@open-mercato/core 0.6.2-develop.3461.1.605f31c2c9 → 0.6.2

package/dist/modules/auth/frontend/login.js

@@ -12,6 +12,7 @@ import { Button } from "@open-mercato/ui/primitives/button";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { translateWithFallback } from "@open-mercato/shared/lib/i18n/translate";
 import { clearAllOperations } from "@open-mercato/ui/backend/operations/store";
+import { notifyAuthIdentityChange } from "@open-mercato/ui/backend/AuthSessionGuard";
 import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
 import { X } from "lucide-react";
 import { Alert, AlertDescription } from "@open-mercato/ui/primitives/alert";
@@ -105,6 +106,38 @@ function LoginPage() {
   useEffect(() => {
     setClientReady(true);
   }, []);
+  useEffect(() => {
+    let cancelled = false;
+    void (async () => {
+      try {
+        const res = await apiCall("/api/auth/feature-check", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ features: [] }),
+          cache: "no-store"
+        });
+        if (cancelled) return;
+        const activeUserId = typeof res.result?.userId === "string" ? res.result.userId : "";
+        if (!activeUserId) return;
+        const rawRedirect = searchParams.get("redirect") || "";
+        let destination = "/backend";
+        if (rawRedirect) {
+          try {
+            const resolved = new URL(rawRedirect, window.location.origin);
+            if (resolved.origin === window.location.origin && resolved.pathname.startsWith("/") && !resolved.pathname.includes("//")) {
+              destination = resolved.pathname + resolved.search + resolved.hash;
+            }
+          } catch {
+          }
+        }
+        router.replace(destination);
+      } catch {
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [router, searchParams]);
   useEffect(() => {
     const tenantParam = (searchParams.get("tenant") || "").trim();
     if (tenantParam) {
@@ -186,6 +219,7 @@ function LoginPage() {
       const res = await fetch("/api/auth/login", { method: "POST", body: form });
       if (res.redirected) {
         clearAllOperations();
+        notifyAuthIdentityChange();
         router.replace(res.url);
         return;
       }
@@ -237,6 +271,7 @@ function LoginPage() {
       const data = await res.json().catch(() => null);
       emitLoginResponseEvent(data);
       clearAllOperations();
+      notifyAuthIdentityChange();
       if (data && typeof data.redirect === "string" && data.redirect.length > 0) {
         router.replace(data.redirect);
       }

package/dist/modules/auth/frontend/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/frontend/login.tsx"],
-  "sourcesContent": ["\"use client\"\nimport { useCallback, useEffect, useMemo, useState } from 'react'\nimport type { ReactNode } from 'react'\nimport Image from 'next/image'\nimport Link from 'next/link'\nimport { useRouter, useSearchParams } from 'next/navigation'\nimport { Card, CardContent, CardHeader, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'\nimport { clearAllOperations } from '@open-mercato/ui/backend/operations/store'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { X } from 'lucide-react'\nimport { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'\nimport { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'\nimport { useRegisteredComponent } from '@open-mercato/ui/backend/injection/useRegisteredComponent'\nimport type { AuthOverride, LoginFormWidgetContext } from './login-injection'\n\nconst loginTenantKey = 'om_login_tenant'\nconst loginTenantCookieMaxAge = 60 * 60 * 24 * 14\n\nfunction readTenantCookie() {\n  if (typeof document === 'undefined') return null\n  const entries = document.cookie.split(';')\n  for (const entry of entries) {\n    const [name, ...rest] = entry.trim().split('=')\n    if (name === loginTenantKey) return decodeURIComponent(rest.join('='))\n  }\n  return null\n}\n\nfunction setTenantCookie(value: string) {\n  if (typeof document === 'undefined') return\n  document.cookie = `${loginTenantKey}=${encodeURIComponent(value)}; path=/; max-age=${loginTenantCookieMaxAge}; samesite=lax`\n}\n\nfunction clearTenantCookie() {\n  if (typeof document === 'undefined') return\n  document.cookie = `${loginTenantKey}=; path=/; max-age=0; samesite=lax`\n}\n\nfunction extractErrorMessage(payload: unknown): string | null {\n  if (!payload) return null\n  if (typeof payload === 'string') return payload\n  if (Array.isArray(payload)) {\n    for (const entry of payload) {\n      const resolved = extractErrorMessage(entry)\n      if (resolved) return resolved\n    }\n    return null\n  }\n  if (typeof payload === 'object') {\n    const record = payload as Record<string, unknown>\n    const candidates: unknown[] = [\n      record.error,\n      record.message,\n      record.detail,\n      record.details,\n      record.description,\n    ]\n    for (const candidate of candidates) {\n      const resolved = extractErrorMessage(candidate)\n      if (resolved) return resolved\n    }\n  }\n  return null\n}\n\nfunction looksLikeJsonString(value: string): boolean {\n  const trimmed = value.trim()\n  return trimmed.startsWith('{') || trimmed.startsWith('[')\n}\n\ntype LoginResponseEventDetail = Record<string, unknown> | null\n\ntype LoginFormSectionProps = {\n  children: ReactNode\n}\n\nfunction LoginFormSectionDefault({ children }: LoginFormSectionProps) {\n  return <>{children}</>\n}\n\nfunction emitLoginResponseEvent(detail: LoginResponseEventDetail) {\n  if (typeof window === 'undefined') return\n  window.dispatchEvent(new CustomEvent('om:auth:login-response', { detail }))\n}\n\nexport default function LoginPage() {\n  const t = useT()\n  const translate = useCallback(\n    (key: string, fallback: string, params?: Record<string, string | number>) =>\n      translateWithFallback(t, key, fallback, params),\n    [t],\n  )\n  const router = useRouter()\n  const searchParams = useSearchParams()\n  const requireRole = (searchParams.get('requireRole') || searchParams.get('role') || '').trim()\n  const requireFeature = (searchParams.get('requireFeature') || '').trim()\n  const requiredRoles = requireRole ? requireRole.split(',').map((value) => value.trim()).filter(Boolean) : []\n  const requiredFeatures = requireFeature ? requireFeature.split(',').map((value) => value.trim()).filter(Boolean) : []\n  const translatedRoles = requiredRoles.map((role) => translate(`auth.roles.${role}`, role))\n  const translatedFeatures = requiredFeatures.map((feature) => translate(`features.${feature}`, feature))\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n  const [authOverride, setAuthOverride] = useState<AuthOverride | null>(null)\n  const [authOverridePending, setAuthOverridePending] = useState(false)\n  const [clientReady, setClientReady] = useState(false)\n  const [email, setEmail] = useState('')\n  const [tenantId, setTenantId] = useState<string | null>(null)\n  const [tenantName, setTenantName] = useState<string | null>(null)\n  const [tenantLoading, setTenantLoading] = useState(false)\n  const [tenantInvalid, setTenantInvalid] = useState<string | null>(null)\n  const showTenantInvalid = tenantId != null && tenantInvalid === tenantId\n  const LoginFormSection = useRegisteredComponent<LoginFormSectionProps>(\n    'section:auth.login.form',\n    LoginFormSectionDefault,\n  )\n\n  useEffect(() => {\n    setClientReady(true)\n  }, [])\n\n  useEffect(() => {\n    const tenantParam = (searchParams.get('tenant') || '').trim()\n    if (tenantParam) {\n      setTenantId(tenantParam)\n      window.localStorage.setItem(loginTenantKey, tenantParam)\n      setTenantCookie(tenantParam)\n      return\n    }\n    const storedTenant = window.localStorage.getItem(loginTenantKey) || readTenantCookie()\n    if (storedTenant) {\n      setTenantId(storedTenant)\n    }\n  }, [searchParams])\n\n  useEffect(() => {\n    if (!tenantId) {\n      setTenantName(null)\n      setTenantInvalid(null)\n      return\n    }\n    if (tenantInvalid === tenantId) {\n      setTenantName(null)\n      setTenantLoading(false)\n      return\n    }\n    let active = true\n    setTenantLoading(true)\n    setTenantInvalid(null)\n    apiCall<{ ok: boolean; tenant?: { id: string; name: string }; error?: string }>(\n      `/api/directory/tenants/lookup?tenantId=${encodeURIComponent(tenantId)}`,\n    )\n      .then(({ result }) => {\n        if (!active) return\n        if (result?.ok && result.tenant) {\n          setTenantName(result.tenant.name)\n          return\n        }\n        setTenantName(null)\n        setTenantInvalid(tenantId)\n        setError(null)\n      })\n      .catch(() => {\n        if (!active) return\n        setTenantName(null)\n        setTenantInvalid(tenantId)\n        setError(null)\n      })\n      .finally(() => {\n        if (active) setTenantLoading(false)\n      })\n    return () => {\n      active = false\n    }\n  }, [tenantId, translate])\n\n  function handleClearTenant() {\n    window.localStorage.removeItem(loginTenantKey)\n    clearTenantCookie()\n    setTenantId(null)\n    setTenantName(null)\n    setTenantInvalid(null)\n    const params = new URLSearchParams(searchParams)\n    params.delete('tenant')\n    setError(null)\n    const query = params.toString()\n    router.replace(query ? `/login?${query}` : '/login')\n  }\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    if (!clientReady || authOverridePending) {\n      return\n    }\n    setError(null)\n    if (authOverride) {\n      authOverride.onSubmit()\n      return\n    }\n    setSubmitting(true)\n    try {\n      const form = new FormData(e.currentTarget)\n      if (requiredRoles.length) form.set('requireRole', requiredRoles.join(','))\n      const redirectParam = searchParams.get('redirect')\n      if (redirectParam) form.set('redirect', redirectParam)\n      const res = await fetch('/api/auth/login', { method: 'POST', body: form })\n      if (res.redirected) {\n        clearAllOperations()\n        // NextResponse.redirect from API\n        router.replace(res.url)\n        return\n      }\n      if (!res.ok) {\n        const fallback = (() => {\n          if (res.status === 403) {\n            return translate(\n              'auth.login.errors.permissionDenied',\n              'You do not have permission to access this area. Please contact your administrator.',\n            )\n          }\n          if (res.status === 401 || res.status === 400) {\n            return translate('auth.login.errors.invalidCredentials', 'Invalid email or password')\n          }\n          return translate('auth.login.errors.generic', 'An error occurred. Please try again.')\n        })()\n        const cloned = res.clone()\n        let errorMessage = ''\n        const contentType = res.headers.get('content-type') || ''\n        if (contentType.includes('application/json')) {\n          try {\n            const data = await res.json()\n            errorMessage = extractErrorMessage(data) || ''\n          } catch {\n            try {\n              const text = await cloned.text()\n              const trimmed = text.trim()\n              if (trimmed && !looksLikeJsonString(trimmed)) {\n                errorMessage = trimmed\n              }\n            } catch {\n              errorMessage = ''\n            }\n          }\n        } else {\n          try {\n            const text = await res.text()\n            const trimmed = text.trim()\n            if (trimmed && !looksLikeJsonString(trimmed)) {\n              errorMessage = trimmed\n            }\n          } catch {\n            errorMessage = ''\n          }\n        }\n        setError(errorMessage || fallback)\n        return\n      }\n      // In case API returns 200 with JSON\n      const data = await res.json().catch(() => null) as LoginResponseEventDetail\n      emitLoginResponseEvent(data)\n      clearAllOperations()\n      if (data && typeof data.redirect === 'string' && data.redirect.length > 0) {\n        router.replace(data.redirect)\n      }\n    } catch (err: unknown) {\n      // Handle any errors thrown (e.g., network errors or thrown exceptions)\n      const message = err instanceof Error ? err.message : ''\n      setError(message || translate('auth.login.errors.generic', 'An error occurred. Please try again.'))\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  const loginFormContext = useMemo<LoginFormWidgetContext>(() => ({\n    email,\n    tenantId,\n    searchParams,\n    setAuthOverride,\n    setAuthOverridePending,\n    setError,\n  }), [email, tenantId, searchParams])\n\n  const formReady = clientReady && !authOverridePending\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader className=\"flex flex-col items-center gap-4 text-center p-10\">\n          <Image alt={translate('auth.login.logoAlt', 'Open Mercato logo')} src=\"/open-mercato.svg\" width={150} height={150} priority />\n          <h1 className=\"text-2xl font-semibold\">{translate('auth.login.brandName', 'Open Mercato')}</h1>\n          <CardDescription>{translate('auth.login.subtitle', 'Access your workspace')}</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <LoginFormSection>\n            <form className=\"grid gap-3\" onSubmit={onSubmit} noValidate data-auth-ready={formReady ? '1' : '0'}>\n              {tenantId ? (\n                <input type=\"hidden\" name=\"tenantId\" value={tenantId} />\n              ) : null}\n              {!!translatedRoles.length && (\n                <Alert variant=\"info\" className=\"text-center\">\n                  <AlertDescription>\n                    {translate(\n                      translatedRoles.length > 1 ? 'auth.login.requireRolesMessage' : 'auth.login.requireRoleMessage',\n                      translatedRoles.length > 1\n                        ? 'Access requires one of the following roles: {roles}'\n                        : 'Access requires role: {roles}',\n                      { roles: translatedRoles.join(', ') },\n                    )}\n                  </AlertDescription>\n                </Alert>\n              )}\n              {!!translatedFeatures.length && (\n                <Alert variant=\"info\" className=\"text-center\">\n                  <AlertDescription>\n                    {translate('auth.login.featureDenied', \"You don't have access to this feature ({feature}). Please contact your administrator.\", {\n                      feature: translatedFeatures.join(', '),\n                    })}\n                  </AlertDescription>\n                </Alert>\n              )}\n              {showTenantInvalid ? (\n                <div className=\"rounded-md border border-red-200 bg-red-50 px-3 py-2 text-center text-xs text-red-700\">\n                  <div className=\"font-medium\">{translate('auth.login.errors.tenantInvalid', 'Tenant not found. Clear the tenant selection and try again.')}</div>\n                  <Button type=\"button\" variant=\"outline\" size=\"sm\" className=\"mt-2 border-red-300 text-red-700\" onClick={handleClearTenant}>\n                    <X className=\"mr-2 size-4\" aria-hidden=\"true\" />\n                    {translate('auth.login.tenantClear', 'Clear')}\n                  </Button>\n                </div>\n              ) : tenantId ? (\n                <div className=\"rounded-md border border-emerald-200 bg-emerald-50 px-3 py-2 text-center text-xs text-emerald-900\">\n                  <div className=\"font-medium\">\n                    {tenantLoading\n                      ? translate('auth.login.tenantLoading', 'Loading tenant details...')\n                      : translate('auth.login.tenantBanner', \"You're logging in to {tenant} tenant.\", {\n                          tenant: tenantName || tenantId,\n                        })}\n                  </div>\n                  <Button type=\"button\" variant=\"outline\" size=\"sm\" className=\"mt-2 border-emerald-300 text-emerald-900\" onClick={handleClearTenant}>\n                    <X className=\"mr-2 size-4\" aria-hidden=\"true\" />\n                    {translate('auth.login.tenantClear', 'Clear')}\n                  </Button>\n                </div>\n              ) : null}\n              {error && !showTenantInvalid && (\n                <div className=\"rounded-md border border-red-200 bg-red-50 px-3 py-2 text-center text-sm text-red-700\" role=\"alert\" aria-live=\"polite\">\n                  {error}\n                </div>\n              )}\n              <div className=\"grid gap-1\">\n                <Label htmlFor=\"email\">{t('auth.email')}</Label>\n                <EmailInput\n                  id=\"email\"\n                  name=\"email\"\n                  required\n                  aria-invalid={!!error}\n                  onChange={(e) => setEmail(e.target.value)}\n                  onBlur={(e) => setEmail(e.target.value)}\n                />\n              </div>\n              <InjectionSpot<LoginFormWidgetContext>\n                spotId=\"auth.login:form\"\n                context={loginFormContext}\n              />\n              {authOverride?.hidePassword ? null : (\n                <div className=\"grid gap-1\">\n                  <Label htmlFor=\"password\">{t('auth.password')}</Label>\n                  <PasswordInput id=\"password\" name=\"password\" required={!authOverride} aria-invalid={!!error} autoComplete=\"current-password\" />\n                </div>\n              )}\n              {!authOverride?.hideRememberMe && !authOverride?.hidePassword && (\n                <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n                  <input type=\"checkbox\" name=\"remember\" className=\"accent-foreground\" />\n                  <span>{translate('auth.login.rememberMe', 'Remember me')}</span>\n                </label>\n              )}\n              <Button type=\"submit\" disabled={submitting || !formReady} className=\"h-10 mt-2\">\n                {submitting\n                  ? translate('auth.login.loading', 'Loading...')\n                  : authOverride\n                    ? authOverride.providerLabel\n                    : translate('auth.signIn', 'Sign in')}\n              </Button>\n              {!authOverride?.hideForgotPassword && (\n                <div className=\"text-xs text-muted-foreground mt-2\">\n                  <Link className=\"underline\" href=\"/reset\">\n                    {translate('auth.login.forgotPassword', 'Forgot password?')}\n                  </Link>\n                </div>\n              )}\n            </form>\n          </LoginFormSection>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n"],
