAAA,MAC3C,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,WAAW,KAAK,aAAa;AAAA,MAC7B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,eAAe,WAAW;AAAA,MAC1B,qBAAqB,WAAW;AAAA,MAChC,aAAa,SAAS,KAAK,OAAO,IAAI,KAAK,UAAU;AAAA,MACrD,WAAW,WAAW;AAAA,MACtB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,iBAAiB,CAAC,UAAmB;AACzC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,UAAI,MAAM,WAAW,UAAU,EAAG,QAAO,MAAM,MAAM,WAAW,MAAM;AACtE,aAAO;AAAA,IACT;AAEA,UAAM,sBAAsB,CAAC,UAAoD;AAC/E,UAAI,UAAU,KAAM,QAAO;AAC3B,UAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,QACA;AAGN,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,eAAe,MAAM,WAAW;AAAA,MAC7C,WAAW,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAAI,MAAM,YAAY;AAAA,MACjG,aAAa,iBAAiB,MAAM,WAAW,KAAK;AAAA,MACpD,cAAc,iBAAiB,MAAM,YAAY,KAAK;AAAA,MACtD,YAAY,iBAAiB,MAAM,UAAU,KAAK;AAAA,MAClD,oBAAoB,iBAAiB,MAAM,kBAAkB,KAAK;AAAA,MAClE,kBAAkB,iBAAiB,MAAM,gBAAgB,KAAK;AAAA,MAC9D,gBAAgB,MAAM,mBAAmB,YAAY,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAChH,WAAW,iBAAiB,MAAM,SAAS,KAAK;AAAA,MAChD,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM;AAAA,MACrB,SAAS,oBAAoB,MAAM,OAAO;AAAA,MAC1C,SAAS,iBAAiB,MAAM,OAAO;AAAA,IACzC;AAAA,EACF;AAAA,EAEQ,eAAe,OAAoC;AACzD,WAAO,oBAAoB,MAAM;AAAA,MAC/B,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,QAAsC;AAChE,UAAM,SAAS,CAAC,GAAI,OAAO,gBAAgB,CAAC,CAAE;AAC9C,QAAI,OAAO,YAAa,QAAO,KAAK,OAAO,WAAW;AAEtD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,kBAAkB,QAAsC;AAC9D,UAAM,SAAS,CAAC,GAAI,OAAO,cAAc,CAAC,CAAE;AAC5C,QAAI,OAAO,UAAW,QAAO,KAAK,OAAO,SAAS;AAElD,WAAO,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAChF;AAAA,EAEQ,mBAAmB,QAAmD;AAC5E,UAAM,SAAS,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAC7C,QAAI,OAAO,WAAY,QAAO,KAAK,OAAO,UAAU;AAEpD,WAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,EAC9B,OAAO,CAAC,UAAwC,wBAAwB,SAAS,KAA4B,CAAC;AAAA,EACnH;AAAA,EAEQ,kBAAkB,QAA+F;AACvH,UAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,WAAW,IACrD,OAAO,WACP,OAAO,OAAO,UAAU,YAAY,OAAO,QAAQ,IACjD,OAAO,QACP;AACR,UAAM,OAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,IAAI,OAAO,OAAO;AAChF,UAAM,SACJ,OAAO,OAAO,WAAW,YAAY,OAAO,UAAU,IAClD,OAAO,UACN,OAAO,KAAK;AACnB,WAAO,EAAE,MAAM,UAAU,QAAQ,OAAO,SAAS;AAAA,EACnD;AAAA,EAEA,MAAc,YAAY,QAA4B,SAAkC;AACtF,QAAI,QAAS,KAAK,eAAe,MAAM,EAAU,OAAO,sBAAsB;AAE9E,QAAI,SAAS,aAAa,OAAO;AAC/B,YAAM,EAAE,OAAO,OAAO,IAAI,KAAK,kBAAkB,MAAM;AACvD,cAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,MAAM;AAAA,IAC1C;AAEA,UAAM,OAAO,MAAM,MAAM,QAAQ;AACjC,UAAM,MAAM,KAAK,IAAI,CAAC,QAAa,IAAI,EAAE,EAAE,OAAO,OAAO;AACzD,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAE9B,UAAM,UAAU,MAAM,KAAK,GAAG,KAAK,WAAW;AAAA,MAC5C,IAAI,EAAE,KAAK,IAAI;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,eAAe,OAAO;AAEjC,UAAM,OAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAe,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AACnE,WAAO,IACJ,IAAI,CAAC,OAAY,KAAK,IAAI,EAAE,CAAC,EAC7B,OAAO,CAAC,UAAmC,QAAQ,KAAK,CAAC;AAAA,EAC9D;AAAA,EAEQ,eAAe,QAAiC;AACtD,QAAI,QAAS,KAAK,GAAG,UAAe,EACjC,WAAW,aAAa,EACxB,UAAU,EACV,MAAM,0BAA0B,MAAM,IAAI;AAE7C,QAAI,OAAO,SAAU,SAAQ,MAAM,MAAM,yBAAyB,KAAK,OAAO,QAAQ;AACtF,QAAI,OAAO,eAAgB,SAAQ,MAAM,MAAM,+BAA+B,KAAK,OAAO,cAAc;AAExG,UAAM,eAAe,KAAK,oBAAoB,MAAM;AACpD,QAAI,aAAa,WAAW,EAAG,SAAQ,MAAM,MAAM,6BAA6B,KAAK,aAAa,CAAC,CAAC;AACpG,QAAI,aAAa,SAAS,EAAG,SAAQ,MAAM,MAAM,6BAA6B,MAAM,YAAY;AAEhG,QAAI,OAAO,kBAAkB,OAAO,gBAAgB,OAAO,YAAY;AACrE,cAAQ,MAAM;AAAA,QAAM,CAAC,OACnB,GAAG,GAAG;AAAA,UACJ,GAAG,IAAI;AAAA,YACL,GAAG,6BAA6B,KAAK,OAAO,YAAY;AAAA,YACxD,GAAG,2BAA2B,KAAK,OAAO,UAAU;AAAA,UACtD,CAAC;AAAA,UACD,GAAG,IAAI;AAAA,YACL,GAAG,oCAAoC,KAAK,OAAO,YAAY;AAAA,YAC/D,GAAG,kCAAkC,KAAK,OAAO,UAAU;AAAA,UAC7D,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,UAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,6BAA6B,KAAK,OAAO,YAAY;AAClG,UAAI,OAAO,WAAY,SAAQ,MAAM,MAAM,2BAA2B,KAAK,OAAO,UAAU;AAAA,IAC9F;AAEA,QAAI,OAAO,aAAc,SAAQ,MAAM,MAAM,0BAA0B,UAAU,IAAI;AACrF,QAAI,OAAO,OAAQ,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