@open-mercato/core 0.6.5-develop.5382.1.f542de69af → 0.6.5

package/dist/helpers/integration/crmFixtures.js

@@ -50,6 +50,10 @@ async function createDealFixture(request, token, input) {
   if (input.pipelineStageId) data.pipelineStageId = input.pipelineStageId;
   if (input.valueAmount !== void 0) data.valueAmount = input.valueAmount;
   if (input.valueCurrency) data.valueCurrency = input.valueCurrency;
+  if (input.status) data.status = input.status;
+  if (input.expectedCloseAt) data.expectedCloseAt = input.expectedCloseAt;
+  if (input.ownerUserId) data.ownerUserId = input.ownerUserId;
+  if (input.closureOutcome) data.closureOutcome = input.closureOutcome;
   return createEntity(request, token, "/api/customers/deals", data, ["dealId", "id", "entityId"]);
 }
 async function createPipelineFixture(request, token, input) {

package/dist/helpers/integration/crmFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/crmFixtures.ts"],
-  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { readJsonSafe } from './generalFixtures';\n\ntype JsonRecord = Record<string, unknown>;\n\nexport { readJsonSafe } from './generalFixtures';\n\nfunction isRecord(value: unknown): value is JsonRecord {\n  return typeof value === 'object' && value !== null;\n}\n\nfunction findStringByKeys(value: unknown, keys: readonly string[]): string | null {\n  if (!isRecord(value)) return null;\n\n  for (const key of keys) {\n    const candidate = value[key];\n    if (typeof candidate === 'string' && candidate.trim().length > 0) {\n      return candidate.trim();\n    }\n  }\n\n  for (const nested of Object.values(value)) {\n    if (Array.isArray(nested)) continue;\n    const found = findStringByKeys(nested, keys);\n    if (found) return found;\n  }\n\n  return null;\n}\n\nasync function createEntity(\n  request: APIRequestContext,\n  token: string,\n  path: string,\n  data: Record<string, unknown>,\n  idKeys: readonly string[],\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', path, { token, data });\n  const payload = await readJsonSafe(response);\n  expect(response.ok(), `Failed POST ${path}: ${response.status()}`).toBeTruthy();\n  const id = findStringByKeys(payload, idKeys);\n  expect(id, `No id in ${path} response`).toBeTruthy();\n  return id as string;\n}\n\nexport async function createCompanyFixture(\n  request: APIRequestContext,\n  token: string,\n  displayName: string,\n): Promise<string> {\n  return createEntity(request, token, '/api/customers/companies', { displayName }, ['id', 'entityId', 'companyId']);\n}\n\nexport async function createPersonFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { firstName: string; lastName: string; displayName: string; companyEntityId?: string },\n): Promise<string> {\n  const data: Record<string, unknown> = {\n    firstName: input.firstName,\n    lastName: input.lastName,\n    displayName: input.displayName,\n  };\n  if (input.companyEntityId) {\n    data.companyEntityId = input.companyEntityId;\n  }\n  return createEntity(request, token, '/api/customers/people', data, ['id', 'entityId', 'personId']);\n}\n\nexport async function createDealFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { title: string; companyIds?: string[]; personIds?: string[]; pipelineId?: string; pipelineStageId?: string; valueAmount?: number; valueCurrency?: string },\n): Promise<string> {\n  const data: Record<string, unknown> = { title: input.title };\n  if (input.companyIds?.length) data.companyIds = input.companyIds;\n  if (input.personIds?.length) data.personIds = input.personIds;\n  if (input.pipelineId) data.pipelineId = input.pipelineId;\n  if (input.pipelineStageId) data.pipelineStageId = input.pipelineStageId;\n  if (input.valueAmount !== undefined) data.valueAmount = input.valueAmount;\n  if (input.valueCurrency) data.valueCurrency = input.valueCurrency;\n  return createEntity(request, token, '/api/customers/deals', data, ['dealId', 'id', 'entityId']);\n}\n\nexport async function createPipelineFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { name: string; isDefault?: boolean },\n): Promise<string> {\n  const data: Record<string, unknown> = { name: input.name };\n  if (input.isDefault !== undefined) data.isDefault = input.isDefault;\n  return createEntity(request, token, '/api/customers/pipelines', data, ['id', 'pipelineId']);\n}\n\nexport async function createPipelineStageFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { pipelineId: string; label: string; order?: number },\n): Promise<string> {\n  const data: Record<string, unknown> = { pipelineId: input.pipelineId, label: input.label };\n  if (input.order !== undefined) data.order = input.order;\n  return createEntity(request, token, '/api/customers/pipeline-stages', data, ['id', 'stageId']);\n}\n\nexport async function deleteEntityByBody(\n  request: APIRequestContext,\n  token: string | null,\n  path: string,\n  id: string | null,\n): Promise<void> {\n  if (!token || !id) return;\n  try {\n    await apiRequest(request, 'DELETE', path, { token, data: { id } });\n  } catch {\n    return;\n  }\n}\n\nexport async function deleteEntityIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  path: string,\n  id: string | null,\n): Promise<void> {\n  if (!token || !id) return;\n  try {\n    await apiRequest(request, 'DELETE', `${path}?id=${encodeURIComponent(id)}`, { token });\n  } catch {\n    return;\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAI7B,SAAS,gBAAAA,qBAAoB;AAE7B,SAAS,SAAS,OAAqC;AACrD,SAAO,OAAO,UAAU,YAAY,UAAU;AAChD;AAEA,SAAS,iBAAiB,OAAgB,MAAwC;AAChF,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAE7B,aAAW,OAAO,MAAM;AACtB,UAAM,YAAY,MAAM,GAAG;AAC3B,QAAI,OAAO,cAAc,YAAY,UAAU,KAAK,EAAE,SAAS,GAAG;AAChE,aAAO,UAAU,KAAK;AAAA,IACxB;AAAA,EACF;AAEA,aAAW,UAAU,OAAO,OAAO,KAAK,GAAG;AACzC,QAAI,MAAM,QAAQ,MAAM,EAAG;AAC3B,UAAM,QAAQ,iBAAiB,QAAQ,IAAI;AAC3C,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,SAAO;AACT;AAEA,eAAe,aACb,SACA,OACA,MACA,MACA,QACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC;AACxE,QAAM,UAAU,MAAM,aAAa,QAAQ;AAC3C,SAAO,SAAS,GAAG,GAAG,eAAe,IAAI,KAAK,SAAS,OAAO,CAAC,EAAE,EAAE,WAAW;AAC9E,QAAM,KAAK,iBAAiB,SAAS,MAAM;AAC3C,SAAO,IAAI,YAAY,IAAI,WAAW,EAAE,WAAW;AACnD,SAAO;AACT;AAEA,eAAsB,qBACpB,SACA,OACA,aACiB;AACjB,SAAO,aAAa,SAAS,OAAO,4BAA4B,EAAE,YAAY,GAAG,CAAC,MAAM,YAAY,WAAW,CAAC;AAClH;AAEA,eAAsB,oBACpB,SACA,OACA,OACiB;AACjB,QAAM,OAAgC;AAAA,IACpC,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,aAAa,MAAM;AAAA,EACrB;AACA,MAAI,MAAM,iBAAiB;AACzB,SAAK,kBAAkB,MAAM;AAAA,EAC/B;AACA,SAAO,aAAa,SAAS,OAAO,yBAAyB,MAAM,CAAC,MAAM,YAAY,UAAU,CAAC;AACnG;AAEA,eAAsB,kBACpB,SACA,OACA,OACiB;AACjB,QAAM,OAAgC,EAAE,OAAO,MAAM,MAAM;AAC3D,MAAI,MAAM,YAAY,OAAQ,MAAK,aAAa,MAAM;AACtD,MAAI,MAAM,WAAW,OAAQ,MAAK,YAAY,MAAM;AACpD,MAAI,MAAM,WAAY,MAAK,aAAa,MAAM;AAC9C,MAAI,MAAM,gBAAiB,MAAK,kBAAkB,MAAM;AACxD,MAAI,MAAM,gBAAgB,OAAW,MAAK,cAAc,MAAM;AAC9D,MAAI,MAAM,cAAe,MAAK,gBAAgB,MAAM;AACpD,SAAO,aAAa,SAAS,OAAO,wBAAwB,MAAM,CAAC,UAAU,MAAM,UAAU,CAAC;AAChG;AAEA,eAAsB,sBACpB,SACA,OACA,OACiB;AACjB,QAAM,OAAgC,EAAE,MAAM,MAAM,KAAK;AACzD,MAAI,MAAM,cAAc,OAAW,MAAK,YAAY,MAAM;AAC1D,SAAO,aAAa,SAAS,OAAO,4BAA4B,MAAM,CAAC,MAAM,YAAY,CAAC;AAC5F;AAEA,eAAsB,2BACpB,SACA,OACA,OACiB;AACjB,QAAM,OAAgC,EAAE,YAAY,MAAM,YAAY,OAAO,MAAM,MAAM;AACzF,MAAI,MAAM,UAAU,OAAW,MAAK,QAAQ,MAAM;AAClD,SAAO,aAAa,SAAS,OAAO,kCAAkC,MAAM,CAAC,MAAM,SAAS,CAAC;AAC/F;AAEA,eAAsB,mBACpB,SACA,OACA,MACA,IACe;AACf,MAAI,CAAC,SAAS,CAAC,GAAI;AACnB,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC;AAAA,EACnE,QAAQ;AACN;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,SACA,OACA,MACA,IACe;AACf,MAAI,CAAC,SAAS,CAAC,GAAI;AACnB,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,GAAG,IAAI,OAAO,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;AAAA,EACvF,QAAQ;AACN;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { readJsonSafe } from './generalFixtures';\n\ntype JsonRecord = Record<string, unknown>;\n\nexport { readJsonSafe } from './generalFixtures';\n\nfunction isRecord(value: unknown): value is JsonRecord {\n  return typeof value === 'object' && value !== null;\n}\n\nfunction findStringByKeys(value: unknown, keys: readonly string[]): string | null {\n  if (!isRecord(value)) return null;\n\n  for (const key of keys) {\n    const candidate = value[key];\n    if (typeof candidate === 'string' && candidate.trim().length > 0) {\n      return candidate.trim();\n    }\n  }\n\n  for (const nested of Object.values(value)) {\n    if (Array.isArray(nested)) continue;\n    const found = findStringByKeys(nested, keys);\n    if (found) return found;\n  }\n\n  return null;\n}\n\nasync function createEntity(\n  request: APIRequestContext,\n  token: string,\n  path: string,\n  data: Record<string, unknown>,\n  idKeys: readonly string[],\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', path, { token, data });\n  const payload = await readJsonSafe(response);\n  expect(response.ok(), `Failed POST ${path}: ${response.status()}`).toBeTruthy();\n  const id = findStringByKeys(payload, idKeys);\n  expect(id, `No id in ${path} response`).toBeTruthy();\n  return id as string;\n}\n\nexport async function createCompanyFixture(\n  request: APIRequestContext,\n  token: string,\n  displayName: string,\n): Promise<string> {\n  return createEntity(request, token, '/api/customers/companies', { displayName }, ['id', 'entityId', 'companyId']);\n}\n\nexport async function createPersonFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { firstName: string; lastName: string; displayName: string; companyEntityId?: string },\n): Promise<string> {\n  const data: Record<string, unknown> = {\n    firstName: input.firstName,\n    lastName: input.lastName,\n    displayName: input.displayName,\n  };\n  if (input.companyEntityId) {\n    data.companyEntityId = input.companyEntityId;\n  }\n  return createEntity(request, token, '/api/customers/people', data, ['id', 'entityId', 'personId']);\n}\n\nexport async function createDealFixture(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    title: string;\n    companyIds?: string[];\n    personIds?: string[];\n    pipelineId?: string;\n    pipelineStageId?: string;\n    valueAmount?: number;\n    valueCurrency?: string;\n    // Optional deal lifecycle fields \u2014 all valid on `dealCreateSchema`. Forwarded so KPI/summary\n    // tests can seed won/lost/overdue/owned deals across quarters (see TC-CRM-082). `status` is a\n    // free-form dictionary value (e.g. 'open', 'in_progress', 'win', 'loose'); `expectedCloseAt`\n    // accepts an ISO string (the schema coerces it to a Date); `closureOutcome` is 'won' | 'lost'.\n    status?: string;\n    expectedCloseAt?: string;\n    ownerUserId?: string;\n    closureOutcome?: 'won' | 'lost';\n  },\n): Promise<string> {\n  const data: Record<string, unknown> = { title: input.title };\n  if (input.companyIds?.length) data.companyIds = input.companyIds;\n  if (input.personIds?.length) data.personIds = input.personIds;\n  if (input.pipelineId) data.pipelineId = input.pipelineId;\n  if (input.pipelineStageId) data.pipelineStageId = input.pipelineStageId;\n  if (input.valueAmount !== undefined) data.valueAmount = input.valueAmount;\n  if (input.valueCurrency) data.valueCurrency = input.valueCurrency;\n  if (input.status) data.status = input.status;\n  if (input.expectedCloseAt) data.expectedCloseAt = input.expectedCloseAt;\n  if (input.ownerUserId) data.ownerUserId = input.ownerUserId;\n  if (input.closureOutcome) data.closureOutcome = input.closureOutcome;\n  return createEntity(request, token, '/api/customers/deals', data, ['dealId', 'id', 'entityId']);\n}\n\nexport async function createPipelineFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { name: string; isDefault?: boolean },\n): Promise<string> {\n  const data: Record<string, unknown> = { name: input.name };\n  if (input.isDefault !== undefined) data.isDefault = input.isDefault;\n  return createEntity(request, token, '/api/customers/pipelines', data, ['id', 'pipelineId']);\n}\n\nexport async function createPipelineStageFixture(\n  request: APIRequestContext,\n  token: string,\n  input: { pipelineId: string; label: string; order?: number },\n): Promise<string> {\n  const data: Record<string, unknown> = { pipelineId: input.pipelineId, label: input.label };\n  if (input.order !== undefined) data.order = input.order;\n  return createEntity(request, token, '/api/customers/pipeline-stages', data, ['id', 'stageId']);\n}\n\nexport async function deleteEntityByBody(\n  request: APIRequestContext,\n  token: string | null,\n  path: string,\n  id: string | null,\n): Promise<void> {\n  if (!token || !id) return;\n  try {\n    await apiRequest(request, 'DELETE', path, { token, data: { id } });\n  } catch {\n    return;\n  }\n}\n\nexport async function deleteEntityIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  path: string,\n  id: string | null,\n): Promise<void> {\n  if (!token || !id) return;\n  try {\n    await apiRequest(request, 'DELETE', `${path}?id=${encodeURIComponent(id)}`, { token });\n  } catch {\n    return;\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAI7B,SAAS,gBAAAA,qBAAoB;AAE7B,SAAS,SAAS,OAAqC;AACrD,SAAO,OAAO,UAAU,YAAY,UAAU;AAChD;AAEA,SAAS,iBAAiB,OAAgB,MAAwC;AAChF,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAE7B,aAAW,OAAO,MAAM;AACtB,UAAM,YAAY,MAAM,GAAG;AAC3B,QAAI,OAAO,cAAc,YAAY,UAAU,KAAK,EAAE,SAAS,GAAG;AAChE,aAAO,UAAU,KAAK;AAAA,IACxB;AAAA,EACF;AAEA,aAAW,UAAU,OAAO,OAAO,KAAK,GAAG;AACzC,QAAI,MAAM,QAAQ,MAAM,EAAG;AAC3B,UAAM,QAAQ,iBAAiB,QAAQ,IAAI;AAC3C,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,SAAO;AACT;AAEA,eAAe,aACb,SACA,OACA,MACA,MACA,QACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC;AACxE,QAAM,UAAU,MAAM,aAAa,QAAQ;AAC3C,SAAO,SAAS,GAAG,GAAG,eAAe,IAAI,KAAK,SAAS,OAAO,CAAC,EAAE,EAAE,WAAW;AAC9E,QAAM,KAAK,iBAAiB,SAAS,MAAM;AAC3C,SAAO,IAAI,YAAY,IAAI,WAAW,EAAE,WAAW;AACnD,SAAO;AACT;AAEA,eAAsB,qBACpB,SACA,OACA,aACiB;AACjB,SAAO,aAAa,SAAS,OAAO,4BAA4B,EAAE,YAAY,GAAG,CAAC,MAAM,YAAY,WAAW,CAAC;AAClH;AAEA,eAAsB,oBACpB,SACA,OACA,OACiB;AACjB,QAAM,OAAgC;AAAA,IACpC,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,aAAa,MAAM;AAAA,EACrB;AACA,MAAI,MAAM,iBAAiB;AACzB,SAAK,kBAAkB,MAAM;AAAA,EAC/B;AACA,SAAO,aAAa,SAAS,OAAO,yBAAyB,MAAM,CAAC,MAAM,YAAY,UAAU,CAAC;AACnG;AAEA,eAAsB,kBACpB,SACA,OACA,OAiBiB;AACjB,QAAM,OAAgC,EAAE,OAAO,MAAM,MAAM;AAC3D,MAAI,MAAM,YAAY,OAAQ,MAAK,aAAa,MAAM;AACtD,MAAI,MAAM,WAAW,OAAQ,MAAK,YAAY,MAAM;AACpD,MAAI,MAAM,WAAY,MAAK,aAAa,MAAM;AAC9C,MAAI,MAAM,gBAAiB,MAAK,kBAAkB,MAAM;AACxD,MAAI,MAAM,gBAAgB,OAAW,MAAK,cAAc,MAAM;AAC9D,MAAI,MAAM,cAAe,MAAK,gBAAgB,MAAM;AACpD,MAAI,MAAM,OAAQ,MAAK,SAAS,MAAM;AACtC,MAAI,MAAM,gBAAiB,MAAK,kBAAkB,MAAM;AACxD,MAAI,MAAM,YAAa,MAAK,cAAc,MAAM;AAChD,MAAI,MAAM,eAAgB,MAAK,iBAAiB,MAAM;AACtD,SAAO,aAAa,SAAS,OAAO,wBAAwB,MAAM,CAAC,UAAU,MAAM,UAAU,CAAC;AAChG;AAEA,eAAsB,sBACpB,SACA,OACA,OACiB;AACjB,QAAM,OAAgC,EAAE,MAAM,MAAM,KAAK;AACzD,MAAI,MAAM,cAAc,OAAW,MAAK,YAAY,MAAM;AAC1D,SAAO,aAAa,SAAS,OAAO,4BAA4B,MAAM,CAAC,MAAM,YAAY,CAAC;AAC5F;AAEA,eAAsB,2BACpB,SACA,OACA,OACiB;AACjB,QAAM,OAAgC,EAAE,YAAY,MAAM,YAAY,OAAO,MAAM,MAAM;AACzF,MAAI,MAAM,UAAU,OAAW,MAAK,QAAQ,MAAM;AAClD,SAAO,aAAa,SAAS,OAAO,kCAAkC,MAAM,CAAC,MAAM,SAAS,CAAC;AAC/F;AAEA,eAAsB,mBACpB,SACA,OACA,MACA,IACe;AACf,MAAI,CAAC,SAAS,CAAC,GAAI;AACnB,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC;AAAA,EACnE,QAAQ;AACN;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,SACA,OACA,MACA,IACe;AACf,MAAI,CAAC,SAAS,CAAC,GAAI;AACnB,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,GAAG,IAAI,OAAO,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;AAAA,EACvF,QAAQ;AACN;AAAA,EACF;AACF;",
   "names": ["readJsonSafe"]
 }

package/dist/modules/attachments/api/route.js

@@ -11,6 +11,7 @@ import { requestOcrProcessing } from "../lib/ocrQueue.js";
 import { StorageDriverFactory } from "../lib/drivers/index.js";
 import { OcrService, shouldUseLlmOcr } from "../lib/ocrService.js";
 import { clearAttachmentThumbnailCache } from "../lib/thumbnailCache.js";
+import { assertAttachmentScopeInvariant } from "../lib/access.js";
 import {
   mergeAttachmentMetadata,
   normalizeAttachmentAssignments,
@@ -376,6 +377,7 @@ async function POST(req) {
   }
   const metadata2 = mergeAttachmentMetadata(null, { assignments, tags });
   const attachmentId = randomUUID();
+  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: auth.orgId });
   const att = em.create(Attachment, {
     id: attachmentId,
     entityId,

