@open-mercato/core 0.6.3-develop.3857.1.da89d7530c → 0.6.3-develop.3881.1.0b590ac4eb

package/dist/modules/workflows/workers/workflow-activities.worker.js

@@ -1,4 +1,3 @@
-import { WORKFLOW_ACTIVITIES_QUEUE_NAME } from "../lib/activity-queue-types.js";
 import { WorkflowInstance } from "../data/entities.js";
 import { logWorkflowEvent } from "../lib/event-logger.js";
 import {
@@ -9,21 +8,36 @@ import {
   executeCallWebhook,
   executeFunction
 } from "../lib/activity-executor.js";
+const WORKFLOW_ACTIVITIES_QUEUE = "workflow-activities";
 const DEFAULT_CONCURRENCY = 1;
 const envConcurrency = process.env.WORKERS_WORKFLOW_ACTIVITIES_CONCURRENCY;
 const metadata = {
-  queue: WORKFLOW_ACTIVITIES_QUEUE_NAME,
+  queue: WORKFLOW_ACTIVITIES_QUEUE,
   id: "workflows:workflow-activities",
   concurrency: envConcurrency ? parseInt(envConcurrency, 10) : DEFAULT_CONCURRENCY
 };
 async function handle(job, ctx) {
   const { payload } = job;
   const startTime = Date.now();
+  const em = ctx.resolve("em");
+  const container = ctx;
+  if (payload.kind === "timer") {
+    console.log(
+      `[workflows:activity-worker] Firing timer for instance ${payload.workflowInstanceId} (job ${ctx.jobId})`
+    );
+    const { fireTimer } = await import("../lib/timer-handler.js");
+    await fireTimer(em, container, {
+      instanceId: payload.workflowInstanceId,
+      stepInstanceId: payload.stepInstanceId,
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId,
+      userId: payload.userId
+    });
+    return;
+  }
   console.log(
     `[workflows:activity-worker] Processing activity ${payload.activityId} (${payload.activityType}) for workflow instance ${payload.workflowInstanceId} (job ${ctx.jobId}, attempt ${ctx.attemptNumber})`
   );
-  const em = ctx.resolve("em");
-  const container = ctx;
   try {
     const instance = await em.findOne(WorkflowInstance, {
       id: payload.workflowInstanceId,
@@ -67,6 +81,8 @@ async function handle(job, ctx) {
           return await executeCallWebhook(payload.activityConfig, activityContext, { signal });
         case "EXECUTE_FUNCTION":
           return await executeFunction(payload.activityConfig, activityContext, container);
+        case "WAIT":
+          return { waited: true };
         default:
           throw new Error(`Unsupported activity type: ${payload.activityType}`);
       }

