@open-mercato/core 0.6.3-develop.3562.1.71049275ff → 0.6.3-develop.3574.1.f3c5dcf345

package/dist/modules/workflows/lib/event-trigger-service.js

@@ -1,4 +1,6 @@
 import { matchEventPattern } from "@open-mercato/shared/lib/events/patterns";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { testLinearRegex } from "@open-mercato/shared/lib/regex/linear";
 import {
   WorkflowEventTrigger,
   WorkflowDefinition,
@@ -140,11 +142,12 @@ function evaluateCondition(condition, payload) {
       if (typeof value !== "string" || typeof expected !== "string") return false;
       if (value.length > MAX_WORKFLOW_REGEX_INPUT_LENGTH) return false;
       if (!isSafeWorkflowRegexPattern(expected)) return false;
-      try {
-        const regex = new RegExp(expected);
-        return regex.test(value);
-      } catch {
-        return false;
+      {
+        const result = testLinearRegex(expected, value, {
+          maxPatternLength: MAX_WORKFLOW_REGEX_PATTERN_LENGTH,
+          maxInputLength: MAX_WORKFLOW_REGEX_INPUT_LENGTH
+        });
+        return result.ok ? result.matched : false;
       }
     default:
       return false;
@@ -168,7 +171,9 @@ function getCacheKey(tenantId, organizationId) {
   return `${tenantId}:${organizationId}`;
 }
 async function loadLegacyTriggers(em, tenantId, organizationId) {
-  const legacyTriggers = await em.find(
+  const postgresEm = em;
+  const legacyTriggers = await findWithDecryption(
+    postgresEm,
     WorkflowEventTrigger,
     {
       tenantId,
@@ -178,14 +183,17 @@ async function loadLegacyTriggers(em, tenantId, organizationId) {
     },
     {
       orderBy: { priority: "DESC", createdAt: "ASC" }
-    }
+    },
+    { tenantId, organizationId }
   );
   const definitionIds = [...new Set(legacyTriggers.map((t) => t.workflowDefinitionId))];
-  const definitions = definitionIds.length > 0 ? await em.find(WorkflowDefinition, {
+  const definitions = definitionIds.length > 0 ? await findWithDecryption(postgresEm, WorkflowDefinition, {
     id: { $in: definitionIds },
+    tenantId,
+    organizationId,
     enabled: true,
     deletedAt: null
-  }) : [];
+  }, {}, { tenantId, organizationId }) : [];
   const definitionMap = new Map(definitions.map((d) => [d.id, d]));
   return legacyTriggers.filter((t) => definitionMap.has(t.workflowDefinitionId)).map((t) => {
     const def = definitionMap.get(t.workflowDefinitionId);
@@ -208,14 +216,18 @@ async function loadLegacyTriggers(em, tenantId, organizationId) {
   });
 }
 async function loadEmbeddedTriggers(em, tenantId, organizationId) {
-  const definitions = await em.find(
+  const postgresEm = em;
+  const definitions = await findWithDecryption(
+    postgresEm,
     WorkflowDefinition,
     {
       tenantId,
       organizationId,
       enabled: true,
       deletedAt: null
-    }
+    },
+    {},
+    { tenantId, organizationId }
   );
   const triggers = [];
   for (const def of definitions) {

