@open-mercato/core 0.6.3-develop.3525.3.cc18b8a43f → 0.6.3-develop.3574.1.f3c5dcf345

package/dist/modules/auth/backend/users/[id]/edit/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/auth/backend/users/%5Bid%5D/edit/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { E } from '#generated/entities.ids.generated'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm, type CrudField, type CrudFormGroup, type CrudFieldOption } from '@open-mercato/ui/backend/CrudForm'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { deleteCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'\nimport { AclEditor, type AclData } from '@open-mercato/core/modules/auth/components/AclEditor'\nimport { OrganizationSelect } from '@open-mercato/core/modules/directory/components/OrganizationSelect'\nimport { TenantSelect } from '@open-mercato/core/modules/directory/components/TenantSelect'\nimport { fetchRoleOptions } from '@open-mercato/core/modules/auth/backend/users/roleOptions'\nimport { WidgetVisibilityEditor, type WidgetVisibilityEditorHandle } from '@open-mercato/core/modules/dashboards/components/WidgetVisibilityEditor'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { extractCustomFieldEntries } from '@open-mercato/shared/lib/crud/custom-fields-client'\nimport { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { UserConsentsPanel } from '@open-mercato/core/modules/auth/components/UserConsentsPanel'\nimport { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'\n\ntype EditUserFormValues = {\n  email: string\n  name: string\n  password: string\n  tenantId: string | null\n  organizationId: string | null\n  roles: string[]\n} & Record<string, unknown>\n\ntype LoadedUser = {\n  id: string\n  email: string\n  name: string | null\n  organizationId: string | null\n  tenantId: string | null\n  tenantName: string | null\n  organizationName: string | null\n  roles: string[]\n  roleIds: string[]\n  hasPassword: boolean\n}\n\ntype UserApiItem = {\n  id?: string | null\n  email?: string | null\n  name?: string | null\n  organizationId?: string | null\n  tenantId?: string | null\n  tenantName?: string | null\n  organizationName?: string | null\n  roles?: unknown\n  roleIds?: unknown\n  hasPassword?: boolean\n}\n\ntype UserListResponse = {\n  items?: UserApiItem[]\n  isSuperAdmin?: boolean\n}\n\ntype FeatureCheckResponse = {\n  ok?: boolean\n}\n\ntype TenantAwareOrganizationSelectProps = {\n  fieldId: string\n  value: string | null\n  setValue: (value: string | null) => void\n  tenantId: string | null\n  includeInactiveIds?: Iterable<string | null | undefined>\n}\n\nfunction TenantAwareOrganizationSelectInput({\n  fieldId,\n  value,\n  setValue,\n  tenantId,\n  includeInactiveIds,\n}: TenantAwareOrganizationSelectProps) {\n  const prevTenantRef = React.useRef<string | null>(tenantId)\n  const hydratedRef = React.useRef(false)\n  const handleChange = React.useCallback((next: string | null) => {\n    setValue(next ?? null)\n  }, [setValue])\n\n  React.useEffect(() => {\n    if (!hydratedRef.current) {\n      hydratedRef.current = true\n      prevTenantRef.current = tenantId\n      return\n    }\n    if (prevTenantRef.current !== tenantId) {\n      prevTenantRef.current = tenantId\n      setValue(null)\n    }\n  }, [tenantId, setValue])\n\n  return (\n    <OrganizationSelect\n      id={fieldId}\n      value={value}\n      onChange={handleChange}\n      required\n      includeEmptyOption\n      className=\"w-full h-9 rounded border pl-2 pr-7 text-sm truncate\"\n      includeInactiveIds={includeInactiveIds}\n      tenantId={tenantId}\n    />\n  )\n}\n\nexport default function EditUserPage({ params }: { params?: { id?: string } }) {\n  const id = params?.id\n  const t = useT()\n  const tRef = React.useRef(t)\n  tRef.current = t\n  const [initialUser, setInitialUser] = React.useState<LoadedUser | null>(null)\n  const [selectedTenantId, setSelectedTenantId] = React.useState<string | null>(null)\n  const [loading, setLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [canEditOrgs, setCanEditOrgs] = React.useState(false)\n  const [aclData, setAclData] = React.useState<AclData>({ isSuperAdmin: false, features: [], organizations: null })\n  const [customFieldValues, setCustomFieldValues] = React.useState<Record<string, unknown>>({})\n  const [actorIsSuperAdmin, setActorIsSuperAdmin] = React.useState(false)\n  const [actorResolved, setActorResolved] = React.useState(false)\n  const widgetEditorRef = React.useRef<WidgetVisibilityEditorHandle | null>(null)\n  const [resendingInvite, setResendingInvite] = React.useState(false)\n\n  const handleResendInvite = React.useCallback(async () => {\n    if (!id) return\n    setResendingInvite(true)\n    try {\n      const { ok, result } = await apiCall<{ ok?: boolean; warning?: string }>('/api/auth/users/resend-invite', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ id }),\n      })\n      if (ok) {\n        if (result?.warning === 'invite_email_failed') {\n          flash(tRef.current('auth.users.flash.inviteEmailFailed', 'Invite token created but the email could not be sent. Please check your email provider configuration.'), 'warning')\n        } else {\n          flash(tRef.current('auth.users.flash.inviteSent', 'Invitation email sent'), 'success')\n        }\n      }\n    } catch (err) {\n      console.error('Failed to resend invite:', err)\n      flash(tRef.current('auth.users.form.errors.inviteResend', 'Failed to send invitation email'), 'error')\n    } finally {\n      setResendingInvite(false)\n    }\n  }, [id])\n  const passwordPolicy = React.useMemo(() => getPasswordPolicy(), [])\n  const passwordRequirements = React.useMemo(\n    () => formatPasswordRequirements(passwordPolicy, t),\n    [passwordPolicy, t],\n  )\n  const passwordDescription = React.useMemo(() => (\n    passwordRequirements\n      ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })\n      : undefined\n  ), [passwordRequirements, t])\n\n  React.useEffect(() => {\n    if (!id) {\n      setLoading(false)\n      setError(tRef.current('auth.users.form.errors.noId', 'No user ID provided'))\n      return\n    }\n    let cancelled = false\n    async function load() {\n      setLoading(true)\n      setError(null)\n      setCustomFieldValues({})\n      try {\n        const { ok, result } = await apiCall<UserListResponse>(\n          `/api/auth/users?id=${encodeURIComponent(String(id))}&page=1&pageSize=1`,\n        )\n        if (!ok) throw new Error('load_failed')\n        const item = Array.isArray(result?.items) ? result?.items?.[0] : undefined\n        if (!cancelled) {\n          setActorIsSuperAdmin(Boolean(result?.isSuperAdmin))\n          setActorResolved(true)\n          if (!item) {\n            setError(tRef.current('auth.users.form.errors.notFound', 'User not found'))\n            setCustomFieldValues({})\n            setInitialUser(null)\n            setSelectedTenantId(null)\n          } else {\n            const roleNames = Array.isArray(item.roles)\n              ? item.roles\n                  .map((role) => (typeof role === 'string' ? role : role == null ? '' : String(role)))\n                  .filter((role) => role.trim().length > 0)\n              : []\n            const roleIds = Array.isArray(item.roleIds)\n              ? (item.roleIds as string[]).filter((rid) => typeof rid === 'string' && rid.trim().length > 0)\n              : []\n            setInitialUser({\n              id: item.id ? String(item.id) : String(id),\n              email: item.email ? String(item.email) : '',\n              name: item.name ? String(item.name) : null,\n              organizationId: item.organizationId ? String(item.organizationId) : null,\n              tenantId: item.tenantId ? String(item.tenantId) : null,\n              tenantName: item.tenantName ? String(item.tenantName) : null,\n              organizationName: item.organizationName ? String(item.organizationName) : null,\n              roles: roleNames,\n              roleIds: roleIds.length > 0 ? roleIds : roleNames,\n              hasPassword: item.hasPassword !== false,\n            })\n            setSelectedTenantId(item.tenantId ? String(item.tenantId) : null)\n            const custom = extractCustomFieldEntries(item as Record<string, unknown>)\n            setCustomFieldValues(custom)\n          }\n        }\n      } catch (err) {\n        console.error('Failed to load user:', err)\n        if (!cancelled) setError(tRef.current('auth.users.form.errors.load', 'Failed to load user data'))\n        if (!cancelled) setCustomFieldValues({})\n        if (!cancelled) setActorResolved(true)\n      }\n      if (!cancelled) setLoading(false)\n      try {\n        const featureCheck = await apiCall<FeatureCheckResponse>(\n          '/api/auth/feature-check',\n          {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({ features: ['directory.organizations.view'] }),\n          },\n          { fallback: { ok: false } },\n        )\n        if (!cancelled) setCanEditOrgs(Boolean(featureCheck.result?.ok))\n      } catch (err) {\n        console.error('Failed to check features:', err)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [id])\n\n  const selectedOrgId = initialUser?.organizationId ? String(initialUser.organizationId) : null\n  const preloadedTenants = React.useMemo(() => {\n    if (!selectedTenantId) return null\n    const name = initialUser?.tenantId === selectedTenantId\n      ? (initialUser?.tenantName ?? selectedTenantId)\n      : selectedTenantId\n    return [{ id: selectedTenantId, name, isActive: true }]\n  }, [initialUser, selectedTenantId])\n\n  // Block role loading until we know whether the actor is a super admin. Without this guard the\n  // initial (non-super-admin) branch fires before the flag resolves and the server returns roles\n  // from other tenants because the real caller is a super admin without tenantId scoping.\n  const loadRoleOptions = React.useCallback(async (query?: string): Promise<CrudFieldOption[]> => {\n    if (!actorResolved) return []\n    if (actorIsSuperAdmin) {\n      if (!selectedTenantId) return []\n      return fetchRoleOptions(query, { tenantId: selectedTenantId })\n    }\n    return fetchRoleOptions(query)\n  }, [actorIsSuperAdmin, actorResolved, selectedTenantId])\n\n  const userHasPassword = initialUser?.hasPassword !== false\n  const fields: CrudField[] = React.useMemo(() => {\n    const items: CrudField[] = [\n      { id: 'email', label: t('auth.users.form.field.email', 'Email'), type: 'text', required: true },\n      { id: 'name', label: t('auth.users.form.field.name', 'Display name'), type: 'text' },\n      {\n        id: 'password',\n        label: userHasPassword\n          ? t('auth.users.form.field.newPassword', 'New Password')\n          : t('auth.users.form.field.setPassword', 'Set Password'),\n        type: 'password' as const,\n        description: [\n          userHasPassword\n            ? t('auth.users.form.field.passwordChangeHint', 'Leave blank to keep current password')\n            : t('auth.users.form.field.passwordInviteHint', 'Optionally set a password for this user (they were invited via email)'),\n          passwordDescription,\n        ].filter(Boolean).join('. '),\n      },\n    ]\n    if (actorIsSuperAdmin) {\n      items.push({\n        id: 'tenantId',\n        label: t('auth.users.form.field.tenant', 'Tenant'),\n        type: 'custom',\n        required: true,\n        component: ({ value, setValue }) => {\n          const normalizedValue = typeof value === 'string'\n            ? value\n            : (typeof selectedTenantId === 'string' ? selectedTenantId : null)\n          return (\n            <TenantSelect\n              id=\"tenantId\"\n              value={normalizedValue}\n              onChange={(next) => {\n                const resolved = next ?? null\n                setValue(resolved)\n                setSelectedTenantId(resolved)\n                setAclData({ isSuperAdmin: false, features: [], organizations: null })\n              }}\n              includeEmptyOption\n              className=\"w-full h-9 rounded border pl-2 pr-7 text-sm truncate\"\n              required\n              tenants={preloadedTenants}\n            />\n          )\n        },\n      })\n    }\n    items.push({\n      id: 'organizationId',\n      label: t('auth.users.form.field.organization', 'Organization'),\n      type: 'custom',\n      required: true,\n      component: ({ id, value, setValue }) => {\n        const normalizedValue = typeof value === 'string' ? (value.length > 0 ? value : null) : null\n        return (\n          <TenantAwareOrganizationSelectInput\n            fieldId={id}\n            value={normalizedValue}\n            setValue={(next) => setValue(next ?? null)}\n            tenantId={selectedTenantId}\n            includeInactiveIds={selectedOrgId ? [selectedOrgId] : undefined}\n          />\n        )\n      },\n    })\n    items.push({ id: 'roles', label: t('auth.users.form.field.roles', 'Roles'), type: 'tags', loadOptions: loadRoleOptions })\n    return items\n  }, [actorIsSuperAdmin, loadRoleOptions, passwordDescription, preloadedTenants, selectedOrgId, selectedTenantId, t, userHasPassword])\n\n  const detailFieldIds = React.useMemo(() => {\n    const base: string[] = ['email', 'name', 'password', 'organizationId', 'roles']\n    if (actorIsSuperAdmin) base.splice(2, 0, 'tenantId')\n    return base\n  }, [actorIsSuperAdmin])\n\n  const groups: CrudFormGroup[] = React.useMemo(() => [\n    { id: 'details', title: t('auth.users.form.group.details', 'Details'), column: 1, fields: detailFieldIds },\n    { id: 'custom', title: t('auth.users.form.group.customFields', 'Custom Data'), column: 2, kind: 'customFields' },\n    {\n      id: 'acl',\n      title: t('auth.users.form.group.access', 'Access'),\n      column: 1,\n      component: () => (id\n        ? (\n          <AclEditor\n            kind=\"user\"\n            targetId={String(id)}\n            canEditOrganizations={canEditOrgs}\n            value={aclData}\n            onChange={setAclData}\n            userRoles={initialUser?.roles || []}\n            currentUserIsSuperAdmin={actorIsSuperAdmin}\n            tenantId={selectedTenantId ?? null}\n          />\n        )\n        : null),\n    },\n    {\n      id: 'dashboardWidgets',\n      title: t('auth.users.form.group.widgets', 'Dashboard Widgets'),\n      column: 2,\n      component: () => (id && initialUser\n        ? (\n          <WidgetVisibilityEditor\n            kind=\"user\"\n            targetId={String(id)}\n            tenantId={selectedTenantId ?? null}\n            organizationId={initialUser?.organizationId ?? null}\n            ref={widgetEditorRef}\n          />\n        ) : null\n      ),\n    },\n    {\n      id: 'consents',\n      title: t('auth.users.form.group.consents', 'Consents'),\n      column: 2,\n      component: () => (id ? <UserConsentsPanel userId={String(id)} /> : null),\n    },\n  ], [aclData, actorIsSuperAdmin, canEditOrgs, detailFieldIds, id, initialUser, selectedTenantId, t])\n\n  const initialValues = React.useMemo(() => {\n    if (initialUser) {\n      return {\n        email: initialUser.email,\n        name: initialUser.name ?? '',\n        password: '',\n        tenantId: initialUser.tenantId,\n        organizationId: initialUser.organizationId,\n        roles: initialUser.roleIds,\n        ...customFieldValues,\n      }\n    }\n    return {\n      email: '',\n      name: '',\n      password: '',\n      tenantId: selectedTenantId ?? null,\n      organizationId: null,\n      roles: [],\n      ...customFieldValues,\n    }\n  }, [initialUser, customFieldValues, selectedTenantId])\n\n  return (\n    <Page>\n      <PageBody>\n        {error && (\n          <div className=\"p-4 mb-4 bg-red-50 border border-red-200 rounded text-red-800\">\n            {error}\n          </div>\n        )}\n        <CrudForm<EditUserFormValues>\n          title={t('auth.users.form.title.edit', 'Edit User')}\n          backHref=\"/backend/users\"\n          versionHistory={{ resourceKind: 'auth.user', resourceId: id ? String(id) : '' }}\n          fields={fields}\n          groups={groups}\n          entityId={E.auth.user}\n          initialValues={initialValues}\n          isLoading={loading}\n          loadingMessage={t('auth.users.form.loading', 'Loading user data...')}\n          submitLabel={t('auth.users.form.action.save', 'Save')}\n          cancelHref=\"/backend/users\"\n          extraActions={id && !userHasPassword ? (\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              disabled={resendingInvite}\n              onClick={handleResendInvite}\n            >\n              {resendingInvite\n                ? t('auth.users.form.action.resendingInvite', 'Sending...')\n                : t('auth.users.form.action.resendInvite', 'Resend Invite')}\n            </Button>\n          ) : undefined}\n          successRedirect={`/backend/users?flash=${encodeURIComponent(t('auth.users.flash.updated', 'User saved'))}&type=success`}\n          onSubmit={async (values) => {\n            if (!id) return\n            const customFields = collectCustomFieldValues(values)\n            const payload = {\n              id: id ? String(id) : '',\n              email: values.email,\n              name: normalizeDisplayNameInput(values.name),\n              password: values.password && values.password.trim() ? values.password : undefined,\n              organizationId: values.organizationId ? values.organizationId : undefined,\n              roles: Array.isArray(values.roles) ? values.roles : [],\n              ...(Object.keys(customFields).length ? { customFields } : {}),\n            }\n            await updateCrud('auth/users', payload)\n            await updateCrud('auth/users/acl', { userId: id, ...aclData }, {\n              errorMessage: t('auth.users.form.errors.aclUpdate', 'Failed to update user access control'),\n            })\n            await widgetEditorRef.current?.save()\n            try { window.dispatchEvent(new Event('om:refresh-sidebar')) } catch {}\n          }}\n          onDelete={async () => {\n            await deleteCrud('auth/users', String(id), {\n              errorMessage: t('auth.users.form.errors.delete', 'Failed to delete user'),\n            })\n          }}\n          deleteRedirect={`/backend/users?flash=${encodeURIComponent(t('auth.users.flash.deleted', 'User