@open-mercato/core 0.6.6-develop.5459.1.170077434e → 0.6.6-develop.5491.1.469e89d368

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 3322 entry points
+[build:core] found 3323 entry points
 [build:core] built successfully
 [build:core:generated] found 185 entry points
 [build:core:generated] built successfully

package/dist/modules/auth/api/login.js

@@ -92,21 +92,12 @@ async function POST(req) {
     user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId);
   } else {
     const users = await auth.findUsersByEmail(parsed.data.email);
-    if (users.length > 1) {
-      return NextResponse.json({
-        ok: false,
-        error: translate("auth.login.errors.tenantRequired", "Use the login link provided with your tenant activation to continue.")
-      }, { status: 400 });
-    }
-    user = users[0] ?? null;
-  }
-  if (!user || !user.passwordHash) {
-    void emitAuthEvent("auth.login.failed", { email: parsed.data.email, reason: "invalid_credentials" }).catch(() => void 0);
-    return NextResponse.json({ ok: false, error: translate("auth.login.errors.invalidCredentials", "Invalid email or password") }, { status: 401 });
+    user = users.length === 1 ? users[0] : null;
   }
   const ok = await auth.verifyPassword(user, parsed.data.password);
-  if (!ok) {
-    void emitAuthEvent("auth.login.failed", { email: parsed.data.email, reason: "invalid_password" }).catch(() => void 0);
+  if (!user || !ok) {
+    const reason = user?.passwordHash ? "invalid_password" : "invalid_credentials";
+    void emitAuthEvent("auth.login.failed", { email: parsed.data.email, reason }).catch(() => void 0);
     return NextResponse.json({ ok: false, error: translate("auth.login.errors.invalidCredentials", "Invalid email or password") }, { status: 401 });
   }
   if (requiredRoles.length) {

package/dist/modules/auth/api/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/login.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { userLoginSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { EventBus } from '@open-mercato/events/types'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { getAppBaseUrl } from '@open-mercato/shared/lib/url'\n\nconst loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',\n})\nconst loginIpRateLimitConfig = readEndpointRateLimitConfig('LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'login-ip',\n})\n\nexport const metadata = { requireAuth: false }\n\n// validation comes from userLoginSchema\n\ntype ParsedLoginForm = {\n  email: string\n  password: string\n  remember: boolean\n  tenantIdRaw: string\n  requiredRoles: string[]\n  redirectTo: string\n}\n\nfunction parseRequiredRoles(rawValue: string): string[] {\n  return rawValue\n    .split(',')\n    .map((value) => value.trim())\n    .filter(Boolean)\n}\n\nasync function parseLoginForm(req: Request): Promise<ParsedLoginForm> {\n  const rawContentType = req.headers.get('content-type') ?? ''\n  const contentType = rawContentType.split(';')[0].trim().toLowerCase()\n\n  try {\n    if (contentType === 'application/x-www-form-urlencoded') {\n      const body = await req.text()\n      const params = new URLSearchParams(body)\n      const requireRoleRaw = String(params.get('requireRole') ?? params.get('role') ?? '').trim()\n      return {\n        email: String(params.get('email') ?? ''),\n        password: String(params.get('password') ?? ''),\n        remember: parseBooleanToken(params.get('remember')) === true,\n        tenantIdRaw: String(params.get('tenantId') ?? params.get('tenant') ?? '').trim(),\n        requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n        redirectTo: String(params.get('redirect') ?? ''),\n      }\n    }\n\n    const form = await req.formData()\n    const requireRoleRaw = String(form.get('requireRole') ?? form.get('role') ?? '').trim()\n    return {\n      email: String(form.get('email') ?? ''),\n      password: String(form.get('password') ?? ''),\n      remember: parseBooleanToken(form.get('remember')?.toString()) === true,\n      tenantIdRaw: String(form.get('tenantId') ?? form.get('tenant') ?? '').trim(),\n      requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n      redirectTo: String(form.get('redirect') ?? ''),\n    }\n  } catch {\n    return {\n      email: '',\n      password: '',\n      remember: false,\n      tenantIdRaw: '',\n      requiredRoles: [],\n      redirectTo: '',\n    }\n  }\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  const { email, password, remember, tenantIdRaw, requiredRoles, redirectTo } = await parseLoginForm(req)\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError, compoundKey: rateLimitCompoundKey } = await checkAuthRateLimit({\n    req, ipConfig: loginIpRateLimitConfig, compoundConfig: loginRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = userLoginSchema.pick({ email: true, password: true, tenantId: true }).safeParse({\n    email,\n    password,\n    tenantId: tenantIdRaw || undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid credentials') }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const auth = (container.resolve('authService') as AuthService)\n  const tenantId = parsed.data.tenantId ?? null\n  let user = null\n  if (tenantId) {\n    user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(parsed.data.email)\n    if (users.length > 1) {\n      return NextResponse.json({\n        ok: false,\n        error: translate('auth.login.errors.tenantRequired', 'Use the login link provided with your tenant activation to continue.'),\n      }, { status: 400 })\n    }\n    user = users[0] ?? null\n  }\n  if (!user || !user.passwordHash) {\n    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason: 'invalid_credentials' }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })\n  }\n  const ok = await auth.verifyPassword(user, parsed.data.password)\n  if (!ok) {\n    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason: 'invalid_password' }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })\n  }\n  // Optional role requirement\n  if (requiredRoles.length) {\n    const userRoleNames = await auth.getUserRoles(user, tenantId ?? (user.tenantId ? String(user.tenantId) : null))\n    const authorized = requiredRoles.some(r => userRoleNames.includes(r))\n    if (!authorized) {\n      return NextResponse.json({ ok: false, error: translate('auth.login.errors.permissionDenied', 'Not authorized for this area') }, { status: 403 })\n    }\n  }\n  await auth.updateLastLoginAt(user)\n  // Reset rate limit counter on successful login so legitimate users aren't penalized for prior typos\n  if (rateLimitCompoundKey) {\n    await resetAuthRateLimit(rateLimitCompoundKey, loginRateLimitConfig)\n  }\n  const resolvedTenantId = tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const userRoleNames = await auth.getUserRoles(user, resolvedTenantId)\n  try {\n    const eventBus = (container.resolve('eventBus') as EventBus)\n    void eventBus.emitEvent('query_index.coverage.warmup', {\n      tenantId: resolvedTenantId,\n    }).catch(() => undefined)\n  } catch {\n    // optional warmup\n  }\n  const rememberMeDays = Number(process.env.REMEMBER_ME_DAYS || '30')\n  const accessTokenMaxAgeSeconds = 60 * 60 * 8\n  const sessionExpiresAt = remember\n    ? new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    : new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session: loginSession, token: sessionRefreshToken } = await auth.createSession(user, sessionExpiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(loginSession.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles: userRoleNames\n  })\n  void emitAuthEvent('auth.login.success', { id: String(user.id), email: user.email, tenantId: resolvedTenantId, organizationId: user.organizationId ? String(user.organizationId) : null }).catch(() => undefined)\n  const responseData: { ok: true; token: string; redirect: string; refreshToken?: string } = {\n    ok: true,\n    token,\n    redirect: sanitizeRedirectPath(redirectTo, getAppBaseUrl(req), '/backend'),\n  }\n  if (remember) {\n    responseData.refreshToken = sessionRefreshToken\n  }\n  const em = container.resolve('em')\n  const interceptedResponse = await runCustomRouteAfterInterceptors({\n    routePath: 'auth/login',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      body: {\n        email: parsed.data.email,\n        tenantId: parsed.data.tenantId ?? undefined,\n        remember,\n        requireRole: requiredRoles.length > 0 ? requiredRoles : undefined,\n      },\n      headers: Object.fromEntries(req.headers.entries()),\n    },\n    response: {\n      statusCode: 200,\n      body: responseData,\n      headers: {},\n    },\n    context: {\n      em,\n      container,\n    },\n  })\n  if (!interceptedResponse.ok) {\n    return NextResponse.json(interceptedResponse.body, { status: interceptedResponse.statusCode })\n  }\n\n  const interceptedBody = interceptedResponse.body\n  const authTokenForCookie = typeof interceptedBody.token === 'string' && interceptedBody.token.length > 0\n    ? interceptedBody.token\n    : token\n  const refreshTokenForCookie = typeof interceptedBody.refreshToken === 'string'\n    ? interceptedBody.refreshToken\n    : undefined\n\n  const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })\n  res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  if (remember && refreshTokenForCookie) {\n    const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })\n  } else if (!remember && authTokenForCookie === token) {\n    res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  }\n  return res\n}\n\nconst loginRequestSchema = userLoginSchema.extend({\n  password: z.string().min(6).describe('User password'),\n  remember: z.enum(['on', '1', 'true']).optional().describe('Persist the session (submit `on`, `1`, or `true`).'),\n}).describe('Login form payload')\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  token: z.string().describe('JWT token issued for subsequent API calls'),\n  redirect: z.string().nullable().describe('Next location the client should navigate to'),\n  refreshToken: z.string().optional().describe('Long-lived refresh token for obtaining new access tokens (only present when remember=true)'),\n})\n\nconst loginErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst loginMethodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Validates the submitted credentials and issues a bearer token cookie for subsequent API calls.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/x-www-form-urlencoded',\n    schema: loginRequestSchema,\n    description: 'Form-encoded payload captured from the login form.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Authentication succeeded',\n      schema: loginSuccessSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: loginErrorSchema },\n    { status: 401, description: 'Invalid credentials', schema: loginErrorSchema },\n    { status: 403, description: 'User lacks required role', schema: loginErrorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Accepts login form submissions and manages cookie/session issuance.',\n  methods: {\n    POST: loginMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AAEvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uCAAuC;AAChD,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAE9B,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,WAAW,EAAE,aAAa,MAAM;AAa7C,SAAS,mBAAmB,UAA4B;AACtD,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,eAAe,eAAe,KAAwC;AACpE,QAAM,iBAAiB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC1D,QAAM,cAAc,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY;AAEpE,MAAI;AACF,QAAI,gBAAgB,qCAAqC;AACvD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,IAAI,gBAAgB,IAAI;AACvC,YAAMA,kBAAiB,OAAO,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AAC1F,aAAO;AAAA,QACL,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK,EAAE;AAAA,QACvC,UAAU,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,QAC7C,UAAU,kBAAkB,OAAO,IAAI,UAAU,CAAC,MAAM;AAAA,QACxD,aAAa,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,QAC/E,eAAeA,kBAAiB,mBAAmBA,eAAc,IAAI,CAAC;AAAA,QACtE,YAAY,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,iBAAiB,OAAO,KAAK,IAAI,aAAa,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACtF,WAAO;AAAA,MACL,OAAO,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAAA,MACrC,UAAU,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,MAC3C,UAAU,kBAAkB,KAAK,IAAI,UAAU,GAAG,SAAS,CAAC,MAAM;AAAA,MAClE,aAAa,OAAO,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,MAC3E,eAAe,iBAAiB,mBAAmB,cAAc,IAAI,CAAC;AAAA,MACtE,YAAY,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,YAAY;AAAA,IACd;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,EAAE,OAAO,UAAU,UAAU,aAAa,eAAe,WAAW,IAAI,MAAM,eAAe,GAAG;AAEtG,QAAM,EAAE,OAAO,gBAAgB,aAAa,qBAAqB,IAAI,MAAM,mBAAmB;AAAA,IAC5F;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,gBAAgB,KAAK,EAAE,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC,EAAE,UAAU;AAAA,IAC7F;AAAA,IACA;AAAA,IACA,UAAU,eAAe;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,qBAAqB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1I;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,MAAI,OAAO;AACX,MAAI,UAAU;AACZ,WAAO,MAAM,KAAK,yBAAyB,OAAO,KAAK,OAAO,QAAQ;AAAA,EACxE,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,OAAO,KAAK,KAAK;AAC3D,QAAI,MAAM,SAAS,GAAG;AACpB,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,OAAO,UAAU,oCAAoC,sEAAsE;AAAA,MAC7H,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AACA,WAAO,MAAM,CAAC,KAAK;AAAA,EACrB;AACA,MAAI,CAAC,QAAQ,CAAC,KAAK,cAAc;AAC/B,SAAK,cAAc,qBAAqB,EAAE,OAAO,OAAO,KAAK,OAAO,QAAQ,sBAAsB,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1H,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChJ;AACA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,OAAO,KAAK,QAAQ;AAC/D,MAAI,CAAC,IAAI;AACP,SAAK,cAAc,qBAAqB,EAAE,OAAO,OAAO,KAAK,OAAO,QAAQ,mBAAmB,CAAC,EAAE,MAAM,MAAM,MAAS;AACvH,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChJ;AAEA,MAAI,cAAc,QAAQ;AACxB,UAAMC,iBAAgB,MAAM,KAAK,aAAa,MAAM,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK;AAC9G,UAAM,aAAa,cAAc,KAAK,OAAKA,eAAc,SAAS,CAAC,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AAAA,EACF;AACA,QAAM,KAAK,kBAAkB,IAAI;AAEjC,MAAI,sBAAsB;AACxB,UAAM,mBAAmB,sBAAsB,oBAAoB;AAAA,EACrE;AACA,QAAM,mBAAmB,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9E,QAAM,gBAAgB,MAAM,KAAK,aAAa,MAAM,gBAAgB;AACpE,MAAI;AACF,UAAM,WAAY,UAAU,QAAQ,UAAU;AAC9C,SAAK,SAAS,UAAU,+BAA+B;AAAA,MACrD,UAAU;AAAA,IACZ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,OAAO,QAAQ,IAAI,oBAAoB,IAAI;AAClE,QAAM,2BAA2B,KAAK,KAAK;AAC3C,QAAM,mBAAmB,WACrB,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI,IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACzD,QAAM,EAAE,SAAS,cAAc,OAAO,oBAAoB,IAAI,MAAM,KAAK,cAAc,MAAM,gBAAgB;AAC7G,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,aAAa,EAAE;AAAA,IAC3B,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ,OAAO;AAAA,EACT,CAAC;AACD,OAAK,cAAc,sBAAsB,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,UAAU,kBAAkB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAChN,QAAM,eAAqF;AAAA,IACzF,IAAI;AAAA,IACJ;AAAA,IACA,UAAU,qBAAqB,YAAY,cAAc,GAAG,GAAG,UAAU;AAAA,EAC3E;AACA,MAAI,UAAU;AACZ,iBAAa,eAAe;AAAA,EAC9B;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,MAAM,gCAAgC;AAAA,IAChE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,OAAO,OAAO,KAAK;AAAA,QACnB,UAAU,OAAO,KAAK,YAAY;AAAA,QAClC;AAAA,QACA,aAAa,cAAc,SAAS,IAAI,gBAAgB;AAAA,MAC1D;AAAA,MACA,SAAS,OAAO,YAAY,IAAI,QAAQ,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,CAAC;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,oBAAoB,IAAI;AAC3B,WAAO,aAAa,KAAK,oBAAoB,MAAM,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AAAA,EAC/F;AAEA,QAAM,kBAAkB,oBAAoB;AAC5C,QAAM,qBAAqB,OAAO,gBAAgB,UAAU,YAAY,gBAAgB,MAAM,SAAS,IACnG,gBAAgB,QAChB;AACJ,QAAM,wBAAwB,OAAO,gBAAgB,iBAAiB,WAClE,gBAAgB,eAChB;AAEJ,QAAM,MAAM,aAAa,KAAK,iBAAiB,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AACzF,MAAI,QAAQ,IAAI,cAAc,oBAAoB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AACjL,MAAI,YAAY,uBAAuB;AACrC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AAC5E,QAAI,QAAQ,IAAI,iBAAiB,uBAAuB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,SAAS,UAAU,CAAC;AAAA,EAC3K,WAAW,CAAC,YAAY,uBAAuB,OAAO;AACpD,QAAI,QAAQ,IAAI,iBAAiB,qBAAqB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AAAA,EACvL;AACA,SAAO;AACT;AAEA,MAAM,qBAAqB,gBAAgB,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,eAAe;AAAA,EACpD,UAAU,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAChH,CAAC,EAAE,SAAS,oBAAoB;AAEhC,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,2CAA2C;AAAA,EACtE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6CAA6C;AAAA,EACtF,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4FAA4F;AAC3I,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,iBAAiB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { userLoginSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { EventBus } from '@open-mercato/events/types'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { getAppBaseUrl } from '@open-mercato/shared/lib/url'\n\nconst loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',\n})\nconst loginIpRateLimitConfig = readEndpointRateLimitConfig('LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'login-ip',\n})\n\nexport const metadata = { requireAuth: false }\n\n// validation comes from userLoginSchema\n\ntype ParsedLoginForm = {\n  email: string\n  password: string\n  remember: boolean\n  tenantIdRaw: string\n  requiredRoles: string[]\n  redirectTo: string\n}\n\nfunction parseRequiredRoles(rawValue: string): string[] {\n  return rawValue\n    .split(',')\n    .map((value) => value.trim())\n    .filter(Boolean)\n}\n\nasync function parseLoginForm(req: Request): Promise<ParsedLoginForm> {\n  const rawContentType = req.headers.get('content-type') ?? ''\n  const contentType = rawContentType.split(';')[0].trim().toLowerCase()\n\n  try {\n    if (contentType === 'application/x-www-form-urlencoded') {\n      const body = await req.text()\n      const params = new URLSearchParams(body)\n      const requireRoleRaw = String(params.get('requireRole') ?? params.get('role') ?? '').trim()\n      return {\n        email: String(params.get('email') ?? ''),\n        password: String(params.get('password') ?? ''),\n        remember: parseBooleanToken(params.get('remember')) === true,\n        tenantIdRaw: String(params.get('tenantId') ?? params.get('tenant') ?? '').trim(),\n        requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n        redirectTo: String(params.get('redirect') ?? ''),\n      }\n    }\n\n    const form = await req.formData()\n    const requireRoleRaw = String(form.get('requireRole') ?? form.get('role') ?? '').trim()\n    return {\n      email: String(form.get('email') ?? ''),\n      password: String(form.get('password') ?? ''),\n      remember: parseBooleanToken(form.get('remember')?.toString()) === true,\n      tenantIdRaw: String(form.get('tenantId') ?? form.get('tenant') ?? '').trim(),\n      requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n      redirectTo: String(form.get('redirect') ?? ''),\n    }\n  } catch {\n    return {\n      email: '',\n      password: '',\n      remember: false,\n      tenantIdRaw: '',\n      requiredRoles: [],\n      redirectTo: '',\n    }\n  }\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  const { email, password, remember, tenantIdRaw, requiredRoles, redirectTo } = await parseLoginForm(req)\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError, compoundKey: rateLimitCompoundKey } = await checkAuthRateLimit({\n    req, ipConfig: loginIpRateLimitConfig, compoundConfig: loginRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = userLoginSchema.pick({ email: true, password: true, tenantId: true }).safeParse({\n    email,\n    password,\n    tenantId: tenantIdRaw || undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid credentials') }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const auth = (container.resolve('authService') as AuthService)\n  const tenantId = parsed.data.tenantId ?? null\n  let user = null\n  if (tenantId) {\n    user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(parsed.data.email)\n    // Never disclose that an email is registered across multiple tenants \u2014 a\n    // password-independent 400-vs-401 response is an account/topology oracle\n    // (issue #2242). Treat an ambiguous match as no resolvable user and fall\n    // through to the uniform invalid-credentials path; tenant-selection\n    // guidance is delivered out-of-band via the activation/login link.\n    user = users.length === 1 ? users[0] : null\n  }\n  // Always verify the password \u2014 verifyPassword runs a constant-time bcrypt\n  // comparison even when the user is missing or has no hash \u2014 so unknown-email,\n  // wrong-password, and multi-tenant cases return an identical 401 with\n  // identical latency.\n  const ok = await auth.verifyPassword(user, parsed.data.password)\n  if (!user || !ok) {\n    const reason = user?.passwordHash ? 'invalid_password' : 'invalid_credentials'\n    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })\n  }\n  // Optional role requirement\n  if (requiredRoles.length) {\n    const userRoleNames = await auth.getUserRoles(user, tenantId ?? (user.tenantId ? String(user.tenantId) : null))\n    const authorized = requiredRoles.some(r => userRoleNames.includes(r))\n    if (!authorized) {\n      return NextResponse.json({ ok: false, error: translate('auth.login.errors.permissionDenied', 'Not authorized for this area') }, { status: 403 })\n    }\n  }\n  await auth.updateLastLoginAt(user)\n  // Reset rate limit counter on successful login so legitimate users aren't penalized for prior typos\n  if (rateLimitCompoundKey) {\n    await resetAuthRateLimit(rateLimitCompoundKey, loginRateLimitConfig)\n  }\n  const resolvedTenantId = tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const userRoleNames = await auth.getUserRoles(user, resolvedTenantId)\n  try {\n    const eventBus = (container.resolve('eventBus') as EventBus)\n    void eventBus.emitEvent('query_index.coverage.warmup', {\n      tenantId: resolvedTenantId,\n    }).catch(() => undefined)\n  } catch {\n    // optional warmup\n  }\n  const rememberMeDays = Number(process.env.REMEMBER_ME_DAYS || '30')\n  const accessTokenMaxAgeSeconds = 60 * 60 * 8\n  const sessionExpiresAt = remember\n    ? new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    : new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session: loginSession, token: sessionRefreshToken } = await auth.createSession(user, sessionExpiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(loginSession.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles: userRoleNames\n  })\n  void emitAuthEvent('auth.login.success', { id: String(user.id), email: user.email, tenantId: resolvedTenantId, organizationId: user.organizationId ? String(user.organizationId) : null }).catch(() => undefined)\n  const responseData: { ok: true; token: string; redirect: string; refreshToken?: string } = {\n    ok: true,\n    token,\n    redirect: sanitizeRedirectPath(redirectTo, getAppBaseUrl(req), '/backend'),\n  }\n  if (remember) {\n    responseData.refreshToken = sessionRefreshToken\n  }\n  const em = container.resolve('em')\n  const interceptedResponse = await runCustomRouteAfterInterceptors({\n    routePath: 'auth/login',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      body: {\n        email: parsed.data.email,\n        tenantId: parsed.data.tenantId ?? undefined,\n        remember,\n        requireRole: requiredRoles.length > 0 ? requiredRoles : undefined,\n      },\n      headers: Object.fromEntries(req.headers.entries()),\n    },\n    response: {\n      statusCode: 200,\n      body: responseData,\n      headers: {},\n    },\n    context: {\n      em,\n      container,\n    },\n  })\n  if (!interceptedResponse.ok) {\n    return NextResponse.json(interceptedResponse.body, { status: interceptedResponse.statusCode })\n  }\n\n  const interceptedBody = interceptedResponse.body\n  const authTokenForCookie = typeof interceptedBody.token === 'string' && interceptedBody.token.length > 0\n    ? interceptedBody.token\n    : token\n  const refreshTokenForCookie = typeof interceptedBody.refreshToken === 'string'\n    ? interceptedBody.refreshToken\n    : undefined\n\n  const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })\n  res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  if (remember && refreshTokenForCookie) {\n    const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })\n  } else if (!remember && authTokenForCookie === token) {\n    res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  }\n  return res\n}\n\nconst loginRequestSchema = userLoginSchema.extend({\n  password: z.string().min(6).describe('User password'),\n  remember: z.enum(['on', '1', 'true']).optional().describe('Persist the session (submit `on`, `1`, or `true`).'),\n}).describe('Login form payload')\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  token: z.string().describe('JWT token issued for subsequent API calls'),\n  redirect: z.string().nullable().describe('Next location the client should navigate to'),\n  refreshToken: z.string().optional().describe('Long-lived refresh token for obtaining new access tokens (only present when remember=true)'),\n})\n\nconst loginErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst loginMethodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Validates the submitted credentials and issues a bearer token cookie for subsequent API calls.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/x-www-form-urlencoded',\n    schema: loginRequestSchema,\n    description: 'Form-encoded payload captured from the login form.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Authentication succeeded',\n      schema: loginSuccessSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: loginErrorSchema },\n    { status: 401, description: 'Invalid credentials', schema: loginErrorSchema },\n    { status: 403, description: 'User lacks required role', schema: loginErrorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Accepts login form submissions and manages cookie/session issuance.',\n  methods: {\n    POST: loginMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AAEvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uCAAuC;AAChD,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAE9B,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,WAAW,EAAE,aAAa,MAAM;AAa7C,SAAS,mBAAmB,UAA4B;AACtD,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,eAAe,eAAe,KAAwC;AACpE,QAAM,iBAAiB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC1D,QAAM,cAAc,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY;AAEpE,MAAI;AACF,QAAI,gBAAgB,qCAAqC;AACvD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,IAAI,gBAAgB,IAAI;AACvC,YAAMA,kBAAiB,OAAO,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AAC1F,aAAO;AAAA,QACL,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK,EAAE;AAAA,QACvC,UAAU,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,QAC7C,UAAU,kBAAkB,OAAO,IAAI,UAAU,CAAC,MAAM;AAAA,QACxD,aAAa,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,QAC/E,eAAeA,kBAAiB,mBAAmBA,eAAc,IAAI,CAAC;AAAA,QACtE,YAAY,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,iBAAiB,OAAO,KAAK,IAAI,aAAa,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACtF,WAAO;AAAA,MACL,OAAO,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAAA,MACrC,UAAU,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,MAC3C,UAAU,kBAAkB,KAAK,IAAI,UAAU,GAAG,SAAS,CAAC,MAAM;AAAA,MAClE,aAAa,OAAO,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,MAC3E,eAAe,iBAAiB,mBAAmB,cAAc,IAAI,CAAC;AAAA,MACtE,YAAY,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,YAAY;AAAA,IACd;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,EAAE,OAAO,UAAU,UAAU,aAAa,eAAe,WAAW,IAAI,MAAM,eAAe,GAAG;AAEtG,QAAM,EAAE,OAAO,gBAAgB,aAAa,qBAAqB,IAAI,MAAM,mBAAmB;AAAA,IAC5F;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,gBAAgB,KAAK,EAAE,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC,EAAE,UAAU;AAAA,IAC7F;AAAA,IACA;AAAA,IACA,UAAU,eAAe;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,qBAAqB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1I;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,MAAI,OAAO;AACX,MAAI,UAAU;AACZ,WAAO,MAAM,KAAK,yBAAyB,OAAO,KAAK,OAAO,QAAQ;AAAA,EACxE,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,OAAO,KAAK,KAAK;AAM3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAKA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,OAAO,KAAK,QAAQ;AAC/D,MAAI,CAAC,QAAQ,CAAC,IAAI;AAChB,UAAM,SAAS,MAAM,eAAe,qBAAqB;AACzD,SAAK,cAAc,qBAAqB,EAAE,OAAO,OAAO,KAAK,OAAO,OAAO,CAAC,EAAE,MAAM,MAAM,MAAS;AACnG,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChJ;AAEA,MAAI,cAAc,QAAQ;AACxB,UAAMC,iBAAgB,MAAM,KAAK,aAAa,MAAM,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK;AAC9G,UAAM,aAAa,cAAc,KAAK,OAAKA,eAAc,SAAS,CAAC,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AAAA,EACF;AACA,QAAM,KAAK,kBAAkB,IAAI;AAEjC,MAAI,sBAAsB;AACxB,UAAM,mBAAmB,sBAAsB,oBAAoB;AAAA,EACrE;AACA,QAAM,mBAAmB,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9E,QAAM,gBAAgB,MAAM,KAAK,aAAa,MAAM,gBAAgB;AACpE,MAAI;AACF,UAAM,WAAY,UAAU,QAAQ,UAAU;AAC9C,SAAK,SAAS,UAAU,+BAA+B;AAAA,MACrD,UAAU;AAAA,IACZ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,OAAO,QAAQ,IAAI,oBAAoB,IAAI;AAClE,QAAM,2BAA2B,KAAK,KAAK;AAC3C,QAAM,mBAAmB,WACrB,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI,IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACzD,QAAM,EAAE,SAAS,cAAc,OAAO,oBAAoB,IAAI,MAAM,KAAK,cAAc,MAAM,gBAAgB;AAC7G,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,aAAa,EAAE;AAAA,IAC3B,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ,OAAO;AAAA,EACT,CAAC;AACD,OAAK,cAAc,sBAAsB,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,UAAU,kBAAkB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAChN,QAAM,eAAqF;AAAA,IACzF,IAAI;AAAA,IACJ;AAAA,IACA,UAAU,qBAAqB,YAAY,cAAc,GAAG,GAAG,UAAU;AAAA,EAC3E;AACA,MAAI,UAAU;AACZ,iBAAa,eAAe;AAAA,EAC9B;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,MAAM,gCAAgC;AAAA,IAChE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,OAAO,OAAO,KAAK;AAAA,QACnB,UAAU,OAAO,KAAK,YAAY;AAAA,QAClC;AAAA,QACA,aAAa,cAAc,SAAS,IAAI,gBAAgB;AAAA,MAC1D;AAAA,MACA,SAAS,OAAO,YAAY,IAAI,QAAQ,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,CAAC;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,oBAAoB,IAAI;AAC3B,WAAO,aAAa,KAAK,oBAAoB,MAAM,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AAAA,EAC/F;AAEA,QAAM,kBAAkB,oBAAoB;AAC5C,QAAM,qBAAqB,OAAO,gBAAgB,UAAU,YAAY,gBAAgB,MAAM,SAAS,IACnG,gBAAgB,QAChB;AACJ,QAAM,wBAAwB,OAAO,gBAAgB,iBAAiB,WAClE,gBAAgB,eAChB;AAEJ,QAAM,MAAM,aAAa,KAAK,iBAAiB,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AACzF,MAAI,QAAQ,IAAI,cAAc,oBAAoB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AACjL,MAAI,YAAY,uBAAuB;AACrC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AAC5E,QAAI,QAAQ,IAAI,iBAAiB,uBAAuB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,SAAS,UAAU,CAAC;AAAA,EAC3K,WAAW,CAAC,YAAY,uBAAuB,OAAO;AACpD,QAAI,QAAQ,IAAI,iBAAiB,qBAAqB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AAAA,EACvL;AACA,SAAO;AACT;AAEA,MAAM,qBAAqB,gBAAgB,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,eAAe;AAAA,EACpD,UAAU,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAChH,CAAC,EAAE,SAAS,oBAAoB;AAEhC,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,2CAA2C;AAAA,EACtE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6CAA6C;AAAA,EACtF,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4FAA4F;AAC3I,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,iBAAiB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": ["requireRoleRaw", "userRoleNames"]
 }