package/dist/modules/workflows/lib/event-trigger-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/workflows/lib/event-trigger-service.ts"],
-  "sourcesContent": ["/**\n * Workflows Module - Event Trigger Service\n *\n * Core service for evaluating and processing workflow event triggers.\n * Handles pattern matching, filter evaluation, context mapping, and workflow starting.\n */\n\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { AwilixContainer } from 'awilix'\nimport type { CacheService } from '@open-mercato/cache'\nimport { matchEventPattern } from '@open-mercato/shared/lib/events/patterns'\nimport {\n  WorkflowEventTrigger,\n  WorkflowDefinition,\n  WorkflowInstance,\n  type TriggerFilterCondition,\n  type TriggerContextMapping,\n  type WorkflowEventTriggerConfig,\n  type WorkflowDefinitionTrigger,\n} from '../data/entities'\nimport { startWorkflow, executeWorkflow } from './workflow-executor'\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface EventTriggerContext {\n  eventName: string\n  payload: Record<string, unknown>\n  tenantId: string\n  organizationId: string\n}\n\nexport interface ProcessTriggersResult {\n  triggered: number\n  skipped: number\n  errors: Array<{ triggerId: string; error: string }>\n  instances: Array<{ triggerId: string; instanceId: string }>\n}\n\n/**\n * Unified trigger interface for both legacy (entity) and embedded (definition) triggers\n */\nexport interface UnifiedTrigger {\n  id: string  // For legacy: entity ID, for embedded: `${definitionId}:${triggerId}`\n  triggerId: string\n  name: string\n  description?: string | null\n  eventPattern: string\n  config: WorkflowEventTriggerConfig | null\n  enabled: boolean\n  priority: number\n  workflowDefinitionId: string\n  workflowId: string\n  workflowVersion: number\n  source: 'legacy' | 'embedded'\n  tenantId: string\n  organizationId: string\n}\n\ninterface CachedTriggers {\n  triggers: UnifiedTrigger[]\n  cachedAt: number\n}\n\n// Cache TTL: 5 minutes\nconst TRIGGER_CACHE_TTL = 5 * 60 * 1000\n\n// ============================================================================\n// Pattern Matching\n// ============================================================================\n\n// ============================================================================\n// Filter Evaluation\n// ============================================================================\n\nconst MAX_WORKFLOW_REGEX_PATTERN_LENGTH = 200\nconst MAX_WORKFLOW_REGEX_INPUT_LENGTH = 10_000\n\n/**\n * Get a nested value from an object using dot notation.\n */\nfunction getNestedValue(obj: unknown, path: string): unknown {\n  if (obj === null || obj === undefined) return undefined\n\n  const parts = path.split('.')\n  let current: unknown = obj\n\n  for (const part of parts) {\n    if (current === null || current === undefined) return undefined\n    if (typeof current !== 'object') return undefined\n    current = (current as Record<string, unknown>)[part]\n  }\n\n  return current\n}\n\nfunction getQuantifierEnd(pattern: string, index: number): number | null {\n  const char = pattern[index]\n  if (char === '*' || char === '+' || char === '?') return index\n  if (char !== '{') return null\n\n  const closeIndex = pattern.indexOf('}', index + 1)\n  if (closeIndex === -1) return null\n\n  const body = pattern.slice(index + 1, closeIndex)\n  return /^[0-9]+(?:,[0-9]*)?$/.test(body) ? closeIndex : null\n}\n\ninterface RegexGroupFrame {\n  hasAlternation: boolean\n  hasQuantifier: boolean\n}\n\nfunction isSafeWorkflowRegexPattern(pattern: string): boolean {\n  if (pattern.length > MAX_WORKFLOW_REGEX_PATTERN_LENGTH) return false\n\n  const groupStack: RegexGroupFrame[] = [{ hasAlternation: false, hasQuantifier: false }]\n  let inCharClass = false\n  let lastClosedGroup: RegexGroupFrame | null = null\n  let lastAtomWasQuantified = false\n\n  for (let index = 0; index < pattern.length; index += 1) {\n    const char = pattern[index]\n\n    if (char === '\\\\') {\n      const next = pattern[index + 1]\n      if (!inCharClass && (/[1-9]/.test(next ?? '') || (next === 'k' && pattern[index + 2] === '<'))) {\n        return false\n      }\n      index += 1\n      lastClosedGroup = null\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    if (inCharClass) {\n      if (char === ']') {\n        inCharClass = false\n        lastAtomWasQuantified = false\n      }\n      lastClosedGroup = null\n      continue\n    }\n\n    if (char === '[') {\n      inCharClass = true\n      lastClosedGroup = null\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    if (char === '(') {\n      if (pattern[index + 1] === '?') {\n        if (pattern[index + 2] !== ':') return false\n        index += 2\n      }\n\n      groupStack.push({ hasAlternation: false, hasQuantifier: false })\n      lastClosedGroup = null\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    if (char === ')') {\n      if (groupStack.length === 1) return false\n      lastClosedGroup = groupStack.pop()!\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    if (char === '|') {\n      groupStack[groupStack.length - 1].hasAlternation = true\n      lastClosedGroup = null\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    const quantifierEnd = getQuantifierEnd(pattern, index)\n    if (quantifierEnd !== null) {\n      if (lastAtomWasQuantified) return false\n      if (lastClosedGroup?.hasAlternation || lastClosedGroup?.hasQuantifier) return false\n\n      groupStack[groupStack.length - 1].hasQuantifier = true\n      lastClosedGroup = null\n      lastAtomWasQuantified = true\n      index = quantifierEnd\n\n      if (pattern[index + 1] === '?') {\n        index += 1\n      }\n\n      continue\n    }\n\n    lastClosedGroup = null\n    lastAtomWasQuantified = false\n  }\n\n  return groupStack.length === 1 && !inCharClass\n}\n\n/**\n * Evaluate a single filter condition against the event payload.\n */\nfunction evaluateCondition(condition: TriggerFilterCondition, payload: Record<string, unknown>): boolean {\n  const value = getNestedValue(payload, condition.field)\n  const expected = condition.value\n\n  switch (condition.operator) {\n    case 'eq':\n      return value === expected\n\n    case 'neq':\n      return value !== expected\n\n    case 'gt':\n      return typeof value === 'number' && typeof expected === 'number' && value > expected\n\n    case 'gte':\n      return typeof value === 'number' && typeof expected === 'number' && value >= expected\n\n    case 'lt':\n      return typeof value === 'number' && typeof expected === 'number' && value < expected\n\n    case 'lte':\n      return typeof value === 'number' && typeof expected === 'number' && value <= expected\n\n    case 'contains':\n      if (typeof value === 'string' && typeof expected === 'string') {\n        return value.includes(expected)\n      }\n      if (Array.isArray(value)) {\n        return value.includes(expected)\n      }\n      return false\n\n    case 'startsWith':\n      return typeof value === 'string' && typeof expected === 'string' && value.startsWith(expected)\n\n    case 'endsWith':\n      return typeof value === 'string' && typeof expected === 'string' && value.endsWith(expected)\n\n    case 'in':\n      return Array.isArray(expected) && expected.includes(value)\n\n    case 'notIn':\n      return Array.isArray(expected) && !expected.includes(value)\n\n    case 'exists':\n      return value !== undefined && value !== null\n\n    case 'notExists':\n      return value === undefined || value === null\n\n    case 'regex':\n      if (typeof value !== 'string' || typeof expected !== 'string') return false\n      if (value.length > MAX_WORKFLOW_REGEX_INPUT_LENGTH) return false\n      if (!isSafeWorkflowRegexPattern(expected)) return false\n      try {\n        const regex = new RegExp(expected)\n        return regex.test(value)\n      } catch {\n        return false\n      }\n\n    default:\n      return false\n  }\n}\n\n/**\n * Evaluate all filter conditions against the event payload.\n * All conditions must pass (AND logic).\n */\nexport function evaluateFilterConditions(\n  conditions: TriggerFilterCondition[] | undefined,\n  payload: Record<string, unknown>\n): boolean {\n  if (!conditions || conditions.length === 0) return true\n\n  return conditions.every(condition => evaluateCondition(condition, payload))\n}\n\n// ============================================================================\n// Context Mapping\n// ============================================================================\n\n/**\n * Map event payload to workflow initial context.\n */\nexport function mapEventToContext(\n  mapping: TriggerContextMapping[] | undefined,\n  payload: Record<string, unknown>\n): Record<string, unknown> {\n  const context: Record<string, unknown> = {}\n\n  if (!mapping || mapping.length === 0) return context\n\n  for (const item of mapping) {\n    const value = getNestedValue(payload, item.sourceExpression)\n    context[item.targetKey] = value !== undefined ? value : item.defaultValue\n  }\n\n  return context\n}\n\n// ============================================================================\n// Trigger Loading with Caching\n// ============================================================================\n\n// In-memory cache for triggers (per tenant/org)\nconst triggerCache = new Map<string, CachedTriggers>()\n\nfunction getCacheKey(tenantId: string, organizationId: string): string {\n  return `${tenantId}:${organizationId}`\n}\n\n/**\n * Load legacy triggers from WorkflowEventTrigger entity table.\n * For backward compatibility with existing triggers.\n */\nasync function loadLegacyTriggers(\n  em: EntityManager,\n  tenantId: string,\n  organizationId: string\n): Promise<UnifiedTrigger[]> {\n  const legacyTriggers = await em.find(\n    WorkflowEventTrigger,\n    {\n      tenantId,\n      organizationId,\n      enabled: true,\n      deletedAt: null,\n    },\n    {\n      orderBy: { priority: 'DESC', createdAt: 'ASC' },\n    }\n  )\n\n  // Get definitions for these triggers to get workflowId\n  const definitionIds = [...new Set(legacyTriggers.map(t => t.workflowDefinitionId))]\n  const definitions = definitionIds.length > 0 ? await em.find(WorkflowDefinition, {\n    id: { $in: definitionIds },\n    enabled: true,\n    deletedAt: null,\n  }) : []\n  const definitionMap = new Map(definitions.map(d => [d.id, d]))\n\n  return legacyTriggers\n    .filter(t => definitionMap.has(t.workflowDefinitionId))\n    .map(t => {\n      const def = definitionMap.get(t.workflowDefinitionId)!\n      return {\n        id: t.id,\n        triggerId: t.id,\n        name: t.name,\n        description: t.description,\n        eventPattern: t.eventPattern,\n        config: t.config ?? null,\n        enabled: t.enabled,\n        priority: t.priority,\n        workflowDefinitionId: t.workflowDefinitionId,\n        workflowId: def.workflowId,\n        workflowVersion: def.version,\n        source: 'legacy' as const,\n        tenantId: t.tenantId,\n        organizationId: t.organizationId,\n      }\n    })\n}\n\n/**\n * Load embedded triggers from workflow definitions.\n * New triggers are embedded directly in the definition JSONB.