,MAAM;AACnF,QAAI,OAAO,MAAO,SAAQ,MAAM,MAAM,0BAA0B,KAAK,OAAO,KAAK;AAEjF,UAAM,aAAa,KAAK,kBAAkB,MAAM;AAChD,QAAI,WAAW,WAAW,EAAG,SAAQ,MAAM,MAAM,qCAAqC,KAAK,WAAW,CAAC,CAAC;AACxG,QAAI,WAAW,SAAS,EAAG,SAAQ,MAAM,MAAM,qCAAqC,MAAM,UAAU;AAEpG,UAAM,cAAc,KAAK,mBAAmB,MAAM;AAClD,QAAI,YAAY,WAAW,EAAG,SAAQ,MAAM,MAAM,2BAA2B,KAAK,YAAY,CAAC,CAAC;AAChG,QAAI,YAAY,SAAS,EAAG,SAAQ,MAAM,MAAM,2BAA2B,MAAM,WAAW;AAE5F,QAAI,OAAO,cAAc,QAAQ;AAC/B,cAAQ,MAAM,SAAS,wBAAwB,kBAAkB,2BAA2B;AAAA,IAC9F;AAEA,UAAM,UAAU,OAAO,YAAY,QAAQ,QAAQ;AACnD,YAAQ,OAAO,WAAW;AAAA,MACxB,KAAK;AACH,gBAAQ,MAAM,QAAQ,oEAAoE,OAAO;AACjG;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,4CAA4C,OAAO;AACzE;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,sDAAsD,OAAO;AACnF;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,QAAQ,2CAA2C,OAAO;AACxE;AAAA,MACF,KAAK;AAAA,MACL;AACE,gBAAQ,MAAM,QAAQ,YAAY,WAAW,OAAO;AACpD,gBAAQ,MAAM,QAAQ,kBAAkB,OAAO;AAC/C,eAAO;AAAA,IACX;AAEA,YAAQ,MAAM,QAAQ,0BAA0B,MAAM;AACtD,YAAQ,MAAM,QAAQ,kBAAkB,MAAM;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,MAAM,OAAoC;AAC9C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,MAAM,MAAO,KAAK,eAAe,MAAM,EAC1C,YAAY,EACZ,aAAa,EACb,OAAO,cAAsB,GAAG,OAAO,CAAC,EACxC,iBAAiB;AAEpB,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,IAAI,SAAS;AAC9B,WAAO,OAAO,aAAa,WAAW,WAAW,OAAO,SAAS,UAAU,EAAE,KAAK;AAAA,EACpF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAM,EAAE,MAAM,SAAS,IAAI,KAAK,kBAAkB,MAAM;AACxD,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,KAAK,YAAY,MAAM;AAAA,MACvB,KAAK,MAAM,MAAM;AAAA,IACnB,CAAC;AACD,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAM,uBAAuB,aAAqB,OAAqE;AACrH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY,YAAmC;AAC9D,UAAM,OAAO,KAAK,GAAG,KAAK;AAC1B,UAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACjE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAEhB,UAAM,WAAW,aAAa,KAAK,gBAAgB,MAAM,KAAK,iBAAiB,UAAU,CAAC,IAAI;AAC9F,QAAI,UAAU;AACZ,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAEA,UAAM,KAAK,MAAM;AACjB,UAAM,KAAK,eAAe,GAAG;AAC7B,QAAI,SAAU,OAAM,KAAK,eAAe,QAAQ;AAEhD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,WAAmB;AACvC,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,WAAW,WAAW,KAAK,CAAC;AAC7E,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACtE,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,QAM7B;AACD,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AAEjD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBAAqB,aAAqB,OAAqE;AACnH,UAAM,QAAgC;AAAA,MACpC;AAAA,MACA,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AACA,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,eAAgB,OAAM,iBAAiB,MAAM;AAEvD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,WAAW,OAAO,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AACxF,UAAM,KAAK,eAAe,KAAK;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,IAAY;AAC3B,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,WAAW,EAAE,IAAI,WAAW,KAAK,CAAC;AACpE,QAAI,CAAC,IAAK,QAAO;AAEjB,QAAI,iBAAiB;AACrB,QAAI,YAAY;AAChB,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,UAA8C,CAAC,GAA+C;AACtH,UAAM,YAAY,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,QAAQ,aAAa,GAAG,GAAG,CAAC,GAAG,GAAI;AAClF,UAAM,SAAS,QAAQ,WAAW,MAAM;AAAA,IAAC;AACzC,UAAM,SAA4C;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAEA,QAAI,kBAA+B;AACnC,QAAI,WAA0B;AAE9B,WAAO,MAAM;AACX,YAAM,YAAa,KAAK,GAAG,UAAe,EACvC,WAAW,aAAa,EACxB,OAAO;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC,EACA,MAAM,0BAA0B,MAAM,IAAI;AAE7C,UAAI,QAAQ,SAAU,WAAU,MAAM,yBAAyB,KAAK,QAAQ,QAAQ;AACpF,UAAI,QAAQ,eAAgB,WAAU,MAAM,+BAA+B,KAAK,QAAQ,cAAc;AAEtG,UAAI,CAAC,QAAQ,OAAO;AAClB,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,2BAA2B,MAAM,IAAI;AAAA,YACxC,GAAG,0BAA0B,MAAM,IAAI;AAAA,YACvC,GAAG,8BAA8B,MAAM,IAAI;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,mBAAmB,UAAU;AAC/B,kBAAU;AAAA,UAAM,CAAC,OACf,GAAG,GAAG;AAAA,YACJ,GAAG,0BAA0B,KAAK,eAAe;AAAA,YACjD,GAAG,IAAI;AAAA,cACL,GAAG,0BAA0B,KAAK,eAAe;AAAA,cACjD,GAAG,kBAAkB,KAAK,QAAQ;AAAA,YACpC,CAAC;AAAA,UACH,CAAC;AAAA,QACH;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,UAChB,QAAQ,cAAc,KAAK,EAC3B,QAAQ,MAAM,KAAK,EACnB,MAAM,SAAS;AAElB,UAAI,KAAK,WAAW,EAAG;AAEvB,iBAAW,OAAO,MAAM;AACtB,eAAO,WAAW;AAElB,YAAI;AACF,gBAAM,YAAY,MAAM,KAAK,oBAAoB,GAAyC;AAC1F,gBAAM,aAAa,0BAA0B;AAAA,YAC3C,aAAa,WAAW,WAAW,eAAe,eAAe;AAAA,YACjE,aAAa,WAAW,WAAW,eAAe,cAAc;AAAA,YAChE,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,WAAW,WAAW,WAAW,aAAa,YAAY,KAAK;AAAA,YAC/D,SAAS,WAAW,WAAW,eAAe,cAAc;AAAA,YAC5D,gBAAgB,UAAU,WAAW,kBAAkB,iBAAiB;AAAA,UAC1E,CAAC;AAED,gBAAM,cAAc,QAAQ,UAAU,QACjC,IAAI,gBAAgB,WAAW,cAC/B,IAAI,eAAe,WAAW,aAC9B,IAAI,0BAA0B,WAAW,uBACzC,CAAC,kBAAkB,IAAI,gBAAgB,WAAW,aAAa;AAEpE,cAAI,CAAC,aAAa;AAChB,mBAAO,WAAW;AAClB;AAAA,UACF;AAEA,gBAAO,KAAK,GAAG,UAAe,EAC3B,YAAY,aAAa,EACzB,IAAI;AAAA,YACH,aAAa,WAAW;AAAA,YACxB,gBAAgB,WAAW;AAAA,YAC3B,uBAAuB,WAAW;AAAA,YAClC,YAAY,WAAW;AAAA,UACzB,CAAC,EACA,MAAM,MAAM,KAAK,IAAI,EAAE,EACvB,QAAQ;AAEX,iBAAO,WAAW;AAAA,QACpB,SAAS,KAAK;AACZ,iBAAO,UAAU;AACjB,iBAAO,oCAAoC,IAAI,EAAE,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,QAC1G;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,wBAAkB,QAAQ;AAC1B,iBAAW,QAAQ;AAEnB;AAAA,QACE,wBAAwB,OAAO,OAAO,0BAA0B,OAAO,OAAO,cAAc,OAAO,OAAO,aAAa,OAAO,MAAM;AAAA,MACtI;AAEA,UAAI,KAAK,SAAS,UAAW;AAAA,IAC/B;AAEA,WAAO;AAAA,EACT;AACF;",
   "names": ["decrypted"]
 }

package/dist/modules/auth/api/roles/acl/route.js CHANGED Viewed

@@ -137,7 +137,7 @@ async function PUT(req) {
   if (parsed.data.organizations !== void 0) acl.organizationsJson = parsed.data.organizations;
   acl.isSuperAdmin = effectiveIsSuperAdmin;
   acl.featuresJson = effectiveFeatures;
-  await em.persistAndFlush(acl);
+  await em.persist(acl).flush();
   if (targetTenantId) {
     await rbacService.invalidateTenantCache(targetTenantId);
     try {

package/dist/modules/auth/api/roles/acl/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/auth/api/roles/acl/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { RoleAcl, Role } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\ntype TaggableCache = { deleteByTags?: (tags: string[]) => Promise<void> | void }\n\nconst getSchema = z.object({\n  roleId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n})\nconst putSchema = z.object({\n  roleId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst roleAclResponseSchema = z.object({\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n})\n\nconst roleAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst roleAclErrorSchema = z.object({ error: z.string() })\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({\n    roleId: url.searchParams.get('roleId'),\n    tenantId: url.searchParams.get('tenantId') || undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const em = container.resolve('em') as EntityManager\n  const authTenantId = auth.tenantId ?? null\n  const roleFilter: Record<string, unknown> = { id: parsed.data.roleId }\n  if (!isSuperAdmin && authTenantId) {\n    roleFilter.$or = [{ tenantId: authTenantId }, { tenantId: null }]\n  }\n  const role = await em.findOne(Role, roleFilter)\n  if (!role) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  const roleTenantId = role?.tenantId ? String(role.tenantId) : null\n\n  let tenantScope = parsed.data.tenantId ?? roleTenantId ?? authTenantId ?? null\n  if (parsed.data.tenantId && parsed.data.tenantId !== tenantScope) {\n    if (isSuperAdmin || parsed.data.tenantId === authTenantId) tenantScope = parsed.data.tenantId\n    else return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (!tenantScope && !isSuperAdmin) tenantScope = authTenantId ?? null\n\n  const acl = tenantScope\n    ? await em.findOne(RoleAcl, { role, tenantId: tenantScope })\n    : null\n  const response = acl\n    ? {\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n      }\n    : { isSuperAdmin: false, features: [], organizations: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.roleId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.role_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId: tenantScope,\n    query: { roleId: parsed.data.roleId, tenantId: tenantScope },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const rbacService = container.resolve('rbacService') as RbacService\n  const authTenantId = auth.tenantId ?? null\n  const putRoleFilter: Record<string, unknown> = { id: parsed.data.roleId }\n  if (!isSuperAdmin && authTenantId) {\n    putRoleFilter.