-  "mappings": ";AAoFS,wBAiND,YAjNC;AAnFT,SAAS,aAAa,WAAW,SAAS,gBAAgB;AAE1D,OAAO,WAAW;AAClB,OAAO,UAAU;AACjB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,MAAM,aAAa,YAAY,uBAAuB;AAE/D,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,aAAa;AACtB,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,SAAS;AAClB,SAAS,OAAO,wBAAwB;AACxC,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AAGvC,MAAM,iBAAiB;AACvB,MAAM,0BAA0B,KAAK,KAAK,KAAK;AAE/C,SAAS,mBAAmB;AAC1B,MAAI,OAAO,aAAa,YAAa,QAAO;AAC5C,QAAM,UAAU,SAAS,OAAO,MAAM,GAAG;AACzC,aAAW,SAAS,SAAS;AAC3B,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,KAAK,EAAE,MAAM,GAAG;AAC9C,QAAI,SAAS,eAAgB,QAAO,mBAAmB,KAAK,KAAK,GAAG,CAAC;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAe;AACtC,MAAI,OAAO,aAAa,YAAa;AACrC,WAAS,SAAS,GAAG,cAAc,IAAI,mBAAmB,KAAK,CAAC,qBAAqB,uBAAuB;AAC9G;AAEA,SAAS,oBAAoB;AAC3B,MAAI,OAAO,aAAa,YAAa;AACrC,WAAS,SAAS,GAAG,cAAc;AACrC;AAEA,SAAS,oBAAoB,SAAiC;AAC5D,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,eAAW,SAAS,SAAS;AAC3B,YAAM,WAAW,oBAAoB,KAAK;AAC1C,UAAI,SAAU,QAAO;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,UAAU;AAC/B,UAAM,SAAS;AACf,UAAM,aAAwB;AAAA,MAC5B,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,IACT;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,WAAW,oBAAoB,SAAS;AAC9C,UAAI,SAAU,QAAO;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;AACnD,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG;AAC1D;AAQA,SAAS,wBAAwB,EAAE,SAAS,GAA0B;AACpE,SAAO,gCAAG,UAAS;AACrB;AAEA,SAAS,uBAAuB,QAAkC;AAChE,MAAI,OAAO,WAAW,YAAa;AACnC,SAAO,cAAc,IAAI,YAAY,0BAA0B,EAAE,OAAO,CAAC,CAAC;AAC5E;AAEe,SAAR,YAA6B;AAClC,QAAM,IAAI,KAAK;AACf,QAAM,YAAY;AAAA,IAChB,CAAC,KAAa,UAAkB,WAC9B,sBAAsB,GAAG,KAAK,UAAU,MAAM;AAAA,IAChD,CAAC,CAAC;AAAA,EACJ;AACA,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,gBAAgB;AACrC,QAAM,eAAe,aAAa,IAAI,aAAa,KAAK,aAAa,IAAI,MAAM,KAAK,IAAI,KAAK;AAC7F,QAAM,kBAAkB,aAAa,IAAI,gBAAgB,KAAK,IAAI,KAAK;AACvE,QAAM,gBAAgB,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI,CAAC;AAC3G,QAAM,mBAAmB,iBAAiB,eAAe,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI,CAAC;AACpH,QAAM,kBAAkB,cAAc,IAAI,CAAC,SAAS,UAAU,cAAc,IAAI,IAAI,IAAI,CAAC;AACzF,QAAM,qBAAqB,iBAAiB,IAAI,CAAC,YAAY,UAAU,YAAY,OAAO,IAAI,OAAO,CAAC;AACtG,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,cAAc,eAAe,IAAI,SAA8B,IAAI;AAC1E,QAAM,CAAC,qBAAqB,sBAAsB,IAAI,SAAS,KAAK;AACpE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,SAAwB,IAAI;AAChE,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAS,KAAK;AACxD,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAwB,IAAI;AACtE,QAAM,oBAAoB,YAAY,QAAQ,kBAAkB;AAChE,QAAM,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AAEA,YAAU,MAAM;AACd,mBAAe,IAAI;AAAA,EACrB,GAAG,CAAC,CAAC;AAEL,YAAU,MAAM;AACd,UAAM,eAAe,aAAa,IAAI,QAAQ,KAAK,IAAI,KAAK;AAC5D,QAAI,aAAa;AACf,kBAAY,WAAW;AACvB,aAAO,aAAa,QAAQ,gBAAgB,WAAW;AACvD,sBAAgB,WAAW;AAC3B;AAAA,IACF;AACA,UAAM,eAAe,OAAO,aAAa,QAAQ,cAAc,KAAK,iBAAiB;AACrF,QAAI,cAAc;AAChB,kBAAY,YAAY;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,YAAU,MAAM;AACd,QAAI,CAAC,UAAU;AACb,oBAAc,IAAI;AAClB,uBAAiB,IAAI;AACrB;AAAA,IACF;AACA,QAAI,kBAAkB,UAAU;AAC9B,oBAAc,IAAI;AAClB,uBAAiB,KAAK;AACtB;AAAA,IACF;AACA,QAAI,SAAS;AACb,qBAAiB,IAAI;AACrB,qBAAiB,IAAI;AACrB;AAAA,MACE,0CAA0C,mBAAmB,QAAQ,CAAC;AAAA,IACxE,EACG,KAAK,CAAC,EAAE,OAAO,MAAM;AACpB,UAAI,CAAC,OAAQ;AACb,UAAI,QAAQ,MAAM,OAAO,QAAQ;AAC/B,sBAAc,OAAO,OAAO,IAAI;AAChC;AAAA,MACF;AACA,oBAAc,IAAI;AAClB,uBAAiB,QAAQ;AACzB,eAAS,IAAI;AAAA,IACf,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,OAAQ;AACb,oBAAc,IAAI;AAClB,uBAAiB,QAAQ;AACzB,eAAS,IAAI;AAAA,IACf,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,OAAQ,kBAAiB,KAAK;AAAA,IACpC,CAAC;AACH,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,UAAU,SAAS,CAAC;AAExB,WAAS,oBAAoB;AAC3B,WAAO,aAAa,WAAW,cAAc;AAC7C,sBAAkB;AAClB,gBAAY,IAAI;AAChB,kBAAc,IAAI;AAClB,qBAAiB,IAAI;AACrB,UAAM,SAAS,IAAI,gBAAgB,YAAY;AAC/C,WAAO,OAAO,QAAQ;AACtB,aAAS,IAAI;AACb,UAAM,QAAQ,OAAO,SAAS;AAC9B,WAAO,QAAQ,QAAQ,UAAU,KAAK,KAAK,QAAQ;AAAA,EACrD;AAEA,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,QAAI,CAAC,eAAe,qBAAqB;AACvC;AAAA,IACF;AACA,aAAS,IAAI;AACb,QAAI,cAAc;AAChB,mBAAa,SAAS;AACtB;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,UAAI,cAAc,OAAQ,MAAK,IAAI,eAAe,cAAc,KAAK,GAAG,CAAC;AACzE,YAAM,gBAAgB,aAAa,IAAI,UAAU;AACjD,UAAI,cAAe,MAAK,IAAI,YAAY,aAAa;AACrD,YAAM,MAAM,MAAM,MAAM,mBAAmB,EAAE,QAAQ,QAAQ,MAAM,KAAK,CAAC;AACzE,UAAI,IAAI,YAAY;AAClB,2BAAmB;AAEnB,eAAO,QAAQ,IAAI,GAAG;AACtB;AAAA,MACF;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,YAAY,MAAM;AACtB,cAAI,IAAI,WAAW,KAAK;AACtB,mBAAO;AAAA,cACL;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,mBAAO,UAAU,wCAAwC,2BAA2B;AAAA,UACtF;AACA,iBAAO,UAAU,6BAA6B,sCAAsC;AAAA,QACtF,GAAG;AACH,cAAM,SAAS,IAAI,MAAM;AACzB,YAAI,eAAe;AACnB,cAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,YAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,cAAI;AACF,kBAAMA,QAAO,MAAM,IAAI,KAAK;AAC5B,2BAAe,oBAAoBA,KAAI,KAAK;AAAA,UAC9C,QAAQ;AACN,gBAAI;AACF,oBAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,oBAAM,UAAU,KAAK,KAAK;AAC1B,kBAAI,WAAW,CAAC,oBAAoB,OAAO,GAAG;AAC5C,+BAAe;AAAA,cACjB;AAAA,YACF,QAAQ;AACN,6BAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF,OAAO;AACL,cAAI;AACF,kBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,kBAAM,UAAU,KAAK,KAAK;AAC1B,gBAAI,WAAW,CAAC,oBAAoB,OAAO,GAAG;AAC5C,6BAAe;AAAA,YACjB;AAAA,UACF,QAAQ;AACN,2BAAe;AAAA,UACjB;AAAA,QACF;AACA,iBAAS,gBAAgB,QAAQ;AACjC;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,6BAAuB,IAAI;AAC3B,yBAAmB;AACnB,UAAI,QAAQ,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,GAAG;AACzE,eAAO,QAAQ,KAAK,QAAQ;AAAA,MAC9B;AAAA,IACF,SAAS,KAAc;AAErB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAS,WAAW,UAAU,6BAA6B,sCAAsC,CAAC;AAAA,IACpG,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,mBAAmB,QAAgC,OAAO;AAAA,IAC9D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,CAAC,OAAO,UAAU,YAAY,CAAC;AAEnC,QAAM,YAAY,eAAe,CAAC;AAElC,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cAAW,WAAU,qDACpB;AAAA,0BAAC,SAAM,KAAK,UAAU,sBAAsB,mBAAmB,GAAG,KAAI,qBAAoB,OAAO,KAAK,QAAQ,KAAK,UAAQ,MAAC;AAAA,MAC5H,oBAAC,QAAG,WAAU,0BAA0B,oBAAU,wBAAwB,cAAc,GAAE;AAAA,MAC1F,oBAAC,mBAAiB,oBAAU,uBAAuB,uBAAuB,GAAE;AAAA,OAC9E;AAAA,IACA,oBAAC,eACC,8BAAC,oBACC,+BAAC,UAAK,WAAU,cAAa,UAAoB,YAAU,MAAC,mBAAiB,YAAY,MAAM,KAC5F;AAAA,iBACC,oBAAC,WAAM,MAAK,UAAS,MAAK,YAAW,OAAO,UAAU,IACpD;AAAA,MACH,CAAC,CAAC,gBAAgB,UACjB,oBAAC,SAAM,SAAQ,QAAO,WAAU,eAC9B,8BAAC,oBACE;AAAA,QACC,gBAAgB,SAAS,IAAI,mCAAmC;AAAA,QAChE,gBAAgB,SAAS,IACrB,wDACA;AAAA,QACJ,EAAE,OAAO,gBAAgB,KAAK,IAAI,EAAE;AAAA,MACtC,GACF,GACF;AAAA,MAED,CAAC,CAAC,mBAAmB,UACpB,oBAAC,SAAM,SAAQ,QAAO,WAAU,eAC9B,8BAAC,oBACE,oBAAU,4BAA4B,yFAAyF;AAAA,QAC9H,SAAS,mBAAmB,KAAK,IAAI;AAAA,MACvC,CAAC,GACH,GACF;AAAA,MAED,oBACC,qBAAC,SAAI,WAAU,yFACb;AAAA,4BAAC,SAAI,WAAU,eAAe,oBAAU,mCAAmC,6DAA6D,GAAE;AAAA,QAC1I,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,WAAU,oCAAmC,SAAS,mBACtG;AAAA,8BAAC,KAAE,WAAU,eAAc,eAAY,QAAO;AAAA,UAC7C,UAAU,0BAA0B,OAAO;AAAA,WAC9C;AAAA,SACF,IACE,WACF,qBAAC,SAAI,WAAU,qGACb;AAAA,4BAAC,SAAI,WAAU,eACZ,0BACG,UAAU,4BAA4B,2BAA2B,IACjE,UAAU,2BAA2B,yCAAyC;AAAA,UAC5E,QAAQ,cAAc;AAAA,QACxB,CAAC,GACP;AAAA,QACA,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,WAAU,4CAA2C,SAAS,mBAC9G;AAAA,8BAAC,KAAE,WAAU,eAAc,eAAY,QAAO;AAAA,UAC7C,UAAU,0BAA0B,OAAO;AAAA,WAC9C;AAAA,SACF,IACE;AAAA,MACH,SAAS,CAAC,qBACT,oBAAC,SAAI,WAAU,yFAAwF,MAAK,SAAQ,aAAU,UAC3H,iBACH;AAAA,MAEF,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,SAAS,YAAE,YAAY,GAAE;AAAA,QACxC;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,gBAAc,CAAC,CAAC;AAAA,YAChB,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YACxC,QAAQ,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA;AAAA,QACxC;AAAA,SACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,QAAO;AAAA,UACP,SAAS;AAAA;AAAA,MACX;AAAA,MACC,cAAc,eAAe,OAC5B,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAY,YAAE,eAAe,GAAE;AAAA,QAC9C,oBAAC,iBAAc,IAAG,YAAW,MAAK,YAAW,UAAU,CAAC,cAAc,gBAAc,CAAC,CAAC,OAAO,cAAa,oBAAmB;AAAA,SAC/H;AAAA,MAED,CAAC,cAAc,kBAAkB,CAAC,cAAc,gBAC/C,qBAAC,WAAM,WAAU,yDACf;AAAA,4BAAC,WAAM,MAAK,YAAW,MAAK,YAAW,WAAU,qBAAoB;AAAA,QACrE,oBAAC,UAAM,oBAAU,yBAAyB,aAAa,GAAE;AAAA,SAC3D;AAAA,MAEF,oBAAC,UAAO,MAAK,UAAS,UAAU,cAAc,CAAC,WAAW,WAAU,aACjE,uBACG,UAAU,sBAAsB,YAAY,IAC5C,eACE,aAAa,gBACb,UAAU,eAAe,SAAS,GAC1C;AAAA,MACC,CAAC,cAAc,sBACd,oBAAC,SAAI,WAAU,sCACb,8BAAC,QAAK,WAAU,aAAY,MAAK,UAC9B,oBAAU,6BAA6B,kBAAkB,GAC5D,GACF;AAAA,OAEJ,GACF,GACF;AAAA,KACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport { useCallback, useEffect, useMemo, useState } from 'react'\nimport type { ReactNode } from 'react'\nimport Image from 'next/image'\nimport Link from 'next/link'\nimport { useRouter, useSearchParams } from 'next/navigation'\nimport { Card, CardContent, CardHeader, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'\nimport { clearAllOperations } from '@open-mercato/ui/backend/operations/store'\nimport { notifyAuthIdentityChange } from '@open-mercato/ui/backend/AuthSessionGuard'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { X } from 'lucide-react'\nimport { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'\nimport { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'\nimport { useRegisteredComponent } from '@open-mercato/ui/backend/injection/useRegisteredComponent'\nimport type { AuthOverride, LoginFormWidgetContext } from './login-injection'\n\nconst loginTenantKey = 'om_login_tenant'\nconst loginTenantCookieMaxAge = 60 * 60 * 24 * 14\n\nfunction readTenantCookie() {\n  if (typeof document === 'undefined') return null\n  const entries = document.cookie.split(';')\n  for (const entry of entries) {\n    const [name, ...rest] = entry.trim().split('=')\n    if (name === loginTenantKey) return decodeURIComponent(rest.join('='))\n  }\n  return null\n}\n\nfunction setTenantCookie(value: string) {\n  if (typeof document === 'undefined') return\n  document.cookie = `${loginTenantKey}=${encodeURIComponent(value)}; path=/; max-age=${loginTenantCookieMaxAge}; samesite=lax`\n}\n\nfunction clearTenantCookie() {\n  if (typeof document === 'undefined') return\n  document.cookie = `${loginTenantKey}=; path=/; max-age=0; samesite=lax`\n}\n\nfunction extractErrorMessage(payload: unknown): string | null {\n  if (!payload) return null\n  if (typeof payload === 'string') return payload\n  if (Array.isArray(payload)) {\n    for (const entry of payload) {\n      const resolved = extractErrorMessage(entry)\n      if (resolved) return resolved\n    }\n    return null\n  }\n  if (typeof payload === 'object') {\n    const record = payload as Record<string, unknown>\n    const candidates: unknown[] = [\n      record.error,\n      record.message,\n      record.detail,\n      record.details,\n      record.description,\n    ]\n    for (const candidate of candidates) {\n      const resolved = extractErrorMessage(candidate)\n      if (resolved) return resolved\n    }\n  }\n  return null\n}\n\nfunction looksLikeJsonString(value: string): boolean {\n  const trimmed = value.trim()\n  return trimmed.startsWith('{') || trimmed.startsWith('[')\n}\n\ntype LoginResponseEventDetail = Record<string, unknown> | null\n\ntype LoginFormSectionProps = {\n  children: ReactNode\n}\n\nfunction LoginFormSectionDefault({ children }: LoginFormSectionProps) {\n  return <>{children}</>\n}\n\nfunction emitLoginResponseEvent(detail: LoginResponseEventDetail) {\n  if (typeof window === 'undefined') return\n  window.dispatchEvent(new CustomEvent('om:auth:login-response', { detail }))\n}\n\nexport default function LoginPage() {\n  const t = useT()\n  const translate = useCallback(\n    (key: string, fallback: string, params?: Record<string, string | number>) =>\n      translateWithFallback(t, key, fallback, params),\n    [t],\n  )\n  const router = useRouter()\n  const searchParams = useSearchParams()\n  const requireRole = (searchParams.get('requireRole') || searchParams.get('role') || '').trim()\n  const requireFeature = (searchParams.get('requireFeature') || '').trim()\n  const requiredRoles = requireRole ? requireRole.split(',').map((value) => value.trim()).filter(Boolean) : []\n  const requiredFeatures = requireFeature ? requireFeature.split(',').map((value) => value.trim()).filter(Boolean) : []\n  const translatedRoles = requiredRoles.map((role) => translate(`auth.roles.${role}`, role))\n  const translatedFeatures = requiredFeatures.map((feature) => translate(`features.${feature}`, feature))\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n  const [authOverride, setAuthOverride] = useState<AuthOverride | null>(null)\n  const [authOverridePending, setAuthOverridePending] = useState(false)\n  const [clientReady, setClientReady] = useState(false)\n  const [email, setEmail] = useState('')\n  const [tenantId, setTenantId] = useState<string | null>(null)\n  const [tenantName, setTenantName] = useState<string | null>(null)\n  const [tenantLoading, setTenantLoading] = useState(false)\n  const [tenantInvalid, setTenantInvalid] = useState<string | null>(null)\n  const showTenantInvalid = tenantId != null && tenantInvalid === tenantId\n  const LoginFormSection = useRegisteredComponent<LoginFormSectionProps>(\n    'section:auth.login.form',\n    LoginFormSectionDefault,\n  )\n\n  useEffect(() => {\n    setClientReady(true)\n  }, [])\n\n  useEffect(() => {\n    let cancelled = false\n    void (async () => {\n      try {\n        const res = await apiCall<{ userId?: string }>('/api/auth/feature-check', {\n          method: 'POST',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({ features: [] }),\n          cache: 'no-store',\n        })\n        if (cancelled) return\n        const activeUserId = typeof res.result?.userId === 'string' ? res.result.userId : ''\n        if (!activeUserId) return\n        const rawRedirect = searchParams.get('redirect') || ''\n        let destination = '/backend'\n        if (rawRedirect) {\n          try {\n            const resolved = new URL(rawRedirect, window.location.origin)\n            if (\n              resolved.origin === window.location.origin &&\n              resolved.pathname.startsWith('/') &&\n              !resolved.pathname.includes('//')\n            ) {\n              destination = resolved.pathname + resolved.search + resolved.hash\n            }\n          } catch {\n            // fall back to /backend\n          }\n        }\n        router.replace(destination)\n      } catch {\n        // ignore \u2014 leave login form usable on network failure\n      }\n    })()\n    return () => { cancelled = true }\n  }, [router, searchParams])\n\n  useEffect(() => {\n    const tenantParam = (searchParams.get('tenant') || '').trim()\n    if (tenantParam) {\n      setTenantId(tenantParam)\n      window.localStorage.setItem(loginTenantKey, tenantParam)\n      setTenantCookie(tenantParam)\n      return\n    }\n    const storedTenant = window.localStorage.getItem(loginTenantKey) || readTenantCookie()\n    if (storedTenant) {\n      setTenantId(storedTenant)\n    }\n  }, [searchParams])\n\n  useEffect(() => {\n    if (!tenantId) {\n      setTenantName(null)\n      setTenantInvalid(null)\n      return\n    }\n    if (tenantInvalid === tenantId) {\n      setTenantName(null)\n      setTenantLoading(false)\n      return\n    }\n    let active = true\n    setTenantLoading(true)\n    setTenantInvalid(null)\n    apiCall<{ ok: boolean; tenant?: { id: string; name: string }; error?: string }>(\n      `/api/directory/tenants/lookup?tenantId=${encodeURIComponent(tenantId)}`,\n    )\n      .then(({ result }) => {\n        if (!active) return\n        if (result?.ok && result.tenant) {\n          setTenantName(result.tenant.name)\n          return\n        }\n        setTenantName(null)\n        setTenantInvalid(tenantId)\n        setError(null)\n      })\n      .catch(() => {\n        if (!active) return\n        setTenantName(null)\n        setTenantInvalid(tenantId)\n        setError(null)\n      })\n      .finally(() => {\n        if (active) setTenantLoading(false)\n      })\n    return () => {\n      active = false\n    }\n  }, [tenantId, translate])\n\n  function handleClearTenant() {\n    window.localStorage.removeItem(loginTenantKey)\n    clearTenantCookie()\n    setTenantId(null)\n    setTenantName(null)\n    setTenantInvalid(null)\n    const params = new URLSearchParams(searchParams)\n    params.delete('tenant')\n    setError(null)\n    const query = params.toString()\n    router.replace(query ? `/login?