deleted'))}&type=success`}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAmGI,cAqTE,YArTF;AAlGJ,YAAY,WAAW;AACvB,SAAS,SAAS;AAClB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAA0E;AACnF,SAAS,eAAe;AACxB,SAAS,YAAY,kBAAkB;AACvC,SAAS,gCAAgC;AACzC,SAAS,iBAA+B;AACxC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,8BAAiE;AAC1E,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B,yBAAyB;AAC9D,SAAS,yBAAyB;AAClC,SAAS,iCAAiC;AAsD1C,SAAS,mCAAmC;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAuC;AACrC,QAAM,gBAAgB,MAAM,OAAsB,QAAQ;AAC1D,QAAM,cAAc,MAAM,OAAO,KAAK;AACtC,QAAM,eAAe,MAAM,YAAY,CAAC,SAAwB;AAC9D,aAAS,QAAQ,IAAI;AAAA,EACvB,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,YAAY,SAAS;AACxB,kBAAY,UAAU;AACtB,oBAAc,UAAU;AACxB;AAAA,IACF;AACA,QAAI,cAAc,YAAY,UAAU;AACtC,oBAAc,UAAU;AACxB,eAAS,IAAI;AAAA,IACf;AAAA,EACF,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,IAAI;AAAA,MACJ;AAAA,MACA,UAAU;AAAA,MACV,UAAQ;AAAA,MACR,oBAAkB;AAAA,MAClB,WAAU;AAAA,MACV;AAAA,MACA;AAAA;AAAA,EACF;AAEJ;AAEe,SAAR,aAA8B,EAAE,OAAO,GAAiC;AAC7E,QAAM,KAAK,QAAQ;AACnB,QAAM,IAAI,KAAK;AACf,QAAM,OAAO,MAAM,OAAO,CAAC;AAC3B,OAAK,UAAU;AACf,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAA4B,IAAI;AAC5E,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAwB,IAAI;AAClF,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,KAAK;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAkB,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK,CAAC;AAChH,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAkC,CAAC,CAAC;AAC5F,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAS,KAAK;AACtE,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,kBAAkB,MAAM,OAA4C,IAAI;AAC9E,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAElE,QAAM,qBAAqB,MAAM,YAAY,YAAY;AACvD,QAAI,CAAC,GAAI;AACT,uBAAmB,IAAI;AACvB,QAAI;AACF,YAAM,EAAE,IAAI,OAAO,IAAI,MAAM,QAA4C,iCAAiC;AAAA,QACxG,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,GAAG,CAAC;AAAA,MAC7B,CAAC;AACD,UAAI,IAAI;AACN,YAAI,QAAQ,YAAY,uBAAuB;AAC7C,gBAAM,KAAK,QAAQ,sCAAsC,uGAAuG,GAAG,SAAS;AAAA,QAC9K,OAAO;AACL,gBAAM,KAAK,QAAQ,+BAA+B,uBAAuB,GAAG,SAAS;AAAA,QACvF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,4BAA4B,GAAG;AAC7C,YAAM,KAAK,QAAQ,uCAAuC,iCAAiC,GAAG,OAAO;AAAA,IACvG,UAAE;AACA,yBAAmB,KAAK;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,EAAE,CAAC;AACP,QAAM,iBAAiB,MAAM,QAAQ,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAClE,QAAM,uBAAuB,MAAM;AAAA,IACjC,MAAM,2BAA2B,gBAAgB,CAAC;AAAA,IAClD,CAAC,gBAAgB,CAAC;AAAA,EACpB;AACA,QAAM,sBAAsB,MAAM,QAAQ,MACxC,uBACI,EAAE,mCAAmC,yCAAyC,EAAE,cAAc,qBAAqB,CAAC,IACpH,QACH,CAAC,sBAAsB,CAAC,CAAC;AAE5B,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,IAAI;AACP,iBAAW,KAAK;AAChB,eAAS,KAAK,QAAQ,+BAA+B,qBAAqB,CAAC;AAC3E;AAAA,IACF;AACA,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,iBAAW,IAAI;AACf,eAAS,IAAI;AACb,2BAAqB,CAAC,CAAC;AACvB,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,UAC3B,sBAAsB,mBAAmB,OAAO,EAAE,CAAC,CAAC;AAAA,QACtD;AACA,YAAI,CAAC,GAAI,OAAM,IAAI,MAAM,aAAa;AACtC,cAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAC,IAAI;AACjE,YAAI,CAAC,WAAW;AACd,+BAAqB,QAAQ,QAAQ,YAAY,CAAC;AAClD,2BAAiB,IAAI;AACrB,cAAI,CAAC,MAAM;AACT,qBAAS,KAAK,QAAQ,mCAAmC,gBAAgB,CAAC;AAC1E,iCAAqB,CAAC,CAAC;AACvB,2BAAe,IAAI;AACnB,gCAAoB,IAAI;AAAA,UAC1B,OAAO;AACL,kBAAM,YAAY,MAAM,QAAQ,KAAK,KAAK,IACtC,KAAK,MACF,IAAI,CAAC,SAAU,OAAO,SAAS,WAAW,OAAO,QAAQ,OAAO,KAAK,OAAO,IAAI,CAAE,EAClF,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,SAAS,CAAC,IAC1C,CAAC;AACL,kBAAM,UAAU,MAAM,QAAQ,KAAK,OAAO,IACrC,KAAK,QAAqB,OAAO,CAAC,QAAQ,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,SAAS,CAAC,IAC3F,CAAC;AACL,2BAAe;AAAA,cACb,IAAI,KAAK,KAAK,OAAO,KAAK,EAAE,IAAI,OAAO,EAAE;AAAA,cACzC,OAAO,KAAK,QAAQ,OAAO,KAAK,KAAK,IAAI;AAAA,cACzC,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,cACtC,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,cACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,cAClD,YAAY,KAAK,aAAa,OAAO,KAAK,UAAU,IAAI;AAAA,cACxD,kBAAkB,KAAK,mBAAmB,OAAO,KAAK,gBAAgB,IAAI;AAAA,cAC1E,OAAO;AAAA,cACP,SAAS,QAAQ,SAAS,IAAI,UAAU;AAAA,cACxC,aAAa,KAAK,gBAAgB;AAAA,YACpC,CAAC;AACD,gCAAoB,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,IAAI;AAChE,kBAAM,SAAS,0BAA0B,IAA+B;AACxE,iCAAqB,MAAM;AAAA,UAC7B;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,MAAM,wBAAwB,GAAG;AACzC,YAAI,CAAC,UAAW,UAAS,KAAK,QAAQ,+BAA+B,0BAA0B,CAAC;AAChG,YAAI,CAAC,UAAW,sBAAqB,CAAC,CAAC;AACvC,YAAI,CAAC,UAAW,kBAAiB,IAAI;AAAA,MACvC;AACA,UAAI,CAAC,UAAW,YAAW,KAAK;AAChC,UAAI;AACF,cAAM,eAAe,MAAM;AAAA,UACzB;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,CAAC,8BAA8B,EAAE,CAAC;AAAA,UACrE;AAAA,UACA,EAAE,UAAU,EAAE,IAAI,MAAM,EAAE;AAAA,QAC5B;AACA,YAAI,CAAC,UAAW,gBAAe,QAAQ,aAAa,QAAQ,EAAE,CAAC;AAAA,MACjE,SAAS,KAAK;AACZ,gBAAQ,MAAM,6BAA6B,GAAG;AAAA,MAChD;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,EAAE,CAAC;AAEP,QAAM,gBAAgB,aAAa,iBAAiB,OAAO,YAAY,cAAc,IAAI;AACzF,QAAM,mBAAmB,MAAM,QAAQ,MAAM;AAC3C,QAAI,CAAC,iBAAkB,QAAO;AAC9B,UAAM,OAAO,aAAa,aAAa,mBAClC,aAAa,cAAc,mBAC5B;AACJ,WAAO,CAAC,EAAE,IAAI,kBAAkB,MAAM,UAAU,KAAK,CAAC;AAAA,EACxD,GAAG,CAAC,aAAa,gBAAgB,CAAC;AAKlC,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAA+C;AAC9F,QAAI,CAAC,cAAe,QAAO,CAAC;AAC5B,QAAI,mBAAmB;AACrB,UAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,aAAO,iBAAiB,OAAO,EAAE,UAAU,iBAAiB,CAAC;AAAA,IAC/D;AACA,WAAO,iBAAiB,KAAK;AAAA,EAC/B,GAAG,CAAC,mBAAmB,eAAe,gBAAgB,CAAC;AAEvD,QAAM,kBAAkB,aAAa,gBAAgB;AACrD,QAAM,SAAsB,MAAM,QAAQ,MAAM;AAC9C,UAAM,QAAqB;AAAA,MACzB,EAAE,IAAI,SAAS,OAAO,EAAE,+BAA+B,OAAO,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,MAC9F,EAAE,IAAI,QAAQ,OAAO,EAAE,8BAA8B,cAAc,GAAG,MAAM,OAAO;AAAA,MACnF;AAAA,QACE,IAAI;AAAA,QACJ,OAAO,kBACH,EAAE,qCAAqC,cAAc,IACrD,EAAE,qCAAqC,cAAc;AAAA,QACzD,MAAM;AAAA,QACN,aAAa;AAAA,UACX,kBACI,EAAE,4CAA4C,sCAAsC,IACpF,EAAE,4CAA4C,uEAAuE;AAAA,UACzH;AAAA,QACF,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,MAC7B;AAAA,IACF;AACA,QAAI,mBAAmB;AACrB,YAAM,KAAK;AAAA,QACT,IAAI;AAAA,QACJ,OAAO,EAAE,gCAAgC,QAAQ;AAAA,QACjD,MAAM;AAAA,QACN,UAAU;AAAA,QACV,WAAW,CAAC,EAAE,OAAO,SAAS,MAAM;AAClC,gBAAM,kBAAkB,OAAO,UAAU,WACrC,QACC,OAAO,qBAAqB,WAAW,mBAAmB;AAC/D,iBACE;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO;AAAA,cACP,UAAU,CAAC,SAAS;AAClB,sBAAM,WAAW,QAAQ;AACzB,yBAAS,QAAQ;AACjB,oCAAoB,QAAQ;AAC5B,2BAAW,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK,CAAC;AAAA,cACvE;AAAA,cACA,oBAAkB;AAAA,cAClB,WAAU;AAAA,cACV,UAAQ;AAAA,cACR,SAAS;AAAA;AAAA,UACX;AAAA,QAEJ;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,KAAK;AAAA,MACT,IAAI;AAAA,MACJ,OAAO,EAAE,sCAAsC,cAAc;AAAA,MAC7D,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW,CAAC,EAAE,IAAAA,KAAI,OAAO,SAAS,MAAM;AACtC,cAAM,kBAAkB,OAAO,UAAU,WAAY,MAAM,SAAS,IAAI,QAAQ,OAAQ;AACxF,eACE;AAAA,UAAC;AAAA;AAAA,YACC,SAASA;AAAA,YACT,OAAO;AAAA,YACP,UAAU,CAAC,SAAS,SAAS,QAAQ,IAAI;AAAA,YACzC,UAAU;AAAA,YACV,oBAAoB,gBAAgB,CAAC,aAAa,IAAI;AAAA;AAAA,QACxD;AAAA,MAEJ;AAAA,IACF,CAAC;AACD,UAAM,KAAK,EAAE,IAAI,SAAS,OAAO,EAAE,+BAA+B,OAAO,GAAG,MAAM,QAAQ,aAAa,gBAAgB,CAAC;AACxH,WAAO;AAAA,EACT,GAAG,CAAC,mBAAmB,iBAAiB,qBAAqB,kBAAkB,eAAe,kBAAkB,GAAG,eAAe,CAAC;AAEnI,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,UAAM,OAAiB,CAAC,SAAS,QAAQ,YAAY,kBAAkB,OAAO;AAC9E,QAAI,kBAAmB,MAAK,OAAO,GAAG,GAAG,UAAU;AACnD,WAAO;AAAA,EACT,GAAG,CAAC,iBAAiB,CAAC;AAEtB,QAAM,SAA0B,MAAM,QAAQ,MAAM;AAAA,IAClD,EAAE,IAAI,WAAW,OAAO,EAAE,iCAAiC,SAAS,GAAG,QAAQ,GAAG,QAAQ,eAAe;AAAA,IACzG,EAAE,IAAI,UAAU,OAAO,EAAE,sCAAsC,aAAa,GAAG,QAAQ,GAAG,MAAM,eAAe;AAAA,IAC/G;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,gCAAgC,QAAQ;AAAA,MACjD,QAAQ;AAAA,MACR,WAAW,MAAO,KAEd;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,UAAU,OAAO,EAAE;AAAA,UACnB,sBAAsB;AAAA,UACtB,OAAO;AAAA,UACP,UAAU;AAAA,UACV,WAAW,aAAa,SAAS,CAAC;AAAA,UAClC,yBAAyB;AAAA,UACzB,UAAU,oBAAoB;AAAA;AAAA,MAChC,IAEA;AAAA,IACN;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,iCAAiC,mBAAmB;AAAA,MAC7D,QAAQ;AAAA,MACR,WAAW,MAAO,MAAM,cAEpB;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,UAAU,OAAO,EAAE;AAAA,UACnB,UAAU,oBAAoB;AAAA,UAC9B,gBAAgB,aAAa,kBAAkB;AAAA,UAC/C,KAAK;AAAA;AAAA,MACP,IACE;AAAA,IAER;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,kCAAkC,UAAU;AAAA,MACrD,QAAQ;AAAA,MACR,WAAW,MAAO,KAAK,oBAAC,qBAAkB,QAAQ,OAAO,EAAE,GAAG,IAAK;AAAA,IACrE;AAAA,EACF,GAAG,CAAC,SAAS,mBAAmB,aAAa,gBAAgB,IAAI,aAAa,kBAAkB,CAAC,CAAC;AAElG,QAAM,gBAAgB,MAAM,QAAQ,MAAM;AACxC,QAAI,aAAa;AACf,aAAO;AAAA,QACL,OAAO,YAAY;AAAA,QACnB,MAAM,YAAY,QAAQ;AAAA,QAC1B,UAAU;AAAA,QACV,UAAU,YAAY;AAAA,QACtB,gBAAgB,YAAY;AAAA,QAC5B,OAAO,YAAY;AAAA,QACnB,GAAG;AAAA,MACL;AAAA,IACF;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU,oBAAoB;AAAA,MAC9B,gBAAgB;AAAA,MAChB,OAAO,CAAC;AAAA,MACR,GAAG;AAAA,IACL;AAAA,EACF,GAAG,CAAC,aAAa,mBAAmB,gBAAgB,CAAC;AAErD,SACE,oBAAC,QACC,+BAAC,YACE;AAAA,aACC,oBAAC,SAAI,WAAU,iEACZ,iBACH;AAAA,IAEF;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,8BAA8B,WAAW;AAAA,QAClD,UAAS;AAAA,QACT,gBAAgB,EAAE,cAAc,aAAa,YAAY,KAAK,OAAO,EAAE,IAAI,GAAG;AAAA,QAC9E;AAAA,QACA;AAAA,QACA,UAAU,EAAE,KAAK;AAAA,QACjB;AAAA,QACA,WAAW;AAAA,QACX,gBAAgB,EAAE,2BAA2B,sBAAsB;AAAA,QACnE,aAAa,EAAE,+BAA+B,MAAM;AAAA,QACpD,YAAW;AAAA,QACX,cAAc,MAAM,CAAC,kBACnB;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,UAAU;AAAA,YACV,SAAS;AAAA,YAER,4BACG,EAAE,0CAA0C,YAAY,IACxD,EAAE,uCAAuC,eAAe;AAAA;AAAA,QAC9D,IACE;AAAA,QACJ,iBAAiB,wBAAwB,mBAAmB,EAAE,4BAA4B,YAAY,CAAC,CAAC;AAAA,QACxG,UAAU,OAAO,WAAW;AAC1B,cAAI,CAAC,GAAI;AACT,gBAAM,eAAe,yBAAyB,MAAM;AACpD,gBAAM,UAAU;AAAA,YACd,IAAI,KAAK,OAAO,EAAE,IAAI;AAAA,YACtB,OAAO,OAAO;AAAA,YACd,MAAM,0BAA0B,OAAO,IAAI;AAAA,YAC3C,UAAU,OAAO,YAAY,OAAO,SAAS,KAAK,IAAI,OAAO,WAAW;AAAA,YACxE,gBAAgB,OAAO,iBAAiB,OAAO,iBAAiB;AAAA,YAChE,OAAO,MAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,QAAQ,CAAC;AAAA,YACrD,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC;AAAA,UAC7D;AACA,gBAAM,WAAW,cAAc,OAAO;AACtC,gBAAM,WAAW,kBAAkB,EAAE,QAAQ,IAAI,GAAG,QAAQ,GAAG;AAAA,YAC7D,cAAc,EAAE,oCAAoC,sCAAsC;AAAA,UAC5F,CAAC;AACD,gBAAM,gBAAgB,SAAS,KAAK;AACpC,cAAI;AAAE,mBAAO,cAAc,IAAI,MAAM,oBAAoB,CAAC;AAAA,UAAE,QAAQ;AAAA,UAAC;AAAA,QACvE;AAAA,QACA,UAAU,YAAY;AACpB,gBAAM,WAAW,cAAc,OAAO,EAAE,GAAG;AAAA,YACzC,cAAc,EAAE,iCAAiC,uBAAuB;AAAA,UAC1E,CAAC;AAAA,QACH;AAAA,QACA,gBAAgB,wBAAwB,mBAAmB,EAAE,4BAA4B,cAAc,CAAC,CAAC;AAAA;AAAA,IAC3G;AAAA,KACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { E } from '#generated/entities.ids.generated'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm, type CrudField, type CrudFormGroup, type CrudFieldOption } from '@open-mercato/ui/backend/CrudForm'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { deleteCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'\nimport { AclEditor, type AclData } from '@open-mercato/core/modules/auth/components/AclEditor'\nimport { OrganizationSelect } from '@open-mercato/core/modules/directory/components/OrganizationSelect'\nimport { TenantSelect } from '@open-mercato/core/modules/directory/components/TenantSelect'\nimport { fetchRoleOptions } from '@open-mercato/core/modules/auth/backend/users/roleOptions'\nimport { WidgetVisibilityEditor, type WidgetVisibilityEditorHandle } from '@open-mercato/core/modules/dashboards/components/WidgetVisibilityEditor'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { extractCustomFieldEntries } from '@open-mercato/shared/lib/crud/custom-fields-client'\nimport { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { UserConsentsPanel } from '@open-mercato/core/modules/auth/components/UserConsentsPanel'\nimport { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'\n\ntype EditUserFormValues = {\n  email: string\n  name: string\n  password: string\n  tenantId: string | null\n  organizationId: string | null\n  roles: string[]\n} & Record<string, unknown>\n\ntype LoadedUser = {\n  id: string\n  email: string\n  name: string | null\n  organizationId: string | null\n  tenantId: string | null\n  tenantName: string | null\n  organizationName: string | null\n  roles: string[]\n  roleIds: string[]\n  hasPassword: boolean\n}\n\ntype UserApiItem = {\n  id?: string | null\n  email?: string | null\n  name?: string | null\n  organizationId?: string | null\n  tenantId?: string | null\n  tenantName?: string | null\n  organizationName?: string | null\n  roles?: unknown\n  roleIds?: unknown\n  hasPassword?: boolean\n}\n\ntype UserListResponse = {\n  items?: UserApiItem[]\n  isSuperAdmin?: boolean\n}\n\ntype FeatureCheckResponse = {\n  ok?: boolean\n}\n\ntype TenantAwareOrganizationSelectProps = {\n  fieldId: string\n  value: string | null\n  setValue: (value: string | null) => void\n  tenantId: string | null\n  includeInactiveIds?: Iterable<string | null | undefined>\n}\n\nfunction TenantAwareOrganizationSelectInput({\n  fieldId,\n  value,\n  setValue,\n  tenantId,\n  includeInactiveIds,\n}: TenantAwareOrganizationSelectProps) {\n  const prevTenantRef = React.useRef<string | null>(tenantId)\n  const hydratedRef = React.useRef(false)\n  const handleChange = React.useCallback((next: string | null) => {\n    setValue(next ?? null)\n  }, [setValue])\n\n  React.useEffect(() => {\n    if (!hydratedRef.current) {\n      hydratedRef.current = true\n      prevTenantRef.current = tenantId\n      return\n    }\n    if (prevTenantRef.current !== tenantId) {\n      prevTenantRef.current = tenantId\n      setValue(null)\n    }\n  }, [tenantId, setValue])\n\n  return (\n    <OrganizationSelect\n      id={fieldId}\n      value={value}\n      onChange={handleChange}\n      required\n      includeEmptyOption\n      className=\"w-full h-9 rounded border pl-2 pr-7 text-sm truncate\"\n      includeInactiveIds={includeInactiveIds}\n      tenantId={tenantId}\n    />\n  )\n}\n\nexport default function EditUserPage({ params }: { params?: { id?: string } }) {\n  const id = params?.id\n  const t = useT()\n  const tRef = React.useRef(t)\n  tRef.current = t\n  const [initialUser, setInitialUser] = React.useState<LoadedUser | null>(null)\n  const [selectedTenantId, setSelectedTenantId] = React.useState<string | null>(null)\n  const [loading, setLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [canEditOrgs, setCanEditOrgs] = React.useState(false)\n  const [aclData, setAclData] = React.useState<AclData>({ isSuperAdmin: false, features: [], organizations: null })\n  const [customFieldValues, setCustomFieldValues] = React.useState<Record<string, unknown>>({})\n  const [actorIsSuperAdmin, setActorIsSuperAdmin] = React.useState(false)\n  const [actorResolved, setActorResolved] = React.useState(false)\n  const widgetEditorRef = React.useRef<WidgetVisibilityEditorHandle | null>(null)\n  const [resendingInvite, setResendingInvite] = React.useState(false)\n\n  const handleResendInvite = React.useCallback(async () => {\n    if (!id) return\n    setResendingInvite(true)\n    try {\n      const { ok, result } = await apiCall<{ ok?: boolean; warning?: string }>('/api/auth/users/resend-invite', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ id }),\n      })\n      if (ok) {\n        if (result?.warning === 'invite_email_failed') {\n          flash(tRef.current('auth.users.flash.inviteEmailFailed', 'Invite token created but the email could not be sent. Please check your email provider configuration.'), 'warning')\n        } else {\n          flash(tRef.current('auth.users.flash.inviteSent', 'Invitation email sent'), 'success')\n        }\n      }\n    } catch (err) {\n      console.error('Failed to resend invite:', err)\n      flash(tRef.current('auth.users.form.errors.inviteResend', 'Failed to send invitation email'), 'error')\n    } finally {\n      setResendingInvite(false)\n    }\n  }, [id])\n  const passwordPolicy = React.useMemo(() => getPasswordPolicy(), [])\n  const passwordRequirements = React.useMemo(\n    () => formatPasswordRequirements(passwordPolicy, t),\n    [passwordPolicy, t],\n  )\n  const passwordDescription = React.useMemo(() => (\n    passwordRequirements\n      ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })\n      : undefined\n  ), [passwordRequirements, t])\n\n  React.useEffect(() => {\n    if (!id) {\n      setLoading(false)\n      setError(tRef.current('auth.users.form.errors.noId', 'No user ID provided'))\n      return\n    }\n    let cancelled = false\n    async function load() {\n      setLoading(true)\n      setError(null)\n      setCustomFieldValues({})\n      try {\n        const { ok, result } = await apiCall<UserListResponse>(\n          `/api/auth/users?id=${encodeURIComponent(String(id))}&page=1&pageSize=1`,\n        )\n        if (!ok) throw new Error('load_failed')\n        const item = Array.isArray(result?.items) ? result?.items?.[0] : undefined\n        if (!cancelled) {\n          setActorIsSuperAdmin(Boolean(result?.isSuperAdmin))\n          setActorResolved(true)\n          if (!item) {\n            setError(tRef.current('auth.users.form.errors.notFound', 'User not found'))\n            setCustomFieldValues({})\n            setInitialUser(null)\n            setSelectedTenantId(null)\n          } else {\n            const roleNames = Array.isArray(item.roles)\n              ? item.roles\n                  .map((role) => (typeof role === 'string' ? role : role == null ? '' : String(role)))\n                  .filter((role) => role.trim().length > 0)\n              : []\n            const roleIds = Array.isArray(item.roleIds)\n              ? (item.roleIds as string[]).filter((rid) => typeof rid === 'string' && rid.trim().length > 0)\n              : []\n            setInitialUser({\n              id: item.id ? String(item.id) : String(id),\n              email: item.email ? String(item.email) : '',\n              name: item.name ? String(item.name) : null,\n              organizationId: item.organizationId ? String(item.organizationId) : null,\n              tenantId: item.tenantId ? String(item.tenantId) : null,\n              tenantName: item.tenantName ? String(item.tenantName) : null,\n              organizationName: item.organizationName ? String(item.organizationName) : null,\n              roles: roleNames,\n              roleIds: roleIds.length > 0 ? roleIds : roleNames,\n              hasPassword: item.hasPassword !== false,\n            })\n            setSelectedTenantId(item.tenantId ? String(item.tenantId) : null)\n            const custom = extractCustomFieldEntries(item as Record<string, unknown>)\n            setCustomFieldValues(custom)\n          }\n        }\n      } catch (err) {\n        console.error('Failed to load user:', err)\n        if (!cancelled) setError(tRef.current('auth.users.form.errors.load', 'Failed to load user data'))\n        if (!cancelled) setCustomFieldValues({})\n        if (!cancelled) setActorResolved(true)\n      }\n      if (!cancelled) setLoading(false)\n      try {\n        const featureCheck = await apiCall<FeatureCheckResponse>(\n          '/api/auth/feature-check',\n          {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({ features: ['directory.organizations.view'] }),\n          },\n          { fallback: { ok: false } },\n        )\n        if (!cancelled) setCanEditOrgs(Boolean(featureCheck.result?.ok))\n      } catch (err) {\n        console.error('Failed to check features:', err)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [id])\n\n  const selectedOrgId = initialUser?.organizationId ? String(initialUser.organizationId) : null\n  const preloadedTenants = React.useMemo(() => {\n    if (!selectedTenantId) return null\n    const name = initialUser?.tenantId === selectedTenantId\n      ? (initialUser?.tenantName ?? selectedTenantId)\n      : selectedTenantId\n    return [{ id: selectedTenantId, name, isActive: true }]\n  }, [initialUser, selectedTenantId])\n\n  // Block role loading until we know whether the actor is a super admin. Without this guard the\n  // initial (non-super-admin) branch fires before the flag resolves and the server returns roles\n  // from other tenants because the real caller is a super admin without tenantId scoping.\n  const loadRoleOptions = React.useCallback(async (query?: string): Promise<CrudFieldOption[]> => {\n    if (!actorResolved) return []\n    if (actorIsSuperAdmin) {\n      if (!selectedTenantId) return []\n      return fetchRoleOptions(query, { tenantId: selectedTenantId, includeSuperAdmin: true })\n    }\n    return fetchRoleOptions(query)\n  }, [actorIsSuperAdmin, actorResolved, selectedTenantId])\n\n  const userHasPassword = initialUser?.hasPassword !== false\n  const fields: CrudField[] = React.useMemo(() => {\n    const items: CrudField[] = [\n      { id: 'email', label: t('auth.users.form.field.email', 'Email'), type: 'text', required: true },\n      { id: 'name', label: t('auth.users.form.field.name', 'Display name'), type: 'text' },\n      {\n        id: 'password',\n        label: userHasPassword\n          ? t('auth.users.form.field.newPassword', 'New Password')\n          : t('auth.users.form.field.setPassword', 'Set Password'),\n        type: 'password' as const,\n        description: [\n          userHasPassword\n            ? t('auth.users.form.field.passwordChangeHint', 'Leave blank to keep current password')\n            : t('auth.users.form.field.passwordInviteHint', 'Optionally set a password for this user (they were invited via email)'),\n          passwordDescription,\n        ].filter(Boolean).join('. '),\n      },\n    ]\n    if (actorIsSuperAdmin) {\n      items.push({\n        id: 'tenantId',\n        label: t('auth.users.form.field.tenant', 'Tenant'),\n        type: 'custom',\n        required: true,\n        component: ({ value, setValue }) => {\n          const normalizedValue = typeof value === 'string'\n            ? value\n            : (typeof selectedTenantId === 'string' ? selectedTenantId : null)\n          return (\n            <TenantSelect\n              id=\"tenantId\"\n              value={normalizedValue}\n              onChange={(next) => {\n                const resolved = next ?? null\n                setValue(resolved)\n                setSelectedTenantId(resolved)\n                setAclData({ isSuperAdmin: false, features: [], organizations: null })\n              }}\n              includeEmptyOption\n              className=\"w-full h-9 rounded border pl-2 pr-7 text-sm truncate\"\n              required\n              tenants={preloadedTenants}\n            />\n          )\n        },\n      })\n    }\n    items.push({\n      id: 'organizationId',\n      label: t('auth.users.form.field.organization', 'Organization'),\n      type: 'custom',\n      required: true,\n      component: ({ id, value, setValue }) => {\n        const normalizedValue = typeof value === 'string' ? (value.length > 0 ? value : null) : null\n        return (\n          <TenantAwareOrganizationSelectInput\n            fieldId={id}\n            value={normalizedValue}\n            setValue={(next) => setValue(next ?? null)}\n            tenantId={selectedTenantId}\n            includeInactiveIds={selectedOrgId ? [selectedOrgId] : undefined}\n          />\n        )\n      },\n    })\n    items.push({ id: 'roles', label: t('auth.users.form.field.roles', 'Roles'), type: 'tags', loadOptions: loadRoleOptions })\n    return items\n  }, [actorIsSuperAdmin, loadRoleOptions, passwordDescription, preloadedTenants, selectedOrgId, selectedTenantId, t, userHasPassword])\n\n  const detailFieldIds = React.useMemo(() => {\n    const base: string[] = ['email', 'name', 'password', 'organizationId', 'roles']\n    if (actorIsSuperAdmin) base.splice(2, 0, 'tenantId')\n    return base\n  }, [actorIsSuperAdmin])\n\n  const groups: CrudFormGroup[] = React.useMemo(() => [\n    { id: 'details', title: t('auth.users.form.group.details', 'Details'), column: 1, fields: detailFieldIds },\n    { id: 'custom', title: t('auth.users.form.group.customFields', 'Custom Data'), column: 2, kind: 'customFields' },\n    {\n      id: 'acl',\n      title: t('auth.users.form.group.access', 'Access'),\n      column: 1,\n      component: () => (id\n        ? (\n          <AclEditor\n            kind=\"user\"\n            targetId={String(id)}\n            canEditOrganizations={canEditOrgs}\n            value={aclData}\n            onChange={setAclData}\n            userRoles={initialUser?.roles || []}\n            currentUserIsSuperAdmin={actorIsSuperAdmin}\n            tenantId={selectedTenantId ?? null}\n          />\n        )\n        : null),\n    },\n    {\n      id: 'dashboardWidgets',\n      title: t('auth.users.form.group.widgets', 'Dashboard Widgets'),\n      column: 2,\n      component: () => (id && initialUser\n        ? (\n          <WidgetVisibilityEditor\n            kind=\"user\"\n            targetId={String(id)}\n            tenantId={selectedTenantId ?? null}\n            organizationId={initialUser?.organizationId ?? null}\n            ref={widgetEditorRef}\n          />\n        ) : null\n      ),\n    },\n    {\n      id: 'consents',\n      title: t('auth.users.form.group.consents', 'Consents'),\n      column: 2,\n      component: () => (id ? <UserConsentsPanel userId={String(id)} /> : null),\n    },\n  ], [aclData, actorIsSuperAdmin, canEditOrgs, detailFieldIds, id, initialUser, selectedTenantId, t])\n\n  const initialValues = React.useMemo(() => {\n    if (initialUser) {\n      return {\n        email: initialUser.email,\n        name: initialUser.name ?? '',\n        password: '',\n        tenantId: initialUser.tenantId,\n        organizationId: initialUser.organizationId,\n        roles: initialUser.roleIds,\n        ...customFieldValues,\n      }\n    }\n    return {\n      email: '',\n      name: '',\n      password: '',\n      tenantId: selectedTenantId ?? null,\n      organizationId: null,\n      roles: [],\n      ...customFieldValues,\n    }\n  }, [initialUser, customFieldValues, selectedTenantId])\n\n  return (\n    <Page>\n      <PageBody>\n        {error && (\n          <div className=\"p-4 mb-4 bg-red-50 border border-red-200 rounded text-red-800\">\n            {error}\n          </div>\n        )}\n        <CrudForm<EditUserFormValues>\n          title={t('auth.users.form.title.edit', 'Edit User')}\n          backHref=\"/backend/users\"\n          versionHistory={{ resourceKind: 'auth.user', resourceId: id ? String(id) : '' }}\n          fields={fields}\n          groups={groups}\n          entityId={E.auth.user}\n          initialValues={initialValues}\n          isLoading={loading}\n          loadingMessage={t('auth.users.form.loading', 'Loading user data...')