package/dist/modules/attachments/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/api/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { z } from 'zod'\nimport { sql } from 'kysely'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildAttachmentFileUrl, buildAttachmentImageUrl, slugifyAttachmentFileName } from '../lib/imageUrls'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode, sanitizePartitionCode } from '../lib/partitions'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { extractAttachmentContent } from '../lib/textExtraction'\nimport { requestOcrProcessing } from '../lib/ocrQueue'\nimport { StorageDriverFactory } from '../lib/drivers'\nimport { OcrService, shouldUseLlmOcr } from '../lib/ocrService'\nimport { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'\nimport {\n  mergeAttachmentMetadata,\n  normalizeAttachmentAssignments,\n  normalizeAttachmentTags,\n  readAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from '../lib/metadata'\nimport { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from '../lib/crud'\nimport { E } from '#generated/entities.ids.generated'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from '../lib/security'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  willExceedAttachmentTenantQuota,\n} from '../lib/upload-limits'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nconst attachmentQuerySchema = z.object({\n  entityId: z.string().min(1).describe('Entity identifier that owns the attachments'),\n  recordId: z.string().min(1).describe('Record identifier within the entity'),\n  page: z.coerce.number().min(1).optional(),\n  pageSize: z.coerce.number().min(1).max(100).optional(),\n})\n\nconst attachmentAssignmentSchema = z.object({\n  type: z.string().describe('Assignment type identifier'),\n  id: z.string().describe('Assignment record identifier'),\n  href: z.string().nullable().optional().describe('Optional link to the related record'),\n  label: z.string().nullable().optional().describe('Optional label for the assignment'),\n})\n\nconst attachmentItemSchema = z.object({\n  id: z.string().describe('Attachment identifier'),\n  url: z.string().describe('Public path to the stored asset'),\n  fileName: z.string().describe('Original filename'),\n  fileSize: z.number().int().nonnegative().describe('File size in bytes'),\n  createdAt: z.string().describe('Upload timestamp (ISO 8601)'),\n  mimeType: z.string().nullable().optional().describe('MIME type of the file'),\n  thumbnailUrl: z.string().optional().describe('Helper route that renders a thumbnail'),\n  partitionCode: z.string().optional().describe('Partition identifier'),\n  tags: z.array(z.string()).optional().describe('Tags assigned to the attachment'),\n  content: z.string().nullable().optional().describe('Extracted text or markdown content'),\n  assignments: z.array(attachmentAssignmentSchema).optional().describe('Records that reference this attachment'),\n})\n\nconst attachmentListResponseSchema = z.object({\n  items: z.array(attachmentItemSchema),\n  total: z.number().int().nonnegative().optional(),\n  page: z.number().int().min(1).optional(),\n  pageSize: z.number().int().min(1).optional(),\n  totalPages: z.number().int().min(1).optional(),\n})\n\nconst attachmentUploadBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  fieldKey: z.string().optional(),\n  file: z.string().min(1).describe('Binary file payload; supplied as multipart form-data'),\n  customFields: z\n    .string()\n    .optional()\n    .describe('JSON encoded map of custom field values collected from the upload form.'),\n})\n\nconst attachmentDeleteQuerySchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst uploadResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    url: z.string(),\n    fileName: z.string(),\n    fileSize: z.number().int().nonnegative(),\n    thumbnailUrl: z.string().optional(),\n    content: z.string().nullable().optional(),\n    tags: z.array(z.string()).optional(),\n    assignments: z.array(attachmentAssignmentSchema).optional(),\n    customFields: z.record(z.string(), z.unknown()).optional(),\n  }),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nconst LIBRARY_ENTITY_ID = 'attachments:library'\n\nfunction parseCustomFieldsEntry(value: FormDataEntryValue | null): Record<string, unknown> {\n  if (!value) return {}\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return {}\n    try {\n      const parsed = JSON.parse(trimmed)\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return parsed as Record<string, unknown>\n      }\n    } catch {\n      return {}\n    }\n  }\n  if (typeof value === 'object' && !Array.isArray(value) && !(value instanceof File)) {\n    return { ...(value as Record<string, unknown>) }\n  }\n  return {}\n}\n\nfunction buildFormPayload(form: FormData): Record<string, unknown> {\n  const payload: Record<string, unknown> = {}\n  form.forEach((value, key) => {\n    if (key === 'customFields') {\n      payload.customFields = parseCustomFieldsEntry(value)\n      return\n    }\n    payload[key] = value\n  })\n  return payload\n}\n\nfunction parseFormTags(value: FormDataEntryValue | null): string[] {\n  if (!value) return []\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return []\n    try {\n      const parsed = JSON.parse(trimmed)\n      return normalizeAttachmentTags(parsed)\n    } catch {\n      return normalizeAttachmentTags(value)\n    }\n  }\n  return []\n}\n\nfunction parseFormAssignments(value: FormDataEntryValue | null): AttachmentAssignment[] {\n  if (!value) return []\n  if (typeof value !== 'string') return []\n  const trimmed = value.trim()\n  if (!trimmed) return []\n  try {\n    const parsed = JSON.parse(trimmed)\n    return normalizeAttachmentAssignments(parsed)\n  } catch {\n    return []\n  }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsedQuery = attachmentQuerySchema.safeParse({\n    entityId: url.searchParams.get('entityId') || '',\n    recordId: url.searchParams.get('recordId') || '',\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'entityId and recordId are required' }, { status: 400 })\n  }\n  const { entityId, recordId, page, pageSize } = parsedQuery.data\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }\n  if (auth.orgId) filter.organizationId = auth.orgId\n  const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC' }\n  const usePaging = typeof page === 'number' && typeof pageSize === 'number'\n  const total = usePaging ? await em.count(Attachment, filter) : null\n  const currentPage = usePaging ? Math.max(1, page) : null\n  const currentPageSize = usePaging ? pageSize : null\n  const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize!)) : null\n  const pageOffset = usePaging ? (Math.min(currentPage!, totalPages!) - 1) * currentPageSize! : undefined\n  const items = await findWithDecryption(\n    em,\n    Attachment,\n    filter,\n    {\n      orderBy,\n      ...(usePaging\n        ? {\n            limit: currentPageSize!,\n            offset: pageOffset,\n          }\n        : {}),\n    },\n    {\n      tenantId: auth.tenantId ?? null,\n      organizationId: auth.orgId ?? null,\n    },\n  )\n  return NextResponse.json({\n    items: items.map((a: any) => {\n      const metadata = readAttachmentMetadata(a.storageMetadata)\n      return {\n        id: a.id,\n        url: a.url,\n        fileName: a.fileName,\n        fileSize: a.fileSize,\n        createdAt: a.createdAt,\n        mimeType: a.mimeType ?? null,\n        partitionCode: a.partitionCode,\n        content: a.content ?? null,\n        thumbnailUrl: buildAttachmentImageUrl(a.id, {\n          width: 320,\n          height: 320,\n          slug: slugifyAttachmentFileName(a.fileName),\n        }),\n        tags: metadata.tags ?? [],\n        assignments: metadata.assignments ?? [],\n      }\n    }),\n    ...(usePaging\n      ? {\n          total,\n          page: Math.min(currentPage!, totalPages!),\n          pageSize: currentPageSize,\n          totalPages,\n        }\n      : {}),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { t } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const tenantId = auth.tenantId\n  const orgId = auth.orgId\n\n  const contentType = req.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const form = await req.formData()\n  const formPayload = buildFormPayload(form)\n  const customFieldValues = splitCustomFieldPayload(formPayload).custom\n  const entityId = String(form.get('entityId') || '')\n  const recordId = String(form.get('recordId') || '')\n  const fieldKey = String(form.get('fieldKey') || '')\n  const file = form.get('file') as unknown as File | null\n  if (!entityId || !recordId || !file) return NextResponse.json({ error: 'entityId, recordId and file are required' }, { status: 400 })\n  const partitionOverrideRaw = form.get('partitionCode')\n  const partitionOverride =\n    typeof partitionOverrideRaw === 'string' && partitionOverrideRaw.trim().length > 0\n      ? sanitizePartitionCode(partitionOverrideRaw)\n      : null\n  const tags = parseFormTags(form.get('tags'))\n  const assignmentsFromForm = parseFormAssignments(form.get('assignments'))\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const dataEngine = resolve('dataEngine')\n  const storageDriverFactory =\n    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  await ensureDefaultPartitions(em)\n  // Optional per-field validations\n  let partitionFromField: string | null = null\n  let fieldMaxAttachmentSizeMb: number | null = null\n  if (fieldKey) {\n    try {\n      const { CustomFieldDef } = await import('@open-mercato/core/modules/entities/data/entities')\n      const def = await em.findOne(CustomFieldDef, {\n        entityId,\n        key: fieldKey,\n        $and: [\n          { $or: [ { tenantId: auth.tenantId }, { tenantId: null } ] },\n        ],\n        isActive: true,\n      })\n      const cfg = (def as any)?.configJson || {}\n      const ext = (file.name || '').split('.').pop()?.toLowerCase() || ''\n      if (Array.isArray(cfg.acceptExtensions) && cfg.acceptExtensions.length) {\n        const allowed = new Set((cfg.acceptExtensions as any[]).map((x: any) => String(x).toLowerCase().replace(/^\\./, '')))\n        if (!allowed.has(ext)) return NextResponse.json({ error: 'File type not allowed' }, { status: 400 })\n      }\n      if (typeof cfg.maxAttachmentSizeMb === 'number' && cfg.maxAttachmentSizeMb > 0) {\n        fieldMaxAttachmentSizeMb = cfg.maxAttachmentSizeMb\n      }\n      if (typeof cfg.partitionCode === 'string' && cfg.partitionCode.trim().length > 0) {\n        partitionFromField = sanitizePartitionCode(cfg.partitionCode)\n      }\n    } catch {}\n  }\n  if (hasDangerousExecutableExtension(file.name)) {\n    return NextResponse.json({\n      error: t('attachments.errors.dangerousExecutable', 'Executable file types are not allowed as attachments.'),\n    }, { status: 400 })\n  }\n  const effectiveMaxBytes = resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb)\n  if (file.size > effectiveMaxBytes) {\n    return NextResponse.json({\n      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n    }, { status: 413 })\n  }\n  const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)\n  if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {\n    return NextResponse.json({\n      error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),\n    }, { status: 413 })\n  }\n  const buf = Buffer.from(await file.arrayBuffer())\n  const safeName = sanitizeUploadedFileName(file.name)\n  const fileMimeType = detectAttachmentMimeType(buf, safeName, (file as any).type)\n  if (isActiveContentAttachment(buf, safeName, fileMimeType)) {\n    return NextResponse.json({ error: t('attachments.errors.activeContentBlocked', 'Active content uploads are not allowed.') }, { status: 400 })\n  }\n  const defaultPartitionCode = resolveDefaultPartitionCode(entityId)\n  const resolvedPartitionCode = partitionOverride ?? partitionFromField ?? defaultPartitionCode\n  const partitionCodeCandidates = Array.from(\n    new Set(\n      [partitionOverride, partitionFromField, resolvedPartitionCode].filter(\n        (code): code is string => typeof code === 'string' && code.length > 0,\n      ),\n    ),\n  )\n  let partition: AttachmentPartition | null = null\n  for (const code of partitionCodeCandidates) {\n    const record = await em.findOne(AttachmentPartition, { code })\n    if (record) {\n      partition = record\n      break\n    }\n  }\n  if (!partition) {\n    partition = await em.findOne(AttachmentPartition, { code: defaultPartitionCode })\n  }\n  if (!partition) {\n    return NextResponse.json({ error: 'Storage partition is not configured.' }, { status: 400 })\n  }\n  const requestedPublicOverride =\n    typeof partitionOverride === 'string' &&\n    partitionOverride.length > 0 &&\n    partition.code === partitionOverride &&\n    partition.isPublic === true &&\n    partition.code !== defaultPartitionCode &&\n    partition.code !== partitionFromField\n  if (requestedPublicOverride) {\n    return NextResponse.json({ error: t('attachments.errors.publicPartitionBlocked', 'Public storage partitions cannot be selected explicitly for this upload.') }, { status: 403 })\n  }\n  const uploadDriver = await storageDriverFactory.resolveForPartition(partition.code, { tenantId, organizationId: orgId })\n  let storedPath: string\n  try {\n    const stored = await uploadDriver.store({\n      partitionCode: partition.code,\n      orgId,\n      tenantId,\n      fileName: safeName,\n      buffer: buf,\n    })\n    storedPath = stored.storagePath\n  } catch (error) {\n    console.error('[attachments] failed to persist file', error)\n    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })\n  }\n\n  const requiresOcr =\n    typeof (partition as any).requiresOcr === 'boolean'\n      ? Boolean((partition as any).requiresOcr)\n      : resolveDefaultAttachmentOcrEnabled()\n  let extractedContent: string | null = null\n  const wantsLlmOcr = requiresOcr && shouldUseLlmOcr(fileMimeType, safeName)\n  const ocrService = wantsLlmOcr ? new OcrService() : null\n  const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n\n  if (requiresOcr && !useLlmOcr) {\n    const { filePath: localPath, cleanup } = await uploadDriver.toLocalPath(partition.code, storedPath)\n    try {\n      extractedContent = await extractAttachmentContent({\n        filePath: localPath,\n        mimeType: fileMimeType,\n      })\n    } catch (error) {\n      console.error('[attachments] failed to extract attachment content', error)\n    } finally {\n      await cleanup().catch(() => {})\n    }\n  }\n\n  let assignments = assignmentsFromForm.slice()\n  if (entityId !== LIBRARY_ENTITY_ID) {\n    assignments = upsertAssignment(assignments, { type: entityId, id: recordId })\n  }\n  const metadata = mergeAttachmentMetadata(null, { assignments, tags })\n  const attachmentId = randomUUID()\n  const att = em.create(Attachment, {\n    id: attachmentId,\n    entityId,\n    recordId,\n    organizationId: auth.orgId!,\n    tenantId: auth.tenantId!,\n    fileName: safeName,\n    mimeType: fileMimeType,\n    fileSize: buf.length,\n    partitionCode: partition.code,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: storedPath,\n    url: buildAttachmentFileUrl(attachmentId),\n    content: extractedContent,\n    storageMetadata: metadata,\n  })\n  // Persist the attachment row and its custom-field values atomically so a\n  // custom-field failure cannot leave behind a committed orphan attachment.\n  try {\n    await em.transactional(async (tx) => {\n      await tx.persist(att).flush()\n      if (dataEngine) {\n        await setCustomFieldsIfAny({\n          dataEngine,\n          entityId: E.attachments.attachment,\n          recordId: attachmentId,\n          tenantId,\n          organizationId: orgId,\n          values: customFieldValues,\n        })\n      }\n    })\n  } catch (error) {\n    console.error('[attachments] failed to persist attachment with custom attributes', error)\n    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })\n  }\n\n  if (useLlmOcr) {\n    requestOcrProcessing(em, att, uploadDriver, storedPath).catch((error) => {\n      console.error('[attachments] failed to queue OCR processing', error)\n    })\n  } else if (wantsLlmOcr) {\n    console.warn('[attachments] OCR requested but OPENAI_API_KEY not configured, falling back to text extraction when available')\n  }\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'created',\n      entity: att,\n      identifiers: {\n        id: att.id,\n        organizationId: att.organizationId ?? null,\n        tenantId: att.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: attachmentId,\n      url: att.url,\n      fileName: safeName,\n      fileSize: buf.length,\n      partitionCode: partition.code,\n      thumbnailUrl: buildAttachmentImageUrl(attachmentId, {\n        width: 320,\n        height: 320,\n        slug: slugifyAttachmentFileName(safeName),\n      }),\n      content: extractedContent ?? null,\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      customFields: Object.keys(customFieldValues).length ? customFieldValues : undefined,\n    },\n  })\n}\n\nasync function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: string): Promise<number> {\n  try {\n    const db = em.getKysely<any>() as any\n    const row = await db\n      .selectFrom('attachments')\n      .select(sql<string>`sum(file_size)`.as('total_size'))\n      .where('tenant_id', '=', tenantId)\n      .executeTakeFirst() as { total_size: string | number | null } | undefined\n    const total = row?.total_size\n    if (typeof total === 'number') return Number.isFinite(total) ? total : 0\n    if (typeof total === 'string') {\n      const parsed = Number(total)\n      return Number.isFinite(parsed) ? parsed : 0\n    }\n    return 0\n  } catch {\n    return 0\n  }\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const id = url.searchParams.get('id') || ''\n  if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const dataEngine = resolve('dataEngine')\n  const storageDriverFactory =\n    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId!, organizationId: auth.orgId }\n  const record = await em.findOne(Attachment, deleteFilter)\n  if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  await em.remove(record).flush()\n  await clearAttachmentThumbnailCache(record.partitionCode, record.id).catch((error) => {\n    console.error('[attachments] failed to cleanup cached thumbnails', error)\n  })\n  if (record.storagePath) {\n    const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {\n      tenantId: record.tenantId ?? auth.tenantId!,\n      organizationId: record.organizationId ?? auth.orgId,\n    })\n    await delDriver.delete(record.partitionCode, record.storagePath)\n  }\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'deleted',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? null,\n        tenantId: record.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage entity attachments',\n  description: 'Upload and list attachments associated with module entities and records.',\n  methods: {\n    GET: {\n      summary: 'List attachments for a record',\n      description: 'Returns uploaded attachments for the given entity record, ordered by newest first.',\n      query: attachmentQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments found for the record', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing entity or record identifiers', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Upload attachment',\n      description: 'Uploads a new attachment using multipart form-data and stores metadata for later retrieval.',\n      requestBody: {\n        contentType: 'multipart/form-data',\n        schema: attachmentUploadBodySchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachment stored successfully', schema: uploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Payload validation error', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Attachment violates field constraints', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete attachment',\n      description: 'Removes an uploaded attachment and deletes the stored asset.',\n      query: attachmentDeleteQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachment deleted', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Attachment not found', schema: errorSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing attachment identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,WAAW;AAEpB,SAAS,wBAAwB,yBAAyB,iCAAiC;AAC3F,SAAS,yBAAyB,6BAA6B,6BAA6B;AAC5F,SAAS,YAAY,2BAA2B;AAChD,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kBAAkB;AAE3B,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,SAAS;AAClB,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAChE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACvE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,6CAA6C;AAAA,EAClF,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,qCAAqC;AAAA,EAC1E,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACvD,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,SAAS,4BAA4B;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,mCAAmC;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,uBAAuB;AAAA,EAC/C,KAAK,EAAE,OAAO,EAAE,SAAS,iCAAiC;AAAA,EAC1D,UAAU,EAAE,OAAO,EAAE,SAAS,mBAAmB;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,oBAAoB;AAAA,EACtE,WAAW,EAAE,OAAO,EAAE,SAAS,6BAA6B;AAAA,EAC5D,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,uBAAuB;AAAA,EAC3E,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,uCAAuC;AAAA,EACpF,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,sBAAsB;AAAA,EACpE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACvF,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS,EAAE,SAAS,wCAAwC;AAC/G,CAAC;AAED,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC/C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,sDAAsD;AAAA,EACvF,cAAc,EACX,OAAO,EACP,SAAS,EACT,SAAS,yEAAyE;AACvF,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,KAAK,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACxC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACnC,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS;AAAA,IAC1D,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC3D,CAAC;AACH,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,oBAAoB;AAE1B,SAAS,uBAAuB,OAA2D;AACzF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB,OAAO;AAClF,WAAO,EAAE,GAAI,MAAkC;AAAA,EACjD;AACA,SAAO,CAAC;AACV;AAEA,SAAS,iBAAiB,MAAyC;AACjE,QAAM,UAAmC,CAAC;AAC1C,OAAK,QAAQ,CAAC,OAAO,QAAQ;AAC3B,QAAI,QAAQ,gBAAgB;AAC1B,cAAQ,eAAe,uBAAuB,KAAK;AACnD;AAAA,IACF;AACA,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,cAAc,OAA4C;AACjE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,aAAO,wBAAwB,MAAM;AAAA,IACvC,QAAQ;AACN,aAAO,wBAAwB,KAAK;AAAA,IACtC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,qBAAqB,OAA0D;AACtF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AACvC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,WAAO,+BAA+B,MAAM;AAAA,EAC9C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,sBAAsB,UAAU;AAAA,IAClD,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,EAAE,UAAU,UAAU,MAAM,SAAS,IAAI,YAAY;AAE3D,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,SAAkC,EAAE,UAAU,UAAU,UAAU,KAAK,SAAU;AACvF,MAAI,KAAK,MAAO,QAAO,iBAAiB,KAAK;AAC7C,QAAM,UAA0C,EAAE,WAAW,OAAO;AACpE,QAAM,YAAY,OAAO,SAAS,YAAY,OAAO,aAAa;AAClE,QAAM,QAAQ,YAAY,MAAM,GAAG,MAAM,YAAY,MAAM,IAAI;AAC/D,QAAM,cAAc,YAAY,KAAK,IAAI,GAAG,IAAI,IAAI;AACpD,QAAM,kBAAkB,YAAY,WAAW;AAC/C,QAAM,aAAa,aAAa,UAAU,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,eAAgB,CAAC,IAAI;AACpG,QAAM,aAAa,aAAa,KAAK,IAAI,aAAc,UAAW,IAAI,KAAK,kBAAmB;AAC9F,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,GAAI,YACA;AAAA,QACE,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,IACA,CAAC;AAAA,IACP;AAAA,IACA;AAAA,MACE,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,IAChC;AAAA,EACF;AACA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,MAAW;AAC3B,YAAMA,YAAW,uBAAuB,EAAE,eAAe;AACzD,aAAO;AAAA,QACL,IAAI,EAAE;AAAA,QACN,KAAK,EAAE;AAAA,QACP,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,WAAW,EAAE;AAAA,QACb,UAAU,EAAE,YAAY;AAAA,QACxB,eAAe,EAAE;AAAA,QACjB,SAAS,EAAE,WAAW;AAAA,QACtB,cAAc,wBAAwB,EAAE,IAAI;AAAA,UAC1C,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,MAAM,0BAA0B,EAAE,QAAQ;AAAA,QAC5C,CAAC;AAAA,QACD,MAAMA,UAAS,QAAQ,CAAC;AAAA,QACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACxC;AAAA,IACF,CAAC;AAAA,IACD,GAAI,YACA;AAAA,MACE;AAAA,MACA,MAAM,KAAK,IAAI,aAAc,UAAW;AAAA,MACxC,UAAU;AAAA,MACV;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/G,QAAM,WAAW,KAAK;AACtB,QAAM,QAAQ,KAAK;AAEnB,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,cAAc,iBAAiB,IAAI;AACzC,QAAM,oBAAoB,wBAAwB,WAAW,EAAE;AAC/D,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,MAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpI,QAAM,uBAAuB,KAAK,IAAI,eAAe;AACrD,QAAM,oBACJ,OAAO,yBAAyB,YAAY,qBAAqB,KAAK,EAAE,SAAS,IAC7E,sBAAsB,oBAAoB,IAC1C;AACN,QAAM,OAAO,cAAc,KAAK,IAAI,MAAM,CAAC;AAC3C,QAAM,sBAAsB,qBAAqB,KAAK,IAAI,aAAa,CAAC;AAExE,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,uBACH,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AACjG,QAAM,wBAAwB,EAAE;AAEhC,MAAI,qBAAoC;AACxC,MAAI,2BAA0C;AAC9C,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,mDAAmD;AAC3F,YAAM,MAAM,MAAM,GAAG,QAAQ,gBAAgB;AAAA,QAC3C;AAAA,QACA,KAAK;AAAA,QACL,MAAM;AAAA,UACJ,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,SAAS,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,QAC7D;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,MAAO,KAAa,cAAc,CAAC;AACzC,YAAM,OAAO,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,GAAG,YAAY,KAAK;AACjE,UAAI,MAAM,QAAQ,IAAI,gBAAgB,KAAK,IAAI,iBAAiB,QAAQ;AACtE,cAAM,UAAU,IAAI,IAAK,IAAI,iBAA2B,IAAI,CAAC,MAAW,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC;AACnH,YAAI,CAAC,QAAQ,IAAI,GAAG,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrG;AACA,UAAI,OAAO,IAAI,wBAAwB,YAAY,IAAI,sBAAsB,GAAG;AAC9E,mCAA2B,IAAI;AAAA,MACjC;AACA,UAAI,OAAO,IAAI,kBAAkB,YAAY,IAAI,cAAc,KAAK,EAAE,SAAS,GAAG;AAChF,6BAAqB,sBAAsB,IAAI,aAAa;AAAA,MAC9D;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,MAAI,gCAAgC,KAAK,IAAI,GAAG;AAC9C,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,0CAA0C,uDAAuD;AAAA,IAC5G,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,oBAAoB,0BAA0B,wBAAwB;AAC5E,MAAI,KAAK,OAAO,mBAAmB;AACjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,IAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,mBAAmB,MAAM,+BAA+B,IAAI,QAAQ;AAC1E,MAAI,gCAAgC,kBAAkB,KAAK,IAAI,GAAG;AAChE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,oDAAoD;AAAA,IACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AAChD,QAAM,WAAW,yBAAyB,KAAK,IAAI;AACnD,QAAM,eAAe,yBAAyB,KAAK,UAAW,KAAa,IAAI;AAC/E,MAAI,0BAA0B,KAAK,UAAU,YAAY,GAAG;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,2CAA2C,yCAAyC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9I;AACA,QAAM,uBAAuB,4BAA4B,QAAQ;AACjE,QAAM,wBAAwB,qBAAqB,sBAAsB;AACzE,QAAM,0BAA0B,MAAM;AAAA,IACpC,IAAI;AAAA,MACF,CAAC,mBAAmB,oBAAoB,qBAAqB,EAAE;AAAA,QAC7D,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAwC;AAC5C,aAAW,QAAQ,yBAAyB;AAC1C,UAAM,SAAS,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAC7D,QAAI,QAAQ;AACV,kBAAY;AACZ;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AACA,QAAM,0BACJ,OAAO,sBAAsB,YAC7B,kBAAkB,SAAS,KAC3B,UAAU,SAAS,qBACnB,UAAU,aAAa,QACvB,UAAU,SAAS,wBACnB,UAAU,SAAS;AACrB,MAAI,yBAAyB;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,6CAA6C,0EAA0E,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjL;AACA,QAAM,eAAe,MAAM,qBAAqB,oBAAoB,UAAU,MAAM,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvH,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,MAAM;AAAA,MACtC,eAAe,UAAU;AAAA,MACzB;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AACD,iBAAa,OAAO;AAAA,EACtB,SAAS,OAAO;AACd,YAAQ,MAAM,wCAAwC,KAAK;AAC3D,WAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,cACJ,OAAQ,UAAkB,gBAAgB,YACtC,QAAS,UAAkB,WAAW,IACtC,mCAAmC;AACzC,MAAI,mBAAkC;AACtC,QAAM,cAAc,eAAe,gBAAgB,cAAc,QAAQ;AACzE,QAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,QAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAE9D,MAAI,eAAe,CAAC,WAAW;AAC7B,UAAM,EAAE,UAAU,WAAW,QAAQ,IAAI,MAAM,aAAa,YAAY,UAAU,MAAM,UAAU;AAClG,QAAI;AACF,yBAAmB,MAAM,yBAAyB;AAAA,QAChD,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,sDAAsD,KAAK;AAAA,IAC3E,UAAE;AACA,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,cAAc,oBAAoB,MAAM;AAC5C,MAAI,aAAa,mBAAmB;AAClC,kBAAc,iBAAiB,aAAa,EAAE,MAAM,UAAU,IAAI,SAAS,CAAC;AAAA,EAC9E;AACA,QAAMA,YAAW,wBAAwB,MAAM,EAAE,aAAa,KAAK,CAAC;AACpE,QAAM,eAAe,WAAW;AAChC,QAAM,MAAM,GAAG,OAAO,YAAY;AAAA,IAChC,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU,IAAI;AAAA,IACd,eAAe,UAAU;AAAA,IACzB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa;AAAA,IACb,KAAK,uBAAuB,YAAY;AAAA,IACxC,SAAS;AAAA,IACT,iBAAiBA;AAAA,EACnB,CAAC;AAGD,MAAI;AACF,UAAM,GAAG,cAAc,OAAO,OAAO;AACnC,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,UAAI,YAAY;AACd,cAAM,qBAAqB;AAAA,UACzB;AAAA,UACA,UAAU,EAAE,YAAY;AAAA,UACxB,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,qEAAqE,KAAK;AACxF,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,MAAI,WAAW;AACb,yBAAqB,IAAI,KAAK,cAAc,UAAU,EAAE,MAAM,CAAC,UAAU;AACvE,cAAQ,MAAM,gDAAgD,KAAK;AAAA,IACrE,CAAC;AAAA,EACH,WAAW,aAAa;AACtB,YAAQ,KAAK,+GAA+G;AAAA,EAC9H;AAEA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,IAAI;AAAA,QACR,gBAAgB,IAAI,kBAAkB;AAAA,QACtC,UAAU,IAAI,YAAY;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ,KAAK,IAAI;AAAA,MACT,UAAU;AAAA,MACV,UAAU,IAAI;AAAA,MACd,eAAe,UAAU;AAAA,MACzB,cAAc,wBAAwB,cAAc;AAAA,QAClD,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,0BAA0B,QAAQ;AAAA,MAC1C,CAAC;AAAA,MACD,SAAS,oBAAoB;AAAA,MAC7B,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC,cAAc,OAAO,KAAK,iBAAiB,EAAE,SAAS,oBAAoB;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;AAEA,eAAe,+BAA+B,IAAmB,UAAmC;AAClG,MAAI;AACF,UAAM,KAAK,GAAG,UAAe;AAC7B,UAAM,MAAM,MAAM,GACf,WAAW,aAAa,EACxB,OAAO,oBAA4B,GAAG,YAAY,CAAC,EACnD,MAAM,aAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,OAAO,KAAK;AAC3B,aAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,IAC5C;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/G,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,IAAI,aAAa,IAAI,IAAI,KAAK;AACzC,MAAI,CAAC,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,uBACH,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AACjG,QAAM,eAAwC,EAAE,IAAI,UAAU,KAAK,UAAW,gBAAgB,KAAK,MAAM;AACzG,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,YAAY;AACxD,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAC9B,QAAM,8BAA8B,OAAO,eAAe,OAAO,EAAE,EAAE,MAAM,CAAC,UAAU;AACpF,YAAQ,MAAM,qDAAqD,KAAK;AAAA,EAC1E,CAAC;AACD,MAAI,OAAO,aAAa;AACtB,UAAM,YAAY,MAAM,qBAAqB,oBAAoB,OAAO,eAAe;AAAA,MACrF,UAAU,OAAO,YAAY,KAAK;AAAA,MAClC,gBAAgB,OAAO,kBAAkB,KAAK;AAAA,IAChD,CAAC;AACD,UAAM,UAAU,OAAO,OAAO,eAAe,OAAO,WAAW;AAAA,EACjE;AACA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,6BAA6B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,qBAAqB;AAAA,MAC7F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,MAC3F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { z } from 'zod'\nimport { sql } from 'kysely'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildAttachmentFileUrl, buildAttachmentImageUrl, slugifyAttachmentFileName } from '../lib/imageUrls'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode, sanitizePartitionCode } from '../lib/partitions'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { extractAttachmentContent } from '../lib/textExtraction'\nimport { requestOcrProcessing } from '../lib/ocrQueue'\nimport { StorageDriverFactory } from '../lib/drivers'\nimport { OcrService, shouldUseLlmOcr } from '../lib/ocrService'\nimport { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'\nimport { assertAttachmentScopeInvariant } from '../lib/access'\nimport {\n  mergeAttachmentMetadata,\n  normalizeAttachmentAssignments,\n  normalizeAttachmentTags,\n  readAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from '../lib/metadata'\nimport { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from '../lib/crud'\nimport { E } from '#generated/entities.ids.generated'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from '../lib/security'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  willExceedAttachmentTenantQuota,\n} from '../lib/upload-limits'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nconst attachmentQuerySchema = z.object({\n  entityId: z.string().min(1).describe('Entity identifier that owns the attachments'),\n  recordId: z.string().min(1).describe('Record identifier within the entity'),\n  page: z.coerce.number().min(1).optional(),\n  pageSize: z.coerce.number().min(1).max(100).optional(),\n})\n\nconst attachmentAssignmentSchema = z.object({\n  type: z.string().describe('Assignment type identifier'),\n  id: z.string().describe('Assignment record identifier'),\n  href: z.string().nullable().optional().describe('Optional link to the related record'),\n  label: z.string().nullable().optional().describe('Optional label for the assignment'),\n})\n\nconst attachmentItemSchema = z.object({\n  id: z.string().describe('Attachment identifier'),\n  url: z.string().describe('Public path to the stored asset'),\n  fileName: z.string().describe('Original filename'),\n  fileSize: z.number().int().nonnegative().describe('File size in bytes'),\n  createdAt: z.string().describe('Upload timestamp (ISO 8601)'),\n  mimeType: z.string().nullable().optional().describe('MIME type of the file'),\n  thumbnailUrl: z.string().optional().describe('Helper route that renders a thumbnail'),\n  partitionCode: z.string().optional().describe('Partition identifier'),\n  tags: z.array(z.string()).optional().describe('Tags assigned to the attachment'),\n  content: z.string().nullable().optional().describe('Extracted text or markdown content'),\n  assignments: z.array(attachmentAssignmentSchema).optional().describe('Records that reference this attachment'),\n})\n\nconst attachmentListResponseSchema = z.object({\n  items: z.array(attachmentItemSchema),\n  total: z.number().int().nonnegative().optional(),\n  page: z.number().int().min(1).optional(),\n  pageSize: z.number().int().min(1).optional(),\n  totalPages: z.number().int().min(1).optional(),\n})\n\nconst attachmentUploadBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  fieldKey: z.string().optional(),\n  file: z.string().min(1).describe('Binary file payload; supplied as multipart form-data'),\n  customFields: z\n    .string()\n    .optional()\n    .describe('JSON encoded map of custom field values collected from the upload form.'),\n})\n\nconst attachmentDeleteQuerySchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst uploadResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    url: z.string(),\n    fileName: z.string(),\n    fileSize: z.number().int().nonnegative(),\n    thumbnailUrl: z.string().optional(),\n    content: z.string().nullable().optional(),\n    tags: z.array(z.string()).optional(),\n    assignments: z.array(attachmentAssignmentSchema).optional(),\n    customFields: z.record(z.string(), z.unknown()).optional(),\n  }),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nconst LIBRARY_ENTITY_ID = 'attachments:library'\n\nfunction parseCustomFieldsEntry(value: FormDataEntryValue | null): Record<string, unknown> {\n  if (!value) return {}\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return {}\n    try {\n      const parsed = JSON.parse(trimmed)\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return parsed as Record<string, unknown>\n      }\n    } catch {\n      return {}\n    }\n  }\n  if (typeof value === 'object' && !Array.isArray(value) && !