${query}` : '/login')\n  }\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    if (!clientReady || authOverridePending) {\n      return\n    }\n    setError(null)\n    if (authOverride) {\n      authOverride.onSubmit()\n      return\n    }\n    setSubmitting(true)\n    try {\n      const form = new FormData(e.currentTarget)\n      if (requiredRoles.length) form.set('requireRole', requiredRoles.join(','))\n      const redirectParam = searchParams.get('redirect')\n      if (redirectParam) form.set('redirect', redirectParam)\n      const res = await fetch('/api/auth/login', { method: 'POST', body: form })\n      if (res.redirected) {\n        clearAllOperations()\n        notifyAuthIdentityChange()\n        // NextResponse.redirect from API\n        router.replace(res.url)\n        return\n      }\n      if (!res.ok) {\n        const fallback = (() => {\n          if (res.status === 403) {\n            return translate(\n              'auth.login.errors.permissionDenied',\n              'You do not have permission to access this area. Please contact your administrator.',\n            )\n          }\n          if (res.status === 401 || res.status === 400) {\n            return translate('auth.login.errors.invalidCredentials', 'Invalid email or password')\n          }\n          return translate('auth.login.errors.generic', 'An error occurred. Please try again.')\n        })()\n        const cloned = res.clone()\n        let errorMessage = ''\n        const contentType = res.headers.get('content-type') || ''\n        if (contentType.includes('application/json')) {\n          try {\n            const data = await res.json()\n            errorMessage = extractErrorMessage(data) || ''\n          } catch {\n            try {\n              const text = await cloned.text()\n              const trimmed = text.trim()\n              if (trimmed && !looksLikeJsonString(trimmed)) {\n                errorMessage = trimmed\n              }\n            } catch {\n              errorMessage = ''\n            }\n          }\n        } else {\n          try {\n            const text = await res.text()\n            const trimmed = text.trim()\n            if (trimmed && !looksLikeJsonString(trimmed)) {\n              errorMessage = trimmed\n            }\n          } catch {\n            errorMessage = ''\n          }\n        }\n        setError(errorMessage || fallback)\n        return\n      }\n      // In case API returns 200 with JSON\n      const data = await res.json().catch(() => null) as LoginResponseEventDetail\n      emitLoginResponseEvent(data)\n      clearAllOperations()\n      notifyAuthIdentityChange()\n      if (data && typeof data.redirect === 'string' && data.redirect.length > 0) {\n        router.replace(data.redirect)\n      }\n    } catch (err: unknown) {\n      // Handle any errors thrown (e.g., network errors or thrown exceptions)\n      const message = err instanceof Error ? err.message : ''\n      setError(message || translate('auth.login.errors.generic', 'An error occurred. Please try again.'))\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  const loginFormContext = useMemo<LoginFormWidgetContext>(() => ({\n    email,\n    tenantId,\n    searchParams,\n    setAuthOverride,\n    setAuthOverridePending,\n    setError,\n  }), [email, tenantId, searchParams])\n\n  const formReady = clientReady && !authOverridePending\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader className=\"flex flex-col items-center gap-4 text-center p-10\">\n          <Image alt={translate('auth.login.logoAlt', 'Open Mercato logo')} src=\"/open-mercato.svg\" width={150} height={150} priority />\n          <h1 className=\"text-2xl font-semibold\">{translate('auth.login.brandName', 'Open Mercato')}</h1>\n          <CardDescription>{translate('auth.login.subtitle', 'Access your workspace')}</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <LoginFormSection>\n            <form className=\"grid gap-3\" onSubmit={onSubmit} noValidate data-auth-ready={formReady ? '1' : '0'}>\n              {tenantId ? (\n                <input type=\"hidden\" name=\"tenantId\" value={tenantId} />\n              ) : null}\n              {!!translatedRoles.length && (\n                <Alert variant=\"info\" className=\"text-center\">\n                  <AlertDescription>\n                    {translate(\n                      translatedRoles.length > 1 ? 'auth.login.requireRolesMessage' : 'auth.login.requireRoleMessage',\n                      translatedRoles.length > 1\n                        ? 'Access requires one of the following roles: {roles}'\n                        : 'Access requires role: {roles}',\n                      { roles: translatedRoles.join(', ') },\n                    )}\n                  </AlertDescription>\n                </Alert>\n              )}\n              {!!translatedFeatures.length && (\n                <Alert variant=\"info\" className=\"text-center\">\n                  <AlertDescription>\n                    {translate('auth.login.featureDenied', \"You don't have access to this feature ({feature}). Please contact your administrator.\", {\n                      feature: translatedFeatures.join(', '),\n                    })}\n                  </AlertDescription>\n                </Alert>\n              )}\n              {showTenantInvalid ? (\n                <div className=\"rounded-md border border-red-200 bg-red-50 px-3 py-2 text-center text-xs text-red-700\">\n                  <div className=\"font-medium\">{translate('auth.login.errors.tenantInvalid', 'Tenant not found. Clear the tenant selection and try again.')}</div>\n                  <Button type=\"button\" variant=\"outline\" size=\"sm\" className=\"mt-2 border-red-300 text-red-700\" onClick={handleClearTenant}>\n                    <X className=\"mr-2 size-4\" aria-hidden=\"true\" />\n                    {translate('auth.login.tenantClear', 'Clear')}\n                  </Button>\n                </div>\n              ) : tenantId ? (\n                <div className=\"rounded-md border border-emerald-200 bg-emerald-50 px-3 py-2 text-center text-xs text-emerald-900\">\n                  <div className=\"font-medium\">\n                    {tenantLoading\n                      ? translate('auth.login.tenantLoading', 'Loading tenant details...')\n                      : translate('auth.login.tenantBanner', \"You're logging in to {tenant} tenant.\", {\n                          tenant: tenantName || tenantId,\n                        })}\n                  </div>\n                  <Button type=\"button\" variant=\"outline\" size=\"sm\" className=\"mt-2 border-emerald-300 text-emerald-900\" onClick={handleClearTenant}>\n                    <X className=\"mr-2 size-4\" aria-hidden=\"true\" />\n                    {translate('auth.login.tenantClear', 'Clear')}\n                  </Button>\n                </div>\n              ) : null}\n              {error && !showTenantInvalid && (\n                <div className=\"rounded-md border border-red-200 bg-red-50 px-3 py-2 text-center text-sm text-red-700\" role=\"alert\" aria-live=\"polite\">\n                  {error}\n                </div>\n              )}\n              <div className=\"grid gap-1\">\n                <Label htmlFor=\"email\">{t('auth.email')}</Label>\n                <EmailInput\n                  id=\"email\"\n                  name=\"email\"\n                  required\n                  aria-invalid={!!error}\n                  onChange={(e) => setEmail(e.target.value)}\n                  onBlur={(e) => setEmail(e.target.value)}\n                />\n              </div>\n              <InjectionSpot<LoginFormWidgetContext>\n                spotId=\"auth.login:form\"\n                context={loginFormContext}\n              />\n              {authOverride?.hidePassword ? null : (\n                <div className=\"grid gap-1\">\n                  <Label htmlFor=\"password\">{t('auth.password')}</Label>\n                  <PasswordInput id=\"password\" name=\"password\" required={!authOverride} aria-invalid={!!error} autoComplete=\"current-password\" />\n                </div>\n              )}\n              {!authOverride?.hideRememberMe && !authOverride?.hidePassword && (\n                <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n                  <input type=\"checkbox\" name=\"remember\" className=\"accent-foreground\" />\n                  <span>{translate('auth.login.rememberMe', 'Remember me')}</span>\n                </label>\n              )}\n              <Button type=\"submit\" disabled={submitting || !formReady} className=\"h-10 mt-2\">\n                {submitting\n                  ? translate('auth.login.loading', 'Loading...')\n                  : authOverride\n                    ? authOverride.providerLabel\n                    : translate('auth.signIn', 'Sign in')}\n              </Button>\n              {!authOverride?.hideForgotPassword && (\n                <div className=\"text-xs text-muted-foreground mt-2\">\n                  <Link className=\"underline\" href=\"/reset\">\n                    {translate('auth.login.forgotPassword', 'Forgot password?')}\n                  </Link>\n                </div>\n              )}\n            </form>\n          </LoginFormSection>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n"],
+  "mappings": ";AAqFS,wBAwPD,YAxPC;AApFT,SAAS,aAAa,WAAW,SAAS,gBAAgB;AAE1D,OAAO,WAAW;AAClB,OAAO,UAAU;AACjB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,MAAM,aAAa,YAAY,uBAAuB;AAE/D,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,aAAa;AACtB,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC,SAAS,0BAA0B;AACnC,SAAS,gCAAgC;AACzC,SAAS,eAAe;AACxB,SAAS,SAAS;AAClB,SAAS,OAAO,wBAAwB;AACxC,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AAGvC,MAAM,iBAAiB;AACvB,MAAM,0BAA0B,KAAK,KAAK,KAAK;AAE/C,SAAS,mBAAmB;AAC1B,MAAI,OAAO,aAAa,YAAa,QAAO;AAC5C,QAAM,UAAU,SAAS,OAAO,MAAM,GAAG;AACzC,aAAW,SAAS,SAAS;AAC3B,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,KAAK,EAAE,MAAM,GAAG;AAC9C,QAAI,SAAS,eAAgB,QAAO,mBAAmB,KAAK,KAAK,GAAG,CAAC;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAe;AACtC,MAAI,OAAO,aAAa,YAAa;AACrC,WAAS,SAAS,GAAG,cAAc,IAAI,mBAAmB,KAAK,CAAC,qBAAqB,uBAAuB;AAC9G;AAEA,SAAS,oBAAoB;AAC3B,MAAI,OAAO,aAAa,YAAa;AACrC,WAAS,SAAS,GAAG,cAAc;AACrC;AAEA,SAAS,oBAAoB,SAAiC;AAC5D,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,eAAW,SAAS,SAAS;AAC3B,YAAM,WAAW,oBAAoB,KAAK;AAC1C,UAAI,SAAU,QAAO;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,UAAU;AAC/B,UAAM,SAAS;AACf,UAAM,aAAwB;AAAA,MAC5B,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,IACT;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,WAAW,oBAAoB,SAAS;AAC9C,UAAI,SAAU,QAAO;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;AACnD,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG;AAC1D;AAQA,SAAS,wBAAwB,EAAE,SAAS,GAA0B;AACpE,SAAO,gCAAG,UAAS;AACrB;AAEA,SAAS,uBAAuB,QAAkC;AAChE,MAAI,OAAO,WAAW,YAAa;AACnC,SAAO,cAAc,IAAI,YAAY,0BAA0B,EAAE,OAAO,CAAC,CAAC;AAC5E;AAEe,SAAR,YAA6B;AAClC,QAAM,IAAI,KAAK;AACf,QAAM,YAAY;AAAA,IAChB,CAAC,KAAa,UAAkB,WAC9B,sBAAsB,GAAG,KAAK,UAAU,MAAM;AAAA,IAChD,CAAC,CAAC;AAAA,EACJ;AACA,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,gBAAgB;AACrC,QAAM,eAAe,aAAa,IAAI,aAAa,KAAK,aAAa,IAAI,MAAM,KAAK,IAAI,KAAK;AAC7F,QAAM,kBAAkB,aAAa,IAAI,gBAAgB,KAAK,IAAI,KAAK;AACvE,QAAM,gBAAgB,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI,CAAC;AAC3G,QAAM,mBAAmB,iBAAiB,eAAe,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI,CAAC;AACpH,QAAM,kBAAkB,cAAc,IAAI,CAAC,SAAS,UAAU,cAAc,IAAI,IAAI,IAAI,CAAC;AACzF,QAAM,qBAAqB,iBAAiB,IAAI,CAAC,YAAY,UAAU,YAAY,OAAO,IAAI,OAAO,CAAC;AACtG,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,cAAc,eAAe,IAAI,SAA8B,IAAI;AAC1E,QAAM,CAAC,qBAAqB,sBAAsB,IAAI,SAAS,KAAK;AACpE,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,KAAK;AACpD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAI,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,SAAwB,IAAI;AAChE,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAS,KAAK;AACxD,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAwB,IAAI;AACtE,QAAM,oBAAoB,YAAY,QAAQ,kBAAkB;AAChE,QAAM,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AAEA,YAAU,MAAM;AACd,mBAAe,IAAI;AAAA,EACrB,GAAG,CAAC,CAAC;AAEL,YAAU,MAAM;AACd,QAAI,YAAY;AAChB,UAAM,YAAY;AAChB,UAAI;AACF,cAAM,MAAM,MAAM,QAA6B,2BAA2B;AAAA,UACxE,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;AAAA,UACrC,OAAO;AAAA,QACT,CAAC;AACD,YAAI,UAAW;AACf,cAAM,eAAe,OAAO,IAAI,QAAQ,WAAW,WAAW,IAAI,OAAO,SAAS;AAClF,YAAI,CAAC,aAAc;AACnB,cAAM,cAAc,aAAa,IAAI,UAAU,KAAK;AACpD,YAAI,cAAc;AAClB,YAAI,aAAa;AACf,cAAI;AACF,kBAAM,WAAW,IAAI,IAAI,aAAa,OAAO,SAAS,MAAM;AAC5D,gBACE,SAAS,WAAW,OAAO,SAAS,UACpC,SAAS,SAAS,WAAW,GAAG,KAChC,CAAC,SAAS,SAAS,SAAS,IAAI,GAChC;AACA,4BAAc,SAAS,WAAW,SAAS,SAAS,SAAS;AAAA,YAC/D;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AACA,eAAO,QAAQ,WAAW;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACF,GAAG;AACH,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,QAAQ,YAAY,CAAC;AAEzB,YAAU,MAAM;AACd,UAAM,eAAe,aAAa,IAAI,QAAQ,KAAK,IAAI,KAAK;AAC5D,QAAI,aAAa;AACf,kBAAY,WAAW;AACvB,aAAO,aAAa,QAAQ,gBAAgB,WAAW;AACvD,sBAAgB,WAAW;AAC3B;AAAA,IACF;AACA,UAAM,eAAe,OAAO,aAAa,QAAQ,cAAc,KAAK,iBAAiB;AACrF,QAAI,cAAc;AAChB,kBAAY,YAAY;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,YAAU,MAAM;AACd,QAAI,CAAC,UAAU;AACb,oBAAc,IAAI;AAClB,uBAAiB,IAAI;AACrB;AAAA,IACF;AACA,QAAI,kBAAkB,UAAU;AAC9B,oBAAc,IAAI;AAClB,uBAAiB,KAAK;AACtB;AAAA,IACF;AACA,QAAI,SAAS;AACb,qBAAiB,IAAI;AACrB,qBAAiB,IAAI;AACrB;AAAA,MACE,0CAA0C,mBAAmB,QAAQ,CAAC;AAAA,IACxE,EACG,KAAK,CAAC,EAAE,OAAO,MAAM;AACpB,UAAI,CAAC,OAAQ;AACb,UAAI,QAAQ,MAAM,OAAO,QAAQ;AAC/B,sBAAc,OAAO,OAAO,IAAI;AAChC;AAAA,MACF;AACA,oBAAc,IAAI;AAClB,uBAAiB,QAAQ;AACzB,eAAS,IAAI;AAAA,IACf,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,OAAQ;AACb,oBAAc,IAAI;AAClB,uBAAiB,QAAQ;AACzB,eAAS,IAAI;AAAA,IACf,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,OAAQ,kBAAiB,KAAK;AAAA,IACpC,CAAC;AACH,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,UAAU,SAAS,CAAC;AAExB,WAAS,oBAAoB;AAC3B,WAAO,aAAa,WAAW,cAAc;AAC7C,sBAAkB;AAClB,gBAAY,IAAI;AAChB,kBAAc,IAAI;AAClB,qBAAiB,IAAI;AACrB,UAAM,SAAS,IAAI,gBAAgB,YAAY;AAC/C,WAAO,OAAO,QAAQ;AACtB,aAAS,IAAI;AACb,UAAM,QAAQ,OAAO,SAAS;AAC9B,WAAO,QAAQ,QAAQ,UAAU,KAAK,KAAK,QAAQ;AAAA,EACrD;AAEA,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,QAAI,CAAC,eAAe,qBAAqB;AACvC;AAAA,IACF;AACA,aAAS,IAAI;AACb,QAAI,cAAc;AAChB,mBAAa,SAAS;AACtB;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,UAAI,cAAc,OAAQ,MAAK,IAAI,eAAe,cAAc,KAAK,GAAG,CAAC;AACzE,YAAM,gBAAgB,aAAa,IAAI,UAAU;AACjD,UAAI,cAAe,MAAK,IAAI,YAAY,aAAa;AACrD,YAAM,MAAM,MAAM,MAAM,mBAAmB,EAAE,QAAQ,QAAQ,MAAM,KAAK,CAAC;AACzE,UAAI,IAAI,YAAY;AAClB,2BAAmB;AACnB,iCAAyB;AAEzB,eAAO,QAAQ,IAAI,GAAG;AACtB;AAAA,MACF;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,YAAY,MAAM;AACtB,cAAI,IAAI,WAAW,KAAK;AACtB,mBAAO;AAAA,cACL;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,mBAAO,UAAU,wCAAwC,2BAA2B;AAAA,UACtF;AACA,iBAAO,UAAU,6BAA6B,sCAAsC;AAAA,QACtF,GAAG;AACH,cAAM,SAAS,IAAI,MAAM;AACzB,YAAI,eAAe;AACnB,cAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,YAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,cAAI;AACF,kBAAMA,QAAO,MAAM,IAAI,KAAK;AAC5B,2BAAe,oBAAoBA,KAAI,KAAK;AAAA,UAC9C,QAAQ;AACN,gBAAI;AACF,oBAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,oBAAM,UAAU,KAAK,KAAK;AAC1B,kBAAI,WAAW,CAAC,oBAAoB,OAAO,GAAG;AAC5C,+BAAe;AAAA,cACjB;AAAA,YACF,QAAQ;AACN,6BAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF,OAAO;AACL,cAAI;AACF,kBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,kBAAM,UAAU,KAAK,KAAK;AAC1B,gBAAI,WAAW,CAAC,oBAAoB,OAAO,GAAG;AAC5C,6BAAe;AAAA,YACjB;AAAA,UACF,QAAQ;AACN,2BAAe;AAAA,UACjB;AAAA,QACF;AACA,iBAAS,gBAAgB,QAAQ;AACjC;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,6BAAuB,IAAI;AAC3B,yBAAmB;AACnB,+BAAyB;AACzB,UAAI,QAAQ,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,GAAG;AACzE,eAAO,QAAQ,KAAK,QAAQ;AAAA,MAC9B;AAAA,IACF,SAAS,KAAc;AAErB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAS,WAAW,UAAU,6BAA6B,sCAAsC,CAAC;AAAA,IACpG,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,mBAAmB,QAAgC,OAAO;AAAA,IAC9D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,CAAC,OAAO,UAAU,YAAY,CAAC;AAEnC,QAAM,YAAY,eAAe,CAAC;AAElC,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cAAW,WAAU,qDACpB;AAAA,0BAAC,SAAM,KAAK,UAAU,sBAAsB,mBAAmB,GAAG,KAAI,qBAAoB,OAAO,KAAK,QAAQ,KAAK,UAAQ,MAAC;AAAA,MAC5H,oBAAC,QAAG,WAAU,0BAA0B,oBAAU,wBAAwB,cAAc,GAAE;AAAA,MAC1F,oBAAC,mBAAiB,oBAAU,uBAAuB,uBAAuB,GAAE;AAAA,OAC9E;AAAA,IACA,oBAAC,eACC,8BAAC,oBACC,+BAAC,UAAK,WAAU,cAAa,UAAoB,YAAU,MAAC,mBAAiB,YAAY,MAAM,KAC5F;AAAA,iBACC,oBAAC,WAAM,MAAK,UAAS,MAAK,YAAW,OAAO,UAAU,IACpD;AAAA,MACH,CAAC,CAAC,gBAAgB,UACjB,oBAAC,SAAM,SAAQ,QAAO,WAAU,eAC9B,8BAAC,oBACE;AAAA,QACC,gBAAgB,SAAS,IAAI,mCAAmC;AAAA,QAChE,gBAAgB,SAAS,IACrB,wDACA;AAAA,QACJ,EAAE,OAAO,gBAAgB,KAAK,IAAI,EAAE;AAAA,MACtC,GACF,GACF;AAAA,MAED,CAAC,CAAC,mBAAmB,UACpB,oBAAC,SAAM,SAAQ,QAAO,WAAU,eAC9B,8BAAC,oBACE,oBAAU,4BAA4B,yFAAyF;AAAA,QAC9H,SAAS,mBAAmB,KAAK,IAAI;AAAA,MACvC,CAAC,GACH,GACF;AAAA,MAED,oBACC,qBAAC,SAAI,WAAU,yFACb;AAAA,4BAAC,SAAI,WAAU,eAAe,oBAAU,mCAAmC,6DAA6D,GAAE;AAAA,QAC1I,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,WAAU,oCAAmC,SAAS,mBACtG;AAAA,8BAAC,KAAE,WAAU,eAAc,eAAY,QAAO;AAAA,UAC7C,UAAU,0BAA0B,OAAO;AAAA,WAC9C;AAAA,SACF,IACE,WACF,qBAAC,SAAI,WAAU,qGACb;AAAA,4BAAC,SAAI,WAAU,eACZ,0BACG,UAAU,4BAA4B,2BAA2B,IACjE,UAAU,2BAA2B,yCAAyC;AAAA,UAC5E,QAAQ,cAAc;AAAA,QACxB,CAAC,GACP;AAAA,QACA,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,WAAU,4CAA2C,SAAS,mBAC9G;AAAA,8BAAC,KAAE,WAAU,eAAc,eAAY,QAAO;AAAA,UAC7C,UAAU,0BAA0B,OAAO;AAAA,WAC9C;AAAA,SACF,IACE;AAAA,MACH,SAAS,CAAC,qBACT,oBAAC,SAAI,WAAU,yFAAwF,MAAK,SAAQ,aAAU,UAC3H,iBACH;AAAA,MAEF,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,SAAS,YAAE,YAAY,GAAE;AAAA,QACxC;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,gBAAc,CAAC,CAAC;AAAA,YAChB,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YACxC,QAAQ,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA;AAAA,QACxC;AAAA,SACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,QAAO;AAAA,UACP,SAAS;AAAA;AAAA,MACX;AAAA,MACC,cAAc,eAAe,OAC5B,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAY,YAAE,eAAe,GAAE;AAAA,QAC9C,oBAAC,iBAAc,IAAG,YAAW,MAAK,YAAW,UAAU,CAAC,cAAc,gBAAc,CAAC,CAAC,OAAO,cAAa,oBAAmB;AAAA,SAC/H;AAAA,MAED,CAAC,cAAc,kBAAkB,CAAC,cAAc,gBAC/C,qBAAC,WAAM,WAAU,yDACf;AAAA,4BAAC,WAAM,MAAK,YAAW,MAAK,YAAW,WAAU,qBAAoB;AAAA,QACrE,oBAAC,UAAM,oBAAU,yBAAyB,aAAa,GAAE;AAAA,SAC3D;AAAA,MAEF,oBAAC,UAAO,MAAK,UAAS,UAAU,cAAc,CAAC,WAAW,WAAU,aACjE,uBACG,UAAU,sBAAsB,YAAY,IAC5C,eACE,aAAa,gBACb,UAAU,eAAe,SAAS,GAC1C;AAAA,MACC,CAAC,cAAc,sBACd,oBAAC,SAAI,WAAU,sCACb,8BAAC,QAAK,WAAU,aAAY,MAAK,UAC9B,oBAAU,6BAA6B,kBAAkB,GAC5D,GACF;AAAA,OAEJ,GACF,GACF;AAAA,KACF,GACF;AAEJ;",