}\n          submitLabel={t('auth.users.form.action.save', 'Save')}\n          cancelHref=\"/backend/users\"\n          extraActions={id && !userHasPassword ? (\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              disabled={resendingInvite}\n              onClick={handleResendInvite}\n            >\n              {resendingInvite\n                ? t('auth.users.form.action.resendingInvite', 'Sending...')\n                : t('auth.users.form.action.resendInvite', 'Resend Invite')}\n            </Button>\n          ) : undefined}\n          successRedirect={`/backend/users?flash=${encodeURIComponent(t('auth.users.flash.updated', 'User saved'))}&type=success`}\n          onSubmit={async (values) => {\n            if (!id) return\n            const customFields = collectCustomFieldValues(values)\n            const payload = {\n              id: id ? String(id) : '',\n              email: values.email,\n              name: normalizeDisplayNameInput(values.name),\n              password: values.password && values.password.trim() ? values.password : undefined,\n              organizationId: values.organizationId ? values.organizationId : undefined,\n              roles: Array.isArray(values.roles) ? values.roles : [],\n              ...(Object.keys(customFields).length ? { customFields } : {}),\n            }\n            await updateCrud('auth/users', payload)\n            await updateCrud('auth/users/acl', { userId: id, ...aclData }, {\n              errorMessage: t('auth.users.form.errors.aclUpdate', 'Failed to update user access control'),\n            })\n            await widgetEditorRef.current?.save()\n            try { window.dispatchEvent(new Event('om:refresh-sidebar')) } catch {}\n          }}\n          onDelete={async () => {\n            await deleteCrud('auth/users', String(id), {\n              errorMessage: t('auth.users.form.errors.delete', 'Failed to delete user'),\n            })\n          }}\n          deleteRedirect={`/backend/users?flash=${encodeURIComponent(t('auth.users.flash.deleted', 'User deleted'))}&type=success`}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AAmGI,cAqTE,YArTF;AAlGJ,YAAY,WAAW;AACvB,SAAS,SAAS;AAClB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAA0E;AACnF,SAAS,eAAe;AACxB,SAAS,YAAY,kBAAkB;AACvC,SAAS,gCAAgC;AACzC,SAAS,iBAA+B;AACxC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,8BAAiE;AAC1E,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B,yBAAyB;AAC9D,SAAS,yBAAyB;AAClC,SAAS,iCAAiC;AAsD1C,SAAS,mCAAmC;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAuC;AACrC,QAAM,gBAAgB,MAAM,OAAsB,QAAQ;AAC1D,QAAM,cAAc,MAAM,OAAO,KAAK;AACtC,QAAM,eAAe,MAAM,YAAY,CAAC,SAAwB;AAC9D,aAAS,QAAQ,IAAI;AAAA,EACvB,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,YAAY,SAAS;AACxB,kBAAY,UAAU;AACtB,oBAAc,UAAU;AACxB;AAAA,IACF;AACA,QAAI,cAAc,YAAY,UAAU;AACtC,oBAAc,UAAU;AACxB,eAAS,IAAI;AAAA,IACf;AAAA,EACF,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,IAAI;AAAA,MACJ;AAAA,MACA,UAAU;AAAA,MACV,UAAQ;AAAA,MACR,oBAAkB;AAAA,MAClB,WAAU;AAAA,MACV;AAAA,MACA;AAAA;AAAA,EACF;AAEJ;AAEe,SAAR,aAA8B,EAAE,OAAO,GAAiC;AAC7E,QAAM,KAAK,QAAQ;AACnB,QAAM,IAAI,KAAK;AACf,QAAM,OAAO,MAAM,OAAO,CAAC;AAC3B,OAAK,UAAU;AACf,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAA4B,IAAI;AAC5E,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAwB,IAAI;AAClF,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,KAAK;AAC1D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAkB,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK,CAAC;AAChH,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAkC,CAAC,CAAC;AAC5F,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAS,KAAK;AACtE,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,kBAAkB,MAAM,OAA4C,IAAI;AAC9E,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAElE,QAAM,qBAAqB,MAAM,YAAY,YAAY;AACvD,QAAI,CAAC,GAAI;AACT,uBAAmB,IAAI;AACvB,QAAI;AACF,YAAM,EAAE,IAAI,OAAO,IAAI,MAAM,QAA4C,iCAAiC;AAAA,QACxG,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,GAAG,CAAC;AAAA,MAC7B,CAAC;AACD,UAAI,IAAI;AACN,YAAI,QAAQ,YAAY,uBAAuB;AAC7C,gBAAM,KAAK,QAAQ,sCAAsC,uGAAuG,GAAG,SAAS;AAAA,QAC9K,OAAO;AACL,gBAAM,KAAK,QAAQ,+BAA+B,uBAAuB,GAAG,SAAS;AAAA,QACvF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,4BAA4B,GAAG;AAC7C,YAAM,KAAK,QAAQ,uCAAuC,iCAAiC,GAAG,OAAO;AAAA,IACvG,UAAE;AACA,yBAAmB,KAAK;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,EAAE,CAAC;AACP,QAAM,iBAAiB,MAAM,QAAQ,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAClE,QAAM,uBAAuB,MAAM;AAAA,IACjC,MAAM,2BAA2B,gBAAgB,CAAC;AAAA,IAClD,CAAC,gBAAgB,CAAC;AAAA,EACpB;AACA,QAAM,sBAAsB,MAAM,QAAQ,MACxC,uBACI,EAAE,mCAAmC,yCAAyC,EAAE,cAAc,qBAAqB,CAAC,IACpH,QACH,CAAC,sBAAsB,CAAC,CAAC;AAE5B,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,IAAI;AACP,iBAAW,KAAK;AAChB,eAAS,KAAK,QAAQ,+BAA+B,qBAAqB,CAAC;AAC3E;AAAA,IACF;AACA,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,iBAAW,IAAI;AACf,eAAS,IAAI;AACb,2BAAqB,CAAC,CAAC;AACvB,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,UAC3B,sBAAsB,mBAAmB,OAAO,EAAE,CAAC,CAAC;AAAA,QACtD;AACA,YAAI,CAAC,GAAI,OAAM,IAAI,MAAM,aAAa;AACtC,cAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAC,IAAI;AACjE,YAAI,CAAC,WAAW;AACd,+BAAqB,QAAQ,QAAQ,YAAY,CAAC;AAClD,2BAAiB,IAAI;AACrB,cAAI,CAAC,MAAM;AACT,qBAAS,KAAK,QAAQ,mCAAmC,gBAAgB,CAAC;AAC1E,iCAAqB,CAAC,CAAC;AACvB,2BAAe,IAAI;AACnB,gCAAoB,IAAI;AAAA,UAC1B,OAAO;AACL,kBAAM,YAAY,MAAM,QAAQ,KAAK,KAAK,IACtC,KAAK,MACF,IAAI,CAAC,SAAU,OAAO,SAAS,WAAW,OAAO,QAAQ,OAAO,KAAK,OAAO,IAAI,CAAE,EAClF,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,SAAS,CAAC,IAC1C,CAAC;AACL,kBAAM,UAAU,MAAM,QAAQ,KAAK,OAAO,IACrC,KAAK,QAAqB,OAAO,CAAC,QAAQ,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,SAAS,CAAC,IAC3F,CAAC;AACL,2BAAe;AAAA,cACb,IAAI,KAAK,KAAK,OAAO,KAAK,EAAE,IAAI,OAAO,EAAE;AAAA,cACzC,OAAO,KAAK,QAAQ,OAAO,KAAK,KAAK,IAAI;AAAA,cACzC,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,cACtC,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,cACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,cAClD,YAAY,KAAK,aAAa,OAAO,KAAK,UAAU,IAAI;AAAA,cACxD,kBAAkB,KAAK,mBAAmB,OAAO,KAAK,gBAAgB,IAAI;AAAA,cAC1E,OAAO;AAAA,cACP,SAAS,QAAQ,SAAS,IAAI,UAAU;AAAA,cACxC,aAAa,KAAK,gBAAgB;AAAA,YACpC,CAAC;AACD,gCAAoB,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,IAAI;AAChE,kBAAM,SAAS,0BAA0B,IAA+B;AACxE,iCAAqB,MAAM;AAAA,UAC7B;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,MAAM,wBAAwB,GAAG;AACzC,YAAI,CAAC,UAAW,UAAS,KAAK,QAAQ,+BAA+B,0BAA0B,CAAC;AAChG,YAAI,CAAC,UAAW,sBAAqB,CAAC,CAAC;AACvC,YAAI,CAAC,UAAW,kBAAiB,IAAI;AAAA,MACvC;AACA,UAAI,CAAC,UAAW,YAAW,KAAK;AAChC,UAAI;AACF,cAAM,eAAe,MAAM;AAAA,UACzB;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,CAAC,8BAA8B,EAAE,CAAC;AAAA,UACrE;AAAA,UACA,EAAE,UAAU,EAAE,IAAI,MAAM,EAAE;AAAA,QAC5B;AACA,YAAI,CAAC,UAAW,gBAAe,QAAQ,aAAa,QAAQ,EAAE,CAAC;AAAA,MACjE,SAAS,KAAK;AACZ,gBAAQ,MAAM,6BAA6B,GAAG;AAAA,MAChD;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,EAAE,CAAC;AAEP,QAAM,gBAAgB,aAAa,iBAAiB,OAAO,YAAY,cAAc,IAAI;AACzF,QAAM,mBAAmB,MAAM,QAAQ,MAAM;AAC3C,QAAI,CAAC,iBAAkB,QAAO;AAC9B,UAAM,OAAO,aAAa,aAAa,mBAClC,aAAa,cAAc,mBAC5B;AACJ,WAAO,CAAC,EAAE,IAAI,kBAAkB,MAAM,UAAU,KAAK,CAAC;AAAA,EACxD,GAAG,CAAC,aAAa,gBAAgB,CAAC;AAKlC,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAA+C;AAC9F,QAAI,CAAC,cAAe,QAAO,CAAC;AAC5B,QAAI,mBAAmB;AACrB,UAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,aAAO,iBAAiB,OAAO,EAAE,UAAU,kBAAkB,mBAAmB,KAAK,CAAC;AAAA,IACxF;AACA,WAAO,iBAAiB,KAAK;AAAA,EAC/B,GAAG,CAAC,mBAAmB,eAAe,gBAAgB,CAAC;AAEvD,QAAM,kBAAkB,aAAa,gBAAgB;AACrD,QAAM,SAAsB,MAAM,QAAQ,MAAM;AAC9C,UAAM,QAAqB;AAAA,MACzB,EAAE,IAAI,SAAS,OAAO,EAAE,+BAA+B,OAAO,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,MAC9F,EAAE,IAAI,QAAQ,OAAO,EAAE,8BAA8B,cAAc,GAAG,MAAM,OAAO;AAAA,MACnF;AAAA,QACE,IAAI;AAAA,QACJ,OAAO,kBACH,EAAE,qCAAqC,cAAc,IACrD,EAAE,qCAAqC,cAAc;AAAA,QACzD,MAAM;AAAA,QACN,aAAa;AAAA,UACX,kBACI,EAAE,4CAA4C,sCAAsC,IACpF,EAAE,4CAA4C,uEAAuE;AAAA,UACzH;AAAA,QACF,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,MAC7B;AAAA,IACF;AACA,QAAI,mBAAmB;AACrB,YAAM,KAAK;AAAA,QACT,IAAI;AAAA,QACJ,OAAO,EAAE,gCAAgC,QAAQ;AAAA,QACjD,MAAM;AAAA,QACN,UAAU;AAAA,QACV,WAAW,CAAC,EAAE,OAAO,SAAS,MAAM;AAClC,gBAAM,kBAAkB,OAAO,UAAU,WACrC,QACC,OAAO,qBAAqB,WAAW,mBAAmB;AAC/D,iBACE;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO;AAAA,cACP,UAAU,CAAC,SAAS;AAClB,sBAAM,WAAW,QAAQ;AACzB,yBAAS,QAAQ;AACjB,oCAAoB,QAAQ;AAC5B,2BAAW,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK,CAAC;AAAA,cACvE;AAAA,cACA,oBAAkB;AAAA,cAClB,WAAU;AAAA,cACV,UAAQ;AAAA,cACR,SAAS;AAAA;AAAA,UACX;AAAA,QAEJ;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,KAAK;AAAA,MACT,IAAI;AAAA,MACJ,OAAO,EAAE,sCAAsC,cAAc;AAAA,MAC7D,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW,CAAC,EAAE,IAAAA,KAAI,OAAO,SAAS,MAAM;AACtC,cAAM,kBAAkB,OAAO,UAAU,WAAY,MAAM,SAAS,IAAI,QAAQ,OAAQ;AACxF,eACE;AAAA,UAAC;AAAA;AAAA,YACC,SAASA;AAAA,YACT,OAAO;AAAA,YACP,UAAU,CAAC,SAAS,SAAS,QAAQ,IAAI;AAAA,YACzC,UAAU;AAAA,YACV,oBAAoB,gBAAgB,CAAC,aAAa,IAAI;AAAA;AAAA,QACxD;AAAA,MAEJ;AAAA,IACF,CAAC;AACD,UAAM,KAAK,EAAE,IAAI,SAAS,OAAO,EAAE,+BAA+B,OAAO,GAAG,MAAM,QAAQ,aAAa,gBAAgB,CAAC;AACxH,WAAO;AAAA,EACT,GAAG,CAAC,mBAAmB,iBAAiB,qBAAqB,kBAAkB,eAAe,kBAAkB,GAAG,eAAe,CAAC;AAEnI,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,UAAM,OAAiB,CAAC,SAAS,QAAQ,YAAY,kBAAkB,OAAO;AAC9E,QAAI,kBAAmB,MAAK,OAAO,GAAG,GAAG,UAAU;AACnD,WAAO;AAAA,EACT,GAAG,CAAC,iBAAiB,CAAC;AAEtB,QAAM,SAA0B,MAAM,QAAQ,MAAM;AAAA,IAClD,EAAE,IAAI,WAAW,OAAO,EAAE,iCAAiC,SAAS,GAAG,QAAQ,GAAG,QAAQ,eAAe;AAAA,IACzG,EAAE,IAAI,UAAU,OAAO,EAAE,sCAAsC,aAAa,GAAG,QAAQ,GAAG,MAAM,eAAe;AAAA,IAC/G;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,gCAAgC,QAAQ;AAAA,MACjD,QAAQ;AAAA,MACR,WAAW,MAAO,KAEd;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,UAAU,OAAO,EAAE;AAAA,UACnB,sBAAsB;AAAA,UACtB,OAAO;AAAA,UACP,UAAU;AAAA,UACV,WAAW,aAAa,SAAS,CAAC;AAAA,UAClC,yBAAyB;AAAA,UACzB,UAAU,oBAAoB;AAAA;AAAA,MAChC,IAEA;AAAA,IACN;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,iCAAiC,mBAAmB;AAAA,MAC7D,QAAQ;AAAA,MACR,WAAW,MAAO,MAAM,cAEpB;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,UAAU,OAAO,EAAE;AAAA,UACnB,UAAU,oBAAoB;AAAA,UAC9B,gBAAgB,aAAa,kBAAkB;AAAA,UAC/C,KAAK;AAAA;AAAA,MACP,IACE;AAAA,IAER;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,kCAAkC,UAAU;AAAA,MACrD,QAAQ;AAAA,MACR,WAAW,MAAO,KAAK,oBAAC,qBAAkB,QAAQ,OAAO,EAAE,GAAG,IAAK;AAAA,IACrE;AAAA,EACF,GAAG,CAAC,SAAS,mBAAmB,aAAa,gBAAgB,IAAI,aAAa,kBAAkB,CAAC,CAAC;AAElG,QAAM,gBAAgB,MAAM,QAAQ,MAAM;AACxC,QAAI,aAAa;AACf,aAAO;AAAA,QACL,OAAO,YAAY;AAAA,QACnB,MAAM,YAAY,QAAQ;AAAA,QAC1B,UAAU;AAAA,QACV,UAAU,YAAY;AAAA,QACtB,gBAAgB,YAAY;AAAA,QAC5B,OAAO,YAAY;AAAA,QACnB,GAAG;AAAA,MACL;AAAA,IACF;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU,oBAAoB;AAAA,MAC9B,gBAAgB;AAAA,MAChB,OAAO,CAAC;AAAA,MACR,GAAG;AAAA,IACL;AAAA,EACF,GAAG,CAAC,aAAa,mBAAmB,gBAAgB,CAAC;AAErD,SACE,oBAAC,QACC,+BAAC,YACE;AAAA,aACC,oBAAC,SAAI,WAAU,iEACZ,iBACH;AAAA,IAEF;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,8BAA8B,WAAW;AAAA,QAClD,UAAS;AAAA,QACT,gBAAgB,EAAE,cAAc,aAAa,YAAY,KAAK,OAAO,EAAE,IAAI,GAAG;AAAA,QAC9E;AAAA,QACA;AAAA,QACA,UAAU,EAAE,KAAK;AAAA,QACjB;AAAA,QACA,WAAW;AAAA,QACX,gBAAgB,EAAE,2BAA2B,sBAAsB;AAAA,QACnE,aAAa,EAAE,+BAA+B,MAAM;AAAA,QACpD,YAAW;AAAA,QACX,cAAc,MAAM,CAAC,kBACnB;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,UAAU;AAAA,YACV,SAAS;AAAA,YAER,4BACG,EAAE,0CAA0C,YAAY,IACxD,EAAE,uCAAuC,eAAe;AAAA;AAAA,QAC9D,IACE;AAAA,QACJ,iBAAiB,wBAAwB,mBAAmB,EAAE,4BAA4B,YAAY,CAAC,CAAC;AAAA,QACxG,UAAU,OAAO,WAAW;AAC1B,cAAI,CAAC,GAAI;AACT,gBAAM,eAAe,yBAAyB,MAAM;AACpD,gBAAM,UAAU;AAAA,YACd,IAAI,KAAK,OAAO,EAAE,IAAI;AAAA,YACtB,OAAO,OAAO;AAAA,YACd,MAAM,0BAA0B,OAAO,IAAI;AAAA,YAC3C,UAAU,OAAO,YAAY,OAAO,SAAS,KAAK,IAAI,OAAO,WAAW;AAAA,YACxE,gBAAgB,OAAO,iBAAiB,OAAO,iBAAiB;AAAA,YAChE,OAAO,MAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,QAAQ,CAAC;AAAA,YACrD,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC;AAAA,UAC7D;AACA,gBAAM,WAAW,cAAc,OAAO;AACtC,gBAAM,WAAW,kBAAkB,EAAE,QAAQ,IAAI,GAAG,QAAQ,GAAG;AAAA,YAC7D,cAAc,EAAE,oCAAoC,sCAAsC;AAAA,UAC5F,CAAC;AACD,gBAAM,gBAAgB,SAAS,KAAK;AACpC,cAAI;AAAE,mBAAO,cAAc,IAAI,MAAM,oBAAoB,CAAC;AAAA,UAAE,QAAQ;AAAA,UAAC;AAAA,QACvE;AAAA,QACA,UAAU,YAAY;AACpB,gBAAM,WAAW,cAAc,OAAO,EAAE,GAAG;AAAA,YACzC,cAAc,EAAE,iCAAiC,uBAAuB;AAAA,UAC1E,CAAC;AAAA,QACH;AAAA,QACA,gBAAgB,wBAAwB,mBAAmB,EAAE,4BAA4B,cAAc,CAAC,CAAC;AAAA;AAAA,IAC3G;AAAA,KACF,GACF;AAEJ;",
   "names": ["id"]
 }

package/dist/modules/auth/backend/users/create/page.js

@@ -135,7 +135,7 @@ function CreateUserPage() {
     if (!actorResolved) return [];
     if (actorIsSuperAdmin) {
       if (!selectedTenantId) return [];
-      return fetchRoleOptions(query, { tenantId: selectedTenantId });
+      return fetchRoleOptions(query, { tenantId: selectedTenantId, includeSuperAdmin: true });
     }
     return fetchRoleOptions(query);
   }, [actorIsSuperAdmin, actorResolved, selectedTenantId]);

package/dist/modules/auth/backend/users/create/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/auth/backend/users/create/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { E } from '#generated/entities.ids.generated'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm, type CrudField, type CrudFormGroup, type CrudFieldOption } from '@open-mercato/ui/backend/CrudForm'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { createCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'\nimport { OrganizationSelect } from '@open-mercato/core/modules/directory/components/OrganizationSelect'\nimport { TenantSelect } from '@open-mercato/core/modules/directory/components/TenantSelect'\nimport { fetchRoleOptions } from '@open-mercato/core/modules/auth/backend/users/roleOptions'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { RadioGroup } from '@open-mercato/ui/primitives/radio'\nimport { RadioField } from '@open-mercato/ui/primitives/radio-field'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'\n\ntype CreateUserFormValues = {\n  email: string\n  name: string\n  password: string\n  tenantId: string | null\n  organizationId: string | null\n  roles: string[]\n} & Record<string, unknown>\n\ntype UserListResponse = {\n  isSuperAdmin?: boolean\n}\n\ntype WidgetCatalogResponse = {\n  items?: Array<{ id?: string | null; title?: string | null; description?: string | null }>\n}\n\ntype TenantAwareOrganizationSelectProps = {\n  fieldId: string\n  value: string | null\n  setValue: (value: string | null) => void\n  tenantId: string | null\n  includeInactiveIds?: Iterable<string | null | undefined>\n}\n\nfunction TenantAwareOrganizationSelectInput({\n  fieldId,\n  value,\n  setValue,\n  tenantId,\n  includeInactiveIds,\n}: TenantAwareOrganizationSelectProps) {\n  const prevTenantRef = React.useRef<string | null>(tenantId)\n  const hydratedRef = React.useRef(false)\n  const handleChange = React.useCallback((next: string | null) => {\n    setValue(next ?? null)\n  }, [setValue])\n\n  React.useEffect(() => {\n    if (!hydratedRef.current) {\n      hydratedRef.current = true\n      prevTenantRef.current = tenantId\n      return\n    }\n    if (prevTenantRef.current !== tenantId) {\n      prevTenantRef.current = tenantId\n      setValue(null)\n    }\n  }, [tenantId, setValue])\n\n  return (\n    <OrganizationSelect\n      id={fieldId}\n      value={value}\n      onChange={handleChange}\n      required\n      includeEmptyOption\n      className=\"w-full h-9 rounded border px-2 text-sm\"\n      tenantId={tenantId}\n      includeInactiveIds={includeInactiveIds}\n    />\n  )\n}\n\nexport default function CreateUserPage() {\n  const t = useT()\n  const [widgetCatalog, setWidgetCatalog] = React.useState<Array<{ id: string; title: string; description: string | null }>>([])\n  const [widgetLoading, setWidgetLoading] = React.useState(true)\n  const [widgetError, setWidgetError] = React.useState<string | null>(null)\n  const [widgetMode, setWidgetMode] = React.useState<'inherit' | 'override'>('inherit')\n  const [selectedWidgets, setSelectedWidgets] = React.useState<string[]>([])\n  const [selectedTenantId, setSelectedTenantId] = React.useState<string | null>(null)\n  const [actorIsSuperAdmin, setActorIsSuperAdmin] = React.useState(false)\n  const [actorResolved, setActorResolved] = React.useState(false)\n  const [sendInviteEmail, setSendInviteEmail] = React.useState(false)\n  const passwordPolicy = React.useMemo(() => getPasswordPolicy(), [])\n  const passwordRequirements = React.useMemo(\n    () => formatPasswordRequirements(passwordPolicy, t),\n    [passwordPolicy, t],\n  )\n  const passwordDescription = React.useMemo(() => (\n    passwordRequirements\n      ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })\n      : undefined\n  ), [passwordRequirements, t])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadCatalog() {\n      setWidgetLoading(true)\n      setWidgetError(null)\n      try {\n        const { ok, result } = await apiCall<WidgetCatalogResponse>('/api/dashboards/widgets/catalog')\n        if (!ok) throw new Error('request_failed')\n        if (!cancelled) {\n          const rawItems: unknown[] = Array.isArray(result?.items) ? result?.items ?? [] : []\n          const normalized = rawItems\n            .map((item: unknown) => {\n              if (!item || typeof item !== 'object') return null\n              const entry = item as Record<string, unknown>\n              const idValue = entry.id\n              const titleValue = entry.title\n              const descriptionValue = entry.description\n              const id = typeof idValue === 'string' ? idValue : null\n              if (!id || !id.length) return null\n              const title = typeof titleValue === 'string' && titleValue.length > 0 ? titleValue : id\n              const description = typeof descriptionValue === 'string' && descriptionValue.length > 0 ? descriptionValue : null\n              return { id, title, description }\n            })\n            .filter((item): item is { id: string; title: string; description: string | null } => item !