npm - @open-mercato/core - Versions diffs - 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4 - Mend

@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1795) hide show

package/dist/modules/customer_accounts/backend/customer_accounts/users/page.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/backend/customer_accounts/users/page.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Globe, Settings } from 'lucide-react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { ColumnDef } from '@tanstack/react-table'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Dialog, DialogContent, DialogHeader, DialogTitle } from '@open-mercato/ui/primitives/dialog'\nimport { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\n\ntype UserRow = {\n  id: string\n  displayName: string\n  email: string\n  emailVerified: boolean\n  isActive: boolean\n  lastLoginAt: string | null\n  roles: Array<{ id: string; name: string; slug: string }>\n  createdAt: string\n  personEntityId: string | null\n  customerEntityId: string | null\n}\n\ntype UsersResponse = {\n  items?: UserRow[]\n  total?: number\n  totalPages?: number\n}\n\nfunction formatDate(value: string | null | undefined, fallback: string): string {\n  if (!value) return fallback\n  const date = new Date(value)\n  if (Number.isNaN(date.getTime())) return fallback\n  return date.toLocaleDateString()\n}\n\nasync function fetchRoleFilterOptions(): Promise<Array<{ value: string; label: string; id: string }>> {\n  try {\n    const call = await apiCall<{ items?: Array<{ id: string; name: string }> }>(\n      '/api/customer_accounts/admin/roles?pageSize=100',\n    )\n    if (!call.ok) return []\n    const items = Array.isArray(call.result?.items) ? call.result!.items : []\n    return items\n      .filter((item) => typeof item?.id === 'string' && typeof item?.name === 'string')\n      .map((item) => ({ value: item.id, label: item.name, id: item.id }))\n  } catch {\n    return []\n  }\n}\n\nfunction CreateUserDialog({\n  open,\n  onOpenChange,\n  roleOptions,\n  onCreated,\n  onRunMutation,\n}: {\n  open: boolean\n  onOpenChange: (next: boolean) => void\n  roleOptions: Array<{ id: string; label: string }>\n  onCreated: () => void\n  onRunMutation: <T>(operation: () => Promise<T>) => Promise<T>\n}) {\n  const t = useT()\n  const [email, setEmail] = React.useState('')\n  const [displayName, setDisplayName] = React.useState('')\n  const [password, setPassword] = React.useState('')\n  const [selectedRoleIds, setSelectedRoleIds] = React.useState<string[]>([])\n  const [isSubmitting, setIsSubmitting] = React.useState(false)\n\n  const resetForm = React.useCallback(() => {\n    setEmail('')\n    setDisplayName('')\n    setPassword('')\n    setSelectedRoleIds([])\n  }, [])\n\n  const handleSubmit = React.useCallback(async (event: React.FormEvent) => {\n    event.preventDefault()\n    if (!email.trim() || !displayName.trim() || !password.trim()) {\n      flash(t('customer_accounts.admin.createUser.error.required', 'Email, name, and password are required'), 'error')\n      return\n    }\n    setIsSubmitting(true)\n    try {\n      await onRunMutation(async () => {\n        const call = await apiCall<{ ok: boolean; error?: string }>(\n          '/api/customer_accounts/admin/users',\n          {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({\n              email: email.trim(),\n              displayName: displayName.trim(),\n              password,\n              roleIds: selectedRoleIds.length > 0 ? selectedRoleIds : undefined,\n            }),\n          },\n        )\n        if (!call.ok) {\n          flash(call.result?.error || t('customer_accounts.admin.createUser.error.save', 'Failed to create user'), 'error')\n          return\n        }\n        flash(t('customer_accounts.admin.createUser.flash.created', 'User created'), 'success')\n        resetForm()\n        onOpenChange(false)\n        onCreated()\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.createUser.error.save', 'Failed to create user')\n      flash(message, 'error')\n    } finally {\n      setIsSubmitting(false)\n    }\n  }, [displayName, email, onCreated, onOpenChange, onRunMutation, password, resetForm, selectedRoleIds, t])\n\n  const handleKeyDown = React.useCallback((event: React.KeyboardEvent) => {\n    if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {\n      event.preventDefault()\n      const form = (event.target as HTMLElement).closest('form')\n      if (form) form.requestSubmit()\n    }\n  }, [])\n\n  return (\n    <Dialog open={open} onOpenChange={(next) => { if (!next) resetForm(); onOpenChange(next) }}>\n      <DialogContent className=\"sm:max-w-lg\">\n        <DialogHeader>\n          <DialogTitle>{t('customer_accounts.admin.createUser.title', 'Create Customer User')}</DialogTitle>\n        </DialogHeader>\n        <form onSubmit={(event) => { void handleSubmit(event) }} onKeyDown={handleKeyDown} className=\"space-y-4\">\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-email\">\n              {t('customer_accounts.admin.createUser.fields.email', 'Email')}\n            </label>\n            <EmailInput\n              id=\"create-email\"\n              required\n              value={email}\n              onChange={(event) => setEmail(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.emailPlaceholder', 'user@example.com')}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-name\">\n              {t('customer_accounts.admin.createUser.fields.displayName', 'Display Name')}\n            </label>\n            <Input\n              id=\"create-name\"\n              type=\"text\"\n              required\n              value={displayName}\n              onChange={(event) => setDisplayName(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.displayNamePlaceholder', 'John Doe')}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-password\">\n              {t('customer_accounts.admin.createUser.fields.password', 'Password')}\n            </label>\n            <PasswordInput\n              id=\"create-password\"\n              required\n              minLength={8}\n              value={password}\n              onChange={(event) => setPassword(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.passwordPlaceholder', 'Min. 8 characters')}\n              autoComplete=\"new-password\"\n            />\n          </div>\n          {roleOptions.length > 0 && (\n            <div className=\"space-y-2\">\n              <p className=\"text-sm font-medium\">{t('customer_accounts.admin.createUser.fields.roles', 'Roles')}</p>\n              <div className=\"flex flex-wrap gap-2\">\n                {roleOptions.map((role) => {\n                  const isSelected = selectedRoleIds.includes(role.id)\n                  return (\n                    <button\n                      key={role.id}\n                      type=\"button\"\n                      onClick={() => setSelectedRoleIds((prev) =>\n                        prev.includes(role.id) ? prev.filter((rid) => rid !== role.id) : [...prev, role.id],\n                      )}\n                      className={`rounded-full border px-3 py-1 text-xs font-medium transition-colors ${\n                        isSelected\n                          ? 'border-primary bg-primary/10 text-primary'\n                          : 'border-border bg-background text-muted-foreground hover:bg-muted'\n                      }`}\n                    >\n                      {role.label}\n                    </button>\n                  )\n                })}\n              </div>\n            </div>\n          )}\n          <div className=\"flex justify-end gap-2 pt-2\">\n            <Button type=\"button\" variant=\"outline\" onClick={() => { resetForm(); onOpenChange(false) }}>\n              {t('customer_accounts.admin.createUser.actions.cancel', 'Cancel')}\n            </Button>\n            <Button type=\"submit\" disabled={isSubmitting}>\n              {isSubmitting\n                ? t('customer_accounts.admin.createUser.actions.creating', 'Creating...')\n                : t('customer_accounts.admin.createUser.actions.create', 'Create User')}\n            </Button>\n          </div>\n        </form>\n      </DialogContent>\n    </Dialog>\n  )\n}\n\nexport default function CustomerAccountsPage() {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const t = useT()\n  const router = useRouter()\n  const [rows, setRows] = React.useState<UserRow[]>([])\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const [roleOptions, setRoleOptions] = React.useState<Array<{ value: string; label: string; id: string }>>([])\n  const [createDialogOpen, setCreateDialogOpen] = React.useState(false)\n\n  const { runMutation, retryLastMutation } = useGuardedMutation<{\n    entityType: string\n    entityId?: string\n  }>({\n    contextId: 'customer_accounts:users-list',\n  })\n\n  const runMutationWithContext = React.useCallback(\n    async <T,>(operation: () => Promise<T>, mutationPayload?: Record<string, unknown>): Promise<T> => {\n      return runMutation({\n        operation,\n        mutationPayload,\n        context: { entityType: 'customer_accounts:user' },\n      })\n    },\n    [runMutation],\n  )\n\n  React.useEffect(() => {\n    let cancelled = false\n    fetchRoleFilterOptions().then((opts) => {\n      if (!cancelled) setRoleOptions(opts)\n    })\n    return () => { cancelled = true }\n  }, [])\n\n  const filters = React.useMemo<FilterDef[]>(() => [\n    {\n      id: 'status',\n      label: t('customer_accounts.admin.filters.status', 'Status'),\n      type: 'select',\n      options: [\n        { value: 'active', label: t('customer_accounts.admin.filters.active', 'Active') },\n        { value: 'inactive', label: t('customer_accounts.admin.filters.inactive', 'Inactive') },\n      ],\n    },\n    {\n      id: 'roleId',\n      label: t('customer_accounts.admin.filters.role', 'Role'),\n      type: 'select',\n      options: roleOptions,\n    },\n  ], [roleOptions, t])\n\n  const queryParams = React.useMemo(() => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    if (search.trim()) params.set('search', search.trim())\n    const status = filterValues.status\n    if (typeof status === 'string' && status.trim()) params.set('status', status)\n    const roleId = filterValues.roleId\n    if (typeof roleId === 'string' && roleId.trim()) params.set('roleId', roleId)\n    return params.toString()\n  }, [filterValues, page, pageSize, search])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const fallback: UsersResponse = { items: [], total: 0, totalPages: 1 }\n        const payload = await readApiResultOrThrow<UsersResponse>(\n          `/api/customer_accounts/admin/users?${queryParams}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.error.loadUsers', 'Failed to load customer users'), fallback },\n        )\n        if (cancelled) return\n        const items = Array.isArray(payload?.items) ? payload.items : []\n        setRows(items)\n        setTotal(typeof payload?.total === 'number' ? payload.total : items.length)\n        setTotalPages(typeof payload?.totalPages === 'number' ? payload.totalPages : 1)\n      } catch (err) {\n        if (!cancelled) {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.loadUsers', 'Failed to load customer users')\n          flash(message, 'error')\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [queryParams, reloadToken, t])\n\n  const handleToggleActive = React.useCallback(async (user: UserRow) => {\n    const nextActive = !user.isActive\n    const actionLabel = nextActive\n      ? t('customer_accounts.admin.actions.activate', 'Activate')\n      : t('customer_accounts.admin.actions.deactivate', 'Deactivate')\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.confirm.toggleActive', '{{action}} user \"{{name}}\"?', {\n        action: actionLabel,\n        name: user.displayName || user.email,\n      }),\n      variant: nextActive ? 'default' : 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      await runMutationWithContext(async () => {\n        const call = await apiCall(\n          `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,\n          {\n            method: 'PUT',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({ isActive: nextActive }),\n          },\n        )\n        if (!call.ok) {\n          flash(t('customer_accounts.admin.error.toggleActive', 'Failed to update user status'), 'error')\n          return\n        }\n        flash(\n          nextActive\n            ? t('customer_accounts.admin.flash.activated', 'User activated')\n            : t('customer_accounts.admin.flash.deactivated', 'User deactivated'),\n          'success',\n        )\n        setReloadToken((token) => token + 1)\n      }, { userId: user.id, isActive: nextActive })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.toggleActive', 'Failed to update user status')\n      flash(message, 'error')\n    }\n  }, [confirm, runMutationWithContext, t])\n\n  const handleDelete = React.useCallback(async (user: UserRow) => {\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.confirm.delete', 'Delete user \"{{name}}\"?', {\n        name: user.displayName || user.email,\n      }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      await runMutationWithContext(async () => {\n        const call = await apiCall(\n          `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,\n          { method: 'DELETE' },\n        )\n        if (!call.ok) {\n          flash(t('customer_accounts.admin.error.delete', 'Failed to delete user'), 'error')\n          return\n        }\n        flash(t('customer_accounts.admin.flash.deleted', 'User deleted'), 'success')\n        setReloadToken((token) => token + 1)\n      }, { id: user.id })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.delete', 'Failed to delete user')\n      flash(message, 'error')\n    }\n  }, [confirm, runMutationWithContext, t])\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    setFilterValues(values)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const columns = React.useMemo<ColumnDef<UserRow>[]>(() => {\n    const noValue = <span className=\"text-muted-foreground text-sm\">-</span>\n    return [\n      {\n        accessorKey: 'displayName',\n        header: t('customer_accounts.admin.columns.displayName', 'Name'),\n        cell: ({ row }) => (\n          <Link\n            href={`/backend/customer_accounts/users/${row.original.id}`}\n            className=\"font-medium hover:underline\"\n          >\n            {row.original.displayName || row.original.email}\n          </Link>\n        ),\n      },\n      {\n        accessorKey: 'email',\n        header: t('customer_accounts.admin.columns.email', 'Email'),\n      },\n      {\n        accessorKey: 'emailVerified',\n        header: t('customer_accounts.admin.columns.emailVerified', 'Verified'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${\n            row.original.emailVerified\n              ? 