   "names": ["data"]
 }

package/dist/modules/auth/lib/grantChecks.js

@@ -1,7 +1,7 @@
 import { CrudHttpError, forbidden } from "@open-mercato/shared/lib/crud/errors";
 import { hasFeature } from "@open-mercato/shared/security/features";
-import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
-import { Role, RoleAcl } from "@open-mercato/core/modules/auth/data/entities";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { Role, RoleAcl, UserAcl, UserRole } from "@open-mercato/core/modules/auth/data/entities";
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function assertActorCanGrantRoleTokens(input) {
   const tokens = normalizeStringList(input.roleTokens);
@@ -55,6 +55,96 @@ async function assertActorCanGrantAcl(input) {
 function normalizeGrantFeatureList(features) {
   return normalizeStringList(features);
 }
+async function assertActorCanModifySuperAdminUserTarget(input) {
+  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input);
+  if (actorIsSuperAdmin) return;
+  const targetIsSuperAdmin = await isUserEffectivelySuperAdmin(input.em, input.targetUserId);
+  if (targetIsSuperAdmin) {
+    throw forbidden("Only super administrators can modify super administrator accounts.");
+  }
+}
+async function assertActorCanModifySuperAdminRoleTarget(input) {
+  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input);
+  if (actorIsSuperAdmin) return;
+  const targetIsSuperAdmin = await isRoleEffectivelySuperAdmin(input.em, input.targetRoleId);
+  if (targetIsSuperAdmin) {
+    throw forbidden("Only super administrators can modify super administrator roles.");
+  }
+}
+async function resolveActorIsSuperAdmin(input) {
+  if (typeof input.actorIsSuperAdmin === "boolean") return input.actorIsSuperAdmin;
+  const acl = await loadActorAcl(input);
+  return acl.isSuperAdmin;
+}
+async function isUserEffectivelySuperAdmin(em, userId) {
+  const directGrant = await em.findOne(
+    UserAcl,
+    { user: userId, isSuperAdmin: true }
+  );
+  if (directGrant && directGrant.isSuperAdmin === true) return true;
+  const links = await findWithDecryption(
+    em,
+    UserRole,
+    { user: userId },
+    { populate: ["role"] },
+    { tenantId: null, organizationId: null }
+  );
+  const roleIds = (Array.isArray(links) ? links : []).map((link) => {
+    const role = link.role;
+    if (!role) return null;
+    if (typeof role === "string") return role;
+    return role.id ? String(role.id) : null;
+  }).filter((id) => typeof id === "string" && id.length > 0);
+  if (!roleIds.length) return false;
+  const roleGrant = await em.findOne(
+    RoleAcl,
+    { role: { $in: roleIds }, isSuperAdmin: true }
+  );
+  return !!roleGrant && roleGrant.isSuperAdmin === true;
+}
+async function isRoleEffectivelySuperAdmin(em, roleId) {
+  const grant = await em.findOne(
+    RoleAcl,
+    { role: roleId, isSuperAdmin: true }
+  );
+  return !!grant && grant.isSuperAdmin === true;
+}
+async function listSuperAdminUserIds(em, tenantId) {
+  const ids = /* @__PURE__ */ new Set();
+  const userAclFilter = { isSuperAdmin: true };
+  if (tenantId) userAclFilter.tenantId = tenantId;
+  const userAcls = await em.find(UserAcl, userAclFilter);
+  for (const acl of userAcls) {
+    const userRef = acl.user;
+    const userId = userRef && typeof userRef === "object" ? userRef.id : userRef;
+    if (userId) ids.add(String(userId));
+  }
+  const roleAcls = await em.find(
+    RoleAcl,
+    { isSuperAdmin: true }
+  );
+  const roleIds = roleAcls.map((acl) => {
+    const roleRef = acl.role;
+    if (!roleRef) return null;
+    if (typeof roleRef === "string") return roleRef;
+    return roleRef.id ? String(roleRef.id) : null;
+  }).filter((id) => typeof id === "string" && id.length > 0);
+  if (roleIds.length) {
+    const links = await findWithDecryption(
+      em,
+      UserRole,
+      { role: { $in: roleIds } },
+      {},
+      { tenantId: null, organizationId: null }
+    );
+    for (const link of Array.isArray(links) ? links : []) {
+      const userRef = link.user;
+      const userId = userRef && typeof userRef === "object" ? userRef.id : userRef;
+      if (userId) ids.add(String(userId));
+    }
+  }
+  return ids;
+}
 async function loadActorAcl(input) {
   const actorUserId = normalizeNullableString(input.actorUserId);
   if (!actorUserId) throw forbidden("Not authorized to grant ACL privileges.");
@@ -155,6 +245,11 @@ export {
   assertActorCanGrantAcl,
   assertActorCanGrantRoleTokens,
   assertActorCanGrantRoles,
+  assertActorCanModifySuperAdminRoleTarget,
+  assertActorCanModifySuperAdminUserTarget,
+  isRoleEffectivelySuperAdmin,
+  isUserEffectivelySuperAdmin,
+  listSuperAdminUserIds,
   normalizeGrantFeatureList
 };
 //# sourceMappingURL=grantChecks.js.map

package/dist/modules/auth/lib/grantChecks.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/grantChecks.ts"],
-  "sourcesContent": ["import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Role, RoleAcl } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\ntype ActorAcl = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype GrantCheckContext = {\n  em: EntityManager\n  rbacService: RbacService\n  actorUserId: string | null | undefined\n  tenantId: string | null | undefined\n  organizationId?: string | null | undefined\n}\n\ntype RoleGrantCheckInput = GrantCheckContext & {\n  roles: Role[]\n}\n\ntype RoleTokenGrantCheckInput = GrantCheckContext & {\n  roleTokens: unknown\n}\n\ntype FeatureGrantCheckInput = GrantCheckContext & {\n  features: unknown\n  isSuperAdmin?: boolean\n  organizations?: string[] | null\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {\n  const tokens = normalizeStringList(input.roleTokens)\n  if (!tokens.length) return []\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const roles = await resolveRolesForGrant(input.em, tokens, tenantId)\n  await assertActorCanGrantRoles({ ...input, tenantId, roles })\n  return roles\n}\n\nexport async function assertActorCanGrantRoles(input: RoleGrantCheckInput): Promise<void> {\n  if (!input.roles.length) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const actorAcl = await loadActorAcl({ ...input, tenantId })\n  if (actorAcl.isSuperAdmin) return\n\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant roles.')\n  }\n\n  for (const role of input.roles) {\n    const roleTenantId = normalizeNullableString(role.tenantId)\n    if (roleTenantId !== tenantId) {\n      throw forbidden('Cannot grant a role outside the target tenant.')\n    }\n\n    const acl = await findOneWithDecryption(\n      input.em,\n      RoleAcl,\n      { role, tenantId } as FilterQuery<RoleAcl>,\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!acl) continue\n\n    assertActorCanGrantAclSnapshot(actorAcl, {\n      isSuperAdmin: !!acl.isSuperAdmin,\n      features: normalizeStringList(acl.featuresJson),\n      organizations: normalizeOrganizationList(acl.organizationsJson),\n    })\n  }\n}\n\nexport async function assertActorCanGrantAcl(input: FeatureGrantCheckInput): Promise<void> {\n  const actorAcl = await loadActorAcl(input)\n  if (actorAcl.isSuperAdmin) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant ACL features.')\n  }\n\n  assertActorCanGrantAclSnapshot(actorAcl, {\n    isSuperAdmin: !!input.isSuperAdmin,\n    features: normalizeStringList(input.features),\n    organizations: input.organizations === undefined ? undefined : normalizeOrganizationList(input.organizations),\n  })\n}\n\nexport function normalizeGrantFeatureList(features: unknown): string[] {\n  return normalizeStringList(features)\n}\n\nasync function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {\n  const actorUserId = normalizeNullableString(input.actorUserId)\n  if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')\n\n  const acl = await input.rbacService.loadAcl(actorUserId, {\n    tenantId: normalizeNullableString(input.tenantId),\n    organizationId: normalizeNullableString(input.organizationId),\n  })\n\n  return {\n    isSuperAdmin: !!acl?.isSuperAdmin,\n    features: normalizeStringList(acl?.features),\n    organizations: normalizeOrganizationList(acl?.organizations),\n  }\n}\n\nasync function resolveRolesForGrant(\n  em: EntityManager,\n  roleTokens: string[],\n  tenantId: string | null,\n): Promise<Role[]> {\n  const roles: Role[] = []\n  const missingRoles: string[] = []\n\n  for (const token of roleTokens) {\n    const role = await resolveRoleForGrant(em, token, tenantId)\n    if (!role) {\n      missingRoles.push(token)\n    } else {\n      roles.push(role)\n    }\n  }\n\n  if (missingRoles.length) {\n    const labels = missingRoles.map((role) => `\"${role}\"`).join(', ')\n    throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` })\n  }\n\n  return roles\n}\n\nasync function resolveRoleForGrant(\n  em: EntityManager,\n  token: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const where: Record<string, unknown> = UUID_RE.test(token)\n    ? { id: token, deletedAt: null }\n    : { name: token, deletedAt: null }\n  if (tenantId) where.tenantId = tenantId\n  return findOneWithDecryption(\n    em,\n    Role,\n    where as FilterQuery<Role>,\n    {},\n    { tenantId, organizationId: null },\n  )\n}\n\nfunction assertActorCanGrantAclSnapshot(\n  actorAcl: ActorAcl,\n  requested: {\n    isSuperAdmin: boolean\n    features: string[]\n    organizations?: string[] | null\n  },\n): void {\n  if (requested.isSuperAdmin) {\n    throw forbidden('Only super administrators can grant super admin access.')\n  }\n\n  const actorGrantableFeatures = actorAcl.features.filter((grant) => grant !== '*')\n  for (const feature of requested.features) {\n    if (feature === '*') {\n      throw forbidden('Only super administrators can grant global wildcard access.')\n    }\n    if (isWildcardFeature(feature)) {\n      if (!hasFeature(actorGrantableFeatures, feature)) {\n        throw forbidden(`Cannot grant feature wildcard ${feature}.`)\n      }\n      continue\n    }\n    if (!hasFeature(actorGrantableFeatures, feature)) {\n      throw forbidden(`Cannot grant feature ${feature}.`)\n    }\n  }\n\n  if (requested.organizations !== undefined) {\n    assertActorCanGrantOrganizations(actorAcl.organizations, requested.organizations)\n  }\n}\n\nfunction assertActorCanGrantOrganizations(\n  actorOrganizations: string[] | null,\n  requestedOrganizations: string[] | null,\n): void {\n  if (actorOrganizations === null || actorOrganizations.includes('__all__')) return\n\n  if (requestedOrganizations === null || requestedOrganizations.includes('__all__')) {\n    throw forbidden('Cannot grant unrestricted organization access.')\n  }\n\n  for (const organizationId of requestedOrganizations) {\n    if (!actorOrganizations.includes(organizationId)) {\n      throw forbidden('Cannot grant organization access outside actor scope.')\n    }\n  }\n}\n\nfunction normalizeStringList(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  const dedup = new Set<string>()\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction normalizeOrganizationList(values: unknown): string[] | null {\n  if (values === null || values === undefined) return null\n  return normalizeStringList(values)\n}\n\nfunction normalizeNullableString(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nfunction isWildcardFeature(feature: string): boolean {\n  return feature.endsWith('.*')\n}\n"],
-  "mappings": "AACA,SAAS,eAAe,iBAAiB;AACzC,SAAS,kBAAkB;AAC3B,SAAS,6BAA6B;AACtC,SAAS,MAAM,eAAe;AA+B9B,MAAM,UAAU;AAEhB,eAAsB,8BAA8B,OAAkD;AACpG,QAAM,SAAS,oBAAoB,MAAM,UAAU;AACnD,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,QAAQ,MAAM,qBAAqB,MAAM,IAAI,QAAQ,QAAQ;AACnE,QAAM,yBAAyB,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,eAAsB,yBAAyB,OAA2C;AACxF,MAAI,CAAC,MAAM,MAAM,OAAQ;AAEzB,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,WAAW,MAAM,aAAa,EAAE,GAAG,OAAO,SAAS,CAAC;AAC1D,MAAI,SAAS,aAAc;AAE3B,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,4CAA4C;AAAA,EAC9D;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,UAAM,eAAe,wBAAwB,KAAK,QAAQ;AAC1D,QAAI,iBAAiB,UAAU;AAC7B,YAAM,UAAU,gDAAgD;AAAA,IAClE;AAEA,UAAM,MAAM,MAAM;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA,EAAE,MAAM,SAAS;AAAA,MACjB,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,IAAK;AAEV,mCAA+B,UAAU;AAAA,MACvC,cAAc,CAAC,CAAC,IAAI;AAAA,MACpB,UAAU,oBAAoB,IAAI,YAAY;AAAA,MAC9C,eAAe,0BAA0B,IAAI,iBAAiB;AAAA,IAChE,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,uBAAuB,OAA8C;AACzF,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,MAAI,SAAS,aAAc;AAE3B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,mDAAmD;AAAA,EACrE;AAEA,iCAA+B,UAAU;AAAA,IACvC,cAAc,CAAC,CAAC,MAAM;AAAA,IACtB,UAAU,oBAAoB,MAAM,QAAQ;AAAA,IAC5C,eAAe,MAAM,kBAAkB,SAAY,SAAY,0BAA0B,MAAM,aAAa;AAAA,EAC9G,CAAC;AACH;AAEO,SAAS,0BAA0B,UAA6B;AACrE,SAAO,oBAAoB,QAAQ;AACrC;AAEA,eAAe,aAAa,OAA6C;AACvE,QAAM,cAAc,wBAAwB,MAAM,WAAW;AAC7D,MAAI,CAAC,YAAa,OAAM,UAAU,yCAAyC;AAE3E,QAAM,MAAM,MAAM,MAAM,YAAY,QAAQ,aAAa;AAAA,IACvD,UAAU,wBAAwB,MAAM,QAAQ;AAAA,IAChD,gBAAgB,wBAAwB,MAAM,cAAc;AAAA,EAC9D,CAAC;AAED,SAAO;AAAA,IACL,cAAc,CAAC,CAAC,KAAK;AAAA,IACrB,UAAU,oBAAoB,KAAK,QAAQ;AAAA,IAC3C,eAAe,0BAA0B,KAAK,aAAa;AAAA,EAC7D;AACF;AAEA,eAAe,qBACb,IACA,YACA,UACiB;AACjB,QAAM,QAAgB,CAAC;AACvB,QAAM,eAAyB,CAAC;AAEhC,aAAW,SAAS,YAAY;AAC9B,UAAM,OAAO,MAAM,oBAAoB,IAAI,OAAO,QAAQ;AAC1D,QAAI,CAAC,MAAM;AACT,mBAAa,KAAK,KAAK;AAAA,IACzB,OAAO;AACL,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,SAAS,aAAa,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,KAAK,IAAI;AAChE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,sBAAsB,MAAM,GAAG,CAAC;AAAA,EACxE;AAEA,SAAO;AACT;AAEA,eAAe,oBACb,IACA,OACA,UACsB;AACtB,QAAM,QAAiC,QAAQ,KAAK,KAAK,IACrD,EAAE,IAAI,OAAO,WAAW,KAAK,IAC7B,EAAE,MAAM,OAAO,WAAW,KAAK;AACnC,MAAI,SAAU,OAAM,WAAW;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,EACnC;AACF;AAEA,SAAS,+BACP,UACA,WAKM;AACN,MAAI,UAAU,cAAc;AAC1B,UAAM,UAAU,yDAAyD;AAAA,EAC3E;AAEA,QAAM,yBAAyB,SAAS,SAAS,OAAO,CAAC,UAAU,UAAU,GAAG;AAChF,aAAW,WAAW,UAAU,UAAU;AACxC,QAAI,YAAY,KAAK;AACnB,YAAM,UAAU,6DAA6D;AAAA,IAC/E;AACA,QAAI,kBAAkB,OAAO,GAAG;AAC9B,UAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,cAAM,UAAU,iCAAiC,OAAO,GAAG;AAAA,MAC7D;AACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,YAAM,UAAU,wBAAwB,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AAEA,MAAI,UAAU,kBAAkB,QAAW;AACzC,qCAAiC,SAAS,eAAe,UAAU,aAAa;AAAA,EAClF;AACF;AAEA,SAAS,iCACP,oBACA,wBACM;AACN,MAAI,uBAAuB,QAAQ,mBAAmB,SAAS,SAAS,EAAG;AAE3E,MAAI,2BAA2B,QAAQ,uBAAuB,SAAS,SAAS,GAAG;AACjF,UAAM,UAAU,gDAAgD;AAAA,EAClE;AAEA,aAAW,kBAAkB,wBAAwB;AACnD,QAAI,CAAC,mBAAmB,SAAS,cAAc,GAAG;AAChD,YAAM,UAAU,uDAAuD;AAAA,IACzE;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAA2B;AACtD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,QAAkC;AACnE,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,SAAO,oBAAoB,MAAM;AACnC;AAEA,SAAS,wBAAwB,OAA+B;AAC9D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,kBAAkB,SAA0B;AACnD,SAAO,QAAQ,SAAS,IAAI;AAC9B;",