== null)\n          setWidgetCatalog(normalized)\n        }\n      } catch (err) {\n        console.error('Failed to load dashboard widget catalog', err)\n        if (!cancelled) {\n          setWidgetError(t(\n            'auth.users.widgets.errors.load',\n            'Unable to load dashboard widgets. You can configure them later from the user page.',\n          ))\n        }\n      } finally {\n        if (!cancelled) setWidgetLoading(false)\n      }\n    }\n    loadCatalog()\n    return () => { cancelled = true }\n  }, [t])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadActor() {\n      try {\n        const { ok, result } = await apiCall<UserListResponse>('/api/auth/users?page=1&pageSize=1')\n        if (!cancelled && ok) setActorIsSuperAdmin(Boolean(result?.isSuperAdmin))\n      } catch (err) {\n        console.error('Failed to resolve actor super admin flag', err)\n      } finally {\n        if (!cancelled) setActorResolved(true)\n      }\n    }\n    loadActor()\n    return () => { cancelled = true }\n  }, [])\n\n  const toggleWidget = React.useCallback((id: string) => {\n    setSelectedWidgets((prev) => (prev.includes(id) ? prev.filter((value) => value !== id) : [...prev, id]))\n  }, [])\n\n  // Block role loading until we know whether the actor is a super admin. Without this guard the\n  // initial (non-super-admin) branch fires before the flag resolves and the server returns roles\n  // from other tenants because the real caller is a super admin without tenantId scoping.\n  const loadRoleOptions = React.useCallback(async (query?: string): Promise<CrudFieldOption[]> => {\n    if (!actorResolved) return []\n    if (actorIsSuperAdmin) {\n      if (!selectedTenantId) return []\n      return fetchRoleOptions(query, { tenantId: selectedTenantId })\n    }\n    return fetchRoleOptions(query)\n  }, [actorIsSuperAdmin, actorResolved, selectedTenantId])\n\n  const fields: CrudField[] = React.useMemo(() => {\n    const items: CrudField[] = [\n      { id: 'email', label: t('auth.users.form.field.email', 'Email'), type: 'text', required: true },\n      { id: 'name', label: t('auth.users.form.field.name', 'Display name'), type: 'text' },\n      {\n        id: 'sendInviteEmail',\n        label: t('auth.users.form.field.sendInviteEmail', 'Send password setup link via email'),\n        type: 'custom',\n        component: () => (\n          <label className=\"flex items-center gap-2 text-sm\">\n            <input\n              type=\"checkbox\"\n              className=\"size-4\"\n              checked={sendInviteEmail}\n              onChange={(e) => setSendInviteEmail(e.target.checked)}\n            />\n            {t('auth.users.form.field.sendInviteEmailHint', 'Invite user to set their own password via a secure email link')}\n          </label>\n        ),\n      },\n      ...(!sendInviteEmail ? [{\n        id: 'password',\n        label: t('auth.users.form.field.password', 'Password'),\n        type: 'password' as const,\n        required: true,\n        description: passwordDescription,\n      }] : []),\n    ]\n    if (actorIsSuperAdmin) {\n      items.push({\n        id: 'tenantId',\n        label: t('auth.users.form.field.tenant', 'Tenant'),\n        type: 'custom',\n        required: true,\n        component: ({ value, setValue }) => {\n          const normalizedValue = typeof value === 'string'\n            ? value\n            : (typeof selectedTenantId === 'string' ? selectedTenantId : null)\n          return (\n            <TenantSelect\n              id=\"tenantId\"\n              value={normalizedValue}\n              onChange={(next) => {\n                const resolved = next ?? null\n                setValue(resolved)\n                setSelectedTenantId(resolved)\n              }}\n              includeEmptyOption\n              className=\"w-full h-9 rounded border px-2 text-sm\"\n              required\n            />\n          )\n        },\n      })\n    }\n    items.push({\n      id: 'organizationId',\n      label: t('auth.users.form.field.organization', 'Organization'),\n      type: 'custom',\n      required: true,\n      component: ({ id, value, setValue }) => {\n        const normalizedValue = typeof value === 'string' ? value : null\n        return (\n          <TenantAwareOrganizationSelectInput\n            fieldId={id}\n            value={normalizedValue}\n            setValue={(next) => setValue(next ?? null)}\n            tenantId={selectedTenantId}\n          />\n        )\n      },\n    })\n    items.push({ id: 'roles', label: t('auth.users.form.field.roles', 'Roles'), type: 'tags', loadOptions: loadRoleOptions })\n    return items\n  }, [actorIsSuperAdmin, loadRoleOptions, passwordDescription, selectedTenantId, sendInviteEmail, t])\n\n  const detailFieldIds = React.useMemo(() => {\n    const base: string[] = sendInviteEmail\n      ? ['email', 'name', 'sendInviteEmail', 'organizationId', 'roles']\n      : ['email', 'name', 'sendInviteEmail', 'password', 'organizationId', 'roles']\n    if (actorIsSuperAdmin) {\n      const orgIdx = base.indexOf('organizationId')\n      base.splice(orgIdx, 0, 'tenantId')\n    }\n    return base\n  }, [actorIsSuperAdmin, sendInviteEmail])\n\n  const groups: CrudFormGroup[] = React.useMemo(() => [\n    { id: 'details', title: t('auth.users.form.group.details', 'Details'), column: 1, fields: detailFieldIds },\n    {\n      id: 'acl',\n      title: t('auth.users.form.group.access', 'Access'),\n      column: 1,\n      component: () => (\n        <div className=\"text-sm text-muted-foreground\">\n          {t('auth.users.form.aclHint', 'ACL can be edited after creating the user.')}\n        </div>\n      ),\n    },\n    { id: 'custom', title: t('auth.users.form.group.customFields', 'Custom Data'), column: 2, kind: 'customFields' },\n    {\n      id: 'dashboardWidgets',\n      title: t('auth.users.form.group.widgets', 'Dashboard Widgets'),\n      column: 2,\n      component: () => (\n        <DashboardWidgetSelector\n          catalog={widgetCatalog}\n          loading={widgetLoading}\n          error={widgetError}\n          mode={widgetMode}\n          onModeChange={setWidgetMode}\n          selected={selectedWidgets}\n          onToggle={toggleWidget}\n        />\n      ),\n    },\n  ], [detailFieldIds, t, widgetCatalog, widgetError, widgetLoading, widgetMode, selectedWidgets, toggleWidget])\n\n  const initialValues = React.useMemo<Partial<CreateUserFormValues>>(\n    () => ({\n      email: '',\n      name: '',\n      password: '',\n      tenantId: null,\n      organizationId: null,\n      roles: [],\n    }),\n    [],\n  )\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm<CreateUserFormValues>\n          title={t('auth.users.form.title.create', 'Create User')}\n          backHref=\"/backend/users\"\n          fields={fields}\n          groups={groups}\n          entityId={E.auth.user}\n          initialValues={initialValues}\n          submitLabel={t('auth.users.form.action.create', 'Create')}\n          cancelHref=\"/backend/users\"\n          successRedirect={`/backend/users?flash=${encodeURIComponent(\n            sendInviteEmail\n              ? t('auth.users.flash.createdWithInvite', 'User created and invitation sent')\n              : t('auth.users.flash.created', 'User created')\n          )}&type=success`}\n          onSubmit={async (values) => {\n            const customFields = collectCustomFieldValues(values)\n            const payload: Record<string, unknown> = {\n              email: values.email,\n              name: normalizeDisplayNameInput(values.name),\n              organizationId: values.organizationId ? values.organizationId : null,\n              roles: Array.isArray(values.roles) ? values.roles : [],\n              ...(Object.keys(customFields).length ? { customFields } : {}),\n            }\n            if (sendInviteEmail) {\n              payload.sendInviteEmail = true\n            } else {\n              payload.password = values.password\n            }\n            if (actorIsSuperAdmin) {\n              const rawTenant = typeof values.tenantId === 'string' ? values.tenantId.trim() : null\n              payload.tenantId = rawTenant && rawTenant.length ? rawTenant : null\n            }\n            const { result: created } = await createCrud<{ id?: string; _warning?: string }>('auth/users', payload)\n            const newUserId = typeof created?.id === 'string' ? created.id : null\n            if (created?._warning === 'invite_email_failed') {\n              const msg = t('auth.users.flash.createdEmailFailed', 'User created but invitation email could not be sent. You can resend it from the user page.')\n              window.location.href = `/backend/users?flash=${encodeURIComponent(msg)}&type=warning`\n              return\n            }\n\n            if (widgetMode === 'override' && newUserId) {\n              await updateCrud('dashboards/users/widgets', {\n                userId: newUserId,\n                mode: 'override',\n                widgetIds: selectedWidgets,\n                organizationId: values.organizationId ? values.organizationId : null,\n                tenantId: actorIsSuperAdmin\n                  ? (typeof values.tenantId === 'string' && values.tenantId.length ? values.tenantId : null)\n                  : null,\n              }, {\n                errorMessage: t('auth.users.form.errors.widgetsAssign', 'Failed to assign dashboard widgets to the new user'),\n              })\n            }\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\nfunction DashboardWidgetSelector({\n  catalog,\n  loading,\n  error,\n  mode,\n  onModeChange,\n  selected,\n  onToggle,\n}: {\n  catalog: Array<{ id: string; title: string; description: string | null }>\n  loading: boolean\n  error: string | null\n  mode: 'inherit' | 'override'\n  onModeChange: (mode: 'inherit' | 'override') => void\n  selected: string[]\n  onToggle: (id: string) => void\n}) {\n  const t = useT()\n  if (loading) {\n    return (\n      <div className=\"flex items-center gap-2 text-sm text-muted-foreground\">\n        <Spinner size=\"sm\" /> {t('auth.users.widgets.loading', 'Loading widgets\u2026')}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"space-y-3\">\n      {error && (\n        <div className=\"rounded-md border border-destructive/40 bg-destructive/10 p-3 text-sm text-destructive\">{error}</div>\n      )}\n      {!error && (\n        <>\n          <RadioGroup\n            className=\"flex flex-row items-center gap-3 rounded-md border bg-muted/30 px-3 py-2\"\n            value={mode}\n            onValueChange={(next) => onModeChange(next as 'inherit' | 'override')}\n          >\n            <RadioField\n              value=\"inherit\"\n              label={t('auth.users.widgets.mode.inherit', 'Inherit from roles')}\n            />\n            <RadioField\n              value=\"override\"\n              label={t('auth.users.widgets.mode.override', 'Override for this user')}\n            />\n          </RadioGroup>\n          {mode === 'override' && (\n            <div className=\"space-y-2\">\n              {catalog.map((widget) => (\n                <label key={widget.id} className=\"flex items-start gap-3 rounded-md border px-3 py-2 hover:border-primary/40\">\n                  <input\n                    type=\"checkbox\"\n                    className=\"mt-1 size-4\"\n                    checked={selected.includes(widget.id)}\n                    onChange={() => onToggle(widget.id)}\n                  />\n                  <div>\n                    <div className=\"text-sm font-medium leading-none\">{widget.title}</div>\n                    {widget.description ? <div className=\"text-xs text-muted-foreground\">{widget.description}</div> : null}\n                  </div>\n                </label>\n              ))}\n            </div>\n          )}\n          {mode === 'inherit' && (\n            <div className=\"rounded-md border bg-muted/30 px-3 py-2 text-xs text-muted-foreground\">\n              {t('auth.users.widgets.mode.hint', 'New users inherit widgets from their assigned roles. Override to pick a custom set.')}\n            </div>\n          )}\n        </>\n      )}\n    </div>\n  )\n}\n"],
-  "mappings": ";AAqEI,SA8UI,UA9UJ,KAsHM,YAtHN;AApEJ,YAAY,WAAW;AACvB,SAAS,SAAS;AAClB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAA0E;AACnF,SAAS,eAAe;AACxB,SAAS,YAAY,kBAAkB;AACvC,SAAS,gCAAgC;AACzC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,4BAA4B,yBAAyB;AAC9D,SAAS,iCAAiC;AA2B1C,SAAS,mCAAmC;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAuC;AACrC,QAAM,gBAAgB,MAAM,OAAsB,QAAQ;AAC1D,QAAM,cAAc,MAAM,OAAO,KAAK;AACtC,QAAM,eAAe,MAAM,YAAY,CAAC,SAAwB;AAC9D,aAAS,QAAQ,IAAI;AAAA,EACvB,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,YAAY,SAAS;AACxB,kBAAY,UAAU;AACtB,oBAAc,UAAU;AACxB;AAAA,IACF;AACA,QAAI,cAAc,YAAY,UAAU;AACtC,oBAAc,UAAU;AACxB,eAAS,IAAI;AAAA,IACf;AAAA,EACF,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,IAAI;AAAA,MACJ;AAAA,MACA,UAAU;AAAA,MACV,UAAQ;AAAA,MACR,oBAAkB;AAAA,MAClB,WAAU;AAAA,MACV;AAAA,MACA;AAAA;AAAA,EACF;AAEJ;AAEe,SAAR,iBAAkC;AACvC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAA2E,CAAC,CAAC;AAC7H,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,IAAI;AAC7D,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAwB,IAAI;AACxE,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAiC,SAAS;AACpF,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAwB,IAAI;AAClF,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAS,KAAK;AACtE,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAClE,QAAM,iBAAiB,MAAM,QAAQ,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAClE,QAAM,uBAAuB,MAAM;AAAA,IACjC,MAAM,2BAA2B,gBAAgB,CAAC;AAAA,IAClD,CAAC,gBAAgB,CAAC;AAAA,EACpB;AACA,QAAM,sBAAsB,MAAM,QAAQ,MACxC,uBACI,EAAE,mCAAmC,yCAAyC,EAAE,cAAc,qBAAqB,CAAC,IACpH,QACH,CAAC,sBAAsB,CAAC,CAAC;AAE5B,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,cAAc;AAC3B,uBAAiB,IAAI;AACrB,qBAAe,IAAI;AACnB,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM,QAA+B,iCAAiC;AAC7F,YAAI,CAAC,GAAI,OAAM,IAAI,MAAM,gBAAgB;AACzC,YAAI,CAAC,WAAW;AACd,gBAAM,WAAsB,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,SAAS,CAAC,IAAI,CAAC;AAClF,gBAAM,aAAa,SAChB,IAAI,CAAC,SAAkB;AACtB,gBAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,kBAAM,QAAQ;AACd,kBAAM,UAAU,MAAM;AACtB,kBAAM,aAAa,MAAM;AACzB,kBAAM,mBAAmB,MAAM;AAC/B,kBAAM,KAAK,OAAO,YAAY,WAAW,UAAU;AACnD,gBAAI,CAAC,MAAM,CAAC,GAAG,OAAQ,QAAO;AAC9B,kBAAM,QAAQ,OAAO,eAAe,YAAY,WAAW,SAAS,IAAI,aAAa;AACrF,kBAAM,cAAc,OAAO,qBAAqB,YAAY,iBAAiB,SAAS,IAAI,mBAAmB;AAC7G,mBAAO,EAAE,IAAI,OAAO,YAAY;AAAA,UAClC,CAAC,EACA,OAAO,CAAC,SAA4E,SAAS,IAAI;AACpG,2BAAiB,UAAU;AAAA,QAC7B;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,MAAM,2CAA2C,GAAG;AAC5D,YAAI,CAAC,WAAW;AACd,yBAAe;AAAA,YACb;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,kBAAiB,KAAK;AAAA,MACxC;AAAA,IACF;AACA,gBAAY;AACZ,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,YAAY;AACzB,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM,QAA0B,mCAAmC;AAC1F,YAAI,CAAC,aAAa,GAAI,sBAAqB,QAAQ,QAAQ,YAAY,CAAC;AAAA,MAC1E,SAAS,KAAK;AACZ,gBAAQ,MAAM,4CAA4C,GAAG;AAAA,MAC/D,UAAE;AACA,YAAI,CAAC,UAAW,kBAAiB,IAAI;AAAA,MACvC;AAAA,IACF;AACA,cAAU;AACV,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM,YAAY,CAAC,OAAe;AACrD,uBAAmB,CAAC,SAAU,KAAK,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,UAAU,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,EAAE,CAAE;AAAA,EACzG,GAAG,CAAC,CAAC;AAKL,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAA+C;AAC9F,QAAI,CAAC,cAAe,QAAO,CAAC;AAC5B,QAAI,mBAAmB;AACrB,UAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,aAAO,iBAAiB,OAAO,EAAE,UAAU,iBAAiB,CAAC;AAAA,IAC/D;AACA,WAAO,iBAAiB,KAAK;AAAA,EAC/B,GAAG,CAAC,mBAAmB,eAAe,gBAAgB,CAAC;AAEvD,QAAM,SAAsB,MAAM,QAAQ,MAAM;AAC9C,UAAM,QAAqB;AAAA,MACzB,EAAE,IAAI,SAAS,OAAO,EAAE,+BAA+B,OAAO,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,MAC9F,EAAE,IAAI,QAAQ,OAAO,EAAE,8BAA8B,cAAc,GAAG,MAAM,OAAO;AAAA,MACnF;AAAA,QACE,IAAI;AAAA,QACJ,OAAO,EAAE,yCAAyC,oCAAoC;AAAA,QACtF,MAAM;AAAA,QACN,WAAW,MACT,qBAAC,WAAM,WAAU,mCACf;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS;AAAA,cACT,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,OAAO;AAAA;AAAA,UACtD;AAAA,UACC,EAAE,6CAA6C,+DAA+D;AAAA,WACjH;AAAA,MAEJ;AAAA,MACA,GAAI,CAAC,kBAAkB,CAAC;AAAA,QACtB,IAAI;AAAA,QACJ,OAAO,EAAE,kCAAkC,UAAU;AAAA,QACrD,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa;AAAA,MACf,CAAC,IAAI,CAAC;AAAA,IACR;AACA,QAAI,mBAAmB;AACrB,YAAM,KAAK;AAAA,QACT,IAAI;AAAA,QACJ,OAAO,EAAE,gCAAgC,QAAQ;AAAA,QACjD,MAAM;AAAA,QACN,UAAU;AAAA,QACV,WAAW,CAAC,EAAE,OAAO,SAAS,MAAM;AAClC,gBAAM,kBAAkB,OAAO,UAAU,WACrC,QACC,OAAO,qBAAqB,WAAW,mBAAmB;AAC/D,iBACE;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO;AAAA,cACP,UAAU,CAAC,SAAS;AAClB,sBAAM,WAAW,QAAQ;AACzB,yBAAS,QAAQ;AACjB,oCAAoB,QAAQ;AAAA,cAC9B;AAAA,cACA,oBAAkB;AAAA,cAClB,WAAU;AAAA,cACV,UAAQ;AAAA;AAAA,UACV;AAAA,QAEJ;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,KAAK;AAAA,MACT,IAAI;AAAA,MACJ,OAAO,EAAE,sCAAsC,cAAc;AAAA,MAC7D,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW,CAAC,EAAE,IAAI,OAAO,SAAS,MAAM;AACtC,cAAM,kBAAkB,OAAO,UAAU,WAAW,QAAQ;AAC5D,eACE;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,YACP,UAAU,CAAC,SAAS,SAAS,QAAQ,IAAI;AAAA,YACzC,UAAU;AAAA;AAAA,QACZ;AAAA,MAEJ;AAAA,IACF,CAAC;AACD,UAAM,KAAK,EAAE,IAAI,SAAS,OAAO,EAAE,+BAA+B,OAAO,GAAG,MAAM,QAAQ,aAAa,gBAAgB,CAAC;AACxH,WAAO;AAAA,EACT,GAAG,CAAC,mBAAmB,iBAAiB,qBAAqB,kBAAkB,iBAAiB,CAAC,CAAC;AAElG,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,UAAM,OAAiB,kBACnB,CAAC,SAAS,QAAQ,mBAAmB,kBAAkB,OAAO,IAC9D,CAAC,SAAS,QAAQ,mBAAmB,YAAY,kBAAkB,OAAO;AAC9E,QAAI,mBAAmB;AACrB,YAAM,SAAS,KAAK,QAAQ,gBAAgB;AAC5C,WAAK,OAAO,QAAQ,GAAG,UAAU;AAAA,IACnC;AACA,WAAO;AAAA,EACT,GAAG,CAAC,mBAAmB,eAAe,CAAC;AAEvC,QAAM,SAA0B,MAAM,QAAQ,MAAM;AAAA,IAClD,EAAE,IAAI,WAAW,OAAO,EAAE,iCAAiC,SAAS,GAAG,QAAQ,GAAG,QAAQ,eAAe;AAAA,IACzG;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,gCAAgC,QAAQ;AAAA,MACjD,QAAQ;AAAA,MACR,WAAW,MACT,oBAAC,SAAI,WAAU,iCACZ,YAAE,2BAA2B,4CAA4C,GAC5E;AAAA,IAEJ;AAAA,IACA,EAAE,IAAI,UAAU,OAAO,EAAE,sCAAsC,aAAa,GAAG,QAAQ,GAAG,MAAM,eAAe;AAAA,IAC/G;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,iCAAiC,mBAAmB;AAAA,MAC7D,QAAQ;AAAA,MACR,WAAW,MACT;AAAA,QAAC;AAAA;AAAA,UACC,SAAS;AAAA,UACT,SAAS;AAAA,UACT,OAAO;AAAA,UACP,MAAM;AAAA,UACN,cAAc;AAAA,UACd,UAAU;AAAA,UACV,UAAU;AAAA;AAAA,MACZ;AAAA,IAEJ;AAAA,EACF,GAAG,CAAC,gBAAgB,GAAG,eAAe,aAAa,eAAe,YAAY,iBAAiB,YAAY,CAAC;AAE5G,QAAM,gBAAgB,MAAM;AAAA,IAC1B,OAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,CAAC;AAAA,IACV;AAAA,IACA,CAAC;AAAA,EACH;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,gCAAgC,aAAa;AAAA,MACtD,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,UAAU,EAAE,KAAK;AAAA,MACjB;AAAA,MACA,aAAa,EAAE,iCAAiC,QAAQ;AAAA,MACxD,YAAW;AAAA,MACX,iBAAiB,wBAAwB;AAAA,QACvC,kBACI,EAAE,sCAAsC,kCAAkC,IAC1E,EAAE,4BAA4B,cAAc;AAAA,MAClD,CAAC;AAAA,MACD,UAAU,OAAO,WAAW;AAC1B,cAAM,eAAe,yBAAyB,MAAM;AACpD,cAAM,UAAmC;AAAA,UACvC,OAAO,OAAO;AAAA,UACd,MAAM,0BAA0B,OAAO,IAAI;AAAA,UAC3C,gBAAgB,OAAO,iBAAiB,OAAO,iBAAiB;AAAA,UAChE,OAAO,MAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,QAAQ,CAAC;AAAA,UACrD,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC;AAAA,QAC7D;AACA,YAAI,iBAAiB;AACnB,kBAAQ,kBAAkB;AAAA,QAC5B,OAAO;AACL,kBAAQ,WAAW,OAAO;AAAA,QAC5B;AACA,YAAI,mBAAmB;AACrB,gBAAM,YAAY,OAAO,OAAO,aAAa,WAAW,OAAO,SAAS,KAAK,IAAI;AACjF,kBAAQ,WAAW,aAAa,UAAU,SAAS,YAAY;AAAA,QACjE;AACA,cAAM,EAAE,QAAQ,QAAQ,IAAI,MAAM,WAA+C,cAAc,OAAO;AACtG,cAAM,YAAY,OAAO,SAAS,OAAO,WAAW,QAAQ,KAAK;AACjE,YAAI,SAAS,aAAa,uBAAuB;AAC/C,gBAAM,MAAM,EAAE,uCAAuC,4FAA4F;AACjJ,iBAAO,SAAS,OAAO,wBAAwB,mBAAmB,GAAG,CAAC;AACtE;AAAA,QACF;AAEA,YAAI,eAAe,cAAc,WAAW;AAC1C,gBAAM,WAAW,4BAA4B;AAAA,YAC3C,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,WAAW;AAAA,YACX,gBAAgB,OAAO,iBAAiB,OAAO,iBAAiB;AAAA,YAChE,UAAU,oBACL,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,SAAS,OAAO,WAAW,OACnF;AAAA,UACN,GAAG;AAAA,YACD,cAAc,EAAE,wCAAwC,oDAAoD;AAAA,UAC9G,CAAC;AAAA,QACH;AAAA,MACF;AAAA;AAAA,EACF,GACF,GACF;AAEJ;AAEA,SAAS,wBAAwB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAQG;AACD,QAAM,IAAI,KAAK;AACf,MAAI,SAAS;AACX,WACE,qBAAC,SAAI,WAAU,yDACb;AAAA,0BAAC,WAAQ,MAAK,MAAK;AAAA,MAAE;AAAA,MAAE,EAAE,8BAA8B,uBAAkB;AAAA,OAC3E;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,aACC,oBAAC,SAAI,WAAU,0FAA0F,iBAAM;AAAA,IAEhH,CAAC,SACA,iCACE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,WAAU;AAAA,UACV,OAAO;AAAA,UACP,eAAe,CAAC,SAAS,aAAa,IAA8B;AAAA,UAEpE;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,OAAM;AAAA,gBACN,OAAO,EAAE,mCAAmC,oBAAoB;AAAA;AAAA,YAClE;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,OAAM;AAAA,gBACN,OAAO,EAAE,oCAAoC,wBAAwB;AAAA;AAAA,YACvE;AAAA;AAAA;AAAA,MACF;AAAA,MACC,SAAS,cACR,oBAAC,SAAI,WAAU,aACZ,kBAAQ,IAAI,CAAC,WACZ,qBAAC,WAAsB,WAAU,8EAC/B;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,SAAS,SAAS,OAAO,EAAE;AAAA,YACpC,UAAU,MAAM,SAAS,OAAO,EAAE;AAAA;AAAA,QACpC;AAAA,QACA,qBAAC,SACC;AAAA,8BAAC,SAAI,WAAU,oCAAoC,iBAAO,OAAM;AAAA,UAC/D,OAAO,cAAc,oBAAC,SAAI,WAAU,iCAAiC,iBAAO,aAAY,IAAS;AAAA,WACpG;AAAA,WAVU,OAAO,EAWnB,CACD,GACH;AAAA,MAED,SAAS,aACR,oBAAC,SAAI,WAAU,yEACZ,YAAE,gCAAgC,qFAAqF,GAC1H;AAAA,OAEJ;AAAA,KAEJ;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { E } from '#generated/entities.ids.generated'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm, type CrudField, type CrudFormGroup, type CrudFieldOption } from '@open-mercato/ui/backend/CrudForm'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { createCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'\nimport { OrganizationSelect } from '@open-mercato/core/modules/directory/components/OrganizationSelect'\nimport { TenantSelect } from '@open-mercato/core/modules/directory/components/TenantSelect'\nimport { fetchRoleOptions } from '@open-mercato/core/modules/auth/backend/users/roleOptions'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { RadioGroup } from '@open-mercato/ui/primitives/radio'\nimport { RadioField } from '@open-mercato/ui/primitives/radio-field'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'\n\ntype CreateUserFormValues = {\n  email: string\n  name: string\n  password: string\n  tenantId: string | null\n  organizationId: string | null\n  roles: string[]\n} & Record<string, unknown>\n\ntype UserListResponse = {\n  isSuperAdmin?: boolean\n}\n\ntype WidgetCatalogResponse = {\n  items?: Array<{ id?: string | null; title?: string | null; description?: string | null }>\n}\n\ntype TenantAwareOrganizationSelectProps = {\n  fieldId: string\n  value: string | null\n  setValue: (value: string | null) => void\n  tenantId: string | null\n  includeInactiveIds?: Iterable<string | null | undefined>\n}\n\nfunction TenantAwareOrganizationSelectInput({\n  fieldId,\n  value,\n  setValue,\n  tenantId,\n  includeInactiveIds,\n}: TenantAwareOrganizationSelectProps) {\n  const prevTenantRef = React.useRef<string | null>(tenantId)\n  const hydratedRef = React.useRef(false)\n  const handleChange = React.useCallback((next: string | null) => {\n    setValue(next ?? null)\n  }, [setValue])\n\n  React.useEffect(() => {\n    if (!hydratedRef.current) {\n      hydratedRef.current = true\n      prevTenantRef.current = tenantId\n      return\n    }\n    if (prevTenantRef.current !