$or = [{ tenantId: authTenantId }, { tenantId: null }]\n  }\n  const role = await em.findOne(Role, putRoleFilter)\n  if (!role) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n\n  const roleTenantId = role?.tenantId ? String(role.tenantId) : null\n\n  let targetTenantId = parsed.data.tenantId ?? roleTenantId ?? authTenantId ?? null\n  if (parsed.data.tenantId && parsed.data.tenantId !== targetTenantId) {\n    if (isSuperAdmin || parsed.data.tenantId === authTenantId) {\n      targetTenantId = parsed.data.tenantId\n    } else {\n      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n    }\n  }\n  if (!targetTenantId && !isSuperAdmin) targetTenantId = authTenantId ?? null\n  if (!targetTenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })\n\n  if (!isSuperAdmin && targetTenantId !== authTenantId) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  const requestedFeatures = normalizeFeatureList(parsed.data.features)\n  let acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })\n  if (!acl) {\n    acl = em.create(RoleAcl, {\n      role,\n      tenantId: targetTenantId,\n      createdAt: new Date(),\n      isSuperAdmin: false,\n    })\n  }\n\n  const existingIsSuperAdmin = !!acl.isSuperAdmin\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin\n  let effectiveIsSuperAdmin = requestedIsSuperAdmin\n\n  if (!actorIsSuperAdmin) {\n    if (requestedIsSuperAdmin && !existingIsSuperAdmin) {\n      throw forbidden('Only super administrators can mark a role as super admin.')\n    }\n    if (existingIsSuperAdmin && requestedIsSuperAdmin === false) {\n      effectiveIsSuperAdmin = false\n    } else {\n      effectiveIsSuperAdmin = existingIsSuperAdmin\n    }\n  }\n\n  const effectiveFeatures = actorIsSuperAdmin\n    ? requestedFeatures\n    : sanitizeTenantFeatures(requestedFeatures)\n\n  if (parsed.data.organizations !== undefined) acl.organizationsJson = parsed.data.organizations\n  acl.isSuperAdmin = effectiveIsSuperAdmin\n  acl.featuresJson = effectiveFeatures\n  await em.persistAndFlush(acl)\n  \n  // Invalidate cache for all users in this tenant since role ACL changed\n  if (targetTenantId) {\n    await rbacService.invalidateTenantCache(targetTenantId)\n    // Sidebar nav caches depend on RBAC; invalidate tenant scope nav caches\n    try {\n      const cache = container.resolve('cache') as TaggableCache | undefined\n      if (cache?.deleteByTags) await cache.deleteByTags([`rbac:tenant:${targetTenantId}`])\n    } catch {}\n  }\n  \n  return NextResponse.json({\n    ok: true,\n    sanitized: !actorIsSuperAdmin && (effectiveFeatures.length !== requestedFeatures.length || effectiveIsSuperAdmin !== requestedIsSuperAdmin),\n  })\n}\n\nfunction normalizeFeatureList(features: unknown): string[] {\n  if (!Array.isArray(features)) return []\n  const dedup = new Set<string>()\n  for (const value of features) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction sanitizeTenantFeatures(features: string[]): string[] {\n  return features.filter((feature) => !isTenantRestrictedFeature(feature))\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Role ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch role ACL',\n      description: 'Returns the feature and organization assignments associated with a role within the current tenant.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'Role ACL entry', schema: roleAclResponseSchema },\n        { status: 400, description: 'Invalid role id', schema: roleAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: roleAclErrorSchema },\n        { status: 404, description: 'Role not found', schema: roleAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update role ACL',\n      description: 'Replaces the feature list, super admin flag, and optional organization assignments for a role.