'bg-status-success-bg text-status-success-text'\n              : 'bg-status-warning-bg text-status-warning-text'\n          }`}>\n            {row.original.emailVerified\n              ? t('customer_accounts.admin.verified', 'Yes')\n              : t('customer_accounts.admin.unverified', 'No')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'isActive',\n        header: t('customer_accounts.admin.columns.status', 'Status'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${\n            row.original.isActive\n              ? 'bg-status-success-bg text-status-success-text'\n              : 'bg-status-error-bg text-status-error-text'\n          }`}>\n            {row.original.isActive\n              ? t('customer_accounts.admin.active', 'Active')\n              : t('customer_accounts.admin.inactive', 'Inactive')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'lastLoginAt',\n        header: t('customer_accounts.admin.columns.lastLogin', 'Last Login'),\n        cell: ({ row }) => formatDate(row.original.lastLoginAt, '-') || noValue,\n      },\n      {\n        accessorKey: 'roles',\n        header: t('customer_accounts.admin.columns.roles', 'Roles'),\n        cell: ({ row }) => {\n          const roles = row.original.roles\n          if (!roles || !roles.length) return noValue\n          return <span className=\"text-sm\">{roles.map((r) => r.name).join(', ')}</span>\n        },\n      },\n      {\n        accessorKey: 'createdAt',\n        header: t('customer_accounts.admin.columns.createdAt', 'Created'),\n        cell: ({ row }) => formatDate(row.original.createdAt, '-'),\n      },\n    ]\n  }, [t])\n\n  return (\n    <Page>\n      <PageBody className=\"space-y-4\">\n        <div className=\"rounded-lg border border-status-info-border bg-status-info-bg p-4\">\n          <div className=\"flex items-start justify-between gap-4\">\n            <div>\n              <h3 className=\"text-sm font-medium text-status-info-text\">\n                {t('customer_accounts.admin.portalInfo.title', 'Customer Portal')}\n              </h3>\n              <p className=\"mt-1 text-sm text-status-info-text\">\n                {t('customer_accounts.admin.portalInfo.description', 'Manage customer portal accounts. Customers can self-register, log in, and access orders, quotes, and invoices through the portal.')}\n              </p>\n              <p className=\"mt-1.5 text-xs text-status-info-text\">\n                {t('customer_accounts.admin.portalInfo.url', 'Portal URL: {url}', {\n                  url: `${typeof window !== 'undefined' ? window.location.origin : ''}/[org-slug]/portal`,\n                })}\n              </p>\n              <p className=\"mt-0.5 text-xs text-status-info-text\">\n                {t('customer_accounts.admin.portalInfo.credentials', 'Demo credentials: alice.johnson@example.com / password123')}\n              </p>\n            </div>\n            <div className=\"flex shrink-0 flex-col gap-2\">\n              <Button\n                type=\"button\"\n                variant=\"outline\"\n                size=\"sm\"\n                asChild\n              >\n                <Link href=\"/backend/customer_accounts/settings\">\n                  <Settings className=\"size-4\" />\n                  {t('customer_accounts.admin.portalInfo.openConfiguration', 'Open Configuration')}\n                </Link>\n              </Button>\n              <Button\n                type=\"button\"\n                variant=\"outline\"\n                size=\"sm\"\n                asChild\n              >\n                <a href={`${typeof window !== 'undefined' ? window.location.origin : ''}/portal`} target=\"_blank\" rel=\"noopener noreferrer\">\n                  <Globe className=\"size-4\" />\n                  {t('customer_accounts.admin.portalInfo.open', 'Open Portal')}\n                </a>\n              </Button>\n            </div>\n          </div>\n        </div>\n        <DataTable<UserRow>\n          stickyActionsColumn\n          title={t('customer_accounts.admin.title', 'Users')}\n          actions={(\n            <Button onClick={() => setCreateDialogOpen(true)}>\n              {t('customer_accounts.admin.actions.createUser', 'Create User')}\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          searchValue={search}\n          onSearchChange={(value) => { setSearch(value); setPage(1) }}\n          searchPlaceholder={t('customer_accounts.admin.searchPlaceholder', 'Search by name or email...')}\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          perspective={{ tableId: 'customer_accounts.admin.users' }}\n          onRowClick={(row) => router.push(`/backend/customer_accounts/users/${row.id}`)}\n          rowActions={(row) => (\n            <RowActions\n              items={[\n                {\n                  id: 'view',\n                  label: t('customer_accounts.admin.actions.view', 'View'),\n                  onSelect: () => { router.push(`/backend/customer_accounts/users/${row.id}`) },\n                },\n                {\n                  id: 'toggle-active',\n                  label: row.isActive\n                    ? t('customer_accounts.admin.actions.deactivate', 'Deactivate')\n                    : t('customer_accounts.admin.actions.activate', 'Activate'),\n                  onSelect: () => { void handleToggleActive(row) },\n                },\n                {\n                  id: 'delete',\n                  label: t('customer_accounts.admin.actions.delete', 'Delete'),\n                  destructive: true,\n                  onSelect: () => { void handleDelete(row) },\n                },\n              ]}\n            />\n          )}\n          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}\n          isLoading={isLoading}\n        />\n        <CreateUserDialog\n          open={createDialogOpen}\n          onOpenChange={setCreateDialogOpen}\n          roleOptions={roleOptions}\n          onCreated={() => setReloadToken((token) => token + 1)}\n          onRunMutation={runMutationWithContext}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
-  "mappings": ";AA6IU,cAGA,YAHA;AA3IV,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,OAAO,gBAAgB;AAChC,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAE1B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,QAAQ,eAAe,cAAc,mBAAmB;AACjE,SAAS,SAAS,4BAA4B;AAC9C,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AAsBnC,SAAS,WAAW,OAAkC,UAA0B;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO;AACzC,SAAO,KAAK,mBAAmB;AACjC;AAEA,eAAe,yBAAuF;AACpG,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,IACF;AACA,QAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,WAAO,MACJ,OAAO,CAAC,SAAS,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,SAAS,QAAQ,EAC/E,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG,EAAE;AAAA,EACtE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,EAAE;AACvD,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,YAAY,MAAM,YAAY,MAAM;AACxC,aAAS,EAAE;AACX,mBAAe,EAAE;AACjB,gBAAY,EAAE;AACd,uBAAmB,CAAC,CAAC;AAAA,EACvB,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM,YAAY,OAAO,UAA2B;AACvE,UAAM,eAAe;AACrB,QAAI,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,SAAS,KAAK,GAAG;AAC5D,YAAM,EAAE,qDAAqD,wCAAwC,GAAG,OAAO;AAC/G;AAAA,IACF;AACA,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,cAAc,YAAY;AAC9B,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU;AAAA,cACnB,OAAO,MAAM,KAAK;AAAA,cAClB,aAAa,YAAY,KAAK;AAAA,cAC9B;AAAA,cACA,SAAS,gBAAgB,SAAS,IAAI,kBAAkB;AAAA,YAC1D,CAAC;AAAA,UACH;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,KAAK,QAAQ,SAAS,EAAE,iDAAiD,uBAAuB,GAAG,OAAO;AAChH;AAAA,QACF;AACA,cAAM,EAAE,oDAAoD,cAAc,GAAG,SAAS;AACtF,kBAAU;AACV,qBAAa,KAAK;AAClB,kBAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,uBAAuB;AAC/H,YAAM,SAAS,OAAO;AAAA,IACxB,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,aAAa,OAAO,WAAW,cAAc,eAAe,UAAU,WAAW,iBAAiB,CAAC,CAAC;AAExG,QAAM,gBAAgB,MAAM,YAAY,CAAC,UAA+B;AACtE,SAAK,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,SAAS;AAC7D,YAAM,eAAe;AACrB,YAAM,OAAQ,MAAM,OAAuB,QAAQ,MAAM;AACzD,UAAI,KAAM,MAAK,cAAc;AAAA,IAC/B;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,UAAO,MAAY,cAAc,CAAC,SAAS;AAAE,QAAI,CAAC,KAAM,WAAU;AAAG,iBAAa,IAAI;AAAA,EAAE,GACvF,+BAAC,iBAAc,WAAU,eACvB;AAAA,wBAAC,gBACC,8BAAC,eAAa,YAAE,4CAA4C,sBAAsB,GAAE,GACtF;AAAA,IACA,qBAAC,UAAK,UAAU,CAAC,UAAU;AAAE,WAAK,aAAa,KAAK;AAAA,IAAE,GAAG,WAAW,eAAe,WAAU,aAC3F;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,gBAC5C,YAAE,mDAAmD,OAAO,GAC/D;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,UAAQ;AAAA,YACR,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,SAAS,MAAM,OAAO,KAAK;AAAA,YAChD,aAAa,EAAE,8DAA8D,kBAAkB;AAAA;AAAA,QACjG;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,eAC5C,YAAE,yDAAyD,cAAc,GAC5E;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,YACtD,aAAa,EAAE,oEAAoE,UAAU;AAAA;AAAA,QAC/F;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,mBAC5C,YAAE,sDAAsD,UAAU,GACrE;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,UAAQ;AAAA,YACR,WAAW;AAAA,YACX,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,YAAY,MAAM,OAAO,KAAK;AAAA,YACnD,aAAa,EAAE,iEAAiE,mBAAmB;AAAA,YACnG,cAAa;AAAA;AAAA,QACf;AAAA,SACF;AAAA,MACC,YAAY,SAAS,KACpB,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,OAAE,WAAU,uBAAuB,YAAE,mDAAmD,OAAO,GAAE;AAAA,QAClG,oBAAC,SAAI,WAAU,wBACZ,sBAAY,IAAI,CAAC,SAAS;AACzB,gBAAM,aAAa,gBAAgB,SAAS,KAAK,EAAE;AACnD,iBACE;AAAA,YAAC;AAAA;AAAA,cAEC,MAAK;AAAA,cACL,SAAS,MAAM;AAAA,gBAAmB,CAAC,SACjC,KAAK,SAAS,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE;AAAA,cACpF;AAAA,cACA,WAAW,uEACT,aACI,8CACA,kEACN;AAAA,cAEC,eAAK;AAAA;AAAA,YAXD,KAAK;AAAA,UAYZ;AAAA,QAEJ,CAAC,GACH;AAAA,SACF;AAAA,MAEF,qBAAC,SAAI,WAAU,+BACb;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAS,MAAM;AAAE,oBAAU;AAAG,uBAAa,KAAK;AAAA,QAAE,GACvF,YAAE,qDAAqD,QAAQ,GAClE;AAAA,QACA,oBAAC,UAAO,MAAK,UAAS,UAAU,cAC7B,yBACG,EAAE,uDAAuD,aAAa,IACtE,EAAE,qDAAqD,aAAa,GAC1E;AAAA,SACF;AAAA,OACF;AAAA,KACF,GACF;AAEJ;AAEe,SAAR,uBAAwC;AAC7C,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAoB,CAAC,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvE,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAA8D,CAAC,CAAC;AAC5G,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAS,KAAK;AAEpE,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAGxC;AAAA,IACD,WAAW;AAAA,EACb,CAAC;AAED,QAAM,yBAAyB,MAAM;AAAA,IACnC,OAAW,WAA6B,oBAA0D;AAChG,aAAO,YAAY;AAAA,QACjB;AAAA,QACA;AAAA,QACA,SAAS,EAAE,YAAY,yBAAyB;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,IACA,CAAC,WAAW;AAAA,EACd;AAEA,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,2BAAuB,EAAE,KAAK,CAAC,SAAS;AACtC,UAAI,CAAC,UAAW,gBAAe,IAAI;AAAA,IACrC,CAAC;AACD,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM,QAAqB,MAAM;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,0CAA0C,QAAQ;AAAA,MAC3D,MAAM;AAAA,MACN,SAAS;AAAA,QACP,EAAE,OAAO,UAAU,OAAO,EAAE,0CAA0C,QAAQ,EAAE;AAAA,QAChF,EAAE,OAAO,YAAY,OAAO,EAAE,4CAA4C,UAAU,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,wCAAwC,MAAM;AAAA,MACvD,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,aAAa,CAAC,CAAC;AAEnB,QAAM,cAAc,MAAM,QAAQ,MAAM;AACtC,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AACrD,UAAM,SAAS,aAAa;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM;AAC5E,UAAM,SAAS,aAAa;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM;AAC5E,WAAO,OAAO,SAAS;AAAA,EACzB,GAAG,CAAC,cAAc,MAAM,UAAU,MAAM,CAAC;AAEzC,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,WAA0B,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AACrE,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,WAAW;AAAA,UACjD;AAAA,UACA,EAAE,cAAc,EAAE,2CAA2C,+BAA+B,GAAG,SAAS;AAAA,QAC1G;AACA,YAAI,UAAW;AACf,cAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC/D,gBAAQ,KAAK;AACb,iBAAS,OAAO,SAAS,UAAU,WAAW,QAAQ,QAAQ,MAAM,MAAM;AAC1E,sBAAc,OAAO,SAAS,eAAe,WAAW,QAAQ,aAAa,CAAC;AAAA,MAChF,SAAS,KAAK;AACZ,YAAI,CAAC,WAAW;AACd,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,2CAA2C,+BAA+B;AACjI,gBAAM,SAAS,OAAO;AAAA,QACxB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,aAAa,aAAa,CAAC,CAAC;AAEhC,QAAM,qBAAqB,MAAM,YAAY,OAAO,SAAkB;AACpE,UAAM,aAAa,CAAC,KAAK;AACzB,UAAM,cAAc,aAChB,EAAE,4CAA4C,UAAU,IACxD,EAAE,8CAA8C,YAAY;AAChE,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,gDAAgD,+BAA+B;AAAA,QACtF,QAAQ;AAAA,QACR,MAAM,KAAK,eAAe,KAAK;AAAA,MACjC,CAAC;AAAA,MACD,SAAS,aAAa,YAAY;AAAA,IACpC,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,uBAAuB,YAAY;AACvC,cAAM,OAAO,MAAM;AAAA,UACjB,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,UACjE;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,WAAW,CAAC;AAAA,UAC/C;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,EAAE,8CAA8C,8BAA8B,GAAG,OAAO;AAC9F;AAAA,QACF;AACA;AAAA,UACE,aACI,EAAE,2CAA2C,gBAAgB,IAC7D,EAAE,6CAA6C,kBAAkB;AAAA,UACrE;AAAA,QACF;AACA,uBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,MACrC,GAAG,EAAE,QAAQ,KAAK,IAAI,UAAU,WAAW,CAAC;AAAA,IAC9C,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,8CAA8C,8BAA8B;AACnI,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,wBAAwB,CAAC,CAAC;AAEvC,QAAM,eAAe,MAAM,YAAY,OAAO,SAAkB;AAC9D,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,0CAA0C,2BAA2B;AAAA,QAC5E,MAAM,KAAK,eAAe,KAAK;AAAA,MACjC,CAAC;AAAA,MACD,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,uBAAuB,YAAY;AACvC,cAAM,OAAO,MAAM;AAAA,UACjB,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,UACjE,EAAE,QAAQ,SAAS;AAAA,QACrB;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,EAAE,wCAAwC,uBAAuB,GAAG,OAAO;AACjF;AAAA,QACF;AACA,cAAM,EAAE,yCAAyC,cAAc,GAAG,SAAS;AAC3E,uBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,MACrC,GAAG,EAAE,IAAI,KAAK,GAAG,CAAC;AAAA,IACpB,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,wCAAwC,uBAAuB;AACtH,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,wBAAwB,CAAC,CAAC;AAEvC,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,oBAAgB,MAAM;AACtB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM,QAA8B,MAAM;AACxD,UAAM,UAAU,oBAAC,UAAK,WAAU,iCAAgC,eAAC;AACjE,WAAO;AAAA,MACL;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,+CAA+C,MAAM;AAAA,QAC/D,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,UAAC;AAAA;AAAA,YACC,MAAM,oCAAoC,IAAI,SAAS,EAAE;AAAA,YACzD,WAAU;AAAA,YAET,cAAI,SAAS,eAAe,IAAI,SAAS;AAAA;AAAA,QAC5C;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yCAAyC,OAAO;AAAA,MAC5D;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,iDAAiD,UAAU;AAAA,QACrE,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,yEACf,IAAI,SAAS,gBACT,kDACA,+CACN,IACG,cAAI,SAAS,gBACV,EAAE,oCAAoC,KAAK,IAC3C,EAAE,sCAAsC,IAAI,GAClD;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,0CAA0C,QAAQ;AAAA,QAC5D,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,yEACf,IAAI,SAAS,WACT,kDACA,2CACN,IACG,cAAI,SAAS,WACV,EAAE,kCAAkC,QAAQ,IAC5C,EAAE,oCAAoC,UAAU,GACtD;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6CAA6C,YAAY;AAAA,QACnE,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,aAAa,GAAG,KAAK;AAAA,MAClE;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yCAAyC,OAAO;AAAA,QAC1D,MAAM,CAAC,EAAE,IAAI,MAAM;AACjB,gBAAM,QAAQ,IAAI,SAAS;AAC3B,cAAI,CAAC,SAAS,CAAC,MAAM,OAAQ,QAAO;AACpC,iBAAO,oBAAC,UAAK,WAAU,WAAW,gBAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,GAAE;AAAA,QACxE;AAAA,MACF;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6CAA6C,SAAS;AAAA,QAChE,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,WAAW,GAAG;AAAA,MAC3D;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,SACE,qBAAC,QACC;AAAA,yBAAC,YAAS,WAAU,aAClB;AAAA,0BAAC,SAAI,WAAU,qEACb,+BAAC,SAAI,WAAU,0CACb;AAAA,6BAAC,SACC;AAAA,8BAAC,QAAG,WAAU,6CACX,YAAE,4CAA4C,iBAAiB,GAClE;AAAA,UACA,oBAAC,OAAE,WAAU,sCACV,YAAE,kDAAkD,mIAAmI,GAC1L;AAAA,UACA,oBAAC,OAAE,WAAU,wCACV,YAAE,0CAA0C,qBAAqB;AAAA,YAChE,KAAK,GAAG,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS,EAAE;AAAA,UACrE,CAAC,GACH;AAAA,UACA,oBAAC,OAAE,WAAU,wCACV,YAAE,kDAAkD,2DAA2D,GAClH;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,gCACb;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,SAAO;AAAA,cAEP,+BAAC,QAAK,MAAK,uCACT;AAAA,oCAAC,YAAS,WAAU,UAAS;AAAA,gBAC5B,EAAE,wDAAwD,oBAAoB;AAAA,iBACjF;AAAA;AAAA,UACF;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,SAAO;AAAA,cAEP,+BAAC,OAAE,MAAM,GAAG,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS,EAAE,WAAW,QAAO,UAAS,KAAI,uBACpG;AAAA,oCAAC,SAAM,WAAU,UAAS;AAAA,gBACzB,EAAE,2CAA2C,aAAa;AAAA,iBAC7D;AAAA;AAAA,UACF;AAAA,WACF;AAAA,SACF,GACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,qBAAmB;AAAA,UACnB,OAAO,EAAE,iCAAiC,OAAO;AAAA,UACjD,SACE,oBAAC,UAAO,SAAS,MAAM,oBAAoB,IAAI,GAC5C,YAAE,8CAA8C,aAAa,GAChE;AAAA,UAEF;AAAA,UACA,MAAM;AAAA,UACN,aAAa;AAAA,UACb,gBAAgB,CAAC,UAAU;AAAE,sBAAU,KAAK;AAAG,oBAAQ,CAAC;AAAA,UAAE;AAAA,UAC1D,mBAAmB,EAAE,6CAA6C,4BAA4B;AAAA,UAC9F;AAAA,UACA;AAAA,UACA,gBAAgB;AAAA,UAChB,gBAAgB;AAAA,UAChB,aAAa,EAAE,SAAS,gCAAgC;AAAA,UACxD,YAAY,CAAC,QAAQ,OAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,UAC7E,YAAY,CAAC,QACX;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL;AAAA,kBACE,IAAI;AAAA,kBACJ,OAAO,EAAE,wCAAwC,MAAM;AAAA,kBACvD,UAAU,MAAM;AAAE,2BAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,kBAAE;AAAA,gBAC9E;AAAA,gBACA;AAAA,kBACE,IAAI;AAAA,kBACJ,OAAO,IAAI,WACP,EAAE,8CAA8C,YAAY,IAC5D,EAAE,4CAA4C,UAAU;AAAA,kBAC5D,UAAU,MAAM;AAAE,yBAAK,mBAAmB,GAAG;AAAA,kBAAE;AAAA,gBACjD;AAAA,gBACA;AAAA,kBACE,IAAI;AAAA,kBACJ,OAAO,EAAE,0CAA0C,QAAQ;AAAA,kBAC3D,aAAa;AAAA,kBACb,UAAU,MAAM;AAAE,yBAAK,aAAa,GAAG;AAAA,kBAAE;AAAA,gBAC3C;AAAA,cACF;AAAA;AAAA,UACF;AAAA,UAEF,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,cAAc,QAAQ;AAAA,UACvE;AAAA;AAAA,MACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAM;AAAA,UACN,cAAc;AAAA,UACd;AAAA,UACA,WAAW,MAAM,eAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,UACpD,eAAe;AAAA;AAAA,MACjB;AAAA,OACF;AAAA,IACC;AAAA,KACH;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Globe, Settings } from 'lucide-react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { ColumnDef } from '@tanstack/react-table'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { PasswordInput } from '@open-mercato/ui/primitives/password-input'\nimport { Dialog, DialogContent, DialogHeader, DialogTitle } from '@open-mercato/ui/primitives/dialog'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\n\ntype UserRow = {\n  id: string\n  displayName: string\n  email: string\n  emailVerified: boolean\n  isActive: boolean\n  lastLoginAt: string | null\n  roles: Array<{ id: string; name: string; slug: string }>\n  createdAt: string\n  updatedAt?: string | null\n  personEntityId: string | null\n  customerEntityId: string | null\n}\n\ntype UsersResponse = {\n  items?: UserRow[]\n  total?: number\n  totalPages?: number\n}\n\nfunction formatDate(value: string | null | undefined, fallback: string): string {\n  if (!value) return fallback\n  const date = new Date(value)\n  if (Number.isNaN(date.getTime())) return fallback\n  return date.toLocaleDateString()\n}\n\nasync function fetchRoleFilterOptions(): Promise<Array<{ value: string; label: string; id: string }>> {\n  try {\n    const call = await apiCall<{ items?: Array<{ id: string; name: string }> }>(\n      '/api/customer_accounts/admin/roles?pageSize=100',\n    )\n    if (!call.ok) return []\n    const items = Array.isArray(call.result?.items) ? call.result!.items : []\n    return items\n      .filter((item) => typeof item?.id === 'string' && typeof item?.name === 'string')\n      .map((item) => ({ value: item.id, label: item.name, id: item.id }))\n  } catch {\n    return []\n  }\n}\n\nfunction CreateUserDialog({\n  open,\n  onOpenChange,\n  roleOptions,\n  onCreated,\n  onRunMutation,\n}: {\n  open: boolean\n  onOpenChange: (next: boolean) => void\n  roleOptions: Array<{ id: string; label: string }>\n  onCreated: () => void\n  onRunMutation: <T>(operation: () => Promise<T>) => Promise<T>\n}) {\n  const t = useT()\n  const [email, setEmail] = React.useState('')\n  const [displayName, setDisplayName] = React.useState('')\n  const [password, setPassword] = React.useState('')\n  const [selectedRoleIds, setSelectedRoleIds] = React.useState<string[]>([])\n  const [isSubmitting, setIsSubmitting] = React.useState(false)\n\n  const resetForm = React.useCallback(() => {\n    setEmail('')\n    setDisplayName('')\n    setPassword('')\n    setSelectedRoleIds([])\n  }, [])\n\n  const handleSubmit = React.useCallback(async (event: React.FormEvent) => {\n    event.preventDefault()\n    if (!email.trim() || !displayName.trim() || !password.trim()) {\n      flash(t('customer_accounts.admin.createUser.error.required', 'Email, name, and password are required'), 'error')\n      return\n    }\n    setIsSubmitting(true)\n    try {\n      await onRunMutation(async () => {\n        const call = await apiCall<{ ok: boolean; error?: string }>(\n          '/api/customer_accounts/admin/users',\n          {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({\n              email: email.trim(),\n              displayName: displayName.trim(),\n              password,\n              roleIds: selectedRoleIds.length > 0 ? selectedRoleIds : undefined,\n            }),\n          },\n        )\n        if (!call.ok) {\n          flash(call.result?.error || t('customer_accounts.admin.createUser.error.save', 'Failed to create user'), 'error')\n          return\n        }\n        flash(t('customer_accounts.admin.createUser.flash.created', 'User created'), 'success')\n        resetForm()\n        onOpenChange(false)\n        onCreated()\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.createUser.error.save', 'Failed to create user')\n      flash(message, 'error')\n    } finally {\n      setIsSubmitting(false)\n    }\n  }, [displayName, email, onCreated, onOpenChange, onRunMutation, password, resetForm, selectedRoleIds, t])\n\n  const handleKeyDown = React.useCallback((event: React.KeyboardEvent) => {\n    if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {\n      event.preventDefault()\n      const form = (event.target as HTMLElement).closest('form')\n      if (form) form.requestSubmit()\n    }\n  }, [])\n\n  return (\n    <Dialog open={open} onOpenChange={(next) => { if (!next) resetForm(); onOpenChange(next) }}>\n      <DialogContent className=\"sm:max-w-lg\">\n        <DialogHeader>\n          <DialogTitle>{t('customer_accounts.admin.createUser.title', 'Create Customer User')}</DialogTitle>\n        </DialogHeader>\n        <form onSubmit={(event) => { void handleSubmit(event) }} onKeyDown={handleKeyDown} className=\"space-y-4\">\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-email\">\n              {t('customer_accounts.admin.createUser.fields.email', 'Email')}\n            </label>\n            <EmailInput\n              id=\"create-email\"\n              required\n              value={email}\n              onChange={(event) => setEmail(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.emailPlaceholder', 'user@example.com')}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-name\">\n              {t('customer_accounts.admin.createUser.fields.displayName', 'Display Name')}\n            </label>\n            <Input\n              id=\"create-name\"\n              type=\"text\"\n              required\n              value={displayName}\n              onChange={(event) => setDisplayName(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.displayNamePlaceholder', 'John Doe')}\n            />\n          </div>\n          <div className=\"space-y-2\">\n            <label className=\"text-sm font-medium\" htmlFor=\"create-password\">\n              {t('customer_accounts.admin.createUser.fields.password', 'Password')}\n            </label>\n            <PasswordInput\n              id=\"create-password\"\n              required\n              minLength={8}\n              value={password}\n              onChange={(event) => setPassword(event.target.value)}\n              placeholder={t('customer_accounts.admin.createUser.fields.passwordPlaceholder', 'Min. 8 characters')}\n              autoComplete=\"new-password\"\n            />\n          </div>\n          {roleOptions.length > 0 && (\n            <div className=\"space-y-2\">\n              <p className=\"text-sm font-medium\">{t('customer_accounts.admin.createUser.fields.roles', 'Roles')}</p>\n              <div className=\"flex flex-wrap gap-2\">\n                {roleOptions.map((role) => {\n                  const isSelected = selectedRoleIds.includes(role.id)\n                  return (\n                    <button\n                      key={role.id}\n                      type=\"button\"\n                      onClick={() => setSelectedRoleIds((prev) =>\n                        prev.includes(role.id) ? prev.filter((rid) => rid !== role.id) : [...prev, role.id],\n                      )}\n                      className={`rounded-full border px-3 py-1 text-xs font-medium transition-colors ${\n                        isSelected\n                          ? 'border-primary bg-primary/10 text-primary'\n                          : 'border-border bg-background text-muted-foreground hover:bg-muted'\n                      }`}\n                    >\n                      {role.label}\n                    </button>\n                  )\n                })}\n              </div>\n            </div>\n          )}\n          <div className=\"flex justify-end gap-2 pt-2\">\n            <Button type=\"button\" variant=\"outline\" onClick={() => { resetForm(); onOpenChange(false) }}>\n              {t('customer_accounts.admin.createUser.actions.cancel', 'Cancel')}\n            </Button>\n            <Button type=\"submit\" disabled={isSubmitting}>\n              {isSubmitting\n                ? t('customer_accounts.admin.createUser.actions.creating', 'Creating...')\n                : t('customer_accounts.admin.createUser.actions.create', 'Create User')}\n            </Button>\n          </div>\n        </form>\n      </DialogContent>\n    </Dialog>\n  )\n}\n\nexport default function CustomerAccountsPage() {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const t = useT()\n  const router = useRouter()\n  const [rows, setRows] = React.useState<UserRow[]>([])\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const [roleOptions, setRoleOptions] = React.useState<Array<{ value: string; label: string; id: string }>>([])\n  const [createDialogOpen, setCreateDialogOpen] = React.useState(false)\n\n  const { runMutation, retryLastMutation } = useGuardedMutation<{\n    entityType: string\n    entityId?: string\n  }>({\n    contextId: 'customer_accounts:users-list',\n  })\n\n  const runMutationWithContext = React.useCallback(\n    async <T,>(operation: () => Promise<T>, mutationPayload?: Record<string, unknown>): Promise<T> => {\n      return runMutation({\n        operation,\n        mutationPayload,\n        context: { entityType: 'customer_accounts:user' },\n      })\n    },\n    [runMutation],\n  )\n\n  React.useEffect(() => {\n    let cancelled = false\n    fetchRoleFilterOptions().then((opts) => {\n      if (!cancelled) setRoleOptions(opts)\n    })\n    return () => { cancelled = true }\n  }, [])\n\n  const filters = React.useMemo<FilterDef[]>(() => [\n    {\n      id: 'status',\n      label: t('customer_accounts.admin.filters.status', 'Status'),\n      type: 'select',\n      options: [\n        { value: 'active', label: t('customer_accounts.admin.filters.active', 'Active') },\n        { value: 'inactive', label: t('customer_accounts.admin.filters.inactive', 'Inactive') },\n      ],\n    },\n    {\n      id: 'roleId',\n      label: t('customer_accounts.admin.filters.role', 'Role'),\n      type: 'select',\n      options: roleOptions,\n    },\n  ], [roleOptions, t])\n\n  const queryParams = React.useMemo(() => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    if (search.trim()) params.set('search', search.trim())\n    const status = filterValues.status\n    if (typeof status === 'string' && status.trim()) params.set('status', status)\n    const roleId = filterValues.roleId\n    if (typeof roleId === 'string' && roleId.trim()) params.set('roleId', roleId)\n    return params.toString()\n  }, [filterValues, page, pageSize, search])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const fallback: UsersResponse = { items: [], total: 0, totalPages: 1 }\n        const payload = await readApiResultOrThrow<UsersResponse>(\n          `/api/customer_accounts/admin/users?${queryParams}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.error.loadUsers', 'Failed to load customer users'), fallback },\n        )\n        if (cancelled) return\n        const items = Array.isArray(payload?.items) ? payload.items : []\n        setRows(items)\n        setTotal(typeof payload?.total === 'number' ? payload.total : items.length)\n        setTotalPages(typeof payload?.totalPages === 'number' ? payload.totalPages : 1)\n      } catch (err) {\n        if (!cancelled) {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.loadUsers', 'Failed to load customer users')\n          flash(message, 'error')\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [queryParams, reloadToken, t])\n\n  const handleToggleActive = React.useCallback(async (user: UserRow) => {\n    const nextActive = !user.isActive\n    const actionLabel = nextActive\n      ? t('customer_accounts.admin.actions.activate', 'Activate')\n      : t('customer_accounts.admin.actions.deactivate', 'Deactivate')\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.confirm.toggleActive', '{{action}} user \"{{name}}\"?', {\n        action: actionLabel,\n        name: user.displayName || user.email,\n      }),\n      variant: nextActive ? 