== tenantId) {\n      prevTenantRef.current = tenantId\n      setValue(null)\n    }\n  }, [tenantId, setValue])\n\n  return (\n    <OrganizationSelect\n      id={fieldId}\n      value={value}\n      onChange={handleChange}\n      required\n      includeEmptyOption\n      className=\"w-full h-9 rounded border px-2 text-sm\"\n      tenantId={tenantId}\n      includeInactiveIds={includeInactiveIds}\n    />\n  )\n}\n\nexport default function CreateUserPage() {\n  const t = useT()\n  const [widgetCatalog, setWidgetCatalog] = React.useState<Array<{ id: string; title: string; description: string | null }>>([])\n  const [widgetLoading, setWidgetLoading] = React.useState(true)\n  const [widgetError, setWidgetError] = React.useState<string | null>(null)\n  const [widgetMode, setWidgetMode] = React.useState<'inherit' | 'override'>('inherit')\n  const [selectedWidgets, setSelectedWidgets] = React.useState<string[]>([])\n  const [selectedTenantId, setSelectedTenantId] = React.useState<string | null>(null)\n  const [actorIsSuperAdmin, setActorIsSuperAdmin] = React.useState(false)\n  const [actorResolved, setActorResolved] = React.useState(false)\n  const [sendInviteEmail, setSendInviteEmail] = React.useState(false)\n  const passwordPolicy = React.useMemo(() => getPasswordPolicy(), [])\n  const passwordRequirements = React.useMemo(\n    () => formatPasswordRequirements(passwordPolicy, t),\n    [passwordPolicy, t],\n  )\n  const passwordDescription = React.useMemo(() => (\n    passwordRequirements\n      ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })\n      : undefined\n  ), [passwordRequirements, t])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadCatalog() {\n      setWidgetLoading(true)\n      setWidgetError(null)\n      try {\n        const { ok, result } = await apiCall<WidgetCatalogResponse>('/api/dashboards/widgets/catalog')\n        if (!ok) throw new Error('request_failed')\n        if (!cancelled) {\n          const rawItems: unknown[] = Array.isArray(result?.items) ? result?.items ?? [] : []\n          const normalized = rawItems\n            .map((item: unknown) => {\n              if (!item || typeof item !== 'object') return null\n              const entry = item as Record<string, unknown>\n              const idValue = entry.id\n              const titleValue = entry.title\n              const descriptionValue = entry.description\n              const id = typeof idValue === 'string' ? idValue : null\n              if (!id || !id.length) return null\n              const title = typeof titleValue === 'string' && titleValue.length > 0 ? titleValue : id\n              const description = typeof descriptionValue === 'string' && descriptionValue.length > 0 ? descriptionValue : null\n              return { id, title, description }\n            })\n            .filter((item): item is { id: string; title: string; description: string | null } => item !== null)\n          setWidgetCatalog(normalized)\n        }\n      } catch (err) {\n        console.error('Failed to load dashboard widget catalog', err)\n        if (!cancelled) {\n          setWidgetError(t(\n            'auth.users.widgets.errors.load',\n            'Unable to load dashboard widgets. You can configure them later from the user page.',\n          ))\n        }\n      } finally {\n        if (!cancelled) setWidgetLoading(false)\n      }\n    }\n    loadCatalog()\n    return () => { cancelled = true }\n  }, [t])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadActor() {\n      try {\n        const { ok, result } = await apiCall<UserListResponse>('/api/auth/users?page=1&pageSize=1')\n        if (!cancelled && ok) setActorIsSuperAdmin(Boolean(result?.isSuperAdmin))\n      } catch (err) {\n        console.error('Failed to resolve actor super admin flag', err)\n      } finally {\n        if (!cancelled) setActorResolved(true)\n      }\n    }\n    loadActor()\n    return () => { cancelled = true }\n  }, [])\n\n  const toggleWidget = React.useCallback((id: string) => {\n    setSelectedWidgets((prev) => (prev.includes(id) ? prev.filter((value) => value !== id) : [...prev, id]))\n  }, [])\n\n  // Block role loading until we know whether the actor is a super admin. Without this guard the\n  // initial (non-super-admin) branch fires before the flag resolves and the server returns roles\n  // from other tenants because the real caller is a super admin without tenantId scoping.\n  const loadRoleOptions = React.useCallback(async (query?: string): Promise<CrudFieldOption[]> => {\n    if (!actorResolved) return []\n    if (actorIsSuperAdmin) {\n      if (!selectedTenantId) return []\n      return fetchRoleOptions(query, { tenantId: selectedTenantId, includeSuperAdmin: true })\n    }\n    return fetchRoleOptions(query)\n  }, [actorIsSuperAdmin, actorResolved, selectedTenantId])\n\n  const fields: CrudField[] = React.useMemo(() => {\n    const items: CrudField[] = [\n      { id: 'email', label: t('auth.users.form.field.email', 'Email'), type: 'text', required: true },\n      { id: 'name', label: t('auth.users.form.field.name', 'Display name'), type: 'text' },\n      {\n        id: 'sendInviteEmail',\n        label: t('auth.users.form.field.sendInviteEmail', 'Send password setup link via email'),\n        type: 'custom',\n        component: () => (\n          <label className=\"flex items-center gap-2 text-sm\">\n            <input\n              type=\"checkbox\"\n              className=\"size-4\"\n              checked={sendInviteEmail}\n              onChange={(e) => setSendInviteEmail(e.target.checked)}\n            />\n            {t('auth.users.form.field.sendInviteEmailHint', 'Invite user to set their own password via a secure email link')}\n          </label>\n        ),\n      },\n      ...(!sendInviteEmail ? [{\n        id: 'password',\n        label: t('auth.users.form.field.password', 'Password'),\n        type: 'password' as const,\n        required: true,\n        description: passwordDescription,\n      }] : []),\n    ]\n    if (actorIsSuperAdmin) {\n      items.push({\n        id: 'tenantId',\n        label: t('auth.users.form.field.tenant', 'Tenant'),\n        type: 'custom',\n        required: true,\n        component: ({ value, setValue }) => {\n          const normalizedValue = typeof value === 'string'\n            ? value\n            : (typeof selectedTenantId === 'string' ? selectedTenantId : null)\n          return (\n            <TenantSelect\n              id=\"tenantId\"\n              value={normalizedValue}\n              onChange={(next) => {\n                const resolved = next ?? null\n                setValue(resolved)\n                setSelectedTenantId(resolved)\n              }}\n              includeEmptyOption\n              className=\"w-full h-9 rounded border px-2 text-sm\"\n              required\n            />\n          )\n        },\n      })\n    }\n    items.push({\n      id: 'organizationId',\n      label: t('auth.users.form.field.organization', 'Organization'),\n      type: 'custom',\n      required: true,\n      component: ({ id, value, setValue }) => {\n        const normalizedValue = typeof value === 'string' ? value : null\n        return (\n          <TenantAwareOrganizationSelectInput\n            fieldId={id}\n            value={normalizedValue}\n            setValue={(next) => setValue(next ?? null)}\n            tenantId={selectedTenantId}\n          />\n        )\n      },\n    })\n    items.push({ id: 'roles', label: t('auth.users.form.field.roles', 'Roles'), type: 'tags', loadOptions: loadRoleOptions })\n    return items\n  }, [actorIsSuperAdmin, loadRoleOptions, passwordDescription, selectedTenantId, sendInviteEmail, t])\n\n  const detailFieldIds = React.useMemo(() => {\n    const base: string[] = sendInviteEmail\n      ? ['email', 'name', 'sendInviteEmail', 'organizationId', 'roles']\n      : ['email', 'name', 'sendInviteEmail', 'password', 'organizationId', 'roles']\n    if (actorIsSuperAdmin) {\n      const orgIdx = base.indexOf('organizationId')\n      base.splice(orgIdx, 0, 'tenantId')\n    }\n    return base\n  }, [actorIsSuperAdmin, sendInviteEmail])\n\n  const groups: CrudFormGroup[] = React.useMemo(() => [\n    { id: 'details', title: t('auth.users.form.group.details', 'Details'), column: 1, fields: detailFieldIds },\n    {\n      id: 'acl',\n      title: t('auth.users.form.group.access', 'Access'),\n      column: 1,\n      component: () => (\n        <div className=\"text-sm text-muted-foreground\">\n          {t('auth.users.form.aclHint', 'ACL can be edited after creating the user.')}\n        </div>\n      ),\n    },\n    { id: 'custom', title: t('auth.users.form.group.customFields', 'Custom Data'), column: 2, kind: 'customFields' },\n    {\n      id: 'dashboardWidgets',\n      title: t('auth.users.form.group.widgets', 'Dashboard Widgets'),\n      column: 2,\n      component: () => (\n        <DashboardWidgetSelector\n          catalog={widgetCatalog}\n          loading={widgetLoading}\n          error={widgetError}\n          mode={widgetMode}\n          onModeChange={setWidgetMode}\n          selected={selectedWidgets}\n          onToggle={toggleWidget}\n        />\n      ),\n    },\n  ], [detailFieldIds, t, widgetCatalog, widgetError, widgetLoading, widgetMode, selectedWidgets, toggleWidget])\n\n  const initialValues = React.useMemo<Partial<CreateUserFormValues>>(\n    () => ({\n      email: '',\n      name: '',\n      password: '',\n      tenantId: null,\n      organizationId: null,\n      roles: [],\n    }),\n    [],\n  )\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm<CreateUserFormValues>\n          title={t('auth.users.form.title.create', 'Create User')}\n          backHref=\"/backend/users\"\n          fields={fields}\n          groups={groups}\n          entityId={E.auth.user}\n          initialValues={initialValues}\n          submitLabel={t('auth.users.form.action.create', 'Create')}\n          cancelHref=\"/backend/users\"\n          successRedirect={`/backend/users?flash=${encodeURIComponent(\n            sendInviteEmail\n              ? t('auth.users.flash.createdWithInvite', 'User created and invitation sent')\n              : t('auth.users.flash.created', 'User created')\n          )}&type=success`}\n          onSubmit={async (values) => {\n            const customFields = collectCustomFieldValues(values)\n            const payload: Record<string, unknown> = {\n              email: values.email,\n              name: normalizeDisplayNameInput(values.name),\n              organizationId: values.organizationId ? values.organizationId : null,\n              roles: Array.isArray(values.roles) ? values.roles : [],\n              ...(Object.keys(customFields).length ? { customFields } : {}),\n            }\n            if (sendInviteEmail) {\n              payload.sendInviteEmail = true\n            } else {\n              payload.password = values.password\n            }\n            if (actorIsSuperAdmin) {\n              const rawTenant = typeof values.tenantId === 'string' ? values.tenantId.trim() : null\n              payload.tenantId = rawTenant && rawTenant.length ? rawTenant : null\n            }\n            const { result: created } = await createCrud<{ id?: string; _warning?: string }>('auth/users', payload)\n            const newUserId = typeof created?.id === 'string' ? created.id : null\n            if (created?._warning === 'invite_email_failed') {\n              const msg = t('auth.users.flash.createdEmailFailed', 'User created but invitation email could not be sent. You can resend it from the user page.')\n              window.location.href = `/backend/users?flash=${encodeURIComponent(msg)}&type=warning`\n              return\n            }\n\n            if (widgetMode === 'override' && newUserId) {\n              await updateCrud('dashboards/users/widgets', {\n                userId: newUserId,\n                mode: 'override',\n                widgetIds: selectedWidgets,\n                organizationId: values.organizationId ? values.organizationId : null,\n                tenantId: actorIsSuperAdmin\n                  ? (typeof values.tenantId === 'string' && values.tenantId.length ? values.tenantId : null)\n                  : null,\n              }, {\n                errorMessage: t('auth.users.form.errors.widgetsAssign', 'Failed to assign dashboard widgets to the new user'),\n              })\n            }\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\nfunction DashboardWidgetSelector({\n  catalog,\n  loading,\n  error,\n  mode,\n  onModeChange,\n  selected,\n  onToggle,\n}: {\n  catalog: Array<{ id: string; title: string; description: string | null }>\n  loading: boolean\n  error: string | null\n  mode: 'inherit' | 'override'\n  onModeChange: (mode: 'inherit' | 'override') => void\n  selected: string[]\n  onToggle: (id: string) => void\n}) {\n  const t = useT()\n  if (loading) {\n    return (\n      <div className=\"flex items-center gap-2 text-sm text-muted-foreground\">\n        <Spinner size=\"sm\" /> {t('auth.users.widgets.loading', 'Loading widgets\u2026')}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"space-y-3\">\n      {error && (\n        <div className=\"rounded-md border border-destructive/40 bg-destructive/10 p-3 text-sm text-destructive\">{error}</div>\n      )}\n      {!error && (\n        <>\n          <RadioGroup\n            className=\"flex flex-row items-center gap-3 rounded-md border bg-muted/30 px-3 py-2\"\n            value={mode}\n            onValueChange={(next) => onModeChange(next as 'inherit' | 'override')}\n          >\n            <RadioField\n              value=\"inherit\"\n              label={t('auth.users.widgets.mode.inherit', 'Inherit from roles')}\n            />\n            <RadioField\n              value=\"override\"\n              label={t('auth.users.widgets.mode.override', 'Override for this user')}\n            />\n          </RadioGroup>\n          {mode === 'override' && (\n            <div className=\"space-y-2\">\n              {catalog.map((widget) => (\n                <label key={widget.id} className=\"flex items-start gap-3 rounded-md border px-3 py-2 hover:border-primary/40\">\n                  <input\n                    type=\"checkbox\"\n                    className=\"mt-1 size-4\"\n                    checked={selected.includes(widget.id)}\n                    onChange={() => onToggle(widget.id)}\n                  />\n                  <div>\n                    <div className=\"text-sm font-medium leading-none\">{widget.title}</div>\n                    {widget.description ? <div className=\"text-xs text-muted-foreground\">{widget.description}</div> : null}\n                  </div>\n                </label>\n              ))}\n            </div>\n          )}\n          {mode === 'inherit' && (\n            <div className=\"rounded-md border bg-muted/30 px-3 py-2 text-xs text-muted-foreground\">\n              {t('auth.users.widgets.mode.hint', 'New users inherit widgets from their assigned roles. Override to pick a custom set.')}\n            </div>\n          )}\n        </>\n      )}\n    </div>\n  )\n}\n"],
+  "mappings": ";AAqEI,SA8UI,UA9UJ,KAsHM,YAtHN;AApEJ,YAAY,WAAW;AACvB,SAAS,SAAS;AAClB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAA0E;AACnF,SAAS,eAAe;AACxB,SAAS,YAAY,kBAAkB;AACvC,SAAS,gCAAgC;AACzC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,4BAA4B,yBAAyB;AAC9D,SAAS,iCAAiC;AA2B1C,SAAS,mCAAmC;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAuC;AACrC,QAAM,gBAAgB,MAAM,OAAsB,QAAQ;AAC1D,QAAM,cAAc,MAAM,OAAO,KAAK;AACtC,QAAM,eAAe,MAAM,YAAY,CAAC,SAAwB;AAC9D,aAAS,QAAQ,IAAI;AAAA,EACvB,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,YAAY,SAAS;AACxB,kBAAY,UAAU;AACtB,oBAAc,UAAU;AACxB;AAAA,IACF;AACA,QAAI,cAAc,YAAY,UAAU;AACtC,oBAAc,UAAU;AACxB,eAAS,IAAI;AAAA,IACf;AAAA,EACF,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE;AAAA,IAAC;AAAA;AAAA,MACC,IAAI;AAAA,MACJ;AAAA,MACA,UAAU;AAAA,MACV,UAAQ;AAAA,MACR,oBAAkB;AAAA,MAClB,WAAU;AAAA,MACV;AAAA,MACA;AAAA;AAAA,EACF;AAEJ;AAEe,SAAR,iBAAkC;AACvC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAA2E,CAAC,CAAC;AAC7H,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,IAAI;AAC7D,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAwB,IAAI;AACxE,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAiC,SAAS;AACpF,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAwB,IAAI;AAClF,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAS,KAAK;AACtE,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,KAAK;AAClE,QAAM,iBAAiB,MAAM,QAAQ,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAClE,QAAM,uBAAuB,MAAM;AAAA,IACjC,MAAM,2BAA2B,gBAAgB,CAAC;AAAA,IAClD,CAAC,gBAAgB,CAAC;AAAA,EACpB;AACA,QAAM,sBAAsB,MAAM,QAAQ,MACxC,uBACI,EAAE,mCAAmC,yCAAyC,EAAE,cAAc,qBAAqB,CAAC,IACpH,QACH,CAAC,sBAAsB,CAAC,CAAC;AAE5B,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,cAAc;AAC3B,uBAAiB,IAAI;AACrB,qBAAe,IAAI;AACnB,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM,QAA+B,iCAAiC;AAC7F,YAAI,CAAC,GAAI,OAAM,IAAI,MAAM,gBAAgB;AACzC,YAAI,CAAC,WAAW;AACd,gBAAM,WAAsB,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,SAAS,CAAC,IAAI,CAAC;AAClF,gBAAM,aAAa,SAChB,IAAI,CAAC,SAAkB;AACtB,gBAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,kBAAM,QAAQ;AACd,kBAAM,UAAU,MAAM;AACtB,kBAAM,aAAa,MAAM;AACzB,kBAAM,mBAAmB,MAAM;AAC/B,kBAAM,KAAK,OAAO,YAAY,WAAW,UAAU;AACnD,gBAAI,CAAC,MAAM,CAAC,GAAG,OAAQ,QAAO;AAC9B,kBAAM,QAAQ,OAAO,eAAe,YAAY,WAAW,SAAS,IAAI,aAAa;AACrF,kBAAM,cAAc,OAAO,qBAAqB,YAAY,iBAAiB,SAAS,IAAI,mBAAmB;AAC7G,mBAAO,EAAE,IAAI,OAAO,YAAY;AAAA,UAClC,CAAC,EACA,OAAO,CAAC,SAA4E,SAAS,IAAI;AACpG,2BAAiB,UAAU;AAAA,QAC7B;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,MAAM,2CAA2C,GAAG;AAC5D,YAAI,CAAC,WAAW;AACd,yBAAe;AAAA,YACb;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,kBAAiB,KAAK;AAAA,MACxC;AAAA,IACF;AACA,gBAAY;AACZ,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,YAAY;AACzB,UAAI;AACF,cAAM,EAAE,IAAI,OAAO,IAAI,MAAM,QAA0B,mCAAmC;AAC1F,YAAI,CAAC,aAAa,GAAI,sBAAqB,QAAQ,QAAQ,YAAY,CAAC;AAAA,MAC1E,SAAS,KAAK;AACZ,gBAAQ,MAAM,4CAA4C,GAAG;AAAA,MAC/D,UAAE;AACA,YAAI,CAAC,UAAW,kBAAiB,IAAI;AAAA,MACvC;AAAA,IACF;AACA,cAAU;AACV,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM,YAAY,CAAC,OAAe;AACrD,uBAAmB,CAAC,SAAU,KAAK,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,UAAU,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,EAAE,CAAE;AAAA,EACzG,GAAG,CAAC,CAAC;AAKL,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAA+C;AAC9F,QAAI,CAAC,cAAe,QAAO,CAAC;AAC5B,QAAI,mBAAmB;AACrB,UAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,aAAO,iBAAiB,OAAO,EAAE,UAAU,kBAAkB,mBAAmB,KAAK,CAAC;AAAA,IACxF;AACA,WAAO,iBAAiB,KAAK;AAAA,EAC/B,GAAG,CAAC,mBAAmB,eAAe,gBAAgB,CAAC;AAEvD,QAAM,SAAsB,MAAM,QAAQ,MAAM;AAC9C,UAAM,QAAqB;AAAA,MACzB,EAAE,IAAI,SAAS,OAAO,EAAE,+BAA+B,OAAO,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,MAC9F,EAAE,IAAI,QAAQ,OAAO,EAAE,8BAA8B,cAAc,GAAG,MAAM,OAAO;AAAA,MACnF;AAAA,QACE,IAAI;AAAA,QACJ,OAAO,EAAE,yCAAyC,oCAAoC;AAAA,QACtF,MAAM;AAAA,QACN,WAAW,MACT,qBAAC,WAAM,WAAU,mCACf;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS;AAAA,cACT,UAAU,CAAC,MAAM,mBAAmB,EAAE,OAAO,OAAO;AAAA;AAAA,UACtD;AAAA,UACC,EAAE,6CAA6C,+DAA+D;AAAA,WACjH;AAAA,MAEJ;AAAA,MACA,GAAI,CAAC,kBAAkB,CAAC;AAAA,QACtB,IAAI;AAAA,QACJ,OAAO,EAAE,kCAAkC,UAAU;AAAA,QACrD,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa;AAAA,MACf,CAAC,IAAI,CAAC;AAAA,IACR;AACA,QAAI,mBAAmB;AACrB,YAAM,KAAK;AAAA,QACT,IAAI;AAAA,QACJ,OAAO,EAAE,gCAAgC,QAAQ;AAAA,QACjD,