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'Role ACL updated', schema: roleAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: roleAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: roleAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: roleAclErrorSchema },\n        { status: 404, description: 'Role not found', schema: roleAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,iBAAiB;AAC1B,SAAS,SAAS,YAAY;AAE9B,SAAS,2BAA2B;AAKpC,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AACD,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,QAAQ;AAAA,EACxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAC9C,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEzD,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,UAAU,UAAU;AAAA,IACjC,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAAA,IACrC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,KAAK,YAAY;AACtC,QAAM,aAAsC,EAAE,IAAI,OAAO,KAAK,OAAO;AACrE,MAAI,CAAC,gBAAgB,cAAc;AACjC,eAAW,MAAM,CAAC,EAAE,UAAU,aAAa,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,EAClE;AACA,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,UAAU;AAC9C,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC3E,QAAM,eAAe,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAE9D,MAAI,cAAc,OAAO,KAAK,YAAY,gBAAgB,gBAAgB;AAC1E,MAAI,OAAO,KAAK,YAAY,OAAO,KAAK,aAAa,aAAa;AAChE,QAAI,gBAAgB,OAAO,KAAK,aAAa,aAAc,eAAc,OAAO,KAAK;AAAA,QAChF,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACA,MAAI,CAAC,eAAe,CAAC,aAAc,eAAc,gBAAgB;AAEjE,QAAM,MAAM,cACR,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,UAAU,YAAY,CAAC,IACzD;AACJ,QAAM,WAAW,MACb;AAAA,IACE,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAAA,IAChE,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AAAA,EAChF,IACA,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AAE7D,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC/C,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB,KAAK,SAAS;AAAA,IAC9B,UAAU;AAAA,IACV,OAAO,EAAE,QAAQ,OAAO,KAAK,QAAQ,UAAU,YAAY;AAAA,IAC3D,YAAY;AAAA,EACd,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,UAAU,UAAU,IAAI;AACvC,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,eAAe,KAAK,YAAY;AACtC,QAAM,gBAAyC,EAAE,IAAI,OAAO,KAAK,OAAO;AACxE,MAAI,CAAC,gBAAgB,cAAc;AACjC,kBAAc,MAAM,CAAC,EAAE,UAAU,aAAa,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,EACrE;AACA,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,aAAa;AACjD,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3E,QAAM,eAAe,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAE9D,MAAI,iBAAiB,OAAO,KAAK,YAAY,gBAAgB,gBAAgB;AAC7E,MAAI,OAAO,KAAK,YAAY,OAAO,KAAK,aAAa,gBAAgB;AACnE,QAAI,gBAAgB,OAAO,KAAK,aAAa,cAAc;AACzD,uBAAiB,OAAO,KAAK;AAAA,IAC/B,OAAO;AACL,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,MAAI,CAAC,kBAAkB,CAAC,aAAc,kBAAiB,gBAAgB;AACvE,MAAI,CAAC,eAAgB,QAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3F,MAAI,CAAC,gBAAgB,mBAAmB,cAAc;AACpD,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC,IAC3G;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAEtC,QAAM,oBAAoB,qBAAqB,OAAO,KAAK,QAAQ;AACnE,MAAI,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,UAAU,eAAe,CAAC;AACtE,MAAI,CAAC,KAAK;AACR,UAAM,GAAG,OAAO,SAAS;AAAA,MACvB;AAAA,MACA,UAAU;AAAA,MACV,WAAW,oBAAI,KAAK;AAAA,MACpB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,uBAAuB,CAAC,CAAC,IAAI;AACnC,QAAM,wBAAwB,OAAO,KAAK,gBAAgB;AAC1D,MAAI,wBAAwB;AAE5B,MAAI,CAAC,mBAAmB;AACtB,QAAI,yBAAyB,CAAC,sBAAsB;AAClD,YAAM,UAAU,2DAA2D;AAAA,IAC7E;AACA,QAAI,wBAAwB,0BAA0B,OAAO;AAC3D,8BAAwB;AAAA,IAC1B,OAAO;AACL,8BAAwB;AAAA,IAC1B;AAAA,EACF;AAEA,QAAM,oBAAoB,oBACtB,oBACA,uBAAuB,iBAAiB;AAE5C,MAAI,OAAO,KAAK,kBAAkB,OAAW,KAAI,oBAAoB,OAAO,KAAK;AACjF,MAAI,eAAe;AACnB,MAAI,eAAe;AACnB,QAAM,GAAG,gBAAgB,GAAG;AAG5B,MAAI,gBAAgB;AAClB,UAAM,YAAY,sBAAsB,cAAc;AAEtD,QAAI;AACF,YAAM,QAAQ,UAAU,QAAQ,OAAO;AACvC,UAAI,OAAO,aAAc,OAAM,MAAM,aAAa,CAAC,eAAe,cAAc,EAAE,CAAC;AAAA,IACrF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,WAAW,CAAC,sBAAsB,kBAAkB,WAAW,kBAAkB,UAAU,0BAA0B;AAAA,EACvH,CAAC;AACH;AAEA,SAAS,qBAAqB,UAA6B;AACzD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,UAAU;AAC5B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,uBAAuB,UAA8B;AAC5D,SAAO,SAAS,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AACzE;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,mBAAmB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { RoleAcl, Role } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\ntype TaggableCache = { deleteByTags?: (tags: string[]) => Promise<void> | void }\n\nconst getSchema = z.object({\n  roleId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n})\nconst putSchema = z.object({\n  roleId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst roleAclResponseSchema = z.object({\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n})\n\nconst roleAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst roleAclErrorSchema = z.object({ error: z.string() })\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({\n    roleId: url.searchParams.get('roleId'),\n    tenantId: url.searchParams.get('tenantId') || undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const em = container.resolve('em') as EntityManager\n  const authTenantId = auth.tenantId ?? null\n  const roleFilter: Record<string, unknown> = { id: parsed.data.roleId }\n  if (!isSuperAdmin && authTenantId) {\n    roleFilter.$or = [{ tenantId: authTenantId }, { tenantId: null }]\n  }\n  const role = await em.findOne(Role, roleFilter)\n  if (!role) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  const roleTenantId = role?.tenantId ? String(role.tenantId) : null\n\n  let tenantScope = parsed.data.tenantId ?? roleTenantId ?? authTenantId ?? null\n  if (parsed.data.tenantId && parsed.data.tenantId !== tenantScope) {\n    if (isSuperAdmin || parsed.data.tenantId === authTenantId) tenantScope = parsed.data.tenantId\n    else return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (!tenantScope && !isSuperAdmin) tenantScope = authTenantId ?? null\n\n  const acl = tenantScope\n    ? await em.findOne(RoleAcl, { role, tenantId: tenantScope })\n    : null\n  const response = acl\n    ? {\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n      }\n    : { isSuperAdmin: false, features: [], organizations: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.roleId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.role_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId: tenantScope,\n    query: { roleId: parsed.data.roleId, tenantId: tenantScope },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const rbacService = container.resolve('rbacService') as RbacService\n  const authTenantId = auth.tenantId ?? null\n  const putRoleFilter: Record<string, unknown> = { id: parsed.data.roleId }\n  if (!isSuperAdmin && authTenantId) {\n    putRoleFilter.$or = [{ tenantId: authTenantId }, { tenantId: null }]\n  }\n  const role = await em.findOne(Role, putRoleFilter)\n  if (!role) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n\n  const roleTenantId = role?.tenantId ? String(role.tenantId) : null\n\n  let targetTenantId = parsed.data.tenantId ?? roleTenantId ?? authTenantId ?? null\n  if (parsed.data.tenantId && parsed.data.tenantId !== targetTenantId) {\n    if (isSuperAdmin || parsed.data.tenantId === authTenantId) {\n      targetTenantId = parsed.data.tenantId\n    } else {\n      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n    }\n  }\n  if (!targetTenantId && !isSuperAdmin) targetTenantId = authTenantId ?? null\n  if (!targetTenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })\n\n  if (!isSuperAdmin && targetTenantId !