\n */\nasync function loadEmbeddedTriggers(\n  em: EntityManager,\n  tenantId: string,\n  organizationId: string\n): Promise<UnifiedTrigger[]> {\n  // Load all enabled definitions that may have triggers\n  const definitions = await em.find(\n    WorkflowDefinition,\n    {\n      tenantId,\n      organizationId,\n      enabled: true,\n      deletedAt: null,\n    }\n  )\n\n  const triggers: UnifiedTrigger[] = []\n\n  for (const def of definitions) {\n    const embeddedTriggers = def.definition?.triggers as WorkflowDefinitionTrigger[] | undefined\n    if (!embeddedTriggers || embeddedTriggers.length === 0) continue\n\n    for (const trigger of embeddedTriggers) {\n      if (!trigger.enabled) continue\n\n      triggers.push({\n        id: `${def.id}:${trigger.triggerId}`,\n        triggerId: trigger.triggerId,\n        name: trigger.name,\n        description: trigger.description ?? null,\n        eventPattern: trigger.eventPattern,\n        config: trigger.config ?? null,\n        enabled: trigger.enabled,\n        priority: trigger.priority,\n        workflowDefinitionId: def.id,\n        workflowId: def.workflowId,\n        workflowVersion: def.version,\n        source: 'embedded' as const,\n        tenantId,\n        organizationId,\n      })\n    }\n  }\n\n  return triggers\n}\n\n/**\n * Load all enabled triggers for a tenant/organization with caching.\n * Merges both legacy (entity) triggers and embedded (definition) triggers.\n */\nexport async function loadTriggersForTenant(\n  em: EntityManager,\n  tenantId: string,\n  organizationId: string,\n  cacheService?: CacheService\n): Promise<UnifiedTrigger[]> {\n  const cacheKey = getCacheKey(tenantId, organizationId)\n\n  // Check in-memory cache\n  const cached = triggerCache.get(cacheKey)\n  if (cached && Date.now() - cached.cachedAt < TRIGGER_CACHE_TTL) {\n    return cached.triggers\n  }\n\n  // Load from both sources\n  const [legacyTriggers, embeddedTriggers] = await Promise.all([\n    loadLegacyTriggers(em, tenantId, organizationId),\n    loadEmbeddedTriggers(em, tenantId, organizationId),\n  ])\n\n  // Merge and sort by priority (higher first)\n  const allTriggers = [...legacyTriggers, ...embeddedTriggers]\n    .sort((a, b) => b.priority - a.priority)\n\n  // Update cache\n  triggerCache.set(cacheKey, {\n    triggers: allTriggers,\n    cachedAt: Date.now(),\n  })\n\n  return allTriggers\n}\n\n/**\n * Invalidate trigger cache for a tenant/organization.\n * Call this when:\n * - Legacy triggers are created/updated/deleted\n * - Workflow definitions with embedded triggers are created/updated/deleted\n */\nexport function invalidateTriggerCache(tenantId: string, organizationId?: string): void {\n  if (organizationId) {\n    // Invalidate specific org\n    const cacheKey = getCacheKey(tenantId, organizationId)\n    triggerCache.delete(cacheKey)\n  } else {\n    // Invalidate all orgs for tenant\n    for (const key of triggerCache.keys()) {\n      if (key.startsWith(`${tenantId}:`)) {\n        triggerCache.delete(key)\n      }\n    }\n  }\n}\n\n// ============================================================================\n// Trigger Matching\n// ============================================================================\n\n/**\n * Find all triggers that match an event.\n */\nexport async function findMatchingTriggers(\n  em: EntityManager,\n  context: EventTriggerContext\n): Promise<UnifiedTrigger[]> {\n  const triggers = await loadTriggersForTenant(\n    em,\n    context.tenantId,\n    context.organizationId\n  )\n\n  return triggers.filter(trigger => {\n    // Check event pattern\n    if (!matchEventPattern(context.eventName, trigger.eventPattern)) {\n      return false\n    }\n\n    // Check filter conditions\n    if (!evaluateFilterConditions(trigger.config?.filterConditions, context.payload)) {\n      return false\n    }\n\n    return true\n  })\n}\n\n// ============================================================================\n// Trigger Processing\n// ============================================================================\n\n/**\n * Check if max concurrent instances limit is reached.\n */\nasync function checkConcurrencyLimit(\n  em: EntityManager,\n  trigger: UnifiedTrigger\n): Promise<boolean> {\n  const maxInstances = trigger.config?.maxConcurrentInstances\n\n  if (!maxInstances) return true // No limit\n\n  // Count running instances for this trigger's workflow definition\n  const runningCount = await em.count(WorkflowInstance, {\n    definitionId: trigger.workflowDefinitionId,\n    status: { $in: ['RUNNING', 'WAITING_FOR_ACTIVITIES'] },\n    tenantId: trigger.tenantId,\n    organizationId: trigger.organizationId,\n    deletedAt: null,\n  })\n\n  return runningCount < maxInstances\n}\n\n/**\n * Process all matching triggers for an event and start workflows.\n */\nexport async function processEventTriggers(\n  em: EntityManager,\n  container: AwilixContainer,\n  context: EventTriggerContext\n): Promise<ProcessTriggersResult> {\n  const result: ProcessTriggersResult = {\n    triggered: 0,\n    skipped: 0,\n    errors: [],\n    instances: [],\n  }\n\n  // Find matching triggers\n  const triggers = await findMatchingTriggers(em, context)\n\n  if (triggers.length === 0) {\n    return result\n  }\n\n  // Process each trigger (definitions already validated during loading)\n  for (const trigger of triggers) {\n    try {\n      // Check concurrency limit\n      const canStart = await checkConcurrencyLimit(em, trigger)\n      if (!canStart) {\n        console.log(`[workflow-trigger] Skipping trigger \"${trigger.name}\": max concurrent instances reached`)\n        result.skipped++\n        continue\n      }\n\n      // Map event payload to workflow context\n      const mappedContext = mapEventToContext(trigger.config?.contextMapping, context.payload)\n\n      // Extract entity info from payload for metadata\n      const payloadId = context.payload?.id as string | undefined\n      const payloadEntityType = context.payload?.entityType as string | undefined\n\n      // Include event metadata and payload in context\n      const initialContext = {\n        // Include raw event payload fields (e.g., id, organizationId, tenantId)\n        ...context.payload,\n        // Override with explicit mappings if provided\n        ...mappedContext,\n        __trigger: {\n          triggerId: trigger.id,\n          triggerName: trigger.name,\n          eventName: context.eventName,\n          eventPayload: context.payload,\n          triggeredAt: new Date().toISOString(),\n          source: trigger.source,\n        },\n      }\n\n      // Start workflow\n      const instance = await startWorkflow(em, {\n        workflowId: trigger.workflowId,\n        version: trigger.workflowVersion,\n        initialContext,\n        metadata: {\n          initiatedBy: `trigger:${trigger.id}`,\n          // Include entityId and entityType for widget discovery\n          entityId: payloadId,\n          entityType: payloadEntityType || trigger.config?.entityType,\n          labels: {\n            trigger_id: trigger.id,\n            trigger_name: trigger.name,\n            event_name: context.eventName,\n            trigger_source: trigger.source,\n          },\n        },\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n      })\n\n      result.triggered++\n      result.instances.push({\n        triggerId: trigger.id,\n        instanceId: instance.id,\n      })\n\n      // Execute workflow asynchronously (don't wait)\n      executeWorkflow(em.fork(), container, instance.id).catch(err => {\n        console.error(`[workflow-trigger] Error executing workflow ${instance.id}:`, err)\n      })\n\n    } catch (error) {\n      const errorMessage = error instanceof Error ? error.message : String(error)\n      console.error(`[workflow-trigger] Error processing trigger \"${trigger.name}\":`, error)\n      result.errors.push({\n        triggerId: trigger.id,\n        error: errorMessage,\n      })\n    }\n  }\n\n  return result\n}\n"],
-  "mappings": "AAUA,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,eAAe,uBAAuB;AA8C/C,MAAM,oBAAoB,IAAI,KAAK;AAUnC,MAAM,oCAAoC;AAC1C,MAAM,kCAAkC;AAKxC,SAAS,eAAe,KAAc,MAAuB;AAC3D,MAAI,QAAQ,QAAQ,QAAQ,OAAW,QAAO;AAE9C,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,UAAmB;AAEvB,aAAW,QAAQ,OAAO;AACxB,QAAI,YAAY,QAAQ,YAAY,OAAW,QAAO;AACtD,QAAI,OAAO,YAAY,SAAU,QAAO;AACxC,cAAW,QAAoC,IAAI;AAAA,EACrD;AAEA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAiB,OAA8B;AACvE,QAAM,OAAO,QAAQ,KAAK;AAC1B,MAAI,SAAS,OAAO,SAAS,OAAO,SAAS,IAAK,QAAO;AACzD,MAAI,SAAS,IAAK,QAAO;AAEzB,QAAM,aAAa,QAAQ,QAAQ,KAAK,QAAQ,CAAC;AACjD,MAAI,eAAe,GAAI,QAAO;AAE9B,QAAM,OAAO,QAAQ,MAAM,QAAQ,GAAG,UAAU;AAChD,SAAO,uBAAuB,KAAK,IAAI,IAAI,aAAa;AAC1D;AAOA,SAAS,2BAA2B,SAA0B;AAC5D,MAAI,QAAQ,SAAS,kCAAmC,QAAO;AAE/D,QAAM,aAAgC,CAAC,EAAE,gBAAgB,OAAO,eAAe,MAAM,CAAC;AACtF,MAAI,cAAc;AAClB,MAAI,kBAA0C;AAC9C,MAAI,wBAAwB;AAE5B,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;AACtD,UAAM,OAAO,QAAQ,KAAK;AAE1B,QAAI,SAAS,MAAM;AACjB,YAAM,OAAO,QAAQ,QAAQ,CAAC;AAC9B,UAAI,CAAC,gBAAgB,QAAQ,KAAK,QAAQ,EAAE,KAAM,SAAS,OAAO,QAAQ,QAAQ,CAAC,MAAM,MAAO;AAC9F,eAAO;AAAA,MACT;AACA,eAAS;AACT,wBAAkB;AAClB,8BAAwB;AACxB;AAAA,IACF;AAEA,QAAI,aAAa;AACf,UAAI,SAAS,KAAK;AAChB,sBAAc;AACd,gCAAwB;AAAA,MAC1B;AACA,wBAAkB;AAClB;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB,oBAAc;AACd,wBAAkB;AAClB,8BAAwB;AACxB;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB,UAAI,QAAQ,QAAQ,CAAC,MAAM,KAAK;AAC9B,YAAI,QAAQ,QAAQ,CAAC,MAAM,IAAK,QAAO;AACvC,iBAAS;AAAA,MACX;AAEA,iBAAW,KAAK,EAAE,gBAAgB,OAAO,eAAe,MAAM,CAAC;AAC/D,wBAAkB;AAClB,8BAAwB;AACxB;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB,UAAI,WAAW,WAAW,EAAG,QAAO;AACpC,wBAAkB,WAAW,IAAI;AACjC,8BAAwB;AACxB;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB,iBAAW,WAAW,SAAS,CAAC,EAAE,iBAAiB;AACnD,wBAAkB;AAClB,8BAAwB;AACxB;AAAA,IACF;AAEA,UAAM,gBAAgB,iBAAiB,SAAS,KAAK;AACrD,QAAI,kBAAkB,MAAM;AAC1B,UAAI,sBAAuB,QAAO;AAClC,UAAI,iBAAiB,kBAAkB,iBAAiB,cAAe,QAAO;AAE9E,iBAAW,WAAW,SAAS,CAAC,EAAE,gBAAgB;AAClD,wBAAkB;AAClB,8BAAwB;AACxB,cAAQ;AAER,UAAI,QAAQ,QAAQ,CAAC,MAAM,KAAK;AAC9B,iBAAS;AAAA,MACX;AAEA;AAAA,IACF;AAEA,sBAAkB;AAClB,4BAAwB;AAAA,EAC1B;AAEA,SAAO,WAAW,WAAW,KAAK,CAAC;AACrC;AAKA,SAAS,kBAAkB,WAAmC,SAA2C;AACvG,QAAM,QAAQ,eAAe,SAAS,UAAU,KAAK;AACrD,QAAM,WAAW,UAAU;AAE3B,UAAQ,UAAU,UAAU;AAAA,IAC1B,KAAK;AACH,aAAO,UAAU;AAAA,IAEnB,KAAK;AACH,aAAO,UAAU;AAAA,IAEnB,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,QAAQ;AAAA,IAE9E,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,SAAS;AAAA,IAE/E,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,QAAQ;AAAA,IAE9E,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,SAAS;AAAA,IAE/E,KAAK;AACH,UAAI,OAAO,UAAU,YAAY,OAAO,aAAa,UAAU;AAC7D,eAAO,MAAM,SAAS,QAAQ;AAAA,MAChC;AACA,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,MAAM,SAAS,QAAQ;AAAA,MAChC;AACA,aAAO;AAAA,IAET,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,MAAM,WAAW,QAAQ;AAAA,IAE/F,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,MAAM,SAAS,QAAQ;AAAA,IAE7F,KAAK;AACH,aAAO,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,KAAK;AAAA,IAE3D,KAAK;AACH,aAAO,MAAM,QAAQ,QAAQ,KAAK,CAAC,SAAS,SAAS,KAAK;AAAA,IAE5D,KAAK;AACH,aAAO,UAAU,UAAa,UAAU;AAAA,IAE1C,KAAK;AACH,aAAO,UAAU,