MAAM;AAAA,QACN,UAAU;AAAA,QACV,WAAW,CAAC,EAAE,OAAO,SAAS,MAAM;AAClC,gBAAM,kBAAkB,OAAO,UAAU,WACrC,QACC,OAAO,qBAAqB,WAAW,mBAAmB;AAC/D,iBACE;AAAA,YAAC;AAAA;AAAA,cACC,IAAG;AAAA,cACH,OAAO;AAAA,cACP,UAAU,CAAC,SAAS;AAClB,sBAAM,WAAW,QAAQ;AACzB,yBAAS,QAAQ;AACjB,oCAAoB,QAAQ;AAAA,cAC9B;AAAA,cACA,oBAAkB;AAAA,cAClB,WAAU;AAAA,cACV,UAAQ;AAAA;AAAA,UACV;AAAA,QAEJ;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,KAAK;AAAA,MACT,IAAI;AAAA,MACJ,OAAO,EAAE,sCAAsC,cAAc;AAAA,MAC7D,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW,CAAC,EAAE,IAAI,OAAO,SAAS,MAAM;AACtC,cAAM,kBAAkB,OAAO,UAAU,WAAW,QAAQ;AAC5D,eACE;AAAA,UAAC;AAAA;AAAA,YACC,SAAS;AAAA,YACT,OAAO;AAAA,YACP,UAAU,CAAC,SAAS,SAAS,QAAQ,IAAI;AAAA,YACzC,UAAU;AAAA;AAAA,QACZ;AAAA,MAEJ;AAAA,IACF,CAAC;AACD,UAAM,KAAK,EAAE,IAAI,SAAS,OAAO,EAAE,+BAA+B,OAAO,GAAG,MAAM,QAAQ,aAAa,gBAAgB,CAAC;AACxH,WAAO;AAAA,EACT,GAAG,CAAC,mBAAmB,iBAAiB,qBAAqB,kBAAkB,iBAAiB,CAAC,CAAC;AAElG,QAAM,iBAAiB,MAAM,QAAQ,MAAM;AACzC,UAAM,OAAiB,kBACnB,CAAC,SAAS,QAAQ,mBAAmB,kBAAkB,OAAO,IAC9D,CAAC,SAAS,QAAQ,mBAAmB,YAAY,kBAAkB,OAAO;AAC9E,QAAI,mBAAmB;AACrB,YAAM,SAAS,KAAK,QAAQ,gBAAgB;AAC5C,WAAK,OAAO,QAAQ,GAAG,UAAU;AAAA,IACnC;AACA,WAAO;AAAA,EACT,GAAG,CAAC,mBAAmB,eAAe,CAAC;AAEvC,QAAM,SAA0B,MAAM,QAAQ,MAAM;AAAA,IAClD,EAAE,IAAI,WAAW,OAAO,EAAE,iCAAiC,SAAS,GAAG,QAAQ,GAAG,QAAQ,eAAe;AAAA,IACzG;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,gCAAgC,QAAQ;AAAA,MACjD,QAAQ;AAAA,MACR,WAAW,MACT,oBAAC,SAAI,WAAU,iCACZ,YAAE,2BAA2B,4CAA4C,GAC5E;AAAA,IAEJ;AAAA,IACA,EAAE,IAAI,UAAU,OAAO,EAAE,sCAAsC,aAAa,GAAG,QAAQ,GAAG,MAAM,eAAe;AAAA,IAC/G;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,iCAAiC,mBAAmB;AAAA,MAC7D,QAAQ;AAAA,MACR,WAAW,MACT;AAAA,QAAC;AAAA;AAAA,UACC,SAAS;AAAA,UACT,SAAS;AAAA,UACT,OAAO;AAAA,UACP,MAAM;AAAA,UACN,cAAc;AAAA,UACd,UAAU;AAAA,UACV,UAAU;AAAA;AAAA,MACZ;AAAA,IAEJ;AAAA,EACF,GAAG,CAAC,gBAAgB,GAAG,eAAe,aAAa,eAAe,YAAY,iBAAiB,YAAY,CAAC;AAE5G,QAAM,gBAAgB,MAAM;AAAA,IAC1B,OAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,CAAC;AAAA,IACV;AAAA,IACA,CAAC;AAAA,EACH;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,gCAAgC,aAAa;AAAA,MACtD,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,UAAU,EAAE,KAAK;AAAA,MACjB;AAAA,MACA,aAAa,EAAE,iCAAiC,QAAQ;AAAA,MACxD,YAAW;AAAA,MACX,iBAAiB,wBAAwB;AAAA,QACvC,kBACI,EAAE,sCAAsC,kCAAkC,IAC1E,EAAE,4BAA4B,cAAc;AAAA,MAClD,CAAC;AAAA,MACD,UAAU,OAAO,WAAW;AAC1B,cAAM,eAAe,yBAAyB,MAAM;AACpD,cAAM,UAAmC;AAAA,UACvC,OAAO,OAAO;AAAA,UACd,MAAM,0BAA0B,OAAO,IAAI;AAAA,UAC3C,gBAAgB,OAAO,iBAAiB,OAAO,iBAAiB;AAAA,UAChE,OAAO,MAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,QAAQ,CAAC;AAAA,UACrD,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC;AAAA,QAC7D;AACA,YAAI,iBAAiB;AACnB,kBAAQ,kBAAkB;AAAA,QAC5B,OAAO;AACL,kBAAQ,WAAW,OAAO;AAAA,QAC5B;AACA,YAAI,mBAAmB;AACrB,gBAAM,YAAY,OAAO,OAAO,aAAa,WAAW,OAAO,SAAS,KAAK,IAAI;AACjF,kBAAQ,WAAW,aAAa,UAAU,SAAS,YAAY;AAAA,QACjE;AACA,cAAM,EAAE,QAAQ,QAAQ,IAAI,MAAM,WAA+C,cAAc,OAAO;AACtG,cAAM,YAAY,OAAO,SAAS,OAAO,WAAW,QAAQ,KAAK;AACjE,YAAI,SAAS,aAAa,uBAAuB;AAC/C,gBAAM,MAAM,EAAE,uCAAuC,4FAA4F;AACjJ,iBAAO,SAAS,OAAO,wBAAwB,mBAAmB,GAAG,CAAC;AACtE;AAAA,QACF;AAEA,YAAI,eAAe,cAAc,WAAW;AAC1C,gBAAM,WAAW,4BAA4B;AAAA,YAC3C,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,WAAW;AAAA,YACX,gBAAgB,OAAO,iBAAiB,OAAO,iBAAiB;AAAA,YAChE,UAAU,oBACL,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,SAAS,OAAO,WAAW,OACnF;AAAA,UACN,GAAG;AAAA,YACD,cAAc,EAAE,wCAAwC,oDAAoD;AAAA,UAC9G,CAAC;AAAA,QACH;AAAA,MACF;AAAA;AAAA,EACF,GACF,GACF;AAEJ;AAEA,SAAS,wBAAwB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAQG;AACD,QAAM,IAAI,KAAK;AACf,MAAI,SAAS;AACX,WACE,qBAAC,SAAI,WAAU,yDACb;AAAA,0BAAC,WAAQ,MAAK,MAAK;AAAA,MAAE;AAAA,MAAE,EAAE,8BAA8B,uBAAkB;AAAA,OAC3E;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,aACC,oBAAC,SAAI,WAAU,0FAA0F,iBAAM;AAAA,IAEhH,CAAC,SACA,iCACE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,WAAU;AAAA,UACV,OAAO;AAAA,UACP,eAAe,CAAC,SAAS,aAAa,IAA8B;AAAA,UAEpE;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,OAAM;AAAA,gBACN,OAAO,EAAE,mCAAmC,oBAAoB;AAAA;AAAA,YAClE;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,OAAM;AAAA,gBACN,OAAO,EAAE,oCAAoC,wBAAwB;AAAA;AAAA,YACvE;AAAA;AAAA;AAAA,MACF;AAAA,MACC,SAAS,cACR,oBAAC,SAAI,WAAU,aACZ,kBAAQ,IAAI,CAAC,WACZ,qBAAC,WAAsB,WAAU,8EAC/B;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,SAAS,SAAS,OAAO,EAAE;AAAA,YACpC,UAAU,MAAM,SAAS,OAAO,EAAE;AAAA;AAAA,QACpC;AAAA,QACA,qBAAC,SACC;AAAA,8BAAC,SAAI,WAAU,oCAAoC,iBAAO,OAAM;AAAA,UAC/D,OAAO,cAAc,oBAAC,SAAI,WAAU,iCAAiC,iBAAO,aAAY,IAAS;AAAA,WACpG;AAAA,WAVU,OAAO,EAWnB,CACD,GACH;AAAA,MAED,SAAS,aACR,oBAAC,SAAI,WAAU,yEACZ,YAAE,gCAAgC,qFAAqF,GAC1H;AAAA,OAEJ;AAAA,KAEJ;AAEJ;",
   "names": []
 }

package/dist/modules/auth/backend/users/roleOptions.js

@@ -16,7 +16,7 @@ async function fetchRoleOptions(query, params) {
       const id = typeof item?.id === "string" ? item.id.trim() : "";
       const name = typeof item?.name === "string" ? item?.name.trim() : "";
       if (!id || !name) return null;
-      if (name === "superadmin") return null;
+      if (name === "superadmin" && !params?.includeSuperAdmin) return null;
       return { value: id, label: name };
     }).filter((opt) => !!opt);
   } catch {

package/dist/modules/auth/backend/users/roleOptions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/backend/users/roleOptions.ts"],
-  "sourcesContent": ["import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport type { CrudFieldOption } from '@open-mercato/ui/backend/CrudForm'\n\ntype RoleListResponse = {\n  items?: Array<{ id?: string | null; name?: string | null }>\n}\n\ntype FetchRoleOptionsParams = {\n  tenantId?: string | null\n}\n\nexport async function fetchRoleOptions(query?: string, params?: FetchRoleOptionsParams): Promise<CrudFieldOption[]> {\n  const searchParams = new URLSearchParams({ page: '1', pageSize: '20' })\n  if (query && query.trim()) searchParams.set('search', query.trim())\n  const tenantId = typeof params?.tenantId === 'string' && params.tenantId.trim().length ? params.tenantId.trim() : null\n  if (tenantId) searchParams.set('tenantId', tenantId)\n\n  try {\n    const call = await apiCall<RoleListResponse>(\n      `/api/auth/roles?${searchParams.toString()}`,\n      undefined,\n      { fallback: { items: [] } },\n    )\n    if (!call.ok || !Array.isArray(call.result?.items)) return []\n    const { items } = call.result\n    return items\n      .map((item) => {\n        const id = typeof item?.id === 'string' ? item.id.trim() : ''\n        const name = typeof item?.name === 'string' ? item?.name.trim() : ''\n        if (!id || !name) return null\n        if (name === 'superadmin') return null\n        return { value: id, label: name }\n      })\n      .filter((opt): opt is CrudFieldOption => !!opt)\n  } catch {\n    return []\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,eAAe;AAWxB,eAAsB,iBAAiB,OAAgB,QAA6D;AAClH,QAAM,eAAe,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,KAAK,CAAC;AACtE,MAAI,SAAS,MAAM,KAAK,EAAG,cAAa,IAAI,UAAU,MAAM,KAAK,CAAC;AAClE,QAAM,WAAW,OAAO,QAAQ,aAAa,YAAY,OAAO,SAAS,KAAK,EAAE,SAAS,OAAO,SAAS,KAAK,IAAI;AAClH,MAAI,SAAU,cAAa,IAAI,YAAY,QAAQ;AAEnD,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB,mBAAmB,aAAa,SAAS,CAAC;AAAA,MAC1C;AAAA,MACA,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,IAC5B;AACA,QAAI,CAAC,KAAK,MAAM,CAAC,MAAM,QAAQ,KAAK,QAAQ,KAAK,EAAG,QAAO,CAAC;AAC5D,UAAM,EAAE,MAAM,IAAI,KAAK;AACvB,WAAO,MACJ,IAAI,CAAC,SAAS;AACb,YAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,GAAG,KAAK,IAAI;AAC3D,YAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,KAAK,KAAK,IAAI;AAClE,UAAI,CAAC,MAAM,CAAC,KAAM,QAAO;AACzB,UAAI,SAAS,aAAc,QAAO;AAClC,aAAO,EAAE,OAAO,IAAI,OAAO,KAAK;AAAA,IAClC,CAAC,EACA,OAAO,CAAC,QAAgC,CAAC,CAAC,GAAG;AAAA,EAClD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport type { CrudFieldOption } from '@open-mercato/ui/backend/CrudForm'\n\ntype RoleListResponse = {\n  items?: Array<{ id?: string | null; name?: string | null }>\n}\n\ntype FetchRoleOptionsParams = {\n  tenantId?: string | null\n  includeSuperAdmin?: boolean\n}\n\nexport async function fetchRoleOptions(query?: string, params?: FetchRoleOptionsParams): Promise<CrudFieldOption[]> {\n  const searchParams = new URLSearchParams({ page: '1', pageSize: '20' })\n  if (query && query.trim()) searchParams.set('search', query.trim())\n  const tenantId = typeof params?.tenantId === 'string' && params.tenantId.trim().length ? params.tenantId.trim() : null\n  if (tenantId) searchParams.set('tenantId', tenantId)\n\n  try {\n    const call = await apiCall<RoleListResponse>(\n      `/api/auth/roles?${searchParams.toString()}`,\n      undefined,\n      { fallback: { items: [] } },\n    )\n    if (!call.ok || !Array.isArray(call.result?.items)) return []\n    const { items } = call.result\n    return items\n      .map((item) => {\n        const id = typeof item?.id === 'string' ? item.id.trim() : ''\n        const name = typeof item?.name === 'string' ? item?.name.trim() : ''\n        if (!id || !name) return null\n        if (name === 'superadmin' && !params?.includeSuperAdmin) return null\n        return { value: id, label: name }\n      })\n      .filter((opt): opt is CrudFieldOption => !!opt)\n  } catch {\n    return []\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe;AAYxB,eAAsB,iBAAiB,OAAgB,QAA6D;AAClH,QAAM,eAAe,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,KAAK,CAAC;AACtE,MAAI,SAAS,MAAM,KAAK,EAAG,cAAa,IAAI,UAAU,MAAM,KAAK,CAAC;AAClE,QAAM,WAAW,OAAO,QAAQ,aAAa,YAAY,OAAO,SAAS,KAAK,EAAE,SAAS,OAAO,SAAS,KAAK,IAAI;AAClH,MAAI,SAAU,cAAa,IAAI,YAAY,QAAQ;AAEnD,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB,mBAAmB,aAAa,SAAS,CAAC;AAAA,MAC1C;AAAA,MACA,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,IAC5B;AACA,QAAI,CAAC,KAAK,MAAM,CAAC,MAAM,QAAQ,KAAK,QAAQ,KAAK,EAAG,QAAO,CAAC;AAC5D,UAAM,EAAE,MAAM,IAAI,KAAK;AACvB,WAAO,MACJ,IAAI,CAAC,SAAS;AACb,YAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,GAAG,KAAK,IAAI;AAC3D,YAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,KAAK,KAAK,IAAI;AAClE,UAAI,CAAC,MAAM,CAAC,KAAM,QAAO;AACzB,UAAI,SAAS,gBAAgB,CAAC,QAAQ,kBAAmB,QAAO;AAChE,aAAO,EAAE,OAAO,IAAI,OAAO,KAAK;AAAA,IAClC,CAAC,EACA,OAAO,CAAC,QAAgC,CAAC,CAAC,GAAG;AAAA,EAClD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/auth/commands/roles.js

@@ -192,6 +192,14 @@ const updateRoleCommand = {
         }
       }
     }
+    const wantsTenantChange = parsed.tenantId !== void 0 && parsed.tenantId !== current.tenantId;
+    if (wantsTenantChange) {
+      const assignments = await em.count(UserRole, { role: current, deletedAt: null });
+      if (assignments > 0) {
+        throw new CrudHttpError(400, { error: "Role cannot be moved to another tenant while users are assigned" });
+      }
+      await em.nativeDelete(RoleAcl, { role: parsed.id });
+    }
     const de = ctx.container.resolve("dataEngine");
     const role = await de.updateOrmEntity({
       entity: Role,

package/dist/modules/auth/commands/roles.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/commands/roles.ts"],
-  "sourcesContent": ["import type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  emitCrudUndoSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { z } from 'zod'\nimport { Role, RoleAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  loadCustomFieldSnapshot,\n  buildCustomFieldResetMap,\n  diffCustomFieldChanges,\n} from '@open-mercato/shared/lib/commands/customFieldSnapshots'\nimport { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'\n\ntype SerializedRole = {\n  name: string\n  tenantId: string\n  custom?: Record<string, unknown>\n}\n\ntype RoleAclSnapshot = {\n  id: string | null\n  tenantId: string\n  features: string[] | null\n  isSuperAdmin: boolean\n  organizations: string[] | null\n}\n\ntype RoleUndoSnapshot = {\n  id: string\n  name: string\n  tenantId: string\n  acls: RoleAclSnapshot[]\n  custom?: Record<string, unknown>\n}\n\ntype RoleSnapshots = {\n  view: SerializedRole\n  undo: RoleUndoSnapshot\n}\n\nconst RESERVED_ROLE_NAMES = new Set(['superadmin', 'admin'])\n\nfunction isReservedRoleName(name: string | undefined | null): boolean {\n  if (typeof name !== 'string') return false\n  const normalized = name.trim().toLowerCase()\n  return normalized.length > 0 && RESERVED_ROLE_NAMES.has(normalized)\n}\n\nfunction assertRoleNameAllowed(name: string | undefined | null) {\n  if (isReservedRoleName(name)) {\n    throw new CrudHttpError(400, { error: 'Role name is reserved' })\n  }\n}\n\nconst createSchema = z.object({\n  name: z.string().min(2).max(100),\n  tenantId: z.string().uuid().optional(),\n})\n\nconst updateSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string().min(2).max(100).optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const roleCrudEvents: CrudEventsConfig = {\n  module: 'auth',\n  entity: 'role',\n  persistent: true,\n  buildPayload: (ctx) => ({\n    id: ctx.identifiers.id,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nexport const roleCrudIndexer: CrudIndexerConfig = {\n  entityType: E.auth.role,\n  buildUpsertPayload: (ctx) => ({\n    entityType: E.auth.role,\n    recordId: ctx.identifiers.id,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n  buildDeletePayload: (ctx) => ({\n    entityType: E.auth.role,\n    recordId: ctx.identifiers.id,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nconst createRoleCommand: CommandHandler<Record<string, unknown>, Role> = {\n  id: 'auth.roles.create',\n  async execute(rawInput, ctx) {\n    const rawBody = rawInput && typeof rawInput === 'object' ? rawInput as Record<string, unknown> : {}\n    if ('tenantId' in rawBody && rawBody.tenantId === null) {\n      throw new CrudHttpError(400, { error: 'tenantId cannot be null \u2014 global roles are not supported' })\n    }\n    const { parsed, custom } = parseWithCustomFields(createSchema, rawInput)\n    assertRoleNameAllowed(parsed.name)\n    const resolvedTenantId = parsed.tenantId ?? ctx.auth?.tenantId ?? null\n    if (!resolvedTenantId) {\n      throw new CrudHttpError(400, { error: 'tenantId is required \u2014 global roles are not supported' })\n    }\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const role = await de.createOrmEntity({\n      entity: Role,\n      data: {\n        name: parsed.name,\n        tenantId: resolvedTenantId,\n      },\n    })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.auth.role,\n      recordId: String(role.id),\n      organizationId: null,\n      tenantId: resolvedTenantId,\n      values: custom,\n    })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: role,\n      identifiers: {\n        id: String(role.id),\n        organizationId: null,\n        tenantId: resolvedTenantId,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n\n    return role\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n    })\n    return serializeRole(result, custom)\n  },\n  buildLog: async ({ result, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n    })\n    const snapshot = captureRoleSnapshots(result, [], custom)\n    return {\n      actionLabel: translate('auth.audit.roles.create', 'Create role'),\n      resourceKind: 'auth.role',\n      resourceId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      snapshotAfter: snapshot.view,\n      payload: {\n        undo: {\n          after: snapshot.undo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const undo = extractUndoPayload<RoleUndoPayload>(logEntry)?.after\n    if (!undo) return\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await em.nativeDelete(RoleAcl, { role: undo.id as unknown as Role })\n    if (undo.custom && Object.keys(undo.custom).length) {\n      const reset = buildCustomFieldResetMap(undefined, undo.custom)\n      if (Object.keys(reset).length) {\n        await setCustomFieldsIfAny({\n          dataEngine: de,\n          entityId: E.auth.role,\n          recordId: undo.id,\n          organizationId: null,\n          tenantId: undo.tenantId ?? null,\n          values: reset,\n          notify: false,\n        })\n      }\n    }\n    await de.deleteOrmEntity({\n      entity: Role,\n      where: { id: undo.id, deletedAt: null } as FilterQuery<Role>,\n      soft: false,\n    })\n  },\n}\n\nconst updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {\n  id: 'auth.roles.update',\n  async prepare(rawInput, ctx) {\n    const { parsed } = parseWithCustomFields(updateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) throw new CrudHttpError(404, { error: 'Role not found' })\n    const acls = await loadRoleAclSnapshots(em, parsed.id)\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: parsed.id,\n      tenantId: existing.tenantId ? String(existing.tenantId) : null,\n    })\n    return { before: captureRoleSnapshots(existing, acls, custom) }\n  },\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const current = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!current) throw new CrudHttpError(404, { error: 'Role not found' })\n    if (parsed.name !== undefined) {\n      const nextName = parsed.name\n      if (nextName !== current.name) assertRoleNameAllowed(nextName)\n      if (nextName !== current.name) {\n        const assignments = await em.count(UserRole, { role: current, deletedAt: null })\n        if (assignments > 0) {\n          throw new CrudHttpError(400, { error: 'Role name cannot be changed while users are assigned' })\n        }\n      }\n    }\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const role = await de.updateOrmEntity({\n      entity: Role,\n      where: { id: parsed.id, deletedAt: null } as FilterQuery<Role>,\n      apply: (entity) => {\n        if (parsed.name !== undefined) entity.name = parsed.name\n        if (parsed.tenantId !== undefined) entity.tenantId = parsed.tenantId\n      },\n    })\n    if (!role) throw new CrudHttpError(404, { error: 'Role not found' })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.auth.role,\n      recordId: String(role.id),\n      organizationId: null,\n      tenantId: role.tenantId ? String(role.tenantId) : null,\n      values: custom,\n    })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: role,\n      identifiers: {\n        id: String(role.id),\n        organizationId: null,\n        tenantId: role.tenantId ? String(role.tenantId) : null,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n\n    return role\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n    })\n    return serializeRole(result, custom)\n  },\n  buildLog: async ({ result, snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshots = snapshots.before as RoleSnapshots | undefined\n    const before = beforeSnapshots?.view\n    const beforeUndo = beforeSnapshots?.undo ?? null\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const afterAcls = await loadRoleAclSnapshots(em, String(result.id))\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n    })\n    const afterSnapshots = captureRoleSnapshots(result, afterAcls, custom)\n    const after = afterSnapshots.view\n    const changes = buildChanges(before ?? null, after as Record<string, unknown>, ['name', 'tenantId'])\n    const customDiff = diffCustomFieldChanges(before?.custom, custom)\n    for (const [key, diff] of Object.entries(customDiff)) {\n      changes[`cf_${key}`] = diff\n    }\n    return {\n      actionLabel: translate('auth.audit.roles.update', 'Update role'),\n      resourceKind: 'auth.role',\n      resourceId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      changes,\n      snapshotBefore: before ?? null,\n      snapshotAfter: after,\n      payload: {\n        undo: {\n          before: beforeUndo,\n          after: afterSnapshots.undo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const undo = extractUndoPayload<RoleUndoPayload>(logEntry)\n    const before = undo?.before\n    const after = undo?.after\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const updated = await de.updateOrmEntity({\n      entity: Role,\n      where: { id: before.id, deletedAt: null } as FilterQuery<Role>,\n      apply: (entity) => {\n        entity.name = before.name\n        entity.tenantId = before.tenantId\n      },\n    })\n    if (updated) {\n      await restoreRoleAcls(em, before.id, before.acls)\n    }\n    const reset = buildCustomFieldResetMap(before.custom, after?.custom)\n    if (Object.keys(reset).