package/dist/modules/workflows/workers/workflow-activities.worker.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/workflows/workers/workflow-activities.worker.ts"],
-  "sourcesContent": ["/**\n * Workflow Activity Worker\n *\n * Background worker that processes async activities from the workflow queue.\n * Executes activities with timeout, logs events, and triggers workflow resume.\n *\n * This worker is auto-discovered by the queue system and processes jobs from\n * the 'workflow-activities' queue.\n */\n\nimport type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'\nimport { WORKFLOW_ACTIVITIES_QUEUE_NAME, type WorkflowActivityJob } from '../lib/activity-queue-types'\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { AwilixContainer } from 'awilix'\nimport { WorkflowInstance } from '../data/entities'\nimport { logWorkflowEvent } from '../lib/event-logger'\nimport {\n  executeSendEmail,\n  executeCallApi,\n  executeEmitEvent,\n  executeUpdateEntity,\n  executeCallWebhook,\n  executeFunction,\n} from '../lib/activity-executor'\n\n// Worker metadata for auto-discovery\nconst DEFAULT_CONCURRENCY = 1\nconst envConcurrency = process.env.WORKERS_WORKFLOW_ACTIVITIES_CONCURRENCY\n\nexport const metadata: WorkerMeta = {\n  queue: WORKFLOW_ACTIVITIES_QUEUE_NAME,\n  id: 'workflows:workflow-activities',\n  concurrency: envConcurrency ? parseInt(envConcurrency, 10) : DEFAULT_CONCURRENCY,\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\n\n/**\n * Process a workflow activity job.\n *\n * This handler:\n * 1. Fetches the workflow instance\n * 2. Executes the activity by type with timeout support\n * 3. Logs success/failure events to workflow event log\n * 4. Attempts to resume the workflow if all activities complete\n *\n * @param job - The queued job containing activity payload\n * @param ctx - Job context with DI container access\n */\nexport default async function handle(\n  job: QueuedJob<WorkflowActivityJob>,\n  ctx: JobContext & HandlerContext\n): Promise<void> {\n  const { payload } = job\n  const startTime = Date.now()\n\n  console.log(\n    `[workflows:activity-worker] Processing activity ${payload.activityId} (${payload.activityType}) for workflow instance ${payload.workflowInstanceId} (job ${ctx.jobId}, attempt ${ctx.attemptNumber})`\n  )\n\n  // Resolve services from DI container\n  const em = ctx.resolve<EntityManager>('em')\n\n  // Create a container-like object from ctx.resolve for activity executors\n  // The ctx already has the resolve method we need, we just need to cast it\n  const container = ctx as unknown as AwilixContainer\n\n  try {\n    // Fetch workflow instance with tenant/org scoping\n    const instance = await em.findOne(WorkflowInstance, {\n      id: payload.workflowInstanceId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId,\n    })\n\n    if (!instance) {\n      throw new Error(\n        `Workflow instance ${payload.workflowInstanceId} not found (tenant: ${payload.tenantId}, org: ${payload.organizationId})`\n      )\n    }\n\n    // Build activity execution context\n    const activityContext = {\n      workflowInstance: instance,\n      workflowContext: payload.workflowContext,\n      stepContext: payload.stepContext,\n      stepInstanceId: payload.stepInstanceId,\n      userId: payload.userId,\n    }\n\n    // Execute activity by type\n    const executeActivityByType = async (signal?: AbortSignal) => {\n      switch (payload.activityType) {\n        case 'SEND_EMAIL':\n          return await executeSendEmail(payload.activityConfig, activityContext, container)\n        case 'CALL_API':\n          return await executeCallApi(\n            em,\n            payload.activityConfig,\n            activityContext,\n            container,\n            signal\n          )\n        case 'EMIT_EVENT':\n          return await executeEmitEvent(payload.activityConfig, activityContext, container)\n        case 'UPDATE_ENTITY':\n          return await executeUpdateEntity(\n            em,\n            payload.activityConfig,\n            activityContext,\n            container\n          )\n        case 'CALL_WEBHOOK':\n          return await executeCallWebhook(payload.activityConfig, activityContext, { signal })\n        case 'EXECUTE_FUNCTION':\n          return await executeFunction(payload.activityConfig, activityContext, container)\n        default:\n          throw new Error(`Unsupported activity type: ${payload.activityType}`)\n      }\n    }\n\n    // Execute with optional timeout. AbortController aborts in-flight fetches\n    // when the timeout wins the race, preventing phantom executions.\n    let result: any\n    if (payload.timeoutMs && payload.timeoutMs > 0) {\n      const abortController = new AbortController()\n      const timeoutId = setTimeout(() => {\n        abortController.abort()\n      }, payload.timeoutMs)\n\n      try {\n        result = await Promise.race([\n          executeActivityByType(abortController.signal),\n          new Promise((_, reject) =>\n            setTimeout(\n              () => reject(new Error(`Activity timeout after ${payload.timeoutMs}ms`)),\n              payload.timeoutMs\n            )\n          ),\n        ])\n      } finally {\n        clearTimeout(timeoutId)\n      }\n    } else {\n      result = await executeActivityByType()\n    }\n\n    const executionTimeMs = Date.now() - startTime\n\n    // Log success event to workflow event log\n    await logWorkflowEvent(em, {\n      workflowInstanceId: payload.workflowInstanceId,\n      stepInstanceId: payload.stepInstanceId,\n      eventType: 'ACTIVITY_COMPLETED',\n      eventData: {\n        activityId: payload.activityId,\n        activityName: payload.activityName,\n        activityType: payload.activityType,\n        async: true,\n        jobId: ctx.jobId,\n        attemptNumber: ctx.attemptNumber,\n        executionTimeMs,\n        output: result,\n      },\n      userId: payload.userId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId,\n    })\n\n    console.log(\n      `[workflows:activity-worker] Activity ${payload.activityId} (${payload.activityType}) completed successfully for workflow instance ${payload.workflowInstanceId} in ${executionTimeMs}ms`\n    )\n\n    // Attempt to resume workflow if all activities complete\n    await checkAndResumeWorkflow(em, ctx, payload.workflowInstanceId)\n  } catch (error: any) {\n    const executionTimeMs = Date.now() - startTime\n\n    console.error(\n      `[workflows:activity-worker] Activity ${payload.activityId} (${payload.activityType}) failed for workflow instance ${payload.workflowInstanceId} (attempt ${ctx.attemptNumber}):`,\n      error.message\n    )\n\n    // Log failure event to workflow event log\n    await logWorkflowEvent(em, {\n      workflowInstanceId: payload.workflowInstanceId,\n      stepInstanceId: payload.stepInstanceId,\n      eventType: 'ACTIVITY_FAILED',\n      eventData: {\n        