(value instanceof File)) {\n    return { ...(value as Record<string, unknown>) }\n  }\n  return {}\n}\n\nfunction buildFormPayload(form: FormData): Record<string, unknown> {\n  const payload: Record<string, unknown> = {}\n  form.forEach((value, key) => {\n    if (key === 'customFields') {\n      payload.customFields = parseCustomFieldsEntry(value)\n      return\n    }\n    payload[key] = value\n  })\n  return payload\n}\n\nfunction parseFormTags(value: FormDataEntryValue | null): string[] {\n  if (!value) return []\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return []\n    try {\n      const parsed = JSON.parse(trimmed)\n      return normalizeAttachmentTags(parsed)\n    } catch {\n      return normalizeAttachmentTags(value)\n    }\n  }\n  return []\n}\n\nfunction parseFormAssignments(value: FormDataEntryValue | null): AttachmentAssignment[] {\n  if (!value) return []\n  if (typeof value !== 'string') return []\n  const trimmed = value.trim()\n  if (!trimmed) return []\n  try {\n    const parsed = JSON.parse(trimmed)\n    return normalizeAttachmentAssignments(parsed)\n  } catch {\n    return []\n  }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsedQuery = attachmentQuerySchema.safeParse({\n    entityId: url.searchParams.get('entityId') || '',\n    recordId: url.searchParams.get('recordId') || '',\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'entityId and recordId are required' }, { status: 400 })\n  }\n  const { entityId, recordId, page, pageSize } = parsedQuery.data\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }\n  if (auth.orgId) filter.organizationId = auth.orgId\n  const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC' }\n  const usePaging = typeof page === 'number' && typeof pageSize === 'number'\n  const total = usePaging ? await em.count(Attachment, filter) : null\n  const currentPage = usePaging ? Math.max(1, page) : null\n  const currentPageSize = usePaging ? pageSize : null\n  const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize!)) : null\n  const pageOffset = usePaging ? (Math.min(currentPage!, totalPages!) - 1) * currentPageSize! : undefined\n  const items = await findWithDecryption(\n    em,\n    Attachment,\n    filter,\n    {\n      orderBy,\n      ...(usePaging\n        ? {\n            limit: currentPageSize!,\n            offset: pageOffset,\n          }\n        : {}),\n    },\n    {\n      tenantId: auth.tenantId ?? null,\n      organizationId: auth.orgId ?? null,\n    },\n  )\n  return NextResponse.json({\n    items: items.map((a: any) => {\n      const metadata = readAttachmentMetadata(a.storageMetadata)\n      return {\n        id: a.id,\n        url: a.url,\n        fileName: a.fileName,\n        fileSize: a.fileSize,\n        createdAt: a.createdAt,\n        mimeType: a.mimeType ?? null,\n        partitionCode: a.partitionCode,\n        content: a.content ?? null,\n        thumbnailUrl: buildAttachmentImageUrl(a.id, {\n          width: 320,\n          height: 320,\n          slug: slugifyAttachmentFileName(a.fileName),\n        }),\n        tags: metadata.tags ?? [],\n        assignments: metadata.assignments ?? [],\n      }\n    }),\n    ...(usePaging\n      ? {\n          total,\n          page: Math.min(currentPage!, totalPages!),\n          pageSize: currentPageSize,\n          totalPages,\n        }\n      : {}),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { t } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const tenantId = auth.tenantId\n  const orgId = auth.orgId\n\n  const contentType = req.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const form = await req.formData()\n  const formPayload = buildFormPayload(form)\n  const customFieldValues = splitCustomFieldPayload(formPayload).custom\n  const entityId = String(form.get('entityId') || '')\n  const recordId = String(form.get('recordId') || '')\n  const fieldKey = String(form.get('fieldKey') || '')\n  const file = form.get('file') as unknown as File | null\n  if (!entityId || !recordId || !file) return NextResponse.json({ error: 'entityId, recordId and file are required' }, { status: 400 })\n  const partitionOverrideRaw = form.get('partitionCode')\n  const partitionOverride =\n    typeof partitionOverrideRaw === 'string' && partitionOverrideRaw.trim().length > 0\n      ? sanitizePartitionCode(partitionOverrideRaw)\n      : null\n  const tags = parseFormTags(form.get('tags'))\n  const assignmentsFromForm = parseFormAssignments(form.get('assignments'))\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const dataEngine = resolve('dataEngine')\n  const storageDriverFactory =\n    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  await ensureDefaultPartitions(em)\n  // Optional per-field validations\n  let partitionFromField: string | null = null\n  let fieldMaxAttachmentSizeMb: number | null = null\n  if (fieldKey) {\n    try {\n      const { CustomFieldDef } = await import('@open-mercato/core/modules/entities/data/entities')\n      const def = await em.findOne(CustomFieldDef, {\n        entityId,\n        key: fieldKey,\n        $and: [\n          { $or: [ { tenantId: auth.tenantId }, { tenantId: null } ] },\n        ],\n        isActive: true,\n      })\n      const cfg = (def as any)?.configJson || {}\n      const ext = (file.name || '').split('.').pop()?.toLowerCase() || ''\n      if (Array.isArray(cfg.acceptExtensions) && cfg.acceptExtensions.length) {\n        const allowed = new Set((cfg.acceptExtensions as any[]).map((x: any) => String(x).toLowerCase().replace(/^\\./, '')))\n        if (!allowed.has(ext)) return NextResponse.json({ error: 'File type not allowed' }, { status: 400 })\n      }\n      if (typeof cfg.maxAttachmentSizeMb === 'number' && cfg.maxAttachmentSizeMb > 0) {\n        fieldMaxAttachmentSizeMb = cfg.maxAttachmentSizeMb\n      }\n      if (typeof cfg.partitionCode === 'string' && cfg.partitionCode.trim().length > 0) {\n        partitionFromField = sanitizePartitionCode(cfg.partitionCode)\n      }\n    } catch {}\n  }\n  if (hasDangerousExecutableExtension(file.name)) {\n    return NextResponse.json({\n      error: t('attachments.errors.dangerousExecutable', 'Executable file types are not allowed as attachments.'),\n    }, { status: 400 })\n  }\n  const effectiveMaxBytes = resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb)\n  if (file.size > effectiveMaxBytes) {\n    return NextResponse.json({\n      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n    }, { status: 413 })\n  }\n  const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)\n  if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {\n    return NextResponse.json({\n      error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),\n    }, { status: 413 })\n  }\n  const buf = Buffer.from(await file.arrayBuffer())\n  const safeName = sanitizeUploadedFileName(file.name)\n  const fileMimeType = detectAttachmentMimeType(buf, safeName, (file as any).type)\n  if (isActiveContentAttachment(buf, safeName, fileMimeType)) {\n    return NextResponse.json({ error: t('attachments.errors.activeContentBlocked', 'Active content uploads are not allowed.') }, { status: 400 })\n  }\n  const defaultPartitionCode = resolveDefaultPartitionCode(entityId)\n  const resolvedPartitionCode = partitionOverride ?? partitionFromField ?? defaultPartitionCode\n  const partitionCodeCandidates = Array.from(\n    new Set(\n      [partitionOverride, partitionFromField, resolvedPartitionCode].filter(\n        (code): code is string => typeof code === 'string' && code.length > 0,\n      ),\n    ),\n  )\n  let partition: AttachmentPartition | null = null\n  for (const code of partitionCodeCandidates) {\n    const record = await em.findOne(AttachmentPartition, { code })\n    if (record) {\n      partition = record\n      break\n    }\n  }\n  if (!partition) {\n    partition = await em.findOne(AttachmentPartition, { code: defaultPartitionCode })\n  }\n  if (!partition) {\n    return NextResponse.json({ error: 'Storage partition is not configured.' }, { status: 400 })\n  }\n  const requestedPublicOverride =\n    typeof partitionOverride === 'string' &&\n    partitionOverride.length > 0 &&\n    partition.code === partitionOverride &&\n    partition.isPublic === true &&\n    partition.code !== defaultPartitionCode &&\n    partition.code !== partitionFromField\n  if (requestedPublicOverride) {\n    return NextResponse.json({ error: t('attachments.errors.publicPartitionBlocked', 'Public storage partitions cannot be selected explicitly for this upload.') }, { status: 403 })\n  }\n  const uploadDriver = await storageDriverFactory.resolveForPartition(partition.code, { tenantId, organizationId: orgId })\n  let storedPath: string\n  try {\n    const stored = await uploadDriver.store({\n      partitionCode: partition.code,\n      orgId,\n      tenantId,\n      fileName: safeName,\n      buffer: buf,\n    })\n    storedPath = stored.storagePath\n  } catch (error) {\n    console.error('[attachments] failed to persist file', error)\n    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })\n  }\n\n  const requiresOcr =\n    typeof (partition as any).requiresOcr === 'boolean'\n      ? Boolean((partition as any).requiresOcr)\n      : resolveDefaultAttachmentOcrEnabled()\n  let extractedContent: string | null = null\n  const wantsLlmOcr = requiresOcr && shouldUseLlmOcr(fileMimeType, safeName)\n  const ocrService = wantsLlmOcr ? new OcrService() : null\n  const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n\n  if (requiresOcr && !useLlmOcr) {\n    const { filePath: localPath, cleanup } = await uploadDriver.toLocalPath(partition.code, storedPath)\n    try {\n      extractedContent = await extractAttachmentContent({\n        filePath: localPath,\n        mimeType: fileMimeType,\n      })\n    } catch (error) {\n      console.error('[attachments] failed to extract attachment content', error)\n    } finally {\n      await cleanup().catch(() => {})\n    }\n  }\n\n  let assignments = assignmentsFromForm.slice()\n  if (entityId !== LIBRARY_ENTITY_ID) {\n    assignments = upsertAssignment(assignments, { type: entityId, id: recordId })\n  }\n  const metadata = mergeAttachmentMetadata(null, { assignments, tags })\n  const attachmentId = randomUUID()\n  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: auth.orgId })\n  const att = em.create(Attachment, {\n    id: attachmentId,\n    entityId,\n    recordId,\n    organizationId: auth.orgId!,\n    tenantId: auth.tenantId!,\n    fileName: safeName,\n    mimeType: fileMimeType,\n    fileSize: buf.length,\n    partitionCode: partition.code,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: storedPath,\n    url: buildAttachmentFileUrl(attachmentId),\n    content: extractedContent,\n    storageMetadata: metadata,\n  })\n  // Persist the attachment row and its custom-field values atomically so a\n  // custom-field failure cannot leave behind a committed orphan attachment.\n  try {\n    await em.transactional(async (tx) => {\n      await tx.persist(att).flush()\n      if (dataEngine) {\n        await setCustomFieldsIfAny({\n          dataEngine,\n          entityId: E.attachments.attachment,\n          recordId: attachmentId,\n          tenantId,\n          organizationId: orgId,\n          values: customFieldValues,\n        })\n      }\n    })\n  } catch (error) {\n    console.error('[attachments] failed to persist attachment with custom attributes', error)\n    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })\n  }\n\n  if (useLlmOcr) {\n    requestOcrProcessing(em, att, uploadDriver, storedPath).catch((error) => {\n      console.error('[attachments] failed to queue OCR processing', error)\n    })\n  } else if (wantsLlmOcr) {\n    console.warn('[attachments] OCR requested but OPENAI_API_KEY not configured, falling back to text extraction when available')\n  }\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'created',\n      entity: att,\n      identifiers: {\n        id: att.id,\n        organizationId: att.organizationId ?? null,\n        tenantId: att.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: attachmentId,\n      url: att.url,\n      fileName: safeName,\n      fileSize: buf.length,\n      partitionCode: partition.code,\n      thumbnailUrl: buildAttachmentImageUrl(attachmentId, {\n        width: 320,\n        height: 320,\n        slug: slugifyAttachmentFileName(safeName),\n      }),\n      content: extractedContent ?? null,\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      customFields: Object.keys(customFieldValues).length ? customFieldValues : undefined,\n    },\n  })\n}\n\nasync function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: string): Promise<number> {\n  try {\n    const db = em.getKysely<any>() as any\n    const row = await db\n      .selectFrom('attachments')\n      .select(sql<string>`sum(file_size)`.as('total_size'))\n      .where('tenant_id', '=', tenantId)\n      .executeTakeFirst() as { total_size: string | number | null } | undefined\n    const total = row?.total_size\n    if (typeof total === 'number') return Number.isFinite(total) ? total : 0\n    if (typeof total === 'string') {\n      const parsed = Number(total)\n      return Number.isFinite(parsed) ? parsed : 0\n    }\n    return 0\n  } catch {\n    return 0\n  }\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const id = url.searchParams.get('id') || ''\n  if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const dataEngine = resolve('dataEngine')\n  const storageDriverFactory =\n    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId!, organizationId: auth.orgId }\n  const record = await em.findOne(Attachment, deleteFilter)\n  if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  await em.remove(record).flush()\n  await clearAttachmentThumbnailCache(record.partitionCode, record.id).catch((error) => {\n    console.error('[attachments] failed to cleanup cached thumbnails', error)\n  })\n  if (record.storagePath) {\n    const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {\n      tenantId: record.tenantId ?? auth.tenantId!,\n      organizationId: record.organizationId ?? auth.orgId,\n    })\n    await delDriver.delete(record.partitionCode, record.storagePath)\n  }\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'deleted',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? null,\n        tenantId: record.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage entity attachments',\n  description: 'Upload and list attachments associated with module entities and records.',\n  methods: {\n    GET: {\n      summary: 'List attachments for a record',\n      description: 'Returns uploaded attachments for the given entity record, ordered by newest first.',\n      query: attachmentQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments found for the record', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing entity or record identifiers', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Upload attachment',\n      description: 'Uploads a new attachment using multipart form-data and stores metadata for later retrieval.',\n      requestBody: {\n        contentType: 'multipart/form-data',\n        schema: attachmentUploadBodySchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachment stored successfully', schema: uploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Payload validation error', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Attachment violates field constraints', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete attachment',\n      description: 'Removes an uploaded attachment and deletes the stored asset.',\n      query: attachmentDeleteQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachment deleted', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Attachment not found', schema: errorSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing attachment identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,WAAW;AAEpB,SAAS,wBAAwB,yBAAyB,iCAAiC;AAC3F,SAAS,yBAAyB,6BAA6B,6BAA6B;AAC5F,SAAS,YAAY,2BAA2B;AAChD,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,qCAAqC;AAC9C,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kBAAkB;AAE3B,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,SAAS;AAClB,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAChE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACvE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,6CAA6C;AAAA,EAClF,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,qCAAqC;AAAA,EAC1E,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACvD,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,SAAS,4BAA4B;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,mCAAmC;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,uBAAuB;AAAA,EAC/C,KAAK,EAAE,OAAO,EAAE,SAAS,iCAAiC;AAAA,EAC1D,UAAU,EAAE,OAAO,EAAE,SAAS,mBAAmB;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,oBAAoB;AAAA,EACtE,WAAW,EAAE,OAAO,EAAE,SAAS,6BAA6B;AAAA,EAC5D,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,uBAAuB;AAAA,EAC3E,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,uCAAuC;AAAA,EACpF,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,sBAAsB;AAAA,EACpE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACvF,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS,EAAE,SAAS,wCAAwC;AAC/G,CAAC;AAED,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC/C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,sDAAsD;AAAA,EACvF,cAAc,EACX,OAAO,EACP,SAAS,EACT,SAAS,yEAAyE;AACvF,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,KAAK,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACxC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACnC,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS;AAAA,IAC1D,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC3D,CAAC;AACH,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,oBAAoB;AAE1B,SAAS,uBAAuB,OAA2D;AACzF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB,OAAO;AAClF,WAAO,EAAE,GAAI,MAAkC;AAAA,EACjD;AACA,SAAO,CAAC;AACV;AAEA,SAAS,iBAAiB,MAAyC;AACjE,QAAM,UAAmC,CAAC;AAC1C,OAAK,QAAQ,CAAC,OAAO,QAAQ;AAC3B,QAAI,QAAQ,gBAAgB;AAC1B,cAAQ,eAAe,uBAAuB,KAAK;AACnD;AAAA,IACF;AACA,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,cAAc,OAA4C;AACjE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,aAAO,wBAAwB,MAAM;AAAA,IACvC,QAAQ;AACN,aAAO,wBAAwB,KAAK;AAAA,IACtC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,qBAAqB,OAA0D;AACtF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AACvC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,WAAO,+BAA+B,MAAM;AAAA,EAC9C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,sBAAsB,UAAU;AAAA,IAClD,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,EAAE,UAAU,UAAU,MAAM,SAAS,IAAI,YAAY;AAE3D,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,SAAkC,EAAE,UAAU,UAAU,UAAU,KAAK,SAAU;AACvF,MAAI,KAAK,MAAO,QAAO,iBAAiB,KAAK;AAC7C,QAAM,UAA0C,EAAE,WAAW,OAAO;AACpE,QAAM,YAAY,OAAO,SAAS,YAAY,OAAO,aAAa;AAClE,QAAM,QAAQ,YAAY,MAAM,GAAG,MAAM,YAAY,MAAM,IAAI;AAC/D,QAAM,cAAc,YAAY,KAAK,IAAI,GAAG,IAAI,IAAI;AACpD,QAAM,kBAAkB,YAAY,WAAW;AAC/C,QAAM,aAAa,aAAa,UAAU,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,eAAgB,CAAC,IAAI;AACpG,QAAM,aAAa,aAAa,KAAK,IAAI,aAAc,UAAW,IAAI,KAAK,kBAAmB;AAC9F,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,GAAI,YACA;AAAA,QACE,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,IACA,CAAC;AAAA,IACP;AAAA,IACA;AAAA,MACE,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,IAChC;AAAA,EACF;AACA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,MAAW;AAC3B,YAAMA,YAAW,uBAAuB,EAAE,eAAe;AACzD,aAAO;AAAA,QACL,IAAI,EAAE;AAAA,QACN,KAAK,EAAE;AAAA,QACP,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,WAAW,EAAE;AAAA,QACb,UAAU,EAAE,YAAY;AAAA,QACxB,eAAe,EAAE;AAAA,QACjB,SAAS,EAAE,WAAW;AAAA,QACtB,cAAc,wBAAwB,EAAE,IAAI;AAAA,UAC1C,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,MAAM,0BAA0B,EAAE,QAAQ;AAAA,QAC5C,CAAC;AAAA,QACD,MAAMA,UAAS,QAAQ,CAAC;AAAA,QACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACxC;AAAA,IACF,CAAC;AAAA,IACD,GAAI,YACA;AAAA,MACE;AAAA,MACA,MAAM,KAAK,IAAI,aAAc,UAAW;AAAA,MACxC,UAAU;AAAA,MACV;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/G,QAAM,WAAW,KAAK;AACtB,QAAM,QAAQ,KAAK;AAEnB,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,cAAc,iBAAiB,IAAI;AACzC,QAAM,oBAAoB,wBAAwB,WAAW,EAAE;AAC/D,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,MAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpI,QAAM,uBAAuB,KAAK,IAAI,eAAe;AACrD,QAAM,oBACJ,OAAO,yBAAyB,YAAY,qBAAqB,KAAK,EAAE,SAAS,IAC7E,sBAAsB,oBAAoB,IAC1C;AACN,QAAM,OAAO,cAAc,KAAK,IAAI,MAAM,CAAC;AAC3C,QAAM,sBAAsB,qBAAqB,KAAK,IAAI,aAAa,CAAC;AAExE,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,uBACH,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AACjG,QAAM,wBAAwB,EAAE;AAEhC,MAAI,qBAAoC;AACxC,MAAI,2BAA0C;AAC9C,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,mDAAmD;AAC3F,YAAM,MAAM,MAAM,GAAG,QAAQ,gBAAgB;AAAA,QAC3C;AAAA,QACA,KAAK;AAAA,QACL,MAAM;AAAA,UACJ,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,SAAS,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,QAC7D;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,MAAO,KAAa,cAAc,CAAC;AACzC,YAAM,OAAO,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,GAAG,YAAY,KAAK;AACjE,UAAI,MAAM,QAAQ,IAAI,gBAAgB,KAAK,IAAI,iBAAiB,QAAQ;AACtE,cAAM,UAAU,IAAI,IAAK,IAAI,iBAA2B,IAAI,CAAC,MAAW,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC;AACnH,YAAI,CAAC,QAAQ,IAAI,GAAG,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrG;AACA,UAAI,OAAO,IAAI,wBAAwB,YAAY,IAAI,sBAAsB,GAAG;AAC9E,mCAA2B,IAAI;AAAA,MACjC;AACA,UAAI,OAAO,IAAI,kBAAkB,YAAY,IAAI,cAAc,KAAK,EAAE,SAAS,GAAG;AAChF,6BAAqB,sBAAsB,IAAI,aAAa;AAAA,MAC9D;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,MAAI,gCAAgC,KAAK,IAAI,GAAG;AAC9C,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,0CAA0C,uDAAuD;AAAA,IAC5G,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,oBAAoB,0BAA0B,wBAAwB;AAC5E,MAAI,KAAK,OAAO,mBAAmB;AACjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,IAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,mBAAmB,MAAM,+BAA+B,IAAI,QAAQ;AAC1E,MAAI,gCAAgC,kBAAkB,KAAK,IAAI,GAAG;AAChE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,oDAAoD;AAAA,IACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AAChD,QAAM,WAAW,yBAAyB,KAAK,IAAI;AACnD,QAAM,eAAe,yBAAyB,KAAK,UAAW,KAAa,IAAI;AAC/E,MAAI,0BAA0B,KAAK,UAAU,YAAY,GAAG;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,2CAA2C,yCAAyC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9I;AACA,QAAM,uBAAuB,4BAA4B,QAAQ;AACjE,QAAM,wBAAwB,qBAAqB,sBAAsB;AACzE,QAAM,0BAA0B,MAAM;AAAA,IACpC,IAAI;AAAA,MACF,CAAC,mBAAmB,oBAAoB,qBAAqB,EAAE;AAAA,QAC7D,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAwC;AAC5C,aAAW,QAAQ,yBAAyB;AAC1C,UAAM,SAAS,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAC7D,QAAI,QAAQ;AACV,kBAAY;AACZ;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AACA,QAAM,0BACJ,OAAO,sBAAsB,YAC7B,kBAAkB,SAAS,KAC3B,UAAU,SAAS,qBACnB,UAAU,aAAa,QACvB,UAAU,SAAS,wBACnB,UAAU,SAAS;AACrB,MAAI,yBAAyB;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,6CAA6C,0EAA0E,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjL;AACA,QAAM,eAAe,MAAM,qBAAqB,oBAAoB,UAAU,MAAM,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvH,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,MAAM;AAAA,MACtC,eAAe,UAAU;AAAA,MACzB;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AACD,iBAAa,OAAO;AAAA,EACtB,SAAS,OAAO;AACd,YAAQ,MAAM,wCAAwC,KAAK;AAC3D,WAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,cACJ,OAAQ,UAAkB,gBAAgB,YACtC,QAAS,UAAkB,WAAW,IACtC,mCAAmC;AACzC,MAAI,mBAAkC;AACtC,QAAM,cAAc,eAAe,gBAAgB,cAAc,QAAQ;AACzE,QAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,QAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAE9D,MAAI,eAAe,CAAC,WAAW;AAC7B,UAAM,EAAE,UAAU,WAAW,QAAQ,IAAI,MAAM,aAAa,YAAY,UAAU,MAAM,UAAU;AAClG,QAAI;AACF,yBAAmB,MAAM,yBAAyB;AAAA,QAChD,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,sDAAsD,KAAK;AAAA,IAC3E,UAAE;AACA,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,cAAc,oBAAoB,MAAM;AAC5C,MAAI,aAAa,mBAAmB;AAClC,kBAAc,iBAAiB,aAAa,EAAE,MAAM,UAAU,IAAI,SAAS,CAAC;AAAA,EAC9E;AACA,QAAMA,YAAW,wBAAwB,MAAM,EAAE,aAAa,KAAK,CAAC;AACpE,QAAM,eAAe,WAAW;AAChC,iCAA+B,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACtF,QAAM,MAAM,GAAG,OAAO,YAAY;AAAA,IAChC,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU,IAAI;AAAA,IACd,eAAe,UAAU;AAAA,IACzB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa;AAAA,IACb,KAAK,uBAAuB,YAAY;AAAA,IACxC,SAAS;AAAA,IACT,iBAAiBA;AAAA,EACnB,CAAC;AAGD,MAAI;AACF,UAAM,GAAG,cAAc,OAAO,OAAO;AACnC,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,UAAI,YAAY;AACd,cAAM,qBAAqB;AAAA,UACzB;AAAA,UACA,UAAU,EAAE,YAAY;AAAA,UACxB,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,qEAAqE,KAAK;AACxF,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,MAAI,WAAW;AACb,yBAAqB,IAAI,KAAK,cAAc,UAAU,EAAE,MAAM,CAAC,UAAU;AACvE,cAAQ,MAAM,gDAAgD,KAAK;AAAA,IACrE,CAAC;AAAA,EACH,WAAW,aAAa;AACtB,YAAQ,KAAK,+GAA+G;AAAA,EAC9H;AAEA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,IAAI;AAAA,QACR,gBAAgB,IAAI,kBAAkB;AAAA,QACtC,UAAU,IAAI,YAAY;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ,KAAK,IAAI;AAAA,MACT,UAAU;AAAA,MACV,UAAU,IAAI;AAAA,MACd,eAAe,UAAU;AAAA,MACzB,cAAc,wBAAwB,cAAc;AAAA,QAClD,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,0BAA0B,QAAQ;AAAA,MAC1C,CAAC;AAAA,MACD,SAAS,oBAAoB;AAAA,MAC7B,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC,cAAc,OAAO,KAAK,iBAAiB,EAAE,SAAS,oBAAoB;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;AAEA,eAAe,+BAA+B,IAAmB,UAAmC;AAClG,MAAI;AACF,UAAM,KAAK,GAAG,UAAe;AAC7B,UAAM,MAAM,MAAM,GACf,WAAW,aAAa,EACxB,OAAO,oBAA4B,GAAG,YAAY,CAAC,EACnD,MAAM,aAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,OAAO,KAAK;AAC3B,aAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,IAC5C;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/G,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,IAAI,aAAa,IAAI,IAAI,KAAK;AACzC,MAAI,CAAC,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,uBACH,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AACjG,QAAM,eAAwC,EAAE,IAAI,UAAU,KAAK,UAAW,gBAAgB,KAAK,MAAM;AACzG,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,YAAY;AACxD,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAC9B,QAAM,8BAA8B,OAAO,eAAe,OAAO,EAAE,EAAE,MAAM,CAAC,UAAU;AACpF,YAAQ,MAAM,qDAAqD,KAAK;AAAA,EAC1E,CAAC;AACD,MAAI,OAAO,aAAa;AACtB,UAAM,YAAY,MAAM,qBAAqB,oBAAoB,OAAO,eAAe;AAAA,MACrF,UAAU,OAAO,YAAY,KAAK;AAAA,MAClC,gBAAgB,OAAO,kBAAkB,KAAK;AAAA,IAChD,CAAC;AACD,UAAM,UAAU,OAAO,OAAO,eAAe,OAAO,WAAW;AAAA,EACjE;AACA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,6BAA6B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,qBAAqB;AAAA,MAC7F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,MAC3F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/attachments/lib/access.js