package/dist/modules/auth/services/authService.js

@@ -3,6 +3,7 @@ import { User, UserRole, Session, PasswordReset } from "@open-mercato/core/modul
 import { emailHashLookupValues } from "@open-mercato/core/modules/auth/lib/emailHash";
 import { generateAuthToken, hashAuthToken } from "@open-mercato/core/modules/auth/lib/tokenHash";
 import { findWithDecryption, findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+const TIMING_EQUALIZER_PASSWORD_HASH = "$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6";
 class AuthService {
   constructor(em) {
     this.em = em;
@@ -45,8 +46,9 @@ class AuthService {
     );
   }
   async verifyPassword(user, password) {
-    if (!user.passwordHash) return false;
-    return compare(password, user.passwordHash);
+    const storedHash = user?.passwordHash ?? null;
+    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH);
+    return storedHash !== null && matched;
   }
   async updateLastLoginAt(user) {
     const now = /* @__PURE__ */ new Date();

package/dist/modules/auth/services/authService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/services/authService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User, password: string) {\n    if (!user.passwordHash) return false\n    return compare(password, user.passwordHash)\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
-  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAEnD,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAY,UAAkB;AACjD,QAAI,CAAC,KAAK,aAAc,QAAO;AAC/B,WAAO,QAAQ,UAAU,KAAK,YAAY;AAAA,EAC5C;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,OAAQ,IAAI,UAAU,IAAI,UAAU,OAAQ,IAAI,aAAa,IAAK,QAAO;AAG9E,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password\n// can match. verifyPassword compares against it whenever the user is missing or\n// has no password hash, so a failed login spends the same bcrypt CPU time\n// regardless of whether the account exists \u2014 closing the timing side channel\n// for account enumeration (issue #2242).\nconst TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User | null, password: string) {\n    const storedHash = user?.passwordHash ?? null\n    // Always run a bcrypt comparison \u2014 against a fixed dummy hash when the user\n    // is absent or has no password \u2014 so login latency does not reveal whether\n    // the account exists (timing-based enumeration, issue #2242).\n    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)\n    return storedHash !== null && matched\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
+  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAO1D,MAAM,iCAAiC;AAEhC,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAmB,UAAkB;AACxD,UAAM,aAAa,MAAM,gBAAgB;AAIzC,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc,8BAA8B;AACpF,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,OAAQ,IAAI,UAAU,IAAI,UAAU,OAAQ,IAAI,aAAa,IAAK,QAAO;AAG9E,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/modules/sales/components/documents/SalesDocumentsTable.js

@@ -20,6 +20,7 @@ import {
   createDictionaryMap,
   normalizeDictionaryEntries
 } from "@open-mercato/core/modules/dictionaries/components/dictionaryAppearance";
+import { SALES_DOCUMENT_NUMBER_COLUMN_META } from "./salesDocumentsColumns.js";
 const PAGE_SIZE = 20;
 function resolveCustomerName(snapshot, fallback) {
   if (!snapshot) return fallback ?? null;
@@ -469,7 +470,7 @@ function SalesDocumentsTable({ kind }) {
           }
         ) : null
       ] }),
-      meta: { sticky: true }
+      meta: SALES_DOCUMENT_NUMBER_COLUMN_META
     },
     {
       accessorKey: "customerName",