+  "sourcesContent": ["import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Role, RoleAcl, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\ntype ActorAcl = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype GrantCheckContext = {\n  em: EntityManager\n  rbacService: RbacService\n  actorUserId: string | null | undefined\n  tenantId: string | null | undefined\n  organizationId?: string | null | undefined\n}\n\ntype RoleGrantCheckInput = GrantCheckContext & {\n  roles: Role[]\n}\n\ntype RoleTokenGrantCheckInput = GrantCheckContext & {\n  roleTokens: unknown\n}\n\ntype FeatureGrantCheckInput = GrantCheckContext & {\n  features: unknown\n  isSuperAdmin?: boolean\n  organizations?: string[] | null\n}\n\ntype SuperAdminUserTargetInput = GrantCheckContext & {\n  targetUserId: string\n  actorIsSuperAdmin?: boolean\n}\n\ntype SuperAdminRoleTargetInput = GrantCheckContext & {\n  targetRoleId: string\n  actorIsSuperAdmin?: boolean\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {\n  const tokens = normalizeStringList(input.roleTokens)\n  if (!tokens.length) return []\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const roles = await resolveRolesForGrant(input.em, tokens, tenantId)\n  await assertActorCanGrantRoles({ ...input, tenantId, roles })\n  return roles\n}\n\nexport async function assertActorCanGrantRoles(input: RoleGrantCheckInput): Promise<void> {\n  if (!input.roles.length) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const actorAcl = await loadActorAcl({ ...input, tenantId })\n  if (actorAcl.isSuperAdmin) return\n\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant roles.')\n  }\n\n  for (const role of input.roles) {\n    const roleTenantId = normalizeNullableString(role.tenantId)\n    if (roleTenantId !== tenantId) {\n      throw forbidden('Cannot grant a role outside the target tenant.')\n    }\n\n    const acl = await findOneWithDecryption(\n      input.em,\n      RoleAcl,\n      { role, tenantId } as FilterQuery<RoleAcl>,\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!acl) continue\n\n    assertActorCanGrantAclSnapshot(actorAcl, {\n      isSuperAdmin: !!acl.isSuperAdmin,\n      features: normalizeStringList(acl.featuresJson),\n      organizations: normalizeOrganizationList(acl.organizationsJson),\n    })\n  }\n}\n\nexport async function assertActorCanGrantAcl(input: FeatureGrantCheckInput): Promise<void> {\n  const actorAcl = await loadActorAcl(input)\n  if (actorAcl.isSuperAdmin) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant ACL features.')\n  }\n\n  assertActorCanGrantAclSnapshot(actorAcl, {\n    isSuperAdmin: !!input.isSuperAdmin,\n    features: normalizeStringList(input.features),\n    organizations: input.organizations === undefined ? undefined : normalizeOrganizationList(input.organizations),\n  })\n}\n\nexport function normalizeGrantFeatureList(features: unknown): string[] {\n  return normalizeStringList(features)\n}\n\nexport async function assertActorCanModifySuperAdminUserTarget(input: SuperAdminUserTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isUserEffectivelySuperAdmin(input.em, input.targetUserId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator accounts.')\n  }\n}\n\nexport async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isRoleEffectivelySuperAdmin(input.em, input.targetRoleId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator roles.')\n  }\n}\n\nasync function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSuperAdmin?: boolean }): Promise<boolean> {\n  if (typeof input.actorIsSuperAdmin === 'boolean') return input.actorIsSuperAdmin\n  const acl = await loadActorAcl(input)\n  return acl.isSuperAdmin\n}\n\nexport async function isUserEffectivelySuperAdmin(em: EntityManager, userId: string): Promise<boolean> {\n  const directGrant = await em.findOne(\n    UserAcl,\n    { user: userId as unknown, isSuperAdmin: true } as FilterQuery<UserAcl>,\n  )\n  if (directGrant && (directGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true) return true\n  const links = await findWithDecryption(\n    em,\n    UserRole,\n    { user: userId as unknown } as FilterQuery<UserRole>,\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const roleIds = (Array.isArray(links) ? links : [])\n    .map((link) => {\n      const role = (link as { role?: { id?: unknown } | string | null }).role\n      if (!role) return null\n      if (typeof role === 'string') return role\n      return role.id ? String(role.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (!roleIds.length) return false\n  const roleGrant = await em.findOne(\n    RoleAcl,\n    { role: { $in: roleIds } as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!roleGrant && (roleGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function isRoleEffectivelySuperAdmin(em: EntityManager, roleId: string): Promise<boolean> {\n  const grant = await em.findOne(\n    RoleAcl,\n    { role: roleId as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!grant && (grant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function listSuperAdminUserIds(em: EntityManager, tenantId: string | null): Promise<Set<string>> {\n  const ids = new Set<string>()\n  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true }\n  if (tenantId) userAclFilter.tenantId = tenantId\n  const userAcls = await em.find(UserAcl, userAclFilter as FilterQuery<UserAcl>)\n  for (const acl of userAcls) {\n    const userRef = (acl as { user?: { id?: unknown } | string | null }).user\n    const userId = userRef && typeof userRef === 'object'\n      ? userRef.id\n      : userRef\n    if (userId) ids.add(String(userId))\n  }\n  const roleAcls = await em.find(\n    RoleAcl,\n    { isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  const roleIds = roleAcls\n    .map((acl) => {\n      const roleRef = (acl as { role?: { id?: unknown } | string | null }).role\n      if (!roleRef) return null\n      if (typeof roleRef === 'string') return roleRef\n      return roleRef.id ? String(roleRef.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (roleIds.length) {\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { role: { $in: roleIds } as unknown } as FilterQuery<UserRole>,\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    for (const link of Array.isArray(links) ? links : []) {\n      const userRef = (link as { user?: { id?: unknown } | string | null }).user\n      const userId = userRef && typeof userRef === 'object'\n        ? userRef.id\n        : userRef\n      if (userId) ids.add(String(userId))\n    }\n  }\n  return ids\n}\n\nasync function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {\n  const actorUserId = normalizeNullableString(input.actorUserId)\n  if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')\n\n  const acl = await input.rbacService.loadAcl(actorUserId, {\n    tenantId: normalizeNullableString(input.tenantId),\n    organizationId: normalizeNullableString(input.organizationId),\n  })\n\n  return {\n    isSuperAdmin: !!acl?.isSuperAdmin,\n    features: normalizeStringList(acl?.features),\n    organizations: normalizeOrganizationList(acl?.organizations),\n  }\n}\n\nasync function resolveRolesForGrant(\n  em: EntityManager,\n  roleTokens: string[],\n  tenantId: string | null,\n): Promise<Role[]> {\n  const roles: Role[] = []\n  const missingRoles: string[] = []\n\n  for (const token of roleTokens) {\n    const role = await resolveRoleForGrant(em, token, tenantId)\n    if (!role) {\n      missingRoles.push(token)\n    } else {\n      roles.push(role)\n    }\n  }\n\n  if (missingRoles.length) {\n    const labels = missingRoles.map((role) => `\"${role}\"`).join(', ')\n    throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` })\n  }\n\n  return roles\n}\n\nasync function resolveRoleForGrant(\n  em: EntityManager,\n  token: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const where: Record<string, unknown> = UUID_RE.test(token)\n    ? { id: token, deletedAt: null }\n    : { name: token, deletedAt: null }\n  if (tenantId) where.tenantId = tenantId\n  return findOneWithDecryption(\n    em,\n    Role,\n    where as FilterQuery<Role>,\n    {},\n    { tenantId, organizationId: null },\n  )\n}\n\nfunction assertActorCanGrantAclSnapshot(\n  actorAcl: ActorAcl,\n  requested: {\n    isSuperAdmin: boolean\n    features: string[]\n    organizations?: string[] | null\n  },\n): void {\n  if (requested.isSuperAdmin) {\n    throw forbidden('Only super administrators can grant super admin access.')\n  }\n\n  const actorGrantableFeatures = actorAcl.features.filter((grant) => grant !== '*')\n  for (const feature of requested.features) {\n    if (feature === '*') {\n      throw forbidden('Only super administrators can grant global wildcard access.')\n    }\n    if (isWildcardFeature(feature)) {\n      if (!hasFeature(actorGrantableFeatures, feature)) {\n        throw forbidden(`Cannot grant feature wildcard ${feature}.`)\n      }\n      continue\n    }\n    if (!hasFeature(actorGrantableFeatures, feature)) {\n      throw forbidden(`Cannot grant feature ${feature}.`)\n    }\n  }\n\n  if (requested.organizations !== undefined) {\n    assertActorCanGrantOrganizations(actorAcl.organizations, requested.organizations)\n  }\n}\n\nfunction assertActorCanGrantOrganizations(\n  actorOrganizations: string[] | null,\n  requestedOrganizations: string[] | null,\n): void {\n  if (actorOrganizations === null || actorOrganizations.includes('__all__')) return\n\n  if (requestedOrganizations === null || requestedOrganizations.includes('__all__')) {\n    throw forbidden('Cannot grant unrestricted organization access.')\n  }\n\n  for (const organizationId of requestedOrganizations) {\n    if (!actorOrganizations.includes(organizationId)) {\n      throw forbidden('Cannot grant organization access outside actor scope.')\n    }\n  }\n}\n\nfunction normalizeStringList(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  const dedup = new Set<string>()\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction normalizeOrganizationList(values: unknown): string[] | null {\n  if (values === null || values === undefined) return null\n  return normalizeStringList(values)\n}\n\nfunction normalizeNullableString(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nfunction isWildcardFeature(feature: string): boolean {\n  return feature.endsWith('.*')\n}\n"],
+  "mappings": "AACA,SAAS,eAAe,iBAAiB;AACzC,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,MAAM,SAAS,SAAS,gBAAgB;AAyCjD,MAAM,UAAU;AAEhB,eAAsB,8BAA8B,OAAkD;AACpG,QAAM,SAAS,oBAAoB,MAAM,UAAU;AACnD,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,QAAQ,MAAM,qBAAqB,MAAM,IAAI,QAAQ,QAAQ;AACnE,QAAM,yBAAyB,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,eAAsB,yBAAyB,OAA2C;AACxF,MAAI,CAAC,MAAM,MAAM,OAAQ;AAEzB,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,WAAW,MAAM,aAAa,EAAE,GAAG,OAAO,SAAS,CAAC;AAC1D,MAAI,SAAS,aAAc;AAE3B,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,4CAA4C;AAAA,EAC9D;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,UAAM,eAAe,wBAAwB,KAAK,QAAQ;AAC1D,QAAI,iBAAiB,UAAU;AAC7B,YAAM,UAAU,gDAAgD;AAAA,IAClE;AAEA,UAAM,MAAM,MAAM;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA,EAAE,MAAM,SAAS;AAAA,MACjB,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,IAAK;AAEV,mCAA+B,UAAU;AAAA,MACvC,cAAc,CAAC,CAAC,IAAI;AAAA,MACpB,UAAU,oBAAoB,IAAI,YAAY;AAAA,MAC9C,eAAe,0BAA0B,IAAI,iBAAiB;AAAA,IAChE,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,uBAAuB,OAA8C;AACzF,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,MAAI,SAAS,aAAc;AAE3B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,mDAAmD;AAAA,EACrE;AAEA,iCAA+B,UAAU;AAAA,IACvC,cAAc,CAAC,CAAC,MAAM;AAAA,IACtB,UAAU,oBAAoB,MAAM,QAAQ;AAAA,IAC5C,eAAe,MAAM,kBAAkB,SAAY,SAAY,0BAA0B,MAAM,aAAa;AAAA,EAC9G,CAAC;AACH;AAEO,SAAS,0BAA0B,UAA6B;AACrE,SAAO,oBAAoB,QAAQ;AACrC;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,oEAAoE;AAAA,EACtF;AACF;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,iEAAiE;AAAA,EACnF;AACF;AAEA,eAAe,yBAAyB,OAA8E;AACpH,MAAI,OAAO,MAAM,sBAAsB,UAAW,QAAO,MAAM;AAC/D,QAAM,MAAM,MAAM,aAAa,KAAK;AACpC,SAAO,IAAI;AACb;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,cAAc,MAAM,GAAG;AAAA,IAC3B;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,MAAI,eAAgB,YAA2C,iBAAiB,KAAM,QAAO;AAC7F,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,OAAkB;AAAA,IAC1B,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9C,IAAI,CAAC,SAAS;AACb,UAAM,OAAQ,KAAqD;AACnE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,WAAO,KAAK,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,EACrC,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,YAAY,MAAM,GAAG;AAAA,IACzB;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,QAAQ,GAAc,cAAc,KAAK;AAAA,EAC1D;AACA,SAAO,CAAC,CAAC,aAAc,UAAyC,iBAAiB;AACnF;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,QAAQ,MAAM,GAAG;AAAA,IACrB;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,SAAO,CAAC,CAAC,SAAU,MAAqC,iBAAiB;AAC3E;AAEA,eAAsB,sBAAsB,IAAmB,UAA+C;AAC5G,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,gBAAyC,EAAE,cAAc,KAAK;AACpE,MAAI,SAAU,eAAc,WAAW;AACvC,QAAM,WAAW,MAAM,GAAG,KAAK,SAAS,aAAqC;AAC7E,aAAW,OAAO,UAAU;AAC1B,UAAM,UAAW,IAAoD;AACrE,UAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,QAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,EACpC;AACA,QAAM,WAAW,MAAM,GAAG;AAAA,IACxB;AAAA,IACA,EAAE,cAAc,KAAK;AAAA,EACvB;AACA,QAAM,UAAU,SACb,IAAI,CAAC,QAAQ;AACZ,UAAM,UAAW,IAAoD;AACrE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,OAAO,YAAY,SAAU,QAAO;AACxC,WAAO,QAAQ,KAAK,OAAO,QAAQ,EAAE,IAAI;AAAA,EAC3C,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,QAAQ,QAAQ;AAClB,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,MACpC,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,eAAW,QAAQ,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAAG;AACpD,YAAM,UAAW,KAAqD;AACtE,YAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,UAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,aAAa,OAA6C;AACvE,QAAM,cAAc,wBAAwB,MAAM,WAAW;AAC7D,MAAI,CAAC,YAAa,OAAM,UAAU,yCAAyC;AAE3E,QAAM,MAAM,MAAM,MAAM,YAAY,QAAQ,aAAa;AAAA,IACvD,UAAU,wBAAwB,MAAM,QAAQ;AAAA,IAChD,gBAAgB,wBAAwB,MAAM,cAAc;AAAA,EAC9D,CAAC;AAED,SAAO;AAAA,IACL,cAAc,CAAC,CAAC,KAAK;AAAA,IACrB,UAAU,oBAAoB,KAAK,QAAQ;AAAA,IAC3C,eAAe,0BAA0B,KAAK,aAAa;AAAA,EAC7D;AACF;AAEA,eAAe,qBACb,IACA,YACA,UACiB;AACjB,QAAM,QAAgB,CAAC;AACvB,QAAM,eAAyB,CAAC;AAEhC,aAAW,SAAS,YAAY;AAC9B,UAAM,OAAO,MAAM,oBAAoB,IAAI,OAAO,QAAQ;AAC1D,QAAI,CAAC,MAAM;AACT,mBAAa,KAAK,KAAK;AAAA,IACzB,OAAO;AACL,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,SAAS,aAAa,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,KAAK,IAAI;AAChE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,sBAAsB,MAAM,GAAG,CAAC;AAAA,EACxE;AAEA,SAAO;AACT;AAEA,eAAe,oBACb,IACA,OACA,UACsB;AACtB,QAAM,QAAiC,QAAQ,KAAK,KAAK,IACrD,EAAE,IAAI,OAAO,WAAW,KAAK,IAC7B,EAAE,MAAM,OAAO,WAAW,KAAK;AACnC,MAAI,SAAU,OAAM,WAAW;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,EACnC;AACF;AAEA,SAAS,+BACP,UACA,WAKM;AACN,MAAI,UAAU,cAAc;AAC1B,UAAM,UAAU,yDAAyD;AAAA,EAC3E;AAEA,QAAM,yBAAyB,SAAS,SAAS,OAAO,CAAC,UAAU,UAAU,GAAG;AAChF,aAAW,WAAW,UAAU,UAAU;AACxC,QAAI,YAAY,KAAK;AACnB,YAAM,UAAU,6DAA6D;AAAA,IAC/E;AACA,QAAI,kBAAkB,OAAO,GAAG;AAC9B,UAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,cAAM,UAAU,iCAAiC,OAAO,GAAG;AAAA,MAC7D;AACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,YAAM,UAAU,wBAAwB,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AAEA,MAAI,UAAU,kBAAkB,QAAW;AACzC,qCAAiC,SAAS,eAAe,UAAU,aAAa;AAAA,EAClF;AACF;AAEA,SAAS,iCACP,oBACA,wBACM;AACN,MAAI,uBAAuB,QAAQ,mBAAmB,SAAS,SAAS,EAAG;AAE3E,MAAI,2BAA2B,QAAQ,uBAAuB,SAAS,SAAS,GAAG;AACjF,UAAM,UAAU,gDAAgD;AAAA,EAClE;AAEA,aAAW,kBAAkB,wBAAwB;AACnD,QAAI,CAAC,mBAAmB,SAAS,cAAc,GAAG;AAChD,YAAM,UAAU,uDAAuD;AAAA,IACzE;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAA2B;AACtD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,QAAkC;AACnE,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,SAAO,oBAAoB,MAAM;AACnC;AAEA,SAAS,wBAAwB,OAA+B;AAC9D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,kBAAkB,SAA0B;AACnD,SAAO,QAAQ,SAAS,IAAI;AAC9B;",
   "names": []
 }

package/dist/modules/business_rules/lib/expression-evaluator.js

@@ -1,3 +1,4 @@
+import { testLinearRegex } from "@open-mercato/shared/lib/regex/linear";
 import { getNestedValue, resolveSpecialValue } from "./value-resolver.js";
 function evaluateExpression(expression, data, context) {
   if (isGroupCondition(expression)) {
@@ -154,8 +155,8 @@ function endsWith(str, suffix) {
   if (str == null || suffix == null) return false;
   return String(str).endsWith(String(suffix));
 }
-const REGEX_TIMEOUT_MS = 100;
 const MAX_REGEX_LENGTH = 200;
+const MAX_REGEX_INPUT_LENGTH = 1e4;
 function matches(str, pattern) {
   if (str == null || pattern == null) return false;
   try {
@@ -166,14 +167,15 @@ function matches(str, pattern) {
     if (/(\(.*[+*]\).*[+*])/.test(patternStr)) {
       return false;
     }
-    const regex = new RegExp(patternStr);
     const testStr = String(str);
-    const startTime = Date.now();
-    const result = regex.test(testStr);
-    if (Date.now() - startTime > REGEX_TIMEOUT_MS) {
-      throw new Error("Regex execution timeout - potential ReDoS pattern detected");
+    if (testStr.length > MAX_REGEX_INPUT_LENGTH) {
+      return false;
     }
-    return result;
+    const result = testLinearRegex(patternStr, testStr, {
+      maxPatternLength: MAX_REGEX_LENGTH,
+      maxInputLength: MAX_REGEX_INPUT_LENGTH
+    });
+    return result.ok ? result.matched : false;
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
     if (process.env.NODE_ENV !== "test") {

package/dist/modules/business_rules/lib/expression-evaluator.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/business_rules/lib/expression-evaluator.ts"],