@@ -1,3 +1,20 @@
+function normalizeScopeValue(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function assertAttachmentScopeInvariant(scope) {
+  const tenantId = normalizeScopeValue(scope.tenantId);
+  const organizationId = normalizeScopeValue(scope.organizationId);
+  const tenantSet = tenantId !== null;
+  const organizationSet = organizationId !== null;
+  if (tenantSet !== organizationSet) {
+    const missing = tenantSet ? "organization_id" : "tenant_id";
+    throw new Error(
+      `[internal] Attachment scope invariant violated: ${missing} is null while the other scope column is set. Attachments must be either fully scoped (both tenant_id and organization_id) or fully global (both null).`
+    );
+  }
+}
 function isSuperAdminAuth(auth) {
   if (!auth) return false;
   if (auth.isSuperAdmin === true) return true;
@@ -38,6 +55,7 @@ function checkAttachmentAccess(auth, attachment, partition, options) {
   return { ok: true };
 }
 export {
+  assertAttachmentScopeInvariant,
   checkAttachmentAccess,
   isSuperAdminAuth
 };

package/dist/modules/attachments/lib/access.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/access.ts"],
-  "sourcesContent": ["import type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { Attachment, AttachmentPartition } from '../data/entities'\n\nexport function isSuperAdminAuth(auth: AuthContext | null | undefined): boolean {\n  if (!auth) return false\n  if ((auth as any).isSuperAdmin === true) return true\n  const roles = Array.isArray(auth.roles) ? auth.roles : []\n  return roles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === 'superadmin')\n}\n\nfunction isSameScope(auth: AuthContext | null | undefined, attachment: Attachment): boolean {\n  if (!auth) return false\n  const attachmentTenant = attachment.tenantId ?? null\n  const attachmentOrg = attachment.organizationId ?? null\n  // Preserve the legacy \"global attachment\" semantics: a row with both scope\n  // columns null is treated as accessible to any authenticated principal.\n  // The unauthenticated branch in checkAttachmentAccess already gates this on\n  // partition.isPublic.\n  if (attachmentTenant === null && attachmentOrg === null) {\n    return true\n  }\n  // Fail-closed on partial-null scope. Previously a missing tenant_id or\n  // organization_id was treated as \"matches any auth value\", which allowed\n  // cross-tenant / cross-org access on private partitions when an attachment\n  // ended up with one scope column unset. Mirrors the fail-closed pattern\n  // from #2012 (mergeIdFilter).\n  return attachmentTenant === auth.tenantId && attachmentOrg === auth.orgId\n}\n\nexport function checkAttachmentAccess(\n  auth: AuthContext | null | undefined,\n  attachment: Attachment,\n  partition: AttachmentPartition,\n  options?: { requireAuthForPublic?: boolean }\n): { ok: true } | { ok: false; status: number } {\n  const superAdmin = isSuperAdminAuth(auth)\n  const requireAuth = !partition.isPublic || options?.requireAuthForPublic === true\n\n  if (requireAuth) {\n    if (!auth) {\n      return { ok: false, status: 401 }\n    }\n    if (superAdmin || isSameScope(auth, attachment)) {\n      return { ok: true }\n    }\n    return { ok: false, status: 403 }\n  }\n\n  if (!auth) {\n    const isTenantScoped = !!attachment.tenantId || !!attachment.organizationId\n    if (isTenantScoped) {\n      return { ok: false, status: 401 }\n    }\n    return { ok: true }\n  }\n\n  if (!superAdmin && !isSameScope(auth, attachment)) {\n    return { ok: false, status: 403 }\n  }\n  return { ok: true }\n}\n"],
-  "mappings": "AAGO,SAAS,iBAAiB,MAA+C;AAC9E,MAAI,CAAC,KAAM,QAAO;AAClB,MAAK,KAAa,iBAAiB,KAAM,QAAO;AAChD,QAAM,QAAQ,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AACxD,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,YAAY;AACpG;AAEA,SAAS,YAAY,MAAsC,YAAiC;AAC1F,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,mBAAmB,WAAW,YAAY;AAChD,QAAM,gBAAgB,WAAW,kBAAkB;AAKnD,MAAI,qBAAqB,QAAQ,kBAAkB,MAAM;AACvD,WAAO;AAAA,EACT;AAMA,SAAO,qBAAqB,KAAK,YAAY,kBAAkB,KAAK;AACtE;AAEO,SAAS,sBACd,MACA,YACA,WACA,SAC8C;AAC9C,QAAM,aAAa,iBAAiB,IAAI;AACxC,QAAM,cAAc,CAAC,UAAU,YAAY,SAAS,yBAAyB;AAE7E,MAAI,aAAa;AACf,QAAI,CAAC,MAAM;AACT,aAAO,EAAE,IAAI,OAAO,QAAQ,IAAI;AAAA,IAClC;AACA,QAAI,cAAc,YAAY,MAAM,UAAU,GAAG;AAC/C,aAAO,EAAE,IAAI,KAAK;AAAA,IACpB;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,IAAI;AAAA,EAClC;AAEA,MAAI,CAAC,MAAM;AACT,UAAM,iBAAiB,CAAC,CAAC,WAAW,YAAY,CAAC,CAAC,WAAW;AAC7D,QAAI,gBAAgB;AAClB,aAAO,EAAE,IAAI,OAAO,QAAQ,IAAI;AAAA,IAClC;AACA,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AAEA,MAAI,CAAC,cAAc,CAAC,YAAY,MAAM,UAAU,GAAG;AACjD,WAAO,EAAE,IAAI,OAAO,QAAQ,IAAI;AAAA,EAClC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;",
+  "sourcesContent": ["import type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { Attachment, AttachmentPartition } from '../data/entities'\n\nexport type AttachmentScope = {\n  tenantId?: string | null\n  organizationId?: string | null\n}\n\nfunction normalizeScopeValue(value: string | null | undefined): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\n/**\n * Enforce the attachments scope invariant at every creation boundary:\n * an attachment is either fully **global** (both `tenant_id` and\n * `organization_id` null) or fully **scoped** (both set) \u2014 never partial.\n *\n * `isSameScope` deliberately treats a partial-null row as inaccessible to\n * every non-superadmin principal (fail-closed, #2107), so a partial-null row\n * is dead data that can only ever leak through a future code path that skips\n * the access check. Guarding creation keeps that class of fail-open bug from\n * re-emerging (#2109). Call this before persisting any `Attachment`.\n */\nexport function assertAttachmentScopeInvariant(scope: AttachmentScope): void {\n  const tenantId = normalizeScopeValue(scope.tenantId)\n  const organizationId = normalizeScopeValue(scope.organizationId)\n  const tenantSet = tenantId !== null\n  const organizationSet = organizationId !== null\n  if (tenantSet !== organizationSet) {\n    const missing = tenantSet ? 'organization_id' : 'tenant_id'\n    throw new Error(\n      `[internal] Attachment scope invariant violated: ${missing} is null while the other scope column is set. ` +\n        'Attachments must be either fully scoped (both tenant_id and organization_id) or fully global (both null).',\n    )\n  }\n}\n\nexport function isSuperAdminAuth(auth: AuthContext | null | undefined): boolean {\n  if (!auth) return false\n  if ((auth as any).isSuperAdmin === true) return true\n  const roles = Array.isArray(auth.roles) ? auth.roles : []\n  return roles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === 'superadmin')\n}\n\nfunction isSameScope(auth: AuthContext | null | undefined, attachment: Attachment): boolean {\n  if (!auth) return false\n  const attachmentTenant = attachment.tenantId ?? null\n  const attachmentOrg = attachment.organizationId ?? null\n  // Preserve the legacy \"global attachment\" semantics: a row with both scope\n  // columns null is treated as accessible to any authenticated principal.\n  // The unauthenticated branch in checkAttachmentAccess already gates this on\n  // partition.isPublic.\n  if (attachmentTenant === null && attachmentOrg === null) {\n    return true\n  }\n  // Fail-closed on partial-null scope. Previously a missing tenant_id or\n  // organization_id was treated as \"matches any auth value\", which allowed\n  // cross-tenant / cross-org access on private partitions when an attachment\n  // ended up with one scope column unset. Mirrors the fail-closed pattern\n  // from #2012 (mergeIdFilter).\n  return attachmentTenant === auth.tenantId && attachmentOrg === auth.orgId\n}\n\nexport function checkAttachmentAccess(\n  auth: AuthContext | null | undefined,\n  attachment: Attachment,\n  partition: AttachmentPartition,\n  options?: { requireAuthForPublic?: boolean }\n): { ok: true } | { ok: false; status: number } {\n  const superAdmin = isSuperAdminAuth(auth)\n  const requireAuth = !partition.isPublic || options?.requireAuthForPublic === true\n\n  if (requireAuth) {\n    if (!auth) {\n      return { ok: false, status: 401 }\n    }\n    if (superAdmin || isSameScope(auth, attachment)) {\n      return { ok: true }\n    }\n    return { ok: false, status: 403 }\n  }\n\n  if (!auth) {\n    const isTenantScoped = !!attachment.tenantId || !!attachment.organizationId\n    if (isTenantScoped) {\n      return { ok: false, status: 401 }\n    }\n    return { ok: true }\n  }\n\n  if (!superAdmin && !isSameScope(auth, attachment)) {\n    return { ok: false, status: 403 }\n  }\n  return { ok: true }\n}\n"],
+  "mappings": "AAQA,SAAS,oBAAoB,OAAiD;AAC5E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAaO,SAAS,+BAA+B,OAA8B;AAC3E,QAAM,WAAW,oBAAoB,MAAM,QAAQ;AACnD,QAAM,iBAAiB,oBAAoB,MAAM,cAAc;AAC/D,QAAM,YAAY,aAAa;AAC/B,QAAM,kBAAkB,mBAAmB;AAC3C,MAAI,cAAc,iBAAiB;AACjC,UAAM,UAAU,YAAY,oBAAoB;AAChD,UAAM,IAAI;AAAA,MACR,mDAAmD,OAAO;AAAA,IAE5D;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,MAA+C;AAC9E,MAAI,CAAC,KAAM,QAAO;AAClB,MAAK,KAAa,iBAAiB,KAAM,QAAO;AAChD,QAAM,QAAQ,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AACxD,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,YAAY;AACpG;AAEA,SAAS,YAAY,MAAsC,YAAiC;AAC1F,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,mBAAmB,WAAW,YAAY;AAChD,QAAM,gBAAgB,WAAW,kBAAkB;AAKnD,MAAI,qBAAqB,QAAQ,kBAAkB,MAAM;AACvD,WAAO;AAAA,EACT;AAMA,SAAO,qBAAqB,KAAK,YAAY,kBAAkB,KAAK;AACtE;AAEO,SAAS,sBACd,MACA,YACA,WACA,SAC8C;AAC9C,QAAM,aAAa,iBAAiB,IAAI;AACxC,QAAM,cAAc,CAAC,UAAU,YAAY,SAAS,yBAAyB;AAE7E,MAAI,aAAa;AACf,QAAI,CAAC,MAAM;AACT,aAAO,EAAE,IAAI,OAAO,QAAQ,IAAI;AAAA,IAClC;AACA,QAAI,cAAc,YAAY,MAAM,UAAU,GAAG;AAC/C,aAAO,EAAE,IAAI,KAAK;AAAA,IACpB;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,IAAI;AAAA,EAClC;AAEA,MAAI,CAAC,MAAM;AACT,UAAM,iBAAiB,CAAC,CAAC,WAAW,YAAY,CAAC,CAAC,WAAW;AAC7D,QAAI,gBAAgB;AAClB,aAAO,EAAE,IAAI,OAAO,QAAQ,IAAI;AAAA,IAClC;AACA,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AAEA,MAAI,CAAC,cAAc,CAAC,YAAY,MAAM,UAAU,GAAG;AACjD,WAAO,EAAE,IAAI,OAAO,QAAQ,IAAI;AAAA,EAClC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;",
   "names": []
 }