activityId: payload.activityId,\n        activityName: payload.activityName,\n        activityType: payload.activityType,\n        async: true,\n        jobId: ctx.jobId,\n        attemptNumber: ctx.attemptNumber,\n        error: error.message,\n        errorStack: error.stack,\n        executionTimeMs,\n      },\n      userId: payload.userId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId,\n    })\n\n    // Check if this was final attempt (BullMQ handles retries automatically)\n    const maxAttempts = payload.retryPolicy?.maxAttempts || 1\n    if (ctx.attemptNumber >= maxAttempts) {\n      console.error(\n        `[workflows:activity-worker] Activity ${payload.activityId} (${payload.activityType}) failed after ${maxAttempts} attempts for workflow instance ${payload.workflowInstanceId} - triggering workflow failure handling`\n      )\n      // Final failure - attempt to resume workflow (may transition to FAILED state)\n      await checkAndResumeWorkflow(em, ctx, payload.workflowInstanceId)\n    }\n\n    // Re-throw to let BullMQ handle retry logic\n    throw error\n  }\n}\n\n/**\n * Helper to check if workflow can resume after activities complete/fail.\n *\n * This function is called after each activity completes or fails.\n * It checks if all pending activities are done and resumes workflow execution.\n *\n * @param em - Entity manager\n * @param ctx - Handler context with resolve method for DI\n * @param workflowInstanceId - Workflow instance ID to resume\n */\nasync function checkAndResumeWorkflow(\n  em: EntityManager,\n  ctx: HandlerContext,\n  workflowInstanceId: string\n): Promise<void> {\n  // Import here to avoid circular dependency\n  const { resumeWorkflowAfterActivities } = await import('../lib/workflow-executor')\n\n  // Cast ctx to AwilixContainer for the resume function\n  const container = ctx as unknown as AwilixContainer\n\n  try {\n    await resumeWorkflowAfterActivities(em, container, workflowInstanceId)\n  } catch (error: any) {\n    // Ignore error if workflow not ready to resume yet (activities still pending)\n    if (!error.message?.includes('Activities still pending')) {\n      console.error(\n        `[workflows:activity-worker] Failed to resume workflow instance ${workflowInstanceId}:`,\n        error.message\n      )\n    }\n  }\n}\n"],
-  "mappings": "AAWA,SAAS,sCAAgE;AAGzE,SAAS,wBAAwB;AACjC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,MAAM,sBAAsB;AAC5B,MAAM,iBAAiB,QAAQ,IAAI;AAE5B,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa,iBAAiB,SAAS,gBAAgB,EAAE,IAAI;AAC/D;AAgBA,eAAO,OACL,KACA,KACe;AACf,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,YAAY,KAAK,IAAI;AAE3B,UAAQ;AAAA,IACN,mDAAmD,QAAQ,UAAU,KAAK,QAAQ,YAAY,2BAA2B,QAAQ,kBAAkB,SAAS,IAAI,KAAK,aAAa,IAAI,aAAa;AAAA,EACrM;AAGA,QAAM,KAAK,IAAI,QAAuB,IAAI;AAI1C,QAAM,YAAY;AAElB,MAAI;AAEF,UAAM,WAAW,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MAClD,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAED,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,qBAAqB,QAAQ,kBAAkB,uBAAuB,QAAQ,QAAQ,UAAU,QAAQ,cAAc;AAAA,MACxH;AAAA,IACF;AAGA,UAAM,kBAAkB;AAAA,MACtB,kBAAkB;AAAA,MAClB,iBAAiB,QAAQ;AAAA,MACzB,aAAa,QAAQ;AAAA,MACrB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ,QAAQ;AAAA,IAClB;AAGA,UAAM,wBAAwB,OAAO,WAAyB;AAC5D,cAAQ,QAAQ,cAAc;AAAA,QAC5B,KAAK;AACH,iBAAO,MAAM,iBAAiB,QAAQ,gBAAgB,iBAAiB,SAAS;AAAA,QAClF,KAAK;AACH,iBAAO,MAAM;AAAA,YACX;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,KAAK;AACH,iBAAO,MAAM,iBAAiB,QAAQ,gBAAgB,iBAAiB,SAAS;AAAA,QAClF,KAAK;AACH,iBAAO,MAAM;AAAA,YACX;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF,KAAK;AACH,iBAAO,MAAM,mBAAmB,QAAQ,gBAAgB,iBAAiB,EAAE,OAAO,CAAC;AAAA,QACrF,KAAK;AACH,iBAAO,MAAM,gBAAgB,QAAQ,gBAAgB,iBAAiB,SAAS;AAAA,QACjF;AACE,gBAAM,IAAI,MAAM,8BAA8B,QAAQ,YAAY,EAAE;AAAA,MACxE;AAAA,IACF;AAIA,QAAI;AACJ,QAAI,QAAQ,aAAa,QAAQ,YAAY,GAAG;AAC9C,YAAM,kBAAkB,IAAI,gBAAgB;AAC5C,YAAM,YAAY,WAAW,MAAM;AACjC,wBAAgB,MAAM;AAAA,MACxB,GAAG,QAAQ,SAAS;AAEpB,UAAI;AACF,iBAAS,MAAM,QAAQ,KAAK;AAAA,UAC1B,sBAAsB,gBAAgB,MAAM;AAAA,UAC5C,IAAI;AAAA,YAAQ,CAAC,GAAG,WACd;AAAA,cACE,MAAM,OAAO,IAAI,MAAM,0BAA0B,QAAQ,SAAS,IAAI,CAAC;AAAA,cACvE,QAAQ;AAAA,YACV;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,SAAS;AAAA,MACxB;AAAA,IACF,OAAO;AACL,eAAS,MAAM,sBAAsB;AAAA,IACvC;AAEA,UAAM,kBAAkB,KAAK,IAAI,IAAI;AAGrC,UAAM,iBAAiB,IAAI;AAAA,MACzB,oBAAoB,QAAQ;AAAA,MAC5B,gBAAgB,QAAQ;AAAA,MACxB,WAAW;AAAA,MACX,WAAW;AAAA,QACT,YAAY,QAAQ;AAAA,QACpB,cAAc,QAAQ;AAAA,QACtB,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP,OAAO,IAAI;AAAA,QACX,eAAe,IAAI;AAAA,QACnB;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAED,YAAQ;AAAA,MACN,wCAAwC,QAAQ,UAAU,KAAK,QAAQ,YAAY,kDAAkD,QAAQ,kBAAkB,OAAO,eAAe;AAAA,IACvL;AAGA,UAAM,uBAAuB,IAAI,KAAK,QAAQ,kBAAkB;AAAA,EAClE,SAAS,OAAY;AACnB,UAAM,kBAAkB,KAAK,IAAI,IAAI;AAErC,YAAQ;AAAA,MACN,wCAAwC,QAAQ,UAAU,KAAK,QAAQ,YAAY,kCAAkC,QAAQ,kBAAkB,aAAa,IAAI,aAAa;AAAA,MAC7K,MAAM;AAAA,IACR;AAGA,UAAM,iBAAiB,IAAI;AAAA,MACzB,oBAAoB,QAAQ;AAAA,MAC5B,gBAAgB,QAAQ;AAAA,MACxB,WAAW;AAAA,MACX,WAAW;AAAA,QACT,YAAY,QAAQ;AAAA,QACpB,cAAc,QAAQ;AAAA,QACtB,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP,OAAO,IAAI;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB;AAAA,MACF;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAGD,UAAM,cAAc,QAAQ,aAAa,eAAe;AACxD,QAAI,IAAI,iBAAiB,aAAa;AACpC,cAAQ;AAAA,QACN,wCAAwC,QAAQ,UAAU,KAAK,QAAQ,YAAY,kBAAkB,WAAW,mCAAmC,QAAQ,kBAAkB;AAAA,MAC/K;AAEA,YAAM,uBAAuB,IAAI,KAAK,QAAQ,kBAAkB;AAAA,IAClE;AAGA,UAAM;AAAA,EACR;AACF;AAYA,eAAe,uBACb,IACA,KACA,oBACe;AAEf,QAAM,EAAE,8BAA8B,IAAI,MAAM,OAAO,0BAA0B;AAGjF,QAAM,YAAY;AAElB,MAAI;AACF,UAAM,8BAA8B,IAAI,WAAW,kBAAkB;AAAA,EACvE,SAAS,OAAY;AAEnB,QAAI,CAAC,MAAM,SAAS,SAAS,0BAA0B,GAAG;AACxD,cAAQ;AAAA,QACN,kEAAkE,kBAAkB;AAAA,QACpF,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Workflow Activity Worker\n *\n * Background worker that processes async activities from the workflow queue.\n * Executes activities with timeout, logs events, and triggers workflow resume.\n *\n * This worker is auto-discovered by the queue system and processes jobs from\n * the 'workflow-activities' queue.\n */\n\nimport type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'\nimport type { WorkflowActivityJob } from '../lib/activity-queue-types'\nimport type { EntityManager } from '@mikro-orm/core'\nimport type { AwilixContainer } from 'awilix'\nimport { WorkflowInstance } from '../data/entities'\nimport { logWorkflowEvent } from '../lib/event-logger'\nimport {\n  executeSendEmail,\n  executeCallApi,\n  executeEmitEvent,\n  executeUpdateEntity,\n  executeCallWebhook,\n  executeFunction,\n} from '../lib/activity-executor'\n\n// Worker metadata for auto-discovery.\n// NOTE: `queue` MUST be a string literal (or locally-declared const) so the\n// generator's AST-based extractor can resolve it when Node cannot import the\n// .ts source file directly. Importing `WORKFLOW_ACTIVITIES_QUEUE_NAME` from\n// another module breaks auto-discovery and silently drops the worker from\n// `modules.generated.ts`.