-  "sourcesContent": ["import type { ComparisonOperator, LogicalOperator } from '../data/validators'\nimport { getNestedValue, resolveSpecialValue } from './value-resolver'\n\n/**\n * Type definitions for condition expressions\n */\nexport type ConditionExpression = SimpleCondition | GroupCondition\n\nexport interface SimpleCondition {\n  field: string\n  operator: ComparisonOperator\n  value: any\n  valueField?: string // For field-to-field comparison\n}\n\nexport interface GroupCondition {\n  operator: LogicalOperator // 'AND' | 'OR' | 'NOT'\n  rules: ConditionExpression[]\n}\n\nexport interface EvaluationContext {\n  user?: {\n    id?: string\n    email?: string\n    role?: string\n    [key: string]: any\n  }\n  tenant?: {\n    id?: string\n    [key: string]: any\n  }\n  organization?: {\n    id?: string\n    [key: string]: any\n  }\n  now?: Date\n  today?: Date\n  [key: string]: any\n}\n\n/**\n * Evaluate a condition expression (simple or grouped)\n */\nexport function evaluateExpression(\n  expression: ConditionExpression,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  if (isGroupCondition(expression)) {\n    return evaluateGroupCondition(expression, data, context)\n  }\n\n  return evaluateSimpleCondition(expression, data, context)\n}\n\n/**\n * Check if expression is a group condition\n */\nfunction isGroupCondition(expression: ConditionExpression): expression is GroupCondition {\n  return 'rules' in expression && Array.isArray(expression.rules)\n}\n\n/**\n * Evaluate a simple condition\n */\nfunction evaluateSimpleCondition(\n  condition: SimpleCondition,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  // Left side: always resolve from data (field path)\n  const leftValue = resolveFieldPath(condition.field, data)\n\n  let rightValue: any\n  if (condition.valueField) {\n    // Field-to-field comparison: resolve from data\n    rightValue = resolveFieldPath(condition.valueField, data)\n  } else {\n    // Static value or special value\n    rightValue = resolveStaticOrSpecialValue(condition.value, context)\n  }\n\n  const result = applyOperator(leftValue, condition.operator, rightValue)\n\n  // Detailed logging for debugging\n  console.log('[RULE EVAL] Simple condition:', {\n    field: condition.field,\n    operator: condition.operator,\n    expectedValue: rightValue,\n    actualValue: leftValue,\n    actualValueType: typeof leftValue,\n    result: result ? '\u2713 PASS' : '\u2717 FAIL',\n  })\n\n  return result\n}\n\n/**\n * Evaluate a group condition (AND, OR, NOT)\n */\nfunction evaluateGroupCondition(\n  condition: GroupCondition,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  const { operator, rules } = condition\n\n  if (!rules || rules.length === 0) {\n    return true\n  }\n\n  console.log(`[RULE EVAL] Group condition: ${operator} with ${rules.length} rules`)\n\n  let result: boolean\n\n  switch (operator) {\n    case 'AND':\n      result = rules.every((rule) => evaluateExpression(rule, data, context))\n      break\n\n    case 'OR':\n      result = rules.some((rule) => evaluateExpression(rule, data, context))\n      break\n\n    case 'NOT':\n      // NOT operator - negate the first rule (or all rules combined with AND)\n      if (rules.length === 1) {\n        result = !evaluateExpression(rules[0], data, context)\n      } else {\n        // Multiple rules - combine with AND then negate\n        result = !rules.every((rule) => evaluateExpression(rule, data, context))\n      }\n      break\n\n    default:\n      throw new Error(`Unknown logical operator: ${operator}`)\n  }\n\n  console.log(`[RULE EVAL] Group ${operator} result: ${result ? '\u2713 PASS' : '\u2717 FAIL'}`)\n\n  return result\n}\n\n/**\n * Resolve a field path from data\n */\nfunction resolveFieldPath(path: string, data: any): any {\n  return getNestedValue(data, path)\n}\n\n/**\n * Resolve a static value or special template value\n */\nfunction resolveStaticOrSpecialValue(value: any, context: EvaluationContext): any {\n  // If not a string, return as-is (already a value)\n  if (typeof value !== 'string') {\n    return value\n  }\n\n  // Check for special values (template variables)\n  if (value.startsWith('{{') && value.endsWith('}}')) {\n    return resolveSpecialValue(value, context)\n  }\n\n  // Return static string value as-is\n  return value\n}\n\n/**\n * Apply a comparison operator\n */\nfunction applyOperator(left: any, operator: ComparisonOperator, right: any): boolean {\n  switch (operator) {\n    case '=':\n    case '==':\n      return equals(left, right)\n\n    case '!=':\n      return !equals(left, right)\n\n    case '>':\n      return compare(left, right) > 0\n\n    case '>=':\n      return compare(left, right) >= 0\n\n    case '<':\n      return compare(left, right) < 0\n\n    case '<=':\n      return compare(left, right) <= 0\n\n    case 'IN':\n      return isIn(left, right)\n\n    case 'NOT_IN':\n      return !isIn(left, right)\n\n    case 'CONTAINS':\n      return contains(left, right)\n\n    case 'NOT_CONTAINS':\n      return !contains(left, right)\n\n    case 'STARTS_WITH':\n      return startsWith(left, right)\n\n    case 'ENDS_WITH':\n      return endsWith(left, right)\n\n    case 'MATCHES':\n      return matches(left, right)\n\n    case 'IS_EMPTY':\n      return isEmpty(left)\n\n    case 'IS_NOT_EMPTY':\n      return !isEmpty(left)\n\n    default:\n      throw new Error(`Unknown operator: ${operator}`)\n  }\n}\n\n/**\n * Equality comparison (handles different types)\n */\nfunction equals(left: any, right: any): boolean {\n  // Handle null/undefined\n  if (left == null && right == null) return true\n  if (left == null || right == null) return false\n\n  // Type coercion for numbers\n  if (typeof left === 'number' || typeof right === 'number') {\n    return Number(left) === Number(right)\n  }\n\n  // String comparison (case-sensitive)\n  return left === right\n}\n\n/**\n * Comparison for ordering (>, <, >=, <=)\n */\nfunction compare(left: any, right: any): number {\n  // Handle null/undefined\n  if (left == null && right == null) return 0\n  if (left == null) return -1\n  if (right == null) return 1\n\n  // Date comparison\n  if (left instanceof Date && right instanceof Date) {\n    return left.getTime() - right.getTime()\n  }\n\n  // String date comparison\n  if (isDateString(left) && isDateString(right)) {\n    return new Date(left).getTime() - new Date(right).getTime()\n  }\n\n  // Numeric comparison\n  const leftNum = Number(left)\n  const rightNum = Number(right)\n  if (!isNaN(leftNum) && !isNaN(rightNum)) {\n    return leftNum - rightNum\n  }\n\n  // String comparison\n  const leftStr = String(left)\n  const rightStr = String(right)\n  return leftStr.localeCompare(rightStr)\n}\n\n/**\n * Check if value is in array\n */\nfunction isIn(value: any, array: any): boolean {\n  if (!Array.isArray(array)) {\n    return false\n  }\n\n  return array.some((item) => equals(value, item))\n}\n\n/**\n * Check if array/string contains value\n */\nfunction contains(container: any, value: any): boolean {\n  if (container == null) return false\n\n  // Array contains\n  if (Array.isArray(container)) {\n    return container.some((item) => equals(item, value))\n  }\n\n  // String contains\n  if (typeof container === 'string') {\n    return container.includes(String(value))\n  }\n\n  return false\n}\n\n/**\n * Check if string starts with value\n */\nfunction startsWith(str: any, prefix: any): boolean {\n  if (str == null || prefix == null) return false\n\n  return String(str).startsWith(String(prefix))\n}\n\n/**\n * Check if string ends with value\n */\nfunction endsWith(str: any, suffix: any): boolean {\n  if (str == null || suffix == null) return false\n\n  return String(str).endsWith(String(suffix))\n}\n\n/**\n * Security limits for regex operations\n */\nconst REGEX_TIMEOUT_MS = 100\nconst MAX_REGEX_LENGTH = 200\n\n/**\n * Check if string matches regex pattern (with ReDoS protection)\n */\nfunction matches(str: any, pattern: any): boolean {\n  if (str == null || pattern == null) return false\n\n  try {\n    const patternStr = String(pattern)\n\n    // Prevent overly long patterns\n    if (patternStr.length > MAX_REGEX_LENGTH) {\n      return false\n    }\n\n    // Check for dangerous patterns that can cause exponential backtracking\n    // Patterns like (a+)+, (a*)*, (a+)*, etc.\n    if (/(\\(.*[+*]\\).*[+*])/.test(patternStr)) {\n      return false\n    }\n\n    const regex = new RegExp(patternStr)\n    const testStr = String(str)\n\n    // Use a simple timeout mechanism\n    const startTime = Date.now()\n    const result = regex.test(testStr)\n\n    if (Date.now() - startTime > REGEX_TIMEOUT_MS) {\n      throw new Error('Regex execution timeout - potential ReDoS pattern detected')\n    }\n\n    return result\n  } catch (error) {\n    // Log the error for debugging but don't expose to user\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    if (process.env.NODE_ENV !== 'test') {\n      console.error('Regex matching failed:', message)\n    }\n    return false\n  }\n}\n\n/**\n * Check if value is empty (null, undefined, empty string, empty array, empty object)\n */\nfunction isEmpty(value: any): boolean {\n  if (value == null) return true\n\n  if (typeof value === 'string') return value.trim() === ''\n\n  if (Array.isArray(value)) return value.length === 0\n\n  if (typeof value === 'object') return Object.keys(value).length === 0\n\n  return false\n}\n\n/**\n * Check if string looks like a date (ISO format or common date formats)\n */\nfunction isDateString(value: any): boolean {\n  if (typeof value !== 'string') return false\n\n  // ISO date format: YYYY-MM-DD or YYYY-MM-DDTHH:mm:ss\n  const isoDateRegex = /^\\d{4}-\\d{2}-\\d{2}(T\\d{2}:\\d{2}:\\d{2})?/\n  if (isoDateRegex.test(value)) {\n    const date = new Date(value)\n    return !isNaN(date.getTime())\n  }\n\n  return false\n}\n"],
-  "mappings": "AACA,SAAS,gBAAgB,2BAA2B;AA0C7C,SAAS,mBACd,YACA,MACA,SACS;AACT,MAAI,iBAAiB,UAAU,GAAG;AAChC,WAAO,uBAAuB,YAAY,MAAM,OAAO;AAAA,EACzD;AAEA,SAAO,wBAAwB,YAAY,MAAM,OAAO;AAC1D;AAKA,SAAS,iBAAiB,YAA+D;AACvF,SAAO,WAAW,cAAc,MAAM,QAAQ,WAAW,KAAK;AAChE;AAKA,SAAS,wBACP,WACA,MACA,SACS;AAET,QAAM,YAAY,iBAAiB,UAAU,OAAO,IAAI;AAExD,MAAI;AACJ,MAAI,UAAU,YAAY;AAExB,iBAAa,iBAAiB,UAAU,YAAY,IAAI;AAAA,EAC1D,OAAO;AAEL,iBAAa,4BAA4B,UAAU,OAAO,OAAO;AAAA,EACnE;AAEA,QAAM,SAAS,cAAc,WAAW,UAAU,UAAU,UAAU;AAGtE,UAAQ,IAAI,iCAAiC;AAAA,IAC3C,OAAO,UAAU;AAAA,IACjB,UAAU,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,aAAa;AAAA,IACb,iBAAiB,OAAO;AAAA,IACxB,QAAQ,SAAS,gBAAW;AAAA,EAC9B,CAAC;AAED,SAAO;AACT;AAKA,SAAS,uBACP,WACA,MACA,SACS;AACT,QAAM,EAAE,UAAU,MAAM,IAAI;AAE5B,MAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,WAAO;AAAA,EACT;AAEA,UAAQ,IAAI,gCAAgC,QAAQ,SAAS,MAAM,MAAM,QAAQ;AAEjF,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,eAAS,MAAM,MAAM,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AACtE;AAAA,IAEF,KAAK;AACH,eAAS,MAAM,KAAK,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AACrE;AAAA,IAEF,KAAK;AAEH,UAAI,MAAM,WAAW,GAAG;AACtB,iBAAS,CAAC,mBAAmB,MAAM,CAAC,GAAG,MAAM,OAAO;AAAA,MACtD,OAAO;AAEL,iBAAS,CAAC,MAAM,MAAM,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AAAA,MACzE;AACA;AAAA,IAEF;AACE,YAAM,IAAI,MAAM,6BAA6B,QAAQ,EAAE;AAAA,EAC3D;AAEA,UAAQ,IAAI,qBAAqB,QAAQ,YAAY,SAAS,gBAAW,aAAQ,EAAE;AAEnF,SAAO;AACT;AAKA,SAAS,iBAAiB,MAAc,MAAgB;AACtD,SAAO,eAAe,MAAM,IAAI;AAClC;AAKA,SAAS,4BAA4B,OAAY,SAAiC;AAEhF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,IAAI,GAAG;AAClD,WAAO,oBAAoB,OAAO,OAAO;AAAA,EAC3C;AAGA,SAAO;AACT;AAKA,SAAS,cAAc,MAAW,UAA8B,OAAqB;AACnF,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,MAAM,KAAK;AAAA,IAE3B,KAAK;AACH,aAAO,CAAC,OAAO,MAAM,KAAK;AAAA,IAE5B,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,IAAI;AAAA,IAEhC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,KAAK;AAAA,IAEjC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,IAAI;AAAA,IAEhC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,KAAK;AAAA,IAEjC,KAAK;AACH,aAAO,KAAK,MAAM,KAAK;AAAA,IAEzB,KAAK;AACH,aAAO,CAAC,KAAK,MAAM,KAAK;AAAA,IAE1B,KAAK;AACH,aAAO,SAAS,MAAM,KAAK;AAAA,IAE7B,KAAK;AACH,aAAO,CAAC,SAAS,MAAM,KAAK;AAAA,IAE9B,KAAK;AACH,aAAO,WAAW,MAAM,KAAK;AAAA,IAE/B,KAAK;AACH,aAAO,SAAS,MAAM,KAAK;AAAA,IAE7B,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK;AAAA,IAE5B,KAAK;AACH,aAAO,QAAQ,IAAI;AAAA,IAErB,KAAK;AACH,aAAO,CAAC,QAAQ,IAAI;AAAA,IAEtB;AACE,YAAM,IAAI,MAAM,qBAAqB,QAAQ,EAAE;AAAA,EACnD;AACF;AAKA,SAAS,OAAO,MAAW,OAAqB;AAE9C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAC1C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAG1C,MAAI,OAAO,SAAS,YAAY,OAAO,UAAU,UAAU;AACzD,WAAO,OAAO,IAAI,MAAM,OAAO,KAAK;AAAA,EACtC;AAGA,SAAO,SAAS;AAClB;AAKA,SAAS,QAAQ,MAAW,OAAoB;AAE9C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAC1C,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI,SAAS,KAAM,QAAO;AAG1B,MAAI,gBAAgB,QAAQ,iBAAiB,MAAM;AACjD,WAAO,KAAK,QAAQ,IAAI,MAAM,QAAQ;AAAA,EACxC;AAGA,MAAI,aAAa,IAAI,KAAK,aAAa,KAAK,GAAG;AAC7C,WAAO,IAAI,KAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,QAAQ;AAAA,EAC5D;AAGA,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,QAAQ,GAAG;AACvC,WAAO,UAAU;AAAA,EACnB;AAGA,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,WAAW,OAAO,KAAK;AAC7B,SAAO,QAAQ,cAAc,QAAQ;AACvC;AAKA,SAAS,KAAK,OAAY,OAAqB;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,OAAO,IAAI,CAAC;AACjD;AAKA,SAAS,SAAS,WAAgB,OAAqB;AACrD,MAAI,aAAa,KAAM,QAAO;AAG9B,MAAI,MAAM,QAAQ,SAAS,GAAG;AAC5B,WAAO,UAAU,KAAK,CAAC,SAAS,OAAO,MAAM,KAAK,CAAC;AAAA,EACrD;AAGA,MAAI,OAAO,cAAc,UAAU;AACjC,WAAO,UAAU,SAAS,OAAO,KAAK,CAAC;AAAA,EACzC;AAEA,SAAO;AACT;AAKA,SAAS,WAAW,KAAU,QAAsB;AAClD,MAAI,OAAO,QAAQ,UAAU,KAAM,QAAO;AAE1C,SAAO,OAAO,GAAG,EAAE,WAAW,OAAO,MAAM,CAAC;AAC9C;AAKA,SAAS,SAAS,KAAU,QAAsB;AAChD,MAAI,OAAO,QAAQ,UAAU,KAAM,QAAO;AAE1C,SAAO,OAAO,GAAG,EAAE,SAAS,OAAO,MAAM,CAAC;AAC5C;AAKA,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;AAKzB,SAAS,QAAQ,KAAU,SAAuB;AAChD,MAAI,OAAO,QAAQ,WAAW,KAAM,QAAO;AAE3C,MAAI;AACF,UAAM,aAAa,OAAO,OAAO;AAGjC,QAAI,WAAW,SAAS,kBAAkB;AACxC,aAAO;AAAA,IACT;AAIA,QAAI,qBAAqB,KAAK,UAAU,GAAG;AACzC,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,IAAI,OAAO,UAAU;AACnC,UAAM,UAAU,OAAO,GAAG;AAG1B,UAAM,YAAY,KAAK,IAAI;AAC3B,UAAM,SAAS,MAAM,KAAK,OAAO;AAEjC,QAAI,KAAK,IAAI,IAAI,YAAY,kBAAkB;AAC7C,YAAM,IAAI,MAAM,4DAA4D;AAAA,IAC9E;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AAEd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAI,QAAQ,IAAI,aAAa,QAAQ;AACnC,cAAQ,MAAM,0BAA0B,OAAO;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AACF;AAKA,SAAS,QAAQ,OAAqB;AACpC,MAAI,SAAS,KAAM,QAAO;AAE1B,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,KAAK,MAAM;AAEvD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,WAAW;AAElD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,KAAK,EAAE,WAAW;AAEpE,SAAO;AACT;AAKA,SAAS,aAAa,OAAqB;AACzC,MAAI,OAAO,UAAU,SAAU,QAAO;AAGtC,QAAM,eAAe;AACrB,MAAI,aAAa,KAAK,KAAK,GAAG;AAC5B,UAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,WAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;AAAA,EAC9B;AAEA,SAAO;AACT;",
+  "sourcesContent": ["import type { ComparisonOperator, LogicalOperator } from '../data/validators'\nimport { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'\nimport { getNestedValue, resolveSpecialValue } from './value-resolver'\n\n/**\n * Type definitions for condition expressions\n */\nexport type ConditionExpression = SimpleCondition | GroupCondition\n\nexport interface SimpleCondition {\n  field: string\n  operator: ComparisonOperator\n  value: any\n  valueField?: string // For field-to-field comparison\n}\n\nexport interface GroupCondition {\n  operator: LogicalOperator // 'AND' | 'OR' | 'NOT'\n  rules: ConditionExpression[]\n}\n\nexport interface EvaluationContext {\n  user?: {\n    id?: string\n    email?: string\n    role?: string\n    [key: string]: any\n  }\n  tenant?: {\n    id?: string\n    [key: string]: any\n  }\n  organization?: {\n    id?: string\n    [key: string]: any\n  }\n  now?: Date\n  today?: Date\n  [key: string]: any\n}\n\n/**\n * Evaluate a condition expression (simple or grouped)\n */\nexport function evaluateExpression(\n  expression: ConditionExpression,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  if (isGroupCondition(expression)) {\n    return evaluateGroupCondition(expression, data, context)\n  }\n\n  return evaluateSimpleCondition(expression, data, context)\n}\n\n/**\n * Check if expression is a group condition\n */\nfunction isGroupCondition(expression: ConditionExpression): expression is GroupCondition {\n  return 'rules' in expression && Array.isArray(expression.rules)\n}\n\n/**\n * Evaluate a simple condition\n */\nfunction evaluateSimpleCondition(\n  condition: SimpleCondition,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  // Left side: always resolve from data (field path)\n  const leftValue = resolveFieldPath(condition.field, data)\n\n  let rightValue: any\n  if (condition.valueField) {\n    // Field-to-field comparison: resolve from data\n    rightValue = resolveFieldPath(condition.valueField, data)\n  } else {\n    // Static value or special value\n    rightValue = resolveStaticOrSpecialValue(condition.value, context)\n  }\n\n  const result = applyOperator(leftValue, condition.operator, rightValue)\n\n  // Detailed logging for debugging\n  console.log('[RULE EVAL] Simple condition:', {\n    field: condition.field,\n    operator: condition.operator,\n    expectedValue: rightValue,\n    actualValue: leftValue,\n    actualValueType: typeof leftValue,\n    result: result ? '\u2713 PASS' : '\u2717 FAIL',\n  })\n\n  return result\n}\n\n/**\n * Evaluate a group condition (AND, OR, NOT)\n */\nfunction evaluateGroupCondition(\n  condition: GroupCondition,\n  data: any,\n  context: EvaluationContext\n): boolean {\n  const { operator, rules } = condition\n\n  if (!rules || rules.length === 0) {\n    return true\n  }\n\n  console.log(`[RULE EVAL] Group condition: ${operator} with ${rules.length} rules`)\n\n  let result: boolean\n\n  switch (operator) {\n    case 'AND':\n      result = rules.every((rule) => evaluateExpression(rule, data, context))\n      break\n\n    case 'OR':\n      result = rules.some((rule) => evaluateExpression(rule, data, context))\n      break\n\n    case 'NOT':\n      // NOT operator - negate the first rule (or all rules combined with AND)\n      if (rules.length === 1) {\n        result = !evaluateExpression(rules[0], data, context)\n      } else {\n        // Multiple rules - combine with AND then negate\n        result = !rules.every((rule) => evaluateExpression(rule, data, context))\n      }\n      break\n\n    default:\n      throw new Error(`Unknown logical operator: ${operator}`)\n  }\n\n  console.log(`[RULE EVAL] Group ${operator} result: ${result ? '\u2713 PASS' : '\u2717 FAIL'}`)\n\n  return result\n}\n\n/**\n * Resolve a field path from data\n */\nfunction resolveFieldPath(path: string, data: any): any {\n  return getNestedValue(data, path)\n}\n\n/**\n * Resolve a static value or special template value\n */\nfunction resolveStaticOrSpecialValue(value: any, context: EvaluationContext): any {\n  // If not a string, return as-is (already a value)\n  if (typeof value !