package/dist/modules/sales/components/documents/SalesDocumentsTable.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sales/components/documents/SalesDocumentsTable.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport type { ColumnDef, SortingState } from '@tanstack/react-table'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable, type DataTableExportFormat, withDataTableNamespaces } from '@open-mercato/ui/backend/DataTable'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { buildCrudExportUrl, deleteCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  DictionaryValue,\n  type DictionaryMap,\n  createDictionaryMap,\n  normalizeDictionaryEntries,\n} from '@open-mercato/core/modules/dictionaries/components/dictionaryAppearance'\n\ntype SalesDocumentKind = 'order' | 'quote'\n\ntype FilterOption = { value: string; label: string; description?: string | null }\n\ntype CustomerSnapshot = {\n  customer?: {\n    displayName?: string | null\n    primaryEmail?: string | null\n  } | null\n  contact?: {\n    firstName?: string | null\n    lastName?: string | null\n    preferredName?: string | null\n  } | null\n}\n\ntype ApiDocument = {\n  id: string\n  orderNumber?: string | null\n  quoteNumber?: string | null\n  status?: string | null\n  customerEntityId?: string | null\n  customerSnapshot?: Record<string, unknown> | null\n  channelId?: string | null\n  lineItemCount?: number | null\n  grandTotalNetAmount?: number | null\n  grandTotalGrossAmount?: number | null\n  currencyCode?: string | null\n  placedAt?: string | null\n  validUntil?: string | null\n  validFrom?: string | null\n  createdAt?: string | null\n  updatedAt?: string | null\n}\n\ntype DocumentsResponse = {\n  items?: Array<Record<string, unknown>>\n  total?: number\n  totalPages?: number\n}\n\ntype SalesDocumentRow = {\n  id: string\n  number: string\n  status?: string | null\n  customerName?: string | null\n  customerEmail?: string | null\n  channelId?: string | null\n  lineItemCount?: number | null\n  totalNet?: number | null\n  totalGross?: number | null\n  currency?: string | null\n  date?: string | null\n  updatedAt?: string | null\n}\n\nconst PAGE_SIZE = 20\n\nfunction resolveCustomerName(snapshot: CustomerSnapshot | null | undefined, fallback?: string | null) {\n  if (!snapshot) return fallback ?? null\n  const base = snapshot.customer?.displayName ?? null\n  if (base) return base\n  const contact = snapshot.contact\n  if (contact) {\n    const parts = [contact.preferredName, contact.firstName, contact.lastName].filter(\n      (part) => part && part.trim().length\n    ) as string[]\n    if (parts.length) return parts.join(' ')\n  }\n  return fallback ?? null\n}\n\nfunction resolveCustomerEmail(snapshot: CustomerSnapshot | null | undefined) {\n  if (!snapshot) return null\n  if (snapshot.customer?.primaryEmail) return snapshot.customer.primaryEmail\n  return null\n}\n\nfunction toNumber(value: unknown): number | null {\n  if (typeof value === 'number') return Number.isNaN(value) ? null : value\n  if (typeof value === 'string' && value.trim().length) {\n    const parsed = Number(value)\n    return Number.isNaN(parsed) ? null : parsed\n  }\n  return null\n}\n\nfunction formatCurrency(amount: number | null | undefined, currency: string | null | undefined, fallback = '\u2014') {\n  if (amount == null || Number.isNaN(amount)) return fallback\n  try {\n    if (currency && currency.trim().length) {\n      const formatter = new Intl.NumberFormat(undefined, { style: 'currency', currency })\n      return formatter.format(amount)\n    }\n    return new Intl.NumberFormat(undefined, { style: 'decimal', maximumFractionDigits: 2 }).format(amount)\n  } catch {\n    return String(amount)\n  }\n}\n\nfunction mergeOptions(existing: FilterOption[], next: FilterOption[]): FilterOption[] {\n  const map = new Map<string, FilterOption>()\n  existing.forEach((opt) => map.set(opt.value, opt))\n  next.forEach((opt) => map.set(opt.value, opt))\n  return Array.from(map.values()).sort((a, b) => a.label.localeCompare(b.label))\n}\n\nfunction normalizeNumberInput(value: unknown): number | null {\n  if (typeof value === 'number') return Number.isNaN(value) ? null : value\n  if (typeof value === 'string' && value.trim().length) {\n    const parsed = Number(value)\n    return Number.isNaN(parsed) ? null : parsed\n  }\n  return null\n}\n\nexport function SalesDocumentsTable({ kind }: { kind: SalesDocumentKind }) {\n  const t = useT()\n  const router = useRouter()\n  const scopeVersion = useOrganizationScopeVersion()\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const [rows, setRows] = React.useState<SalesDocumentRow[]>([])\n  const [page, setPage] = React.useState(1)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [sorting, setSorting] = React.useState<SortingState>([{ id: 'createdAt', desc: true }])\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n  const [isLoading, setLoading] = React.useState(false)\n  const [cacheStatus, setCacheStatus] = React.useState<'hit' | 'miss' | null>(null)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const [channelOptions, setChannelOptions] = React.useState<FilterOption[]>([])\n  const [tagOptions, setTagOptions] = React.useState<FilterOption[]>([])\n  const [customerOptions, setCustomerOptions] = React.useState<FilterOption[]>([])\n  const [statusMap, setStatusMap] = React.useState<DictionaryMap>({})\n\n  const resource = kind === 'order' ? 'orders' : 'quotes'\n  const entityId = kind === 'order' ? E.sales.sales_order : E.sales.sales_quote\n  const title = kind === 'order'\n    ? t('sales.documents.list.ordersTitle', 'Sales orders')\n    : t('sales.documents.list.quotesTitle', 'Sales quotes')\n  const subtitle = t(\n    'sales.documents.list.subtitle',\n    'Review documents with customer context, totals, and channels.'\n  )\n\n  const fetchChannelOptions = React.useCallback(async (query?: string): Promise<FilterOption[]> => {\n    const params = new URLSearchParams({ page: '1', pageSize: '50' })\n    if (query && query.trim()) params.set('search', query.trim())\n    try {\n      const call = await apiCall<{ items?: unknown[] }>(`/api/sales/channels?${params.toString()}`)\n      if (!call.ok) return []\n      const items = Array.isArray(call.result?.items) ? call.result!.items : []\n      return items\n        .map((item: any): FilterOption | null => {\n          const id = typeof item?.id === 'string' ? item.id : null\n          const name = typeof item?.name === 'string' ? item.name : null\n          if (!id || !name) return null\n          return { value: id, label: name }\n        })\n        .filter((opt): opt is FilterOption => opt !== null)\n    } catch {\n      return []\n    }\n  }, [])\n\n  const fetchTagOptions = React.useCallback(async (query?: string): Promise<FilterOption[]> => {\n    const params = new URLSearchParams({ page: '1', pageSize: '50' })\n    if (query && query.trim()) params.set('search', query.trim())\n    try {\n      const call = await apiCall<{ items?: unknown[] }>(`/api/sales/tags?${params.toString()}`)\n      if (!call.ok) return []\n      const items = Array.isArray(call.result?.items) ? call.result!.items : []\n      return items\n        .map((item: any): FilterOption | null => {\n          const id = typeof item?.id === 'string' ? item.id : null\n          const label = typeof item?.label === 'string' ? item.label : null\n          if (!id || !label) return null\n          const description = typeof item?.description === 'string' ? item.description : null\n          return { value: id, label, description }\n        })\n        .filter((opt): opt is FilterOption => opt !== null)\n    } catch {\n      return []\n    }\n  }, [])\n\n  const fetchCustomerOptions = React.useCallback(async (query?: string): Promise<FilterOption[]> => {\n    const params = new URLSearchParams({ page: '1', pageSize: '20' })\n    if (query && query.trim().length) params.set('search', query.trim())\n    try {\n      const [people, companies] = await Promise.all([\n        apiCall<{ items?: unknown[] }>(`/api/customers/people?${params.toString()}`),\n        apiCall<{ items?: unknown[] }>(`/api/customers/companies?${params.toString()}`),\n      ])\n      const peopleItems = Array.isArray(people.result?.items) ? people.result?.items ?? [] : []\n      const companyItems = Array.isArray(companies.result?.items) ? companies.result?.items ?? [] : []\n      const parseOption = (item: any, kind: 'person' | 'company'): FilterOption | null => {\n        const id = typeof item?.id === 'string' ? item.id : null\n        if (!id) return null\n        const name =\n          typeof item?.display_name === 'string' && item.display_name.trim().length\n            ? item.display_name\n            : typeof item?.name === 'string' && item.name.trim().length\n              ? item.name\n              : id\n        const email =\n          typeof item?.primary_email === 'string' && item.primary_email.trim().length\n            ? item.primary_email.trim()\n            : null\n        const label = email ? `${name} (${email})` : name\n        return { value: id, label }\n      }\n      const options = [...peopleItems.map((i) => parseOption(i, 'person')), ...companyItems.map((i) => parseOption(i, 'company'))]\n        .filter((opt): opt is FilterOption => !!opt)\n      return options\n    } catch {\n      return []\n    }\n  }, [])\n\n  const loadStatusMap = React.useCallback(async () => {\n    try {\n      const params = new URLSearchParams({ page: '1', pageSize: '100' })\n      const response = await apiCall<{ items?: Array<Record<string, unknown>> }>(\n        `/api/sales/order-statuses?${params.toString()}`,\n        undefined,\n        { fallback: { items: [] } }\n      )\n      const entries = normalizeDictionaryEntries(response.result?.items ?? [], { sort: false })\n      setStatusMap(createDictionaryMap(entries))\n    } catch (err) {\n      console.error('sales.documents.statuses.load', err)\n      setStatusMap({})\n    }\n  }, [])\n\n  const loadChannelOptions = React.useCallback(\n    async (query?: string) => {\n      const opts = await fetchChannelOptions(query)\n      if (opts.length) setChannelOptions((prev) => mergeOptions(prev, opts))\n      return opts\n    },\n    [fetchChannelOptions]\n  )\n\n  const loadTagOptions = React.useCallback(\n    async (query?: string) => {\n      const opts = await fetchTagOptions(query)\n      if (opts.length) setTagOptions((prev) => mergeOptions(prev, opts))\n      return opts\n    },\n    [fetchTagOptions]\n  )\n\n  const loadCustomerOptions = React.useCallback(\n    async (query?: string) => {\n      const opts = await fetchCustomerOptions(query)\n      if (opts.length) setCustomerOptions((prev) => mergeOptions(prev, opts))\n      return opts\n    },\n    [fetchCustomerOptions]\n  )\n\n  React.useEffect(() => {\n    loadChannelOptions().catch(() => {})\n    loadTagOptions().catch(() => {})\n    loadCustomerOptions().catch(() => {})\n    loadStatusMap().catch(() => setStatusMap({}))\n  }, [loadChannelOptions, loadCustomerOptions, loadStatusMap, loadTagOptions, scopeVersion])\n\n  const filters = React.useMemo<FilterDef[]>(() => [\n    {\n      id: 'channelId',\n      label: t('sales.documents.list.filters.channel', 'Channel'),\n      type: 'select',\n      options: channelOptions,\n      loadOptions: loadChannelOptions,\n    },\n    {\n      id: 'date',\n      label: t('sales.documents.list.filters.date', 'Date'),\n      type: 'dateRange',\n    },\n    {\n      id: 'lineItemCountMin',\n      label: t('sales.documents.list.filters.itemsMin', 'Min items'),\n      type: 'text',\n    },\n    {\n      id: 'lineItemCountMax',\n      label: t('sales.documents.list.filters.itemsMax', 'Max items'),\n      type: 'text',\n    },\n    {\n      id: 'totalNetMin',\n      label: t('sales.documents.list.filters.totalNetMin', 'Min total (net)'),\n      type: 'text',\n    },\n    {\n      id: 'totalNetMax',\n      label: t('sales.documents.list.filters.totalNetMax', 'Max total (net)'),\n      type: 'text',\n    },\n    {\n      id: 'totalGrossMin',\n      label: t('sales.documents.list.filters.totalGrossMin', 'Min total (gross)'),\n      type: 'text',\n    },\n    {\n      id: 'totalGrossMax',\n      label: t('sales.documents.list.filters.totalGrossMax', 'Max total (gross)'),\n      type: 'text',\n    },\n    {\n      id: 'customerId',\n      label: t('sales.documents.list.filters.customer', 'Customer'),\n      type: 'tags',\n      options: customerOptions,\n      loadOptions: loadCustomerOptions,\n      placeholder: t('sales.documents.list.filters.customerPlaceholder', 'Search customers'),\n      formatValue: (val: string) => {\n        const match = customerOptions.find((opt) => opt.value === val)\n        return match?.label ?? val\n      },\n    },\n    {\n      id: 'tagIds',\n      label: t('sales.documents.list.filters.tags', 'Tags'),\n      type: 'tags',\n      options: tagOptions,\n      loadOptions: loadTagOptions,\n      formatValue: (val: string) => tagOptions.find((o) => o.value === val)?.label ?? val,\n      formatDescription: (val: string) => tagOptions.find((o) => o.value === val)?.description ?? null,\n    },\n  ], [channelOptions, loadChannelOptions, customerOptions, loadCustomerOptions, loadTagOptions, tagOptions, t])\n\n  const queryParams = React.useMemo(() => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(PAGE_SIZE))\n    if (search.trim()) params.set('search', search.trim())\n    const sort = sorting[0]\n    if (sort?.id) {\n      params.set('sortField', sort.id)\n      params.set('sortDir', sort.desc ? 'desc' : 'asc')\n    }\n    const channelId = typeof filterValues.channelId === 'string' ? filterValues.channelId : ''\n    if (channelId) params.set('channelId', channelId)\n    const customerIds = Array.isArray(filterValues.customerId)\n      ? filterValues.customerId\n          .map((value) => (typeof value === 'string' ? value.trim() : String(value || '').trim()))\n          .filter((value) => value.length > 0)\n      : []\n    if (customerIds.length > 0) {\n      params.set('customerId', customerIds[0])\n    }\n    const date = filterValues.date\n    if (date && typeof date === 'object') {\n      if (date.from) params.set('dateFrom', date.from)\n      if (date.to) params.set('dateTo', date.to)\n    }\n    const numberFilters: Array<[keyof FilterValues, string]> = [\n      ['lineItemCountMin', 'lineItemCountMin'],\n      ['lineItemCountMax', 'lineItemCountMax'],\n      ['totalNetMin', 'totalNetMin'],\n      ['totalNetMax', 'totalNetMax'],\n      ['totalGrossMin', 'totalGrossMin'],\n      ['totalGrossMax', 'totalGrossMax'],\n    ]\n    numberFilters.forEach(([key, queryKey]) => {\n      const value = normalizeNumberInput((filterValues as any)[key])\n      if (value != null) params.set(queryKey, String(value))\n    })\n    const tagIds = Array.isArray(filterValues.tagIds)\n      ? filterValues.tagIds.map((value) => (typeof value === 'string' ? value.trim() : String(value || '').trim())).filter((v) => v.length > 0)\n      : []\n    if (tagIds.length > 0) {\n      params.set('tagIds', tagIds.join(','))\n    }\n    Object.entries(filterValues).forEach(([key, value]) => {\n      if (!key.startsWith('cf_') || value == null) return\n      if (Array.isArray(value)) {\n        const normalized = value\n          .map((item) => {\n            if (item == null) return ''\n            if (typeof item === 'string') return item.trim()\n            return String(item).trim()\n          })\n          .filter((item) => item.length > 0)\n        if (normalized.length) params.set(key, normalized.join(','))\n      } else if (typeof value === 'object') {\n        return\n      } else if (value !== '') {\n        const stringValue = typeof value === 'string' ? value.trim() : String(value)\n        if (stringValue) params.set(key, stringValue)\n      }\n    })\n    return params.toString()\n  }, [filterValues, page, search, sorting])\n\n  const currentParams = React.useMemo(() => Object.fromEntries(new URLSearchParams(queryParams)), [queryParams])\n\n  const exportConfig = React.useMemo(() => ({\n    view: {\n      getUrl: (format: DataTableExportFormat) =>\n        buildCrudExportUrl(`sales/${resource}`, { ...currentParams, exportScope: 'view' }, format),\n    },\n    full: {\n      getUrl: (format: DataTableExportFormat) =>\n        buildCrudExportUrl(`sales/${resource}`, { ...currentParams, exportScope: 'full', all: 'true' }, format),\n    },\n  }), [currentParams, resource])\n\n  const mapApiDocument = React.useCallback(\n    (item: Record<string, unknown>): SalesDocumentRow => {\n      const doc = item as ApiDocument\n      const id = typeof doc.id === 'string' ? doc.id : ''\n      const number = kind === 'order'\n        ? doc.orderNumber ?? (item as any)?.order_number ?? id\n        : doc.quoteNumber ?? (item as any)?.quote_number ?? id\n      const customerSnapshot = (doc.customerSnapshot ?? null) as CustomerSnapshot | null\n      const customerName = resolveCustomerName(customerSnapshot, doc.customerEntityId ?? null)\n      const customerEmail = resolveCustomerEmail(customerSnapshot)\n      const totalNet = toNumber(doc.grandTotalNetAmount)\n      const totalGross = toNumber(doc.grandTotalGrossAmount)\n      const placedAt = doc.placedAt ?? null\n      const validUntil = doc.validUntil ?? null\n      const createdAt = doc.createdAt ?? null\n      const date = placedAt ?? validUntil ?? createdAt ?? null\n      return withDataTableNamespaces({\n        id,\n        number,\n        status: doc.status ?? null,\n        customerName,\n        customerEmail,\n        channelId: doc.channelId ?? null,\n        lineItemCount: doc.lineItemCount ?? null,\n        totalNet,\n        totalGross,\n        currency: doc.currencyCode ?? null,\n        date,\n        updatedAt: doc.updatedAt ?? null,\n      }, item)\n    },\n    [kind]\n  )\n\n  const loadDocuments = React.useCallback(async () => {\n    setLoading(true)\n    setCacheStatus(null)\n    try {\n      const call = await apiCall<DocumentsResponse>(`/api/sales/${resource}?