\nconst WORKFLOW_ACTIVITIES_QUEUE = 'workflow-activities'\nconst DEFAULT_CONCURRENCY = 1\nconst envConcurrency = process.env.WORKERS_WORKFLOW_ACTIVITIES_CONCURRENCY\n\nexport const metadata: WorkerMeta = {\n  queue: WORKFLOW_ACTIVITIES_QUEUE,\n  id: 'workflows:workflow-activities',\n  concurrency: envConcurrency ? parseInt(envConcurrency, 10) : DEFAULT_CONCURRENCY,\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\n\n/**\n * Process a workflow activity job.\n *\n * This handler:\n * 1. Fetches the workflow instance\n * 2. Executes the activity by type with timeout support\n * 3. Logs success/failure events to workflow event log\n * 4. Attempts to resume the workflow if all activities complete\n *\n * @param job - The queued job containing activity payload\n * @param ctx - Job context with DI container access\n */\nexport default async function handle(\n  job: QueuedJob<WorkflowActivityJob>,\n  ctx: JobContext & HandlerContext\n): Promise<void> {\n  const { payload } = job\n  const startTime = Date.now()\n\n  // Resolve services from DI container\n  const em = ctx.resolve<EntityManager>('em')\n\n  // Create a container-like object from ctx.resolve for activity executors\n  // The ctx already has the resolve method we need, we just need to cast it\n  const container = ctx as unknown as AwilixContainer\n\n  // Timer jobs (kind: 'timer') are a distinct flow \u2014 they resume a paused\n  // workflow at a WAIT_FOR_TIMER step rather than running an activity.\n  if (payload.kind === 'timer') {\n    console.log(\n      `[workflows:activity-worker] Firing timer for instance ${payload.workflowInstanceId} (job ${ctx.jobId})`\n    )\n    const { fireTimer } = await import('../lib/timer-handler')\n    await fireTimer(em, container, {\n      instanceId: payload.workflowInstanceId,\n      stepInstanceId: payload.stepInstanceId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId,\n      userId: payload.userId,\n    })\n    return\n  }\n\n  console.log(\n    `[workflows:activity-worker] Processing activity ${payload.activityId} (${payload.activityType}) for workflow instance ${payload.workflowInstanceId} (job ${ctx.jobId}, attempt ${ctx.attemptNumber})`\n  )\n\n  try {\n    // Fetch workflow instance with tenant/org scoping\n    const instance = await em.findOne(WorkflowInstance, {\n      id: payload.workflowInstanceId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId,\n    })\n\n    if (!instance) {\n      throw new Error(\n        `Workflow instance ${payload.workflowInstanceId} not found (tenant: ${payload.tenantId}, org: ${payload.organizationId})`\n      )\n    }\n\n    // Build activity execution context\n    const activityContext = {\n      workflowInstance: instance,\n      workflowContext: payload.workflowContext,\n      stepContext: payload.stepContext,\n      stepInstanceId: payload.stepInstanceId,\n      userId: payload.userId,\n    }\n\n    // Execute activity by type\n    const executeActivityByType = async (signal?: AbortSignal) => {\n      switch (payload.activityType) {\n        case 'SEND_EMAIL':\n          return await executeSendEmail(payload.activityConfig, activityContext, container)\n        case 'CALL_API':\n          return await executeCallApi(\n            em,\n            payload.activityConfig,\n            activityContext,\n            container,\n            signal\n          )\n        case 'EMIT_EVENT':\n          return await executeEmitEvent(payload.activityConfig, activityContext, container)\n        case 'UPDATE_ENTITY':\n          return await executeUpdateEntity(\n            em,\n            payload.activityConfig,\n            activityContext,\n            container\n          )\n        case 'CALL_WEBHOOK':\n          return await executeCallWebhook(payload.activityConfig, activityContext, { signal })\n        case 'EXECUTE_FUNCTION':\n          return await executeFunction(payload.activityConfig, activityContext, container)\n        case 'WAIT':\n          // Delay already handled by queue's delayMs \u2014 return success immediately\n          return { waited: true }\n        default:\n          throw new Error(`Unsupported activity type: ${payload.activityType}`)\n      }\n    }\n\n    // Execute with optional timeout. AbortController aborts in-flight fetches\n    // when the timeout wins the race, preventing phantom executions.\n    let result: any\n    if (payload.timeoutMs && payload.timeoutMs > 0) {\n      const abortController = new AbortController()\n      const timeoutId = setTimeout(() => {\n        abortController.abort()\n      }, payload.timeoutMs)\n\n      try {\n        result = await Promise.race([\n          executeActivityByType(abortController.signal),\n          new Promise((_, reject) =>\n            setTimeout(\n              () => reject(new Error(`Activity timeout after ${payload.timeoutMs}ms`)),\n              payload.timeoutMs\n            )\n          ),\n        ])\n      } finally {\n        clearTimeout(timeoutId)\n      }\n    } else {\n      result = await executeActivityByType()\n    }\n\n    const executionTimeMs = Date.now() - startTime\n\n    // Log success event to workflow event log\n    await logWorkflowEvent(em, {\n      workflowInstanceId: payload.workflowInstanceId,\n      stepInstanceId: payload.stepInstanceId,\n      eventType: 'ACTIVITY_COMPLETED',\n      eventData: {\n        activityId: payload.activityId,\n        activityName: payload.activityName,\n        activityType: payload.activityType,\n        async: true,\n        jobId: ctx.jobId,\n        attemptNumber: ctx.attemptNumber,\n        executionTimeMs,\n        output: result,\n      },\n      userId: payload.userId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId,\n    })\n\n    console.log(\n      `[workflows:activity-worker] Activity ${payload.activityId} (${payload.activityType}) completed successfully for workflow instance ${payload.workflowInstanceId} in ${executionTimeMs}ms`\n    )\n\n    // Attempt to resume workflow if all activities complete\n    await checkAndResumeWorkflow(em, ctx, payload.workflowInstanceId)\n  } catch (error: any) {\n    const executionTimeMs = Date.now() - startTime\n\n    console.error(\n      `[workflows:activity-worker] Activity ${payload.activityId} (${payload.activityType}) failed for workflow instance ${payload.workflowInstanceId} (attempt ${ctx.attemptNumber}):`,\n      error.message\n    )\n\n    // Log failure event to workflow event log\n    await logWorkflowEvent(em, {\n      workflowInstanceId: payload.workflowInstanceId,\n      stepInstanceId: payload.stepInstanceId,\n      eventType: 'ACTIVITY_FAILED',\n      eventData: {\n        activityId: payload.activityId,\n        activityName: payload.activityName,\n        activityType: payload.activityType,\n        async: true,\n        jobId: ctx.jobId,\n        attemptNumber: ctx.attemptNumber,\n        error: error.message,\n        errorStack: error.stack,\n        executionTimeMs,\n      },\n      userId: payload.userId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId,\n    })\n\n    // Check if this was final attempt (BullMQ handles retries automatically)\n    const maxAttempts = payload.retryPolicy?.maxAttempts || 1\n    if (ctx.attemptNumber >= maxAttempts) {\n      console.error(\n        `[workflows:activity-worker] Activity ${payload.activityId} (${payload.activityType}) failed after ${maxAttempts} attempts for workflow instance ${payload.workflowInstanceId} - triggering workflow failure handling`\n      )\n      // Final failure - attempt to resume workflow (may transition to FAILED state)\n      await checkAndResumeWorkflow(em, ctx, payload.workflowInstanceId)\n    }\n\n    // Re-throw to let BullMQ handle retry logic\n    throw error\n  }\n}\n\n/**\n * Helper to check if workflow can resume after activities complete/fail.