package/dist/modules/audit_logs/data/entities.js

@@ -174,7 +174,8 @@ __decorateClass([
 AccessLog = __decorateClass([
   Entity({ tableName: "access_logs" }),
   Index({ name: "access_logs_tenant_idx", properties: ["tenantId", "createdAt"] }),
-  Index({ name: "access_logs_actor_idx", properties: ["actorUserId", "createdAt"] })
+  Index({ name: "access_logs_actor_idx", properties: ["actorUserId", "createdAt"] }),
+  Index({ name: "access_logs_created_at_idx", properties: ["createdAt"] })
 ], AccessLog);
 export {
   AccessLog,

package/dist/modules/audit_logs/data/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/audit_logs/data/entities.ts"],
-  "sourcesContent": ["import { Entity, Index, PrimaryKey, Property } from '@mikro-orm/decorators/legacy'\nimport type { ActionLogProjectionType, ActionLogSourceKey } from '@open-mercato/core/modules/audit_logs/lib/projections'\n\nexport type ActionLogExecutionState = 'done' | 'undoing' | 'undone' | 'failed' | 'redone'\n\n@Entity({ tableName: 'action_logs' })\n@Index({ name: 'action_logs_tenant_idx', properties: ['tenantId', 'createdAt'] })\n@Index({ name: 'action_logs_actor_idx', properties: ['actorUserId', 'createdAt'] })\n@Index({ name: 'action_logs_resource_idx', properties: ['tenantId', 'resourceKind', 'resourceId', 'createdAt'] })\n@Index({ name: 'action_logs_parent_resource_idx', properties: ['tenantId', 'parentResourceKind', 'parentResourceId', 'createdAt'] })\n@Index({ name: 'action_logs_action_type_idx', properties: ['tenantId', 'organizationId', 'actionType', 'createdAt'] })\n@Index({ name: 'action_logs_source_key_idx', properties: ['tenantId', 'organizationId', 'sourceKey', 'createdAt'] })\n@Index({ name: 'action_logs_primary_changed_field_idx', properties: ['tenantId', 'organizationId', 'primaryChangedField', 'createdAt'] })\n@Index({ name: 'action_logs_changed_fields_idx', properties: ['changedFields'], type: 'gin' })\n@Index({ name: 'action_logs_related_resource_idx', properties: ['tenantId', 'relatedResourceKind', 'relatedResourceId', 'createdAt'] })\nexport class ActionLog {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId: string | null = null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId: string | null = null\n\n  @Property({ name: 'actor_user_id', type: 'uuid', nullable: true })\n  actorUserId: string | null = null\n\n  @Property({ name: 'command_id', type: 'text' })\n  commandId!: string\n\n  @Property({ name: 'action_label', type: 'text', nullable: true })\n  actionLabel: string | null = null\n\n  @Property({ name: 'action_type', type: 'text', nullable: true })\n  actionType: ActionLogProjectionType | null = null\n\n  @Property({ name: 'resource_kind', type: 'text', nullable: true })\n  resourceKind: string | null = null\n\n  @Property({ name: 'resource_id', type: 'text', nullable: true })\n  resourceId: string | null = null\n\n  @Property({ name: 'parent_resource_kind', type: 'text', nullable: true })\n  parentResourceKind: string | null = null\n\n  @Property({ name: 'parent_resource_id', type: 'text', nullable: true })\n  parentResourceId: string | null = null\n\n  @Property({ name: 'execution_state', type: 'text', default: 'done' })\n  executionState: ActionLogExecutionState = 'done'\n\n  @Property({ name: 'undo_token', type: 'text', nullable: true })\n  undoToken: string | null = null\n\n  @Property({ name: 'command_payload', type: 'jsonb', nullable: true })\n  commandPayload: unknown | null = null\n\n  @Property({ name: 'snapshot_before', type: 'jsonb', nullable: true })\n  snapshotBefore: unknown | null = null\n\n  @Property({ name: 'snapshot_after', type: 'jsonb', nullable: true })\n  snapshotAfter: unknown | null = null\n\n  @Property({ name: 'changes_json', type: 'jsonb', nullable: true })\n  changesJson: Record<string, unknown> | null = null\n\n  @Property({ name: 'changed_fields', type: 'text[]', nullable: true })\n  changedFields: string[] | null = null\n\n  @Property({ name: 'primary_changed_field', type: 'text', nullable: true })\n  primaryChangedField: string | null = null\n\n  @Property({ name: 'context_json', type: 'jsonb', nullable: true })\n  contextJson: Record<string, unknown> | null = null\n\n  @Property({ name: 'source_key', type: 'text', nullable: true })\n  sourceKey: ActionLogSourceKey | null = null\n\n  @Property({ name: 'related_resource_kind', type: 'text', nullable: true })\n  relatedResourceKind: string | null = null\n\n  @Property({ name: 'related_resource_id', type: 'text', nullable: true })\n  relatedResourceId: string | null = null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt: Date | null = null\n}\n\n@Entity({ tableName: 'access_logs' })\n@Index({ name: 'access_logs_tenant_idx', properties: ['tenantId', 'createdAt'] })\n@Index({ name: 'access_logs_actor_idx', properties: ['actorUserId', 'createdAt'] })\nexport class AccessLog {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId: string | null = null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId: string | null = null\n\n  @Property({ name: 'actor_user_id', type: 'uuid', nullable: true })\n  actorUserId: string | null = null\n\n  @Property({ name: 'resource_kind', type: 'text' })\n  resourceKind!: string\n\n  @Property({ name: 'resource_id', type: 'text' })\n  resourceId!: string\n\n  @Property({ name: 'access_type', type: 'text' })\n  accessType!: string\n\n  @Property({ name: 'fields_json', type: 'jsonb', nullable: true })\n  fieldsJson: string[] | null = null\n\n  @Property({ name: 'context_json', type: 'jsonb', nullable: true })\n  contextJson: Record<string, unknown> | null = null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt: Date | null = null\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,YAAY,gBAAgB;AAe7C,IAAM,YAAN,MAAgB;AAAA,EAAhB;AAKL,oBAA0B;AAG1B,0BAAgC;AAGhC,uBAA6B;AAM7B,uBAA6B;AAG7B,sBAA6C;AAG7C,wBAA8B;AAG9B,sBAA4B;AAG5B,8BAAoC;AAGpC,4BAAkC;AAGlC,0BAA0C;AAG1C,qBAA2B;AAG3B,0BAAiC;AAGjC,0BAAiC;AAGjC,yBAAgC;AAGhC,uBAA8C;AAG9C,yBAAiC;AAGjC,+BAAqC;AAGrC,uBAA8C;AAG9C,qBAAuC;AAGvC,+BAAqC;AAGrC,6BAAmC;AAGnC,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAG3B,qBAAyB;AAAA;AAC3B;AA5EE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,UAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAJlD,UAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPxD,UAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,UAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAbnC,UAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBrD,UAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnBpD,UAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtBtD,UAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBpD,UA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,wBAAwB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5B7D,UA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA/B3D,UAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,SAAS,OAAO,CAAC;AAAA,GAlCzD,UAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GArCnD,UAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAxCzD,UAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GA3CzD,UA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GA9CxD,UA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAjDtD,UAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,UAAU,UAAU,KAAK,CAAC;AAAA,GApDzD,UAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,yBAAyB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAvD9D,UAwDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GA1DtD,UA2DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA7DnD,UA8DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,yBAAyB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhE9D,UAiEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnE5D,UAoEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAtE7D,UAuEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAzE7D,UA0EX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA5EjD,UA6EX;AA7EW,YAAN;AAAA,EAVN,OAAO,EAAE,WAAW,cAAc,CAAC;AAAA,EACnC,MAAM,EAAE,MAAM,0BAA0B,YAAY,CAAC,YAAY,WAAW,EAAE,CAAC;AAAA,EAC/E,MAAM,EAAE,MAAM,yBAAyB,YAAY,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,EACjF,MAAM,EAAE,MAAM,4BAA4B,YAAY,CAAC,YAAY,gBAAgB,cAAc,WAAW,EAAE,CAAC;AAAA,EAC/G,MAAM,EAAE,MAAM,mCAAmC,YAAY,CAAC,YAAY,sBAAsB,oBAAoB,WAAW,EAAE,CAAC;AAAA,EAClI,MAAM,EAAE,MAAM,+BAA+B,YAAY,CAAC,YAAY,kBAAkB,cAAc,WAAW,EAAE,CAAC;AAAA,EACpH,MAAM,EAAE,MAAM,8BAA8B,YAAY,CAAC,YAAY,kBAAkB,aAAa,WAAW,EAAE,CAAC;AAAA,EAClH,MAAM,EAAE,MAAM,yCAAyC,YAAY,CAAC,YAAY,kBAAkB,uBAAuB,WAAW,EAAE,CAAC;AAAA,EACvI,MAAM,EAAE,MAAM,kCAAkC,YAAY,CAAC,eAAe,GAAG,MAAM,MAAM,CAAC;AAAA,EAC5F,MAAM,EAAE,MAAM,oCAAoC,YAAY,CAAC,YAAY,uBAAuB,qBAAqB,WAAW,EAAE,CAAC;AAAA,GACzH;AAmFN,IAAM,YAAN,MAAgB;AAAA,EAAhB;AAKL,oBAA0B;AAG1B,0BAAgC;AAGhC,uBAA6B;AAY7B,sBAA8B;AAG9B,uBAA8C;AAG9C,qBAAkB,oBAAI,KAAK;AAG3B,qBAAyB;AAAA;AAC3B;AA/BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,UAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAJlD,UAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPxD,UAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,UAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GAbtC,UAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAhBpC,UAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAnBpC,UAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAtBrD,UAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAzBtD,UA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA5B7D,UA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA/BjD,UAgCX;AAhCW,YAAN;AAAA,EAHN,OAAO,EAAE,WAAW,cAAc,CAAC;AAAA,EACnC,MAAM,EAAE,MAAM,0BAA0B,YAAY,CAAC,YAAY,WAAW,EAAE,CAAC;AAAA,EAC/E,MAAM,EAAE,MAAM,yBAAyB,YAAY,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,GACrE;",
+  "sourcesContent": ["import { Entity, Index, PrimaryKey, Property } from '@mikro-orm/decorators/legacy'\nimport type { ActionLogProjectionType, ActionLogSourceKey } from '@open-mercato/core/modules/audit_logs/lib/projections'\n\nexport type ActionLogExecutionState = 'done' | 'undoing' | 'undone' | 'failed' | 'redone'\n\n@Entity({ tableName: 'action_logs' })\n@Index({ name: 'action_logs_tenant_idx', properties: ['tenantId', 'createdAt'] })\n@Index({ name: 'action_logs_actor_idx', properties: ['actorUserId', 'createdAt'] })\n@Index({ name: 'action_logs_resource_idx', properties: ['tenantId', 'resourceKind', 'resourceId', 'createdAt'] })\n@Index({ name: 'action_logs_parent_resource_idx', properties: ['tenantId', 'parentResourceKind', 'parentResourceId', 'createdAt'] })\n@Index({ name: 'action_logs_action_type_idx', properties: ['tenantId', 'organizationId', 'actionType', 'createdAt'] })\n@Index({ name: 'action_logs_source_key_idx', properties: ['tenantId', 'organizationId', 'sourceKey', 'createdAt'] })\n@Index({ name: 'action_logs_primary_changed_field_idx', properties: ['tenantId', 'organizationId', 'primaryChangedField', 'createdAt'] })\n@Index({ name: 'action_logs_changed_fields_idx', properties: ['changedFields'], type: 'gin' })\n@Index({ name: 'action_logs_related_resource_idx', properties: ['tenantId', 'relatedResourceKind', 'relatedResourceId', 'createdAt'] })\nexport class ActionLog {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId: string | null = null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId: string | null = null\n\n  @Property({ name: 'actor_user_id', type: 'uuid', nullable: true })\n  actorUserId: string | null = null\n\n  @Property({ name: 'command_id', type: 'text' })\n  commandId!: string\n\n  @Property({ name: 'action_label', type: 'text', nullable: true })\n  actionLabel: string | null = null\n\n  @Property({ name: 'action_type', type: 'text', nullable: true })\n  actionType: ActionLogProjectionType | null = null\n\n  @Property({ name: 'resource_kind', type: 'text', nullable: true })\n  resourceKind: string | null = null\n\n  @Property({ name: 'resource_id', type: 'text', nullable: true })\n  resourceId: string | null = null\n\n  @Property({ name: 'parent_resource_kind', type: 'text', nullable: true })\n  parentResourceKind: string | null = null\n\n  @Property({ name: 'parent_resource_id', type: 'text', nullable: true })\n  parentResourceId: string | null = null\n\n  @Property({ name: 'execution_state', type: 'text', default: 'done' })\n  executionState: ActionLogExecutionState = 'done'\n\n  @Property({ name: 'undo_token', type: 'text', nullable: true })\n  undoToken: string | null = null\n\n  @Property({ name: 'command_payload', type: 'jsonb', nullable: true })\n  commandPayload: unknown | null = null\n\n  @Property({ name: 'snapshot_before', type: 'jsonb', nullable: true })\n  snapshotBefore: unknown | null = null\n\n  @Property({ name: 'snapshot_after', type: 'jsonb', nullable: true })\n  snapshotAfter: unknown | null = null\n\n  @Property({ name: 'changes_json', type: 'jsonb', nullable: true })\n  changesJson: Record<string, unknown> | null = null\n\n  @Property({ name: 'changed_fields', type: 'text[]', nullable: true })\n  changedFields: string[] | null = null\n\n  @Property({ name: 'primary_changed_field', type: 'text', nullable: true })\n  primaryChangedField: string | null = null\n\n  @Property({ name: 'context_json', type: 'jsonb', nullable: true })\n  contextJson: Record<string, unknown> | null = null\n\n  @Property({ name: 'source_key', type: 'text', nullable: true })\n  sourceKey: ActionLogSourceKey | null = null\n\n  @Property({ name: 'related_resource_kind', type: 'text', nullable: true })\n  relatedResourceKind: string | null = null\n\n  @Property({ name: 'related_resource_id', type: 'text', nullable: true })\n  relatedResourceId: string | null = null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt: Date | null = null\n}\n\n@Entity({ tableName: 'access_logs' })\n@Index({ name: 'access_logs_tenant_idx', properties: ['tenantId', 'createdAt'] })\n@Index({ name: 'access_logs_actor_idx', properties: ['actorUserId', 'createdAt'] })\n@Index({ name: 'access_logs_created_at_idx', properties: ['createdAt'] })\nexport class AccessLog {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId: string | null = null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId: string | null = null\n\n  @Property({ name: 'actor_user_id', type: 'uuid', nullable: true })\n  actorUserId: string | null = null\n\n  @Property({ name: 'resource_kind', type: 'text' })\n  resourceKind!: string\n\n  @Property({ name: 'resource_id', type: 'text' })\n  resourceId!: string\n\n  @Property({ name: 'access_type', type: 'text' })\n  accessType!: string\n\n  @Property({ name: 'fields_json', type: 'jsonb', nullable: true })\n  fieldsJson: string[] | null = null\n\n  @Property({ name: 'context_json', type: 'jsonb', nullable: true })\n  contextJson: Record<string, unknown> | null = null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt: Date | null = null\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,YAAY,gBAAgB;AAe7C,IAAM,YAAN,MAAgB;AAAA,EAAhB;AAKL,oBAA0B;AAG1B,0BAAgC;AAGhC,uBAA6B;AAM7B,uBAA6B;AAG7B,sBAA6C;AAG7C,wBAA8B;AAG9B,sBAA4B;AAG5B,8BAAoC;AAGpC,4BAAkC;AAGlC,0BAA0C;AAG1C,qBAA2B;AAG3B,0BAAiC;AAGjC,0BAAiC;AAGjC,yBAAgC;AAGhC,uBAA8C;AAG9C,yBAAiC;AAGjC,+BAAqC;AAGrC,uBAA8C;AAG9C,qBAAuC;AAGvC,+BAAqC;AAGrC,6BAAmC;AAGnC,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAG3B,qBAAyB;AAAA;AAC3B;AA5EE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,UAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAJlD,UAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPxD,UAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,UAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAbnC,UAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBrD,UAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnBpD,UAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtBtD,UAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBpD,UA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,wBAAwB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5B7D,UA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA/B3D,UAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,SAAS,OAAO,CAAC;AAAA,GAlCzD,UAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GArCnD,UAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAxCzD,UAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GA3CzD,UA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GA9CxD,UA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAjDtD,UAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,UAAU,UAAU,KAAK,CAAC;AAAA,GApDzD,UAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,yBAAyB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAvD9D,UAwDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GA1DtD,UA2DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA7DnD,UA8DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,yBAAyB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhE9D,UAiEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnE5D,UAoEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAtE7D,UAuEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAzE7D,UA0EX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA5EjD,UA6EX;AA7EW,YAAN;AAAA,EAVN,OAAO,EAAE,WAAW,cAAc,CAAC;AAAA,EACnC,MAAM,EAAE,MAAM,0BAA0B,YAAY,CAAC,YAAY,WAAW,EAAE,CAAC;AAAA,EAC/E,MAAM,EAAE,MAAM,yBAAyB,YAAY,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,EACjF,MAAM,EAAE,MAAM,4BAA4B,YAAY,CAAC,YAAY,gBAAgB,cAAc,WAAW,EAAE,CAAC;AAAA,EAC/G,MAAM,EAAE,MAAM,mCAAmC,YAAY,CAAC,YAAY,sBAAsB,oBAAoB,WAAW,EAAE,CAAC;AAAA,EAClI,MAAM,EAAE,MAAM,+BAA+B,YAAY,CAAC,YAAY,kBAAkB,cAAc,WAAW,EAAE,CAAC;AAAA,EACpH,MAAM,EAAE,MAAM,8BAA8B,YAAY,CAAC,YAAY,kBAAkB,aAAa,WAAW,EAAE,CAAC;AAAA,EAClH,MAAM,EAAE,MAAM,yCAAyC,YAAY,CAAC,YAAY,kBAAkB,uBAAuB,WAAW,EAAE,CAAC;AAAA,EACvI,MAAM,EAAE,MAAM,kCAAkC,YAAY,CAAC,eAAe,GAAG,MAAM,MAAM,CAAC;AAAA,EAC5F,MAAM,EAAE,MAAM,oCAAoC,YAAY,CAAC,YAAY,uBAAuB,qBAAqB,WAAW,EAAE,CAAC;AAAA,GACzH;AAoFN,IAAM,YAAN,MAAgB;AAAA,EAAhB;AAKL,oBAA0B;AAG1B,0BAAgC;AAGhC,uBAA6B;AAY7B,sBAA8B;AAG9B,uBAA8C;AAG9C,qBAAkB,oBAAI,KAAK;AAG3B,qBAAyB;AAAA;AAC3B;AA/BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,UAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAJlD,UAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPxD,UAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,UAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GAbtC,UAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAhBpC,UAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAnBpC,UAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAtBrD,UAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAzBtD,UA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA5B7D,UA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA/BjD,UAgCX;AAhCW,YAAN;AAAA,EAJN,OAAO,EAAE,WAAW,cAAc,CAAC;AAAA,EACnC,MAAM,EAAE,MAAM,0BAA0B,YAAY,CAAC,YAAY,WAAW,EAAE,CAAC;AAAA,EAC/E,MAAM,EAAE,MAAM,yBAAyB,YAAY,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,EACjF,MAAM,EAAE,MAAM,8BAA8B,YAAY,CAAC,WAAW,EAAE,CAAC;AAAA,GAC3D;",
   "names": []
 }