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: E.auth.role,\n        recordId: before.id,\n        organizationId: null,\n        tenantId: before.tenantId,\n        values: reset,\n        notify: false,\n      })\n    }\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: updated,\n      identifiers: {\n        id: before.id,\n        organizationId: null,\n        tenantId: before.tenantId ?? null,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n  },\n}\n\nconst deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?: Record<string, unknown> }, Role> = {\n  id: 'auth.roles.delete',\n  async prepare(input, ctx) {\n    const id = requireId(input, 'Role id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) return {}\n    const acls = await loadRoleAclSnapshots(em, id)\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: id,\n      tenantId: existing.tenantId ? String(existing.tenantId) : null,\n    })\n    return { before: captureRoleSnapshots(existing, acls, custom) }\n  },\n  async execute(input, ctx) {\n    const id = requireId(input, 'Role id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const role = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!role) throw new CrudHttpError(404, { error: 'Role not found' })\n    const activeAssignments = await em.count(UserRole, { role, deletedAt: null })\n    if (activeAssignments > 0) throw new CrudHttpError(400, { error: 'Role has assigned users' })\n\n    await em.nativeDelete(RoleAcl, { role: id })\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const deleted = await de.deleteOrmEntity({\n      entity: Role,\n      where: { id, deletedAt: null } as FilterQuery<Role>,\n      soft: false,\n    })\n    if (!deleted) throw new CrudHttpError(404, { error: 'Role not found' })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: deleted,\n      identifiers: {\n        id,\n        organizationId: null,\n        tenantId: deleted.tenantId ? String(deleted.tenantId) : null,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n\n    return deleted\n  },\n  buildLog: async ({ snapshots, input }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshots = snapshots.before as RoleSnapshots | undefined\n    const before = beforeSnapshots?.view\n    const beforeUndo = beforeSnapshots?.undo ?? null\n    const id = requireId(input, 'Role id required')\n    return {\n      actionLabel: translate('auth.audit.roles.delete', 'Delete role'),\n      resourceKind: 'auth.role',\n      resourceId: id,\n      tenantId: before?.tenantId ?? null,\n      snapshotBefore: before ?? null,\n      payload: {\n        undo: {\n          before: beforeUndo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const before = extractUndoPayload<RoleUndoPayload>(logEntry)?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    let role = await findOneWithDecryption(em, Role, { id: before.id }, {}, { tenantId: null, organizationId: null })\n    if (role) {\n      role.deletedAt = null\n      role.name = before.name\n      role.tenantId = before.tenantId\n      await em.flush()\n    } else {\n      role = await de.createOrmEntity({\n        entity: Role,\n        data: {\n          id: before.id,\n          name: before.name,\n          tenantId: before.tenantId,\n        },\n      })\n    }\n    await restoreRoleAcls(em, before.id, before.acls)\n    const reset = buildCustomFieldResetMap(before.custom, undefined)\n    if (Object.keys(reset).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: E.auth.role,\n        recordId: before.id,\n        organizationId: null,\n        tenantId: before.tenantId ?? null,\n        values: reset,\n        notify: false,\n      })\n    }\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: role,\n      identifiers: {\n        id: before.id,\n        organizationId: null,\n        tenantId: before.tenantId ?? null,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n  },\n}\n\nregisterCommand(createRoleCommand)\nregisterCommand(updateRoleCommand)\nregisterCommand(deleteRoleCommand)\n\nfunction serializeRole(role: Role, custom?: Record<string, unknown> | null): SerializedRole {\n  const payload: SerializedRole = {\n    name: String(role.name ?? ''),\n    tenantId: String(role.tenantId),\n  }\n  if (custom && Object.keys(custom).length) payload.custom = custom\n  return payload\n}\n\nfunction captureRoleSnapshots(\n  role: Role,\n  acls: RoleAclSnapshot[] = [],\n  custom?: Record<string, unknown> | null\n): RoleSnapshots {\n  return {\n    view: serializeRole(role, custom),\n    undo: {\n      id: String(role.id),\n      name: String(role.name ?? ''),\n      tenantId: String(role.tenantId),\n      acls,\n      ...(custom && Object.keys(custom).length ? { custom } : {}),\n    },\n  }\n}\n\nasync function loadRoleAclSnapshots(em: EntityManager, roleId: string): Promise<RoleAclSnapshot[]> {\n  const entries = await findWithDecryption(em, RoleAcl, { role: roleId as unknown as Role }, {}, { tenantId: null, organizationId: null })\n  return entries.map((entry) => ({\n    id: entry.id ? String(entry.id) : null,\n    tenantId: String(entry.tenantId),\n    features: Array.isArray(entry.featuresJson) ? [...entry.featuresJson] : null,\n    isSuperAdmin: Boolean(entry.isSuperAdmin),\n    organizations: Array.isArray(entry.organizationsJson) ? [...entry.organizationsJson] : null,\n  }))\n}\n\nasync function restoreRoleAcls(em: EntityManager, roleId: string, acls: RoleAclSnapshot[]) {\n  await em.nativeDelete(RoleAcl, { role: roleId as unknown as Role })\n  if (!acls.length) {\n    await em.flush()\n    return\n  }\n  const roleRef = em.getReference(Role, roleId)\n  for (const acl of acls) {\n    const entity = em.create(RoleAcl, {\n      id: acl.id ?? undefined,\n      role: roleRef,\n      tenantId: acl.tenantId,\n      featuresJson: acl.features ?? null,\n      isSuperAdmin: acl.isSuperAdmin,\n      organizationsJson: acl.organizations ?? null,\n      createdAt: new Date(),\n    })\n    em.persist(entity)\n  }\n  await em.flush()\n}\n\ntype RoleUndoPayload = { before?: RoleUndoSnapshot | null; after?: RoleUndoSnapshot | null }\n"],
-  "mappings": "AACA,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AAEpC,SAAS,uBAAuB,0BAA0B;AAE1D,SAAS,SAAS;AAClB,SAAS,MAAM,SAAS,gBAAgB;AACxC,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AA6BnC,MAAM,sBAAsB,oBAAI,IAAI,CAAC,cAAc,OAAO,CAAC;AAE3D,SAAS,mBAAmB,MAA0C;AACpE,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAM,aAAa,KAAK,KAAK,EAAE,YAAY;AAC3C,SAAO,WAAW,SAAS,KAAK,oBAAoB,IAAI,UAAU;AACpE;AAEA,SAAS,sBAAsB,MAAiC;AAC9D,MAAI,mBAAmB,IAAI,GAAG;AAC5B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAAA,EACjE;AACF;AAEA,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAED,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,iBAAmC;AAAA,EAC9C,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc,CAAC,SAAS;AAAA,IACtB,IAAI,IAAI,YAAY;AAAA,IACpB,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEO,MAAM,kBAAqC;AAAA,EAChD,YAAY,EAAE,KAAK;AAAA,EACnB,oBAAoB,CAAC,SAAS;AAAA,IAC5B,YAAY,EAAE,KAAK;AAAA,IACnB,UAAU,IAAI,YAAY;AAAA,IAC1B,UAAU,IAAI,YAAY;AAAA,EAC5B;AAAA,EACA,oBAAoB,CAAC,SAAS;AAAA,IAC5B,YAAY,EAAE,KAAK;AAAA,IACnB,UAAU,IAAI,YAAY;AAAA,IAC1B,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEA,MAAM,oBAAmE;AAAA,EACvE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,UAAU,YAAY,OAAO,aAAa,WAAW,WAAsC,CAAC;AAClG,QAAI,cAAc,WAAW,QAAQ,aAAa,MAAM;AACtD,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gEAA2D,CAAC;AAAA,IACpG;AACA,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AACvE,0BAAsB,OAAO,IAAI;AACjC,UAAM,mBAAmB,OAAO,YAAY,IAAI,MAAM,YAAY;AAClE,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,6DAAwD,CAAC;AAAA,IACjG;AACA,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,OAAO,MAAM,GAAG,gBAAgB;AAAA,MACpC,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,MAAM,OAAO;AAAA,QACb,UAAU;AAAA,MACZ;AAAA,IACF,CAAC;AAED,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,KAAK,EAAE;AAAA,MACxB,gBAAgB;AAAA,MAChB,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO,KAAK,EAAE;AAAA,QAClB,gBAAgB;AAAA,QAChB,UAAU;AAAA,MACZ;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACxD,CAAC;AACD,WAAO,cAAc,QAAQ,MAAM;AAAA,EACrC;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACxD,CAAC;AACD,UAAM,WAAW,qBAAqB,QAAQ,CAAC,GAAG,MAAM;AACxD,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,eAAe,SAAS;AAAA,MACxB,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,OAAO,SAAS;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,OAAO,mBAAoC,QAAQ,GAAG;AAC5D,QAAI,CAAC,KAAM;AACX,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,GAAG,aAAa,SAAS,EAAE,MAAM,KAAK,GAAsB,CAAC;AACnE,QAAI,KAAK,UAAU,OAAO,KAAK,KAAK,MAAM,EAAE,QAAQ;AAClD,YAAM,QAAQ,yBAAyB,QAAW,KAAK,MAAM;AAC7D,UAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,cAAM,qBAAqB;AAAA,UACzB,YAAY;AAAA,UACZ,UAAU,EAAE,KAAK;AAAA,UACjB,UAAU,KAAK;AAAA,UACf,gBAAgB;AAAA,UAChB,UAAU,KAAK,YAAY;AAAA,UAC3B,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,GAAG,gBAAgB;AAAA,MACvB,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,KAAK,IAAI,WAAW,KAAK;AAAA,MACtC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;AAEA,MAAM,oBAAmE;AAAA,EACvE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AAC/D,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvI,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACvE,UAAM,OAAO,MAAM,qBAAqB,IAAI,OAAO,EAAE;AACrD,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,UAAU,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AAAA,IAC5D,CAAC;AACD,WAAO,EAAE,QAAQ,qBAAqB,UAAU,MAAM,MAAM,EAAE;AAAA,EAChE;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AACvE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACtI,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACtE,QAAI,OAAO,SAAS,QAAW;AAC7B,YAAM,WAAW,OAAO;AACxB,UAAI,aAAa,QAAQ,KAAM,uBAAsB,QAAQ;AAC7D,UAAI,aAAa,QAAQ,MAAM;AAC7B,cAAM,cAAc,MAAM,GAAG,MAAM,UAAU,EAAE,MAAM,SAAS,WAAW,KAAK,CAAC;AAC/E,YAAI,cAAc,GAAG;AACnB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uDAAuD,CAAC;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,OAAO,MAAM,GAAG,gBAAgB;AAAA,MACpC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,MACxC,OAAO,CAAC,WAAW;AACjB,YAAI,OAAO,SAAS,OAAW,QAAO,OAAO,OAAO;AACpD,YAAI,OAAO,aAAa,OAAW,QAAO,WAAW,OAAO;AAAA,MAC9D;AAAA,IACF,CAAC;AACD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAEnE,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,KAAK,EAAE;AAAA,MACxB,gBAAgB;AAAA,MAChB,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO,KAAK,EAAE;AAAA,QAClB,gBAAgB;AAAA,QAChB,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MACpD;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACxD,CAAC;AACD,WAAO,cAAc,QAAQ,MAAM;AAAA,EACrC;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,WAAW,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,kBAAkB,UAAU;AAClC,UAAM,SAAS,iBAAiB;AAChC,UAAM,aAAa,iBAAiB,QAAQ;AAC5C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,YAAY,MAAM,qBAAqB,IAAI,OAAO,OAAO,EAAE,CAAC;AAClE,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACxD,CAAC;AACD,UAAM,iBAAiB,qBAAqB,QAAQ,WAAW,MAAM;AACrE,UAAM,QAAQ,eAAe;AAC7B,UAAM,UAAU,aAAa,UAAU,MAAM,OAAkC,CAAC,QAAQ,UAAU,CAAC;AACnG,UAAM,aAAa,uBAAuB,QAAQ,QAAQ,MAAM;AAChE,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,UAAU,GAAG;AACpD,cAAQ,MAAM,GAAG,EAAE,IAAI;AAAA,IACzB;AACA,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD;AAAA,MACA,gBAAgB,UAAU;AAAA,MAC1B,eAAe;AAAA,MACf,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ;AAAA,UACR,OAAO,eAAe;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,OAAO,mBAAoC,QAAQ;AACzD,UAAM,SAAS,MAAM;AACrB,UAAM,QAAQ,MAAM;AACpB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,UAAU,MAAM,GAAG,gBAAgB;AAAA,MACvC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,MACxC,OAAO,CAAC,WAAW;AACjB,eAAO,OAAO,OAAO;AACrB,eAAO,WAAW,OAAO;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,QAAI,SAAS;AACX,YAAM,gBAAgB,IAAI,OAAO,IAAI,OAAO,IAAI;AAAA,IAClD;AACA,UAAM,QAAQ,yBAAyB,OAAO,QAAQ,OAAO,MAAM;AACnE,QAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU,EAAE,KAAK;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,gBAAgB;AAAA,QAChB,UAAU,OAAO;AAAA,QACjB,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,MAAM,oBAA+G;AAAA,EACnH,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC5H,QAAI,CAAC,SAAU,QAAO,CAAC;AACvB,UAAM,OAAO,MAAM,qBAAqB,IAAI,EAAE;AAC9C,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU;AAAA,MACV,UAAU,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AAAA,IAC5D,CAAC;AACD,WAAO,EAAE,QAAQ,qBAAqB,UAAU,MAAM,MAAM,EAAE;AAAA,EAChE;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,OAAO,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACxH,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACnE,UAAM,oBAAoB,MAAM,GAAG,MAAM,UAAU,EAAE,MAAM,WAAW,KAAK,CAAC;AAC5E,QAAI,oBAAoB,EAAG,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,0BAA0B,CAAC;AAE5F,UAAM,GAAG,aAAa,SAAS,EAAE,MAAM,GAAG,CAAC;AAE3C,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,UAAU,MAAM,GAAG,gBAAgB;AAAA,MACvC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,WAAW,KAAK;AAAA,MAC7B,MAAM;AAAA,IACR,CAAC;AACD,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAEtE,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX;AAAA,QACA,gBAAgB;AAAA,QAChB,UAAU,QAAQ,WAAW,OAAO,QAAQ,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,MAAM,MAAM;AACxC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,kBAAkB,UAAU;AAClC,UAAM,SAAS,iBAAiB;AAChC,UAAM,aAAa,iBAAiB,QAAQ;AAC5C,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,UAAU,QAAQ,YAAY;AAAA,MAC9B,gBAAgB,UAAU;AAAA,MAC1B,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,SAAS,mBAAoC,QAAQ,GAAG;AAC9D,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,QAAI,OAAO,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAChH,QAAI,MAAM;AACR,WAAK,YAAY;AACjB,WAAK,OAAO,OAAO;AACnB,WAAK,WAAW,OAAO;AACvB,YAAM,GAAG,MAAM;AAAA,IACjB,OAAO;AACL,aAAO,MAAM,GAAG,gBAAgB;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM;AAAA,UACJ,IAAI,OAAO;AAAA,UACX,MAAM,OAAO;AAAA,UACb,UAAU,OAAO;AAAA,QACnB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,gBAAgB,IAAI,OAAO,IAAI,OAAO,IAAI;AAChD,UAAM,QAAQ,yBAAyB,OAAO,QAAQ,MAAS;AAC/D,QAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU,EAAE,KAAK;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,gBAAgB;AAAA,QAChB,UAAU,OAAO,YAAY;AAAA,QAC7B,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AAEjC,SAAS,cAAc,MAAY,QAAyD;AAC1F,QAAM,UAA0B;AAAA,IAC9B,MAAM,OAAO,KAAK,QAAQ,EAAE;AAAA,IAC5B,UAAU,OAAO,KAAK,QAAQ;AAAA,EAChC;AACA,MAAI,UAAU,OAAO,KAAK,MAAM,EAAE,OAAQ,SAAQ,SAAS;AAC3D,SAAO;AACT;AAEA,SAAS,qBACP,MACA,OAA0B,CAAC,GAC3B,QACe;AACf,SAAO;AAAA,IACL,MAAM,cAAc,MAAM,MAAM;AAAA,IAChC,MAAM;AAAA,MACJ,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,MAAM,OAAO,KAAK,QAAQ,EAAE;AAAA,MAC5B,UAAU,OAAO,KAAK,QAAQ;AAAA,MAC9B;AAAA,MACA,GAAI,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3D;AAAA,EACF;AACF;AAEA,eAAe,qBAAqB,IAAmB,QAA4C;AACjG,QAAM,UAAU,MAAM,mBAAmB,IAAI,SAAS,EAAE,MAAM,OAA0B,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvI,SAAO,QAAQ,IAAI,CAAC,WAAW;AAAA,IAC7B,IAAI,MAAM,KAAK,OAAO,MAAM,EAAE,IAAI;AAAA,IAClC,UAAU,OAAO,MAAM,QAAQ;AAAA,IAC/B,UAAU,MAAM,QAAQ,MAAM,YAAY,IAAI,CAAC,GAAG,MAAM,YAAY,IAAI;AAAA,IACxE,cAAc,QAAQ,MAAM,YAAY;AAAA,IACxC,eAAe,MAAM,QAAQ,MAAM,iBAAiB,IAAI,CAAC,GAAG,MAAM,iBAAiB,IAAI;AAAA,EACzF,EAAE;AACJ;AAEA,eAAe,gBAAgB,IAAmB,QAAgB,MAAyB;AACzF,QAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAA0B,CAAC;AAClE,MAAI,CAAC,KAAK,QAAQ;AAChB,UAAM,GAAG,MAAM;AACf;AAAA,EACF;AACA,QAAM,UAAU,GAAG,aAAa,MAAM,MAAM;AAC5C,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,GAAG,OAAO,SAAS;AAAA,MAChC,IAAI,IAAI,MAAM;AAAA,MACd,MAAM;AAAA,MACN,UAAU,IAAI;AAAA,MACd,cAAc,IAAI,YAAY;AAAA,MAC9B,cAAc,IAAI;AAAA,MAClB,mBAAmB,IAAI,iBAAiB;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB;AACA,QAAM,GAAG,MAAM;AACjB;",
+  "sourcesContent": ["import type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  emitCrudUndoSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { z } from 'zod'\nimport { Role, RoleAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  loadCustomFieldSnapshot,\n  buildCustomFieldResetMap,\n  diffCustomFieldChanges,\n} from '@open-mercato/shared/lib/commands/customFieldSnapshots'\nimport { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'\n\ntype SerializedRole = {\n  name: string\n  tenantId: string\n  custom?: Record<string, unknown>\n}\n\ntype RoleAclSnapshot = {\n  id: string | null\n  tenantId: string\n  features: string[] | null\n  isSuperAdmin: boolean\n  organizations: string[] | null\n}\n\ntype RoleUndoSnapshot = {\n  id: string\n  name: string\n  tenantId: string\n  acls: RoleAclSnapshot[]\n  custom?: Record<string, unknown>\n}\n\ntype RoleSnapshots = {\n  view: SerializedRole\n  undo: RoleUndoSnapshot\n}\n\nconst RESERVED_ROLE_NAMES = new Set(['superadmin', 'admin'])\n\nfunction isReservedRoleName(name: string | undefined | null): boolean {\n  if (typeof name !== 'string') return false\n  const normalized = name.trim().toLowerCase()\n  return normalized.length > 0 && RESERVED_ROLE_NAMES.has(normalized)\n}\n\nfunction assertRoleNameAllowed(name: string | undefined | null) {\n  if (isReservedRoleName(name)) {\n    throw new CrudHttpError(400, { error: 'Role name is reserved' })\n  }\n}\n\nconst createSchema = z.object({\n  name: z.string().min(2).max(100),\n  tenantId: z.string().uuid().optional(),\n})\n\nconst updateSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string().min(2).max(100).optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const roleCrudEvents: CrudEventsConfig = {\n  module: 'auth',\n  entity: 'role',\n  persistent: true,\n  buildPayload: (ctx) => ({\n    id: ctx.identifiers.id,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nexport const roleCrudIndexer: CrudIndexerConfig = {\n  entityType: E.auth.role,\n  buildUpsertPayload: (ctx) => ({\n    entityType: E.auth.role,\n    recordId: ctx.identifiers.id,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n  buildDeletePayload: (ctx) => ({\n    entityType: E.auth.role,\n    recordId: ctx.identifiers.id,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nconst createRoleCommand: CommandHandler<Record<string, unknown>, Role> = {\n  id: 'auth.roles.create',\n  async execute(rawInput, ctx) {\n    const rawBody = rawInput && typeof rawInput === 'object' ? rawInput as Record<string, unknown> : {}\n    if ('tenantId' in rawBody && rawBody.tenantId === null) {\n      throw new CrudHttpError(400, { error: 'tenantId cannot be null \u2014 global roles are not supported' })\n    }\n    const { parsed, custom } = parseWithCustomFields(createSchema, rawInput)\n    assertRoleNameAllowed(parsed.name)\n    const resolvedTenantId = parsed.tenantId ?? ctx.auth?.tenantId ?? null\n    if (!resolvedTenantId) {\n      throw new CrudHttpError(400, { error: 'tenantId is required \u2014 global roles are not supported' })\n    }\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const role = await de.createOrmEntity({\n      entity: Role,\n      data: {\n        name: parsed.name,\n        tenantId: resolvedTenantId,\n      },\n    })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.auth.role,\n      recordId: String(role.id),\n      organizationId: null,\n      tenantId: resolvedTenantId,\n      values: custom,\n    })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: role,\n      identifiers: {\n        id: String(role.id),\n        organizationId: null,\n        tenantId: resolvedTenantId,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n\n    return role\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n    })\n    return serializeRole(result, custom)\n  },\n  buildLog: async ({ result, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n    })\n    const snapshot = captureRoleSnapshots(result, [], custom)\n    return {\n      actionLabel: translate('auth.audit.roles.create', 'Create role'),\n      resourceKind: 'auth.role',\n      resourceId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      snapshotAfter: snapshot.view,\n      payload: {\n        undo: {\n          after: snapshot.undo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const undo = extractUndoPayload<RoleUndoPayload>(logEntry)?.after\n    if (!undo) return\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await em.nativeDelete(RoleAcl, { role: undo.id as unknown as Role })\n    if (undo.custom && Object.keys(undo.custom).length) {\n      const reset = buildCustomFieldResetMap(undefined, undo.custom)\n      if (Object.keys(reset).length) {\n        await setCustomFieldsIfAny({\n          dataEngine: de,\n          entityId: E.auth.role,\n          recordId: undo.id,\n          organizationId: null,\n          tenantId: undo.tenantId ?? null,\n          values: reset,\n          notify: false,\n        })\n      }\n    }\n    await de.deleteOrmEntity({\n      entity: Role,\n      where: { id: undo.id, deletedAt: null } as FilterQuery<Role>,\n      soft: false,\n    })\n  },\n}\n\nconst updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {\n  id: 'auth.roles.update',\n  async prepare(rawInput, ctx) {\n    const { parsed } = parseWithCustomFields(updateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) throw new CrudHttpError(404, { error: 'Role not found' })\n    const acls = await loadRoleAclSnapshots(em, parsed.id)\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: parsed.id,\n      tenantId: existing.tenantId ? String(existing.tenantId) : null,\n    })\n    return { before: captureRoleSnapshots(existing, acls, custom) }\n  },\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const current = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!current) throw new CrudHttpError(404, { error: 'Role not found' })\n    if (parsed.name !== undefined) {\n      const nextName = parsed.name\n      if (nextName !== current.name) assertRoleNameAllowed(nextName)\n      if (nextName !