UAAa,UAAU;AAAA,IAE1C,KAAK;AACH,UAAI,OAAO,UAAU,YAAY,OAAO,aAAa,SAAU,QAAO;AACtE,UAAI,MAAM,SAAS,gCAAiC,QAAO;AAC3D,UAAI,CAAC,2BAA2B,QAAQ,EAAG,QAAO;AAClD,UAAI;AACF,cAAM,QAAQ,IAAI,OAAO,QAAQ;AACjC,eAAO,MAAM,KAAK,KAAK;AAAA,MACzB,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IAEF;AACE,aAAO;AAAA,EACX;AACF;AAMO,SAAS,yBACd,YACA,SACS;AACT,MAAI,CAAC,cAAc,WAAW,WAAW,EAAG,QAAO;AAEnD,SAAO,WAAW,MAAM,eAAa,kBAAkB,WAAW,OAAO,CAAC;AAC5E;AASO,SAAS,kBACd,SACA,SACyB;AACzB,QAAM,UAAmC,CAAC;AAE1C,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,aAAW,QAAQ,SAAS;AAC1B,UAAM,QAAQ,eAAe,SAAS,KAAK,gBAAgB;AAC3D,YAAQ,KAAK,SAAS,IAAI,UAAU,SAAY,QAAQ,KAAK;AAAA,EAC/D;AAEA,SAAO;AACT;AAOA,MAAM,eAAe,oBAAI,IAA4B;AAErD,SAAS,YAAY,UAAkB,gBAAgC;AACrE,SAAO,GAAG,QAAQ,IAAI,cAAc;AACtC;AAMA,eAAe,mBACb,IACA,UACA,gBAC2B;AAC3B,QAAM,iBAAiB,MAAM,GAAG;AAAA,IAC9B;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,WAAW;AAAA,IACb;AAAA,IACA;AAAA,MACE,SAAS,EAAE,UAAU,QAAQ,WAAW,MAAM;AAAA,IAChD;AAAA,EACF;AAGA,QAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,eAAe,IAAI,OAAK,EAAE,oBAAoB,CAAC,CAAC;AAClF,QAAM,cAAc,cAAc,SAAS,IAAI,MAAM,GAAG,KAAK,oBAAoB;AAAA,IAC/E,IAAI,EAAE,KAAK,cAAc;AAAA,IACzB,SAAS;AAAA,IACT,WAAW;AAAA,EACb,CAAC,IAAI,CAAC;AACN,QAAM,gBAAgB,IAAI,IAAI,YAAY,IAAI,OAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAE7D,SAAO,eACJ,OAAO,OAAK,cAAc,IAAI,EAAE,oBAAoB,CAAC,EACrD,IAAI,OAAK;AACR,UAAM,MAAM,cAAc,IAAI,EAAE,oBAAoB;AACpD,WAAO;AAAA,MACL,IAAI,EAAE;AAAA,MACN,WAAW,EAAE;AAAA,MACb,MAAM,EAAE;AAAA,MACR,aAAa,EAAE;AAAA,MACf,cAAc,EAAE;AAAA,MAChB,QAAQ,EAAE,UAAU;AAAA,MACpB,SAAS,EAAE;AAAA,MACX,UAAU,EAAE;AAAA,MACZ,sBAAsB,EAAE;AAAA,MACxB,YAAY,IAAI;AAAA,MAChB,iBAAiB,IAAI;AAAA,MACrB,QAAQ;AAAA,MACR,UAAU,EAAE;AAAA,MACZ,gBAAgB,EAAE;AAAA,IACpB;AAAA,EACF,CAAC;AACL;AAMA,eAAe,qBACb,IACA,UACA,gBAC2B;AAE3B,QAAM,cAAc,MAAM,GAAG;AAAA,IAC3B;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,WAAW;AAAA,IACb;AAAA,EACF;AAEA,QAAM,WAA6B,CAAC;AAEpC,aAAW,OAAO,aAAa;AAC7B,UAAM,mBAAmB,IAAI,YAAY;AACzC,QAAI,CAAC,oBAAoB,iBAAiB,WAAW,EAAG;AAExD,eAAW,WAAW,kBAAkB;AACtC,UAAI,CAAC,QAAQ,QAAS;AAEtB,eAAS,KAAK;AAAA,QACZ,IAAI,GAAG,IAAI,EAAE,IAAI,QAAQ,SAAS;AAAA,QAClC,WAAW,QAAQ;AAAA,QACnB,MAAM,QAAQ;AAAA,QACd,aAAa,QAAQ,eAAe;AAAA,QACpC,cAAc,QAAQ;AAAA,QACtB,QAAQ,QAAQ,UAAU;AAAA,QAC1B,SAAS,QAAQ;AAAA,QACjB,UAAU,QAAQ;AAAA,QAClB,sBAAsB,IAAI;AAAA,QAC1B,YAAY,IAAI;AAAA,QAChB,iBAAiB,IAAI;AAAA,QACrB,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,eAAsB,sBACpB,IACA,UACA,gBACA,cAC2B;AAC3B,QAAM,WAAW,YAAY,UAAU,cAAc;AAGrD,QAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,MAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,mBAAmB;AAC9D,WAAO,OAAO;AAAA,EAChB;AAGA,QAAM,CAAC,gBAAgB,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC3D,mBAAmB,IAAI,UAAU,cAAc;AAAA,IAC/C,qBAAqB,IAAI,UAAU,cAAc;AAAA,EACnD,CAAC;AAGD,QAAM,cAAc,CAAC,GAAG,gBAAgB,GAAG,gBAAgB,EACxD,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAGzC,eAAa,IAAI,UAAU;AAAA,IACzB,UAAU;AAAA,IACV,UAAU,KAAK,IAAI;AAAA,EACrB,CAAC;AAED,SAAO;AACT;AAQO,SAAS,uBAAuB,UAAkB,gBAA+B;AACtF,MAAI,gBAAgB;AAElB,UAAM,WAAW,YAAY,UAAU,cAAc;AACrD,iBAAa,OAAO,QAAQ;AAAA,EAC9B,OAAO;AAEL,eAAW,OAAO,aAAa,KAAK,GAAG;AACrC,UAAI,IAAI,WAAW,GAAG,QAAQ,GAAG,GAAG;AAClC,qBAAa,OAAO,GAAG;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AACF;AASA,eAAsB,qBACpB,IACA,SAC2B;AAC3B,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAEA,SAAO,SAAS,OAAO,aAAW;AAEhC,QAAI,CAAC,kBAAkB,QAAQ,WAAW,QAAQ,YAAY,GAAG;AAC/D,aAAO;AAAA,IACT;AAGA,QAAI,CAAC,yBAAyB,QAAQ,QAAQ,kBAAkB,QAAQ,OAAO,GAAG;AAChF,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AASA,eAAe,sBACb,IACA,SACkB;AAClB,QAAM,eAAe,QAAQ,QAAQ;AAErC,MAAI,CAAC,aAAc,QAAO;AAG1B,QAAM,eAAe,MAAM,GAAG,MAAM,kBAAkB;AAAA,IACpD,cAAc,QAAQ;AAAA,IACtB,QAAQ,EAAE,KAAK,CAAC,WAAW,wBAAwB,EAAE;AAAA,IACrD,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,WAAW;AAAA,EACb,CAAC;AAED,SAAO,eAAe;AACxB;AAKA,eAAsB,qBACpB,IACA,WACA,SACgC;AAChC,QAAM,SAAgC;AAAA,IACpC,WAAW;AAAA,IACX,SAAS;AAAA,IACT,QAAQ,CAAC;AAAA,IACT,WAAW,CAAC;AAAA,EACd;AAGA,QAAM,WAAW,MAAM,qBAAqB,IAAI,OAAO;AAEvD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,EACT;AAGA,aAAW,WAAW,UAAU;AAC9B,QAAI;AAEF,YAAM,WAAW,MAAM,sBAAsB,IAAI,OAAO;AACxD,UAAI,CAAC,UAAU;AACb,gBAAQ,IAAI,wCAAwC,QAAQ,IAAI,qCAAqC;AACrG,eAAO;AACP;AAAA,MACF;AAGA,YAAM,gBAAgB,kBAAkB,QAAQ,QAAQ,gBAAgB,QAAQ,OAAO;AAGvF,YAAM,YAAY,QAAQ,SAAS;AACnC,YAAM,oBAAoB,QAAQ,SAAS;AAG3C,YAAM,iBAAiB;AAAA;AAAA,QAErB,GAAG,QAAQ;AAAA;AAAA,QAEX,GAAG;AAAA,QACH,WAAW;AAAA,UACT,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,WAAW,QAAQ;AAAA,UACnB,cAAc,QAAQ;AAAA,UACtB,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,UACpC,QAAQ,QAAQ;AAAA,QAClB;AAAA,MACF;AAGA,YAAM,WAAW,MAAM,cAAc,IAAI;AAAA,QACvC,YAAY,QAAQ;AAAA,QACpB,SAAS,QAAQ;AAAA,QACjB;AAAA,QACA,UAAU;AAAA,UACR,aAAa,WAAW,QAAQ,EAAE;AAAA;AAAA,UAElC,UAAU;AAAA,UACV,YAAY,qBAAqB,QAAQ,QAAQ;AAAA,UACjD,QAAQ;AAAA,YACN,YAAY,QAAQ;AAAA,YACpB,cAAc,QAAQ;AAAA,YACtB,YAAY,QAAQ;AAAA,YACpB,gBAAgB,QAAQ;AAAA,UAC1B;AAAA,QACF;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AAED,aAAO;AACP,aAAO,UAAU,KAAK;AAAA,QACpB,WAAW,QAAQ;AAAA,QACnB,YAAY,SAAS;AAAA,MACvB,CAAC;AAGD,sBAAgB,GAAG,KAAK,GAAG,WAAW,SAAS,EAAE,EAAE,MAAM,SAAO;AAC9D,gBAAQ,MAAM,+CAA+C,SAAS,EAAE,KAAK,GAAG;AAAA,MAClF,CAAC;AAAA,IAEH,SAAS,OAAO;AACd,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E,cAAQ,MAAM,gDAAgD,QAAQ,IAAI,MAAM,KAAK;AACrF,aAAO,OAAO,KAAK;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;",
+  "sourcesContent": ["/**\n * Workflows Module - Event Trigger Service\n *\n * Core service for evaluating and processing workflow event triggers.\n * Handles pattern matching, filter evaluation, context mapping, and workflow starting.\n */\n\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { EntityManager as PostgreSqlEntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { CacheService } from '@open-mercato/cache'\nimport { matchEventPattern } from '@open-mercato/shared/lib/events/patterns'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'\nimport {\n  WorkflowEventTrigger,\n  WorkflowDefinition,\n  WorkflowInstance,\n  type TriggerFilterCondition,\n  type TriggerContextMapping,\n  type WorkflowEventTriggerConfig,\n  type WorkflowDefinitionTrigger,\n} from '../data/entities'\nimport { startWorkflow, executeWorkflow } from './workflow-executor'\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface EventTriggerContext {\n  eventName: string\n  payload: Record<string, unknown>\n  tenantId: string\n  organizationId: string\n}\n\nexport interface ProcessTriggersResult {\n  triggered: number\n  skipped: number\n  errors: Array<{ triggerId: string; error: string }>\n  instances: Array<{ triggerId: string; instanceId: string }>\n}\n\n/**\n * Unified trigger interface for both legacy (entity) and embedded (definition) triggers\n */\nexport interface UnifiedTrigger {\n  id: string  // For legacy: entity ID, for embedded: `${definitionId}:${triggerId}`\n  triggerId: string\n  name: string\n  description?: string | null\n  eventPattern: string\n  config: WorkflowEventTriggerConfig | null\n  enabled: boolean\n  priority: number\n  workflowDefinitionId: string\n  workflowId: string\n  workflowVersion: number\n  source: 'legacy' | 'embedded'\n  tenantId: string\n  organizationId: string\n}\n\ninterface CachedTriggers {\n  triggers: UnifiedTrigger[]\n  cachedAt: number\n}\n\n// Cache TTL: 5 minutes\nconst TRIGGER_CACHE_TTL = 5 * 60 * 1000\n\n// ============================================================================\n// Pattern Matching\n// ============================================================================\n\n// ============================================================================\n// Filter Evaluation\n// ============================================================================\n\nconst MAX_WORKFLOW_REGEX_PATTERN_LENGTH = 200\nconst MAX_WORKFLOW_REGEX_INPUT_LENGTH = 10_000\n\n/**\n * Get a nested value from an object using dot notation.\n */\nfunction getNestedValue(obj: unknown, path: string): unknown {\n  if (obj === null || obj === undefined) return undefined\n\n  const parts = path.split('.')\n  let current: unknown = obj\n\n  for (const part of parts) {\n    if (current === null || current === undefined) return undefined\n    if (typeof current !== 'object') return undefined\n    current = (current as Record<string, unknown>)[part]\n  }\n\n  return current\n}\n\nfunction getQuantifierEnd(pattern: string, index: number): number | null {\n  const char = pattern[index]\n  if (char === '*' || char === '+' || char === '?') return index\n  if (char !== '{') return null\n\n  const closeIndex = pattern.indexOf('}', index + 1)\n  if (closeIndex === -1) return null\n\n  const body = pattern.slice(index + 1, closeIndex)\n  return /^[0-9]+(?:,[0-9]*)?$/.test(body) ? closeIndex : null\n}\n\ninterface RegexGroupFrame {\n  hasAlternation: boolean\n  hasQuantifier: boolean\n}\n\nfunction isSafeWorkflowRegexPattern(pattern: string): boolean {\n  if (pattern.length > MAX_WORKFLOW_REGEX_PATTERN_LENGTH) return false\n\n  const groupStack: RegexGroupFrame[] = [{ hasAlternation: false, hasQuantifier: false }]\n  let inCharClass = false\n  let lastClosedGroup: RegexGroupFrame | null = null\n  let lastAtomWasQuantified = false\n\n  for (let index = 0; index < pattern.length; index += 1) {\n    const char = pattern[index]\n\n    if (char === '\\\\') {\n      const next = pattern[index + 1]\n      if (!inCharClass && (/[1-9]/.test(next ?? '') || (next === 'k' && pattern[index + 2] === '<'))) {\n        return false\n      }\n      index += 1\n      lastClosedGroup = null\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    if (inCharClass) {\n      if (char === ']') {\n        inCharClass = false\n        lastAtomWasQuantified = false\n      }\n      lastClosedGroup = null\n      continue\n    }\n\n    if (char === '[') {\n      inCharClass = true\n      lastClosedGroup = null\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    if (char === '(') {\n      if (pattern[index + 1] === '?') {\n        if (pattern[index + 2] !== ':') return false\n        index += 2\n      }\n\n      groupStack.push({ hasAlternation: false, hasQuantifier: false })\n      lastClosedGroup = null\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    if (char === ')') {\n      if (groupStack.length === 1) return false\n      lastClosedGroup = groupStack.pop()!\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    if (char === '|') {\n      groupStack[groupStack.length - 1].hasAlternation = true\n      lastClosedGroup = null\n      lastAtomWasQuantified = false\n      continue\n    }\n\n    const quantifierEnd = getQuantifierEnd(pattern, index)\n    if (quantifierEnd !== null) {\n      if (lastAtomWasQuantified) return false\n      if (lastClosedGroup?.hasAlternation || lastClosedGroup?.hasQuantifier) return false\n\n      groupStack[groupStack.length - 1].hasQuantifier = true\n      lastClosedGroup = null\n      lastAtomWasQuantified = true\n      index = quantifierEnd\n\n      if (pattern[index + 1] === '?') {\n        index += 1\n      }\n\n      continue\n    }\n\n    lastClosedGroup = null\n    lastAtomWasQuantified = false\n  }\n\n  return groupStack.length === 1 && !inCharClass\n}\n\n/**\n * Evaluate a single filter condition against the event payload.