package/dist/modules/audit_logs/migrations/Migration20260611104500.js

@@ -0,0 +1,13 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260611104500 extends Migration {
+  up() {
+    this.addSql(`create index "access_logs_created_at_idx" on "access_logs" ("created_at");`);
+  }
+  down() {
+    this.addSql(`drop index "access_logs_created_at_idx";`);
+  }
+}
+export {
+  Migration20260611104500
+};
+//# sourceMappingURL=Migration20260611104500.js.map

package/dist/modules/audit_logs/migrations/Migration20260611104500.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/audit_logs/migrations/Migration20260611104500.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260611104500 extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`create index \"access_logs_created_at_idx\" on \"access_logs\" (\"created_at\");`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`drop index \"access_logs_created_at_idx\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,gCAAgC,UAAU;AAAA,EAE5C,KAA2B;AAClC,SAAK,OAAO,4EAA4E;AAAA,EAC1F;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,0CAA0C;AAAA,EACxD;AAEF;",
+  "names": []
+}

package/dist/modules/audit_logs/services/accessLogService.js

@@ -13,10 +13,18 @@ function toPositiveNumber(value, fallback) {
   if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
   return parsed;
 }
+function toNonNegativeNumber(value, fallback) {
+  if (value === void 0 || value === "") return fallback;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 0) return fallback;
+  return parsed;
+}
 const CORE_RETENTION_DAYS = toPositiveNumber(process.env.AUDIT_LOGS_CORE_RETENTION_DAYS, 7);
 const NON_CORE_RETENTION_HOURS = toPositiveNumber(process.env.AUDIT_LOGS_NON_CORE_RETENTION_HOURS, 8);
 const CORE_RETENTION_MS = CORE_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
 const NON_CORE_RETENTION_MS = NON_CORE_RETENTION_HOURS * 60 * 60 * 1e3;
+const ROTATE_INTERVAL_MS = toNonNegativeNumber(process.env.AUDIT_LOGS_ROTATE_INTERVAL_MS, 6e4);
+let lastRotatedAt = null;
 const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/;
 const MAX_BATCH_ROWS = 500;
 let validationWarningLogged = false;
@@ -294,6 +302,8 @@ class AccessLogService {
   }
   async rotate(fork) {
     const now = Date.now();
+    if (ROTATE_INTERVAL_MS > 0 && lastRotatedAt !== null && now - lastRotatedAt < ROTATE_INTERVAL_MS) return;
+    lastRotatedAt = now;
     const coreCutoff = new Date(now - CORE_RETENTION_MS);
     const nonCoreCutoff = new Date(now - NON_CORE_RETENTION_MS);
     try {