'default' : 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      await runMutationWithContext(async () => {\n        const call = await withScopedApiRequestHeaders(\n          buildOptimisticLockHeader(user.updatedAt),\n          () => apiCall(\n            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,\n            {\n              method: 'PUT',\n              headers: { 'content-type': 'application/json' },\n              body: JSON.stringify({ isActive: nextActive }),\n            },\n          ),\n        )\n        if (!call.ok) {\n          flash(t('customer_accounts.admin.error.toggleActive', 'Failed to update user status'), 'error')\n          return\n        }\n        flash(\n          nextActive\n            ? t('customer_accounts.admin.flash.activated', 'User activated')\n            : t('customer_accounts.admin.flash.deactivated', 'User deactivated'),\n          'success',\n        )\n        setReloadToken((token) => token + 1)\n      }, { userId: user.id, isActive: nextActive })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.toggleActive', 'Failed to update user status')\n      flash(message, 'error')\n    }\n  }, [confirm, runMutationWithContext, t])\n\n  const handleDelete = React.useCallback(async (user: UserRow) => {\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.confirm.delete', 'Delete user \"{{name}}\"?', {\n        name: user.displayName || user.email,\n      }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      await runMutationWithContext(async () => {\n        const call = await withScopedApiRequestHeaders(\n          buildOptimisticLockHeader(user.updatedAt),\n          () => apiCall(\n            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,\n            { method: 'DELETE' },\n          ),\n        )\n        if (!call.ok) {\n          flash(t('customer_accounts.admin.error.delete', 'Failed to delete user'), 'error')\n          return\n        }\n        flash(t('customer_accounts.admin.flash.deleted', 'User deleted'), 'success')\n        setReloadToken((token) => token + 1)\n      }, { id: user.id })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.delete', 'Failed to delete user')\n      flash(message, 'error')\n    }\n  }, [confirm, runMutationWithContext, t])\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    setFilterValues(values)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const columns = React.useMemo<ColumnDef<UserRow>[]>(() => {\n    const noValue = <span className=\"text-muted-foreground text-sm\">-</span>\n    return [\n      {\n        accessorKey: 'displayName',\n        header: t('customer_accounts.admin.columns.displayName', 'Name'),\n        cell: ({ row }) => (\n          <Link\n            href={`/backend/customer_accounts/users/${row.original.id}`}\n            className=\"font-medium hover:underline\"\n          >\n            {row.original.displayName || row.original.email}\n          </Link>\n        ),\n      },\n      {\n        accessorKey: 'email',\n        header: t('customer_accounts.admin.columns.email', 'Email'),\n      },\n      {\n        accessorKey: 'emailVerified',\n        header: t('customer_accounts.admin.columns.emailVerified', 'Verified'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${\n            row.original.emailVerified\n              ? 'bg-status-success-bg text-status-success-text'\n              : 'bg-status-warning-bg text-status-warning-text'\n          }`}>\n            {row.original.emailVerified\n              ? t('customer_accounts.admin.verified', 'Yes')\n              : t('customer_accounts.admin.unverified', 'No')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'isActive',\n        header: t('customer_accounts.admin.columns.status', 'Status'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${\n            row.original.isActive\n              ? 'bg-status-success-bg text-status-success-text'\n              : 'bg-status-error-bg text-status-error-text'\n          }`}>\n            {row.original.isActive\n              ? t('customer_accounts.admin.active', 'Active')\n              : t('customer_accounts.admin.inactive', 'Inactive')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'lastLoginAt',\n        header: t('customer_accounts.admin.columns.lastLogin', 'Last Login'),\n        cell: ({ row }) => formatDate(row.original.lastLoginAt, '-') || noValue,\n      },\n      {\n        accessorKey: 'roles',\n        header: t('customer_accounts.admin.columns.roles', 'Roles'),\n        cell: ({ row }) => {\n          const roles = row.original.roles\n          if (!roles || !roles.length) return noValue\n          return <span className=\"text-sm\">{roles.map((r) => r.name).join(', ')}</span>\n        },\n      },\n      {\n        accessorKey: 'createdAt',\n        header: t('customer_accounts.admin.columns.createdAt', 'Created'),\n        cell: ({ row }) => formatDate(row.original.createdAt, '-'),\n      },\n    ]\n  }, [t])\n\n  return (\n    <Page>\n      <PageBody className=\"space-y-4\">\n        <div className=\"rounded-lg border border-status-info-border bg-status-info-bg p-4\">\n          <div className=\"flex items-start justify-between gap-4\">\n            <div>\n              <h3 className=\"text-sm font-medium text-status-info-text\">\n                {t('customer_accounts.admin.portalInfo.title', 'Customer Portal')}\n              </h3>\n              <p className=\"mt-1 text-sm text-status-info-text\">\n                {t('customer_accounts.admin.portalInfo.description', 'Manage customer portal accounts. Customers can self-register, log in, and access orders, quotes, and invoices through the portal.')}\n              </p>\n              <p className=\"mt-1.5 text-xs text-status-info-text\">\n                {t('customer_accounts.admin.portalInfo.url', 'Portal URL: {url}', {\n                  url: `${typeof window !== 'undefined' ? window.location.origin : ''}/[org-slug]/portal`,\n                })}\n              </p>\n              <p className=\"mt-0.5 text-xs text-status-info-text\">\n                {t('customer_accounts.admin.portalInfo.credentials', 'Demo credentials: alice.johnson@example.com / password123')}\n              </p>\n            </div>\n            <div className=\"flex shrink-0 flex-col gap-2\">\n              <Button\n                type=\"button\"\n                variant=\"outline\"\n                size=\"sm\"\n                asChild\n              >\n                <Link href=\"/backend/customer_accounts/settings\">\n                  <Settings className=\"size-4\" />\n                  {t('customer_accounts.admin.portalInfo.openConfiguration', 'Open Configuration')}\n                </Link>\n              </Button>\n              <Button\n                type=\"button\"\n                variant=\"outline\"\n                size=\"sm\"\n                asChild\n              >\n                <a href={`${typeof window !== 'undefined' ? window.location.origin : ''}/portal`} target=\"_blank\" rel=\"noopener noreferrer\">\n                  <Globe className=\"size-4\" />\n                  {t('customer_accounts.admin.portalInfo.open', 'Open Portal')}\n                </a>\n              </Button>\n            </div>\n          </div>\n        </div>\n        <DataTable<UserRow>\n          stickyActionsColumn\n          title={t('customer_accounts.admin.title', 'Users')}\n          actions={(\n            <Button onClick={() => setCreateDialogOpen(true)}>\n              {t('customer_accounts.admin.actions.createUser', 'Create User')}\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          searchValue={search}\n          onSearchChange={(value) => { setSearch(value); setPage(1) }}\n          searchPlaceholder={t('customer_accounts.admin.searchPlaceholder', 'Search by name or email...')}\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          perspective={{ tableId: 'customer_accounts.admin.users' }}\n          emptyState={(\n            <ListEmptyState\n              entityName={t('customer_accounts.admin.title', 'Users')}\n              onCreate={() => setCreateDialogOpen(true)}\n              createLabel={t('customer_accounts.admin.actions.createUser', 'Create User')}\n            />\n          )}\n          onRowClick={(row) => router.push(`/backend/customer_accounts/users/${row.id}`)}\n          rowActions={(row) => (\n            <RowActions\n              items={[\n                {\n                  id: 'view',\n                  label: t('customer_accounts.admin.actions.view', 'View'),\n                  onSelect: () => { router.push(`/backend/customer_accounts/users/${row.id}`) },\n                },\n                {\n                  id: 'toggle-active',\n                  label: row.isActive\n                    ? t('customer_accounts.admin.actions.deactivate', 'Deactivate')\n                    : t('customer_accounts.admin.actions.activate', 'Activate'),\n                  onSelect: () => { void handleToggleActive(row) },\n                },\n                {\n                  id: 'delete',\n                  label: t('customer_accounts.admin.actions.delete', 'Delete'),\n                  destructive: true,\n                  onSelect: () => { void handleDelete(row) },\n                },\n              ]}\n            />\n          )}\n          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}\n          isLoading={isLoading}\n        />\n        <CreateUserDialog\n          open={createDialogOpen}\n          onOpenChange={setCreateDialogOpen}\n          roleOptions={roleOptions}\n          onCreated={() => setReloadToken((token) => token + 1)}\n          onRunMutation={runMutationWithContext}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
+  "mappings": ";AAgJU,cAGA,YAHA;AA9IV,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,OAAO,gBAAgB;AAChC,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAE1B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,QAAQ,eAAe,cAAc,mBAAmB;AACjE,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAuB/B,SAAS,WAAW,OAAkC,UAA0B;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO;AACzC,SAAO,KAAK,mBAAmB;AACjC;AAEA,eAAe,yBAAuF;AACpG,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,IACF;AACA,QAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,WAAO,MACJ,OAAO,CAAC,SAAS,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,SAAS,QAAQ,EAC/E,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,GAAG,EAAE;AAAA,EACtE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAMG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,EAAE;AACvD,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,EAAE;AACjD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,YAAY,MAAM,YAAY,MAAM;AACxC,aAAS,EAAE;AACX,mBAAe,EAAE;AACjB,gBAAY,EAAE;AACd,uBAAmB,CAAC,CAAC;AAAA,EACvB,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM,YAAY,OAAO,UAA2B;AACvE,UAAM,eAAe;AACrB,QAAI,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,SAAS,KAAK,GAAG;AAC5D,YAAM,EAAE,qDAAqD,wCAAwC,GAAG,OAAO;AAC/G;AAAA,IACF;AACA,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,cAAc,YAAY;AAC9B,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA,YACE,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU;AAAA,cACnB,OAAO,MAAM,KAAK;AAAA,cAClB,aAAa,YAAY,KAAK;AAAA,cAC9B;AAAA,cACA,SAAS,gBAAgB,SAAS,IAAI,kBAAkB;AAAA,YAC1D,CAAC;AAAA,UACH;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,KAAK,QAAQ,SAAS,EAAE,iDAAiD,uBAAuB,GAAG,OAAO;AAChH;AAAA,QACF;AACA,cAAM,EAAE,oDAAoD,cAAc,GAAG,SAAS;AACtF,kBAAU;AACV,qBAAa,KAAK;AAClB,kBAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,uBAAuB;AAC/H,YAAM,SAAS,OAAO;AAAA,IACxB,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,aAAa,OAAO,WAAW,cAAc,eAAe,UAAU,WAAW,iBAAiB,CAAC,CAAC;AAExG,QAAM,gBAAgB,MAAM,YAAY,CAAC,UAA+B;AACtE,SAAK,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,SAAS;AAC7D,YAAM,eAAe;AACrB,YAAM,OAAQ,MAAM,OAAuB,QAAQ,MAAM;AACzD,UAAI,KAAM,MAAK,cAAc;AAAA,IAC/B;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,UAAO,MAAY,cAAc,CAAC,SAAS;AAAE,QAAI,CAAC,KAAM,WAAU;AAAG,iBAAa,IAAI;AAAA,EAAE,GACvF,+BAAC,iBAAc,WAAU,eACvB;AAAA,wBAAC,gBACC,8BAAC,eAAa,YAAE,4CAA4C,sBAAsB,GAAE,GACtF;AAAA,IACA,qBAAC,UAAK,UAAU,CAAC,UAAU;AAAE,WAAK,aAAa,KAAK;AAAA,IAAE,GAAG,WAAW,eAAe,WAAU,aAC3F;AAAA,2BAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,gBAC5C,YAAE,mDAAmD,OAAO,GAC/D;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,UAAQ;AAAA,YACR,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,SAAS,MAAM,OAAO,KAAK;AAAA,YAChD,aAAa,EAAE,8DAA8D,kBAAkB;AAAA;AAAA,QACjG;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,eAC5C,YAAE,yDAAyD,cAAc,GAC5E;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,UAAQ;AAAA,YACR,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,YACtD,aAAa,EAAE,oEAAoE,UAAU;AAAA;AAAA,QAC/F;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAQ,mBAC5C,YAAE,sDAAsD,UAAU,GACrE;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,UAAQ;AAAA,YACR,WAAW;AAAA,YACX,OAAO;AAAA,YACP,UAAU,CAAC,UAAU,YAAY,MAAM,OAAO,KAAK;AAAA,YACnD,aAAa,EAAE,iEAAiE,mBAAmB;AAAA,YACnG,cAAa;AAAA;AAAA,QACf;AAAA,SACF;AAAA,MACC,YAAY,SAAS,KACpB,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,OAAE,WAAU,uBAAuB,YAAE,mDAAmD,OAAO,GAAE;AAAA,QAClG,oBAAC,SAAI,WAAU,wBACZ,sBAAY,IAAI,CAAC,SAAS;AACzB,gBAAM,aAAa,gBAAgB,SAAS,KAAK,EAAE;AACnD,iBACE;AAAA,YAAC;AAAA;AAAA,cAEC,MAAK;AAAA,cACL,SAAS,MAAM;AAAA,gBAAmB,CAAC,SACjC,KAAK,SAAS,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE;AAAA,cACpF;AAAA,cACA,WAAW,uEACT,aACI,8CACA,kEACN;AAAA,cAEC,eAAK;AAAA;AAAA,YAXD,KAAK;AAAA,UAYZ;AAAA,QAEJ,CAAC,GACH;AAAA,SACF;AAAA,MAEF,qBAAC,SAAI,WAAU,+BACb;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAS,MAAM;AAAE,oBAAU;AAAG,uBAAa,KAAK;AAAA,QAAE,GACvF,YAAE,qDAAqD,QAAQ,GAClE;AAAA,QACA,oBAAC,UAAO,MAAK,UAAS,UAAU,cAC7B,yBACG,EAAE,uDAAuD,aAAa,IACtE,EAAE,qDAAqD,aAAa,GAC1E;AAAA,SACF;AAAA,OACF;AAAA,KACF,GACF;AAEJ;AAEe,SAAR,uBAAwC;AAC7C,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAoB,CAAC,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvE,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAA8D,CAAC,CAAC;AAC5G,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,MAAM,SAAS,KAAK;AAEpE,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAGxC;AAAA,IACD,WAAW;AAAA,EACb,CAAC;AAED,QAAM,yBAAyB,MAAM;AAAA,IACnC,OAAW,WAA6B,oBAA0D;AAChG,aAAO,YAAY;AAAA,QACjB;AAAA,QACA;AAAA,QACA,SAAS,EAAE,YAAY,yBAAyB;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,IACA,CAAC,WAAW;AAAA,EACd;AAEA,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,2BAAuB,EAAE,KAAK,CAAC,SAAS;AACtC,UAAI,CAAC,UAAW,gBAAe,IAAI;AAAA,IACrC,CAAC;AACD,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM,QAAqB,MAAM;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,0CAA0C,QAAQ;AAAA,MAC3D,MAAM;AAAA,MACN,SAAS;AAAA,QACP,EAAE,OAAO,UAAU,OAAO,EAAE,0CAA0C,QAAQ,EAAE;AAAA,QAChF,EAAE,OAAO,YAAY,OAAO,EAAE,4CAA4C,UAAU,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,wCAAwC,MAAM;AAAA,MACvD,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,aAAa,CAAC,CAAC;AAEnB,QAAM,cAAc,MAAM,QAAQ,MAAM;AACtC,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AACrD,UAAM,SAAS,aAAa;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM;AAC5E,UAAM,SAAS,aAAa;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM;AAC5E,WAAO,OAAO,SAAS;AAAA,EACzB,GAAG,CAAC,cAAc,MAAM,UAAU,MAAM,CAAC;AAEzC,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,WAA0B,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AACrE,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,WAAW;AAAA,UACjD;AAAA,UACA,EAAE,cAAc,EAAE,2CAA2C,+BAA+B,GAAG,SAAS;AAAA,QAC1G;AACA,YAAI,UAAW;AACf,cAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC/D,gBAAQ,KAAK;AACb,iBAAS,OAAO,SAAS,UAAU,WAAW,QAAQ,QAAQ,MAAM,MAAM;AAC1E,sBAAc,OAAO,SAAS,eAAe,WAAW,QAAQ,aAAa,CAAC;AAAA,MAChF,SAAS,KAAK;AACZ,YAAI,CAAC,WAAW;AACd,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,2CAA2C,+BAA+B;AACjI,gBAAM,SAAS,OAAO;AAAA,QACxB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,aAAa,aAAa,CAAC,CAAC;AAEhC,QAAM,qBAAqB,MAAM,YAAY,OAAO,SAAkB;AACpE,UAAM,aAAa,CAAC,KAAK;AACzB,UAAM,cAAc,aAChB,EAAE,4CAA4C,UAAU,IACxD,EAAE,8CAA8C,YAAY;AAChE,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,gDAAgD,+BAA+B;AAAA,QACtF,QAAQ;AAAA,QACR,MAAM,KAAK,eAAe,KAAK;AAAA,MACjC,CAAC;AAAA,MACD,SAAS,aAAa,YAAY;AAAA,IACpC,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,uBAAuB,YAAY;AACvC,cAAM,OAAO,MAAM;AAAA,UACjB,0BAA0B,KAAK,