\n *\n * This function is called after each activity completes or fails.\n * It checks if all pending activities are done and resumes workflow execution.\n *\n * @param em - Entity manager\n * @param ctx - Handler context with resolve method for DI\n * @param workflowInstanceId - Workflow instance ID to resume\n */\nasync function checkAndResumeWorkflow(\n  em: EntityManager,\n  ctx: HandlerContext,\n  workflowInstanceId: string\n): Promise<void> {\n  // Import here to avoid circular dependency\n  const { resumeWorkflowAfterActivities } = await import('../lib/workflow-executor')\n\n  // Cast ctx to AwilixContainer for the resume function\n  const container = ctx as unknown as AwilixContainer\n\n  try {\n    await resumeWorkflowAfterActivities(em, container, workflowInstanceId)\n  } catch (error: any) {\n    // Ignore error if workflow not ready to resume yet (activities still pending)\n    if (!error.message?.includes('Activities still pending')) {\n      console.error(\n        `[workflows:activity-worker] Failed to resume workflow instance ${workflowInstanceId}:`,\n        error.message\n      )\n    }\n  }\n}\n"],
+  "mappings": "AAcA,SAAS,wBAAwB;AACjC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP,MAAM,4BAA4B;AAClC,MAAM,sBAAsB;AAC5B,MAAM,iBAAiB,QAAQ,IAAI;AAE5B,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa,iBAAiB,SAAS,gBAAgB,EAAE,IAAI;AAC/D;AAgBA,eAAO,OACL,KACA,KACe;AACf,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,YAAY,KAAK,IAAI;AAG3B,QAAM,KAAK,IAAI,QAAuB,IAAI;AAI1C,QAAM,YAAY;AAIlB,MAAI,QAAQ,SAAS,SAAS;AAC5B,YAAQ;AAAA,MACN,yDAAyD,QAAQ,kBAAkB,SAAS,IAAI,KAAK;AAAA,IACvG;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,sBAAsB;AACzD,UAAM,UAAU,IAAI,WAAW;AAAA,MAC7B,YAAY,QAAQ;AAAA,MACpB,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AACD;AAAA,EACF;AAEA,UAAQ;AAAA,IACN,mDAAmD,QAAQ,UAAU,KAAK,QAAQ,YAAY,2BAA2B,QAAQ,kBAAkB,SAAS,IAAI,KAAK,aAAa,IAAI,aAAa;AAAA,EACrM;AAEA,MAAI;AAEF,UAAM,WAAW,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MAClD,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAED,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,qBAAqB,QAAQ,kBAAkB,uBAAuB,QAAQ,QAAQ,UAAU,QAAQ,cAAc;AAAA,MACxH;AAAA,IACF;AAGA,UAAM,kBAAkB;AAAA,MACtB,kBAAkB;AAAA,MAClB,iBAAiB,QAAQ;AAAA,MACzB,aAAa,QAAQ;AAAA,MACrB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ,QAAQ;AAAA,IAClB;AAGA,UAAM,wBAAwB,OAAO,WAAyB;AAC5D,cAAQ,QAAQ,cAAc;AAAA,QAC5B,KAAK;AACH,iBAAO,MAAM,iBAAiB,QAAQ,gBAAgB,iBAAiB,SAAS;AAAA,QAClF,KAAK;AACH,iBAAO,MAAM;AAAA,YACX;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,KAAK;AACH,iBAAO,MAAM,iBAAiB,QAAQ,gBAAgB,iBAAiB,SAAS;AAAA,QAClF,KAAK;AACH,iBAAO,MAAM;AAAA,YACX;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF,KAAK;AACH,iBAAO,MAAM,mBAAmB,QAAQ,gBAAgB,iBAAiB,EAAE,OAAO,CAAC;AAAA,QACrF,KAAK;AACH,iBAAO,MAAM,gBAAgB,QAAQ,gBAAgB,iBAAiB,SAAS;AAAA,QACjF,KAAK;AAEH,iBAAO,EAAE,QAAQ,KAAK;AAAA,QACxB;AACE,gBAAM,IAAI,MAAM,8BAA8B,QAAQ,YAAY,EAAE;AAAA,MACxE;AAAA,IACF;AAIA,QAAI;AACJ,QAAI,QAAQ,aAAa,QAAQ,YAAY,GAAG;AAC9C,YAAM,kBAAkB,IAAI,gBAAgB;AAC5C,YAAM,YAAY,WAAW,MAAM;AACjC,wBAAgB,MAAM;AAAA,MACxB,GAAG,QAAQ,SAAS;AAEpB,UAAI;AACF,iBAAS,MAAM,QAAQ,KAAK;AAAA,UAC1B,sBAAsB,gBAAgB,MAAM;AAAA,UAC5C,IAAI;AAAA,YAAQ,CAAC,GAAG,WACd;AAAA,cACE,MAAM,OAAO,IAAI,MAAM,0BAA0B,QAAQ,SAAS,IAAI,CAAC;AAAA,cACvE,QAAQ;AAAA,YACV;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,SAAS;AAAA,MACxB;AAAA,IACF,OAAO;AACL,eAAS,MAAM,sBAAsB;AAAA,IACvC;AAEA,UAAM,kBAAkB,KAAK,IAAI,IAAI;AAGrC,UAAM,iBAAiB,IAAI;AAAA,MACzB,oBAAoB,QAAQ;AAAA,MAC5B,gBAAgB,QAAQ;AAAA,MACxB,WAAW;AAAA,MACX,WAAW;AAAA,QACT,YAAY,QAAQ;AAAA,QACpB,cAAc,QAAQ;AAAA,QACtB,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP,OAAO,IAAI;AAAA,QACX,eAAe,IAAI;AAAA,QACnB;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAED,YAAQ;AAAA,MACN,wCAAwC,QAAQ,UAAU,KAAK,QAAQ,YAAY,kDAAkD,QAAQ,kBAAkB,OAAO,eAAe;AAAA,IACvL;AAGA,UAAM,uBAAuB,IAAI,KAAK,QAAQ,kBAAkB;AAAA,EAClE,SAAS,OAAY;AACnB,UAAM,kBAAkB,KAAK,IAAI,IAAI;AAErC,YAAQ;AAAA,MACN,wCAAwC,QAAQ,UAAU,KAAK,QAAQ,YAAY,kCAAkC,QAAQ,kBAAkB,aAAa,IAAI,aAAa;AAAA,MAC7K,MAAM;AAAA,IACR;AAGA,UAAM,iBAAiB,IAAI;AAAA,MACzB,oBAAoB,QAAQ;AAAA,MAC5B,gBAAgB,QAAQ;AAAA,MACxB,WAAW;AAAA,MACX,WAAW;AAAA,QACT,YAAY,QAAQ;AAAA,QACpB,cAAc,QAAQ;AAAA,QACtB,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP,OAAO,IAAI;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB;AAAA,MACF;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAGD,UAAM,cAAc,QAAQ,aAAa,eAAe;AACxD,QAAI,IAAI,iBAAiB,aAAa;AACpC,cAAQ;AAAA,QACN,wCAAwC,QAAQ,UAAU,KAAK,QAAQ,YAAY,kBAAkB,WAAW,mCAAmC,QAAQ,kBAAkB;AAAA,MAC/K;AAEA,YAAM,uBAAuB,IAAI,KAAK,QAAQ,kBAAkB;AAAA,IAClE;AAGA,UAAM;AAAA,EACR;AACF;AAYA,eAAe,uBACb,IACA,KACA,oBACe;AAEf,QAAM,EAAE,8BAA8B,IAAI,MAAM,OAAO,0BAA0B;AAGjF,QAAM,YAAY;AAElB,MAAI;AACF,UAAM,8BAA8B,IAAI,WAAW,kBAAkB;AAAA,EACvE,SAAS,OAAY;AAEnB,QAAI,CAAC,MAAM,SAAS,SAAS,0BAA0B,GAAG;AACxD,cAAQ;AAAA,QACN,kEAAkE,kBAAkB;AAAA,QACpF,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.3-develop.3857.1.da89d7530c",
+  "version": "0.6.3-develop.3881.1.0b590ac4eb",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -243,16 +243,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.3-develop.3857.1.da89d7530c",
-    "@open-mercato/shared": "0.6.3-develop.3857.1.da89d7530c",
-    "@open-mercato/ui": "0.6.3-develop.3857.1.da89d7530c",
+    "@open-mercato/ai-assistant": "0.6.3-develop.3881.1.0b590ac4eb",
+    "@open-mercato/shared": "0.6.3-develop.3881.1.0b590ac4eb",
+    "@open-mercato/ui": "0.6.3-develop.3881.1.0b590ac4eb",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.3-develop.3857.1.da89d7530c",
-    "@open-mercato/shared": "0.6.3-develop.3857.1.da89d7530c",
-    "@open-mercato/ui": "0.6.3-develop.3857.1.da89d7530c",
+    "@open-mercato/ai-assistant": "0.6.3-develop.3881.1.0b590ac4eb",
+    "@open-mercato/shared": "0.6.3-develop.3881.1.0b590ac4eb",
+    "@open-mercato/ui": "0.6.3-develop.3881.1.0b590ac4eb",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/attachments/api/file/[id]/route.ts