\n */\nfunction evaluateCondition(condition: TriggerFilterCondition, payload: Record<string, unknown>): boolean {\n  const value = getNestedValue(payload, condition.field)\n  const expected = condition.value\n\n  switch (condition.operator) {\n    case 'eq':\n      return value === expected\n\n    case 'neq':\n      return value !== expected\n\n    case 'gt':\n      return typeof value === 'number' && typeof expected === 'number' && value > expected\n\n    case 'gte':\n      return typeof value === 'number' && typeof expected === 'number' && value >= expected\n\n    case 'lt':\n      return typeof value === 'number' && typeof expected === 'number' && value < expected\n\n    case 'lte':\n      return typeof value === 'number' && typeof expected === 'number' && value <= expected\n\n    case 'contains':\n      if (typeof value === 'string' && typeof expected === 'string') {\n        return value.includes(expected)\n      }\n      if (Array.isArray(value)) {\n        return value.includes(expected)\n      }\n      return false\n\n    case 'startsWith':\n      return typeof value === 'string' && typeof expected === 'string' && value.startsWith(expected)\n\n    case 'endsWith':\n      return typeof value === 'string' && typeof expected === 'string' && value.endsWith(expected)\n\n    case 'in':\n      return Array.isArray(expected) && expected.includes(value)\n\n    case 'notIn':\n      return Array.isArray(expected) && !expected.includes(value)\n\n    case 'exists':\n      return value !== undefined && value !== null\n\n    case 'notExists':\n      return value === undefined || value === null\n\n    case 'regex':\n      if (typeof value !== 'string' || typeof expected !== 'string') return false\n      if (value.length > MAX_WORKFLOW_REGEX_INPUT_LENGTH) return false\n      if (!isSafeWorkflowRegexPattern(expected)) return false\n      {\n        const result = testLinearRegex(expected, value, {\n          maxPatternLength: MAX_WORKFLOW_REGEX_PATTERN_LENGTH,\n          maxInputLength: MAX_WORKFLOW_REGEX_INPUT_LENGTH,\n        })\n        return result.ok ? result.matched : false\n      }\n\n    default:\n      return false\n  }\n}\n\n/**\n * Evaluate all filter conditions against the event payload.\n * All conditions must pass (AND logic).\n */\nexport function evaluateFilterConditions(\n  conditions: TriggerFilterCondition[] | undefined,\n  payload: Record<string, unknown>\n): boolean {\n  if (!conditions || conditions.length === 0) return true\n\n  return conditions.every(condition => evaluateCondition(condition, payload))\n}\n\n// ============================================================================\n// Context Mapping\n// ============================================================================\n\n/**\n * Map event payload to workflow initial context.\n */\nexport function mapEventToContext(\n  mapping: TriggerContextMapping[] | undefined,\n  payload: Record<string, unknown>\n): Record<string, unknown> {\n  const context: Record<string, unknown> = {}\n\n  if (!mapping || mapping.length === 0) return context\n\n  for (const item of mapping) {\n    const value = getNestedValue(payload, item.sourceExpression)\n    context[item.targetKey] = value !== undefined ? value : item.defaultValue\n  }\n\n  return context\n}\n\n// ============================================================================\n// Trigger Loading with Caching\n// ============================================================================\n\n// In-memory cache for triggers (per tenant/org)\nconst triggerCache = new Map<string, CachedTriggers>()\n\nfunction getCacheKey(tenantId: string, organizationId: string): string {\n  return `${tenantId}:${organizationId}`\n}\n\n/**\n * Load legacy triggers from WorkflowEventTrigger entity table.\n * For backward compatibility with existing triggers.\n */\nasync function loadLegacyTriggers(\n  em: EntityManager,\n  tenantId: string,\n  organizationId: string\n): Promise<UnifiedTrigger[]> {\n  const postgresEm = em as unknown as PostgreSqlEntityManager\n  const legacyTriggers = await findWithDecryption(\n    postgresEm,\n    WorkflowEventTrigger,\n    {\n      tenantId,\n      organizationId,\n      enabled: true,\n      deletedAt: null,\n    },\n    {\n      orderBy: { priority: 'DESC', createdAt: 'ASC' },\n    },\n    { tenantId, organizationId },\n  )\n\n  // Get definitions for these triggers to get workflowId\n  const definitionIds = [...new Set(legacyTriggers.map(t => t.workflowDefinitionId))]\n  const definitions = definitionIds.length > 0 ? await findWithDecryption(postgresEm, WorkflowDefinition, {\n    id: { $in: definitionIds },\n    tenantId,\n    organizationId,\n    enabled: true,\n    deletedAt: null,\n  }, {}, { tenantId, organizationId }) : []\n  const definitionMap = new Map(definitions.map(d => [d.id, d]))\n\n  return legacyTriggers\n    .filter(t => definitionMap.has(t.workflowDefinitionId))\n    .map(t => {\n      const def = definitionMap.get(t.workflowDefinitionId)!\n      return {\n        id: t.id,\n        triggerId: t.id,\n        name: t.name,\n        description: t.description,\n        eventPattern: t.eventPattern,\n        config: t.config ?? null,\n        enabled: t.enabled,\n        priority: t.priority,\n        workflowDefinitionId: t.workflowDefinitionId,\n        workflowId: def.workflowId,\n        workflowVersion: def.version,\n        source: 'legacy' as const,\n        tenantId: t.tenantId,\n        organizationId: t.organizationId,\n      }\n    })\n}\n\n/**\n * Load embedded triggers from workflow definitions.\n * New triggers are embedded directly in the definition JSONB.\n */\nasync function loadEmbeddedTriggers(\n  em: EntityManager,\n  tenantId: string,\n  organizationId: string\n): Promise<UnifiedTrigger[]> {\n  const postgresEm = em as unknown as PostgreSqlEntityManager\n  // Load all enabled definitions that may have triggers\n  const definitions = await findWithDecryption(\n    postgresEm,\n    WorkflowDefinition,\n    {\n      tenantId,\n      organizationId,\n      enabled: true,\n      deletedAt: null,\n    },\n    {},\n    { tenantId, organizationId },\n  )\n\n  const triggers: UnifiedTrigger[] = []\n\n  for (const def of definitions) {\n    const embeddedTriggers = def.definition?.triggers as WorkflowDefinitionTrigger[] | undefined\n    if (!embeddedTriggers || embeddedTriggers.length === 0) continue\n\n    for (const trigger of embeddedTriggers) {\n      if (!trigger.enabled) continue\n\n      triggers.push({\n        id: `${def.id}:${trigger.triggerId}`,\n        triggerId: trigger.triggerId,\n        name: trigger.name,\n        description: trigger.description ?? null,\n        eventPattern: trigger.eventPattern,\n        config: trigger.config ?? null,\n        enabled: trigger.enabled,\n        priority: trigger.priority,\n        workflowDefinitionId: def.id,\n        workflowId: def.workflowId,\n        workflowVersion: def.version,\n        source: 'embedded' as const,\n        tenantId,\n        organizationId,\n      })\n    }\n  }\n\n  return triggers\n}\n\n/**\n * Load all enabled triggers for a tenant/organization with caching.\n * Merges both legacy (entity) triggers and embedded (definition) triggers.\n */\nexport async function loadTriggersForTenant(\n  em: EntityManager,\n  tenantId: string,\n  organizationId: string,\n  cacheService?: CacheService\n): Promise<UnifiedTrigger[]> {\n  const cacheKey = getCacheKey(tenantId, organizationId)\n\n  // Check in-memory cache\n  const cached = triggerCache.get(cacheKey)\n  if (cached && Date.now() - cached.cachedAt < TRIGGER_CACHE_TTL) {\n    return cached.triggers\n  }\n\n  // Load from both sources\n  const [legacyTriggers, embeddedTriggers] = await Promise.all([\n    loadLegacyTriggers(em, tenantId, organizationId),\n    loadEmbeddedTriggers(em, tenantId, organizationId),\n  ])\n\n  // Merge and sort by priority (higher first)\n  const allTriggers = [...legacyTriggers, ...embeddedTriggers]\n    .sort((a, b) => b.priority - a.priority)\n\n  // Update cache\n  triggerCache.set(cacheKey, {\n    triggers: allTriggers,\n    cachedAt: Date.now(),\n  })\n\n  return allTriggers\n}\n\n/**\n * Invalidate trigger cache for a tenant/organization.\n * Call this when:\n * - Legacy triggers are created/updated/deleted\n * - Workflow definitions with embedded triggers are created/updated/deleted\n */\nexport function invalidateTriggerCache(tenantId: string, organizationId?: string): void {\n  if (organizationId) {\n    // Invalidate specific org\n    const cacheKey = getCacheKey(tenantId, organizationId)\n    triggerCache.delete(cacheKey)\n  } else {\n    // Invalidate all orgs for tenant\n    for (const key of triggerCache.keys()) {\n      if (key.startsWith(`${tenantId}:`)) {\n        triggerCache.delete(key)\n      }\n    }\n  }\n}\n\n// ============================================================================\n// Trigger Matching\n// ============================================================================\n\n/**\n * Find all triggers that match an event.\n */\nexport async function findMatchingTriggers(\n  em: EntityManager,\n  context: EventTriggerContext\n): Promise<UnifiedTrigger[]> {\n  const triggers = await loadTriggersForTenant(\n    em,\n    context.tenantId,\n    context.organizationId\n  )\n\n  return triggers.filter(trigger => {\n    // Check event pattern\n    if (!matchEventPattern(context.eventName, trigger.eventPattern)) {\n      return false\n    }\n\n    // Check filter conditions\n    if (!evaluateFilterConditions(trigger.config?.filterConditions, context.payload)) {\n      return false\n    }\n\n    return true\n  })\n}\n\n// ============================================================================\n// Trigger Processing\n// ============================================================================\n\n/**\n * Check if max concurrent instances limit is reached.\n */\nasync function checkConcurrencyLimit(\n  em: EntityManager,\n  trigger: UnifiedTrigger\n): Promise<boolean> {\n  const maxInstances = trigger.config?.maxConcurrentInstances\n\n  if (!maxInstances) return true // No limit\n\n  // Count running instances for this trigger's workflow definition\n  const runningCount = await em.count(WorkflowInstance, {\n    definitionId: trigger.workflowDefinitionId,\n    status: { $in: ['RUNNING', 'WAITING_FOR_ACTIVITIES'] },\n    tenantId: trigger.tenantId,\n    organizationId: trigger.organizationId,\n    deletedAt: null,\n  })\n\n  return runningCount < maxInstances\n}\n\n/**\n * Process all matching triggers for an event and start workflows.