package/dist/modules/audit_logs/services/accessLogService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/audit_logs/services/accessLogService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport { AccessLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  accessLogCreateSchema,\n  accessLogListSchema,\n  type AccessLogCreateInput,\n  type AccessLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { parseDecryptedFieldValue } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { E } from '#generated/entities.ids.generated'\n\nconst CORE_RESOURCE_KINDS = new Set<string>(['auth.user', 'auth.role'])\n\nfunction toPositiveNumber(value: string | undefined, fallback: number): number {\n  if (!value) return fallback\n  const parsed = Number(value)\n  if (!Number.isFinite(parsed) || parsed <= 0) return fallback\n  return parsed\n}\n\nconst CORE_RETENTION_DAYS = toPositiveNumber(process.env.AUDIT_LOGS_CORE_RETENTION_DAYS, 7)\nconst NON_CORE_RETENTION_HOURS = toPositiveNumber(process.env.AUDIT_LOGS_NON_CORE_RETENTION_HOURS, 8)\nconst CORE_RETENTION_MS = CORE_RETENTION_DAYS * 24 * 60 * 60 * 1000\nconst NON_CORE_RETENTION_MS = NON_CORE_RETENTION_HOURS * 60 * 60 * 1000\nconst UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n// Postgres has a hard limit of 65k bind parameters per statement. Each access\n// log row uses 10 bind values (see INSERT below), so 500 rows \u00D7 10 = 5 000\n// parameters \u2014 well below the limit while keeping memory bounded.\nconst MAX_BATCH_ROWS = 500\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\n\n// Module-level registry of in-flight access-log writes. Both `log` and\n// `logMany` opt every promise they kick off into this set so that\n// `flushAccessLog()` can drain them. This is what makes the new\n// fire-and-forget CRUD path safe for test code that asserts on `access_logs`\n// rows immediately after a response \u2014 the integration harness defaults to\n// blocking via `OM_CRUD_ACCESS_LOG_BLOCKING=1`, and direct callers can opt\n// in to draining explicitly via `flushAccessLog()`.\nconst pendingAccessLogWrites = new Set<Promise<unknown>>()\n\nfunction trackPendingAccessLogWrite<T>(promise: Promise<T>): Promise<T> {\n  pendingAccessLogWrites.add(promise as unknown as Promise<unknown>)\n  promise\n    .catch(() => undefined)\n    .finally(() => {\n      pendingAccessLogWrites.delete(promise as unknown as Promise<unknown>)\n    })\n  return promise\n}\n\nexport async function flushAccessLog(): Promise<void> {\n  while (pendingAccessLogWrites.size > 0) {\n    const snapshot = Array.from(pendingAccessLogWrites)\n    await Promise.allSettled(snapshot)\n  }\n}\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\ntype RawEncryptedFields = {\n  resourceKind?: unknown\n  resourceId?: unknown\n  accessType?: unknown\n  fieldsJson?: unknown\n  contextJson?: unknown\n}\n\nfunction serializeJsonColumn(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') {\n    try {\n      JSON.parse(value)\n      return value\n    } catch {\n      return JSON.stringify(value)\n    }\n  }\n  try {\n    return JSON.stringify(value)\n  } catch {\n    return null\n  }\n}\n\nexport class AccessLogService {\n  constructor(private readonly em: EntityManager) {}\n\n  async log(input: AccessLogCreateInput): Promise<AccessLog | null> {\n    const promise = this.logInternal(input)\n    return trackPendingAccessLogWrite(promise)\n  }\n\n  async logMany(inputs: AccessLogCreateInput[]): Promise<number> {\n    if (!Array.isArray(inputs) || inputs.length === 0) return 0\n    const promise = this.logManyInternal(inputs)\n    return trackPendingAccessLogWrite(promise)\n  }\n\n  flush(): Promise<void> {\n    return flushAccessLog()\n  }\n\n  private async logManyInternal(inputs: AccessLogCreateInput[]): Promise<number> {\n    // Parsing in parallel matches the legacy fan-out `Promise.all(map(...service.log()))`\n    // path's wall-clock; the previous sequential loop made batched writes slower than\n    // un-batched on tenants with encryption enabled and pushed UI integration tests\n    // over their dialog-stability budget.\n    const parsedResults = await Promise.all(inputs.map((input) => this.parseInput(input)))\n    const normalized: AccessLogCreateInput[] = []\n    for (const parsed of parsedResults) {\n      if (parsed) normalized.push(parsed)\n    }\n    if (!normalized.length) return 0\n\n    let written = 0\n    for (let offset = 0; offset < normalized.length; offset += MAX_BATCH_ROWS) {\n      const chunk = normalized.slice(offset, offset + MAX_BATCH_ROWS)\n      written += await this.writeChunk(chunk)\n    }\n    if (written > 0) {\n      const fork = this.em.fork({ useContext: true })\n      await this.rotate(fork)\n    }\n    return written\n  }\n\n  private async writeChunk(chunk: AccessLogCreateInput[]): Promise<number> {\n    if (!chunk.length) return 0\n    const fork = this.em.fork({ useContext: true })\n    const encryption = resolveTenantEncryptionService(fork as any)\n    const createdAt = new Date()\n\n    // Encrypt every row in parallel so encryption-enabled tenants do not pay\n    // the N-rows \u00D7 per-row latency penalty that the previous sequential\n    // for-of loop introduced. The legacy `service.log()` fan-out resolved\n    // its 50 encryption calls concurrently via `Promise.all`; preserve that\n    // characteristic here so the batched single-INSERT path is strictly\n    // faster than the legacy parallel-INSERTs path.\n    type PreparedRow = {\n      tenantId: string | null\n      organizationId: string | null\n      data: AccessLogCreateInput\n      fields: unknown[] | null\n      context: Record<string, unknown> | null\n      encrypted: RawEncryptedFields | null\n    }\n    const prepared: PreparedRow[] = await Promise.all(\n      chunk.map(async (data) => {\n        const fields = Array.isArray(data.fields) && data.fields.length ? data.fields : null\n        const context = data.context && Object.keys(data.context).length ? data.context : null\n        const tenantId = data.tenantId ?? null\n        const organizationId = data.organizationId ?? null\n        const encrypted = encryption\n          ? ((await encryption.encryptEntityPayload(\n              E.audit_logs.access_log,\n              {\n                resourceKind: data.resourceKind,\n                resourceId: data.resourceId,\n                accessType: data.accessType,\n                fieldsJson: fields,\n                contextJson: context,\n              },\n              tenantId,\n              organizationId,\n            )) as RawEncryptedFields)\n          : null\n        return { tenantId, organizationId, data, fields, context, encrypted }\n      }),\n    )\n\n    const placeholders: string[] = []\n    const params: unknown[] = []\n    for (const row of prepared) {\n      const { tenantId, organizationId, data, fields, context, encrypted } = row\n      const resourceKindOut = encrypted?.resourceKind ?? data.resourceKind\n      const resourceIdOut = encrypted?.resourceId ?? data.resourceId\n      const accessTypeOut = encrypted?.accessType ?? data.accessType\n      const fieldsOut = encrypted?.fieldsJson ?? fields\n      const contextOut = encrypted?.contextJson ?? context\n      placeholders.push('(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')\n      params.push(\n        tenantId,\n        organizationId,\n        data.actorUserId ?? null,\n        resourceKindOut,\n        resourceIdOut,\n        accessTypeOut,\n        serializeJsonColumn(fieldsOut),\n        serializeJsonColumn(contextOut),\n        createdAt,\n        null,\n      )\n    }\n    if (!placeholders.length) return 0\n    const sql = `insert into \"access_logs\" (\"tenant_id\", \"organization_id\", \"actor_user_id\", \"resource_kind\", \"resource_id\", \"access_type\", \"fields_json\", \"context_json\", \"created_at\", \"deleted_at\") values ${placeholders.join(', ')}`\n    await fork.getConnection().execute(sql, params)\n    return chunk.length\n  }\n\n  private async parseInput(input: AccessLogCreateInput): Promise<AccessLogCreateInput | null> {\n    const schema = accessLogCreateSchema as typeof accessLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n    if (shouldValidate) {\n      try {\n        const data = schema.parse(input)\n        runtimeValidationAvailable = true\n        return data\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          // eslint-disable-next-line no-console\n          console.warn('[audit_logs] falling back to permissive access log payload parser', err)\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        return this.normalizeInput(input)\n      }\n    }\n    return this.normalizeInput(input)\n  }\n\n  private async logInternal(input: AccessLogCreateInput): Promise<AccessLog | null> {\n    const data = await this.parseInput(input)\n    if (!data) return null\n    const fork = this.em.fork({ useContext: true })\n    const fields = Array.isArray(data.fields) && data.fields.length ? data.fields : null\n    const context = data.context && Object.keys(data.context).length ? data.context : null\n    const createdAt = new Date()\n    const tenantId = data.tenantId ?? null\n    const organizationId = data.organizationId ?? null\n\n    const encryption = resolveTenantEncryptionService(fork as any)\n    const encrypted = encryption\n      ? ((await encryption.encryptEntityPayload(\n          E.audit_logs.access_log,\n          {\n            resourceKind: data.resourceKind,\n            resourceId: data.resourceId,\n            accessType: data.accessType,\n            fieldsJson: fields,\n            contextJson: context,\n          },\n          tenantId,\n          organizationId,\n        )) as RawEncryptedFields)\n      : null\n\n    const payload = {\n      resourceKind: encrypted?.resourceKind ?? data.resourceKind,\n      resourceId: encrypted?.resourceId ?? data.resourceId,\n      accessType: encrypted?.accessType ?? data.accessType,\n      fieldsJson: encrypted?.fieldsJson ?? fields,\n      contextJson: encrypted?.contextJson ?? context,\n    }\n\n    const rows = await fork.getConnection().execute(\n      `insert into \"access_logs\" (\"tenant_id\", \"organization_id\", \"actor_user_id\", \"resource_kind\", \"resource_id\", \"access_type\", \"fields_json\", \"context_json\", \"created_at\", \"deleted_at\") values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) returning \"id\"`,\n      [\n        tenantId,\n        organizationId,\n        data.actorUserId ?? null,\n        payload.resourceKind,\n        payload.resourceId,\n        payload.accessType,\n        serializeJsonColumn(payload.fieldsJson),\n        serializeJsonColumn(payload.contextJson),\n        createdAt,\n        null,\n      ],\n    )\n    await this.rotate(fork)\n    const id = Array.isArray(rows) && rows.length > 0 ? rows[0]?.id ?? null : null\n    if (!id) return null\n    const entry = fork.create(AccessLog, {\n      id,\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      resourceKind: data.resourceKind,\n      resourceId: data.resourceId,\n      accessType: data.accessType,\n      fieldsJson: fields,\n      contextJson: context,\n      createdAt,\n    })\n    return entry\n  }\n\n  private normalizeInput(input: Partial<AccessLogCreateInput> | null | undefined): AccessLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        resourceKind: 'unknown',\n        resourceId: 'unknown',\n        accessType: 'unknown',\n        fields: undefined,\n        context: undefined,\n      }\n    }\n    const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n    const toNullableUuid = (value: unknown) => {\n      if (typeof value !== 'string' || value.length === 0) return null\n      const candidate = value.startsWith('api_key:') ? value.slice('api_key:'.length) : value\n      return UUID_REGEX.test(candidate) ? candidate : null\n    }\n    const fields = Array.isArray(input.fields)\n      ? input.fields.filter((f): f is string => typeof f === 'string' && f.length > 0)\n      : undefined\n    const context = typeof input.context === 'object' && input.context !== null\n      ? input.context as Record<string, unknown>\n      : undefined\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: toNullableUuid(input.actorUserId),\n      resourceKind: String(input.resourceKind || 'unknown'),\n      resourceId: String(input.resourceId || 'unknown'),\n      accessType: String(input.accessType || 'unknown'),\n      fields,\n      context,\n    }\n  }\n\n  async list(query: Partial<AccessLogListQuery>) {\n    const parsed = accessLogListSchema.parse({\n      ...query,\n    })\n\n    const where: FilterQuery<AccessLog> = { deletedAt: null }\n    if (parsed.tenantId) where.tenantId = parsed.tenantId\n    if (parsed.organizationId) where.organizationId = parsed.organizationId\n    if (parsed.actorUserId) where.actorUserId = parsed.actorUserId\n    if (parsed.resourceKind) where.resourceKind = parsed.resourceKind\n    if (parsed.accessType) where.accessType = parsed.accessType\n    if (parsed.before) where.createdAt = { ...(where.createdAt as Record<string, any> | undefined), $lt: parsed.before } as any\n    if (parsed.after) where.createdAt = { ...(where.createdAt as Record<string, any> | undefined), $gt: parsed.after } as any\n\n    const pageSize = parsed.pageSize ?? parsed.limit ?? 50\n    const page = parsed.page ?? 1\n    const offset = (page - 1) * pageSize\n\n    const [items, total] = await this.em.findAndCount(\n      AccessLog,\n      where,\n      {\n        orderBy: { createdAt: 'desc' },\n        limit: pageSize,\n        offset,\n      },\n    )\n\n    // Encrypted jsonb columns (`fields_json`, `context_json`) come back as raw\n    // JSON strings from the encryption subscriber after issue #1810 follow-up\n    // (entity-field decryption no longer auto-parses). Restore the structured\n    // shape on read so API consumers see typed objects/arrays.\n    for (const item of items) {\n      const rawFieldsJson = (item as { fieldsJson?: unknown }).fieldsJson\n      if (typeof rawFieldsJson === 'string') {\n        const parsed = parseDecryptedFieldValue(rawFieldsJson)\n        item.fieldsJson = Array.isArray(parsed) ? (parsed as string[]) : null\n      }\n      const rawContextJson = (item as { contextJson?: unknown }).contextJson\n      if (typeof rawContextJson === 'string') {\n        const parsed = parseDecryptedFieldValue(rawContextJson)\n        item.contextJson = parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n          ? (parsed as Record<string, unknown>)\n          : null\n      }\n    }\n\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  private async rotate(fork: EntityManager) {\n    const now = Date.now()\n    const coreCutoff = new Date(now - CORE_RETENTION_MS)\n    const nonCoreCutoff = new Date(now - NON_CORE_RETENTION_MS)\n    try {\n      if (CORE_RESOURCE_KINDS.size > 0) {\n        await fork.nativeDelete(AccessLog, {\n          resourceKind: { $in: Array.from(CORE_RESOURCE_KINDS) },\n          createdAt: { $lt: coreCutoff },\n        })\n      }\n      await fork.nativeDelete(AccessLog, {\n        resourceKind: { $nin: Array.from(CORE_RESOURCE_KINDS) },\n        createdAt: { $lt: nonCoreCutoff },\n      })\n    } catch (err) {\n      // eslint-disable-next-line no-console\n      console.warn('[audit_logs] failed to rotate access logs', err)\n    }\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,sCAAsC;AAC/C,SAAS,gCAAgC;AACzC,SAAS,SAAS;AAElB,MAAM,sBAAsB,oBAAI,IAAY,CAAC,aAAa,WAAW,CAAC;AAEtE,SAAS,iBAAiB,OAA2B,UAA0B;AAC7E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,MAAM,sBAAsB,iBAAiB,QAAQ,IAAI,gCAAgC,CAAC;AAC1F,MAAM,2BAA2B,iBAAiB,QAAQ,IAAI,qCAAqC,CAAC;AACpG,MAAM,oBAAoB,sBAAsB,KAAK,KAAK,KAAK;AAC/D,MAAM,wBAAwB,2BAA2B,KAAK,KAAK;AACnE,MAAM,aAAa;AAInB,MAAM,iBAAiB;AAEvB,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AASjD,MAAM,yBAAyB,oBAAI,IAAsB;AAEzD,SAAS,2BAA8B,SAAiC;AACtE,yBAAuB,IAAI,OAAsC;AACjE,UACG,MAAM,MAAM,MAAS,EACrB,QAAQ,MAAM;AACb,2BAAuB,OAAO,OAAsC;AAAA,EACtE,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,iBAAgC;AACpD,SAAO,uBAAuB,OAAO,GAAG;AACtC,UAAM,WAAW,MAAM,KAAK,sBAAsB;AAClD,UAAM,QAAQ,WAAW,QAAQ;AAAA,EACnC;AACF;AAEA,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAUxI,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI;AACF,WAAK,MAAM,KAAK;AAChB,aAAO;AAAA,IACT,QAAQ;AACN,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AAAA,EACF;AACA,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,IAAI,OAAwD;AAChE,UAAM,UAAU,KAAK,YAAY,KAAK;AACtC,WAAO,2BAA2B,OAAO;AAAA,EAC3C;AAAA,EAEA,MAAM,QAAQ,QAAiD;AAC7D,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,EAAG,QAAO;AAC1D,UAAM,UAAU,KAAK,gBAAgB,MAAM;AAC3C,WAAO,2BAA2B,OAAO;AAAA,EAC3C;AAAA,EAEA,QAAuB;AACrB,WAAO,eAAe;AAAA,EACxB;AAAA,EAEA,MAAc,gBAAgB,QAAiD;AAK7E,UAAM,gBAAgB,MAAM,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,WAAW,KAAK,CAAC,CAAC;AACrF,UAAM,aAAqC,CAAC;AAC5C,eAAW,UAAU,eAAe;AAClC,UAAI,OAAQ,YAAW,KAAK,MAAM;AAAA,IACpC;AACA,QAAI,CAAC,WAAW,OAAQ,QAAO;AAE/B,QAAI,UAAU;AACd,aAAS,SAAS,GAAG,SAAS,WAAW,QAAQ,UAAU,gBAAgB;AACzE,YAAM,QAAQ,WAAW,MAAM,QAAQ,SAAS,cAAc;AAC9D,iBAAW,MAAM,KAAK,WAAW,KAAK;AAAA,IACxC;AACA,QAAI,UAAU,GAAG;AACf,YAAM,OAAO,KAAK,GAAG,KAAK,EAAE,YAAY,KAAK,CAAC;AAC9C,YAAM,KAAK,OAAO,IAAI;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,WAAW,OAAgD;AACvE,QAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,UAAM,OAAO,KAAK,GAAG,KAAK,EAAE,YAAY,KAAK,CAAC;AAC9C,UAAM,aAAa,+BAA+B,IAAW;AAC7D,UAAM,YAAY,oBAAI,KAAK;AAgB3B,UAAM,WAA0B,MAAM,QAAQ;AAAA,MAC5C,MAAM,IAAI,OAAO,SAAS;AACxB,cAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,KAAK,KAAK,OAAO,SAAS,KAAK,SAAS;AAChF,cAAM,UAAU,KAAK,WAAW,OAAO,KAAK,KAAK,OAAO,EAAE,SAAS,KAAK,UAAU;AAClF,cAAM,WAAW,KAAK,YAAY;AAClC,cAAM,iBAAiB,KAAK,kBAAkB;AAC9C,cAAM,YAAY,aACZ,MAAM,WAAW;AAAA,UACjB,EAAE,WAAW;AAAA,UACb;AAAA,YACE,cAAc,KAAK;AAAA,YACnB,YAAY,KAAK;AAAA,YACjB,YAAY,KAAK;AAAA,YACjB,YAAY;AAAA,YACZ,aAAa;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF,IACA;AACJ,eAAO,EAAE,UAAU,gBAAgB,MAAM,QAAQ,SAAS,UAAU;AAAA,MACtE,CAAC;AAAA,IACH;AAEA,UAAM,eAAyB,CAAC;AAChC,UAAM,SAAoB,CAAC;AAC3B,eAAW,OAAO,UAAU;AAC1B,YAAM,EAAE,UAAU,gBAAgB,MAAM,QAAQ,SAAS,UAAU,IAAI;AACvE,YAAM,kBAAkB,WAAW,gBAAgB,KAAK;AACxD,YAAM,gBAAgB,WAAW,cAAc,KAAK;AACpD,YAAM,gBAAgB,WAAW,cAAc,KAAK;AACpD,YAAM,YAAY,WAAW,cAAc;AAC3C,YAAM,aAAa,WAAW,eAAe;AAC7C,mBAAa,KAAK,gCAAgC;AAClD,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,KAAK,eAAe;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB,SAAS;AAAA,QAC7B,oBAAoB,UAAU;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,aAAa,OAAQ,QAAO;AACjC,UAAM,MAAM,gMAAgM,aAAa,KAAK,IAAI,CAAC;AACnO,UAAM,KAAK,cAAc,EAAE,QAAQ,KAAK,MAAM;AAC9C,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,MAAc,WAAW,OAAmE;AAC1F,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AACrE,QAAI,gBAAgB;AAClB,UAAI;AACF,cAAM,OAAO,OAAO,MAAM,KAAK;AAC/B,qCAA6B;AAC7B,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAE1B,kBAAQ,KAAK,qEAAqE,GAAG;AAAA,QACvF;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,KAAK;AAAA,MAClC;AAAA,IACF;AACA,WAAO,KAAK,eAAe,KAAK;AAAA,EAClC;AAAA,EAEA,MAAc,YAAY,OAAwD;AAChF,UAAM,OAAO,MAAM,KAAK,WAAW,KAAK;AACxC,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,OAAO,KAAK,GAAG,KAAK,EAAE,YAAY,KAAK,CAAC;AAC9C,UAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,KAAK,KAAK,OAAO,SAAS,KAAK,SAAS;AAChF,UAAM,UAAU,KAAK,WAAW,OAAO,KAAK,KAAK,OAAO,EAAE,SAAS,KAAK,UAAU;AAClF,UAAM,YAAY,oBAAI,KAAK;AAC3B,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,iBAAiB,KAAK,kBAAkB;AAE9C,UAAM,aAAa,+BAA+B,IAAW;AAC7D,UAAM,YAAY,aACZ,MAAM,WAAW;AAAA,MACjB,EAAE,WAAW;AAAA,MACb;AAAA,QACE,cAAc,KAAK;AAAA,QACnB,YAAY,KAAK;AAAA,QACjB,YAAY,KAAK;AAAA,QACjB,YAAY;AAAA,QACZ,aAAa;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAEJ,UAAM,UAAU;AAAA,MACd,cAAc,WAAW,gBAAgB,KAAK;AAAA,MAC9C,YAAY,WAAW,cAAc,KAAK;AAAA,MAC1C,YAAY,WAAW,cAAc,KAAK;AAAA,MAC1C,YAAY,WAAW,cAAc;AAAA,MACrC,aAAa,WAAW,eAAe;AAAA,IACzC;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,KAAK,eAAe;AAAA,QACpB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,oBAAoB,QAAQ,UAAU;AAAA,QACtC,oBAAoB,QAAQ,WAAW;AAAA,QACvC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,OAAO,IAAI;AACtB,UAAM,KAAK,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,MAAM,OAAO;AAC1E,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,QAAQ,KAAK,OAAO,WAAW;AAAA,MACnC;AAAA,MACA,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAMA,cAAa;AACnB,UAAM,iBAAiB,CAAC,UAAmB;AACzC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,YAAM,YAAY,MAAM,WAAW,UAAU,IAAI,MAAM,MAAM,WAAW,MAAM,IAAI;AAClF,aAAOA,YAAW,KAAK,SAAS,IAAI,YAAY;AAAA,IAClD;AACA,UAAM,SAAS,MAAM,QAAQ,MAAM,MAAM,IACrC,MAAM,OAAO,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,IAC7E;AACJ,UAAM,UAAU,OAAO,MAAM,YAAY,YAAY,MAAM,YAAY,OACnE,MAAM,UACN;AACJ,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,eAAe,MAAM,WAAW;AAAA,MAC7C,cAAc,OAAO,MAAM,gBAAgB,SAAS;AAAA,MACpD,YAAY,OAAO,MAAM,cAAc,SAAS;AAAA,MAChD,YAAY,OAAO,MAAM,cAAc,SAAS;AAAA,MAChD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,oBAAoB,MAAM;AAAA,MACvC,GAAG;AAAA,IACL,CAAC;AAED,UAAM,QAAgC,EAAE,WAAW,KAAK;AACxD,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,YAAa,OAAM,cAAc,OAAO;AACnD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AACjD,QAAI,OAAO,OAAQ,OAAM,YAAY,EAAE,GAAI,MAAM,WAA+C,KAAK,OAAO,OAAO;AACnH,QAAI,OAAO,MAAO,OAAM,YAAY,EAAE,GAAI,MAAM,WAA+C,KAAK,OAAO,MAAM;AAEjH,UAAM,WAAW,OAAO,YAAY,OAAO,SAAS;AACpD,UAAM,OAAO,OAAO,QAAQ;AAC5B,UAAM,UAAU,OAAO,KAAK;AAE5B,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,KAAK,GAAG;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAMA,eAAW,QAAQ,OAAO;AACxB,YAAM,gBAAiB,KAAkC;AACzD,UAAI,OAAO,kBAAkB,UAAU;AACrC,cAAMC,UAAS,yBAAyB,aAAa;AACrD,aAAK,aAAa,MAAM,QAAQA,OAAM,IAAKA,UAAsB;AAAA,MACnE;AACA,YAAM,iBAAkB,KAAmC;AAC3D,UAAI,OAAO,mBAAmB,UAAU;AACtC,cAAMA,UAAS,yBAAyB,cAAc;AACtD,aAAK,cAAcA,WAAU,OAAOA,YAAW,YAAY,CAAC,MAAM,QAAQA,OAAM,IAC3EA,UACD;AAAA,MACN;AAAA,IACF;AAEA,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAc,OAAO,MAAqB;AACxC,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,aAAa,IAAI,KAAK,MAAM,iBAAiB;AACnD,UAAM,gBAAgB,IAAI,KAAK,MAAM,qBAAqB;AAC1D,QAAI;AACF,UAAI,oBAAoB,OAAO,GAAG;AAChC,cAAM,KAAK,aAAa,WAAW;AAAA,UACjC,cAAc,EAAE,KAAK,MAAM,KAAK,mBAAmB,EAAE;AAAA,UACrD,WAAW,EAAE,KAAK,WAAW;AAAA,QAC/B,CAAC;AAAA,MACH;AACA,YAAM,KAAK,aAAa,WAAW;AAAA,QACjC,cAAc,EAAE,MAAM,MAAM,KAAK,mBAAmB,EAAE;AAAA,QACtD,WAAW,EAAE,KAAK,cAAc;AAAA,MAClC,CAAC;AAAA,IACH,SAAS,KAAK;AAEZ,cAAQ,KAAK,6CAA6C,GAAG;AAAA,IAC/D;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport { AccessLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport {\n  accessLogCreateSchema,\n  accessLogListSchema,\n  type AccessLogCreateInput,\n  type AccessLogListQuery,\n} from '@open-mercato/core/modules/audit_logs/data/validators'\nimport { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { parseDecryptedFieldValue } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { E } from '#generated/entities.ids.generated'\n\nconst CORE_RESOURCE_KINDS = new Set<string>(['auth.user', 'auth.role'])\n\nfunction toPositiveNumber(value: string | undefined, fallback: number): number {\n  if (!value) return fallback\n  const parsed = Number(value)\n  if (!Number.isFinite(parsed) || parsed <= 0) return fallback\n  return parsed\n}\n\nfunction toNonNegativeNumber(value: string | undefined, fallback: number): number {\n  if (value === undefined || value === '') return fallback\n  const parsed = Number(value)\n  if (!Number.isFinite(parsed) || parsed < 0) return fallback\n  return parsed\n}\n\nconst CORE_RETENTION_DAYS = toPositiveNumber(process.env.AUDIT_LOGS_CORE_RETENTION_DAYS, 7)\nconst NON_CORE_RETENTION_HOURS = toPositiveNumber(process.env.AUDIT_LOGS_NON_CORE_RETENTION_HOURS, 8)\nconst CORE_RETENTION_MS = CORE_RETENTION_DAYS * 24 * 60 * 60 * 1000\nconst NON_CORE_RETENTION_MS = NON_CORE_RETENTION_HOURS * 60 * 60 * 1000\n// Rotation runs after every successful write; without a gate that means two\n// DELETE statements per CRUD GET. Amortize to one rotation per interval per\n// process \u2014 `0` opts back into rotate-on-every-write (test harnesses).