== 'string') {\n    return value\n  }\n\n  // Check for special values (template variables)\n  if (value.startsWith('{{') && value.endsWith('}}')) {\n    return resolveSpecialValue(value, context)\n  }\n\n  // Return static string value as-is\n  return value\n}\n\n/**\n * Apply a comparison operator\n */\nfunction applyOperator(left: any, operator: ComparisonOperator, right: any): boolean {\n  switch (operator) {\n    case '=':\n    case '==':\n      return equals(left, right)\n\n    case '!=':\n      return !equals(left, right)\n\n    case '>':\n      return compare(left, right) > 0\n\n    case '>=':\n      return compare(left, right) >= 0\n\n    case '<':\n      return compare(left, right) < 0\n\n    case '<=':\n      return compare(left, right) <= 0\n\n    case 'IN':\n      return isIn(left, right)\n\n    case 'NOT_IN':\n      return !isIn(left, right)\n\n    case 'CONTAINS':\n      return contains(left, right)\n\n    case 'NOT_CONTAINS':\n      return !contains(left, right)\n\n    case 'STARTS_WITH':\n      return startsWith(left, right)\n\n    case 'ENDS_WITH':\n      return endsWith(left, right)\n\n    case 'MATCHES':\n      return matches(left, right)\n\n    case 'IS_EMPTY':\n      return isEmpty(left)\n\n    case 'IS_NOT_EMPTY':\n      return !isEmpty(left)\n\n    default:\n      throw new Error(`Unknown operator: ${operator}`)\n  }\n}\n\n/**\n * Equality comparison (handles different types)\n */\nfunction equals(left: any, right: any): boolean {\n  // Handle null/undefined\n  if (left == null && right == null) return true\n  if (left == null || right == null) return false\n\n  // Type coercion for numbers\n  if (typeof left === 'number' || typeof right === 'number') {\n    return Number(left) === Number(right)\n  }\n\n  // String comparison (case-sensitive)\n  return left === right\n}\n\n/**\n * Comparison for ordering (>, <, >=, <=)\n */\nfunction compare(left: any, right: any): number {\n  // Handle null/undefined\n  if (left == null && right == null) return 0\n  if (left == null) return -1\n  if (right == null) return 1\n\n  // Date comparison\n  if (left instanceof Date && right instanceof Date) {\n    return left.getTime() - right.getTime()\n  }\n\n  // String date comparison\n  if (isDateString(left) && isDateString(right)) {\n    return new Date(left).getTime() - new Date(right).getTime()\n  }\n\n  // Numeric comparison\n  const leftNum = Number(left)\n  const rightNum = Number(right)\n  if (!isNaN(leftNum) && !isNaN(rightNum)) {\n    return leftNum - rightNum\n  }\n\n  // String comparison\n  const leftStr = String(left)\n  const rightStr = String(right)\n  return leftStr.localeCompare(rightStr)\n}\n\n/**\n * Check if value is in array\n */\nfunction isIn(value: any, array: any): boolean {\n  if (!Array.isArray(array)) {\n    return false\n  }\n\n  return array.some((item) => equals(value, item))\n}\n\n/**\n * Check if array/string contains value\n */\nfunction contains(container: any, value: any): boolean {\n  if (container == null) return false\n\n  // Array contains\n  if (Array.isArray(container)) {\n    return container.some((item) => equals(item, value))\n  }\n\n  // String contains\n  if (typeof container === 'string') {\n    return container.includes(String(value))\n  }\n\n  return false\n}\n\n/**\n * Check if string starts with value\n */\nfunction startsWith(str: any, prefix: any): boolean {\n  if (str == null || prefix == null) return false\n\n  return String(str).startsWith(String(prefix))\n}\n\n/**\n * Check if string ends with value\n */\nfunction endsWith(str: any, suffix: any): boolean {\n  if (str == null || suffix == null) return false\n\n  return String(str).endsWith(String(suffix))\n}\n\nconst MAX_REGEX_LENGTH = 200\nconst MAX_REGEX_INPUT_LENGTH = 10_000\n\n/**\n * Check if string matches regex pattern (with ReDoS protection)\n */\nfunction matches(str: any, pattern: any): boolean {\n  if (str == null || pattern == null) return false\n\n  try {\n    const patternStr = String(pattern)\n\n    // Prevent overly long patterns\n    if (patternStr.length > MAX_REGEX_LENGTH) {\n      return false\n    }\n\n    // Check for dangerous patterns that can cause exponential backtracking\n    // Patterns like (a+)+, (a*)*, (a+)*, etc.\n    if (/(\\(.*[+*]\\).*[+*])/.test(patternStr)) {\n      return false\n    }\n\n    const testStr = String(str)\n    if (testStr.length > MAX_REGEX_INPUT_LENGTH) {\n      return false\n    }\n\n    const result = testLinearRegex(patternStr, testStr, {\n      maxPatternLength: MAX_REGEX_LENGTH,\n      maxInputLength: MAX_REGEX_INPUT_LENGTH,\n    })\n    return result.ok ? result.matched : false\n  } catch (error) {\n    // Log the error for debugging but don't expose to user\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    if (process.env.NODE_ENV !== 'test') {\n      console.error('Regex matching failed:', message)\n    }\n    return false\n  }\n}\n\n/**\n * Check if value is empty (null, undefined, empty string, empty array, empty object)\n */\nfunction isEmpty(value: any): boolean {\n  if (value == null) return true\n\n  if (typeof value === 'string') return value.trim() === ''\n\n  if (Array.isArray(value)) return value.length === 0\n\n  if (typeof value === 'object') return Object.keys(value).length === 0\n\n  return false\n}\n\n/**\n * Check if string looks like a date (ISO format or common date formats)\n */\nfunction isDateString(value: any): boolean {\n  if (typeof value !== 'string') return false\n\n  // ISO date format: YYYY-MM-DD or YYYY-MM-DDTHH:mm:ss\n  const isoDateRegex = /^\\d{4}-\\d{2}-\\d{2}(T\\d{2}:\\d{2}:\\d{2})?/\n  if (isoDateRegex.test(value)) {\n    const date = new Date(value)\n    return !isNaN(date.getTime())\n  }\n\n  return false\n}\n"],
+  "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,gBAAgB,2BAA2B;AA0C7C,SAAS,mBACd,YACA,MACA,SACS;AACT,MAAI,iBAAiB,UAAU,GAAG;AAChC,WAAO,uBAAuB,YAAY,MAAM,OAAO;AAAA,EACzD;AAEA,SAAO,wBAAwB,YAAY,MAAM,OAAO;AAC1D;AAKA,SAAS,iBAAiB,YAA+D;AACvF,SAAO,WAAW,cAAc,MAAM,QAAQ,WAAW,KAAK;AAChE;AAKA,SAAS,wBACP,WACA,MACA,SACS;AAET,QAAM,YAAY,iBAAiB,UAAU,OAAO,IAAI;AAExD,MAAI;AACJ,MAAI,UAAU,YAAY;AAExB,iBAAa,iBAAiB,UAAU,YAAY,IAAI;AAAA,EAC1D,OAAO;AAEL,iBAAa,4BAA4B,UAAU,OAAO,OAAO;AAAA,EACnE;AAEA,QAAM,SAAS,cAAc,WAAW,UAAU,UAAU,UAAU;AAGtE,UAAQ,IAAI,iCAAiC;AAAA,IAC3C,OAAO,UAAU;AAAA,IACjB,UAAU,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,aAAa;AAAA,IACb,iBAAiB,OAAO;AAAA,IACxB,QAAQ,SAAS,gBAAW;AAAA,EAC9B,CAAC;AAED,SAAO;AACT;AAKA,SAAS,uBACP,WACA,MACA,SACS;AACT,QAAM,EAAE,UAAU,MAAM,IAAI;AAE5B,MAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,WAAO;AAAA,EACT;AAEA,UAAQ,IAAI,gCAAgC,QAAQ,SAAS,MAAM,MAAM,QAAQ;AAEjF,MAAI;AAEJ,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,eAAS,MAAM,MAAM,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AACtE;AAAA,IAEF,KAAK;AACH,eAAS,MAAM,KAAK,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AACrE;AAAA,IAEF,KAAK;AAEH,UAAI,MAAM,WAAW,GAAG;AACtB,iBAAS,CAAC,mBAAmB,MAAM,CAAC,GAAG,MAAM,OAAO;AAAA,MACtD,OAAO;AAEL,iBAAS,CAAC,MAAM,MAAM,CAAC,SAAS,mBAAmB,MAAM,MAAM,OAAO,CAAC;AAAA,MACzE;AACA;AAAA,IAEF;AACE,YAAM,IAAI,MAAM,6BAA6B,QAAQ,EAAE;AAAA,EAC3D;AAEA,UAAQ,IAAI,qBAAqB,QAAQ,YAAY,SAAS,gBAAW,aAAQ,EAAE;AAEnF,SAAO;AACT;AAKA,SAAS,iBAAiB,MAAc,MAAgB;AACtD,SAAO,eAAe,MAAM,IAAI;AAClC;AAKA,SAAS,4BAA4B,OAAY,SAAiC;AAEhF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,IAAI,GAAG;AAClD,WAAO,oBAAoB,OAAO,OAAO;AAAA,EAC3C;AAGA,SAAO;AACT;AAKA,SAAS,cAAc,MAAW,UAA8B,OAAqB;AACnF,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,MAAM,KAAK;AAAA,IAE3B,KAAK;AACH,aAAO,CAAC,OAAO,MAAM,KAAK;AAAA,IAE5B,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,IAAI;AAAA,IAEhC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,KAAK;AAAA,IAEjC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,IAAI;AAAA,IAEhC,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK,KAAK;AAAA,IAEjC,KAAK;AACH,aAAO,KAAK,MAAM,KAAK;AAAA,IAEzB,KAAK;AACH,aAAO,CAAC,KAAK,MAAM,KAAK;AAAA,IAE1B,KAAK;AACH,aAAO,SAAS,MAAM,KAAK;AAAA,IAE7B,KAAK;AACH,aAAO,CAAC,SAAS,MAAM,KAAK;AAAA,IAE9B,KAAK;AACH,aAAO,WAAW,MAAM,KAAK;AAAA,IAE/B,KAAK;AACH,aAAO,SAAS,MAAM,KAAK;AAAA,IAE7B,KAAK;AACH,aAAO,QAAQ,MAAM,KAAK;AAAA,IAE5B,KAAK;AACH,aAAO,QAAQ,IAAI;AAAA,IAErB,KAAK;AACH,aAAO,CAAC,QAAQ,IAAI;AAAA,IAEtB;AACE,YAAM,IAAI,MAAM,qBAAqB,QAAQ,EAAE;AAAA,EACnD;AACF;AAKA,SAAS,OAAO,MAAW,OAAqB;AAE9C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAC1C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAG1C,MAAI,OAAO,SAAS,YAAY,OAAO,UAAU,UAAU;AACzD,WAAO,OAAO,IAAI,MAAM,OAAO,KAAK;AAAA,EACtC;AAGA,SAAO,SAAS;AAClB;AAKA,SAAS,QAAQ,MAAW,OAAoB;AAE9C,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAC1C,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI,SAAS,KAAM,QAAO;AAG1B,MAAI,gBAAgB,QAAQ,iBAAiB,MAAM;AACjD,WAAO,KAAK,QAAQ,IAAI,MAAM,QAAQ;AAAA,EACxC;AAGA,MAAI,aAAa,IAAI,KAAK,aAAa,KAAK,GAAG;AAC7C,WAAO,IAAI,KAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,QAAQ;AAAA,EAC5D;AAGA,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,QAAQ,GAAG;AACvC,WAAO,UAAU;AAAA,EACnB;AAGA,QAAM,UAAU,OAAO,IAAI;AAC3B,QAAM,WAAW,OAAO,KAAK;AAC7B,SAAO,QAAQ,cAAc,QAAQ;AACvC;AAKA,SAAS,KAAK,OAAY,OAAqB;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,OAAO,IAAI,CAAC;AACjD;AAKA,SAAS,SAAS,WAAgB,OAAqB;AACrD,MAAI,aAAa,KAAM,QAAO;AAG9B,MAAI,MAAM,QAAQ,SAAS,GAAG;AAC5B,WAAO,UAAU,KAAK,CAAC,SAAS,OAAO,MAAM,KAAK,CAAC;AAAA,EACrD;AAGA,MAAI,OAAO,cAAc,UAAU;AACjC,WAAO,UAAU,SAAS,OAAO,KAAK,CAAC;AAAA,EACzC;AAEA,SAAO;AACT;AAKA,SAAS,WAAW,KAAU,QAAsB;AAClD,MAAI,OAAO,QAAQ,UAAU,KAAM,QAAO;AAE1C,SAAO,OAAO,GAAG,EAAE,WAAW,OAAO,MAAM,CAAC;AAC9C;AAKA,SAAS,SAAS,KAAU,QAAsB;AAChD,MAAI,OAAO,QAAQ,UAAU,KAAM,QAAO;AAE1C,SAAO,OAAO,GAAG,EAAE,SAAS,OAAO,MAAM,CAAC;AAC5C;AAEA,MAAM,mBAAmB;AACzB,MAAM,yBAAyB;AAK/B,SAAS,QAAQ,KAAU,SAAuB;AAChD,MAAI,OAAO,QAAQ,WAAW,KAAM,QAAO;AAE3C,MAAI;AACF,UAAM,aAAa,OAAO,OAAO;AAGjC,QAAI,WAAW,SAAS,kBAAkB;AACxC,aAAO;AAAA,IACT;AAIA,QAAI,qBAAqB,KAAK,UAAU,GAAG;AACzC,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,OAAO,GAAG;AAC1B,QAAI,QAAQ,SAAS,wBAAwB;AAC3C,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,gBAAgB,YAAY,SAAS;AAAA,MAClD,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,IAClB,CAAC;AACD,WAAO,OAAO,KAAK,OAAO,UAAU;AAAA,EACtC,SAAS,OAAO;AAEd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAI,QAAQ,IAAI,aAAa,QAAQ;AACnC,cAAQ,MAAM,0BAA0B,OAAO;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AACF;AAKA,SAAS,QAAQ,OAAqB;AACpC,MAAI,SAAS,KAAM,QAAO;AAE1B,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,KAAK,MAAM;AAEvD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,WAAW;AAElD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,KAAK,EAAE,WAAW;AAEpE,SAAO;AACT;AAKA,SAAS,aAAa,OAAqB;AACzC,MAAI,OAAO,UAAU,SAAU,QAAO;AAGtC,QAAM,eAAe;AACrB,MAAI,aAAa,KAAK,KAAK,GAAG;AAC5B,UAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,WAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;AAAA,EAC9B;AAEA,SAAO;AACT;",
   "names": []
 }

package/dist/modules/business_rules/lib/rule-evaluator.js

@@ -26,7 +26,7 @@ async function evaluate(rules, data, context) {
       failedRules.push(rule);
     }
   }
-  const evaluationTime = Date.now() - startTime;
+  const evaluationTime = Math.max(0, Date.now() - startTime);
   const conditionsPassed = matchedRules.length > 0;
   return {
     conditionsPassed,
@@ -70,7 +70,7 @@ async function evaluateSingleRule(rule, data, context) {
       };
     }
     const conditionsPassed = await evaluateConditions(rule.conditionExpression, data, context);
-    const evaluationTime = Date.now() - startTime;
+    const evaluationTime = Math.max(0, Date.now() - startTime);
     console.log("[RULE EVAL] Final result:", {
       ruleId: rule.ruleId,
       conditionsPassed: conditionsPassed ? "\u2713 PASS" : "\u2717 FAIL",
@@ -84,7 +84,7 @@ async function evaluateSingleRule(rule, data, context) {
       evaluationTime
     };
   } catch (error) {
-    const evaluationTime = Date.now() - startTime;
+    const evaluationTime = Math.max(0, Date.now() - startTime);
     const errorMessage = error instanceof Error ? error.message : String(error);
     console.log("[RULE EVAL] \u2717 ERROR:", errorMessage);
     console.log("[RULE EVAL] ========================================");

package/dist/modules/business_rules/lib/rule-evaluator.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/business_rules/lib/rule-evaluator.ts"],
-  "sourcesContent": ["import type { BusinessRule } from '../data/entities'\nimport { evaluateExpression, type EvaluationContext, type ConditionExpression } from './expression-evaluator'\n\n/**\n * Rule evaluation context\n */\nexport interface RuleEvaluationContext extends EvaluationContext {\n  entityType?: string\n  entityId?: string\n  eventType?: string\n  [key: string]: any\n}\n\n/**\n * Rule evaluation result (for evaluating multiple rules)\n */\nexport interface RuleEvaluationResult {\n  conditionsPassed: boolean        // At least one rule matched\n  evaluationCompleted: boolean     // All rules evaluated without critical errors\n  matchedRules: BusinessRule[]\n  failedRules: BusinessRule[]\n  evaluationTime: number\n  errors?: string[]\n}\n\n/**\n * Single rule evaluation result\n */\nexport interface SingleRuleResult {\n  rule: BusinessRule\n  conditionsPassed: boolean     // Logical result: did conditions evaluate to true?\n  evaluationCompleted: boolean  // Technical success: did evaluation finish without errors?\n  evaluationTime: number\n  error?: string\n}\n\n/**\n * Evaluate multiple rules and return aggregated results\n */\nexport async function evaluate(\n  rules: BusinessRule[],\n  data: any,\n  context: RuleEvaluationContext\n): Promise<RuleEvaluationResult> {\n  const startTime = Date.now()\n  const matchedRules: BusinessRule[] = []\n  const failedRules: BusinessRule[] = []\n  const errors: string[] = []\n  let anyEvaluationCompleted = false\n\n  // Sort rules by priority (higher priority first)\n  const sortedRules = sortRulesByPriority(rules)\n\n  // Evaluate each rule\n  for (const rule of sortedRules) {\n    try {\n      const result = await evaluateSingleRule(rule, data, context)\n\n      // Track if any rule completed evaluation\n      if (result.evaluationCompleted) {\n        anyEvaluationCompleted = true\n      }\n\n      if (result.evaluationCompleted && result.conditionsPassed) {\n        matchedRules.push(rule)\n      } else {\n        failedRules.push(rule)\n      }\n\n      if (result.error) {\n        errors.push(`Rule ${rule.ruleId}: ${result.error}`)\n      }\n    } catch (error) {\n      const errorMessage = error instanceof Error ? error.message : String(error)\n      errors.push(`Rule ${rule.ruleId}: ${errorMessage}`)\n      failedRules.push(rule)\n    }\n  }\n\n  const evaluationTime = Date.now() - startTime\n\n  // Determine if conditions were met (at least one rule matched)\n  const conditionsPassed = matchedRules.length > 0\n\n  return {\n    conditionsPassed,\n    evaluationCompleted: anyEvaluationCompleted,\n    matchedRules,\n    failedRules,\n    evaluationTime,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Evaluate a single business rule\n */\nexport async function evaluateSingleRule(\n  rule: BusinessRule,\n  data: any,\n  context: RuleEvaluationContext\n): Promise<SingleRuleResult> {\n  const startTime = Date.now()\n\n  console.log('[RULE EVAL] ========================================')\n  console.log('[RULE EVAL] Evaluating rule:', {\n    ruleId: rule.ruleId,\n    ruleName: rule.ruleName,\n    ruleType: rule.ruleType,\n    entityType: rule.entityType,\n    eventType: rule.eventType,\n  })\n  console.log('[RULE EVAL] Conditions:', JSON.stringify(rule.conditionExpression, null, 2))\n\n  try {\n    // Check if rule is enabled\n    if (!rule.enabled) {\n      console.log('[RULE EVAL] \u2717 Rule is disabled')\n      return {\n        rule,\n        conditionsPassed: false,\n        evaluationCompleted: false,\n        evaluationTime: 0,\n        error: 'Rule is disabled',\n      }\n    }\n\n    // Check effective date range\n    if (!isRuleEffective(rule)) {\n      console.log('[RULE EVAL] \u2717 Rule is not effective (outside date range)')\n      return {\n        rule,\n        conditionsPassed: false,\n        evaluationCompleted: false,\n        evaluationTime: 0,\n        error: 'Rule is not effective (outside date range)',\n      }\n    }\n\n    // Evaluate conditions\n    const conditionsPassed = await evaluateConditions(rule.conditionExpression, data, context)\n\n    const evaluationTime = Date.now() - startTime\n\n    console.log('[RULE EVAL] Final result:', {\n      ruleId: rule.ruleId,\n      conditionsPassed: conditionsPassed ? '\u2713 PASS' : '\u2717 FAIL',\n      evaluationTime: `${evaluationTime}ms`,\n    })\n    console.log('[RULE EVAL] ========================================')\n\n    return {\n      rule,\n      conditionsPassed,\n      evaluationCompleted: true,\n      evaluationTime,\n    }\n  } catch (error) {\n    const evaluationTime = Date.now() - startTime\n    const errorMessage = error instanceof Error ? error.message : String(error)\n\n    console.log('[RULE EVAL] \u2717 ERROR:', errorMessage)\n    console.log('[RULE EVAL] ========================================')\n\n    return {\n      rule,\n      conditionsPassed: false,\n      evaluationCompleted: false,\n      evaluationTime,\n      error: errorMessage,\n    }\n  }\n}\n\n/**\n * Evaluate rule conditions (delegates to expression evaluator)\n */\nexport async function evaluateConditions(\n  conditions: any,\n  data: any,\n  context: RuleEvaluationContext\n): Promise<boolean> {\n  if (!conditions) {\n    return true\n  }\n\n  try {\n    const expression = conditions as ConditionExpression\n    return evaluateExpression(expression, data, context)\n  } catch (error) {\n    // If evaluation fails, the rule fails\n    throw new Error(`Condition evaluation failed: ${error instanceof Error ? error.message : String(error)}`)\n  }\n}\n\n/**\n * Sort rules by priority (higher priority first, then by ID for stability)\n */\nexport function sortRulesByPriority(rules: BusinessRule[]): BusinessRule[] {\n  return [...rules].sort((a, b) => {\n    if (b.priority !