${queryParams}`)\n      if (!call.ok) {\n        flash(t('sales.documents.list.errors.load', 'Failed to load documents.'), 'error')\n        setRows([])\n        setTotal(0)\n        setTotalPages(1)\n        return\n      }\n      const payload = call.result ?? {}\n      const items = Array.isArray(payload.items) ? payload.items : []\n      setRows(items.map((item) => mapApiDocument(item)))\n      const count = typeof payload.total === 'number' ? payload.total : items.length\n      setTotal(count)\n      const pages = typeof payload.totalPages === 'number'\n        ? payload.totalPages\n        : Math.max(1, Math.ceil(count / PAGE_SIZE))\n      setTotalPages(pages)\n      setCacheStatus(call.cacheStatus ?? null)\n    } catch (err) {\n      console.error('sales.documents.list', err)\n      flash(t('sales.documents.list.errors.load', 'Failed to load documents.'), 'error')\n    } finally {\n      setLoading(false)\n    }\n  }, [mapApiDocument, queryParams, resource, t])\n\n  React.useEffect(() => {\n    void loadDocuments()\n  }, [loadDocuments, reloadToken, scopeVersion])\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    setFilterValues(values)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const handleSearchChange = React.useCallback((value: string) => {\n    setSearch(value)\n    setPage(1)\n  }, [])\n\n  const handleRefresh = React.useCallback(() => {\n    setReloadToken((token) => token + 1)\n  }, [])\n\n  const handleDelete = React.useCallback(\n    async (row: SalesDocumentRow) => {\n      const confirmMessage =\n        kind === 'order'\n          ? t(\n              'sales.documents.list.table.deleteOrderConfirm',\n              'Delete this sales order? Related shipments, payments, addresses, and items will be removed.'\n            )\n          : t(\n              'sales.documents.list.table.deleteQuoteConfirm',\n              'Delete this sales quote? Related addresses, comments, and items will be removed.'\n            )\n      const confirmed = await confirm({\n        title: confirmMessage,\n        variant: 'destructive',\n      })\n      if (!confirmed) return\n      try {\n        const result = await withScopedApiRequestHeaders(\n          buildOptimisticLockHeader(row.updatedAt),\n          () =>\n            deleteCrud(`sales/${resource}`, row.id, {\n              errorMessage: t('sales.documents.list.table.deleteError', 'Failed to delete document.'),\n            }),\n        )\n        if (result.ok) {\n          flash(\n            kind === 'order'\n              ? t('sales.documents.list.table.orderDeleted', 'Sales order deleted.')\n              : t('sales.documents.list.table.quoteDeleted', 'Sales quote deleted.'),\n            'success'\n          )\n          handleRefresh()\n        }\n      } catch (err) {\n        console.error('sales.documents.delete', err)\n        flash(t('sales.documents.list.table.deleteError', 'Failed to delete document.'), 'error')\n      }\n    },\n    [confirm, handleRefresh, kind, resource, t]\n  )\n\n  const handleRowClick = React.useCallback((row: SalesDocumentRow) => {\n    router.push(`/backend/sales/${resource}/${row.id}?kind=${kind}`)\n  }, [kind, resource, router])\n\n  const columns = React.useMemo<ColumnDef<SalesDocumentRow>[]>(() => [\n    {\n      id: 'number',\n      accessorKey: 'number',\n      header: kind === 'order'\n        ? t('sales.documents.list.table.order', 'Order')\n        : t('sales.documents.list.table.quote', 'Quote'),\n      cell: ({ row }) => (\n        <div className=\"flex flex-col\">\n          <span className=\"font-semibold\">{row.original.number}</span>\n          {row.original.status ? (\n            <DictionaryValue\n              value={row.original.status}\n              map={statusMap}\n              fallback={<span className=\"text-xs text-muted-foreground\">{row.original.status}</span>}\n              className=\"text-xs text-muted-foreground font-medium\"\n              iconWrapperClassName=\"inline-flex h-5 w-5 items-center justify-center rounded bg-muted text-muted-foreground\"\n              iconClassName=\"h-3.5 w-3.5\"\n              colorClassName=\"h-3 w-3 rounded-full border border-border/70\"\n            />\n          ) : null}\n        </div>\n      ),\n      meta: { sticky: true },\n    },\n    {\n      accessorKey: 'customerName',\n      header: t('sales.documents.list.table.customer', 'Customer'),\n      cell: ({ row }) => (\n        <div className=\"flex flex-col\">\n          <span className=\"text-sm font-medium\">\n            {row.original.customerName ?? t('sales.documents.list.table.noCustomer', 'No customer')}\n          </span>\n          <span className=\"text-xs text-muted-foreground\">\n            {row.original.customerEmail ?? t('sales.documents.list.table.noEmail', 'No email')}\n          </span>\n        </div>\n      ),\n      enableSorting: false,\n    },\n    {\n      accessorKey: 'channelId',\n      header: t('sales.documents.list.table.channel', 'Channel'),\n      cell: ({ row }) => {\n        const channelId = row.original.channelId\n        if (!channelId) return <span className=\"text-xs text-muted-foreground\">{t('sales.documents.list.table.unassigned', 'Unassigned')}</span>\n        const channel = channelOptions.find((opt) => opt.value === channelId)\n        return (\n          <span className=\"text-sm\">{channel?.label ?? channelId}</span>\n        )\n      },\n      enableSorting: false,\n    },\n    {\n      id: 'lineItemCount',\n      accessorKey: 'lineItemCount',\n      header: t('sales.documents.list.table.items', 'Items'),\n      cell: ({ row }) => (\n        <span className=\"text-sm font-semibold\">{typeof row.original.lineItemCount === 'number' ? row.original.lineItemCount : '\u2014'}</span>\n      ),\n    },\n    {\n      id: 'grandTotalNetAmount',\n      accessorKey: 'totalNet',\n      header: t('sales.documents.list.table.totalNet', 'Total (net)'),\n      cell: ({ row }) => (\n        <span className=\"text-sm\">{formatCurrency(row.original.totalNet ?? null, row.original.currency)}</span>\n      ),\n    },\n    {\n      id: 'grandTotalGrossAmount',\n      accessorKey: 'totalGross',\n      header: t('sales.documents.list.table.totalGross', 'Total (gross)'),\n      cell: ({ row }) => (\n        <span className=\"text-sm\">{formatCurrency(row.original.totalGross ?? null, row.original.currency)}</span>\n      ),\n    },\n    {\n      id: 'createdAt',\n      accessorKey: 'date',\n      header: t('sales.documents.list.table.date', 'Date'),\n      cell: ({ row }) =>\n        row.original.date\n          ? <span className=\"text-xs text-muted-foreground\">{new Date(row.original.date).toLocaleString()}</span>\n          : <span className=\"text-xs text-muted-foreground\">\u2014</span>,\n    },\n  ], [channelOptions, kind, statusMap, t])\n\n  const emptyLabel = kind === 'order'\n    ? t('sales.documents.list.table.emptyOrders', 'No orders yet.')\n    : t('sales.documents.list.table.emptyQuotes', 'No quotes yet.')\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable<SalesDocumentRow>\n          stickyActionsColumn\n          title={(\n            <div className=\"flex flex-col\">\n              <span>{title}</span>\n              <span className=\"text-sm font-normal text-muted-foreground\">{subtitle}</span>\n            </div>\n          )}\n          actions={(\n            <Button asChild>\n              <Link href={`/backend/sales/documents/create?kind=${kind}`}>\n                {t('sales.documents.create.title', 'Create sales document')}\n              </Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          sorting={sorting}\n          onSortingChange={setSorting}\n          isLoading={isLoading}\n          searchValue={search}\n          onSearchChange={handleSearchChange}\n          searchPlaceholder={\n            kind === 'order'\n              ? t('sales.documents.list.search.orders', 'Search orders\u2026')\n              : t('sales.documents.list.search.quotes', 'Search quotes\u2026')\n          }\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          entityId={entityId}\n          exporter={exportConfig}\n          pagination={{\n            page,\n            pageSize: PAGE_SIZE,\n            total,\n            totalPages,\n            onPageChange: setPage,\n            cacheStatus,\n          }}\n          refreshButton={{\n            label: t('sales.documents.list.table.refresh', 'Refresh'),\n            onRefresh: handleRefresh,\n            isRefreshing: isLoading,\n          }}\n          rowActions={(row) => (\n            <RowActions\n              items={[\n                {\n                  id: 'open',\n                  label: t('sales.documents.list.table.open', 'Open'),\n                  href: `/backend/sales/${resource}/${row.id}?kind=${kind}`,\n                },\n                {\n                  id: 'delete',\n                  label:\n                    kind === 'order'\n                      ? t('sales.documents.list.table.deleteOrder', 'Delete order')\n                      : t('sales.documents.list.table.deleteQuote', 'Delete quote'),\n                  onSelect: () => handleDelete(row),\n                },\n              ]}\n            />\n          )}\n          perspective={{ tableId: kind === 'order' ? 'sales.orders' : 'sales.quotes' }}\n          onRowClick={handleRowClick}\n          emptyState={\n            <div className=\"py-10 text-center text-sm text-muted-foreground\">\n              {emptyLabel}\n            </div>\n          }\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n\nexport default SalesDocumentsTable\n"],
-  "mappings": ";AAqkBQ,SACE,KADF;AAnkBR,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAE1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,WAAuC,+BAA+B;AAE/E,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,SAAS,mCAAmC;AACrD,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB,kBAAkB;AAC/C,SAAS,aAAa;AACtB,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AA0DP,MAAM,YAAY;AAElB,SAAS,oBAAoB,UAA+C,UAA0B;AACpG,MAAI,CAAC,SAAU,QAAO,YAAY;AAClC,QAAM,OAAO,SAAS,UAAU,eAAe;AAC/C,MAAI,KAAM,QAAO;AACjB,QAAM,UAAU,SAAS;AACzB,MAAI,SAAS;AACX,UAAM,QAAQ,CAAC,QAAQ,eAAe,QAAQ,WAAW,QAAQ,QAAQ,EAAE;AAAA,MACzE,CAAC,SAAS,QAAQ,KAAK,KAAK,EAAE;AAAA,IAChC;AACA,QAAI,MAAM,OAAQ,QAAO,MAAM,KAAK,GAAG;AAAA,EACzC;AACA,SAAO,YAAY;AACrB;AAEA,SAAS,qBAAqB,UAA+C;AAC3E,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,UAAU,aAAc,QAAO,SAAS,SAAS;AAC9D,SAAO;AACT;AAEA,SAAS,SAAS,OAA+B;AAC/C,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,MAAM,KAAK,IAAI,OAAO;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,QAAQ;AACpD,UAAM,SAAS,OAAO,KAAK;AAC3B,WAAO,OAAO,MAAM,MAAM,IAAI,OAAO;AAAA,EACvC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAmC,UAAqC,WAAW,UAAK;AAC9G,MAAI,UAAU,QAAQ,OAAO,MAAM,MAAM,EAAG,QAAO;AACnD,MAAI;AACF,QAAI,YAAY,SAAS,KAAK,EAAE,QAAQ;AACtC,YAAM,YAAY,IAAI,KAAK,aAAa,QAAW,EAAE,OAAO,YAAY,SAAS,CAAC;AAClF,aAAO,UAAU,OAAO,MAAM;AAAA,IAChC;AACA,WAAO,IAAI,KAAK,aAAa,QAAW,EAAE,OAAO,WAAW,uBAAuB,EAAE,CAAC,EAAE,OAAO,MAAM;AAAA,EACvG,QAAQ;AACN,WAAO,OAAO,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,aAAa,UAA0B,MAAsC;AACpF,QAAM,MAAM,oBAAI,IAA0B;AAC1C,WAAS,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC;AACjD,OAAK,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC;AAC7C,SAAO,MAAM,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAC/E;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,MAAM,KAAK,IAAI,OAAO;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,QAAQ;AACpD,UAAM,SAAS,OAAO,KAAK;AAC3B,WAAO,OAAO,MAAM,MAAM,IAAI,OAAO;AAAA,EACvC;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,EAAE,KAAK,GAAgC;AACzE,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,4BAA4B;AACjD,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA6B,CAAC,CAAC;AAC7D,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,EAAE,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC;AAC5F,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvE,QAAM,CAAC,WAAW,UAAU,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAgC,IAAI;AAChF,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAyB,CAAC,CAAC;AAC7E,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAyB,CAAC,CAAC;AACrE,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAyB,CAAC,CAAC;AAC/E,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAwB,CAAC,CAAC;AAElE,QAAM,WAAW,SAAS,UAAU,WAAW;AAC/C,QAAM,WAAW,SAAS,UAAU,EAAE,MAAM,cAAc,EAAE,MAAM;AAClE,QAAM,QAAQ,SAAS,UACnB,EAAE,oCAAoC,cAAc,IACpD,EAAE,oCAAoC,cAAc;AACxD,QAAM,WAAW;AAAA,IACf;AAAA,IACA;AAAA,EACF;AAEA,QAAM,sBAAsB,MAAM,YAAY,OAAO,UAA4C;AAC/F,UAAM,SAAS,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,KAAK,CAAC;AAChE,QAAI,SAAS,MAAM,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM,KAAK,CAAC;AAC5D,QAAI;AACF,YAAM,OAAO,MAAM,QAA+B,uBAAuB,OAAO,SAAS,CAAC,EAAE;AAC5F,UAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,YAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,aAAO,MACJ,IAAI,CAAC,SAAmC;AACvC,cAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,KAAK;AACpD,cAAM,OAAO,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AAC1D,YAAI,CAAC,MAAM,CAAC,KAAM,QAAO;AACzB,eAAO,EAAE,OAAO,IAAI,OAAO,KAAK;AAAA,MAClC,CAAC,EACA,OAAO,CAAC,QAA6B,QAAQ,IAAI;AAAA,IACtD,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAA4C;AAC3F,UAAM,SAAS,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,KAAK,CAAC;AAChE,QAAI,SAAS,MAAM,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM,KAAK,CAAC;AAC5D,QAAI;AACF,YAAM,OAAO,MAAM,QAA+B,mBAAmB,OAAO,SAAS,CAAC,EAAE;AACxF,UAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,YAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,aAAO,MACJ,IAAI,CAAC,SAAmC;AACvC,cAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,KAAK;AACpD,cAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ;AAC7D,YAAI,CAAC,MAAM,CAAC,MAAO,QAAO;AAC1B,cAAM,cAAc,OAAO,MAAM,gBAAgB,WAAW,KAAK,cAAc;AAC/E,eAAO,EAAE,OAAO,IAAI,OAAO,YAAY;AAAA,MACzC,CAAC,EACA,OAAO,CAAC,QAA6B,QAAQ,IAAI;AAAA,IACtD,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,uBAAuB,MAAM,YAAY,OAAO,UAA4C;AAChG,UAAM,SAAS,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,KAAK,CAAC;AAChE,QAAI,SAAS,MAAM,KAAK,EAAE,OAAQ,QAAO,IAAI,UAAU,MAAM,KAAK,CAAC;AACnE,QAAI;AACF,YAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC5C,QAA+B,yBAAyB,OAAO,SAAS,CAAC,EAAE;AAAA,QAC3E,QAA+B,4BAA4B,OAAO,SAAS,CAAC,EAAE;AAAA,MAChF,CAAC;AACD,YAAM,cAAc,MAAM,QAAQ,OAAO,QAAQ,KAAK,IAAI,OAAO,QAAQ,SAAS,CAAC,IAAI,CAAC;AACxF,YAAM,eAAe,MAAM,QAAQ,UAAU,QAAQ,KAAK,IAAI,UAAU,QAAQ,SAAS,CAAC,IAAI,CAAC;AAC/F,YAAM,cAAc,CAAC,MAAWA,UAAoD;AAClF,cAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,KAAK;AACpD,YAAI,CAAC,GAAI,QAAO;AAChB,cAAM,OACJ,OAAO,MAAM,iBAAiB,YAAY,KAAK,aAAa,KAAK,EAAE,SAC/D,KAAK,eACL,OAAO,MAAM,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SACjD,KAAK,OACL;AACR,cAAM,QACJ,OAAO,MAAM,kBAAkB,YAAY,KAAK,cAAc,KAAK,EAAE,SACjE,KAAK,cAAc,KAAK,IACxB;AACN,cAAM,QAAQ,QAAQ,GAAG,IAAI,KAAK,KAAK,MAAM;AAC7C,eAAO,EAAE,OAAO,IAAI,MAAM;AAAA,MAC5B;AACA,YAAM,UAAU,CAAC,GAAG,YAAY,IAAI,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,GAAG,aAAa,IAAI,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,EACxH,OAAO,CAAC,QAA6B,CAAC,CAAC,GAAG;AAC7C,aAAO;AAAA,IACT,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,QAAI;AACF,YAAM,SAAS,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,MAAM,CAAC;AACjE,YAAM,WAAW,MAAM;AAAA,QACrB,6BAA6B,OAAO,SAAS,CAAC;AAAA,QAC9C;AAAA,QACA,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,MAC5B;AACA,YAAM,UAAU,2BAA2B,SAAS,QAAQ,SAAS,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;AACxF,mBAAa,oBAAoB,OAAO,CAAC;AAAA,IAC3C,SAAS,KAAK;AACZ,cAAQ,MAAM,iCAAiC,GAAG;AAClD,mBAAa,CAAC,CAAC;AAAA,IACjB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM;AAAA,IAC/B,OAAO,UAAmB;AACxB,YAAM,OAAO,MAAM,oBAAoB,KAAK;AAC5C,UAAI,KAAK,OAAQ,mBAAkB,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;AACrE,aAAO;AAAA,IACT;AAAA,IACA,CAAC,mBAAmB;AAAA,EACtB;AAEA,QAAM,iBAAiB,MAAM;AAAA,IAC3B,OAAO,UAAmB;AACxB,YAAM,OAAO,MAAM,gBAAgB,KAAK;AACxC,UAAI,KAAK,OAAQ,eAAc,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;AACjE,aAAO;AAAA,IACT;AAAA,IACA,CAAC,eAAe;AAAA,EAClB;AAEA,QAAM,sBAAsB,MAAM;AAAA,IAChC,OAAO,UAAmB;AACxB,YAAM,OAAO,MAAM,qBAAqB,KAAK;AAC7C,UAAI,KAAK,OAAQ,oBAAmB,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;AACtE,aAAO;AAAA,IACT;AAAA,IACA,CAAC,oBAAoB;AAAA,EACvB;AAEA,QAAM,UAAU,MAAM;AACpB,uBAAmB,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACnC,mBAAe,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAC/B,wBAAoB,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACpC,kBAAc,EAAE,MAAM,MAAM,aAAa,CAAC,CAAC,CAAC;AAAA,EAC9C,GAAG,CAAC,oBAAoB,qBAAqB,eAAe,gBAAgB,YAAY,CAAC;AAEzF,QAAM,UAAU,MAAM,QAAqB,MAAM;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,wCAAwC,SAAS;AAAA,MAC1D,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qCAAqC,MAAM;AAAA,MACpD,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,yCAAyC,WAAW;AAAA,MAC7D,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,yCAAyC,WAAW;AAAA,MAC7D,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,4CAA4C,iBAAiB;AAAA,MACtE,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,4CAA4C,iBAAiB;AAAA,MACtE,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,8CAA8C,mBAAmB;AAAA,MAC1E,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,8CAA8C,mBAAmB;AAAA,MAC1E,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,yCAAyC,UAAU;AAAA,MAC5D,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,oDAAoD,kBAAkB;AAAA,MACrF,aAAa,CAAC,QAAgB;AAC5B,cAAM,QAAQ,gBAAgB,KAAK,CAAC,QAAQ,IAAI,UAAU,GAAG;AAC7D,eAAO,OAAO,SAAS;AAAA,MACzB;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qCAAqC,MAAM;AAAA,MACpD,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,CAAC,QAAgB,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,GAAG,SAAS;AAAA,MAChF,mBAAmB,CAAC,QAAgB,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,GAAG,eAAe;AAAA,IAC9F;AAAA,EACF,GAAG,CAAC,gBAAgB,oBAAoB,iBAAiB,qBAAqB,gBAAgB,YAAY,CAAC,CAAC;AAE5G,QAAM,cAAc,MAAM,QAAQ,MAAM;AACtC,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,SAAS,CAAC;AACxC,QAAI,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AACrD,UAAM,OAAO,QAAQ,CAAC;AACtB,QAAI,MAAM,IAAI;AACZ,aAAO,IAAI,aAAa,KAAK,EAAE;AAC/B,aAAO,IAAI,WAAW,KAAK,OAAO,SAAS,KAAK;AAAA,IAClD;AACA,UAAM,YAAY,OAAO,aAAa,cAAc,WAAW,aAAa,YAAY;AACxF,QAAI,UAAW,QAAO,IAAI,aAAa,SAAS;AAChD,UAAM,cAAc,MAAM,QAAQ,aAAa,UAAU,IACrD,aAAa,WACV,IAAI,CAAC,UAAW,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI,OAAO,SAAS,EAAE,EAAE,KAAK,CAAE,EACtF,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC,IACrC,CAAC;AACL,QAAI,YAAY,SAAS,GAAG;AAC1B,aAAO,IAAI,cAAc,YAAY,CAAC,CAAC;AAAA,IACzC;AACA,UAAM,OAAO,aAAa;AAC1B,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAI,KAAK,KAAM,QAAO,IAAI,YAAY,KAAK,IAAI;AAC/C,UAAI,KAAK,GAAI,QAAO,IAAI,UAAU,KAAK,EAAE;AAAA,IAC3C;AACA,UAAM,gBAAqD;AAAA,MACzD,CAAC,oBAAoB,kBAAkB;AAAA,MACvC,CAAC,oBAAoB,kBAAkB;AAAA,MACvC,CAAC,eAAe,aAAa;AAAA,MAC7B,CAAC,eAAe,aAAa;AAAA,MAC7B,CAAC,iBAAiB,eAAe;AAAA,MACjC,CAAC,iBAAiB,eAAe;AAAA,IACnC;AACA,kBAAc,QAAQ,CAAC,CAAC,KAAK,QAAQ,MAAM;AACzC,YAAM,QAAQ,qBAAsB,aAAqB,GAAG,CAAC;AAC7D,UAAI,SAAS,KAAM,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AAAA,IACvD,CAAC;AACD,UAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,IAC5C,aAAa,OAAO,IAAI,CAAC,UAAW,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI,OAAO,SAAS,EAAE,EAAE,KAAK,CAAE,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IACtI,CAAC;AACL,QAAI,OAAO,SAAS,GAAG;AACrB,aAAO,IAAI,UAAU,OAAO,KAAK,GAAG,CAAC;AAAA,IACvC;AACA,WAAO,QAAQ,YAAY,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACrD,UAAI,CAAC,IAAI,WAAW,KAAK,KAAK,SAAS,KAAM;AAC7C,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAM,aAAa,MAChB,IAAI,CAAC,SAAS;AACb,cAAI,QAAQ,KAAM,QAAO;AACzB,cAAI,OAAO,SAAS,SAAU,QAAO,KAAK,KAAK;AAC/C,iBAAO,OAAO,IAAI,EAAE,KAAK;AAAA,QAC3B,CAAC,EACA,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACnC,YAAI,WAAW,OAAQ,QAAO,IAAI,KAAK,WAAW,KAAK,GAAG,CAAC;AAAA,MAC7D,WAAW,OAAO,UAAU,UAAU;AACpC;AAAA,MACF,WAAW,UAAU,IAAI;AACvB,cAAM,cAAc,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;AAC3E,YAAI,YAAa,QAAO,IAAI,KAAK,WAAW;AAAA,MAC9C;AAAA,IACF,CAAC;AACD,WAAO,OAAO,SAAS;AAAA,EACzB,GAAG,CAAC,cAAc,MAAM,QAAQ,OAAO,CAAC;AAExC,QAAM,gBAAgB,MAAM,QAAQ,MAAM,OAAO,YAAY,IAAI,gBAAgB,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;AAE7G,QAAM,eAAe,MAAM,QAAQ,OAAO;AAAA,IACxC,MAAM;AAAA,MACJ,QAAQ,CAAC,WACP,mBAAmB,SAAS,QAAQ,IAAI,EAAE,GAAG,eAAe,aAAa,OAAO,GAAG,MAAM;AAAA,IAC7F;AAAA,IACA,MAAM;AAAA,MACJ,QAAQ,CAAC,WACP,mBAAmB,SAAS,QAAQ,IAAI,EAAE,GAAG,eAAe,aAAa,QAAQ,KAAK,OAAO,GAAG,MAAM;AAAA,IAC1G;AAAA,EACF,IAAI,CAAC,eAAe,QAAQ,CAAC;AAE7B,QAAM,iBAAiB,MAAM;AAAA,IAC3B,CAAC,SAAoD;AACnD,YAAM,MAAM;AACZ,YAAM,KAAK,OAAO,IAAI,OAAO,WAAW,IAAI,KAAK;AACjD,YAAM,SAAS,SAAS,UACpB,IAAI,eAAgB,MAAc,gBAAgB,KAClD,IAAI,eAAgB,MAAc,gBAAgB;AACtD,YAAM,mBAAoB,IAAI,oBAAoB;AAClD,YAAM,eAAe,oBAAoB,kBAAkB,IAAI,oBAAoB,IAAI;AACvF,YAAM,gBAAgB,qBAAqB,gBAAgB;AAC3D,YAAM,WAAW,SAAS,IAAI,mBAAmB;AACjD,YAAM,aAAa,SAAS,IAAI,qBAAqB;AACrD,YAAM,WAAW,IAAI,YAAY;AACjC,YAAM,aAAa,IAAI,cAAc;AACrC,YAAM,YAAY,IAAI,aAAa;AACnC,YAAM,OAAO,YAAY,cAAc,aAAa;AACpD,aAAO,wBAAwB;AAAA,QAC7B;AAAA,QACA;AAAA,QACA,QAAQ,IAAI,UAAU;AAAA,QACtB;AAAA,QACA;AAAA,QACA,WAAW,IAAI,aAAa;AAAA,QAC5B,eAAe,IAAI,iBAAiB;AAAA,QACpC;AAAA,QACA;AAAA,QACA,UAAU,IAAI,gBAAgB;AAAA,QAC9B;AAAA,QACA,WAAW,IAAI,aAAa;AAAA,MAC9B,GAAG,IAAI;AAAA,IACT;AAAA,IACA,CAAC,IAAI;AAAA,EACP;AAEA,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,eAAW,IAAI;AACf,mBAAe,IAAI;AACnB,QAAI;AACF,YAAM,OAAO,MAAM,QAA2B,cAAc,QAAQ,IAAI,WAAW,EAAE;AACrF,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,EAAE,oCAAoC,2BAA2B,GAAG,OAAO;AACjF,gBAAQ,CAAC,CAAC;AACV,iBAAS,CAAC;AACV,sBAAc,CAAC;AACf;AAAA,MACF;AACA,YAAM,UAAU,KAAK,UAAU,CAAC;AAChC,YAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC9D,cAAQ,MAAM,IAAI,CAAC,SAAS,eAAe,IAAI,CAAC,CAAC;AACjD,YAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,MAAM;AACxE,eAAS,KAAK;AACd,YAAM,QAAQ,OAAO,QAAQ,eAAe,WACxC,QAAQ,aACR,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,SAAS,CAAC;AAC5C,oBAAc,KAAK;AACnB,qBAAe,KAAK,eAAe,IAAI;AAAA,IACzC,SAAS,KAAK;AACZ,cAAQ,MAAM,wBAAwB,GAAG;AACzC,YAAM,EAAE,oCAAoC,2BAA2B,GAAG,OAAO;AAAA,IACnF,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,gBAAgB,aAAa,UAAU,CAAC,CAAC;AAE7C,QAAM,UAAU,MAAM;AACpB,SAAK,cAAc;AAAA,EACrB,GAAG,CAAC,eAAe,aAAa,YAAY,CAAC;AAE7C,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,oBAAgB,MAAM;AACtB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,CAAC,UAAkB;AAC9D,cAAU,KAAK;AACf,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,MAAM,YAAY,MAAM;AAC5C,mBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,EACrC,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM;AAAA,IACzB,OAAO,QAA0B;AAC/B,YAAM,iBACJ,SAAS,UACL;AAAA,QACE;AAAA,QACA;AAAA,MACF,IACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AACN,YAAM,YAAY,MAAM,QAAQ;AAAA,QAC9B,OAAO;AAAA,QACP,SAAS;AAAA,MACX,CAAC;AACD,UAAI,CAAC,UAAW;AAChB,UAAI;AACF,cAAM,SAAS,MAAM;AAAA,UACnB,0BAA0B,IAAI,SAAS;AAAA,UACvC,MACE,WAAW,SAAS,QAAQ,IAAI,IAAI,IAAI;AAAA,YACtC,cAAc,EAAE,0CAA0C,4BAA4B;AAAA,UACxF,CAAC;AAAA,QACL;AACA,YAAI,OAAO,IAAI;AACb;AAAA,YACE,SAAS,UACL,EAAE,2CAA2C,sBAAsB,IACnE,EAAE,2CAA2C,sBAAsB;AAAA,YACvE;AAAA,UACF;AACA,wBAAc;AAAA,QAChB;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,MAAM,0BAA0B,GAAG;AAC3C,cAAM,EAAE,0CAA0C,4BAA4B,GAAG,OAAO;AAAA,MAC1F;AAAA,IACF;AAAA,IACA,CAAC,SAAS,eAAe,MAAM,UAAU,CAAC;AAAA,EAC5C;AAEA,QAAM,iBAAiB,MAAM,YAAY,CAAC,QAA0B;AAClE,WAAO,KAAK,kBAAkB,QAAQ,IAAI,IAAI,EAAE,SAAS,IAAI,EAAE;AAAA,EACjE,GAAG,CAAC,MAAM,UAAU,MAAM,CAAC;AAE3B,QAAM,UAAU,MAAM,QAAuC,MAAM;AAAA,IACjE;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,SAAS,UACb,EAAE,oCAAoC,OAAO,IAC7C,EAAE,oCAAoC,OAAO;AAAA,MACjD,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,iBACb;AAAA,4BAAC,UAAK,WAAU,iBAAiB,cAAI,SAAS,QAAO;AAAA,QACpD,IAAI,SAAS,SACZ;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,IAAI,SAAS;AAAA,YACpB,KAAK;AAAA,YACL,UAAU,oBAAC,UAAK,WAAU,iCAAiC,cAAI,SAAS,QAAO;AAAA,YAC/E,WAAU;AAAA,YACV,sBAAqB;AAAA,YACrB,eAAc;AAAA,YACd,gBAAe;AAAA;AAAA,QACjB,IACE;AAAA,SACN;AAAA,MAEF,MAAM,EAAE,QAAQ,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,uCAAuC,UAAU;AAAA,MAC3D,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,iBACb;AAAA,4BAAC,UAAK,WAAU,uBACb,cAAI,SAAS,gBAAgB,EAAE,yCAAyC,aAAa,GACxF;AAAA,QACA,oBAAC,UAAK,WAAU,iCACb,cAAI,SAAS,iBAAiB,EAAE,sCAAsC,UAAU,GACnF;AAAA,SACF;AAAA,MAEF,eAAe;AAAA,IACjB;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,sCAAsC,SAAS;AAAA,MACzD,MAAM,CAAC,EAAE,IAAI,MAAM;AACjB,cAAM,YAAY,IAAI,SAAS;AAC/B,YAAI,CAAC,UAAW,QAAO,oBAAC,UAAK,WAAU,iCAAiC,YAAE,yCAAyC,YAAY,GAAE;AACjI,cAAM,UAAU,eAAe,KAAK,CAAC,QAAQ,IAAI,UAAU,SAAS;AACpE,eACE,oBAAC,UAAK,WAAU,WAAW,mBAAS,SAAS,WAAU;AAAA,MAE3D;AAAA,MACA,eAAe;AAAA,IACjB;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,EAAE,oCAAoC,OAAO;AAAA,MACrD,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAU,yBAAyB,iBAAO,IAAI,SAAS,kBAAkB,WAAW,IAAI,SAAS,gBAAgB,UAAI;AAAA,IAE/H;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,EAAE,uCAAuC,aAAa;AAAA,MAC9D,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAU,WAAW,yBAAe,IAAI,SAAS,YAAY,MAAM,IAAI,SAAS,QAAQ,GAAE;AAAA,IAEpG;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,EAAE,yCAAyC,eAAe;AAAA,MAClE,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAU,WAAW,yBAAe,IAAI,SAAS,cAAc,MAAM,IAAI,SAAS,QAAQ,GAAE;AAAA,IAEtG;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,EAAE,mCAAmC,MAAM;AAAA,MACnD,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,OACT,oBAAC,UAAK,WAAU,iCAAiC,cAAI,KAAK,IAAI,SAAS,IAAI,EAAE,eAAe,GAAE,IAC9F,oBAAC,UAAK,WAAU,iCAAgC,oBAAC;AAAA,IACzD;AAAA,EACF,GAAG,CAAC,gBAAgB,MAAM,WAAW,CAAC,CAAC;AAEvC,QAAM,aAAa,SAAS,UACxB,EAAE,0CAA0C,gBAAgB,IAC5D,EAAE,0CAA0C,gBAAgB;AAEhE,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,qBAAmB;AAAA,QACnB,OACE,qBAAC,SAAI,WAAU,iBACb;AAAA,8BAAC,UAAM,iBAAM;AAAA,UACb,oBAAC,UAAK,WAAU,6CAA6C,oBAAS;AAAA,WACxE;AAAA,QAEF,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAM,wCAAwC,IAAI,IACrD,YAAE,gCAAgC,uBAAuB,GAC5D,GACF;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,QACA,aAAa;AAAA,QACb,gBAAgB;AAAA,QAChB,mBACE,SAAS,UACL,EAAE,sCAAsC,qBAAgB,IACxD,EAAE,sCAAsC,qBAAgB;AAAA,QAE9D;AAAA,QACA;AAAA,QACA,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB;AAAA,QACA,UAAU;AAAA,QACV,YAAY;AAAA,UACV;AAAA,UACA,UAAU;AAAA,UACV;AAAA,UACA;AAAA,UACA,cAAc;AAAA,UACd;AAAA,QACF;AAAA,QACA,eAAe;AAAA,UACb,OAAO,EAAE,sCAAsC,SAAS;AAAA,UACxD,WAAW;AAAA,UACX,cAAc;AAAA,QAChB;AAAA,QACA,YAAY,CAAC,QACX;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,cACL;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,EAAE,mCAAmC,MAAM;AAAA,gBAClD,MAAM,kBAAkB,QAAQ,IAAI,IAAI,EAAE,SAAS,IAAI;AAAA,cACzD;AAAA,cACA;AAAA,gBACE,IAAI;AAAA,gBACJ,OACE,SAAS,UACL,EAAE,0CAA0C,cAAc,IAC1D,EAAE,0CAA0C,cAAc;AAAA,gBAChE,UAAU,MAAM,aAAa,GAAG;AAAA,cAClC;AAAA,YACF;AAAA;AAAA,QACF;AAAA,QAEF,aAAa,EAAE,SAAS,SAAS,UAAU,iBAAiB,eAAe;AAAA,QAC3E,YAAY;AAAA,QACZ,YACE,oBAAC,SAAI,WAAU,mDACZ,sBACH;AAAA;AAAA,IAEJ,GACF;AAAA,IACC;AAAA,KACH;AAEJ;AAEA,IAAO,8BAAQ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport type { ColumnDef, SortingState } from '@tanstack/react-table'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable, type DataTableExportFormat, withDataTableNamespaces } from '@open-mercato/ui/backend/DataTable'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { buildCrudExportUrl, deleteCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { E } from '#generated/entities.ids.generated'\nimport {\n  DictionaryValue,\n  type DictionaryMap,\n  createDictionaryMap,\n  normalizeDictionaryEntries,\n} from '@open-mercato/core/modules/dictionaries/components/dictionaryAppearance'\nimport { SALES_DOCUMENT_NUMBER_COLUMN_META } from './salesDocumentsColumns'\n\ntype SalesDocumentKind = 'order' | 'quote'\n\ntype FilterOption = { value: string; label: string; description?: string | null }\n\ntype CustomerSnapshot = {\n  customer?: {\n    displayName?: string | null\n    primaryEmail?: string | null\n  } | null\n  contact?: {\n    firstName?: string | null\n    lastName?: string | null\n    preferredName?: string | null\n  } | null\n}\n\ntype ApiDocument = {\n  id: string\n  orderNumber?: string | null\n  quoteNumber?: string | null\n  status?: string | null\n  customerEntityId?: string | null\n  customerSnapshot?: Record<string, unknown> | null\n  channelId?: string | null\n  lineItemCount?: number | null\n  grandTotalNetAmount?: number | null\n  grandTotalGrossAmount?: number | null\n  currencyCode?: string | null\n  placedAt?: string | null\n  validUntil?: string | null\n  validFrom?: string | null\n  createdAt?: string | null\n  updatedAt?: string | null\n}\n\ntype DocumentsResponse = {\n  items?: Array<Record<string, unknown>>\n  total?: number\n  totalPages?: number\n}\n\ntype SalesDocumentRow = {\n  id: string\n  number: string\n  status?: string | null\n  customerName?: string | null\n  customerEmail?: string | null\n  channelId?: string | null\n  lineItemCount?: number | null\n  totalNet?: number | null\n  totalGross?: number | null\n  currency?: string | null\n  date?: string | null\n  updatedAt?: string | null\n}\n\nconst PAGE_SIZE = 20\n\nfunction resolveCustomerName(snapshot: CustomerSnapshot | null | undefined, fallback?: string | null) {\n  if (!snapshot) return fallback ?? null\n  const base = snapshot.customer?.displayName ?? null\n  if (base) return base\n  const contact = snapshot.contact\n  if (contact) {\n    const parts = [contact.preferredName, contact.firstName, contact.lastName].filter(\n      (part) => part && part.trim().length\n    ) as string[]\n    if (parts.length) return parts.join(' ')\n  }\n  return fallback ?? null\n}\n\nfunction resolveCustomerEmail(snapshot: CustomerSnapshot | null | undefined) {\n  if (!snapshot) return null\n  if (snapshot.customer?.primaryEmail) return snapshot.customer.primaryEmail\n  return null\n}\n\nfunction toNumber(value: unknown): number | null {\n  if (typeof value === 'number') return Number.isNaN(value) ? null : value\n  if (typeof value === 'string' && value.trim().length) {\n    const parsed = Number(value)\n    return Number.isNaN(parsed) ? null : parsed\n  }\n  return null\n}\n\nfunction formatCurrency(amount: number | null | undefined, currency: string | null | undefined, fallback = '\u2014') {\n  if (amount == null || Number.isNaN(amount)) return fallback\n  try {\n    if (currency && currency.trim().length) {\n      const formatter = new Intl.NumberFormat(undefined, { style: 'currency', currency })\n      return formatter.format(amount)\n    }\n    return new Intl.NumberFormat(undefined, { style: 'decimal', maximumFractionDigits: 2 }).format(amount)\n  } catch {\n    return String(amount)\n  }\n}\n\nfunction mergeOptions(existing: FilterOption[], next: FilterOption[]): FilterOption[] {\n  const map = new Map<string, FilterOption>()\n  existing.forEach((opt) => map.set(opt.value, opt))\n  next.forEach((opt) => map.set(opt.value, opt))\n  return Array.from(map.values()).sort((a, b) => a.label.localeCompare(b.label))\n}\n\nfunction normalizeNumberInput(value: unknown): number | null {\n  if (typeof value === 'number') return Number.isNaN(value) ? null : value\n  if (typeof value === 'string' && value.trim().length) {\n    const parsed = Number(value)\n    return Number.isNaN(parsed) ? null : parsed\n  }\n  return null\n}\n\nexport function SalesDocumentsTable({ kind }: { kind: SalesDocumentKind }) {\n  const t = useT()\n  const router = useRouter()\n  const scopeVersion = useOrganizationScopeVersion()\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const [rows, setRows] = React.useState<SalesDocumentRow[]>([])\n  const [page, setPage] = React.useState(1)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [sorting, setSorting] = React.useState<SortingState>([{ id: 'createdAt', desc: true }])\n  const [search, setSearch] = React.useState('')\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n  const [isLoading, setLoading] = React.useState(false)\n  const [cacheStatus, setCacheStatus] = React.useState<'hit' | 'miss' | null>(null)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const [channelOptions, setChannelOptions] = React.useState<FilterOption[]>([])\n  const [tagOptions, setTagOptions] = React.useState<FilterOption[]>([])\n  const [customerOptions, setCustomerOptions] = React.useState<FilterOption[]>([])\n  const [statusMap, setStatusMap] = React.useState<DictionaryMap>({})\n\n  const resource = kind === 'order' ? 'orders' : 'quotes'\n  const entityId = kind === 'order' ? E.sales.sales_order : E.sales.sales_quote\n  const title = kind === 'order'\n    ? t('sales.documents.list.ordersTitle', 'Sales orders')\n    : t('sales.documents.list.quotesTitle', 'Sales quotes')\n  const subtitle = t(\n    'sales.documents.list.subtitle',\n    'Review documents with customer context, totals, and channels.'\n  )\n\n  const fetchChannelOptions = React.useCallback(async (query?: string): Promise<FilterOption[]> => {\n    const params = new URLSearchParams({ page: '1', pageSize: '50' })\n    if (query && query.trim()) params.set('search', query.trim())\n    try {\n      const call = await apiCall<{ items?: unknown[] }>(`/api/sales/channels?${params.toString()}`)\n      if (!call.ok) return []\n      const items = Array.isArray(call.result?.items) ? call.result!.items : []\n      return items\n        .map((item: any): FilterOption | null => {\n          const id = typeof item?.id === 'string' ? item.id : null\n          const name = typeof item?.name === 'string' ? item.name : null\n          if (!id || !name) return null\n          return { value: id, label: name }\n        })\n        .filter((opt): opt is FilterOption => opt !== null)\n    } catch {\n      return []\n    }\n  }, [])\n\n  const fetchTagOptions = React.useCallback(async (query?: string): Promise<FilterOption[]> => {\n    const params = new URLSearchParams({ page: '1', pageSize: '50' })\n    if (query && query.trim()) params.set('search', query.trim())\n    try {\n      const call = await apiCall<{ items?: unknown[] }>(`/api/sales/tags?${params.toString()}`)\n      if (!call.ok) return []\n      const items = Array.isArray(call.result?.items) ? call.result!.items : []\n      return items\n        .map((item: any): FilterOption | null => {\n          const id = typeof item?.id === 'string' ? item.id : null\n          const label = typeof item?.label === 'string' ? item.label : null\n          if (!id || !label) return null\n          const description = typeof item?.description === 'string' ? item.description : null\n          return { value: id, label, description }\n        })\n        .filter((opt): opt is FilterOption => opt !== null)\n    } catch {\n      return []\n    }\n  }, [])\n\n  const fetchCustomerOptions = React.useCallback(async (query?: string): Promise<FilterOption[]> => {\n    const params = new URLSearchParams({ page: '1', pageSize: '20' })\n    if (query && query.trim().length) params.set('search', query.trim())\n    try {\n      const [people, companies] = await Promise.all([\n        apiCall<{ items?: unknown[] }>(`/api/customers/people?${params.toString()}`),\n        apiCall<{ items?: unknown[] }>(`/api/customers/companies?${params.toString()}`),\n      ])\n      const peopleItems = Array.isArray(people.result?.items) ? people.result?.items ?? [] : []\n      const companyItems = Array.isArray(companies.result?.items) ? companies.result?.items ?? [] : []\n      const parseOption = (item: any, kind: 'person' | 'company'): FilterOption | null => {\n        const id = typeof item?.id === 'string' ? item.id : null\n        if (!id) return null\n        const name =\n          typeof item?.display_name === 'string' && item.display_name.trim().length\n            ? item.display_name\n            : typeof item?.name === 'string' && item.name.trim().length\n              ? item.name\n              : id\n        const email =\n          typeof item?.primary_email === 'string' && item.primary_email.trim().length\n            ? item.primary_email.trim()\n            : null\n        const label = email ? `${name} (${email})` : name\n        return { value: id, label }\n      }\n      const options = [...peopleItems.map((i) => parseOption(i, 'person')), ...companyItems.map((i) => parseOption(i, 'company'))]\n        .filter((opt): opt is FilterOption => !!opt)\n      return options\n    } catch {\n      return []\n    }\n  }, [])\n\n  const loadStatusMap = React.useCallback(async () => {\n    try {\n      const params = new URLSearchParams({ page: '1', pageSize: '100' })\n      const response = await apiCall<{ items?: Array<Record<string, unknown>> }>(\n        `/api/sales/order-statuses?