\n */\nexport async function processEventTriggers(\n  em: EntityManager,\n  container: AwilixContainer,\n  context: EventTriggerContext\n): Promise<ProcessTriggersResult> {\n  const result: ProcessTriggersResult = {\n    triggered: 0,\n    skipped: 0,\n    errors: [],\n    instances: [],\n  }\n\n  // Find matching triggers\n  const triggers = await findMatchingTriggers(em, context)\n\n  if (triggers.length === 0) {\n    return result\n  }\n\n  // Process each trigger (definitions already validated during loading)\n  for (const trigger of triggers) {\n    try {\n      // Check concurrency limit\n      const canStart = await checkConcurrencyLimit(em, trigger)\n      if (!canStart) {\n        console.log(`[workflow-trigger] Skipping trigger \"${trigger.name}\": max concurrent instances reached`)\n        result.skipped++\n        continue\n      }\n\n      // Map event payload to workflow context\n      const mappedContext = mapEventToContext(trigger.config?.contextMapping, context.payload)\n\n      // Extract entity info from payload for metadata\n      const payloadId = context.payload?.id as string | undefined\n      const payloadEntityType = context.payload?.entityType as string | undefined\n\n      // Include event metadata and payload in context\n      const initialContext = {\n        // Include raw event payload fields (e.g., id, organizationId, tenantId)\n        ...context.payload,\n        // Override with explicit mappings if provided\n        ...mappedContext,\n        __trigger: {\n          triggerId: trigger.id,\n          triggerName: trigger.name,\n          eventName: context.eventName,\n          eventPayload: context.payload,\n          triggeredAt: new Date().toISOString(),\n          source: trigger.source,\n        },\n      }\n\n      // Start workflow\n      const instance = await startWorkflow(em, {\n        workflowId: trigger.workflowId,\n        version: trigger.workflowVersion,\n        initialContext,\n        metadata: {\n          initiatedBy: `trigger:${trigger.id}`,\n          // Include entityId and entityType for widget discovery\n          entityId: payloadId,\n          entityType: payloadEntityType || trigger.config?.entityType,\n          labels: {\n            trigger_id: trigger.id,\n            trigger_name: trigger.name,\n            event_name: context.eventName,\n            trigger_source: trigger.source,\n          },\n        },\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n      })\n\n      result.triggered++\n      result.instances.push({\n        triggerId: trigger.id,\n        instanceId: instance.id,\n      })\n\n      // Execute workflow asynchronously (don't wait)\n      executeWorkflow(em.fork(), container, instance.id).catch(err => {\n        console.error(`[workflow-trigger] Error executing workflow ${instance.id}:`, err)\n      })\n\n    } catch (error) {\n      const errorMessage = error instanceof Error ? error.message : String(error)\n      console.error(`[workflow-trigger] Error processing trigger \"${trigger.name}\":`, error)\n      result.errors.push({\n        triggerId: trigger.id,\n        error: errorMessage,\n      })\n    }\n  }\n\n  return result\n}\n"],
+  "mappings": "AAWA,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,eAAe,uBAAuB;AA8C/C,MAAM,oBAAoB,IAAI,KAAK;AAUnC,MAAM,oCAAoC;AAC1C,MAAM,kCAAkC;AAKxC,SAAS,eAAe,KAAc,MAAuB;AAC3D,MAAI,QAAQ,QAAQ,QAAQ,OAAW,QAAO;AAE9C,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,UAAmB;AAEvB,aAAW,QAAQ,OAAO;AACxB,QAAI,YAAY,QAAQ,YAAY,OAAW,QAAO;AACtD,QAAI,OAAO,YAAY,SAAU,QAAO;AACxC,cAAW,QAAoC,IAAI;AAAA,EACrD;AAEA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAiB,OAA8B;AACvE,QAAM,OAAO,QAAQ,KAAK;AAC1B,MAAI,SAAS,OAAO,SAAS,OAAO,SAAS,IAAK,QAAO;AACzD,MAAI,SAAS,IAAK,QAAO;AAEzB,QAAM,aAAa,QAAQ,QAAQ,KAAK,QAAQ,CAAC;AACjD,MAAI,eAAe,GAAI,QAAO;AAE9B,QAAM,OAAO,QAAQ,MAAM,QAAQ,GAAG,UAAU;AAChD,SAAO,uBAAuB,KAAK,IAAI,IAAI,aAAa;AAC1D;AAOA,SAAS,2BAA2B,SAA0B;AAC5D,MAAI,QAAQ,SAAS,kCAAmC,QAAO;AAE/D,QAAM,aAAgC,CAAC,EAAE,gBAAgB,OAAO,eAAe,MAAM,CAAC;AACtF,MAAI,cAAc;AAClB,MAAI,kBAA0C;AAC9C,MAAI,wBAAwB;AAE5B,WAAS,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;AACtD,UAAM,OAAO,QAAQ,KAAK;AAE1B,QAAI,SAAS,MAAM;AACjB,YAAM,OAAO,QAAQ,QAAQ,CAAC;AAC9B,UAAI,CAAC,gBAAgB,QAAQ,KAAK,QAAQ,EAAE,KAAM,SAAS,OAAO,QAAQ,QAAQ,CAAC,MAAM,MAAO;AAC9F,eAAO;AAAA,MACT;AACA,eAAS;AACT,wBAAkB;AAClB,8BAAwB;AACxB;AAAA,IACF;AAEA,QAAI,aAAa;AACf,UAAI,SAAS,KAAK;AAChB,sBAAc;AACd,gCAAwB;AAAA,MAC1B;AACA,wBAAkB;AAClB;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB,oBAAc;AACd,wBAAkB;AAClB,8BAAwB;AACxB;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB,UAAI,QAAQ,QAAQ,CAAC,MAAM,KAAK;AAC9B,YAAI,QAAQ,QAAQ,CAAC,MAAM,IAAK,QAAO;AACvC,iBAAS;AAAA,MACX;AAEA,iBAAW,KAAK,EAAE,gBAAgB,OAAO,eAAe,MAAM,CAAC;AAC/D,wBAAkB;AAClB,8BAAwB;AACxB;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB,UAAI,WAAW,WAAW,EAAG,QAAO;AACpC,wBAAkB,WAAW,IAAI;AACjC,8BAAwB;AACxB;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB,iBAAW,WAAW,SAAS,CAAC,EAAE,iBAAiB;AACnD,wBAAkB;AAClB,8BAAwB;AACxB;AAAA,IACF;AAEA,UAAM,gBAAgB,iBAAiB,SAAS,KAAK;AACrD,QAAI,kBAAkB,MAAM;AAC1B,UAAI,sBAAuB,QAAO;AAClC,UAAI,iBAAiB,kBAAkB,iBAAiB,cAAe,QAAO;AAE9E,iBAAW,WAAW,SAAS,CAAC,EAAE,gBAAgB;AAClD,wBAAkB;AAClB,8BAAwB;AACxB,cAAQ;AAER,UAAI,QAAQ,QAAQ,CAAC,MAAM,KAAK;AAC9B,iBAAS;AAAA,MACX;AAEA;AAAA,IACF;AAEA,sBAAkB;AAClB,4BAAwB;AAAA,EAC1B;AAEA,SAAO,WAAW,WAAW,KAAK,CAAC;AACrC;AAKA,SAAS,kBAAkB,WAAmC,SAA2C;AACvG,QAAM,QAAQ,eAAe,SAAS,UAAU,KAAK;AACrD,QAAM,WAAW,UAAU;AAE3B,UAAQ,UAAU,UAAU;AAAA,IAC1B,KAAK;AACH,aAAO,UAAU;AAAA,IAEnB,KAAK;AACH,aAAO,UAAU;AAAA,IAEnB,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,QAAQ;AAAA,IAE9E,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,SAAS;AAAA,IAE/E,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,QAAQ;AAAA,IAE9E,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,SAAS;AAAA,IAE/E,KAAK;AACH,UAAI,OAAO,UAAU,YAAY,OAAO,aAAa,UAAU;AAC7D,eAAO,MAAM,SAAS,QAAQ;AAAA,MAChC;AACA,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,MAAM,SAAS,QAAQ;AAAA,MAChC;AACA,aAAO;AAAA,IAET,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,MAAM,WAAW,QAAQ;AAAA,IAE/F,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,OAAO,aAAa,YAAY,MAAM,SAAS,QAAQ;AAAA,IAE7F,KAAK;AACH,aAAO,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,KAAK;AAAA,IAE3D,KAAK;AACH,aAAO,MAAM,QAAQ,QAAQ,KAAK,CAAC,SAAS,SAAS,KAAK;AAAA,IAE5D,KAAK;AACH,aAAO,UAAU,UAAa,UAAU;AAAA,IAE1C,KAAK;AACH,aAAO,UAAU,UAAa,UAAU;AAAA,IAE1C,KAAK;AACH,UAAI,OAAO,UAAU,YAAY,OAAO,aAAa,SAAU,QAAO;AACtE,UAAI,MAAM,SAAS,gCAAiC,QAAO;AAC3D,UAAI,CAAC,2BAA2B,QAAQ,EAAG,QAAO;AAClD;AACE,cAAM,SAAS,gBAAgB,UAAU,OAAO;AAAA,UAC9C,kBAAkB;AAAA,UAClB,gBAAgB;AAAA,QAClB,CAAC;AACD,eAAO,OAAO,KAAK,OAAO,UAAU;AAAA,MACtC;AAAA,IAEF;AACE,aAAO;AAAA,EACX;AACF;AAMO,SAAS,yBACd,YACA,SACS;AACT,MAAI,CAAC,cAAc,WAAW,WAAW,EAAG,QAAO;AAEnD,SAAO,WAAW,MAAM,eAAa,kBAAkB,WAAW,OAAO,CAAC;AAC5E;AASO,SAAS,kBACd,SACA,SACyB;AACzB,QAAM,UAAmC,CAAC;AAE1C,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,aAAW,QAAQ,SAAS;AAC1B,UAAM,QAAQ,eAAe,SAAS,KAAK,gBAAgB;AAC3D,YAAQ,KAAK,SAAS,IAAI,UAAU,SAAY,QAAQ,KAAK;AAAA,EAC/D;AAEA,SAAO;AACT;AAOA,MAAM,eAAe,oBAAI,IAA4B;AAErD,SAAS,YAAY,UAAkB,gBAAgC;AACrE,SAAO,GAAG,QAAQ,IAAI,cAAc;AACtC;AAMA,eAAe,mBACb,IACA,UACA,gBAC2B;AAC3B,QAAM,aAAa;AACnB,QAAM,iBAAiB,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,WAAW;AAAA,IACb;AAAA,IACA;AAAA,MACE,SAAS,EAAE,UAAU,QAAQ,WAAW,MAAM;AAAA,IAChD;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AAGA,QAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,eAAe,IAAI,OAAK,EAAE,oBAAoB,CAAC,CAAC;AAClF,QAAM,cAAc,cAAc,SAAS,IAAI,MAAM,mBAAmB,YAAY,oBAAoB;AAAA,IACtG,IAAI,EAAE,KAAK,cAAc;AAAA,IACzB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,EAAE,UAAU,eAAe,CAAC,IAAI,CAAC;AACxC,QAAM,gBAAgB,IAAI,IAAI,YAAY,IAAI,OAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAE7D,SAAO,eACJ,OAAO,OAAK,cAAc,IAAI,EAAE,oBAAoB,CAAC,EACrD,IAAI,OAAK;AACR,UAAM,MAAM,cAAc,IAAI,EAAE,oBAAoB;AACpD,WAAO;AAAA,MACL,IAAI,EAAE;AAAA,MACN,WAAW,EAAE;AAAA,MACb,MAAM,EAAE;AAAA,MACR,aAAa,EAAE;AAAA,MACf,cAAc,EAAE;AAAA,MAChB,QAAQ,EAAE,UAAU;AAAA,MACpB,SAAS,EAAE;AAAA,MACX,UAAU,EAAE;AAAA,MACZ,sBAAsB,EAAE;AAAA,MACxB,YAAY,IAAI;AAAA,MAChB,iBAAiB,IAAI;AAAA,MACrB,QAAQ;AAAA,MACR,UAAU,EAAE;AAAA,MACZ,gBAAgB,EAAE;AAAA,IACpB;AAAA,EACF,CAAC;AACL;AAMA,eAAe,qBACb,IACA,UACA,gBAC2B;AAC3B,QAAM,aAAa;AAEnB,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,eAAe;AAAA,EAC7B;AAEA,QAAM,WAA6B,CAAC;AAEpC,aAAW,OAAO,aAAa;AAC7B,UAAM,mBAAmB,IAAI,YAAY;AACzC,QAAI,CAAC,oBAAoB,iBAAiB,WAAW,EAAG;AAExD,eAAW,WAAW,kBAAkB;AACtC,UAAI,CAAC,QAAQ,QAAS;AAEtB,eAAS,KAAK;AAAA,QACZ,IAAI,GAAG,IAAI,EAAE,IAAI,QAAQ,SAAS;AAAA,QAClC,WAAW,QAAQ;AAAA,QACnB,MAAM,QAAQ;AAAA,QACd,aAAa,QAAQ,eAAe;AAAA,QACpC,cAAc,QAAQ;AAAA,QACtB,QAAQ,QAAQ,UAAU;AAAA,QAC1B,SAAS,QAAQ;AAAA,QACjB,UAAU,QAAQ;AAAA,QAClB,sBAAsB,IAAI;AAAA,QAC1B,YAAY,IAAI;AAAA,QAChB,iBAAiB,IAAI;AAAA,QACrB,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,eAAsB,sBACpB,IACA,UACA,gBACA,cAC2B;AAC3B,QAAM,WAAW,YAAY,UAAU,cAAc;AAGrD,QAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,MAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,mBAAmB;AAC9D,WAAO,OAAO;AAAA,EAChB;AAGA,QAAM,CAAC,gBAAgB,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC3D,mBAAmB,IAAI,UAAU,cAAc;AAAA,IAC/C,qBAAqB,IAAI,UAAU,cAAc;AAAA,EACnD,CAAC;AAGD,QAAM,cAAc,CAAC,GAAG,gBAAgB,GAAG,gBAAgB,EACxD,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAGzC,eAAa,IAAI,UAAU;AAAA,IACzB,UAAU;AAAA,IACV,UAAU,KAAK,IAAI;AAAA,EACrB,CAAC;AAED,SAAO;AACT;AAQO,SAAS,uBAAuB,UAAkB,gBAA+B;AACtF,MAAI,gBAAgB;AAElB,UAAM,WAAW,YAAY,UAAU,cAAc;AACrD,iBAAa,OAAO,QAAQ;AAAA,EAC9B,OAAO;AAEL,eAAW,OAAO,aAAa,KAAK,GAAG;AACrC,UAAI,IAAI,WAAW,GAAG,QAAQ,GAAG,GAAG;AAClC,qBAAa,OAAO,GAAG;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AACF;AASA,eAAsB,qBACpB,IACA,SAC2B;AAC3B,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAEA,SAAO,SAAS,OAAO,aAAW;AAEhC,QAAI,CAAC,kBAAkB,QAAQ,WAAW,QAAQ,YAAY,GAAG;AAC/D,aAAO;AAAA,IACT;AAGA,QAAI,CAAC,yBAAyB,QAAQ,QAAQ,kBAAkB,QAAQ,OAAO,GAAG;AAChF,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AASA,eAAe,sBACb,IACA,SACkB;AAClB,QAAM,eAAe,QAAQ,QAAQ;AAErC,MAAI,CAAC,aAAc,QAAO;AAG1B,QAAM,eAAe,MAAM,GAAG,MAAM,kBAAkB;AAAA,IACpD,cAAc,QAAQ;AAAA,IACtB,QAAQ,EAAE,KAAK,CAAC,WAAW,wBAAwB,EAAE;AAAA,IACrD,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,WAAW;AAAA,EACb,CAAC;AAED,SAAO,eAAe;AACxB;AAKA,eAAsB,qBACpB,IACA,WACA,SACgC;AAChC,QAAM,SAAgC;AAAA,IACpC,WAAW;AAAA,IACX,SAAS;AAAA,IACT,QAAQ,CAAC;AAAA,IACT,WAAW,CAAC;AAAA,EACd;AAGA,QAAM,WAAW,MAAM,qBAAqB,IAAI,OAAO;AAEvD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,EACT;AAGA,aAAW,WAAW,UAAU;AAC9B,QAAI;AAEF,YAAM,WAAW,MAAM,sBAAsB,IAAI,OAAO;AACxD,UAAI,CAAC,UAAU;AACb,gBAAQ,IAAI,wCAAwC,QAAQ,IAAI,qCAAqC;AACrG,eAAO;AACP;AAAA,MACF;AAGA,YAAM,gBAAgB,kBAAkB,QAAQ,QAAQ,gBAAgB,QAAQ,OAAO;AAGvF,YAAM,YAAY,QAAQ,SAAS;AACnC,YAAM,oBAAoB,QAAQ,SAAS;AAG3C,YAAM,iBAAiB;AAAA;AAAA,QAErB,GAAG,QAAQ;AAAA;AAAA,QAEX,GAAG;AAAA,QACH,WAAW;AAAA,UACT,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,WAAW,QAAQ;AAAA,UACnB,cAAc,QAAQ;AAAA,UACtB,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,UACpC,QAAQ,QAAQ;AAAA,QAClB;AAAA,MACF;AAGA,YAAM,WAAW,MAAM,cAAc,IAAI;AAAA,QACvC,YAAY,QAAQ;AAAA,QACpB,SAAS,QAAQ;AAAA,QACjB;AAAA,QACA,UAAU;AAAA,UACR,aAAa,WAAW,QAAQ,EAAE;AAAA;AAAA,UAElC,UAAU;AAAA,UACV,YAAY,qBAAqB,QAAQ,QAAQ;AAAA,UACjD,QAAQ;AAAA,YACN,YAAY,QAAQ;AAAA,YACpB,cAAc,QAAQ;AAAA,YACtB,YAAY,QAAQ;AAAA,YACpB,gBAAgB,QAAQ;AAAA,UAC1B;AAAA,QACF;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AAED,aAAO;AACP,aAAO,UAAU,KAAK;AAAA,QACpB,WAAW,QAAQ;AAAA,QACnB,YAAY,SAAS;AAAA,MACvB,CAAC;AAGD,sBAAgB,GAAG,KAAK,GAAG,WAAW,SAAS,EAAE,EAAE,MAAM,SAAO;AAC9D,gBAAQ,MAAM,+CAA+C,SAAS,EAAE,KAAK,GAAG;AAAA,MAClF,CAAC;AAAA,IAEH,SAAS,OAAO;AACd,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E,cAAQ,MAAM,gDAAgD,QAAQ,IAAI,MAAM,KAAK;AACrF,aAAO,OAAO,KAAK;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;",
   "names": []
 }