SAAS;AAAA,UACxC,MAAM;AAAA,YACJ,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,YACjE;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,WAAW,CAAC;AAAA,YAC/C;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,EAAE,8CAA8C,8BAA8B,GAAG,OAAO;AAC9F;AAAA,QACF;AACA;AAAA,UACE,aACI,EAAE,2CAA2C,gBAAgB,IAC7D,EAAE,6CAA6C,kBAAkB;AAAA,UACrE;AAAA,QACF;AACA,uBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,MACrC,GAAG,EAAE,QAAQ,KAAK,IAAI,UAAU,WAAW,CAAC;AAAA,IAC9C,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,8CAA8C,8BAA8B;AACnI,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,wBAAwB,CAAC,CAAC;AAEvC,QAAM,eAAe,MAAM,YAAY,OAAO,SAAkB;AAC9D,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,0CAA0C,2BAA2B;AAAA,QAC5E,MAAM,KAAK,eAAe,KAAK;AAAA,MACjC,CAAC;AAAA,MACD,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,uBAAuB,YAAY;AACvC,cAAM,OAAO,MAAM;AAAA,UACjB,0BAA0B,KAAK,SAAS;AAAA,UACxC,MAAM;AAAA,YACJ,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,YACjE,EAAE,QAAQ,SAAS;AAAA,UACrB;AAAA,QACF;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,EAAE,wCAAwC,uBAAuB,GAAG,OAAO;AACjF;AAAA,QACF;AACA,cAAM,EAAE,yCAAyC,cAAc,GAAG,SAAS;AAC3E,uBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,MACrC,GAAG,EAAE,IAAI,KAAK,GAAG,CAAC;AAAA,IACpB,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,wCAAwC,uBAAuB;AACtH,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,wBAAwB,CAAC,CAAC;AAEvC,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,oBAAgB,MAAM;AACtB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM,QAA8B,MAAM;AACxD,UAAM,UAAU,oBAAC,UAAK,WAAU,iCAAgC,eAAC;AACjE,WAAO;AAAA,MACL;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,+CAA+C,MAAM;AAAA,QAC/D,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,UAAC;AAAA;AAAA,YACC,MAAM,oCAAoC,IAAI,SAAS,EAAE;AAAA,YACzD,WAAU;AAAA,YAET,cAAI,SAAS,eAAe,IAAI,SAAS;AAAA;AAAA,QAC5C;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yCAAyC,OAAO;AAAA,MAC5D;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,iDAAiD,UAAU;AAAA,QACrE,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,yEACf,IAAI,SAAS,gBACT,kDACA,+CACN,IACG,cAAI,SAAS,gBACV,EAAE,oCAAoC,KAAK,IAC3C,EAAE,sCAAsC,IAAI,GAClD;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,0CAA0C,QAAQ;AAAA,QAC5D,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,yEACf,IAAI,SAAS,WACT,kDACA,2CACN,IACG,cAAI,SAAS,WACV,EAAE,kCAAkC,QAAQ,IAC5C,EAAE,oCAAoC,UAAU,GACtD;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6CAA6C,YAAY;AAAA,QACnE,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,aAAa,GAAG,KAAK;AAAA,MAClE;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yCAAyC,OAAO;AAAA,QAC1D,MAAM,CAAC,EAAE,IAAI,MAAM;AACjB,gBAAM,QAAQ,IAAI,SAAS;AAC3B,cAAI,CAAC,SAAS,CAAC,MAAM,OAAQ,QAAO;AACpC,iBAAO,oBAAC,UAAK,WAAU,WAAW,gBAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,GAAE;AAAA,QACxE;AAAA,MACF;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6CAA6C,SAAS;AAAA,QAChE,MAAM,CAAC,EAAE,IAAI,MAAM,WAAW,IAAI,SAAS,WAAW,GAAG;AAAA,MAC3D;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,SACE,qBAAC,QACC;AAAA,yBAAC,YAAS,WAAU,aAClB;AAAA,0BAAC,SAAI,WAAU,qEACb,+BAAC,SAAI,WAAU,0CACb;AAAA,6BAAC,SACC;AAAA,8BAAC,QAAG,WAAU,6CACX,YAAE,4CAA4C,iBAAiB,GAClE;AAAA,UACA,oBAAC,OAAE,WAAU,sCACV,YAAE,kDAAkD,mIAAmI,GAC1L;AAAA,UACA,oBAAC,OAAE,WAAU,wCACV,YAAE,0CAA0C,qBAAqB;AAAA,YAChE,KAAK,GAAG,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS,EAAE;AAAA,UACrE,CAAC,GACH;AAAA,UACA,oBAAC,OAAE,WAAU,wCACV,YAAE,kDAAkD,2DAA2D,GAClH;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,gCACb;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,SAAO;AAAA,cAEP,+BAAC,QAAK,MAAK,uCACT;AAAA,oCAAC,YAAS,WAAU,UAAS;AAAA,gBAC5B,EAAE,wDAAwD,oBAAoB;AAAA,iBACjF;AAAA;AAAA,UACF;AAAA,UACA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAQ;AAAA,cACR,MAAK;AAAA,cACL,SAAO;AAAA,cAEP,+BAAC,OAAE,MAAM,GAAG,OAAO,WAAW,cAAc,OAAO,SAAS,SAAS,EAAE,WAAW,QAAO,UAAS,KAAI,uBACpG;AAAA,oCAAC,SAAM,WAAU,UAAS;AAAA,gBACzB,EAAE,2CAA2C,aAAa;AAAA,iBAC7D;AAAA;AAAA,UACF;AAAA,WACF;AAAA,SACF,GACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,qBAAmB;AAAA,UACnB,OAAO,EAAE,iCAAiC,OAAO;AAAA,UACjD,SACE,oBAAC,UAAO,SAAS,MAAM,oBAAoB,IAAI,GAC5C,YAAE,8CAA8C,aAAa,GAChE;AAAA,UAEF;AAAA,UACA,MAAM;AAAA,UACN,aAAa;AAAA,UACb,gBAAgB,CAAC,UAAU;AAAE,sBAAU,KAAK;AAAG,oBAAQ,CAAC;AAAA,UAAE;AAAA,UAC1D,mBAAmB,EAAE,6CAA6C,4BAA4B;AAAA,UAC9F;AAAA,UACA;AAAA,UACA,gBAAgB;AAAA,UAChB,gBAAgB;AAAA,UAChB,aAAa,EAAE,SAAS,gCAAgC;AAAA,UACxD,YACE;AAAA,YAAC;AAAA;AAAA,cACC,YAAY,EAAE,iCAAiC,OAAO;AAAA,cACtD,UAAU,MAAM,oBAAoB,IAAI;AAAA,cACxC,aAAa,EAAE,8CAA8C,aAAa;AAAA;AAAA,UAC5E;AAAA,UAEF,YAAY,CAAC,QAAQ,OAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,UAC7E,YAAY,CAAC,QACX;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,gBACL;AAAA,kBACE,IAAI;AAAA,kBACJ,OAAO,EAAE,wCAAwC,MAAM;AAAA,kBACvD,UAAU,MAAM;AAAE,2BAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,kBAAE;AAAA,gBAC9E;AAAA,gBACA;AAAA,kBACE,IAAI;AAAA,kBACJ,OAAO,IAAI,WACP,EAAE,8CAA8C,YAAY,IAC5D,EAAE,4CAA4C,UAAU;AAAA,kBAC5D,UAAU,MAAM;AAAE,yBAAK,mBAAmB,GAAG;AAAA,kBAAE;AAAA,gBACjD;AAAA,gBACA;AAAA,kBACE,IAAI;AAAA,kBACJ,OAAO,EAAE,0CAA0C,QAAQ;AAAA,kBAC3D,aAAa;AAAA,kBACb,UAAU,MAAM;AAAE,yBAAK,aAAa,GAAG;AAAA,kBAAE;AAAA,gBAC3C;AAAA,cACF;AAAA;AAAA,UACF;AAAA,UAEF,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,cAAc,QAAQ;AAAA,UACvE;AAAA;AAAA,MACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAM;AAAA,UACN,cAAc;AAAA,UACd;AAAA,UACA,WAAW,MAAM,eAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,UACpD,eAAe;AAAA;AAAA,MACjB;AAAA,OACF;AAAA,IACC;AAAA,KACH;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/data/validators.js CHANGED Viewed

@@ -13,7 +13,8 @@ const signupSchema = z.object({
 const loginSchema = z.object({
   email: emailField,
   password: z.string().min(1).max(128),
-  tenantId: z.string().uuid().optional()
+  tenantId: z.string().uuid().optional(),
+  organizationId: z.string().uuid().optional()
 });
 const emailVerifySchema = z.object({
   token: z.string().min(1).max(512)

package/dist/modules/customer_accounts/data/validators.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/data/validators.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { normalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\n\nconst emailField = z.string().email().max(255)\nconst passwordField = z.string().min(8).max(128)\nconst displayNameField = z.string().min(1).max(255)\n\nexport const signupSchema = z.object({\n  email: emailField,\n  password: passwordField,\n  displayName: displayNameField,\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nexport const loginSchema = z.object({\n  email: emailField,\n  password: z.string().min(1).max(128),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const emailVerifySchema = z.object({\n  token: z.string().min(1).max(512),\n})\n\nexport const passwordResetRequestSchema = z.object({\n  email: emailField,\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const passwordResetConfirmSchema = z.object({\n  token: z.string().min(1).max(512),\n  password: passwordField,\n})\n\nexport const magicLinkRequestSchema = z.object({\n  email: emailField,\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const magicLinkVerifySchema = z.object({\n  token: z.string().min(1).max(512),\n})\n\nexport const invitationAcceptSchema = z.object({\n  token: z.string().min(1).max(512),\n  password: passwordField,\n  displayName: displayNameField,\n})\n\nexport const profileUpdateSchema = z.object({\n  displayName: displayNameField.optional(),\n})\n\nexport const passwordChangeSchema = z.object({\n  currentPassword: z.string().min(1).max(128),\n  newPassword: passwordField,\n})\n\nexport const createRoleSchema = z.object({\n  name: z.string().min(1).max(255),\n  slug: z.string().min(1).max(255).regex(/^[a-z0-9_-]+$/),\n  description: z.string().max(1000).optional(),\n  isDefault: z.boolean().optional(),\n  customerAssignable: z.boolean().optional(),\n})\n\nexport const updateRoleSchema = z.object({\n  name: z.string().min(1).max(255).optional(),\n  description: z.string().max(1000).optional(),\n  isDefault: z.boolean().optional(),\n  customerAssignable: z.boolean().optional(),\n})\n\nexport const updateRoleAclSchema = z.object({\n  features: z.array(z.string().min(1).max(255)),\n  isPortalAdmin: z.boolean().optional(),\n})\n\nexport const inviteUserSchema = z.object({\n  email: emailField,\n  customerEntityId: z.string().uuid().optional(),\n  roleIds: z.array(z.string().uuid()).min(1),\n  displayName: displayNameField.optional(),\n})\n\nexport const assignRolesSchema = z.object({\n  roleIds: z.array(z.string().uuid()).min(1),\n})\n\nexport const adminCreateUserSchema = z.object({\n  email: emailField,\n  password: passwordField,\n  displayName: displayNameField,\n  roleIds: z.array(z.string().uuid()).optional(),\n  customerEntityId: z.string().uuid().optional(),\n})\n\nexport const adminUpdateUserSchema = z.object({\n  displayName: displayNameField.optional(),\n  isActive: z.boolean().optional(),\n  lockedUntil: z.string().datetime().nullable().optional(),\n  personEntityId: z.string().uuid().nullable().optional(),\n  customerEntityId: z.string().uuid().nullable().optional(),\n  roleIds: z.array(z.string().uuid()).optional(),\n})\n\nexport const adminResetPasswordSchema = z.object({\n  newPassword: passwordField,\n})\n\nexport type AdminCreateUserInput = z.infer<typeof adminCreateUserSchema>\nexport type AdminResetPasswordInput = z.infer<typeof adminResetPasswordSchema>\nexport type SignupInput = z.infer<typeof signupSchema>\nexport type LoginInput = z.infer<typeof loginSchema>\nexport type EmailVerifyInput = z.infer<typeof emailVerifySchema>\nexport type PasswordResetRequestInput = z.infer<typeof passwordResetRequestSchema>\nexport type PasswordResetConfirmInput = z.infer<typeof passwordResetConfirmSchema>\nexport type MagicLinkRequestInput = z.infer<typeof magicLinkRequestSchema>\nexport type MagicLinkVerifyInput = z.infer<typeof magicLinkVerifySchema>\nexport type InvitationAcceptInput = z.infer<typeof invitationAcceptSchema>\nexport type ProfileUpdateInput = z.infer<typeof profileUpdateSchema>\nexport type PasswordChangeInput = z.infer<typeof passwordChangeSchema>\nexport type CreateRoleInput = z.infer<typeof createRoleSchema>\nexport type UpdateRoleInput = z.infer<typeof updateRoleSchema>\nexport type UpdateRoleAclInput = z.infer<typeof updateRoleAclSchema>\nexport type InviteUserInput = z.infer<typeof inviteUserSchema>\nexport type AssignRolesInput = z.infer<typeof assignRolesSchema>\nexport type AdminUpdateUserInput = z.infer<typeof adminUpdateUserSchema>\n\n// Custom domain mapping\nexport const hostnameSchema = z\n  .string()\n  .min(1, 'Hostname is required')\n  .max(512, 'Hostname is too long')\n  .transform((value, ctx) => {\n    try {\n      return normalizeHostname(value)\n    } catch (err) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: err instanceof Error ? err.message : 'Invalid hostname',\n      })\n      return z.NEVER\n    }\n  })\n\nexport const registerDomainSchema = z.object({\n  hostname: hostnameSchema,\n  organizationId: z.string().uuid(),\n  replacesDomainId: z.string().uuid().optional(),\n})\n\nexport type RegisterDomainInput = z.infer<typeof registerDomainSchema>\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,yBAAyB;AAElC,MAAM,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAC7C,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC/C,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAE3C,MAAM,eAAe,EAAE,OAAO;AAAA,EACnC,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,cAAc,EAAE,OAAO;AAAA,EAClC,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,UAAU;AACZ,CAAC;AAEM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAEM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,UAAU;AAAA,EACV,aAAa;AACf,CAAC;AAEM,MAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,aAAa,iBAAiB,SAAS;AACzC,CAAC;AAEM,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa;AACf,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,eAAe;AAAA,EACtD,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC5C,eAAe,EAAE,QAAQ,EAAE,SAAS;AACtC,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO;AAAA,EACP,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,aAAa,iBAAiB,SAAS;AACzC,CAAC;AAEM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAC3C,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7C,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC/C,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,aAAa,iBAAiB,SAAS;AAAA,EACvC,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAC/C,CAAC;AAEM,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,aAAa;AACf,CAAC;AAsBM,MAAM,iBAAiB,EAC3B,OAAO,EACP,IAAI,GAAG,sBAAsB,EAC7B,IAAI,KAAK,sBAAsB,EAC/B,UAAU,CAAC,OAAO,QAAQ;AACzB,MAAI;AACF,WAAO,kBAAkB,KAAK;AAAA,EAChC,SAAS,KAAK;AACZ,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS,eAAe,QAAQ,IAAI,UAAU;AAAA,IAChD,CAAC;AACD,WAAO,EAAE;AAAA,EACX;AACF,CAAC;AAEI,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,UAAU;AAAA,EACV,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC/C,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { normalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\n\nconst emailField = z.string().email().max(255)\nconst passwordField = z.string().min(8).max(128)\nconst displayNameField = z.string().min(1).max(255)\n\nexport const signupSchema = z.object({\n  email: emailField,\n  password: passwordField,\n  displayName: displayNameField,\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nexport const loginSchema = z.object({\n  email: emailField,\n  password: z.string().min(1).max(128),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nexport const emailVerifySchema = z.object({\n  token: z.string().min(1).max(512),\n})\n\nexport const passwordResetRequestSchema = z.object({\n  email: emailField,\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const passwordResetConfirmSchema = z.object({\n  token: z.string().min(1).max(512),\n  password: passwordField,\n})\n\nexport const magicLinkRequestSchema = z.object({\n  email: emailField,\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const magicLinkVerifySchema = z.object({\n  token: z.string().min(1).max(512),\n})\n\nexport const invitationAcceptSchema = z.object({\n  token: z.string().min(1).max(512),\n  password: passwordField,\n  displayName: displayNameField,\n})\n\nexport const profileUpdateSchema = z.object({\n  displayName: displayNameField.optional(),\n})\n\nexport const passwordChangeSchema = z.object({\n  currentPassword: z.string().min(1).max(128),\n  newPassword: passwordField,\n})\n\nexport const createRoleSchema = z.object({\n  name: z.string().min(1).max(255),\n  slug: z.string().min(1).max(255).regex(/^[a-z0-9_-]+$/),\n  description: z.string().max(1000).optional(),\n  isDefault: z.boolean().optional(),\n  customerAssignable: z.boolean().optional(),\n})\n\nexport const updateRoleSchema = z.object({\n  name: z.string().min(1).max(255).optional(),\n  description: z.string().max(1000).optional(),\n  isDefault: z.boolean().optional(),\n  customerAssignable: z.boolean().optional(),\n})\n\nexport const updateRoleAclSchema = z.object({\n  features: z.array(z.string().min(1).max(255)),\n  isPortalAdmin: z.boolean().optional(),\n})\n\nexport const inviteUserSchema = z.object({\n  email: emailField,\n  customerEntityId: z.string().uuid().optional(),\n  roleIds: z.array(z.string().uuid()).min(1),\n  displayName: displayNameField.optional(),\n})\n\nexport const assignRolesSchema = z.object({\n  roleIds: z.array(z.string().uuid()).min(1),\n})\n\nexport const adminCreateUserSchema = z.object({\n  email: emailField,\n  password: passwordField,\n  displayName: displayNameField,\n  roleIds: z.array(z.string().uuid()).optional(),\n  customerEntityId: z.string().uuid().optional(),\n})\n\nexport const adminUpdateUserSchema = z.object({\n  displayName: displayNameField.optional(),\n  isActive: z.boolean().optional(),\n  lockedUntil: z.string().datetime().nullable().optional(),\n  personEntityId: z.string().uuid().nullable().optional(),\n  customerEntityId: z.string().uuid().nullable().optional(),\n  roleIds: z.array(z.string().uuid()).optional(),\n})\n\nexport const adminResetPasswordSchema = z.object({\n  newPassword: passwordField,\n})\n\nexport type AdminCreateUserInput = z.infer<typeof adminCreateUserSchema>\nexport type AdminResetPasswordInput = z.infer<typeof adminResetPasswordSchema>\nexport type SignupInput = z.infer<typeof signupSchema>\nexport type LoginInput = z.infer<typeof loginSchema>\nexport type EmailVerifyInput = z.infer<typeof emailVerifySchema>\nexport type PasswordResetRequestInput = z.infer<typeof passwordResetRequestSchema>\nexport type PasswordResetConfirmInput = z.infer<typeof passwordResetConfirmSchema>\nexport type MagicLinkRequestInput = z.infer<typeof magicLinkRequestSchema>\nexport type MagicLinkVerifyInput = z.infer<typeof magicLinkVerifySchema>\nexport type InvitationAcceptInput = z.infer<typeof invitationAcceptSchema>\nexport type ProfileUpdateInput = z.infer<typeof profileUpdateSchema>\nexport type PasswordChangeInput = z.infer<typeof passwordChangeSchema>\nexport type CreateRoleInput = z.infer<typeof createRoleSchema>\nexport type UpdateRoleInput = z.infer<typeof updateRoleSchema>\nexport type UpdateRoleAclInput = z.infer<typeof updateRoleAclSchema>\nexport type InviteUserInput = z.infer<typeof inviteUserSchema>\nexport type AssignRolesInput = z.infer<typeof assignRolesSchema>\nexport type AdminUpdateUserInput = z.infer<typeof adminUpdateUserSchema>\n\n// Custom domain mapping\nexport const hostnameSchema = z\n  .string()\n  .min(1, 'Hostname is required')\n  .max(512, 'Hostname is too long')\n  .transform((value, ctx) => {\n    try {\n      return normalizeHostname(value)\n    } catch (err) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: err instanceof Error ? err.message : 'Invalid hostname',\n      })\n      return z.NEVER\n    }\n  })\n\nexport const registerDomainSchema = z.object({\n  hostname: hostnameSchema,\n  organizationId: z.string().uuid(),\n  replacesDomainId: z.string().uuid().optional(),\n})\n\nexport type RegisterDomainInput = z.infer<typeof registerDomainSchema>\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,yBAAyB;AAElC,MAAM,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAC7C,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC/C,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAE3C,MAAM,eAAe,EAAE,OAAO;AAAA,EACnC,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,cAAc,EAAE,OAAO;AAAA,EAClC,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,UAAU;AACZ,CAAC;AAEM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAEM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,UAAU;AAAA,EACV,aAAa;AACf,CAAC;AAEM,MAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,aAAa,iBAAiB,SAAS;AACzC,CAAC;AAEM,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa;AACf,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,eAAe;AAAA,EACtD,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC5C,eAAe,EAAE,QAAQ,EAAE,SAAS;AACtC,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO;AAAA,EACP,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EACzC,aAAa,iBAAiB,SAAS;AACzC,CAAC;AAEM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAC3C,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7C,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC/C,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,aAAa,iBAAiB,SAAS;AAAA,EACvC,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAC/C,CAAC;AAEM,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,aAAa;AACf,CAAC;AAsBM,MAAM,iBAAiB,EAC3B,OAAO,EACP,IAAI,GAAG,sBAAsB,EAC7B,IAAI,KAAK,sBAAsB,EAC/B,UAAU,CAAC,OAAO,QAAQ;AACzB,MAAI;AACF,WAAO,kBAAkB,KAAK;AAAA,EAChC,SAAS,KAAK;AACZ,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS,eAAe,QAAQ,IAAI,UAAU;AAAA,IAChD,CAAC;AACD,WAAO,EAAE;AAAA,EACX;AACF,CAAC;AAEI,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,UAAU;AAAA,EACV,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC/C,CAAC;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/customerEntityOwnership.js ADDED Viewed

@@ -0,0 +1,22 @@
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+async function isOwnedCompanyEntity(em, customerEntityId, scope) {
+  const { CustomerEntity } = await import("@open-mercato/core/modules/customers/data/entities");
+  const entity = await findOneWithDecryption(
+    em,
+    CustomerEntity,
+    {
+      id: customerEntityId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      kind: "company",
+      deletedAt: null
+    },
+    void 0,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId }
+  );
+  return !!entity;
+}
+export {
+  isOwnedCompanyEntity
+};
+//# sourceMappingURL=customerEntityOwnership.js.map

package/dist/modules/customer_accounts/lib/customerEntityOwnership.js.map ADDED Viewed

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/customerEntityOwnership.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport type CustomerEntityScope = {\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n}\n\n/**\n * Confirms that a caller-supplied `customerEntityId` (the CRM company FK linked\n * onto a customer user) exists, is a company, is not soft-deleted, and belongs\n * to the caller's tenant and organization.\n *\n * Without this check an admin in org A could pass a company UUID from org B in\n * the same tenant and cross-link a customer user into another org's portal\n * context (#2693). The lookup is org-scoped to match how `CustomerEntity` rows\n * are created and listed.\n */\nexport async function isOwnedCompanyEntity(\n  em: EntityManager,\n  customerEntityId: string,\n  scope: CustomerEntityScope,\n): Promise<boolean> {\n  const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')\n  const entity = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: customerEntityId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      kind: 'company',\n      deletedAt: null,\n    } as any,\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  return !!entity\n}\n"],
+  "mappings": "AACA,SAAS,6BAA6B;AAiBtC,eAAsB,qBACpB,IACA,kBACA,OACkB;AAClB,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,oDAAoD;AAC5F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,SAAO,CAAC,CAAC;AACX;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/rateLimiter.js CHANGED Viewed

@@ -48,6 +48,18 @@ const customerMagicLinkIpRateLimitConfig = readEndpointRateLimitConfig("CUSTOMER
   blockDuration: 120,
   keyPrefix: "customer-magic-link-ip"
 });
+const customerInviteRateLimitConfig = readEndpointRateLimitConfig("CUSTOMER_INVITE", {
+  points: 5,
+  duration: 60,
+  blockDuration: 120,
+  keyPrefix: "customer-invite"
+});
+const customerInviteIpRateLimitConfig = readEndpointRateLimitConfig("CUSTOMER_INVITE_IP", {
+  points: 20,
+  duration: 60,
+  blockDuration: 120,
+  keyPrefix: "customer-invite-ip"
+});
 const domainResolveAllIpRateLimitConfig = readEndpointRateLimitConfig("DOMAIN_RESOLVE_ALL_IP", {
   points: 30,
   duration: 60,
@@ -56,6 +68,8 @@ const domainResolveAllIpRateLimitConfig = readEndpointRateLimitConfig("DOMAIN_RE
 });
 export {
   checkAuthRateLimit,
+  customerInviteIpRateLimitConfig,
+  customerInviteRateLimitConfig,
   customerLoginIpRateLimitConfig,
   customerLoginRateLimitConfig,
   customerMagicLinkIpRateLimitConfig,

package/dist/modules/customer_accounts/lib/rateLimiter.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/rateLimiter.ts"],
-  "sourcesContent": ["import { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\n\nexport const customerLoginRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'customer-login',\n})\n\nexport const customerLoginIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'customer-login-ip',\n})\n\nexport const customerSignupRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup',\n})\n\nexport const customerSignupIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup-ip',\n})\n\nexport const customerPasswordResetRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset',\n})\n\nexport const customerPasswordResetIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset-ip',\n})\n\nexport const customerMagicLinkRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link',\n})\n\nexport const customerMagicLinkIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link-ip',\n})\n\n// Bulk custom-domain warm-up endpoint (`/api/customer_accounts/domain-resolve/all`).\n// Single shared `DOMAIN_RESOLVE_SECRET` gates a payload that lists every active\n// custom-domain mapping in the deployment, so we cap requests per IP to make\n// brute-force or post-leak enumeration noisy. 30 req/min/IP comfortably covers\n// the Node middleware warm-up cadence (one call per process boot) while\n// staying well below useful enumeration throughput.\nexport const domainResolveAllIpRateLimitConfig = readEndpointRateLimitConfig('DOMAIN_RESOLVE_ALL_IP', {\n  points: 30, duration: 60, blockDuration: 60, keyPrefix: 'domain-resolve-all',\n})\n\nexport { checkAuthRateLimit, resetAuthRateLimit }\n"],
-  "mappings": "AAAA,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,mCAAmC;AAErC,MAAM,+BAA+B,4BAA4B,kBAAkB;AAAA,EACxF,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AAEM,MAAM,iCAAiC,4BAA4B,qBAAqB;AAAA,EAC7F,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,gCAAgC,4BAA4B,mBAAmB;AAAA,EAC1F,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,kCAAkC,4BAA4B,sBAAsB;AAAA,EAC/F,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,uCAAuC,4BAA4B,2BAA2B;AAAA,EACzG,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,yCAAyC,4BAA4B,8BAA8B;AAAA,EAC9G,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,mCAAmC,4BAA4B,uBAAuB;AAAA,EACjG,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,qCAAqC,4BAA4B,0BAA0B;AAAA,EACtG,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAQM,MAAM,oCAAoC,4BAA4B,yBAAyB;AAAA,EACpG,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;",
+  "sourcesContent": ["import { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\n\nexport const customerLoginRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'customer-login',\n})\n\nexport const customerLoginIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'customer-login-ip',\n})\n\nexport const customerSignupRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup',\n})\n\nexport const customerSignupIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup-ip',\n})\n\nexport const customerPasswordResetRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset',\n})\n\nexport const customerPasswordResetIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset-ip',\n})\n\nexport const customerMagicLinkRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link',\n})\n\nexport const customerMagicLinkIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link-ip',\n})\n\n// Staff- and portal-facing customer invitation endpoints\n// (`/api/customer_accounts/admin/users-invite`, `/api/customer_accounts/portal/users-invite`).\n// Both are authenticated, but a single authorized actor must not be able to mint\n// unbounded invitation rows/tokens. The compound layer caps repeated invitations\n// targeting the same recipient address from the same client, while the IP layer\n// caps overall invitation throughput per client.\nexport const customerInviteRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_INVITE', {\n  points: 5, duration: 60, blockDuration: 120, keyPrefix: 'customer-invite',\n})\n\nexport const customerInviteIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_INVITE_IP', {\n  points: 20, duration: 60, blockDuration: 120, keyPrefix: 'customer-invite-ip',\n})\n\n// Bulk custom-domain warm-up endpoint (`/api/customer_accounts/domain-resolve/all`).\n// Single shared `DOMAIN_RESOLVE_SECRET` gates a payload that lists every active\n// custom-domain mapping in the deployment, so we cap requests per IP to make\n// brute-force or post-leak enumeration noisy. 30 req/min/IP comfortably covers\n// the Node middleware warm-up cadence (one call per process boot) while\n// staying well below useful enumeration throughput.\nexport const domainResolveAllIpRateLimitConfig = readEndpointRateLimitConfig('DOMAIN_RESOLVE_ALL_IP', {\n  points: 30, duration: 60, blockDuration: 60, keyPrefix: 'domain-resolve-all',\n})\n\nexport { checkAuthRateLimit, resetAuthRateLimit }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,mCAAmC;AAErC,MAAM,+BAA+B,4BAA4B,kBAAkB;AAAA,EACxF,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AAEM,MAAM,iCAAiC,4BAA4B,qBAAqB;AAAA,EAC7F,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,gCAAgC,4BAA4B,mBAAmB;AAAA,EAC1F,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,kCAAkC,4BAA4B,sBAAsB;AAAA,EAC/F,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,uCAAuC,4BAA4B,2BAA2B;AAAA,EACzG,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,yCAAyC,4BAA4B,8BAA8B;AAAA,EAC9G,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,mCAAmC,4BAA4B,uBAAuB;AAAA,EACjG,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,qCAAqC,4BAA4B,0BAA0B;AAAA,EACtG,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAQM,MAAM,gCAAgC,4BAA4B,mBAAmB;AAAA,EAC1F,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,kCAAkC,4BAA4B,sBAAsB;AAAA,EAC/F,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAQM,MAAM,oCAAoC,4BAA4B,yBAAyB;AAAA,EACpG,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/resolveTenantContext.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { tryNormalizeHostname } from "@open-mercato/core/modules/customer_accounts/lib/hostname";
 import { platformDomains } from "@open-mercato/core/modules/customer_accounts/lib/platformDomains";
 import { secretEqual } from "@open-mercato/core/modules/customer_accounts/lib/secretCompare";
+import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 class TenantResolutionError extends Error {
   constructor(message, status) {
     super(message);
@@ -16,13 +17,55 @@ function readForcedHost(req) {
   const host = req.headers.get("x-force-host");
   return host && host.length > 0 ? host : null;
 }
+async function resolveTenantFromOrganization(organizationId, container) {
+  let em;
+  if (container) {
+    em = container.resolve("em");
+  } else {
+    const { createRequestContainer } = await import("@open-mercato/shared/lib/di/container");
+    const requestContainer = await createRequestContainer();
+    em = requestContainer.resolve("em");
+  }
+  const organization = await em.findOne(
+    Organization,
+    { id: organizationId, deletedAt: null },