${params.toString()}`,\n        undefined,\n        { fallback: { items: [] } }\n      )\n      const entries = normalizeDictionaryEntries(response.result?.items ?? [], { sort: false })\n      setStatusMap(createDictionaryMap(entries))\n    } catch (err) {\n      console.error('sales.documents.statuses.load', err)\n      setStatusMap({})\n    }\n  }, [])\n\n  const loadChannelOptions = React.useCallback(\n    async (query?: string) => {\n      const opts = await fetchChannelOptions(query)\n      if (opts.length) setChannelOptions((prev) => mergeOptions(prev, opts))\n      return opts\n    },\n    [fetchChannelOptions]\n  )\n\n  const loadTagOptions = React.useCallback(\n    async (query?: string) => {\n      const opts = await fetchTagOptions(query)\n      if (opts.length) setTagOptions((prev) => mergeOptions(prev, opts))\n      return opts\n    },\n    [fetchTagOptions]\n  )\n\n  const loadCustomerOptions = React.useCallback(\n    async (query?: string) => {\n      const opts = await fetchCustomerOptions(query)\n      if (opts.length) setCustomerOptions((prev) => mergeOptions(prev, opts))\n      return opts\n    },\n    [fetchCustomerOptions]\n  )\n\n  React.useEffect(() => {\n    loadChannelOptions().catch(() => {})\n    loadTagOptions().catch(() => {})\n    loadCustomerOptions().catch(() => {})\n    loadStatusMap().catch(() => setStatusMap({}))\n  }, [loadChannelOptions, loadCustomerOptions, loadStatusMap, loadTagOptions, scopeVersion])\n\n  const filters = React.useMemo<FilterDef[]>(() => [\n    {\n      id: 'channelId',\n      label: t('sales.documents.list.filters.channel', 'Channel'),\n      type: 'select',\n      options: channelOptions,\n      loadOptions: loadChannelOptions,\n    },\n    {\n      id: 'date',\n      label: t('sales.documents.list.filters.date', 'Date'),\n      type: 'dateRange',\n    },\n    {\n      id: 'lineItemCountMin',\n      label: t('sales.documents.list.filters.itemsMin', 'Min items'),\n      type: 'text',\n    },\n    {\n      id: 'lineItemCountMax',\n      label: t('sales.documents.list.filters.itemsMax', 'Max items'),\n      type: 'text',\n    },\n    {\n      id: 'totalNetMin',\n      label: t('sales.documents.list.filters.totalNetMin', 'Min total (net)'),\n      type: 'text',\n    },\n    {\n      id: 'totalNetMax',\n      label: t('sales.documents.list.filters.totalNetMax', 'Max total (net)'),\n      type: 'text',\n    },\n    {\n      id: 'totalGrossMin',\n      label: t('sales.documents.list.filters.totalGrossMin', 'Min total (gross)'),\n      type: 'text',\n    },\n    {\n      id: 'totalGrossMax',\n      label: t('sales.documents.list.filters.totalGrossMax', 'Max total (gross)'),\n      type: 'text',\n    },\n    {\n      id: 'customerId',\n      label: t('sales.documents.list.filters.customer', 'Customer'),\n      type: 'tags',\n      options: customerOptions,\n      loadOptions: loadCustomerOptions,\n      placeholder: t('sales.documents.list.filters.customerPlaceholder', 'Search customers'),\n      formatValue: (val: string) => {\n        const match = customerOptions.find((opt) => opt.value === val)\n        return match?.label ?? val\n      },\n    },\n    {\n      id: 'tagIds',\n      label: t('sales.documents.list.filters.tags', 'Tags'),\n      type: 'tags',\n      options: tagOptions,\n      loadOptions: loadTagOptions,\n      formatValue: (val: string) => tagOptions.find((o) => o.value === val)?.label ?? val,\n      formatDescription: (val: string) => tagOptions.find((o) => o.value === val)?.description ?? null,\n    },\n  ], [channelOptions, loadChannelOptions, customerOptions, loadCustomerOptions, loadTagOptions, tagOptions, t])\n\n  const queryParams = React.useMemo(() => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(PAGE_SIZE))\n    if (search.trim()) params.set('search', search.trim())\n    const sort = sorting[0]\n    if (sort?.id) {\n      params.set('sortField', sort.id)\n      params.set('sortDir', sort.desc ? 'desc' : 'asc')\n    }\n    const channelId = typeof filterValues.channelId === 'string' ? filterValues.channelId : ''\n    if (channelId) params.set('channelId', channelId)\n    const customerIds = Array.isArray(filterValues.customerId)\n      ? filterValues.customerId\n          .map((value) => (typeof value === 'string' ? value.trim() : String(value || '').trim()))\n          .filter((value) => value.length > 0)\n      : []\n    if (customerIds.length > 0) {\n      params.set('customerId', customerIds[0])\n    }\n    const date = filterValues.date\n    if (date && typeof date === 'object') {\n      if (date.from) params.set('dateFrom', date.from)\n      if (date.to) params.set('dateTo', date.to)\n    }\n    const numberFilters: Array<[keyof FilterValues, string]> = [\n      ['lineItemCountMin', 'lineItemCountMin'],\n      ['lineItemCountMax', 'lineItemCountMax'],\n      ['totalNetMin', 'totalNetMin'],\n      ['totalNetMax', 'totalNetMax'],\n      ['totalGrossMin', 'totalGrossMin'],\n      ['totalGrossMax', 'totalGrossMax'],\n    ]\n    numberFilters.forEach(([key, queryKey]) => {\n      const value = normalizeNumberInput((filterValues as any)[key])\n      if (value != null) params.set(queryKey, String(value))\n    })\n    const tagIds = Array.isArray(filterValues.tagIds)\n      ? filterValues.tagIds.map((value) => (typeof value === 'string' ? value.trim() : String(value || '').trim())).filter((v) => v.length > 0)\n      : []\n    if (tagIds.length > 0) {\n      params.set('tagIds', tagIds.join(','))\n    }\n    Object.entries(filterValues).forEach(([key, value]) => {\n      if (!key.startsWith('cf_') || value == null) return\n      if (Array.isArray(value)) {\n        const normalized = value\n          .map((item) => {\n            if (item == null) return ''\n            if (typeof item === 'string') return item.trim()\n            return String(item).trim()\n          })\n          .filter((item) => item.length > 0)\n        if (normalized.length) params.set(key, normalized.join(','))\n      } else if (typeof value === 'object') {\n        return\n      } else if (value !== '') {\n        const stringValue = typeof value === 'string' ? value.trim() : String(value)\n        if (stringValue) params.set(key, stringValue)\n      }\n    })\n    return params.toString()\n  }, [filterValues, page, search, sorting])\n\n  const currentParams = React.useMemo(() => Object.fromEntries(new URLSearchParams(queryParams)), [queryParams])\n\n  const exportConfig = React.useMemo(() => ({\n    view: {\n      getUrl: (format: DataTableExportFormat) =>\n        buildCrudExportUrl(`sales/${resource}`, { ...currentParams, exportScope: 'view' }, format),\n    },\n    full: {\n      getUrl: (format: DataTableExportFormat) =>\n        buildCrudExportUrl(`sales/${resource}`, { ...currentParams, exportScope: 'full', all: 'true' }, format),\n    },\n  }), [currentParams, resource])\n\n  const mapApiDocument = React.useCallback(\n    (item: Record<string, unknown>): SalesDocumentRow => {\n      const doc = item as ApiDocument\n      const id = typeof doc.id === 'string' ? doc.id : ''\n      const number = kind === 'order'\n        ? doc.orderNumber ?? (item as any)?.order_number ?? id\n        : doc.quoteNumber ?? (item as any)?.quote_number ?? id\n      const customerSnapshot = (doc.customerSnapshot ?? null) as CustomerSnapshot | null\n      const customerName = resolveCustomerName(customerSnapshot, doc.customerEntityId ?? null)\n      const customerEmail = resolveCustomerEmail(customerSnapshot)\n      const totalNet = toNumber(doc.grandTotalNetAmount)\n      const totalGross = toNumber(doc.grandTotalGrossAmount)\n      const placedAt = doc.placedAt ?? null\n      const validUntil = doc.validUntil ?? null\n      const createdAt = doc.createdAt ?? null\n      const date = placedAt ?? validUntil ?? createdAt ?? null\n      return withDataTableNamespaces({\n        id,\n        number,\n        status: doc.status ?? null,\n        customerName,\n        customerEmail,\n        channelId: doc.channelId ?? null,\n        lineItemCount: doc.lineItemCount ?? null,\n        totalNet,\n        totalGross,\n        currency: doc.currencyCode ?? null,\n        date,\n        updatedAt: doc.updatedAt ?? null,\n      }, item)\n    },\n    [kind]\n  )\n\n  const loadDocuments = React.useCallback(async () => {\n    setLoading(true)\n    setCacheStatus(null)\n    try {\n      const call = await apiCall<DocumentsResponse>(`/api/sales/${resource}?${queryParams}`)\n      if (!call.ok) {\n        flash(t('sales.documents.list.errors.load', 'Failed to load documents.'), 'error')\n        setRows([])\n        setTotal(0)\n        setTotalPages(1)\n        return\n      }\n      const payload = call.result ?? {}\n      const items = Array.isArray(payload.items) ? payload.items : []\n      setRows(items.map((item) => mapApiDocument(item)))\n      const count = typeof payload.total === 'number' ? payload.total : items.length\n      setTotal(count)\n      const pages = typeof payload.totalPages === 'number'\n        ? payload.totalPages\n        : Math.max(1, Math.ceil(count / PAGE_SIZE))\n      setTotalPages(pages)\n      setCacheStatus(call.cacheStatus ?? null)\n    } catch (err) {\n      console.error('sales.documents.list', err)\n      flash(t('sales.documents.list.errors.load', 'Failed to load documents.'), 'error')\n    } finally {\n      setLoading(false)\n    }\n  }, [mapApiDocument, queryParams, resource, t])\n\n  React.useEffect(() => {\n    void loadDocuments()\n  }, [loadDocuments, reloadToken, scopeVersion])\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    setFilterValues(values)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const handleSearchChange = React.useCallback((value: string) => {\n    setSearch(value)\n    setPage(1)\n  }, [])\n\n  const handleRefresh = React.useCallback(() => {\n    setReloadToken((token) => token + 1)\n  }, [])\n\n  const handleDelete = React.useCallback(\n    async (row: SalesDocumentRow) => {\n      const confirmMessage =\n        kind === 'order'\n          ? t(\n              'sales.documents.list.table.deleteOrderConfirm',\n              'Delete this sales order? Related shipments, payments, addresses, and items will be removed.'\n            )\n          : t(\n              'sales.documents.list.table.deleteQuoteConfirm',\n              'Delete this sales quote? Related addresses, comments, and items will be removed.'\n            )\n      const confirmed = await confirm({\n        title: confirmMessage,\n        variant: 'destructive',\n      })\n      if (!confirmed) return\n      try {\n        const result = await withScopedApiRequestHeaders(\n          buildOptimisticLockHeader(row.updatedAt),\n          () =>\n            deleteCrud(`sales/${resource}`, row.id, {\n              errorMessage: t('sales.documents.list.table.deleteError', 'Failed to delete document.'),\n            }),\n        )\n        if (result.ok) {\n          flash(\n            kind === 'order'\n              ? t('sales.documents.list.table.orderDeleted', 'Sales order deleted.')\n              : t('sales.documents.list.table.quoteDeleted', 'Sales quote deleted.'),\n            'success'\n          )\n          handleRefresh()\n        }\n      } catch (err) {\n        console.error('sales.documents.delete', err)\n        flash(t('sales.documents.list.table.deleteError', 'Failed to delete document.'), 'error')\n      }\n    },\n    [confirm, handleRefresh, kind, resource, t]\n  )\n\n  const handleRowClick = React.useCallback((row: SalesDocumentRow) => {\n    router.push(`/backend/sales/${resource}/${row.id}?kind=${kind}`)\n  }, [kind, resource, router])\n\n  const columns = React.useMemo<ColumnDef<SalesDocumentRow>[]>(() => [\n    {\n      id: 'number',\n      accessorKey: 'number',\n      header: kind === 'order'\n        ? t('sales.documents.list.table.order', 'Order')\n        : t('sales.documents.list.table.quote', 'Quote'),\n      cell: ({ row }) => (\n        <div className=\"flex flex-col\">\n          <span className=\"font-semibold\">{row.original.number}</span>\n          {row.original.status ? (\n            <DictionaryValue\n              value={row.original.status}\n              map={statusMap}\n              fallback={<span className=\"text-xs text-muted-foreground\">{row.original.status}</span>}\n              className=\"text-xs text-muted-foreground font-medium\"\n              iconWrapperClassName=\"inline-flex h-5 w-5 items-center justify-center rounded bg-muted text-muted-foreground\"\n              iconClassName=\"h-3.5 w-3.5\"\n              colorClassName=\"h-3 w-3 rounded-full border border-border/70\"\n            />\n          ) : null}\n        </div>\n      ),\n      meta: SALES_DOCUMENT_NUMBER_COLUMN_META,\n    },\n    {\n      accessorKey: 'customerName',\n      header: t('sales.documents.list.table.customer', 'Customer'),\n      cell: ({ row }) => (\n        <div className=\"flex flex-col\">\n          <span className=\"text-sm font-medium\">\n            {row.original.customerName ?? t('sales.documents.list.table.noCustomer', 'No customer')}\n          </span>\n          <span className=\"text-xs text-muted-foreground\">\n            {row.original.customerEmail ?? t('sales.documents.list.table.noEmail', 'No email')}\n          </span>\n        </div>\n      ),\n      enableSorting: false,\n    },\n    {\n      accessorKey: 'channelId',\n      header: t('sales.documents.list.table.channel', 'Channel'),\n      cell: ({ row }) => {\n        const channelId = row.original.channelId\n        if (!channelId) return <span className=\"text-xs text-muted-foreground\">{t('sales.documents.list.table.unassigned', 'Unassigned')}</span>\n        const channel = channelOptions.find((opt) => opt.value === channelId)\n        return (\n          <span className=\"text-sm\">{channel?.label ?? channelId}</span>\n        )\n      },\n      enableSorting: false,\n    },\n    {\n      id: 'lineItemCount',\n      accessorKey: 'lineItemCount',\n      header: t('sales.documents.list.table.items', 'Items'),\n      cell: ({ row }) => (\n        <span className=\"text-sm font-semibold\">{typeof row.original.lineItemCount === 'number' ? row.original.lineItemCount : '\u2014'}</span>\n      ),\n    },\n    {\n      id: 'grandTotalNetAmount',\n      accessorKey: 'totalNet',\n      header: t('sales.documents.list.table.totalNet', 'Total (net)'),\n      cell: ({ row }) => (\n        <span className=\"text-sm\">{formatCurrency(row.original.totalNet ?? null, row.original.currency)}</span>\n      ),\n    },\n    {\n      id: 'grandTotalGrossAmount',\n      accessorKey: 'totalGross',\n      header: t('sales.documents.list.table.totalGross', 'Total (gross)'),\n      cell: ({ row }) => (\n        <span className=\"text-sm\">{formatCurrency(row.original.totalGross ?? null, row.original.currency)}</span>\n      ),\n    },\n    {\n      id: 'createdAt',\n      accessorKey: 'date',\n      header: t('sales.documents.list.table.date', 'Date'),\n      cell: ({ row }) =>\n        row.original.date\n          ? <span className=\"text-xs text-muted-foreground\">{new Date(row.original.date).toLocaleString()}</span>\n          : <span className=\"text-xs text-muted-foreground\">\u2014</span>,\n    },\n  ], [channelOptions, kind, statusMap, t])\n\n  const emptyLabel = kind === 'order'\n    ? t('sales.documents.list.table.emptyOrders', 'No orders yet.')\n    : t('sales.documents.list.table.emptyQuotes', 'No quotes yet.')\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable<SalesDocumentRow>\n          stickyActionsColumn\n          title={(\n            <div className=\"flex flex-col\">\n              <span>{title}</span>\n              <span className=\"text-sm font-normal text-muted-foreground\">{subtitle}</span>\n            </div>\n          )}\n          actions={(\n            <Button asChild>\n              <Link href={`/backend/sales/documents/create?kind=${kind}`}>\n                {t('sales.documents.create.title', 'Create sales document')}\n              </Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          sorting={sorting}\n          onSortingChange={setSorting}\n          isLoading={isLoading}\n          searchValue={search}\n          onSearchChange={handleSearchChange}\n          searchPlaceholder={\n            kind === 'order'\n              ? t('sales.documents.list.search.orders', 'Search orders\u2026')\n              : t('sales.documents.list.search.quotes', 'Search quotes\u2026')\n          }\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          entityId={entityId}\n          exporter={exportConfig}\n          pagination={{\n            page,\n            pageSize: PAGE_SIZE,\n            total,\n            totalPages,\n            onPageChange: setPage,\n            cacheStatus,\n          }}\n          refreshButton={{\n            label: t('sales.documents.list.table.refresh', 'Refresh'),\n            onRefresh: handleRefresh,\n            isRefreshing: isLoading,\n          }}\n          rowActions={(row) => (\n            <RowActions\n              items={[\n                {\n                  id: 'open',\n                  label: t('sales.documents.list.table.open', 'Open'),\n                  href: `/backend/sales/${resource}/${row.id}?kind=${kind}`,\n                },\n                {\n                  id: 'delete',\n                  label:\n                    kind === 'order'\n                      ? t('sales.documents.list.table.deleteOrder', 'Delete order')\n                      : t('sales.documents.list.table.deleteQuote', 'Delete quote'),\n                  onSelect: () => handleDelete(row),\n                },\n              ]}\n            />\n          )}\n          perspective={{ tableId: kind === 'order' ? 'sales.orders' : 'sales.quotes' }}\n          onRowClick={handleRowClick}\n          emptyState={\n            <div className=\"py-10 text-center text-sm text-muted-foreground\">\n              {emptyLabel}\n            </div>\n          }\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n\nexport default SalesDocumentsTable\n"],