@@ -7,7 +7,7 @@ import {
   AttachmentPartition,
 } from "@open-mercato/core/modules/attachments/data/entities";
 import type { EntityManager } from "@mikro-orm/postgresql";
-import { checkAttachmentAccess } from "@open-mercato/core/modules/attachments/lib/access";
+import { checkAttachmentAccess, isSuperAdminAuth } from "@open-mercato/core/modules/attachments/lib/access";
 import { z } from "zod";
 import { attachmentsTag, attachmentErrorSchema } from "../../openapi";
 import {
@@ -38,7 +38,12 @@ export async function GET(
     (resolve("storageDriverFactory") as StorageDriverFactory | null) ??
     new StorageDriverFactory(em);
 
-  const attachment = await em.findOne(Attachment, { id });
+  const findFilter: Record<string, unknown> = { id };
+  if (auth && !isSuperAdminAuth(auth)) {
+    if (auth.tenantId) findFilter.tenantId = auth.tenantId;
+    if (auth.orgId) findFilter.organizationId = auth.orgId;
+  }
+  const attachment = await em.findOne(Attachment, findFilter);
   if (!attachment) {
     return NextResponse.json(
       { error: "Attachment not found" },

package/src/modules/attachments/api/image/[id]/[[...slug]]/route.ts

@@ -11,7 +11,7 @@ import {
   writeThumbnailCache,
 } from '@open-mercato/core/modules/attachments/lib/thumbnailCache'
 import { canRenderInlineAttachment } from '@open-mercato/core/modules/attachments/lib/security'
-import { checkAttachmentAccess } from '@open-mercato/core/modules/attachments/lib/access'
+import { checkAttachmentAccess, isSuperAdminAuth } from '@open-mercato/core/modules/attachments/lib/access'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { attachmentsTag, imageQuerySchema, attachmentErrorSchema } from '../../../openapi'
 import {
@@ -53,9 +53,12 @@ export async function GET(
   const storageDriverFactory =
     (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
 
-  const attachment = await em.findOne(Attachment, {
-    id,
-  })
+  const findFilter: Record<string, unknown> = { id }
+  if (auth && !isSuperAdminAuth(auth)) {
+    if (auth.tenantId) findFilter.tenantId = auth.tenantId
+    if (auth.orgId) findFilter.organizationId = auth.orgId
+  }
+  const attachment = await em.findOne(Attachment, findFilter)
   if (!attachment) {
     return NextResponse.json({ error: 'Not found' }, { status: 404 })
   }

package/src/modules/audit_logs/services/accessLogService.ts

@@ -25,24 +25,191 @@ const NON_CORE_RETENTION_HOURS = toPositiveNumber(process.env.AUDIT_LOGS_NON_COR
 const CORE_RETENTION_MS = CORE_RETENTION_DAYS * 24 * 60 * 60 * 1000
 const NON_CORE_RETENTION_MS = NON_CORE_RETENTION_HOURS * 60 * 60 * 1000
 const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/
+// Postgres has a hard limit of 65k bind parameters per statement. Each access
+// log row uses 10 bind values (see INSERT below), so 500 rows × 10 = 5 000
+// parameters — well below the limit while keeping memory bounded.
+const MAX_BATCH_ROWS = 500
 
 let validationWarningLogged = false
 let runtimeValidationAvailable: boolean | null = null
 
+// Module-level registry of in-flight access-log writes. Both `log` and
+// `logMany` opt every promise they kick off into this set so that
+// `flushAccessLog()` can drain them. This is what makes the new
+// fire-and-forget CRUD path safe for test code that asserts on `access_logs`
+// rows immediately after a response — the integration harness defaults to
+// blocking via `OM_CRUD_ACCESS_LOG_BLOCKING=1`, and direct callers can opt
+// in to draining explicitly via `flushAccessLog()`.
+const pendingAccessLogWrites = new Set<Promise<unknown>>()
+
+function trackPendingAccessLogWrite<T>(promise: Promise<T>): Promise<T> {
+  pendingAccessLogWrites.add(promise as unknown as Promise<unknown>)
+  promise
+    .catch(() => undefined)
+    .finally(() => {
+      pendingAccessLogWrites.delete(promise as unknown as Promise<unknown>)
+    })
+  return promise
+}
+
+export async function flushAccessLog(): Promise<void> {
+  while (pendingAccessLogWrites.size > 0) {
+    const snapshot = Array.from(pendingAccessLogWrites)
+    await Promise.allSettled(snapshot)
+  }
+}
+
 const isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')
 
+type RawEncryptedFields = {
+  resourceKind?: unknown
+  resourceId?: unknown
+  accessType?: unknown
+  fieldsJson?: unknown
+  contextJson?: unknown
+}
+
+function serializeJsonColumn(value: unknown): string | null {
+  if (value === null || value === undefined) return null
+  if (typeof value === 'string') {
+    try {
+      JSON.parse(value)
+      return value
+    } catch {
+      return JSON.stringify(value)
+    }
+  }
+  try {
+    return JSON.stringify(value)
+  } catch {
+    return null
+  }
+}
+
 export class AccessLogService {
   constructor(private readonly em: EntityManager) {}
 