+    { populate: ["tenant"] }
+  );
+  if (!organization) {
+    throw new TenantResolutionError("Organization not found", 400);
+  }
+  const tenantId = typeof organization.tenant === "string" ? organization.tenant : organization.tenant?.id ? String(organization.tenant.id) : null;
+  if (!tenantId) {
+    throw new TenantResolutionError("Organization not found", 400);
+  }
+  return { tenantId, organizationId: String(organization.id) };
+}
 async function resolveTenantContext(req, bodyTenantId, options) {
   const rawHost = readForcedHost(req) ?? req.headers.get("host");
   const hostname = rawHost ? tryNormalizeHostname(rawHost) : null;
   const isPlatform = hostname ? platformDomains().includes(hostname) : true;
+  const bodyOrganizationId = options?.organizationId ?? null;
   if (isPlatform) {
+    if (bodyOrganizationId) {
+      const resolved2 = await resolveTenantFromOrganization(bodyOrganizationId, options?.container);
+      if (bodyTenantId && bodyTenantId !== resolved2.tenantId) {
+        throw new TenantResolutionError(
+          "tenantId in request body does not match the resolved organization",
+          400
+        );
+      }
+      return {
+        source: "body",
+        tenantId: resolved2.tenantId,
+        organizationId: resolved2.organizationId,
+        hostname
+      };
+    }
     if (!bodyTenantId) {
-      throw new TenantResolutionError("tenantId is required for platform-domain logins", 400);
+      throw new TenantResolutionError(
+        "organizationId or tenantId is required for platform-domain logins",
+        400
+      );
     }
     return { source: "body", tenantId: bodyTenantId, organizationId: null, hostname };
   }

package/dist/modules/customer_accounts/lib/resolveTenantContext.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/resolveTenantContext.ts"],
-  "sourcesContent": ["/**\n * Resolve the tenant context for a customer-portal request.\n *\n * - Platform-domain hosts: require `tenantId` in the request body.\n * - Custom-domain hosts: resolve via `domainMappingService.resolveByHostname()`.\n *   If the body supplied a different `tenantId`, fail closed (mismatch).\n *\n * This is the single entry point used by all customer-auth routes (login,\n * signup, magic-link, password-reset) so they all behave consistently when\n * the request arrives on a tenant's branded URL.\n *\n * See `.ai/specs/2026-04-08-portal-custom-domain-routing.md` Phase 1.5.\n */\n\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\n\nexport class TenantResolutionError extends Error {\n  constructor(message: string, public readonly status: number) {\n    super(message)\n    this.name = 'TenantResolutionError'\n  }\n}\n\nexport type ResolvedTenantContext = {\n  source: 'body' | 'host'\n  tenantId: string\n  organizationId: string | null\n  hostname: string | null\n}\n\nfunction readForcedHost(req: Request): string | null {\n  // Test-only override. The middleware honors `X-Force-Host` only when\n  // `NODE_ENV === 'test'` AND `X-Force-Host-Secret` matches; we mirror the\n  // same check here so request-scoped helpers behave the same way under tests.\n  if (process.env.NODE_ENV !== 'test') return null\n  const expected = process.env.FORCE_HOST_SECRET\n  if (!expected) return null\n  if (!secretEqual(req.headers.get('x-force-host-secret'), expected)) return null\n  const host = req.headers.get('x-force-host')\n  return host && host.length > 0 ? host : null\n}\n\nexport async function resolveTenantContext(\n  req: Request,\n  bodyTenantId: string | null | undefined,\n  options?: { container?: AppContainer },\n): Promise<ResolvedTenantContext> {\n  const rawHost = readForcedHost(req) ?? req.headers.get('host')\n  const hostname = rawHost ? tryNormalizeHostname(rawHost) : null\n  const isPlatform = hostname ? platformDomains().includes(hostname) : true\n\n  if (isPlatform) {\n    if (!bodyTenantId) {\n      throw new TenantResolutionError('tenantId is required for platform-domain logins', 400)\n    }\n    return { source: 'body', tenantId: bodyTenantId, organizationId: null, hostname }\n  }\n\n  // Custom-domain host\n  let service: DomainMappingService | null = null\n  try {\n    if (options?.container) {\n      service = options.container.resolve('domainMappingService') as DomainMappingService\n    } else {\n      const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n      const container = await createRequestContainer()\n      service = container.resolve('domainMappingService') as DomainMappingService\n    }\n  } catch {\n    throw new TenantResolutionError('Custom domain routing is not available on this deployment', 503)\n  }\n\n  if (!hostname) throw new TenantResolutionError('Unable to determine request hostname', 400)\n  const resolved = await service.resolveByHostname(hostname)\n  if (!resolved || resolved.status !== 'active') {\n    throw new TenantResolutionError('This domain is not configured for any active organization', 404)\n  }\n\n  if (bodyTenantId && bodyTenantId !== resolved.tenantId) {\n    throw new TenantResolutionError(\n      'tenantId in request body does not match the resolved custom domain',\n      400,\n    )\n  }\n\n  return {\n    source: 'host',\n    tenantId: resolved.tenantId,\n    organizationId: resolved.organizationId,\n    hostname,\n  }\n}\n"],
-  "mappings": "AAcA,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAIrB,MAAM,8BAA8B,MAAM;AAAA,EAC/C,YAAY,SAAiC,QAAgB;AAC3D,UAAM,OAAO;AAD8B;AAE3C,SAAK,OAAO;AAAA,EACd;AACF;AASA,SAAS,eAAe,KAA6B;AAInD,MAAI,QAAQ,IAAI,aAAa,OAAQ,QAAO;AAC5C,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,CAAC,YAAY,IAAI,QAAQ,IAAI,qBAAqB,GAAG,QAAQ,EAAG,QAAO;AAC3E,QAAM,OAAO,IAAI,QAAQ,IAAI,cAAc;AAC3C,SAAO,QAAQ,KAAK,SAAS,IAAI,OAAO;AAC1C;AAEA,eAAsB,qBACpB,KACA,cACA,SACgC;AAChC,QAAM,UAAU,eAAe,GAAG,KAAK,IAAI,QAAQ,IAAI,MAAM;AAC7D,QAAM,WAAW,UAAU,qBAAqB,OAAO,IAAI;AAC3D,QAAM,aAAa,WAAW,gBAAgB,EAAE,SAAS,QAAQ,IAAI;AAErE,MAAI,YAAY;AACd,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,sBAAsB,mDAAmD,GAAG;AAAA,IACxF;AACA,WAAO,EAAE,QAAQ,QAAQ,UAAU,cAAc,gBAAgB,MAAM,SAAS;AAAA,EAClF;AAGA,MAAI,UAAuC;AAC3C,MAAI;AACF,QAAI,SAAS,WAAW;AACtB,gBAAU,QAAQ,UAAU,QAAQ,sBAAsB;AAAA,IAC5D,OAAO;AACL,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,YAAM,YAAY,MAAM,uBAAuB;AAC/C,gBAAU,UAAU,QAAQ,sBAAsB;AAAA,IACpD;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,sBAAsB,6DAA6D,GAAG;AAAA,EAClG;AAEA,MAAI,CAAC,SAAU,OAAM,IAAI,sBAAsB,wCAAwC,GAAG;AAC1F,QAAM,WAAW,MAAM,QAAQ,kBAAkB,QAAQ;AACzD,MAAI,CAAC,YAAY,SAAS,WAAW,UAAU;AAC7C,UAAM,IAAI,sBAAsB,6DAA6D,GAAG;AAAA,EAClG;AAEA,MAAI,gBAAgB,iBAAiB,SAAS,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB;AAAA,EACF;AACF;",
-  "names": []
+  "sourcesContent": ["/**\n * Resolve the tenant context for a customer-portal request.\n *\n * - Platform-domain hosts: resolve the tenant server-side from the body\n *   `organizationId` (org \u2192 tenant). A legacy body `tenantId` is still accepted\n *   and cross-checked against the resolved tenant (fail closed on mismatch); if\n *   no `organizationId` is supplied it falls back to the legacy `tenantId`.\n * - Custom-domain hosts: resolve via `domainMappingService.resolveByHostname()`.\n *   If the body supplied a different `tenantId`, fail closed (mismatch).\n *\n * This is the single entry point used by all customer-auth routes (login,\n * signup, magic-link, password-reset) so they all behave consistently when\n * the request arrives on a tenant's branded URL.\n *\n * See `.ai/specs/2026-04-08-portal-custom-domain-routing.md` Phase 1.5 and\n * `.ai/specs/2026-06-05-tenant-ownership-and-module-acl-authorization.md` \u00A7 C.\n */\n\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\n\nexport class TenantResolutionError extends Error {\n  constructor(message: string, public readonly status: number) {\n    super(message)\n    this.name = 'TenantResolutionError'\n  }\n}\n\nexport type ResolvedTenantContext = {\n  source: 'body' | 'host'\n  tenantId: string\n  organizationId: string | null\n  hostname: string | null\n}\n\nfunction readForcedHost(req: Request): string | null {\n  // Test-only override. The middleware honors `X-Force-Host` only when\n  // `NODE_ENV === 'test'` AND `X-Force-Host-Secret` matches; we mirror the\n  // same check here so request-scoped helpers behave the same way under tests.\n  if (process.env.NODE_ENV !== 'test') return null\n  const expected = process.env.FORCE_HOST_SECRET\n  if (!expected) return null\n  if (!secretEqual(req.headers.get('x-force-host-secret'), expected)) return null\n  const host = req.headers.get('x-force-host')\n  return host && host.length > 0 ? host : null\n}\n\nasync function resolveTenantFromOrganization(\n  organizationId: string,\n  container: AppContainer | undefined,\n): Promise<{ tenantId: string; organizationId: string }> {\n  let em: EntityManager\n  if (container) {\n    em = container.resolve('em') as EntityManager\n  } else {\n    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n    const requestContainer = await createRequestContainer()\n    em = requestContainer.resolve('em') as EntityManager\n  }\n\n  const organization = await em.findOne(\n    Organization,\n    { id: organizationId, deletedAt: null },\n    { populate: ['tenant'] },\n  )\n  if (!organization) {\n    throw new TenantResolutionError('Organization not found', 400)\n  }\n  const tenantId = typeof organization.tenant === 'string'\n    ? organization.tenant\n    : organization.tenant?.id\n      ? String(organization.tenant.id)\n      : null\n  if (!tenantId) {\n    throw new TenantResolutionError('Organization not found', 400)\n  }\n  return { tenantId, organizationId: String(organization.id) }\n}\n\nexport async function resolveTenantContext(\n  req: Request,\n  bodyTenantId: string | null | undefined,\n  options?: { container?: AppContainer; organizationId?: string | null },\n): Promise<ResolvedTenantContext> {\n  const rawHost = readForcedHost(req) ?? req.headers.get('host')\n  const hostname = rawHost ? tryNormalizeHostname(rawHost) : null\n  const isPlatform = hostname ? platformDomains().includes(hostname) : true\n  const bodyOrganizationId = options?.organizationId ?? null\n\n  if (isPlatform) {\n    if (bodyOrganizationId) {\n      const resolved = await resolveTenantFromOrganization(bodyOrganizationId, options?.container)\n      if (bodyTenantId && bodyTenantId !== resolved.tenantId) {\n        throw new TenantResolutionError(\n          'tenantId in request body does not match the resolved organization',\n          400,\n        )\n      }\n      return {\n        source: 'body',\n        tenantId: resolved.tenantId,\n        organizationId: resolved.organizationId,\n        hostname,\n      }\n    }\n    if (!bodyTenantId) {\n      throw new TenantResolutionError(\n        'organizationId or tenantId is required for platform-domain logins',\n        400,\n      )\n    }\n    return { source: 'body', tenantId: bodyTenantId, organizationId: null, hostname }\n  }\n\n  // Custom-domain host\n  let service: DomainMappingService | null = null\n  try {\n    if (options?.container) {\n      service = options.container.resolve('domainMappingService') as DomainMappingService\n    } else {\n      const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n      const container = await createRequestContainer()\n      service = container.resolve('domainMappingService') as DomainMappingService\n    }\n  } catch {\n    throw new TenantResolutionError('Custom domain routing is not available on this deployment', 503)\n  }\n\n  if (!hostname) throw new TenantResolutionError('Unable to determine request hostname', 400)\n  const resolved = await service.resolveByHostname(hostname)\n  if (!resolved || resolved.status !== 'active') {\n    throw new TenantResolutionError('This domain is not configured for any active organization', 404)\n  }\n\n  if (bodyTenantId && bodyTenantId !== resolved.tenantId) {\n    throw new TenantResolutionError(\n      'tenantId in request body does not match the resolved custom domain',\n      400,\n    )\n  }\n\n  return {\n    source: 'host',\n    tenantId: resolved.tenantId,\n    organizationId: resolved.organizationId,\n    hostname,\n  }\n}\n"],
+  "mappings": "AAkBA,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAKtB,MAAM,8BAA8B,MAAM;AAAA,EAC/C,YAAY,SAAiC,QAAgB;AAC3D,UAAM,OAAO;AAD8B;AAE3C,SAAK,OAAO;AAAA,EACd;AACF;AASA,SAAS,eAAe,KAA6B;AAInD,MAAI,QAAQ,IAAI,aAAa,OAAQ,QAAO;AAC5C,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,CAAC,YAAY,IAAI,QAAQ,IAAI,qBAAqB,GAAG,QAAQ,EAAG,QAAO;AAC3E,QAAM,OAAO,IAAI,QAAQ,IAAI,cAAc;AAC3C,SAAO,QAAQ,KAAK,SAAS,IAAI,OAAO;AAC1C;AAEA,eAAe,8BACb,gBACA,WACuD;AACvD,MAAI;AACJ,MAAI,WAAW;AACb,SAAK,UAAU,QAAQ,IAAI;AAAA,EAC7B,OAAO;AACL,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,UAAM,mBAAmB,MAAM,uBAAuB;AACtD,SAAK,iBAAiB,QAAQ,IAAI;AAAA,EACpC;AAEA,QAAM,eAAe,MAAM,GAAG;AAAA,IAC5B;AAAA,IACA,EAAE,IAAI,gBAAgB,WAAW,KAAK;AAAA,IACtC,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,EACzB;AACA,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,sBAAsB,0BAA0B,GAAG;AAAA,EAC/D;AACA,QAAM,WAAW,OAAO,aAAa,WAAW,WAC5C,aAAa,SACb,aAAa,QAAQ,KACnB,OAAO,aAAa,OAAO,EAAE,IAC7B;AACN,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,sBAAsB,0BAA0B,GAAG;AAAA,EAC/D;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO,aAAa,EAAE,EAAE;AAC7D;AAEA,eAAsB,qBACpB,KACA,cACA,SACgC;AAChC,QAAM,UAAU,eAAe,GAAG,KAAK,IAAI,QAAQ,IAAI,MAAM;AAC7D,QAAM,WAAW,UAAU,qBAAqB,OAAO,IAAI;AAC3D,QAAM,aAAa,WAAW,gBAAgB,EAAE,SAAS,QAAQ,IAAI;AACrE,QAAM,qBAAqB,SAAS,kBAAkB;AAEtD,MAAI,YAAY;AACd,QAAI,oBAAoB;AACtB,YAAMA,YAAW,MAAM,8BAA8B,oBAAoB,SAAS,SAAS;AAC3F,UAAI,gBAAgB,iBAAiBA,UAAS,UAAU;AACtD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,UAAUA,UAAS;AAAA,QACnB,gBAAgBA,UAAS;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,QAAQ,UAAU,cAAc,gBAAgB,MAAM,SAAS;AAAA,EAClF;AAGA,MAAI,UAAuC;AAC3C,MAAI;AACF,QAAI,SAAS,WAAW;AACtB,gBAAU,QAAQ,UAAU,QAAQ,sBAAsB;AAAA,IAC5D,OAAO;AACL,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,YAAM,YAAY,MAAM,uBAAuB;AAC/C,gBAAU,UAAU,QAAQ,sBAAsB;AAAA,IACpD;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,sBAAsB,6DAA6D,GAAG;AAAA,EAClG;AAEA,MAAI,CAAC,SAAU,OAAM,IAAI,sBAAsB,wCAAwC,GAAG;AAC1F,QAAM,WAAW,MAAM,QAAQ,kBAAkB,QAAQ;AACzD,MAAI,CAAC,YAAY,SAAS,WAAW,UAAU;AAC7C,UAAM,IAAI,sBAAsB,6DAA6D,GAAG;AAAA,EAClG;AAEA,MAAI,gBAAgB,iBAAiB,SAAS,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB;AAAA,EACF;AACF;",
+  "names": ["resolved"]
 }

package/dist/modules/customer_accounts/services/customerInvitationService.js CHANGED Viewed

@@ -17,12 +17,39 @@ class CustomerInvitationService {
   async createInvitation(email, scope, options) {
     const token = generateSecureToken();
     const emailHash = hashForLookup(email);
+    const normalizedEmail = email.toLowerCase().trim();
     const expiresAt = new Date(Date.now() + INVITATION_TTL_MS);
     const tokenHashed = hashToken(token);
+    const existing = await findOneWithDecryption(
+      this.em,
+      CustomerUserInvitation,
+      {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        emailHash,
+        acceptedAt: null,
+        cancelledAt: null,
+        expiresAt: { $gt: /* @__PURE__ */ new Date() }
+      },
+      void 0,
+      { tenantId: scope.tenantId, organizationId: scope.organizationId }