+  "mappings": ";AAskBQ,SACE,KADF;AApkBR,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAE1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,WAAuC,+BAA+B;AAE/E,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,SAAS,mCAAmC;AACrD,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB,kBAAkB;AAC/C,SAAS,aAAa;AACtB,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yCAAyC;AA0DlD,MAAM,YAAY;AAElB,SAAS,oBAAoB,UAA+C,UAA0B;AACpG,MAAI,CAAC,SAAU,QAAO,YAAY;AAClC,QAAM,OAAO,SAAS,UAAU,eAAe;AAC/C,MAAI,KAAM,QAAO;AACjB,QAAM,UAAU,SAAS;AACzB,MAAI,SAAS;AACX,UAAM,QAAQ,CAAC,QAAQ,eAAe,QAAQ,WAAW,QAAQ,QAAQ,EAAE;AAAA,MACzE,CAAC,SAAS,QAAQ,KAAK,KAAK,EAAE;AAAA,IAChC;AACA,QAAI,MAAM,OAAQ,QAAO,MAAM,KAAK,GAAG;AAAA,EACzC;AACA,SAAO,YAAY;AACrB;AAEA,SAAS,qBAAqB,UAA+C;AAC3E,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,UAAU,aAAc,QAAO,SAAS,SAAS;AAC9D,SAAO;AACT;AAEA,SAAS,SAAS,OAA+B;AAC/C,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,MAAM,KAAK,IAAI,OAAO;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,QAAQ;AACpD,UAAM,SAAS,OAAO,KAAK;AAC3B,WAAO,OAAO,MAAM,MAAM,IAAI,OAAO;AAAA,EACvC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAmC,UAAqC,WAAW,UAAK;AAC9G,MAAI,UAAU,QAAQ,OAAO,MAAM,MAAM,EAAG,QAAO;AACnD,MAAI;AACF,QAAI,YAAY,SAAS,KAAK,EAAE,QAAQ;AACtC,YAAM,YAAY,IAAI,KAAK,aAAa,QAAW,EAAE,OAAO,YAAY,SAAS,CAAC;AAClF,aAAO,UAAU,OAAO,MAAM;AAAA,IAChC;AACA,WAAO,IAAI,KAAK,aAAa,QAAW,EAAE,OAAO,WAAW,uBAAuB,EAAE,CAAC,EAAE,OAAO,MAAM;AAAA,EACvG,QAAQ;AACN,WAAO,OAAO,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,aAAa,UAA0B,MAAsC;AACpF,QAAM,MAAM,oBAAI,IAA0B;AAC1C,WAAS,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC;AACjD,OAAK,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC;AAC7C,SAAO,MAAM,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAC/E;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,MAAM,KAAK,IAAI,OAAO;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,QAAQ;AACpD,UAAM,SAAS,OAAO,KAAK;AAC3B,WAAO,OAAO,MAAM,MAAM,IAAI,OAAO;AAAA,EACvC;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,EAAE,KAAK,GAAgC;AACzE,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,4BAA4B;AACjD,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA6B,CAAC,CAAC;AAC7D,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,EAAE,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC;AAC5F,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvE,QAAM,CAAC,WAAW,UAAU,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAgC,IAAI;AAChF,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAyB,CAAC,CAAC;AAC7E,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAyB,CAAC,CAAC;AACrE,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAyB,CAAC,CAAC;AAC/E,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAwB,CAAC,CAAC;AAElE,QAAM,WAAW,SAAS,UAAU,WAAW;AAC/C,QAAM,WAAW,SAAS,UAAU,EAAE,MAAM,cAAc,EAAE,MAAM;AAClE,QAAM,QAAQ,SAAS,UACnB,EAAE,oCAAoC,cAAc,IACpD,EAAE,oCAAoC,cAAc;AACxD,QAAM,WAAW;AAAA,IACf;AAAA,IACA;AAAA,EACF;AAEA,QAAM,sBAAsB,MAAM,YAAY,OAAO,UAA4C;AAC/F,UAAM,SAAS,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,KAAK,CAAC;AAChE,QAAI,SAAS,MAAM,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM,KAAK,CAAC;AAC5D,QAAI;AACF,YAAM,OAAO,MAAM,QAA+B,uBAAuB,OAAO,SAAS,CAAC,EAAE;AAC5F,UAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,YAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,aAAO,MACJ,IAAI,CAAC,SAAmC;AACvC,cAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,KAAK;AACpD,cAAM,OAAO,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AAC1D,YAAI,CAAC,MAAM,CAAC,KAAM,QAAO;AACzB,eAAO,EAAE,OAAO,IAAI,OAAO,KAAK;AAAA,MAClC,CAAC,EACA,OAAO,CAAC,QAA6B,QAAQ,IAAI;AAAA,IACtD,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,kBAAkB,MAAM,YAAY,OAAO,UAA4C;AAC3F,UAAM,SAAS,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,KAAK,CAAC;AAChE,QAAI,SAAS,MAAM,KAAK,EAAG,QAAO,IAAI,UAAU,MAAM,KAAK,CAAC;AAC5D,QAAI;AACF,YAAM,OAAO,MAAM,QAA+B,mBAAmB,OAAO,SAAS,CAAC,EAAE;AACxF,UAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,YAAM,QAAQ,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAQ,QAAQ,CAAC;AACxE,aAAO,MACJ,IAAI,CAAC,SAAmC;AACvC,cAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,KAAK;AACpD,cAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ;AAC7D,YAAI,CAAC,MAAM,CAAC,MAAO,QAAO;AAC1B,cAAM,cAAc,OAAO,MAAM,gBAAgB,WAAW,KAAK,cAAc;AAC/E,eAAO,EAAE,OAAO,IAAI,OAAO,YAAY;AAAA,MACzC,CAAC,EACA,OAAO,CAAC,QAA6B,QAAQ,IAAI;AAAA,IACtD,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,uBAAuB,MAAM,YAAY,OAAO,UAA4C;AAChG,UAAM,SAAS,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,KAAK,CAAC;AAChE,QAAI,SAAS,MAAM,KAAK,EAAE,OAAQ,QAAO,IAAI,UAAU,MAAM,KAAK,CAAC;AACnE,QAAI;AACF,YAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC5C,QAA+B,yBAAyB,OAAO,SAAS,CAAC,EAAE;AAAA,QAC3E,QAA+B,4BAA4B,OAAO,SAAS,CAAC,EAAE;AAAA,MAChF,CAAC;AACD,YAAM,cAAc,MAAM,QAAQ,OAAO,QAAQ,KAAK,IAAI,OAAO,QAAQ,SAAS,CAAC,IAAI,CAAC;AACxF,YAAM,eAAe,MAAM,QAAQ,UAAU,QAAQ,KAAK,IAAI,UAAU,QAAQ,SAAS,CAAC,IAAI,CAAC;AAC/F,YAAM,cAAc,CAAC,MAAWA,UAAoD;AAClF,cAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,KAAK;AACpD,YAAI,CAAC,GAAI,QAAO;AAChB,cAAM,OACJ,OAAO,MAAM,iBAAiB,YAAY,KAAK,aAAa,KAAK,EAAE,SAC/D,KAAK,eACL,OAAO,MAAM,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SACjD,KAAK,OACL;AACR,cAAM,QACJ,OAAO,MAAM,kBAAkB,YAAY,KAAK,cAAc,KAAK,EAAE,SACjE,KAAK,cAAc,KAAK,IACxB;AACN,cAAM,QAAQ,QAAQ,GAAG,IAAI,KAAK,KAAK,MAAM;AAC7C,eAAO,EAAE,OAAO,IAAI,MAAM;AAAA,MAC5B;AACA,YAAM,UAAU,CAAC,GAAG,YAAY,IAAI,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,GAAG,aAAa,IAAI,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,EACxH,OAAO,CAAC,QAA6B,CAAC,CAAC,GAAG;AAC7C,aAAO;AAAA,IACT,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,QAAI;AACF,YAAM,SAAS,IAAI,gBAAgB,EAAE,MAAM,KAAK,UAAU,MAAM,CAAC;AACjE,YAAM,WAAW,MAAM;AAAA,QACrB,6BAA6B,OAAO,SAAS,CAAC;AAAA,QAC9C;AAAA,QACA,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,MAC5B;AACA,YAAM,UAAU,2BAA2B,SAAS,QAAQ,SAAS,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;AACxF,mBAAa,oBAAoB,OAAO,CAAC;AAAA,IAC3C,SAAS,KAAK;AACZ,cAAQ,MAAM,iCAAiC,GAAG;AAClD,mBAAa,CAAC,CAAC;AAAA,IACjB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM;AAAA,IAC/B,OAAO,UAAmB;AACxB,YAAM,OAAO,MAAM,oBAAoB,KAAK;AAC5C,UAAI,KAAK,OAAQ,mBAAkB,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;AACrE,aAAO;AAAA,IACT;AAAA,IACA,CAAC,mBAAmB;AAAA,EACtB;AAEA,QAAM,iBAAiB,MAAM;AAAA,IAC3B,OAAO,UAAmB;AACxB,YAAM,OAAO,MAAM,gBAAgB,KAAK;AACxC,UAAI,KAAK,OAAQ,eAAc,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;AACjE,aAAO;AAAA,IACT;AAAA,IACA,CAAC,eAAe;AAAA,EAClB;AAEA,QAAM,sBAAsB,MAAM;AAAA,IAChC,OAAO,UAAmB;AACxB,YAAM,OAAO,MAAM,qBAAqB,KAAK;AAC7C,UAAI,KAAK,OAAQ,oBAAmB,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;AACtE,aAAO;AAAA,IACT;AAAA,IACA,CAAC,oBAAoB;AAAA,EACvB;AAEA,QAAM,UAAU,MAAM;AACpB,uBAAmB,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACnC,mBAAe,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAC/B,wBAAoB,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACpC,kBAAc,EAAE,MAAM,MAAM,aAAa,CAAC,CAAC,CAAC;AAAA,EAC9C,GAAG,CAAC,oBAAoB,qBAAqB,eAAe,gBAAgB,YAAY,CAAC;AAEzF,QAAM,UAAU,MAAM,QAAqB,MAAM;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,wCAAwC,SAAS;AAAA,MAC1D,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qCAAqC,MAAM;AAAA,MACpD,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,yCAAyC,WAAW;AAAA,MAC7D,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,yCAAyC,WAAW;AAAA,MAC7D,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,4CAA4C,iBAAiB;AAAA,MACtE,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,4CAA4C,iBAAiB;AAAA,MACtE,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,8CAA8C,mBAAmB;AAAA,MAC1E,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,8CAA8C,mBAAmB;AAAA,MAC1E,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,yCAAyC,UAAU;AAAA,MAC5D,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,oDAAoD,kBAAkB;AAAA,MACrF,aAAa,CAAC,QAAgB;AAC5B,cAAM,QAAQ,gBAAgB,KAAK,CAAC,QAAQ,IAAI,UAAU,GAAG;AAC7D,eAAO,OAAO,SAAS;AAAA,MACzB;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qCAAqC,MAAM;AAAA,MACpD,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,CAAC,QAAgB,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,GAAG,SAAS;AAAA,MAChF,mBAAmB,CAAC,QAAgB,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,GAAG,eAAe;AAAA,IAC9F;AAAA,EACF,GAAG,CAAC,gBAAgB,oBAAoB,iBAAiB,qBAAqB,gBAAgB,YAAY,CAAC,CAAC;AAE5G,QAAM,cAAc,MAAM,QAAQ,MAAM;AACtC,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,SAAS,CAAC;AACxC,QAAI,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AACrD,UAAM,OAAO,QAAQ,CAAC;AACtB,QAAI,MAAM,IAAI;AACZ,aAAO,IAAI,aAAa,KAAK,EAAE;AAC/B,aAAO,IAAI,WAAW,KAAK,OAAO,SAAS,KAAK;AAAA,IAClD;AACA,UAAM,YAAY,OAAO,aAAa,cAAc,WAAW,aAAa,YAAY;AACxF,QAAI,UAAW,QAAO,IAAI,aAAa,SAAS;AAChD,UAAM,cAAc,MAAM,QAAQ,aAAa,UAAU,IACrD,aAAa,WACV,IAAI,CAAC,UAAW,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI,OAAO,SAAS,EAAE,EAAE,KAAK,CAAE,EACtF,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC,IACrC,CAAC;AACL,QAAI,YAAY,SAAS,GAAG;AAC1B,aAAO,IAAI,cAAc,YAAY,CAAC,CAAC;AAAA,IACzC;AACA,UAAM,OAAO,aAAa;AAC1B,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAI,KAAK,KAAM,QAAO,IAAI,YAAY,KAAK,IAAI;AAC/C,UAAI,KAAK,GAAI,QAAO,IAAI,UAAU,KAAK,EAAE;AAAA,IAC3C;AACA,UAAM,gBAAqD;AAAA,MACzD,CAAC,oBAAoB,kBAAkB;AAAA,MACvC,CAAC,oBAAoB,kBAAkB;AAAA,MACvC,CAAC,eAAe,aAAa;AAAA,MAC7B,CAAC,eAAe,aAAa;AAAA,MAC7B,CAAC,iBAAiB,eAAe;AAAA,MACjC,CAAC,iBAAiB,eAAe;AAAA,IACnC;AACA,kBAAc,QAAQ,CAAC,CAAC,KAAK,QAAQ,MAAM;AACzC,YAAM,QAAQ,qBAAsB,aAAqB,GAAG,CAAC;AAC7D,UAAI,SAAS,KAAM,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AAAA,IACvD,CAAC;AACD,UAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,IAC5C,aAAa,OAAO,IAAI,CAAC,UAAW,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI,OAAO,SAAS,EAAE,EAAE,KAAK,CAAE,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IACtI,CAAC;AACL,QAAI,OAAO,SAAS,GAAG;AACrB,aAAO,IAAI,UAAU,OAAO,KAAK,GAAG,CAAC;AAAA,IACvC;AACA,WAAO,QAAQ,YAAY,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACrD,UAAI,CAAC,IAAI,WAAW,KAAK,KAAK,SAAS,KAAM;AAC7C,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAM,aAAa,MAChB,IAAI,CAAC,SAAS;AACb,cAAI,QAAQ,KAAM,QAAO;AACzB,cAAI,OAAO,SAAS,SAAU,QAAO,KAAK,KAAK;AAC/C,iBAAO,OAAO,IAAI,EAAE,KAAK;AAAA,QAC3B,CAAC,EACA,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACnC,YAAI,WAAW,OAAQ,QAAO,IAAI,KAAK,WAAW,KAAK,GAAG,CAAC;AAAA,MAC7D,WAAW,OAAO,UAAU,UAAU;AACpC;AAAA,MACF,WAAW,UAAU,IAAI;AACvB,cAAM,cAAc,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;AAC3E,YAAI,YAAa,QAAO,IAAI,KAAK,WAAW;AAAA,MAC9C;AAAA,IACF,CAAC;AACD,WAAO,OAAO,SAAS;AAAA,EACzB,GAAG,CAAC,cAAc,MAAM,QAAQ,OAAO,CAAC;AAExC,QAAM,gBAAgB,MAAM,QAAQ,MAAM,OAAO,YAAY,IAAI,gBAAgB,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;AAE7G,QAAM,eAAe,MAAM,QAAQ,OAAO;AAAA,IACxC,MAAM;AAAA,MACJ,QAAQ,CAAC,WACP,mBAAmB,SAAS,QAAQ,IAAI,EAAE,GAAG,eAAe,aAAa,OAAO,GAAG,MAAM;AAAA,IAC7F;AAAA,IACA,MAAM;AAAA,MACJ,QAAQ,CAAC,WACP,mBAAmB,SAAS,QAAQ,IAAI,EAAE,GAAG,eAAe,aAAa,QAAQ,KAAK,OAAO,GAAG,MAAM;AAAA,IAC1G;AAAA,EACF,IAAI,CAAC,eAAe,QAAQ,CAAC;AAE7B,QAAM,iBAAiB,MAAM;AAAA,IAC3B,CAAC,SAAoD;AACnD,YAAM,MAAM;AACZ,YAAM,KAAK,OAAO,IAAI,OAAO,WAAW,IAAI,KAAK;AACjD,YAAM,SAAS,SAAS,UACpB,IAAI,eAAgB,MAAc,gBAAgB,KAClD,IAAI,eAAgB,MAAc,gBAAgB;AACtD,YAAM,mBAAoB,IAAI,oBAAoB;AAClD,YAAM,eAAe,oBAAoB,kBAAkB,IAAI,oBAAoB,IAAI;AACvF,YAAM,gBAAgB,qBAAqB,gBAAgB;AAC3D,YAAM,WAAW,SAAS,IAAI,mBAAmB;AACjD,YAAM,aAAa,SAAS,IAAI,qBAAqB;AACrD,YAAM,WAAW,IAAI,YAAY;AACjC,YAAM,aAAa,IAAI,cAAc;AACrC,YAAM,YAAY,IAAI,aAAa;AACnC,YAAM,OAAO,YAAY,cAAc,aAAa;AACpD,aAAO,wBAAwB;AAAA,QAC7B;AAAA,QACA;AAAA,QACA,QAAQ,IAAI,UAAU;AAAA,QACtB;AAAA,QACA;AAAA,QACA,WAAW,IAAI,aAAa;AAAA,QAC5B,eAAe,IAAI,iBAAiB;AAAA,QACpC;AAAA,QACA;AAAA,QACA,UAAU,IAAI,gBAAgB;AAAA,QAC9B;AAAA,QACA,WAAW,IAAI,aAAa;AAAA,MAC9B,GAAG,IAAI;AAAA,IACT;AAAA,IACA,CAAC,IAAI;AAAA,EACP;AAEA,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,eAAW,IAAI;AACf,mBAAe,IAAI;AACnB,QAAI;AACF,YAAM,OAAO,MAAM,QAA2B,cAAc,QAAQ,IAAI,WAAW,EAAE;AACrF,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,EAAE,oCAAoC,2BAA2B,GAAG,OAAO;AACjF,gBAAQ,CAAC,CAAC;AACV,iBAAS,CAAC;AACV,sBAAc,CAAC;AACf;AAAA,MACF;AACA,YAAM,UAAU,KAAK,UAAU,CAAC;AAChC,YAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC9D,cAAQ,MAAM,IAAI,CAAC,SAAS,eAAe,IAAI,CAAC,CAAC;AACjD,YAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,MAAM;AACxE,eAAS,KAAK;AACd,YAAM,QAAQ,OAAO,QAAQ,eAAe,WACxC,QAAQ,aACR,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,SAAS,CAAC;AAC5C,oBAAc,KAAK;AACnB,qBAAe,KAAK,eAAe,IAAI;AAAA,IACzC,SAAS,KAAK;AACZ,cAAQ,MAAM,wBAAwB,GAAG;AACzC,YAAM,EAAE,oCAAoC,2BAA2B,GAAG,OAAO;AAAA,IACnF,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,gBAAgB,aAAa,UAAU,CAAC,CAAC;AAE7C,QAAM,UAAU,MAAM;AACpB,SAAK,cAAc;AAAA,EACrB,GAAG,CAAC,eAAe,aAAa,YAAY,CAAC;AAE7C,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,oBAAgB,MAAM;AACtB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,CAAC,UAAkB;AAC9D,cAAU,KAAK;AACf,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,MAAM,YAAY,MAAM;AAC5C,mBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,EACrC,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,MAAM;AAAA,IACzB,OAAO,QAA0B;AAC/B,YAAM,iBACJ,SAAS,UACL;AAAA,QACE;AAAA,QACA;AAAA,MACF,IACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AACN,YAAM,YAAY,MAAM,QAAQ;AAAA,QAC9B,OAAO;AAAA,QACP,SAAS;AAAA,MACX,CAAC;AACD,UAAI,CAAC,UAAW;AAChB,UAAI;AACF,cAAM,SAAS,MAAM;AAAA,UACnB,0BAA0B,IAAI,SAAS;AAAA,UACvC,MACE,WAAW,SAAS,QAAQ,IAAI,IAAI,IAAI;AAAA,YACtC,cAAc,EAAE,0CAA0C,4BAA4B;AAAA,UACxF,CAAC;AAAA,QACL;AACA,YAAI,OAAO,IAAI;AACb;AAAA,YACE,SAAS,UACL,EAAE,2CAA2C,sBAAsB,IACnE,EAAE,2CAA2C,sBAAsB;AAAA,YACvE;AAAA,UACF;AACA,wBAAc;AAAA,QAChB;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,MAAM,0BAA0B,GAAG;AAC3C,cAAM,EAAE,0CAA0C,4BAA4B,GAAG,OAAO;AAAA,MAC1F;AAAA,IACF;AAAA,IACA,CAAC,SAAS,eAAe,MAAM,UAAU,CAAC;AAAA,EAC5C;AAEA,QAAM,iBAAiB,MAAM,YAAY,CAAC,QAA0B;AAClE,WAAO,KAAK,kBAAkB,QAAQ,IAAI,IAAI,EAAE,SAAS,IAAI,EAAE;AAAA,EACjE,GAAG,CAAC,MAAM,UAAU,MAAM,CAAC;AAE3B,QAAM,UAAU,MAAM,QAAuC,MAAM;AAAA,IACjE;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,SAAS,UACb,EAAE,oCAAoC,OAAO,IAC7C,EAAE,oCAAoC,OAAO;AAAA,MACjD,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,iBACb;AAAA,4BAAC,UAAK,WAAU,iBAAiB,cAAI,SAAS,QAAO;AAAA,QACpD,IAAI,SAAS,SACZ;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,IAAI,SAAS;AAAA,YACpB,KAAK;AAAA,YACL,UAAU,oBAAC,UAAK,WAAU,iCAAiC,cAAI,SAAS,QAAO;AAAA,YAC/E,WAAU;AAAA,YACV,sBAAqB;AAAA,YACrB,eAAc;AAAA,YACd,gBAAe;AAAA;AAAA,QACjB,IACE;AAAA,SACN;AAAA,MAEF,MAAM;AAAA,IACR;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,uCAAuC,UAAU;AAAA,MAC3D,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,iBACb;AAAA,4BAAC,UAAK,WAAU,uBACb,cAAI,SAAS,gBAAgB,EAAE,yCAAyC,aAAa,GACxF;AAAA,QACA,oBAAC,UAAK,WAAU,iCACb,cAAI,SAAS,iBAAiB,EAAE,sCAAsC,UAAU,GACnF;AAAA,SACF;AAAA,MAEF,eAAe;AAAA,IACjB;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,sCAAsC,SAAS;AAAA,MACzD,MAAM,CAAC,EAAE,IAAI,MAAM;AACjB,cAAM,YAAY,IAAI,SAAS;AAC/B,YAAI,CAAC,UAAW,QAAO,oBAAC,UAAK,WAAU,iCAAiC,YAAE,yCAAyC,YAAY,GAAE;AACjI,cAAM,UAAU,eAAe,KAAK,CAAC,QAAQ,IAAI,UAAU,SAAS;AACpE,eACE,oBAAC,UAAK,WAAU,WAAW,mBAAS,SAAS,WAAU;AAAA,MAE3D;AAAA,MACA,eAAe;AAAA,IACjB;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,EAAE,oCAAoC,OAAO;AAAA,MACrD,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAU,yBAAyB,iBAAO,IAAI,SAAS,kBAAkB,WAAW,IAAI,SAAS,gBAAgB,UAAI;AAAA,IAE/H;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,EAAE,uCAAuC,aAAa;AAAA,MAC9D,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAU,WAAW,yBAAe,IAAI,SAAS,YAAY,MAAM,IAAI,SAAS,QAAQ,GAAE;AAAA,IAEpG;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,EAAE,yCAAyC,eAAe;AAAA,MAClE,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAU,WAAW,yBAAe,IAAI,SAAS,cAAc,MAAM,IAAI,SAAS,QAAQ,GAAE;AAAA,IAEtG;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,QAAQ,EAAE,mCAAmC,MAAM;AAAA,MACnD,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,OACT,oBAAC,UAAK,WAAU,iCAAiC,cAAI,KAAK,IAAI,SAAS,IAAI,EAAE,eAAe,GAAE,IAC9F,oBAAC,UAAK,WAAU,iCAAgC,oBAAC;AAAA,IACzD;AAAA,EACF,GAAG,CAAC,gBAAgB,MAAM,WAAW,CAAC,CAAC;AAEvC,QAAM,aAAa,SAAS,UACxB,EAAE,0CAA0C,gBAAgB,IAC5D,EAAE,0CAA0C,gBAAgB;AAEhE,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,qBAAmB;AAAA,QACnB,OACE,qBAAC,SAAI,WAAU,iBACb;AAAA,8BAAC,UAAM,iBAAM;AAAA,UACb,oBAAC,UAAK,WAAU,6CAA6C,oBAAS;AAAA,WACxE;AAAA,QAEF,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAM,wCAAwC,IAAI,IACrD,YAAE,gCAAgC,uBAAuB,GAC5D,GACF;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,QACA,aAAa;AAAA,QACb,gBAAgB;AAAA,QAChB,mBACE,SAAS,UACL,EAAE,sCAAsC,qBAAgB,IACxD,EAAE,sCAAsC,qBAAgB;AAAA,QAE9D;AAAA,QACA;AAAA,QACA,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB;AAAA,QACA,UAAU;AAAA,QACV,YAAY;AAAA,UACV;AAAA,UACA,UAAU;AAAA,UACV;AAAA,UACA;AAAA,UACA,cAAc;AAAA,UACd;AAAA,QACF;AAAA,QACA,eAAe;AAAA,UACb,OAAO,EAAE,sCAAsC,SAAS;AAAA,UACxD,WAAW;AAAA,UACX,cAAc;AAAA,QAChB;AAAA,QACA,YAAY,CAAC,QACX;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,cACL;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,EAAE,mCAAmC,MAAM;AAAA,gBAClD,MAAM,kBAAkB,QAAQ,IAAI,IAAI,EAAE,SAAS,IAAI;AAAA,cACzD;AAAA,cACA;AAAA,gBACE,IAAI;AAAA,gBACJ,OACE,SAAS,UACL,EAAE,0CAA0C,cAAc,IAC1D,EAAE,0CAA0C,cAAc;AAAA,gBAChE,UAAU,MAAM,aAAa,GAAG;AAAA,cAClC;AAAA,YACF;AAAA;AAAA,QACF;AAAA,QAEF,aAAa,EAAE,SAAS,SAAS,UAAU,iBAAiB,eAAe;AAAA,QAC3E,YAAY;AAAA,QACZ,YACE,oBAAC,SAAI,WAAU,mDACZ,sBACH;AAAA;AAAA,IAEJ,GACF;AAAA,IACC;AAAA,KACH;AAEJ;AAEA,IAAO,8BAAQ;",
   "names": ["kind"]
 }