package/jest.config.cjs

@@ -1,6 +1,7 @@
 /** @type {import('jest').Config} */
 module.exports = {
   testEnvironment: 'node',
+  testTimeout: 30000,
   watchman: false,
   rootDir: '.',
   moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.3-develop.3562.1.71049275ff",
+  "version": "0.6.3-develop.3574.1.f3c5dcf345",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -242,16 +242,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.3-develop.3562.1.71049275ff",
-    "@open-mercato/shared": "0.6.3-develop.3562.1.71049275ff",
-    "@open-mercato/ui": "0.6.3-develop.3562.1.71049275ff",
+    "@open-mercato/ai-assistant": "0.6.3-develop.3574.1.f3c5dcf345",
+    "@open-mercato/shared": "0.6.3-develop.3574.1.f3c5dcf345",
+    "@open-mercato/ui": "0.6.3-develop.3574.1.f3c5dcf345",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.3-develop.3562.1.71049275ff",
-    "@open-mercato/shared": "0.6.3-develop.3562.1.71049275ff",
-    "@open-mercato/ui": "0.6.3-develop.3562.1.71049275ff",
+    "@open-mercato/ai-assistant": "0.6.3-develop.3574.1.f3c5dcf345",
+    "@open-mercato/shared": "0.6.3-develop.3574.1.f3c5dcf345",
+    "@open-mercato/ui": "0.6.3-develop.3574.1.f3c5dcf345",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/queue-runner.ts