== a.priority) {\n      return b.priority - a.priority\n    }\n\n    // If priority is the same, sort by ruleId for stability\n    return a.ruleId.localeCompare(b.ruleId)\n  })\n}\n\n/**\n * Check if rule is within its effective date range\n */\nfunction isRuleEffective(rule: BusinessRule): boolean {\n  const now = new Date()\n\n  // Check effectiveFrom\n  if (rule.effectiveFrom && rule.effectiveFrom > now) {\n    return false\n  }\n\n  // Check effectiveTo\n  if (rule.effectiveTo && rule.effectiveTo < now) {\n    return false\n  }\n\n  return true\n}\n\n/**\n * Filter rules by entity type and event type\n */\nexport function filterRulesByContext(\n  rules: BusinessRule[],\n  entityType?: string,\n  eventType?: string\n): BusinessRule[] {\n  return rules.filter((rule) => {\n    // Filter by entity type\n    if (entityType && rule.entityType !== entityType) {\n      return false\n    }\n\n    // Filter by event type (if rule specifies one)\n    if (eventType && rule.eventType && rule.eventType !== eventType) {\n      return false\n    }\n\n    return true\n  })\n}\n\n/**\n * Get applicable rules for a context (filtered, sorted, and enabled)\n */\nexport function getApplicableRules(\n  rules: BusinessRule[],\n  entityType?: string,\n  eventType?: string\n): BusinessRule[] {\n  // Filter by context\n  const filtered = filterRulesByContext(rules, entityType, eventType)\n\n  // Filter by enabled status\n  const enabled = filtered.filter((rule) => rule.enabled)\n\n  // Filter by effective date\n  const effective = enabled.filter((rule) => isRuleEffective(rule))\n\n  // Sort by priority\n  return sortRulesByPriority(effective)\n}\n"],
-  "mappings": "AACA,SAAS,0BAA4E;AAsCrF,eAAsB,SACpB,OACA,MACA,SAC+B;AAC/B,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,eAA+B,CAAC;AACtC,QAAM,cAA8B,CAAC;AACrC,QAAM,SAAmB,CAAC;AAC1B,MAAI,yBAAyB;AAG7B,QAAM,cAAc,oBAAoB,KAAK;AAG7C,aAAW,QAAQ,aAAa;AAC9B,QAAI;AACF,YAAM,SAAS,MAAM,mBAAmB,MAAM,MAAM,OAAO;AAG3D,UAAI,OAAO,qBAAqB;AAC9B,iCAAyB;AAAA,MAC3B;AAEA,UAAI,OAAO,uBAAuB,OAAO,kBAAkB;AACzD,qBAAa,KAAK,IAAI;AAAA,MACxB,OAAO;AACL,oBAAY,KAAK,IAAI;AAAA,MACvB;AAEA,UAAI,OAAO,OAAO;AAChB,eAAO,KAAK,QAAQ,KAAK,MAAM,KAAK,OAAO,KAAK,EAAE;AAAA,MACpD;AAAA,IACF,SAAS,OAAO;AACd,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E,aAAO,KAAK,QAAQ,KAAK,MAAM,KAAK,YAAY,EAAE;AAClD,kBAAY,KAAK,IAAI;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,iBAAiB,KAAK,IAAI,IAAI;AAGpC,QAAM,mBAAmB,aAAa,SAAS;AAE/C,SAAO;AAAA,IACL;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EACvC;AACF;AAKA,eAAsB,mBACpB,MACA,MACA,SAC2B;AAC3B,QAAM,YAAY,KAAK,IAAI;AAE3B,UAAQ,IAAI,sDAAsD;AAClE,UAAQ,IAAI,gCAAgC;AAAA,IAC1C,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,UAAU,KAAK;AAAA,IACf,YAAY,KAAK;AAAA,IACjB,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,UAAQ,IAAI,2BAA2B,KAAK,UAAU,KAAK,qBAAqB,MAAM,CAAC,CAAC;AAExF,MAAI;AAEF,QAAI,CAAC,KAAK,SAAS;AACjB,cAAQ,IAAI,qCAAgC;AAC5C,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB;AAAA,QAClB,qBAAqB;AAAA,QACrB,gBAAgB;AAAA,QAChB,OAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,cAAQ,IAAI,+DAA0D;AACtE,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB;AAAA,QAClB,qBAAqB;AAAA,QACrB,gBAAgB;AAAA,QAChB,OAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,mBAAmB,MAAM,mBAAmB,KAAK,qBAAqB,MAAM,OAAO;AAEzF,UAAM,iBAAiB,KAAK,IAAI,IAAI;AAEpC,YAAQ,IAAI,6BAA6B;AAAA,MACvC,QAAQ,KAAK;AAAA,MACb,kBAAkB,mBAAmB,gBAAW;AAAA,MAChD,gBAAgB,GAAG,cAAc;AAAA,IACnC,CAAC;AACD,YAAQ,IAAI,sDAAsD;AAElE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,qBAAqB;AAAA,MACrB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,iBAAiB,KAAK,IAAI,IAAI;AACpC,UAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAE1E,YAAQ,IAAI,6BAAwB,YAAY;AAChD,YAAQ,IAAI,sDAAsD;AAElE,WAAO;AAAA,MACL;AAAA,MACA,kBAAkB;AAAA,MAClB,qBAAqB;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AACF;AAKA,eAAsB,mBACpB,YACA,MACA,SACkB;AAClB,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,aAAa;AACnB,WAAO,mBAAmB,YAAY,MAAM,OAAO;AAAA,EACrD,SAAS,OAAO;AAEd,UAAM,IAAI,MAAM,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,EAC1G;AACF;AAKO,SAAS,oBAAoB,OAAuC;AACzE,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM;AAC/B,QAAI,EAAE,aAAa,EAAE,UAAU;AAC7B,aAAO,EAAE,WAAW,EAAE;AAAA,IACxB;AAGA,WAAO,EAAE,OAAO,cAAc,EAAE,MAAM;AAAA,EACxC,CAAC;AACH;AAKA,SAAS,gBAAgB,MAA6B;AACpD,QAAM,MAAM,oBAAI,KAAK;AAGrB,MAAI,KAAK,iBAAiB,KAAK,gBAAgB,KAAK;AAClD,WAAO;AAAA,EACT;AAGA,MAAI,KAAK,eAAe,KAAK,cAAc,KAAK;AAC9C,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAKO,SAAS,qBACd,OACA,YACA,WACgB;AAChB,SAAO,MAAM,OAAO,CAAC,SAAS;AAE5B,QAAI,cAAc,KAAK,eAAe,YAAY;AAChD,aAAO;AAAA,IACT;AAGA,QAAI,aAAa,KAAK,aAAa,KAAK,cAAc,WAAW;AAC/D,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAKO,SAAS,mBACd,OACA,YACA,WACgB;AAEhB,QAAM,WAAW,qBAAqB,OAAO,YAAY,SAAS;AAGlE,QAAM,UAAU,SAAS,OAAO,CAAC,SAAS,KAAK,OAAO;AAGtD,QAAM,YAAY,QAAQ,OAAO,CAAC,SAAS,gBAAgB,IAAI,CAAC;AAGhE,SAAO,oBAAoB,SAAS;AACtC;",
+  "sourcesContent": ["import type { BusinessRule } from '../data/entities'\nimport { evaluateExpression, type EvaluationContext, type ConditionExpression } from './expression-evaluator'\n\n/**\n * Rule evaluation context\n */\nexport interface RuleEvaluationContext extends EvaluationContext {\n  entityType?: string\n  entityId?: string\n  eventType?: string\n  [key: string]: any\n}\n\n/**\n * Rule evaluation result (for evaluating multiple rules)\n */\nexport interface RuleEvaluationResult {\n  conditionsPassed: boolean        // At least one rule matched\n  evaluationCompleted: boolean     // All rules evaluated without critical errors\n  matchedRules: BusinessRule[]\n  failedRules: BusinessRule[]\n  evaluationTime: number\n  errors?: string[]\n}\n\n/**\n * Single rule evaluation result\n */\nexport interface SingleRuleResult {\n  rule: BusinessRule\n  conditionsPassed: boolean     // Logical result: did conditions evaluate to true?\n  evaluationCompleted: boolean  // Technical success: did evaluation finish without errors?\n  evaluationTime: number\n  error?: string\n}\n\n/**\n * Evaluate multiple rules and return aggregated results\n */\nexport async function evaluate(\n  rules: BusinessRule[],\n  data: any,\n  context: RuleEvaluationContext\n): Promise<RuleEvaluationResult> {\n  const startTime = Date.now()\n  const matchedRules: BusinessRule[] = []\n  const failedRules: BusinessRule[] = []\n  const errors: string[] = []\n  let anyEvaluationCompleted = false\n\n  // Sort rules by priority (higher priority first)\n  const sortedRules = sortRulesByPriority(rules)\n\n  // Evaluate each rule\n  for (const rule of sortedRules) {\n    try {\n      const result = await evaluateSingleRule(rule, data, context)\n\n      // Track if any rule completed evaluation\n      if (result.evaluationCompleted) {\n        anyEvaluationCompleted = true\n      }\n\n      if (result.evaluationCompleted && result.conditionsPassed) {\n        matchedRules.push(rule)\n      } else {\n        failedRules.push(rule)\n      }\n\n      if (result.error) {\n        errors.push(`Rule ${rule.ruleId}: ${result.error}`)\n      }\n    } catch (error) {\n      const errorMessage = error instanceof Error ? error.message : String(error)\n      errors.push(`Rule ${rule.ruleId}: ${errorMessage}`)\n      failedRules.push(rule)\n    }\n  }\n\n  const evaluationTime = Math.max(0, Date.now() - startTime)\n\n  // Determine if conditions were met (at least one rule matched)\n  const conditionsPassed = matchedRules.length > 0\n\n  return {\n    conditionsPassed,\n    evaluationCompleted: anyEvaluationCompleted,\n    matchedRules,\n    failedRules,\n    evaluationTime,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Evaluate a single business rule\n */\nexport async function evaluateSingleRule(\n  rule: BusinessRule,\n  data: any,\n  context: RuleEvaluationContext\n): Promise<SingleRuleResult> {\n  const startTime = Date.now()\n\n  console.log('[RULE EVAL] ========================================')\n  console.log('[RULE EVAL] Evaluating rule:', {\n    ruleId: rule.ruleId,\n    ruleName: rule.ruleName,\n    ruleType: rule.ruleType,\n    entityType: rule.entityType,\n    eventType: rule.eventType,\n  })\n  console.log('[RULE EVAL] Conditions:', JSON.stringify(rule.conditionExpression, null, 2))\n\n  try {\n    // Check if rule is enabled\n    if (!rule.enabled) {\n      console.log('[RULE EVAL] \u2717 Rule is disabled')\n      return {\n        rule,\n        conditionsPassed: false,\n        evaluationCompleted: false,\n        evaluationTime: 0,\n        error: 'Rule is disabled',\n      }\n    }\n\n    // Check effective date range\n    if (!isRuleEffective(rule)) {\n      console.log('[RULE EVAL] \u2717 Rule is not effective (outside date range)')\n      return {\n        rule,\n        conditionsPassed: false,\n        evaluationCompleted: false,\n        evaluationTime: 0,\n        error: 'Rule is not effective (outside date range)',\n      }\n    }\n\n    // Evaluate conditions\n    const conditionsPassed = await evaluateConditions(rule.conditionExpression, data, context)\n\n    const evaluationTime = Math.max(0, Date.now() - startTime)\n\n    console.log('[RULE EVAL] Final result:', {\n      ruleId: rule.ruleId,\n      conditionsPassed: conditionsPassed ? '\u2713 PASS' : '\u2717 FAIL',\n      evaluationTime: `${evaluationTime}ms`,\n    })\n    console.log('[RULE EVAL] ========================================')\n\n    return {\n      rule,\n      conditionsPassed,\n      evaluationCompleted: true,\n      evaluationTime,\n    }\n  } catch (error) {\n    const evaluationTime = Math.max(0, Date.now() - startTime)\n    const errorMessage = error instanceof Error ? error.message : String(error)\n\n    console.log('[RULE EVAL] \u2717 ERROR:', errorMessage)\n    console.log('[RULE EVAL] ========================================')\n\n    return {\n      rule,\n      conditionsPassed: false,\n      evaluationCompleted: false,\n      evaluationTime,\n      error: errorMessage,\n    }\n  }\n}\n\n/**\n * Evaluate rule conditions (delegates to expression evaluator)\n */\nexport async function evaluateConditions(\n  conditions: any,\n  data: any,\n  context: RuleEvaluationContext\n): Promise<boolean> {\n  if (!conditions) {\n    return true\n  }\n\n  try {\n    const expression = conditions as ConditionExpression\n    return evaluateExpression(expression, data, context)\n  } catch (error) {\n    // If evaluation fails, the rule fails\n    throw new Error(`Condition evaluation failed: ${error instanceof Error ? error.message : String(error)}`)\n  }\n}\n\n/**\n * Sort rules by priority (higher priority first, then by ID for stability)\n */\nexport function sortRulesByPriority(rules: BusinessRule[]): BusinessRule[] {\n  return [...rules].sort((a, b) => {\n    if (b.priority !== a.priority) {\n      return b.priority - a.priority\n    }\n\n    // If priority is the same, sort by ruleId for stability\n    return a.ruleId.localeCompare(b.ruleId)\n  })\n}\n\n/**\n * Check if rule is within its effective date range\n */\nfunction isRuleEffective(rule: BusinessRule): boolean {\n  const now = new Date()\n\n  // Check effectiveFrom\n  if (rule.effectiveFrom && rule.effectiveFrom > now) {\n    return false\n  }\n\n  // Check effectiveTo\n  if (rule.effectiveTo && rule.effectiveTo < now) {\n    return false\n  }\n\n  return true\n}\n\n/**\n * Filter rules by entity type and event type\n */\nexport function filterRulesByContext(\n  rules: BusinessRule[],\n  entityType?: string,\n  eventType?: string\n): BusinessRule[] {\n  return rules.filter((rule) => {\n    // Filter by entity type\n    if (entityType && rule.entityType !== entityType) {\n      return false\n    }\n\n    // Filter by event type (if rule specifies one)\n    if (eventType && rule.eventType && rule.eventType !== eventType) {\n      return false\n    }\n\n    return true\n  })\n}\n\n/**\n * Get applicable rules for a context (filtered, sorted, and enabled)\n */\nexport function getApplicableRules(\n  rules: BusinessRule[],\n  entityType?: string,\n  eventType?: string\n): BusinessRule[] {\n  // Filter by context\n  const filtered = filterRulesByContext(rules, entityType, eventType)\n\n  // Filter by enabled status\n  const enabled = filtered.filter((rule) => rule.enabled)\n\n  // Filter by effective date\n  const effective = enabled.filter((rule) => isRuleEffective(rule))\n\n  // Sort by priority\n  return sortRulesByPriority(effective)\n}\n"],
+  "mappings": "AACA,SAAS,0BAA4E;AAsCrF,eAAsB,SACpB,OACA,MACA,SAC+B;AAC/B,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,eAA+B,CAAC;AACtC,QAAM,cAA8B,CAAC;AACrC,QAAM,SAAmB,CAAC;AAC1B,MAAI,yBAAyB;AAG7B,QAAM,cAAc,oBAAoB,KAAK;AAG7C,aAAW,QAAQ,aAAa;AAC9B,QAAI;AACF,YAAM,SAAS,MAAM,mBAAmB,MAAM,MAAM,OAAO;AAG3D,UAAI,OAAO,qBAAqB;AAC9B,iCAAyB;AAAA,MAC3B;AAEA,UAAI,OAAO,uBAAuB,OAAO,kBAAkB;AACzD,qBAAa,KAAK,IAAI;AAAA,MACxB,OAAO;AACL,oBAAY,KAAK,IAAI;AAAA,MACvB;AAEA,UAAI,OAAO,OAAO;AAChB,eAAO,KAAK,QAAQ,KAAK,MAAM,KAAK,OAAO,KAAK,EAAE;AAAA,MACpD;AAAA,IACF,SAAS,OAAO;AACd,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E,aAAO,KAAK,QAAQ,KAAK,MAAM,KAAK,YAAY,EAAE;AAClD,kBAAY,KAAK,IAAI;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAGzD,QAAM,mBAAmB,aAAa,SAAS;AAE/C,SAAO;AAAA,IACL;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EACvC;AACF;AAKA,eAAsB,mBACpB,MACA,MACA,SAC2B;AAC3B,QAAM,YAAY,KAAK,IAAI;AAE3B,UAAQ,IAAI,sDAAsD;AAClE,UAAQ,IAAI,gCAAgC;AAAA,IAC1C,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,UAAU,KAAK;AAAA,IACf,YAAY,KAAK;AAAA,IACjB,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,UAAQ,IAAI,2BAA2B,KAAK,UAAU,KAAK,qBAAqB,MAAM,CAAC,CAAC;AAExF,MAAI;AAEF,QAAI,CAAC,KAAK,SAAS;AACjB,cAAQ,IAAI,qCAAgC;AAC5C,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB;AAAA,QAClB,qBAAqB;AAAA,QACrB,gBAAgB;AAAA,QAChB,OAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,cAAQ,IAAI,+DAA0D;AACtE,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB;AAAA,QAClB,qBAAqB;AAAA,QACrB,gBAAgB;AAAA,QAChB,OAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,mBAAmB,MAAM,mBAAmB,KAAK,qBAAqB,MAAM,OAAO;AAEzF,UAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAEzD,YAAQ,IAAI,6BAA6B;AAAA,MACvC,QAAQ,KAAK;AAAA,MACb,kBAAkB,mBAAmB,gBAAW;AAAA,MAChD,gBAAgB,GAAG,cAAc;AAAA,IACnC,CAAC;AACD,YAAQ,IAAI,sDAAsD;AAElE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,qBAAqB;AAAA,MACrB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AACzD,UAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAE1E,YAAQ,IAAI,6BAAwB,YAAY;AAChD,YAAQ,IAAI,sDAAsD;AAElE,WAAO;AAAA,MACL;AAAA,MACA,kBAAkB;AAAA,MAClB,qBAAqB;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AACF;AAKA,eAAsB,mBACpB,YACA,MACA,SACkB;AAClB,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,aAAa;AACnB,WAAO,mBAAmB,YAAY,MAAM,OAAO;AAAA,EACrD,SAAS,OAAO;AAEd,UAAM,IAAI,MAAM,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,EAC1G;AACF;AAKO,SAAS,oBAAoB,OAAuC;AACzE,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM;AAC/B,QAAI,EAAE,aAAa,EAAE,UAAU;AAC7B,aAAO,EAAE,WAAW,EAAE;AAAA,IACxB;AAGA,WAAO,EAAE,OAAO,cAAc,EAAE,MAAM;AAAA,EACxC,CAAC;AACH;AAKA,SAAS,gBAAgB,MAA6B;AACpD,QAAM,MAAM,oBAAI,KAAK;AAGrB,MAAI,KAAK,iBAAiB,KAAK,gBAAgB,KAAK;AAClD,WAAO;AAAA,EACT;AAGA,MAAI,KAAK,eAAe,KAAK,cAAc,KAAK;AAC9C,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAKO,SAAS,qBACd,OACA,YACA,WACgB;AAChB,SAAO,MAAM,OAAO,CAAC,SAAS;AAE5B,QAAI,cAAc,KAAK,eAAe,YAAY;AAChD,aAAO;AAAA,IACT;AAGA,QAAI,aAAa,KAAK,aAAa,KAAK,cAAc,WAAW;AAC/D,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AAKO,SAAS,mBACd,OACA,YACA,WACgB;AAEhB,QAAM,WAAW,qBAAqB,OAAO,YAAY,SAAS;AAGlE,QAAM,UAAU,SAAS,OAAO,CAAC,SAAS,KAAK,OAAO;AAGtD,QAAM,YAAY,QAAQ,OAAO,CAAC,SAAS,gBAAgB,IAAI,CAAC;AAGhE,SAAO,oBAAoB,SAAS;AACtC;",
   "names": []
 }