== current.name) {\n        const assignments = await em.count(UserRole, { role: current, deletedAt: null })\n        if (assignments > 0) {\n          throw new CrudHttpError(400, { error: 'Role name cannot be changed while users are assigned' })\n        }\n      }\n    }\n    const wantsTenantChange = parsed.tenantId !== undefined && parsed.tenantId !== current.tenantId\n    if (wantsTenantChange) {\n      const assignments = await em.count(UserRole, { role: current, deletedAt: null })\n      if (assignments > 0) {\n        throw new CrudHttpError(400, { error: 'Role cannot be moved to another tenant while users are assigned' })\n      }\n      await em.nativeDelete(RoleAcl, { role: parsed.id as unknown as Role })\n    }\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const role = await de.updateOrmEntity({\n      entity: Role,\n      where: { id: parsed.id, deletedAt: null } as FilterQuery<Role>,\n      apply: (entity) => {\n        if (parsed.name !== undefined) entity.name = parsed.name\n        if (parsed.tenantId !== undefined) entity.tenantId = parsed.tenantId\n      },\n    })\n    if (!role) throw new CrudHttpError(404, { error: 'Role not found' })\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.auth.role,\n      recordId: String(role.id),\n      organizationId: null,\n      tenantId: role.tenantId ? String(role.tenantId) : null,\n      values: custom,\n    })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: role,\n      identifiers: {\n        id: String(role.id),\n        organizationId: null,\n        tenantId: role.tenantId ? String(role.tenantId) : null,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n\n    return role\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n    })\n    return serializeRole(result, custom)\n  },\n  buildLog: async ({ result, snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshots = snapshots.before as RoleSnapshots | undefined\n    const before = beforeSnapshots?.view\n    const beforeUndo = beforeSnapshots?.undo ?? null\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const afterAcls = await loadRoleAclSnapshots(em, String(result.id))\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n    })\n    const afterSnapshots = captureRoleSnapshots(result, afterAcls, custom)\n    const after = afterSnapshots.view\n    const changes = buildChanges(before ?? null, after as Record<string, unknown>, ['name', 'tenantId'])\n    const customDiff = diffCustomFieldChanges(before?.custom, custom)\n    for (const [key, diff] of Object.entries(customDiff)) {\n      changes[`cf_${key}`] = diff\n    }\n    return {\n      actionLabel: translate('auth.audit.roles.update', 'Update role'),\n      resourceKind: 'auth.role',\n      resourceId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      changes,\n      snapshotBefore: before ?? null,\n      snapshotAfter: after,\n      payload: {\n        undo: {\n          before: beforeUndo,\n          after: afterSnapshots.undo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const undo = extractUndoPayload<RoleUndoPayload>(logEntry)\n    const before = undo?.before\n    const after = undo?.after\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const updated = await de.updateOrmEntity({\n      entity: Role,\n      where: { id: before.id, deletedAt: null } as FilterQuery<Role>,\n      apply: (entity) => {\n        entity.name = before.name\n        entity.tenantId = before.tenantId\n      },\n    })\n    if (updated) {\n      await restoreRoleAcls(em, before.id, before.acls)\n    }\n    const reset = buildCustomFieldResetMap(before.custom, after?.custom)\n    if (Object.keys(reset).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: E.auth.role,\n        recordId: before.id,\n        organizationId: null,\n        tenantId: before.tenantId,\n        values: reset,\n        notify: false,\n      })\n    }\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: updated,\n      identifiers: {\n        id: before.id,\n        organizationId: null,\n        tenantId: before.tenantId ?? null,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n  },\n}\n\nconst deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?: Record<string, unknown> }, Role> = {\n  id: 'auth.roles.delete',\n  async prepare(input, ctx) {\n    const id = requireId(input, 'Role id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) return {}\n    const acls = await loadRoleAclSnapshots(em, id)\n    const custom = await loadCustomFieldSnapshot(em, {\n      entityId: E.auth.role,\n      recordId: id,\n      tenantId: existing.tenantId ? String(existing.tenantId) : null,\n    })\n    return { before: captureRoleSnapshots(existing, acls, custom) }\n  },\n  async execute(input, ctx) {\n    const id = requireId(input, 'Role id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const role = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!role) throw new CrudHttpError(404, { error: 'Role not found' })\n    const activeAssignments = await em.count(UserRole, { role, deletedAt: null })\n    if (activeAssignments > 0) throw new CrudHttpError(400, { error: 'Role has assigned users' })\n\n    await em.nativeDelete(RoleAcl, { role: id })\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const deleted = await de.deleteOrmEntity({\n      entity: Role,\n      where: { id, deletedAt: null } as FilterQuery<Role>,\n      soft: false,\n    })\n    if (!deleted) throw new CrudHttpError(404, { error: 'Role not found' })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: deleted,\n      identifiers: {\n        id,\n        organizationId: null,\n        tenantId: deleted.tenantId ? String(deleted.tenantId) : null,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n\n    return deleted\n  },\n  buildLog: async ({ snapshots, input }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshots = snapshots.before as RoleSnapshots | undefined\n    const before = beforeSnapshots?.view\n    const beforeUndo = beforeSnapshots?.undo ?? null\n    const id = requireId(input, 'Role id required')\n    return {\n      actionLabel: translate('auth.audit.roles.delete', 'Delete role'),\n      resourceKind: 'auth.role',\n      resourceId: id,\n      tenantId: before?.tenantId ?? null,\n      snapshotBefore: before ?? null,\n      payload: {\n        undo: {\n          before: beforeUndo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const before = extractUndoPayload<RoleUndoPayload>(logEntry)?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    let role = await findOneWithDecryption(em, Role, { id: before.id }, {}, { tenantId: null, organizationId: null })\n    if (role) {\n      role.deletedAt = null\n      role.name = before.name\n      role.tenantId = before.tenantId\n      await em.flush()\n    } else {\n      role = await de.createOrmEntity({\n        entity: Role,\n        data: {\n          id: before.id,\n          name: before.name,\n          tenantId: before.tenantId,\n        },\n      })\n    }\n    await restoreRoleAcls(em, before.id, before.acls)\n    const reset = buildCustomFieldResetMap(before.custom, undefined)\n    if (Object.keys(reset).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: E.auth.role,\n        recordId: before.id,\n        organizationId: null,\n        tenantId: before.tenantId ?? null,\n        values: reset,\n        notify: false,\n      })\n    }\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: role,\n      identifiers: {\n        id: before.id,\n        organizationId: null,\n        tenantId: before.tenantId ?? null,\n      },\n      events: roleCrudEvents,\n      indexer: roleCrudIndexer,\n    })\n  },\n}\n\nregisterCommand(createRoleCommand)\nregisterCommand(updateRoleCommand)\nregisterCommand(deleteRoleCommand)\n\nfunction serializeRole(role: Role, custom?: Record<string, unknown> | null): SerializedRole {\n  const payload: SerializedRole = {\n    name: String(role.name ?? ''),\n    tenantId: String(role.tenantId),\n  }\n  if (custom && Object.keys(custom).length) payload.custom = custom\n  return payload\n}\n\nfunction captureRoleSnapshots(\n  role: Role,\n  acls: RoleAclSnapshot[] = [],\n  custom?: Record<string, unknown> | null\n): RoleSnapshots {\n  return {\n    view: serializeRole(role, custom),\n    undo: {\n      id: String(role.id),\n      name: String(role.name ?? ''),\n      tenantId: String(role.tenantId),\n      acls,\n      ...(custom && Object.keys(custom).length ? { custom } : {}),\n    },\n  }\n}\n\nasync function loadRoleAclSnapshots(em: EntityManager, roleId: string): Promise<RoleAclSnapshot[]> {\n  const entries = await findWithDecryption(em, RoleAcl, { role: roleId as unknown as Role }, {}, { tenantId: null, organizationId: null })\n  return entries.map((entry) => ({\n    id: entry.id ? String(entry.id) : null,\n    tenantId: String(entry.tenantId),\n    features: Array.isArray(entry.featuresJson) ? [...entry.featuresJson] : null,\n    isSuperAdmin: Boolean(entry.isSuperAdmin),\n    organizations: Array.isArray(entry.organizationsJson) ? [...entry.organizationsJson] : null,\n  }))\n}\n\nasync function restoreRoleAcls(em: EntityManager, roleId: string, acls: RoleAclSnapshot[]) {\n  await em.nativeDelete(RoleAcl, { role: roleId as unknown as Role })\n  if (!acls.length) {\n    await em.flush()\n    return\n  }\n  const roleRef = em.getReference(Role, roleId)\n  for (const acl of acls) {\n    const entity = em.create(RoleAcl, {\n      id: acl.id ?? undefined,\n      role: roleRef,\n      tenantId: acl.tenantId,\n      featuresJson: acl.features ?? null,\n      isSuperAdmin: acl.isSuperAdmin,\n      organizationsJson: acl.organizations ?? null,\n      createdAt: new Date(),\n    })\n    em.persist(entity)\n  }\n  await em.flush()\n}\n\ntype RoleUndoPayload = { before?: RoleUndoSnapshot | null; after?: RoleUndoSnapshot | null }\n"],
+  "mappings": "AACA,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AAEpC,SAAS,uBAAuB,0BAA0B;AAE1D,SAAS,SAAS;AAClB,SAAS,MAAM,SAAS,gBAAgB;AACxC,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AA6BnC,MAAM,sBAAsB,oBAAI,IAAI,CAAC,cAAc,OAAO,CAAC;AAE3D,SAAS,mBAAmB,MAA0C;AACpE,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAM,aAAa,KAAK,KAAK,EAAE,YAAY;AAC3C,SAAO,WAAW,SAAS,KAAK,oBAAoB,IAAI,UAAU;AACpE;AAEA,SAAS,sBAAsB,MAAiC;AAC9D,MAAI,mBAAmB,IAAI,GAAG;AAC5B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAAA,EACjE;AACF;AAEA,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAED,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,iBAAmC;AAAA,EAC9C,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc,CAAC,SAAS;AAAA,IACtB,IAAI,IAAI,YAAY;AAAA,IACpB,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEO,MAAM,kBAAqC;AAAA,EAChD,YAAY,EAAE,KAAK;AAAA,EACnB,oBAAoB,CAAC,SAAS;AAAA,IAC5B,YAAY,EAAE,KAAK;AAAA,IACnB,UAAU,IAAI,YAAY;AAAA,IAC1B,UAAU,IAAI,YAAY;AAAA,EAC5B;AAAA,EACA,oBAAoB,CAAC,SAAS;AAAA,IAC5B,YAAY,EAAE,KAAK;AAAA,IACnB,UAAU,IAAI,YAAY;AAAA,IAC1B,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEA,MAAM,oBAAmE;AAAA,EACvE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,UAAU,YAAY,OAAO,aAAa,WAAW,WAAsC,CAAC;AAClG,QAAI,cAAc,WAAW,QAAQ,aAAa,MAAM;AACtD,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,gEAA2D,CAAC;AAAA,IACpG;AACA,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AACvE,0BAAsB,OAAO,IAAI;AACjC,UAAM,mBAAmB,OAAO,YAAY,IAAI,MAAM,YAAY;AAClE,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,6DAAwD,CAAC;AAAA,IACjG;AACA,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,OAAO,MAAM,GAAG,gBAAgB;AAAA,MACpC,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,MAAM,OAAO;AAAA,QACb,UAAU;AAAA,MACZ;AAAA,IACF,CAAC;AAED,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,KAAK,EAAE;AAAA,MACxB,gBAAgB;AAAA,MAChB,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO,KAAK,EAAE;AAAA,QAClB,gBAAgB;AAAA,QAChB,UAAU;AAAA,MACZ;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACxD,CAAC;AACD,WAAO,cAAc,QAAQ,MAAM;AAAA,EACrC;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACxD,CAAC;AACD,UAAM,WAAW,qBAAqB,QAAQ,CAAC,GAAG,MAAM;AACxD,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,eAAe,SAAS;AAAA,MACxB,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,OAAO,SAAS;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,OAAO,mBAAoC,QAAQ,GAAG;AAC5D,QAAI,CAAC,KAAM;AACX,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,GAAG,aAAa,SAAS,EAAE,MAAM,KAAK,GAAsB,CAAC;AACnE,QAAI,KAAK,UAAU,OAAO,KAAK,KAAK,MAAM,EAAE,QAAQ;AAClD,YAAM,QAAQ,yBAAyB,QAAW,KAAK,MAAM;AAC7D,UAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,cAAM,qBAAqB;AAAA,UACzB,YAAY;AAAA,UACZ,UAAU,EAAE,KAAK;AAAA,UACjB,UAAU,KAAK;AAAA,UACf,gBAAgB;AAAA,UAChB,UAAU,KAAK,YAAY;AAAA,UAC3B,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,GAAG,gBAAgB;AAAA,MACvB,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,KAAK,IAAI,WAAW,KAAK;AAAA,MACtC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;AAEA,MAAM,oBAAmE;AAAA,EACvE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AAC/D,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvI,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACvE,UAAM,OAAO,MAAM,qBAAqB,IAAI,OAAO,EAAE;AACrD,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,UAAU,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AAAA,IAC5D,CAAC;AACD,WAAO,EAAE,QAAQ,qBAAqB,UAAU,MAAM,MAAM,EAAE;AAAA,EAChE;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AACvE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACtI,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACtE,QAAI,OAAO,SAAS,QAAW;AAC7B,YAAM,WAAW,OAAO;AACxB,UAAI,aAAa,QAAQ,KAAM,uBAAsB,QAAQ;AAC7D,UAAI,aAAa,QAAQ,MAAM;AAC7B,cAAM,cAAc,MAAM,GAAG,MAAM,UAAU,EAAE,MAAM,SAAS,WAAW,KAAK,CAAC;AAC/E,YAAI,cAAc,GAAG;AACnB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uDAAuD,CAAC;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AACA,UAAM,oBAAoB,OAAO,aAAa,UAAa,OAAO,aAAa,QAAQ;AACvF,QAAI,mBAAmB;AACrB,YAAM,cAAc,MAAM,GAAG,MAAM,UAAU,EAAE,MAAM,SAAS,WAAW,KAAK,CAAC;AAC/E,UAAI,cAAc,GAAG;AACnB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,kEAAkE,CAAC;AAAA,MAC3G;AACA,YAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,GAAsB,CAAC;AAAA,IACvE;AACA,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,OAAO,MAAM,GAAG,gBAAgB;AAAA,MACpC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,MACxC,OAAO,CAAC,WAAW;AACjB,YAAI,OAAO,SAAS,OAAW,QAAO,OAAO,OAAO;AACpD,YAAI,OAAO,aAAa,OAAW,QAAO,WAAW,OAAO;AAAA,MAC9D;AAAA,IACF,CAAC;AACD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAEnE,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,KAAK,EAAE;AAAA,MACxB,gBAAgB;AAAA,MAChB,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,QAAQ;AAAA,IACV,CAAC;AAED,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO,KAAK,EAAE;AAAA,QAClB,gBAAgB;AAAA,QAChB,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MACpD;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACxD,CAAC;AACD,WAAO,cAAc,QAAQ,MAAM;AAAA,EACrC;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,WAAW,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,kBAAkB,UAAU;AAClC,UAAM,SAAS,iBAAiB;AAChC,UAAM,aAAa,iBAAiB,QAAQ;AAC5C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,YAAY,MAAM,qBAAqB,IAAI,OAAO,OAAO,EAAE,CAAC;AAClE,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,OAAO,EAAE;AAAA,MAC1B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,IACxD,CAAC;AACD,UAAM,iBAAiB,qBAAqB,QAAQ,WAAW,MAAM;AACrE,UAAM,QAAQ,eAAe;AAC7B,UAAM,UAAU,aAAa,UAAU,MAAM,OAAkC,CAAC,QAAQ,UAAU,CAAC;AACnG,UAAM,aAAa,uBAAuB,QAAQ,QAAQ,MAAM;AAChE,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,UAAU,GAAG;AACpD,cAAQ,MAAM,GAAG,EAAE,IAAI;AAAA,IACzB;AACA,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD;AAAA,MACA,gBAAgB,UAAU;AAAA,MAC1B,eAAe;AAAA,MACf,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ;AAAA,UACR,OAAO,eAAe;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,OAAO,mBAAoC,QAAQ;AACzD,UAAM,SAAS,MAAM;AACrB,UAAM,QAAQ,MAAM;AACpB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,UAAU,MAAM,GAAG,gBAAgB;AAAA,MACvC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,MACxC,OAAO,CAAC,WAAW;AACjB,eAAO,OAAO,OAAO;AACrB,eAAO,WAAW,OAAO;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,QAAI,SAAS;AACX,YAAM,gBAAgB,IAAI,OAAO,IAAI,OAAO,IAAI;AAAA,IAClD;AACA,UAAM,QAAQ,yBAAyB,OAAO,QAAQ,OAAO,MAAM;AACnE,QAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU,EAAE,KAAK;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,gBAAgB;AAAA,QAChB,UAAU,OAAO;AAAA,QACjB,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,MAAM,oBAA+G;AAAA,EACnH,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC5H,QAAI,CAAC,SAAU,QAAO,CAAC;AACvB,UAAM,OAAO,MAAM,qBAAqB,IAAI,EAAE;AAC9C,UAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,MAC/C,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU;AAAA,MACV,UAAU,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AAAA,IAC5D,CAAC;AACD,WAAO,EAAE,QAAQ,qBAAqB,UAAU,MAAM,MAAM,EAAE;AAAA,EAChE;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,OAAO,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACxH,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACnE,UAAM,oBAAoB,MAAM,GAAG,MAAM,UAAU,EAAE,MAAM,WAAW,KAAK,CAAC;AAC5E,QAAI,oBAAoB,EAAG,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,0BAA0B,CAAC;AAE5F,UAAM,GAAG,aAAa,SAAS,EAAE,MAAM,GAAG,CAAC;AAE3C,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,UAAU,MAAM,GAAG,gBAAgB;AAAA,MACvC,QAAQ;AAAA,MACR,OAAO,EAAE,IAAI,WAAW,KAAK;AAAA,MAC7B,MAAM;AAAA,IACR,CAAC;AACD,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAEtE,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX;AAAA,QACA,gBAAgB;AAAA,QAChB,UAAU,QAAQ,WAAW,OAAO,QAAQ,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,MAAM,MAAM;AACxC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,kBAAkB,UAAU;AAClC,UAAM,SAAS,iBAAiB;AAChC,UAAM,aAAa,iBAAiB,QAAQ;AAC5C,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,UAAU,QAAQ,YAAY;AAAA,MAC9B,gBAAgB,UAAU;AAAA,MAC1B,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,SAAS,mBAAoC,QAAQ,GAAG;AAC9D,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,QAAI,OAAO,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAChH,QAAI,MAAM;AACR,WAAK,YAAY;AACjB,WAAK,OAAO,OAAO;AACnB,WAAK,WAAW,OAAO;AACvB,YAAM,GAAG,MAAM;AAAA,IACjB,OAAO;AACL,aAAO,MAAM,GAAG,gBAAgB;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM;AAAA,UACJ,IAAI,OAAO;AAAA,UACX,MAAM,OAAO;AAAA,UACb,UAAU,OAAO;AAAA,QACnB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,gBAAgB,IAAI,OAAO,IAAI,OAAO,IAAI;AAChD,UAAM,QAAQ,yBAAyB,OAAO,QAAQ,MAAS;AAC/D,QAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU,EAAE,KAAK;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,gBAAgB;AAAA,QAChB,UAAU,OAAO,YAAY;AAAA,QAC7B,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AAEjC,SAAS,cAAc,MAAY,QAAyD;AAC1F,QAAM,UAA0B;AAAA,IAC9B,MAAM,OAAO,KAAK,QAAQ,EAAE;AAAA,IAC5B,UAAU,OAAO,KAAK,QAAQ;AAAA,EAChC;AACA,MAAI,UAAU,OAAO,KAAK,MAAM,EAAE,OAAQ,SAAQ,SAAS;AAC3D,SAAO;AACT;AAEA,SAAS,qBACP,MACA,OAA0B,CAAC,GAC3B,QACe;AACf,SAAO;AAAA,IACL,MAAM,cAAc,MAAM,MAAM;AAAA,IAChC,MAAM;AAAA,MACJ,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,MAAM,OAAO,KAAK,QAAQ,EAAE;AAAA,MAC5B,UAAU,OAAO,KAAK,QAAQ;AAAA,MAC9B;AAAA,MACA,GAAI,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3D;AAAA,EACF;AACF;AAEA,eAAe,qBAAqB,IAAmB,QAA4C;AACjG,QAAM,UAAU,MAAM,mBAAmB,IAAI,SAAS,EAAE,MAAM,OAA0B,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvI,SAAO,QAAQ,IAAI,CAAC,WAAW;AAAA,IAC7B,IAAI,MAAM,KAAK,OAAO,MAAM,EAAE,IAAI;AAAA,IAClC,UAAU,OAAO,MAAM,QAAQ;AAAA,IAC/B,UAAU,MAAM,QAAQ,MAAM,YAAY,IAAI,CAAC,GAAG,MAAM,YAAY,IAAI;AAAA,IACxE,cAAc,QAAQ,MAAM,YAAY;AAAA,IACxC,eAAe,MAAM,QAAQ,MAAM,iBAAiB,IAAI,CAAC,GAAG,MAAM,iBAAiB,IAAI;AAAA,EACzF,EAAE;AACJ;AAEA,eAAe,gBAAgB,IAAmB,QAAgB,MAAyB;AACzF,QAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAA0B,CAAC;AAClE,MAAI,CAAC,KAAK,QAAQ;AAChB,UAAM,GAAG,MAAM;AACf;AAAA,EACF;AACA,QAAM,UAAU,GAAG,aAAa,MAAM,MAAM;AAC5C,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,GAAG,OAAO,SAAS;AAAA,MAChC,IAAI,IAAI,MAAM;AAAA,MACd,MAAM;AAAA,MACN,UAAU,IAAI;AAAA,MACd,cAAc,IAAI,YAAY;AAAA,MAC9B,cAAc,IAAI;AAAA,MAClB,mBAAmB,IAAI,iBAAiB;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB;AACA,QAAM,GAAG,MAAM;AACjB;",
   "names": []
 }

package/dist/modules/auth/commands/users.js

@@ -218,6 +218,7 @@ const createUserCommand = {
       resourceKind: "auth.user",
       resourceId: String(user.id),
       tenantId: user.tenantId ? String(user.tenantId) : null,
+      organizationId: user.organizationId ? String(user.organizationId) : null,
       snapshotAfter: snapshot.view,
       payload: {
         undo: {
@@ -464,6 +465,7 @@ const updateUserCommand = {
       resourceKind: "auth.user",
       resourceId: String(result.id),
       tenantId: result.tenantId ? String(result.tenantId) : null,
+      organizationId: result.organizationId ? String(result.organizationId) : null,
       changes,
       snapshotBefore: before ?? null,
       snapshotAfter: after,
@@ -584,6 +586,7 @@ const deleteUserCommand = {
       resourceId: id,
       snapshotBefore: before ?? null,
       tenantId: before?.tenantId ?? null,
+      organizationId: before?.organizationId ?? null,
       payload: {
         undo: {
           before: beforeUndo