@@ -7,13 +7,27 @@ import { createQueue } from '@open-mercato/queue'
 export type QueueDrainRunnerOptions = {
   appRoot: string
   jobLimit: number
+  queueBaseDir?: string
+}
+
+type BootstrapData = Awaited<ReturnType<typeof bootstrapFromAppRoot>>
+
+const bootstrapCache = new Map<string, Promise<BootstrapData>>()
+
+function getBootstrapData(appRoot: string): Promise<BootstrapData> {
+  const resolvedAppRoot = path.resolve(appRoot)
+  const cached = bootstrapCache.get(resolvedAppRoot)
+  if (cached) return cached
+  const promise = bootstrapFromAppRoot(resolvedAppRoot)
+  bootstrapCache.set(resolvedAppRoot, promise)
+  return promise
 }
 
 export async function drainQueueFromAppRoot(
   queueName: string,
   options: QueueDrainRunnerOptions,
 ): Promise<number> {
-  const data = await bootstrapFromAppRoot(options.appRoot)
+  const data = await getBootstrapData(options.appRoot)
   const worker = data.modules
     .flatMap((module) => module.workers ?? [])
     .find((entry) => entry.queue === queueName)
@@ -21,7 +35,11 @@ export async function drainQueueFromAppRoot(
 
   const container = await createRequestContainer()
   const queue = createQueue(queueName, 'local', {
-    baseDir: path.resolve(options.appRoot, '.mercato/queue'),
+    baseDir: path.resolve(
+      options.queueBaseDir?.trim()
+      || process.env.QUEUE_BASE_DIR?.trim()
+      || path.resolve(options.appRoot, '.mercato/queue'),
+    ),
     concurrency: 1,
   })
   const resolve = <T = unknown>(name: string): T => container.resolve(name) as T
@@ -53,6 +71,7 @@ export async function runQueueDrainFromEnv(): Promise<void> {
   const processed = await drainQueueFromAppRoot(queueName, {
     appRoot: path.resolve(appRoot),
     jobLimit,
+    queueBaseDir: process.env.QUEUE_BASE_DIR,
   })
   console.log(JSON.stringify({ processed }))
 }

package/src/helpers/integration/queue.ts

@@ -32,7 +32,7 @@ function drainQueueInAppProcess(queueName: string, options: Required<DrainQueueO
         OM_INTEGRATION_APP_ROOT: options.appRoot,
         OM_INTEGRATION_QUEUE_NAME: queueName,
         OM_INTEGRATION_QUEUE_JOB_LIMIT: String(options.jobLimit),
-        QUEUE_BASE_DIR: path.resolve(options.appRoot, '.mercato/queue'),
+        QUEUE_BASE_DIR: process.env.QUEUE_BASE_DIR?.trim() || path.resolve(options.appRoot, '.mercato/queue'),
       },
       stdio: ['ignore', 'pipe', 'pipe'],
     })

package/src/modules/auth/api/roles/acl/route.ts

@@ -9,7 +9,11 @@ import { RoleAcl, Role } from '@open-mercato/core/modules/auth/data/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
-import { assertActorCanGrantAcl, normalizeGrantFeatureList } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import {
+  assertActorCanGrantAcl,
+  assertActorCanModifySuperAdminRoleTarget,
+  normalizeGrantFeatureList,
+} from '@open-mercato/core/modules/auth/lib/grantChecks'
 
 type TaggableCache = { deleteByTags?: (tags: string[]) => Promise<void> | void }
 
@@ -71,6 +75,23 @@ export async function GET(req: Request) {
   }
   if (!tenantScope && !isSuperAdmin) tenantScope = authTenantId ?? null
 
+  if (!isSuperAdmin && auth.sub) {
+    try {
+      await assertActorCanModifySuperAdminRoleTarget({
+        em,
+        rbacService: container.resolve('rbacService') as RbacService,
+        actorUserId: auth.sub,
+        tenantId: tenantScope,
+        organizationId: auth.orgId ?? null,
+        targetRoleId: parsed.data.roleId,
+        actorIsSuperAdmin: false,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
+
   const acl = tenantScope
     ? await em.findOne(RoleAcl, { role, tenantId: tenantScope })
     : null
@@ -133,6 +154,23 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
+  if (!isSuperAdmin && auth.sub) {
+    try {
+      await assertActorCanModifySuperAdminRoleTarget({
+        em,
+        rbacService,
+        actorUserId: auth.sub,
+        tenantId: targetTenantId,
+        organizationId: auth.orgId ?? null,
+        targetRoleId: parsed.data.roleId,
+        actorIsSuperAdmin: false,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
+
   let acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })
   if (!acl) {
     acl = em.create(RoleAcl, {

package/src/modules/auth/api/roles/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { Role, RoleAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'
@@ -13,6 +14,8 @@ import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { roleCrudEvents, roleCrudIndexer } from '@open-mercato/core/modules/auth/commands/roles'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { assertActorCanModifySuperAdminRoleTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 const querySchema = z.object({
   id: z.string().uuid().optional(),
@@ -87,7 +90,12 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
     update: {
       commandId: 'auth.roles.update',
       schema: rawBodySchema,
-      mapInput: ({ parsed }) => parsed,
+      mapInput: async ({ parsed, ctx }) => {
+        if (ctx.request && typeof parsed.id === 'string' && parsed.id.length) {
+          await assertCanModifySuperAdminRole(ctx.request, parsed.id)
+        }
+        return parsed
+      },
       response: () => ({ ok: true }),
     },
     delete: {
@@ -236,7 +244,35 @@ export async function GET(req: Request) {
 
 export const POST = crud.POST
 export const PUT = crud.PUT
-export const DELETE = crud.DELETE
+export const DELETE = async (req: Request) => {
+  const targetId = new URL(req.url).searchParams.get('id')
+  if (targetId) {
+    try {
+      await assertCanModifySuperAdminRole(req, targetId)
+    } catch (err) {
+      if (err instanceof CrudHttpError) {
+        return NextResponse.json(err.body, { status: err.status })
+      }
+      throw err
+    }
+  }
+  return crud.DELETE(req)
+}
+
+async function assertCanModifySuperAdminRole(req: Request, targetRoleId: string) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  await assertActorCanModifySuperAdminRoleTarget({
+    em,
+    rbacService: container.resolve('rbacService') as RbacService,
+    actorUserId: auth.sub,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    targetRoleId,
+  })
+}
 
 export const openApi: OpenApiRouteDoc = {
   tag: 'Authentication & Accounts',

package/src/modules/auth/api/users/acl/route.ts

@@ -4,8 +4,11 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
-import { forbidden } from '@open-mercato/shared/lib/crud/errors'
+import { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { UserAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { assertActorCanModifySuperAdminUserTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { EntityManager } from '@mikro-orm/postgresql'
 
 const getSchema = z.object({ userId: z.string().uuid() })
 const putSchema = z.object({
@@ -42,6 +45,26 @@ export async function GET(req: Request) {
   if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })
   const container = await createRequestContainer()
   const em = container.resolve('em') as any
+  const rbacService = container.resolve('rbacService') as any
+  const actorAcl = auth.sub
+    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
+    : null
+  if (!actorAcl?.isSuperAdmin && auth.sub) {
+    try {
+      await assertActorCanModifySuperAdminUserTarget({
+        em: em as EntityManager,
+        rbacService: rbacService as RbacService,
+        actorUserId: auth.sub,
+        tenantId: auth.tenantId ?? null,
+        organizationId: auth.orgId ?? null,
+        targetUserId: parsed.data.userId,
+        actorIsSuperAdmin: false,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
   const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
   const response = acl
     ? {
@@ -83,6 +106,23 @@ export async function PUT(req: Request) {
     : null
   const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin
 
+  if (!actorIsSuperAdmin && auth.sub) {
+    try {
+      await assertActorCanModifySuperAdminUserTarget({
+        em: em as EntityManager,
+        rbacService: rbacService as RbacService,
+        actorUserId: auth.sub,
+        tenantId: auth.tenantId ?? null,
+        organizationId: auth.orgId ?? null,
+        targetUserId: parsed.data.userId,
+        actorIsSuperAdmin: false,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
+
   const requestedFeatures = normalizeFeatureList(parsed.data.features)
   const organizations = Array.isArray(parsed.data.organizations) ? parsed.data.organizations : null
 

package/src/modules/auth/api/users/route.ts

@@ -13,7 +13,11 @@ import { E } from '#generated/entities.ids.generated'
 import { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { userCrudEvents, userCrudIndexer } from '@open-mercato/core/modules/auth/commands/users'
-import { assertActorCanGrantRoleTokens } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import {
+  assertActorCanGrantRoleTokens,
+  assertActorCanModifySuperAdminUserTarget,
+  listSuperAdminUserIds,
+} from '@open-mercato/core/modules/auth/lib/grantChecks'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
@@ -132,6 +136,9 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
       schema: rawBodySchema,
       mapInput: async ({ parsed, ctx }) => {
         if (ctx.request) {
+          if (typeof parsed.id === 'string' && parsed.id.length) {
+            await assertCanModifySuperAdminTarget(ctx.request, parsed.id)
+          }
           await assertCanAssignRoles(ctx.request, parsed.roles, parsed)
         }
         return parsed
@@ -184,6 +191,10 @@ export async function GET(req: Request) {
       return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })
     }
     effectiveTenantId = actorTenantId
+    const superAdminUserIds = await listSuperAdminUserIds(em, actorTenantId)
+    if (superAdminUserIds.size) {
+      filters.push({ id: { $nin: Array.from(superAdminUserIds) as any } })
+    }
   } else {
     const selectedTenantId = getSelectedTenantFromRequest(req)
     if (typeof selectedTenantId === 'string' && selectedTenantId.trim().length > 0) {
@@ -437,7 +448,20 @@ export const PUT = async (req: Request) => {
   return crud.PUT(req)
 }
 
-export const DELETE = crud.DELETE
+export const DELETE = async (req: Request) => {
+  const targetId = new URL(req.url).searchParams.get('id')
+  if (targetId) {
+    try {
+      await assertCanModifySuperAdminTarget(req, targetId)
+    } catch (err) {
+      if (err instanceof CrudHttpError) {
+        return NextResponse.json(err.body, { status: err.status })
+      }
+      throw err
+    }
+  }
+  return crud.DELETE(req)
+}
 
 async function findUserIdsBySearchTokens(
   em: EntityManager,
@@ -469,6 +493,21 @@ async function findUserIdsBySearchTokens(
     .filter((id): id is string => typeof id === 'string' && id.length > 0)
 }
 
+async function assertCanModifySuperAdminTarget(req: Request, targetUserId: string) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  await assertActorCanModifySuperAdminUserTarget({
+    em,
+    rbacService: container.resolve('rbacService') as RbacService,
+    actorUserId: auth.sub,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    targetUserId,
+  })
+}
+
 async function assertCanAssignRoles(req: Request, roles: unknown, payload: Record<string, unknown>) {
   if (!Array.isArray(roles)) return
   const auth = await getAuthFromRequest(req)

package/src/modules/auth/commands/users.ts

@@ -286,6 +286,7 @@ const createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResul
       resourceKind: 'auth.user',
       resourceId: String(user.id),
       tenantId: user.tenantId ? String(user.tenantId) : null,
+      organizationId: user.organizationId ? String(user.organizationId) : null,
       snapshotAfter: snapshot.view,
       payload: {
         undo: {
@@ -559,6 +560,7 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
       resourceKind: 'auth.user',
       resourceId: String(result.id),
       tenantId: result.tenantId ? String(result.tenantId) : null,
+      organizationId: result.organizationId ? String(result.organizationId) : null,
       changes,
       snapshotBefore: before ?? null,
       snapshotAfter: after,
@@ -689,6 +691,7 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
       resourceId: id,
       snapshotBefore: before ?? null,
       tenantId: before?.tenantId ?? null,
+      organizationId: before?.organizationId ?? null,
       payload: {
         undo: {
           before: beforeUndo,