+    );
+    if (existing) {
+      existing.email = normalizedEmail;
+      existing.token = tokenHashed;
+      existing.customerEntityId = options.customerEntityId || null;
+      existing.roleIdsJson = options.roleIds;
+      existing.invitedByUserId = options.invitedByUserId || null;
+      existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null;
+      existing.displayName = options.displayName || null;
+      existing.expiresAt = expiresAt;
+      await this.em.flush();
+      return { invitation: existing, rawToken: token };
+    }
     const invitation = this.em.create(CustomerUserInvitation, {
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      email: email.toLowerCase().trim(),
+      email: normalizedEmail,
       emailHash,
       token: tokenHashed,
       customerEntityId: options.customerEntityId || null,

package/dist/modules/customer_accounts/services/customerInvitationService.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/customerInvitationService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport {\n  CustomerUser,\n  CustomerUserInvitation,\n  CustomerUserRole,\n  CustomerRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours\n\nexport class CustomerInvitationService {\n  constructor(private em: EntityManager) {}\n\n  async createInvitation(\n    email: string,\n    scope: { tenantId: string; organizationId: string },\n    options: {\n      customerEntityId?: string | null\n      roleIds: string[]\n      invitedByUserId?: string | null\n      invitedByCustomerUserId?: string | null\n      displayName?: string | null\n    },\n  ): Promise<{ invitation: CustomerUserInvitation; rawToken: string }> {\n    const token = generateSecureToken()\n    const emailHash = hashForLookup(email)\n    const expiresAt = new Date(Date.now() + INVITATION_TTL_MS)\n\n    const tokenHashed = hashToken(token)\n    const invitation = this.em.create(CustomerUserInvitation, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      email: email.toLowerCase().trim(),\n      emailHash,\n      token: tokenHashed,\n      customerEntityId: options.customerEntityId || null,\n      roleIdsJson: options.roleIds,\n      invitedByUserId: options.invitedByUserId || null,\n      invitedByCustomerUserId: options.invitedByCustomerUserId || null,\n      displayName: options.displayName || null,\n      expiresAt,\n      createdAt: new Date(),\n    } as any) as CustomerUserInvitation\n    await this.em.persist(invitation).flush()\n    return { invitation, rawToken: token }\n  }\n\n  async findByToken(token: string): Promise<CustomerUserInvitation | null> {\n    const tokenHashed = hashToken(token)\n    const invitation = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      { token: tokenHashed } as any,\n    )\n    if (!invitation) return null\n    if (invitation.acceptedAt) return null\n    if (invitation.cancelledAt) return null\n    if (invitation.expiresAt.getTime() < Date.now()) return null\n    return invitation\n  }\n\n  async acceptInvitation(\n    token: string,\n    password: string,\n    displayName: string,\n  ): Promise<{ user: CustomerUser; invitation: CustomerUserInvitation } | null> {\n    const invitation = await this.findByToken(token)\n    if (!invitation) return null\n\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(invitation.email)\n\n    // Create user\n    const user = this.em.create(CustomerUser, {\n      email: invitation.email,\n      emailHash,\n      passwordHash,\n      displayName: displayName || invitation.displayName || invitation.email,\n      tenantId: invitation.tenantId,\n      organizationId: invitation.organizationId,\n      customerEntityId: invitation.customerEntityId || null,\n      isActive: true,\n      emailVerifiedAt: new Date(), // Invitation implicitly verifies email\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any) as CustomerUser\n    this.em.persist(user)\n\n    // Assign roles\n    const roleIds = Array.isArray(invitation.roleIdsJson) ? invitation.roleIdsJson : []\n    const roles = roleIds.length > 0\n      ? await findWithDecryption(\n          this.em,\n          CustomerRole,\n          {\n            id: { $in: roleIds } as any,\n            tenantId: invitation.tenantId,\n            deletedAt: null,\n          } as any,\n          undefined,\n          { tenantId: invitation.tenantId, organizationId: invitation.organizationId },\n        )\n      : []\n    for (const role of roles) {\n      const userRole = this.em.create(CustomerUserRole, {\n        user,\n        role,\n        createdAt: new Date(),\n      } as any)\n      this.em.persist(userRole)\n    }\n\n    // Mark invitation as accepted\n    invitation.acceptedAt = new Date()\n\n    await this.em.flush()\n    return { user, invitation }\n  }\n}\n"],
-  "mappings": "AACA,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB,0BAA0B;AAE1D,MAAM,cAAc;AACpB,MAAM,oBAAoB,KAAK,KAAK,KAAK;AAElC,MAAM,0BAA0B;AAAA,EACrC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,iBACJ,OACA,OACA,SAOmE;AACnE,UAAM,QAAQ,oBAAoB;AAClC,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AAEzD,UAAM,cAAc,UAAU,KAAK;AACnC,UAAM,aAAa,KAAK,GAAG,OAAO,wBAAwB;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,MAChC;AAAA,MACA,OAAO;AAAA,MACP,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ;AAAA,MACrB,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,yBAAyB,QAAQ,2BAA2B;AAAA,MAC5D,aAAa,QAAQ,eAAe;AAAA,MACpC;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,UAAU,EAAE,MAAM;AACxC,WAAO,EAAE,YAAY,UAAU,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,YAAY,OAAuD;AACvE,UAAM,cAAc,UAAU,KAAK;AACnC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,OAAO,YAAY;AAAA,IACvB;AACA,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,WAAW,WAAY,QAAO;AAClC,QAAI,WAAW,YAAa,QAAO;AACnC,QAAI,WAAW,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBACJ,OACA,UACA,aAC4E;AAC5E,UAAM,aAAa,MAAM,KAAK,YAAY,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,WAAW,KAAK;AAGhD,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,WAAW;AAAA,MAClB;AAAA,MACA;AAAA,MACA,aAAa,eAAe,WAAW,eAAe,WAAW;AAAA,MACjE,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,kBAAkB,WAAW,oBAAoB;AAAA,MACjD,UAAU;AAAA,MACV,iBAAiB,oBAAI,KAAK;AAAA;AAAA,MAC1B,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,SAAK,GAAG,QAAQ,IAAI;AAGpB,UAAM,UAAU,MAAM,QAAQ,WAAW,WAAW,IAAI,WAAW,cAAc,CAAC;AAClF,UAAM,QAAQ,QAAQ,SAAS,IAC3B,MAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,QAAQ;AAAA,QACnB,UAAU,WAAW;AAAA,QACrB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E,IACA,CAAC;AACL,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,GAAG,OAAO,kBAAkB;AAAA,QAChD;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,WAAK,GAAG,QAAQ,QAAQ;AAAA,IAC1B;AAGA,eAAW,aAAa,oBAAI,KAAK;AAEjC,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport {\n  CustomerUser,\n  CustomerUserInvitation,\n  CustomerUserRole,\n  CustomerRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours\n\nexport class CustomerInvitationService {\n  constructor(private em: EntityManager) {}\n\n  async createInvitation(\n    email: string,\n    scope: { tenantId: string; organizationId: string },\n    options: {\n      customerEntityId?: string | null\n      roleIds: string[]\n      invitedByUserId?: string | null\n      invitedByCustomerUserId?: string | null\n      displayName?: string | null\n    },\n  ): Promise<{ invitation: CustomerUserInvitation; rawToken: string }> {\n    const token = generateSecureToken()\n    const emailHash = hashForLookup(email)\n    const normalizedEmail = email.toLowerCase().trim()\n    const expiresAt = new Date(Date.now() + INVITATION_TTL_MS)\n    const tokenHashed = hashToken(token)\n\n    // Dedupe: reuse an existing pending (not accepted, not cancelled, unexpired)\n    // invitation for the same recipient instead of inserting a new row. This caps\n    // row/token growth and keeps a single live token per concurrently-pending\n    // (tenant, organization, email) tuple.\n    const existing = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        emailHash,\n        acceptedAt: null,\n        cancelledAt: null,\n        expiresAt: { $gt: new Date() },\n      } as any,\n      undefined,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    )\n\n    if (existing) {\n      existing.email = normalizedEmail\n      existing.token = tokenHashed\n      existing.customerEntityId = options.customerEntityId || null\n      existing.roleIdsJson = options.roleIds\n      existing.invitedByUserId = options.invitedByUserId || null\n      existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null\n      existing.displayName = options.displayName || null\n      existing.expiresAt = expiresAt\n      await this.em.flush()\n      return { invitation: existing, rawToken: token }\n    }\n\n    const invitation = this.em.create(CustomerUserInvitation, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      email: normalizedEmail,\n      emailHash,\n      token: tokenHashed,\n      customerEntityId: options.customerEntityId || null,\n      roleIdsJson: options.roleIds,\n      invitedByUserId: options.invitedByUserId || null,\n      invitedByCustomerUserId: options.invitedByCustomerUserId || null,\n      displayName: options.displayName || null,\n      expiresAt,\n      createdAt: new Date(),\n    } as any) as CustomerUserInvitation\n    await this.em.persist(invitation).flush()\n    return { invitation, rawToken: token }\n  }\n\n  async findByToken(token: string): Promise<CustomerUserInvitation | null> {\n    const tokenHashed = hashToken(token)\n    const invitation = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      { token: tokenHashed } as any,\n    )\n    if (!invitation) return null\n    if (invitation.acceptedAt) return null\n    if (invitation.cancelledAt) return null\n    if (invitation.expiresAt.getTime() < Date.now()) return null\n    return invitation\n  }\n\n  async acceptInvitation(\n    token: string,\n    password: string,\n    displayName: string,\n  ): Promise<{ user: CustomerUser; invitation: CustomerUserInvitation } | null> {\n    const invitation = await this.findByToken(token)\n    if (!invitation) return null\n\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(invitation.email)\n\n    // Create user\n    const user = this.em.create(CustomerUser, {\n      email: invitation.email,\n      emailHash,\n      passwordHash,\n      displayName: displayName || invitation.displayName || invitation.email,\n      tenantId: invitation.tenantId,\n      organizationId: invitation.organizationId,\n      customerEntityId: invitation.customerEntityId || null,\n      isActive: true,\n      emailVerifiedAt: new Date(), // Invitation implicitly verifies email\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any) as CustomerUser\n    this.em.persist(user)\n\n    // Assign roles\n    const roleIds = Array.isArray(invitation.roleIdsJson) ? invitation.roleIdsJson : []\n    const roles = roleIds.length > 0\n      ? await findWithDecryption(\n          this.em,\n          CustomerRole,\n          {\n            id: { $in: roleIds } as any,\n            tenantId: invitation.tenantId,\n            deletedAt: null,\n          } as any,\n          undefined,\n          { tenantId: invitation.tenantId, organizationId: invitation.organizationId },\n        )\n      : []\n    for (const role of roles) {\n      const userRole = this.em.create(CustomerUserRole, {\n        user,\n        role,\n        createdAt: new Date(),\n      } as any)\n      this.em.persist(userRole)\n    }\n\n    // Mark invitation as accepted\n    invitation.acceptedAt = new Date()\n\n    await this.em.flush()\n    return { user, invitation }\n  }\n}\n"],
+  "mappings": "AACA,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB,0BAA0B;AAE1D,MAAM,cAAc;AACpB,MAAM,oBAAoB,KAAK,KAAK,KAAK;AAElC,MAAM,0BAA0B;AAAA,EACrC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,iBACJ,OACA,OACA,SAOmE;AACnE,UAAM,QAAQ,oBAAoB;AAClC,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,kBAAkB,MAAM,YAAY,EAAE,KAAK;AACjD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AACzD,UAAM,cAAc,UAAU,KAAK;AAMnC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AAEA,QAAI,UAAU;AACZ,eAAS,QAAQ;AACjB,eAAS,QAAQ;AACjB,eAAS,mBAAmB,QAAQ,oBAAoB;AACxD,eAAS,cAAc,QAAQ;AAC/B,eAAS,kBAAkB,QAAQ,mBAAmB;AACtD,eAAS,0BAA0B,QAAQ,2BAA2B;AACtE,eAAS,cAAc,QAAQ,eAAe;AAC9C,eAAS,YAAY;AACrB,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,YAAY,UAAU,UAAU,MAAM;AAAA,IACjD;AAEA,UAAM,aAAa,KAAK,GAAG,OAAO,wBAAwB;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ;AAAA,MACrB,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,yBAAyB,QAAQ,2BAA2B;AAAA,MAC5D,aAAa,QAAQ,eAAe;AAAA,MACpC;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,UAAU,EAAE,MAAM;AACxC,WAAO,EAAE,YAAY,UAAU,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,YAAY,OAAuD;AACvE,UAAM,cAAc,UAAU,KAAK;AACnC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,OAAO,YAAY;AAAA,IACvB;AACA,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,WAAW,WAAY,QAAO;AAClC,QAAI,WAAW,YAAa,QAAO;AACnC,QAAI,WAAW,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBACJ,OACA,UACA,aAC4E;AAC5E,UAAM,aAAa,MAAM,KAAK,YAAY,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,WAAW,KAAK;AAGhD,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,WAAW;AAAA,MAClB;AAAA,MACA;AAAA,MACA,aAAa,eAAe,WAAW,eAAe,WAAW;AAAA,MACjE,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,kBAAkB,WAAW,oBAAoB;AAAA,MACjD,UAAU;AAAA,MACV,iBAAiB,oBAAI,KAAK;AAAA;AAAA,MAC1B,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,SAAK,GAAG,QAAQ,IAAI;AAGpB,UAAM,UAAU,MAAM,QAAQ,WAAW,WAAW,IAAI,WAAW,cAAc,CAAC;AAClF,UAAM,QAAQ,QAAQ,SAAS,IAC3B,MAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,QAAQ;AAAA,QACnB,UAAU,WAAW;AAAA,QACrB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E,IACA,CAAC;AACL,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,GAAG,OAAO,kBAAkB;AAAA,QAChD;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,WAAK,GAAG,QAAQ,QAAQ;AAAA,IAC1B;AAGA,eAAW,aAAa,oBAAI,KAAK;AAEjC,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/services/customerUserService.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { hash, compare } from "bcryptjs";
 import { CustomerUser } from "@open-mercato/core/modules/customer_accounts/data/entities";
-import { hashForLookup } from "@open-mercato/shared/lib/encryption/aes";
+import { hashForLookup, lookupHashCandidates } from "@open-mercato/shared/lib/encryption/aes";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 const BCRYPT_COST = 10;
 const MAX_FAILED_ATTEMPTS = 5;
 const LOCKOUT_DURATION_MS = 15 * 60 * 1e3;
@@ -25,12 +26,17 @@ class CustomerUserService {
     return user;
   }
   async findByEmail(email, tenantId) {
-    const emailHash = hashForLookup(email);
-    return this.em.findOne(CustomerUser, {
-      emailHash,
-      tenantId,
-      deletedAt: null
-    });
+    return findOneWithDecryption(
+      this.em,
+      CustomerUser,
+      {
+        emailHash: { $in: lookupHashCandidates(email) },
+        tenantId,
+        deletedAt: null
+      },
+      void 0,
+      { tenantId }
+    );
   }
   async findById(id, tenantId) {
     return this.em.findOne(CustomerUser, { id, tenantId, deletedAt: null });