== authTenantId) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  const requestedFeatures = normalizeFeatureList(parsed.data.features)\n  let acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })\n  if (!acl) {\n    acl = em.create(RoleAcl, {\n      role,\n      tenantId: targetTenantId,\n      createdAt: new Date(),\n      isSuperAdmin: false,\n    })\n  }\n\n  const existingIsSuperAdmin = !!acl.isSuperAdmin\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin\n  let effectiveIsSuperAdmin = requestedIsSuperAdmin\n\n  if (!actorIsSuperAdmin) {\n    if (requestedIsSuperAdmin && !existingIsSuperAdmin) {\n      throw forbidden('Only super administrators can mark a role as super admin.')\n    }\n    if (existingIsSuperAdmin && requestedIsSuperAdmin === false) {\n      effectiveIsSuperAdmin = false\n    } else {\n      effectiveIsSuperAdmin = existingIsSuperAdmin\n    }\n  }\n\n  const effectiveFeatures = actorIsSuperAdmin\n    ? requestedFeatures\n    : sanitizeTenantFeatures(requestedFeatures)\n\n  if (parsed.data.organizations !== undefined) acl.organizationsJson = parsed.data.organizations\n  acl.isSuperAdmin = effectiveIsSuperAdmin\n  acl.featuresJson = effectiveFeatures\n  await em.persist(acl).flush()\n  \n  // Invalidate cache for all users in this tenant since role ACL changed\n  if (targetTenantId) {\n    await rbacService.invalidateTenantCache(targetTenantId)\n    // Sidebar nav caches depend on RBAC; invalidate tenant scope nav caches\n    try {\n      const cache = container.resolve('cache') as TaggableCache | undefined\n      if (cache?.deleteByTags) await cache.deleteByTags([`rbac:tenant:${targetTenantId}`])\n    } catch {}\n  }\n  \n  return NextResponse.json({\n    ok: true,\n    sanitized: !actorIsSuperAdmin && (effectiveFeatures.length !== requestedFeatures.length || effectiveIsSuperAdmin !== requestedIsSuperAdmin),\n  })\n}\n\nfunction normalizeFeatureList(features: unknown): string[] {\n  if (!Array.isArray(features)) return []\n  const dedup = new Set<string>()\n  for (const value of features) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction sanitizeTenantFeatures(features: string[]): string[] {\n  return features.filter((feature) => !isTenantRestrictedFeature(feature))\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Role ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch role ACL',\n      description: 'Returns the feature and organization assignments associated with a role within the current tenant.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'Role ACL entry', schema: roleAclResponseSchema },\n        { status: 400, description: 'Invalid role id', schema: roleAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: roleAclErrorSchema },\n        { status: 404, description: 'Role not found', schema: roleAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update role ACL',\n      description: 'Replaces the feature list, super admin flag, and optional organization assignments for a role.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'Role ACL updated', schema: roleAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: roleAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: roleAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: roleAclErrorSchema },\n        { status: 404, description: 'Role not found', schema: roleAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,iBAAiB;AAC1B,SAAS,SAAS,YAAY;AAE9B,SAAS,2BAA2B;AAKpC,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AACD,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,QAAQ;AAAA,EACxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAC9C,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEzD,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,UAAU,UAAU;AAAA,IACjC,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAAA,IACrC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,KAAK,YAAY;AACtC,QAAM,aAAsC,EAAE,IAAI,OAAO,KAAK,OAAO;AACrE,MAAI,CAAC,gBAAgB,cAAc;AACjC,eAAW,MAAM,CAAC,EAAE,UAAU,aAAa,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,EAClE;AACA,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,UAAU;AAC9C,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC3E,QAAM,eAAe,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAE9D,MAAI,cAAc,OAAO,KAAK,YAAY,gBAAgB,gBAAgB;AAC1E,MAAI,OAAO,KAAK,YAAY,OAAO,KAAK,aAAa,aAAa;AAChE,QAAI,gBAAgB,OAAO,KAAK,aAAa,aAAc,eAAc,OAAO,KAAK;AAAA,QAChF,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACA,MAAI,CAAC,eAAe,CAAC,aAAc,eAAc,gBAAgB;AAEjE,QAAM,MAAM,cACR,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,UAAU,YAAY,CAAC,IACzD;AACJ,QAAM,WAAW,MACb;AAAA,IACE,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAAA,IAChE,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AAAA,EAChF,IACA,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AAE7D,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC/C,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB,KAAK,SAAS;AAAA,IAC9B,UAAU;AAAA,IACV,OAAO,EAAE,QAAQ,OAAO,KAAK,QAAQ,UAAU,YAAY;AAAA,IAC3D,YAAY;AAAA,EACd,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,UAAU,UAAU,IAAI;AACvC,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,eAAe,KAAK,YAAY;AACtC,QAAM,gBAAyC,EAAE,IAAI,OAAO,KAAK,OAAO;AACxE,MAAI,CAAC,gBAAgB,cAAc;AACjC,kBAAc,MAAM,CAAC,EAAE,UAAU,aAAa,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,EACrE;AACA,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,aAAa;AACjD,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3E,QAAM,eAAe,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAE9D,MAAI,iBAAiB,OAAO,KAAK,YAAY,gBAAgB,gBAAgB;AAC7E,MAAI,OAAO,KAAK,YAAY,OAAO,KAAK,aAAa,gBAAgB;AACnE,QAAI,gBAAgB,OAAO,KAAK,aAAa,cAAc;AACzD,uBAAiB,OAAO,KAAK;AAAA,IAC/B,OAAO;AACL,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,MAAI,CAAC,kBAAkB,CAAC,aAAc,kBAAiB,gBAAgB;AACvE,MAAI,CAAC,eAAgB,QAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3F,MAAI,CAAC,gBAAgB,mBAAmB,cAAc;AACpD,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC,IAC3G;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAEtC,QAAM,oBAAoB,qBAAqB,OAAO,KAAK,QAAQ;AACnE,MAAI,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,UAAU,eAAe,CAAC;AACtE,MAAI,CAAC,KAAK;AACR,UAAM,GAAG,OAAO,SAAS;AAAA,MACvB;AAAA,MACA,UAAU;AAAA,MACV,WAAW,oBAAI,KAAK;AAAA,MACpB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,uBAAuB,CAAC,CAAC,IAAI;AACnC,QAAM,wBAAwB,OAAO,KAAK,gBAAgB;AAC1D,MAAI,wBAAwB;AAE5B,MAAI,CAAC,mBAAmB;AACtB,QAAI,yBAAyB,CAAC,sBAAsB;AAClD,YAAM,UAAU,2DAA2D;AAAA,IAC7E;AACA,QAAI,wBAAwB,0BAA0B,OAAO;AAC3D,8BAAwB;AAAA,IAC1B,OAAO;AACL,8BAAwB;AAAA,IAC1B;AAAA,EACF;AAEA,QAAM,oBAAoB,oBACtB,oBACA,uBAAuB,iBAAiB;AAE5C,MAAI,OAAO,KAAK,kBAAkB,OAAW,KAAI,oBAAoB,OAAO,KAAK;AACjF,MAAI,eAAe;AACnB,MAAI,eAAe;AACnB,QAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAG5B,MAAI,gBAAgB;AAClB,UAAM,YAAY,sBAAsB,cAAc;AAEtD,QAAI;AACF,YAAM,QAAQ,UAAU,QAAQ,OAAO;AACvC,UAAI,OAAO,aAAc,OAAM,MAAM,aAAa,CAAC,eAAe,cAAc,EAAE,CAAC;AAAA,IACrF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,WAAW,CAAC,sBAAsB,kBAAkB,WAAW,kBAAkB,UAAU,0BAA0B;AAAA,EACvH,CAAC;AACH;AAEA,SAAS,qBAAqB,UAA6B;AACzD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,UAAU;AAC5B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,uBAAuB,UAA8B;AAC5D,SAAO,SAAS,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AACzE;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,mBAAmB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/api/users/acl/route.js CHANGED Viewed

@@ -87,7 +87,7 @@ async function PUT(req) {
   }
   const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0;
   if (!hasCustomAcl) {
-    if (acl) await em.removeAndFlush(acl);
+    if (acl) await em.remove(acl).flush();
   } else {
     if (!acl) {
       acl = em.create(UserAcl, { user: parsed.data.userId, tenantId: auth.tenantId });
@@ -96,7 +96,7 @@ async function PUT(req) {
     aclRecord.isSuperAdmin = effectiveIsSuperAdmin;
     aclRecord.featuresJson = effectiveFeatures;
     aclRecord.organizationsJson = organizations;
-    await em.persistAndFlush(acl);
+    await em.persist(acl).flush();
   }
   await rbacService.invalidateUserCache(parsed.data.userId);
   try {