   async log(input: AccessLogCreateInput): Promise<AccessLog | null> {
-    let data: AccessLogCreateInput
+    const promise = this.logInternal(input)
+    return trackPendingAccessLogWrite(promise)
+  }
+
+  async logMany(inputs: AccessLogCreateInput[]): Promise<number> {
+    if (!Array.isArray(inputs) || inputs.length === 0) return 0
+    const promise = this.logManyInternal(inputs)
+    return trackPendingAccessLogWrite(promise)
+  }
+
+  flush(): Promise<void> {
+    return flushAccessLog()
+  }
+
+  private async logManyInternal(inputs: AccessLogCreateInput[]): Promise<number> {
+    // Parsing in parallel matches the legacy fan-out `Promise.all(map(...service.log()))`
+    // path's wall-clock; the previous sequential loop made batched writes slower than
+    // un-batched on tenants with encryption enabled and pushed UI integration tests
+    // over their dialog-stability budget.
+    const parsedResults = await Promise.all(inputs.map((input) => this.parseInput(input)))
+    const normalized: AccessLogCreateInput[] = []
+    for (const parsed of parsedResults) {
+      if (parsed) normalized.push(parsed)
+    }
+    if (!normalized.length) return 0
+
+    let written = 0
+    for (let offset = 0; offset < normalized.length; offset += MAX_BATCH_ROWS) {
+      const chunk = normalized.slice(offset, offset + MAX_BATCH_ROWS)
+      written += await this.writeChunk(chunk)
+    }
+    if (written > 0) {
+      const fork = this.em.fork({ useContext: true })
+      await this.rotate(fork)
+    }
+    return written
+  }
+
+  private async writeChunk(chunk: AccessLogCreateInput[]): Promise<number> {
+    if (!chunk.length) return 0
+    const fork = this.em.fork({ useContext: true })
+    const encryption = resolveTenantEncryptionService(fork as any)
+    const createdAt = new Date()
+
+    // Encrypt every row in parallel so encryption-enabled tenants do not pay
+    // the N-rows × per-row latency penalty that the previous sequential
+    // for-of loop introduced. The legacy `service.log()` fan-out resolved
+    // its 50 encryption calls concurrently via `Promise.all`; preserve that
+    // characteristic here so the batched single-INSERT path is strictly
+    // faster than the legacy parallel-INSERTs path.
+    type PreparedRow = {
+      tenantId: string | null
+      organizationId: string | null
+      data: AccessLogCreateInput
+      fields: unknown[] | null
+      context: Record<string, unknown> | null
+      encrypted: RawEncryptedFields | null
+    }
+    const prepared: PreparedRow[] = await Promise.all(
+      chunk.map(async (data) => {
+        const fields = Array.isArray(data.fields) && data.fields.length ? data.fields : null
+        const context = data.context && Object.keys(data.context).length ? data.context : null
+        const tenantId = data.tenantId ?? null
+        const organizationId = data.organizationId ?? null
+        const encrypted = encryption
+          ? ((await encryption.encryptEntityPayload(
+              E.audit_logs.access_log,
+              {
+                resourceKind: data.resourceKind,
+                resourceId: data.resourceId,
+                accessType: data.accessType,
+                fieldsJson: fields,
+                contextJson: context,
+              },
+              tenantId,
+              organizationId,
+            )) as RawEncryptedFields)
+          : null
+        return { tenantId, organizationId, data, fields, context, encrypted }
+      }),
+    )
+
+    const placeholders: string[] = []
+    const params: unknown[] = []
+    for (const row of prepared) {
+      const { tenantId, organizationId, data, fields, context, encrypted } = row
+      const resourceKindOut = encrypted?.resourceKind ?? data.resourceKind
+      const resourceIdOut = encrypted?.resourceId ?? data.resourceId
+      const accessTypeOut = encrypted?.accessType ?? data.accessType
+      const fieldsOut = encrypted?.fieldsJson ?? fields
+      const contextOut = encrypted?.contextJson ?? context
+      placeholders.push('(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+      params.push(
+        tenantId,
+        organizationId,
+        data.actorUserId ?? null,
+        resourceKindOut,
+        resourceIdOut,
+        accessTypeOut,
+        serializeJsonColumn(fieldsOut),
+        serializeJsonColumn(contextOut),
+        createdAt,
+        null,
+      )
+    }
+    if (!placeholders.length) return 0
+    const sql = `insert into "access_logs" ("tenant_id", "organization_id", "actor_user_id", "resource_kind", "resource_id", "access_type", "fields_json", "context_json", "created_at", "deleted_at") values ${placeholders.join(', ')}`
+    await fork.getConnection().execute(sql, params)
+    return chunk.length
+  }
+
+  private async parseInput(input: AccessLogCreateInput): Promise<AccessLogCreateInput | null> {
     const schema = accessLogCreateSchema as typeof accessLogCreateSchema & { _zod?: unknown }
     const canValidate = Boolean(schema && typeof schema.parse === 'function')
     const shouldValidate = canValidate && runtimeValidationAvailable !== false
     if (shouldValidate) {
       try {
-        data = schema.parse(input)
+        const data = schema.parse(input)
         runtimeValidationAvailable = true
+        return data
       } catch (err) {
         if (!isZodRuntimeMissing(err) && !validationWarningLogged) {
           validationWarningLogged = true
@@ -50,11 +217,15 @@ export class AccessLogService {
           console.warn('[audit_logs] falling back to permissive access log payload parser', err)
         }
         if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false
-        data = this.normalizeInput(input)
+        return this.normalizeInput(input)
       }
-    } else {
-      data = this.normalizeInput(input)
     }
+    return this.normalizeInput(input)
+  }
+
+  private async logInternal(input: AccessLogCreateInput): Promise<AccessLog | null> {
+    const data = await this.parseInput(input)
+    if (!data) return null
     const fork = this.em.fork({ useContext: true })
     const fields = Array.isArray(data.fields) && data.fields.length ? data.fields : null
     const context = data.context && Object.keys(data.context).length ? data.context : null
@@ -62,13 +233,6 @@ export class AccessLogService {
     const tenantId = data.tenantId ?? null
     const organizationId = data.organizationId ?? null
 
-    type AccessLogEncryptedFields = {
-      resourceKind?: unknown
-      resourceId?: unknown
-      accessType?: unknown
-      fieldsJson?: unknown
-      contextJson?: unknown
-    }
     const encryption = resolveTenantEncryptionService(fork as any)
     const encrypted = encryption
       ? ((await encryption.encryptEntityPayload(
@@ -82,7 +246,7 @@ export class AccessLogService {
           },
           tenantId,
           organizationId,
-        )) as AccessLogEncryptedFields)
+        )) as RawEncryptedFields)
       : null
 
     const payload = {
@@ -102,8 +266,8 @@ export class AccessLogService {
         payload.resourceKind,
         payload.resourceId,
         payload.accessType,
-        payload.fieldsJson !== null && payload.fieldsJson !== undefined ? JSON.stringify(payload.fieldsJson) : null,
-        payload.contextJson !== null && payload.contextJson !== undefined ? JSON.stringify(payload.contextJson) : null,
+        serializeJsonColumn(payload.fieldsJson),
+        serializeJsonColumn(payload.contextJson),
         createdAt,
         null,
       ],

package/src/modules/auth/di.ts

@@ -1,11 +1,34 @@
-import { asClass } from 'awilix'
+import { asClass, asFunction } from 'awilix'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { CacheStrategy } from '@open-mercato/cache'
 import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
 import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import {
+  createRbacFallbackCache,
+  isRbacDefaultCacheEnabled,
+  resetRbacFallbackCache,
+} from '@open-mercato/core/modules/auth/services/rbacDefaultCache'
+
+export { resetRbacFallbackCache }
 
 export function register(container: AppContainer) {
   // Register or override core auth service
   container.register({ authService: asClass(AuthService).scoped() })
-  // RBAC service
-  container.register({ rbacService: asClass(RbacService).scoped() })
+  // RBAC service. The bare `asClass(...).scoped()` registration matches
+  // develop and is the default. Setting `OM_RBAC_DEFAULT_CACHE=on` opts
+  // into the in-process LRU fallback for deployments that don't wire a
+  // shared CacheStrategy (CLI scripts, lean test bootstraps). Production
+  // bootstraps that already register `cache` via `@open-mercato/cache`
+  // preempt this fallback because the container's existing `cache`
+  // registration wins when `RbacService` reaches for it.
+  if (isRbacDefaultCacheEnabled()) {
+    container.register({
+      rbacService: asFunction((cradle: { em: EntityManager; cache?: CacheStrategy }) => {
+        return new RbacService(cradle.em, cradle.cache ?? createRbacFallbackCache())
+      }).scoped(),
+    })
+  } else {
+    container.register({ rbacService: asClass(RbacService).scoped() })
+  }
 }