\nconst ROTATE_INTERVAL_MS = toNonNegativeNumber(process.env.AUDIT_LOGS_ROTATE_INTERVAL_MS, 60_000)\n\nlet lastRotatedAt: number | null = null\nconst UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n// Postgres has a hard limit of 65k bind parameters per statement. Each access\n// log row uses 10 bind values (see INSERT below), so 500 rows \u00D7 10 = 5 000\n// parameters \u2014 well below the limit while keeping memory bounded.\nconst MAX_BATCH_ROWS = 500\n\nlet validationWarningLogged = false\nlet runtimeValidationAvailable: boolean | null = null\n\n// Module-level registry of in-flight access-log writes. Both `log` and\n// `logMany` opt every promise they kick off into this set so that\n// `flushAccessLog()` can drain them. This is what makes the new\n// fire-and-forget CRUD path safe for test code that asserts on `access_logs`\n// rows immediately after a response \u2014 the integration harness defaults to\n// blocking via `OM_CRUD_ACCESS_LOG_BLOCKING=1`, and direct callers can opt\n// in to draining explicitly via `flushAccessLog()`.\nconst pendingAccessLogWrites = new Set<Promise<unknown>>()\n\nfunction trackPendingAccessLogWrite<T>(promise: Promise<T>): Promise<T> {\n  pendingAccessLogWrites.add(promise as unknown as Promise<unknown>)\n  promise\n    .catch(() => undefined)\n    .finally(() => {\n      pendingAccessLogWrites.delete(promise as unknown as Promise<unknown>)\n    })\n  return promise\n}\n\nexport async function flushAccessLog(): Promise<void> {\n  while (pendingAccessLogWrites.size > 0) {\n    const snapshot = Array.from(pendingAccessLogWrites)\n    await Promise.allSettled(snapshot)\n  }\n}\n\nconst isZodRuntimeMissing = (err: unknown) => err instanceof TypeError && typeof err.message === 'string' && err.message.includes('_zod')\n\ntype RawEncryptedFields = {\n  resourceKind?: unknown\n  resourceId?: unknown\n  accessType?: unknown\n  fieldsJson?: unknown\n  contextJson?: unknown\n}\n\nfunction serializeJsonColumn(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') {\n    try {\n      JSON.parse(value)\n      return value\n    } catch {\n      return JSON.stringify(value)\n    }\n  }\n  try {\n    return JSON.stringify(value)\n  } catch {\n    return null\n  }\n}\n\nexport class AccessLogService {\n  constructor(private readonly em: EntityManager) {}\n\n  async log(input: AccessLogCreateInput): Promise<AccessLog | null> {\n    const promise = this.logInternal(input)\n    return trackPendingAccessLogWrite(promise)\n  }\n\n  async logMany(inputs: AccessLogCreateInput[]): Promise<number> {\n    if (!Array.isArray(inputs) || inputs.length === 0) return 0\n    const promise = this.logManyInternal(inputs)\n    return trackPendingAccessLogWrite(promise)\n  }\n\n  flush(): Promise<void> {\n    return flushAccessLog()\n  }\n\n  private async logManyInternal(inputs: AccessLogCreateInput[]): Promise<number> {\n    // Parsing in parallel matches the legacy fan-out `Promise.all(map(...service.log()))`\n    // path's wall-clock; the previous sequential loop made batched writes slower than\n    // un-batched on tenants with encryption enabled and pushed UI integration tests\n    // over their dialog-stability budget.\n    const parsedResults = await Promise.all(inputs.map((input) => this.parseInput(input)))\n    const normalized: AccessLogCreateInput[] = []\n    for (const parsed of parsedResults) {\n      if (parsed) normalized.push(parsed)\n    }\n    if (!normalized.length) return 0\n\n    let written = 0\n    for (let offset = 0; offset < normalized.length; offset += MAX_BATCH_ROWS) {\n      const chunk = normalized.slice(offset, offset + MAX_BATCH_ROWS)\n      written += await this.writeChunk(chunk)\n    }\n    if (written > 0) {\n      const fork = this.em.fork({ useContext: true })\n      await this.rotate(fork)\n    }\n    return written\n  }\n\n  private async writeChunk(chunk: AccessLogCreateInput[]): Promise<number> {\n    if (!chunk.length) return 0\n    const fork = this.em.fork({ useContext: true })\n    const encryption = resolveTenantEncryptionService(fork as any)\n    const createdAt = new Date()\n\n    // Encrypt every row in parallel so encryption-enabled tenants do not pay\n    // the N-rows \u00D7 per-row latency penalty that the previous sequential\n    // for-of loop introduced. The legacy `service.log()` fan-out resolved\n    // its 50 encryption calls concurrently via `Promise.all`; preserve that\n    // characteristic here so the batched single-INSERT path is strictly\n    // faster than the legacy parallel-INSERTs path.\n    type PreparedRow = {\n      tenantId: string | null\n      organizationId: string | null\n      data: AccessLogCreateInput\n      fields: unknown[] | null\n      context: Record<string, unknown> | null\n      encrypted: RawEncryptedFields | null\n    }\n    const prepared: PreparedRow[] = await Promise.all(\n      chunk.map(async (data) => {\n        const fields = Array.isArray(data.fields) && data.fields.length ? data.fields : null\n        const context = data.context && Object.keys(data.context).length ? data.context : null\n        const tenantId = data.tenantId ?? null\n        const organizationId = data.organizationId ?? null\n        const encrypted = encryption\n          ? ((await encryption.encryptEntityPayload(\n              E.audit_logs.access_log,\n              {\n                resourceKind: data.resourceKind,\n                resourceId: data.resourceId,\n                accessType: data.accessType,\n                fieldsJson: fields,\n                contextJson: context,\n              },\n              tenantId,\n              organizationId,\n            )) as RawEncryptedFields)\n          : null\n        return { tenantId, organizationId, data, fields, context, encrypted }\n      }),\n    )\n\n    const placeholders: string[] = []\n    const params: unknown[] = []\n    for (const row of prepared) {\n      const { tenantId, organizationId, data, fields, context, encrypted } = row\n      const resourceKindOut = encrypted?.resourceKind ?? data.resourceKind\n      const resourceIdOut = encrypted?.resourceId ?? data.resourceId\n      const accessTypeOut = encrypted?.accessType ?? data.accessType\n      const fieldsOut = encrypted?.fieldsJson ?? fields\n      const contextOut = encrypted?.contextJson ?? context\n      placeholders.push('(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')\n      params.push(\n        tenantId,\n        organizationId,\n        data.actorUserId ?? null,\n        resourceKindOut,\n        resourceIdOut,\n        accessTypeOut,\n        serializeJsonColumn(fieldsOut),\n        serializeJsonColumn(contextOut),\n        createdAt,\n        null,\n      )\n    }\n    if (!placeholders.length) return 0\n    const sql = `insert into \"access_logs\" (\"tenant_id\", \"organization_id\", \"actor_user_id\", \"resource_kind\", \"resource_id\", \"access_type\", \"fields_json\", \"context_json\", \"created_at\", \"deleted_at\") values ${placeholders.join(', ')}`\n    await fork.getConnection().execute(sql, params)\n    return chunk.length\n  }\n\n  private async parseInput(input: AccessLogCreateInput): Promise<AccessLogCreateInput | null> {\n    const schema = accessLogCreateSchema as typeof accessLogCreateSchema & { _zod?: unknown }\n    const canValidate = Boolean(schema && typeof schema.parse === 'function')\n    const shouldValidate = canValidate && runtimeValidationAvailable !== false\n    if (shouldValidate) {\n      try {\n        const data = schema.parse(input)\n        runtimeValidationAvailable = true\n        return data\n      } catch (err) {\n        if (!isZodRuntimeMissing(err) && !validationWarningLogged) {\n          validationWarningLogged = true\n          // eslint-disable-next-line no-console\n          console.warn('[audit_logs] falling back to permissive access log payload parser', err)\n        }\n        if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false\n        return this.normalizeInput(input)\n      }\n    }\n    return this.normalizeInput(input)\n  }\n\n  private async logInternal(input: AccessLogCreateInput): Promise<AccessLog | null> {\n    const data = await this.parseInput(input)\n    if (!data) return null\n    const fork = this.em.fork({ useContext: true })\n    const fields = Array.isArray(data.fields) && data.fields.length ? data.fields : null\n    const context = data.context && Object.keys(data.context).length ? data.context : null\n    const createdAt = new Date()\n    const tenantId = data.tenantId ?? null\n    const organizationId = data.organizationId ?? null\n\n    const encryption = resolveTenantEncryptionService(fork as any)\n    const encrypted = encryption\n      ? ((await encryption.encryptEntityPayload(\n          E.audit_logs.access_log,\n          {\n            resourceKind: data.resourceKind,\n            resourceId: data.resourceId,\n            accessType: data.accessType,\n            fieldsJson: fields,\n            contextJson: context,\n          },\n          tenantId,\n          organizationId,\n        )) as RawEncryptedFields)\n      : null\n\n    const payload = {\n      resourceKind: encrypted?.resourceKind ?? data.resourceKind,\n      resourceId: encrypted?.resourceId ?? data.resourceId,\n      accessType: encrypted?.accessType ?? data.accessType,\n      fieldsJson: encrypted?.fieldsJson ?? fields,\n      contextJson: encrypted?.contextJson ?? context,\n    }\n\n    const rows = await fork.getConnection().execute(\n      `insert into \"access_logs\" (\"tenant_id\", \"organization_id\", \"actor_user_id\", \"resource_kind\", \"resource_id\", \"access_type\", \"fields_json\", \"context_json\", \"created_at\", \"deleted_at\") values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) returning \"id\"`,\n      [\n        tenantId,\n        organizationId,\n        data.actorUserId ?? null,\n        payload.resourceKind,\n        payload.resourceId,\n        payload.accessType,\n        serializeJsonColumn(payload.fieldsJson),\n        serializeJsonColumn(payload.contextJson),\n        createdAt,\n        null,\n      ],\n    )\n    await this.rotate(fork)\n    const id = Array.isArray(rows) && rows.length > 0 ? rows[0]?.id ?? null : null\n    if (!id) return null\n    const entry = fork.create(AccessLog, {\n      id,\n      tenantId: data.tenantId ?? null,\n      organizationId: data.organizationId ?? null,\n      actorUserId: data.actorUserId ?? null,\n      resourceKind: data.resourceKind,\n      resourceId: data.resourceId,\n      accessType: data.accessType,\n      fieldsJson: fields,\n      contextJson: context,\n      createdAt,\n    })\n    return entry\n  }\n\n  private normalizeInput(input: Partial<AccessLogCreateInput> | null | undefined): AccessLogCreateInput {\n    if (!input) {\n      return {\n        tenantId: null,\n        organizationId: null,\n        actorUserId: null,\n        resourceKind: 'unknown',\n        resourceId: 'unknown',\n        accessType: 'unknown',\n        fields: undefined,\n        context: undefined,\n      }\n    }\n    const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n    const toNullableUuid = (value: unknown) => {\n      if (typeof value !== 'string' || value.length === 0) return null\n      const candidate = value.startsWith('api_key:') ? value.slice('api_key:'.length) : value\n      return UUID_REGEX.test(candidate) ? candidate : null\n    }\n    const fields = Array.isArray(input.fields)\n      ? input.fields.filter((f): f is string => typeof f === 'string' && f.length > 0)\n      : undefined\n    const context = typeof input.context === 'object' && input.context !== null\n      ? input.context as Record<string, unknown>\n      : undefined\n    return {\n      tenantId: toNullableUuid(input.tenantId),\n      organizationId: toNullableUuid(input.organizationId),\n      actorUserId: toNullableUuid(input.actorUserId),\n      resourceKind: String(input.resourceKind || 'unknown'),\n      resourceId: String(input.resourceId || 'unknown'),\n      accessType: String(input.accessType || 'unknown'),\n      fields,\n      context,\n    }\n  }\n\n  async list(query: Partial<AccessLogListQuery>) {\n    const parsed = accessLogListSchema.parse({\n      ...query,\n    })\n\n    const where: FilterQuery<AccessLog> = { deletedAt: null }\n    if (parsed.tenantId) where.tenantId = parsed.tenantId\n    if (parsed.organizationId) where.organizationId = parsed.organizationId\n    if (parsed.actorUserId) where.actorUserId = parsed.actorUserId\n    if (parsed.resourceKind) where.resourceKind = parsed.resourceKind\n    if (parsed.accessType) where.accessType = parsed.accessType\n    if (parsed.before) where.createdAt = { ...(where.createdAt as Record<string, any> | undefined), $lt: parsed.before } as any\n    if (parsed.after) where.createdAt = { ...(where.createdAt as Record<string, any> | undefined), $gt: parsed.after } as any\n\n    const pageSize = parsed.pageSize ?? parsed.limit ?? 50\n    const page = parsed.page ?? 1\n    const offset = (page - 1) * pageSize\n\n    const [items, total] = await this.em.findAndCount(\n      AccessLog,\n      where,\n      {\n        orderBy: { createdAt: 'desc' },\n        limit: pageSize,\n        offset,\n      },\n    )\n\n    // Encrypted jsonb columns (`fields_json`, `context_json`) come back as raw\n    // JSON strings from the encryption subscriber after issue #1810 follow-up\n    // (entity-field decryption no longer auto-parses). Restore the structured\n    // shape on read so API consumers see typed objects/arrays.\n    for (const item of items) {\n      const rawFieldsJson = (item as { fieldsJson?: unknown }).fieldsJson\n      if (typeof rawFieldsJson === 'string') {\n        const parsed = parseDecryptedFieldValue(rawFieldsJson)\n        item.fieldsJson = Array.isArray(parsed) ? (parsed as string[]) : null\n      }\n      const rawContextJson = (item as { contextJson?: unknown }).contextJson\n      if (typeof rawContextJson === 'string') {\n        const parsed = parseDecryptedFieldValue(rawContextJson)\n        item.contextJson = parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n          ? (parsed as Record<string, unknown>)\n          : null\n      }\n    }\n\n    const totalPages = Math.max(1, Math.ceil((total || 0) / (pageSize || 1)))\n    return { items, total, page, pageSize, totalPages }\n  }\n\n  private async rotate(fork: EntityManager) {\n    const now = Date.now()\n    if (ROTATE_INTERVAL_MS > 0 && lastRotatedAt !== null && now - lastRotatedAt < ROTATE_INTERVAL_MS) return\n    lastRotatedAt = now\n    const coreCutoff = new Date(now - CORE_RETENTION_MS)\n    const nonCoreCutoff = new Date(now - NON_CORE_RETENTION_MS)\n    try {\n      if (CORE_RESOURCE_KINDS.size > 0) {\n        await fork.nativeDelete(AccessLog, {\n          resourceKind: { $in: Array.from(CORE_RESOURCE_KINDS) },\n          createdAt: { $lt: coreCutoff },\n        })\n      }\n      await fork.nativeDelete(AccessLog, {\n        resourceKind: { $nin: Array.from(CORE_RESOURCE_KINDS) },\n        createdAt: { $lt: nonCoreCutoff },\n      })\n    } catch (err) {\n      // eslint-disable-next-line no-console\n      console.warn('[audit_logs] failed to rotate access logs', err)\n    }\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,sCAAsC;AAC/C,SAAS,gCAAgC;AACzC,SAAS,SAAS;AAElB,MAAM,sBAAsB,oBAAI,IAAY,CAAC,aAAa,WAAW,CAAC;AAEtE,SAAS,iBAAiB,OAA2B,UAA0B;AAC7E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,oBAAoB,OAA2B,UAA0B;AAChF,MAAI,UAAU,UAAa,UAAU,GAAI,QAAO;AAChD,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,EAAG,QAAO;AACnD,SAAO;AACT;AAEA,MAAM,sBAAsB,iBAAiB,QAAQ,IAAI,gCAAgC,CAAC;AAC1F,MAAM,2BAA2B,iBAAiB,QAAQ,IAAI,qCAAqC,CAAC;AACpG,MAAM,oBAAoB,sBAAsB,KAAK,KAAK,KAAK;AAC/D,MAAM,wBAAwB,2BAA2B,KAAK,KAAK;AAInE,MAAM,qBAAqB,oBAAoB,QAAQ,IAAI,+BAA+B,GAAM;AAEhG,IAAI,gBAA+B;AACnC,MAAM,aAAa;AAInB,MAAM,iBAAiB;AAEvB,IAAI,0BAA0B;AAC9B,IAAI,6BAA6C;AASjD,MAAM,yBAAyB,oBAAI,IAAsB;AAEzD,SAAS,2BAA8B,SAAiC;AACtE,yBAAuB,IAAI,OAAsC;AACjE,UACG,MAAM,MAAM,MAAS,EACrB,QAAQ,MAAM;AACb,2BAAuB,OAAO,OAAsC;AAAA,EACtE,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,iBAAgC;AACpD,SAAO,uBAAuB,OAAO,GAAG;AACtC,UAAM,WAAW,MAAM,KAAK,sBAAsB;AAClD,UAAM,QAAQ,WAAW,QAAQ;AAAA,EACnC;AACF;AAEA,MAAM,sBAAsB,CAAC,QAAiB,eAAe,aAAa,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,MAAM;AAUxI,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI;AACF,WAAK,MAAM,KAAK;AAChB,aAAO;AAAA,IACT,QAAQ;AACN,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AAAA,EACF;AACA,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,IAAI,OAAwD;AAChE,UAAM,UAAU,KAAK,YAAY,KAAK;AACtC,WAAO,2BAA2B,OAAO;AAAA,EAC3C;AAAA,EAEA,MAAM,QAAQ,QAAiD;AAC7D,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,EAAG,QAAO;AAC1D,UAAM,UAAU,KAAK,gBAAgB,MAAM;AAC3C,WAAO,2BAA2B,OAAO;AAAA,EAC3C;AAAA,EAEA,QAAuB;AACrB,WAAO,eAAe;AAAA,EACxB;AAAA,EAEA,MAAc,gBAAgB,QAAiD;AAK7E,UAAM,gBAAgB,MAAM,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,WAAW,KAAK,CAAC,CAAC;AACrF,UAAM,aAAqC,CAAC;AAC5C,eAAW,UAAU,eAAe;AAClC,UAAI,OAAQ,YAAW,KAAK,MAAM;AAAA,IACpC;AACA,QAAI,CAAC,WAAW,OAAQ,QAAO;AAE/B,QAAI,UAAU;AACd,aAAS,SAAS,GAAG,SAAS,WAAW,QAAQ,UAAU,gBAAgB;AACzE,YAAM,QAAQ,WAAW,MAAM,QAAQ,SAAS,cAAc;AAC9D,iBAAW,MAAM,KAAK,WAAW,KAAK;AAAA,IACxC;AACA,QAAI,UAAU,GAAG;AACf,YAAM,OAAO,KAAK,GAAG,KAAK,EAAE,YAAY,KAAK,CAAC;AAC9C,YAAM,KAAK,OAAO,IAAI;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,WAAW,OAAgD;AACvE,QAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,UAAM,OAAO,KAAK,GAAG,KAAK,EAAE,YAAY,KAAK,CAAC;AAC9C,UAAM,aAAa,+BAA+B,IAAW;AAC7D,UAAM,YAAY,oBAAI,KAAK;AAgB3B,UAAM,WAA0B,MAAM,QAAQ;AAAA,MAC5C,MAAM,IAAI,OAAO,SAAS;AACxB,cAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,KAAK,KAAK,OAAO,SAAS,KAAK,SAAS;AAChF,cAAM,UAAU,KAAK,WAAW,OAAO,KAAK,KAAK,OAAO,EAAE,SAAS,KAAK,UAAU;AAClF,cAAM,WAAW,KAAK,YAAY;AAClC,cAAM,iBAAiB,KAAK,kBAAkB;AAC9C,cAAM,YAAY,aACZ,MAAM,WAAW;AAAA,UACjB,EAAE,WAAW;AAAA,UACb;AAAA,YACE,cAAc,KAAK;AAAA,YACnB,YAAY,KAAK;AAAA,YACjB,YAAY,KAAK;AAAA,YACjB,YAAY;AAAA,YACZ,aAAa;AAAA,UACf;AAAA,UACA;AAAA,UACA;AAAA,QACF,IACA;AACJ,eAAO,EAAE,UAAU,gBAAgB,MAAM,QAAQ,SAAS,UAAU;AAAA,MACtE,CAAC;AAAA,IACH;AAEA,UAAM,eAAyB,CAAC;AAChC,UAAM,SAAoB,CAAC;AAC3B,eAAW,OAAO,UAAU;AAC1B,YAAM,EAAE,UAAU,gBAAgB,MAAM,QAAQ,SAAS,UAAU,IAAI;AACvE,YAAM,kBAAkB,WAAW,gBAAgB,KAAK;AACxD,YAAM,gBAAgB,WAAW,cAAc,KAAK;AACpD,YAAM,gBAAgB,WAAW,cAAc,KAAK;AACpD,YAAM,YAAY,WAAW,cAAc;AAC3C,YAAM,aAAa,WAAW,eAAe;AAC7C,mBAAa,KAAK,gCAAgC;AAClD,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,KAAK,eAAe;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB,SAAS;AAAA,QAC7B,oBAAoB,UAAU;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,aAAa,OAAQ,QAAO;AACjC,UAAM,MAAM,gMAAgM,aAAa,KAAK,IAAI,CAAC;AACnO,UAAM,KAAK,cAAc,EAAE,QAAQ,KAAK,MAAM;AAC9C,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,MAAc,WAAW,OAAmE;AAC1F,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,UAAU,OAAO,OAAO,UAAU,UAAU;AACxE,UAAM,iBAAiB,eAAe,+BAA+B;AACrE,QAAI,gBAAgB;AAClB,UAAI;AACF,cAAM,OAAO,OAAO,MAAM,KAAK;AAC/B,qCAA6B;AAC7B,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,YAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,yBAAyB;AACzD,oCAA0B;AAE1B,kBAAQ,KAAK,qEAAqE,GAAG;AAAA,QACvF;AACA,YAAI,oBAAoB,GAAG,EAAG,8BAA6B;AAC3D,eAAO,KAAK,eAAe,KAAK;AAAA,MAClC;AAAA,IACF;AACA,WAAO,KAAK,eAAe,KAAK;AAAA,EAClC;AAAA,EAEA,MAAc,YAAY,OAAwD;AAChF,UAAM,OAAO,MAAM,KAAK,WAAW,KAAK;AACxC,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,OAAO,KAAK,GAAG,KAAK,EAAE,YAAY,KAAK,CAAC;AAC9C,UAAM,SAAS,MAAM,QAAQ,KAAK,MAAM,KAAK,KAAK,OAAO,SAAS,KAAK,SAAS;AAChF,UAAM,UAAU,KAAK,WAAW,OAAO,KAAK,KAAK,OAAO,EAAE,SAAS,KAAK,UAAU;AAClF,UAAM,YAAY,oBAAI,KAAK;AAC3B,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,iBAAiB,KAAK,kBAAkB;AAE9C,UAAM,aAAa,+BAA+B,IAAW;AAC7D,UAAM,YAAY,aACZ,MAAM,WAAW;AAAA,MACjB,EAAE,WAAW;AAAA,MACb;AAAA,QACE,cAAc,KAAK;AAAA,QACnB,YAAY,KAAK;AAAA,QACjB,YAAY,KAAK;AAAA,QACjB,YAAY;AAAA,QACZ,aAAa;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAEJ,UAAM,UAAU;AAAA,MACd,cAAc,WAAW,gBAAgB,KAAK;AAAA,MAC9C,YAAY,WAAW,cAAc,KAAK;AAAA,MAC1C,YAAY,WAAW,cAAc,KAAK;AAAA,MAC1C,YAAY,WAAW,cAAc;AAAA,MACrC,aAAa,WAAW,eAAe;AAAA,IACzC;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc,EAAE;AAAA,MACtC;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,KAAK,eAAe;AAAA,QACpB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,oBAAoB,QAAQ,UAAU;AAAA,QACtC,oBAAoB,QAAQ,WAAW;AAAA,QACvC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,OAAO,IAAI;AACtB,UAAM,KAAK,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,MAAM,OAAO;AAC1E,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,QAAQ,KAAK,OAAO,WAAW;AAAA,MACnC;AAAA,MACA,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,aAAa,KAAK,eAAe;AAAA,MACjC,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEQ,eAAe,OAA+E;AACpG,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAMA,cAAa;AACnB,UAAM,iBAAiB,CAAC,UAAmB;AACzC,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,YAAM,YAAY,MAAM,WAAW,UAAU,IAAI,MAAM,MAAM,WAAW,MAAM,IAAI;AAClF,aAAOA,YAAW,KAAK,SAAS,IAAI,YAAY;AAAA,IAClD;AACA,UAAM,SAAS,MAAM,QAAQ,MAAM,MAAM,IACrC,MAAM,OAAO,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,IAC7E;AACJ,UAAM,UAAU,OAAO,MAAM,YAAY,YAAY,MAAM,YAAY,OACnE,MAAM,UACN;AACJ,WAAO;AAAA,MACL,UAAU,eAAe,MAAM,QAAQ;AAAA,MACvC,gBAAgB,eAAe,MAAM,cAAc;AAAA,MACnD,aAAa,eAAe,MAAM,WAAW;AAAA,MAC7C,cAAc,OAAO,MAAM,gBAAgB,SAAS;AAAA,MACpD,YAAY,OAAO,MAAM,cAAc,SAAS;AAAA,MAChD,YAAY,OAAO,MAAM,cAAc,SAAS;AAAA,MAChD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,OAAoC;AAC7C,UAAM,SAAS,oBAAoB,MAAM;AAAA,MACvC,GAAG;AAAA,IACL,CAAC;AAED,UAAM,QAAgC,EAAE,WAAW,KAAK;AACxD,QAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,QAAI,OAAO,eAAgB,OAAM,iBAAiB,OAAO;AACzD,QAAI,OAAO,YAAa,OAAM,cAAc,OAAO;AACnD,QAAI,OAAO,aAAc,OAAM,eAAe,OAAO;AACrD,QAAI,OAAO,WAAY,OAAM,aAAa,OAAO;AACjD,QAAI,OAAO,OAAQ,OAAM,YAAY,EAAE,GAAI,MAAM,WAA+C,KAAK,OAAO,OAAO;AACnH,QAAI,OAAO,MAAO,OAAM,YAAY,EAAE,GAAI,MAAM,WAA+C,KAAK,OAAO,MAAM;AAEjH,UAAM,WAAW,OAAO,YAAY,OAAO,SAAS;AACpD,UAAM,OAAO,OAAO,QAAQ;AAC5B,UAAM,UAAU,OAAO,KAAK;AAE5B,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,KAAK,GAAG;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,QAC7B,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAMA,eAAW,QAAQ,OAAO;AACxB,YAAM,gBAAiB,KAAkC;AACzD,UAAI,OAAO,kBAAkB,UAAU;AACrC,cAAMC,UAAS,yBAAyB,aAAa;AACrD,aAAK,aAAa,MAAM,QAAQA,OAAM,IAAKA,UAAsB;AAAA,MACnE;AACA,YAAM,iBAAkB,KAAmC;AAC3D,UAAI,OAAO,mBAAmB,UAAU;AACtC,cAAMA,UAAS,yBAAyB,cAAc;AACtD,aAAK,cAAcA,WAAU,OAAOA,YAAW,YAAY,CAAC,MAAM,QAAQA,OAAM,IAC3EA,UACD;AAAA,MACN;AAAA,IACF;AAEA,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,YAAY,EAAE,CAAC;AACxE,WAAO,EAAE,OAAO,OAAO,MAAM,UAAU,WAAW;AAAA,EACpD;AAAA,EAEA,MAAc,OAAO,MAAqB;AACxC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,qBAAqB,KAAK,kBAAkB,QAAQ,MAAM,gBAAgB,mBAAoB;AAClG,oBAAgB;AAChB,UAAM,aAAa,IAAI,KAAK,MAAM,iBAAiB;AACnD,UAAM,gBAAgB,IAAI,KAAK,MAAM,qBAAqB;AAC1D,QAAI;AACF,UAAI,oBAAoB,OAAO,GAAG;AAChC,cAAM,KAAK,aAAa,WAAW;AAAA,UACjC,cAAc,EAAE,KAAK,MAAM,KAAK,mBAAmB,EAAE;AAAA,UACrD,WAAW,EAAE,KAAK,WAAW;AAAA,QAC/B,CAAC;AAAA,MACH;AACA,YAAM,KAAK,aAAa,WAAW;AAAA,QACjC,cAAc,EAAE,MAAM,MAAM,KAAK,mBAAmB,EAAE;AAAA,QACtD,WAAW,EAAE,KAAK,cAAc;AAAA,MAClC,CAAC;AAAA,IACH,SAAS,KAAK;AAEZ,cAAQ,KAAK,6CAA6C,GAAG;AAAA,IAC/D;AAAA,EACF;AACF;",
   "names": ["UUID_REGEX", "parsed"]
 }