package/src/modules/auth/services/rbacDefaultCache.ts

@@ -0,0 +1,145 @@
+import type { CacheStrategy, CacheValue, CacheSetOptions, CacheGetOptions } from '@open-mercato/cache'
+
+/**
+ * Process-scoped fallback CacheStrategy for RbacService.
+ *
+ * Used only when no shared `cache` service is registered in DI
+ * (CLI scripts, lean test bootstraps, isolated unit harnesses). Production
+ * deployments wire `@open-mercato/cache` via bootstrap.ts, which preempts
+ * this fallback.
+ *
+ * Goals:
+ *  - Match the CacheStrategy contract that RbacService consumes (`get`,
+ *    `set`, `has`, `delete`, `deleteByTags`, `clear`).
+ *  - Bound memory: LRU eviction at MAX_ENTRIES.
+ *  - Honor `OM_RBAC_DEFAULT_CACHE=off` so callers can disable it explicitly.
+ *  - Stay process-scoped via `globalThis` so HMR / module duplication does
+ *    not produce divergent caches (same pattern as registerDiRegistrars).
+ */
+
+type FallbackEntry = {
+  value: CacheValue
+  tags: string[]
+  expiresAt: number | null
+}
+
+type FallbackCache = CacheStrategy & {
+  __reset: () => void
+}
+
+const GLOBAL_KEY = '__openMercatoRbacFallbackCache__'
+const MAX_ENTRIES = 5000
+
+export function isRbacDefaultCacheEnabled(): boolean {
+  // Default OFF — same gating posture as Phases 2/4/5 in this PR. The
+  // integration runtime stays on the bare `asClass(RbacService).scoped()`
+  // path (matching develop) unless an operator opts in explicitly.
+  // Set `OM_RBAC_DEFAULT_CACHE=on` (or `1`/`true`/`yes`) to enable the
+  // in-process LRU fallback.
+  const raw = process.env.OM_RBAC_DEFAULT_CACHE
+  if (raw === undefined) return false
+  const normalized = raw.trim().toLowerCase()
+  if (!normalized.length) return false
+  return normalized === 'on' || normalized === '1' || normalized === 'true' || normalized === 'yes'
+}
+
+function nowMs(): number {
+  return Date.now()
+}
+
+function createCache(): FallbackCache {
+  const store = new Map<string, FallbackEntry>()
+  const touch = (key: string) => {
+    const entry = store.get(key)
+    if (!entry) return undefined
+    if (entry.expiresAt !== null && entry.expiresAt < nowMs()) {
+      store.delete(key)
+      return undefined
+    }
+    // Move to most-recently-used position (Map preserves insertion order).
+    store.delete(key)
+    store.set(key, entry)
+    return entry
+  }
+  const evictIfNeeded = () => {
+    while (store.size > MAX_ENTRIES) {
+      const oldest = store.keys().next().value
+      if (typeof oldest !== 'string') break
+      store.delete(oldest)
+    }
+  }
+  const cache: FallbackCache = {
+    async get(key: string, _options?: CacheGetOptions): Promise<CacheValue | null> {
+      const entry = touch(key)
+      return entry ? entry.value : null
+    },
+    async set(key: string, value: CacheValue, options?: CacheSetOptions): Promise<void> {
+      const ttl = options?.ttl ?? null
+      store.delete(key)
+      store.set(key, {
+        value,
+        tags: options?.tags ?? [],
+        expiresAt: typeof ttl === 'number' && ttl > 0 ? nowMs() + ttl : null,
+      })
+      evictIfNeeded()
+    },
+    async has(key: string): Promise<boolean> {
+      return touch(key) !== undefined
+    },
+    async delete(key: string): Promise<boolean> {
+      return store.delete(key)
+    },
+    async deleteByTags(tags: string[]): Promise<number> {
+      if (!tags.length) return 0
+      const tagSet = new Set(tags)
+      let removed = 0
+      for (const [key, entry] of store.entries()) {
+        if (entry.tags.some((tag) => tagSet.has(tag))) {
+          store.delete(key)
+          removed += 1
+        }
+      }
+      return removed
+    },
+    async clear(): Promise<number> {
+      const count = store.size
+      store.clear()
+      return count
+    },
+    async keys(pattern?: string): Promise<string[]> {
+      if (!pattern) return Array.from(store.keys())
+      const matcher = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.')
+      const regex = new RegExp(`^${matcher}$`)
+      return Array.from(store.keys()).filter((key) => regex.test(key))
+    },
+    async size(): Promise<number> {
+      return store.size
+    },
+    async stats(): Promise<{ size: number; expired: number }> {
+      const now = nowMs()
+      let expired = 0
+      for (const entry of store.values()) {
+        if (entry.expiresAt !== null && entry.expiresAt < now) expired += 1
+      }
+      return { size: store.size, expired }
+    },
+    __reset() {
+      store.clear()
+    },
+  } as FallbackCache
+  return cache
+}
+
+export function createRbacFallbackCache(): CacheStrategy {
+  const existing = (globalThis as any)[GLOBAL_KEY] as FallbackCache | undefined
+  if (existing) return existing
+  const cache = createCache()
+  ;(globalThis as any)[GLOBAL_KEY] = cache
+  return cache
+}
+
+/** Test-only helper. Clears the process-scoped fallback cache. */
+export function resetRbacFallbackCache(): void {
+  const existing = (globalThis as any)[GLOBAL_KEY] as FallbackCache | undefined
+  existing?.__reset()
+}

package/src/modules/currencies/api/currencies/route.ts

@@ -172,10 +172,9 @@ export async function GET(req: Request) {
     orderBy.code = 'ASC'
   }
 
-  const [all, total] = await em.findAndCount(Currency, filter, { orderBy })
-  const start = (page - 1) * pageSize
-  const paged = all.slice(start, start + pageSize)
-  const items = paged.map(toRow)
+  const offset = (page - 1) * pageSize
+  const [rows, total] = await em.findAndCount(Currency, filter, { orderBy, limit: pageSize, offset })
+  const items = rows.map(toRow)
   const totalPages = Math.max(1, Math.ceil(total / pageSize))
 
   return NextResponse.json({ items, total, page, pageSize, totalPages })

package/src/modules/currencies/api/exchange-rates/route.ts

@@ -169,10 +169,9 @@ export async function GET(req: Request) {
     orderBy.date = 'DESC'
   }
 
-  const [all, total] = await em.findAndCount(ExchangeRate, where, { orderBy })
-  const start = (page - 1) * pageSize
-  const paged = all.slice(start, start + pageSize)
-  const items = paged.map(toRow)
+  const offset = (page - 1) * pageSize
+  const [rows, total] = await em.findAndCount(ExchangeRate, where, { orderBy, limit: pageSize, offset })
+  const items = rows.map(toRow)
   const totalPages = Math.max(1, Math.ceil(total / pageSize))
 
   return NextResponse.json({ items, total, page, pageSize, totalPages })