package/dist/modules/sales/components/documents/salesDocumentsColumns.js

@@ -0,0 +1,10 @@
+const SALES_DOCUMENT_NUMBER_COLUMN_MAX_WIDTH = "220px";
+const SALES_DOCUMENT_NUMBER_COLUMN_META = {
+  sticky: true,
+  maxWidth: SALES_DOCUMENT_NUMBER_COLUMN_MAX_WIDTH
+};
+export {
+  SALES_DOCUMENT_NUMBER_COLUMN_MAX_WIDTH,
+  SALES_DOCUMENT_NUMBER_COLUMN_META
+};
+//# sourceMappingURL=salesDocumentsColumns.js.map

package/dist/modules/sales/components/documents/salesDocumentsColumns.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/sales/components/documents/salesDocumentsColumns.ts"],
+  "sourcesContent": ["export const SALES_DOCUMENT_NUMBER_COLUMN_MAX_WIDTH = '220px'\n\nexport const SALES_DOCUMENT_NUMBER_COLUMN_META = {\n  sticky: true,\n  maxWidth: SALES_DOCUMENT_NUMBER_COLUMN_MAX_WIDTH,\n} as const\n"],
+  "mappings": "AAAO,MAAM,yCAAyC;AAE/C,MAAM,oCAAoC;AAAA,EAC/C,QAAQ;AAAA,EACR,UAAU;AACZ;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.5459.1.170077434e",
+  "version": "0.6.6-develop.5491.1.469e89d368",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -245,16 +245,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.5459.1.170077434e",
-    "@open-mercato/shared": "0.6.6-develop.5459.1.170077434e",
-    "@open-mercato/ui": "0.6.6-develop.5459.1.170077434e",
+    "@open-mercato/ai-assistant": "0.6.6-develop.5491.1.469e89d368",
+    "@open-mercato/shared": "0.6.6-develop.5491.1.469e89d368",
+    "@open-mercato/ui": "0.6.6-develop.5491.1.469e89d368",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.5459.1.170077434e",
-    "@open-mercato/shared": "0.6.6-develop.5459.1.170077434e",
-    "@open-mercato/ui": "0.6.6-develop.5459.1.170077434e",
+    "@open-mercato/ai-assistant": "0.6.6-develop.5491.1.469e89d368",
+    "@open-mercato/shared": "0.6.6-develop.5491.1.469e89d368",
+    "@open-mercato/ui": "0.6.6-develop.5491.1.469e89d368",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/auth/api/login.ts

@@ -108,21 +108,21 @@ export async function POST(req: Request) {
     user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId)
   } else {
     const users = await auth.findUsersByEmail(parsed.data.email)
-    if (users.length > 1) {
-      return NextResponse.json({
-        ok: false,
-        error: translate('auth.login.errors.tenantRequired', 'Use the login link provided with your tenant activation to continue.'),
-      }, { status: 400 })
-    }
-    user = users[0] ?? null
-  }
-  if (!user || !user.passwordHash) {
-    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason: 'invalid_credentials' }).catch(() => undefined)
-    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })
+    // Never disclose that an email is registered across multiple tenants — a
+    // password-independent 400-vs-401 response is an account/topology oracle
+    // (issue #2242). Treat an ambiguous match as no resolvable user and fall
+    // through to the uniform invalid-credentials path; tenant-selection
+    // guidance is delivered out-of-band via the activation/login link.
+    user = users.length === 1 ? users[0] : null
   }
+  // Always verify the password — verifyPassword runs a constant-time bcrypt
+  // comparison even when the user is missing or has no hash — so unknown-email,
+  // wrong-password, and multi-tenant cases return an identical 401 with
+  // identical latency.
   const ok = await auth.verifyPassword(user, parsed.data.password)
-  if (!ok) {
-    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason: 'invalid_password' }).catch(() => undefined)
+  if (!user || !ok) {
+    const reason = user?.passwordHash ? 'invalid_password' : 'invalid_credentials'
+    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)
     return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })
   }
   // Optional role requirement

package/src/modules/auth/i18n/de.json

@@ -43,7 +43,6 @@
   "auth.login.errors.invalidCredentials": "Ungültige E-Mail oder ungültiges Passwort",
   "auth.login.errors.permissionDenied": "Du hast keine Berechtigung, auf diesen Bereich zuzugreifen. Bitte wende dich an deine Administration.",
   "auth.login.errors.tenantInvalid": "Tenant nicht gefunden. Entferne die Tenant-Auswahl und versuche es erneut.",
-  "auth.login.errors.tenantRequired": "Nutze den Login-Link aus deiner Tenant-Aktivierung, um fortzufahren.",
   "auth.login.featureDenied": "Du hast keinen Zugriff auf diese Funktion ({feature}). Bitte wende dich an deine Administration.",
   "auth.login.forgotPassword": "Passwort vergessen?",
   "auth.login.loading": "Wird geladen ...",

package/src/modules/auth/i18n/en.json

@@ -43,7 +43,6 @@
   "auth.login.errors.invalidCredentials": "Invalid email or password",
   "auth.login.errors.permissionDenied": "You do not have permission to access this area. Please contact your administrator.",
   "auth.login.errors.tenantInvalid": "Tenant not found. Clear the tenant selection and try again.",
-  "auth.login.errors.tenantRequired": "Use the login link provided with your tenant activation to continue.",
   "auth.login.featureDenied": "You don't have access to this feature ({feature}). Please contact your administrator.",
   "auth.login.forgotPassword": "Forgot password?",
   "auth.login.loading": "Loading...",

package/src/modules/auth/i18n/es.json

@@ -43,7 +43,6 @@
   "auth.login.errors.invalidCredentials": "Correo electrónico o contraseña no válidos",
   "auth.login.errors.permissionDenied": "No tienes permiso para acceder a esta área. Ponte en contacto con tu administrador.",
   "auth.login.errors.tenantInvalid": "No se encontró el inquilino. Borra la selección e inténtalo de nuevo.",
-  "auth.login.errors.tenantRequired": "Usa el enlace de inicio de sesión proporcionado con la activación de tu inquilino para continuar.",
   "auth.login.featureDenied": "No tienes acceso a esta funcionalidad ({feature}). Ponte en contacto con tu administrador.",
   "auth.login.forgotPassword": "¿Olvidaste tu contraseña?",
   "auth.login.loading": "Cargando...",

package/src/modules/auth/i18n/pl.json

@@ -43,7 +43,6 @@
   "auth.login.errors.invalidCredentials": "Nieprawidłowy email lub hasło",
   "auth.login.errors.permissionDenied": "Nie masz uprawnień do tego obszaru. Skontaktuj się z administratorem.",
   "auth.login.errors.tenantInvalid": "Nie znaleziono najemcy. Wyczyść wybór i spróbuj ponownie.",
-  "auth.login.errors.tenantRequired": "Użyj linku logowania z aktywacji najemcy, aby kontynuować.",
   "auth.login.featureDenied": "Nie masz dostępu do tej funkcji ({feature}). Skontaktuj się z administratorem.",
   "auth.login.forgotPassword": "Nie pamiętasz hasła?",
   "auth.login.loading": "Ładowanie...",

package/src/modules/auth/services/authService.ts

@@ -5,6 +5,13 @@ import { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/email
 import { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
+// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password
+// can match. verifyPassword compares against it whenever the user is missing or
+// has no password hash, so a failed login spends the same bcrypt CPU time
+// regardless of whether the account exists — closing the timing side channel
+// for account enumeration (issue #2242).
+const TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'
+
 export class AuthService {
   constructor(private em: EntityManager) {}
 
@@ -48,9 +55,13 @@ export class AuthService {
     )
   }
 
-  async verifyPassword(user: User, password: string) {
-    if (!user.passwordHash) return false
-    return compare(password, user.passwordHash)
+  async verifyPassword(user: User | null, password: string) {
+    const storedHash = user?.passwordHash ?? null
+    // Always run a bcrypt comparison — against a fixed dummy hash when the user
+    // is absent or has no password — so login latency does not reveal whether
+    // the account exists (timing-based enumeration, issue #2242).
+    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)
+    return storedHash !== null && matched
   }
 
   async updateLastLoginAt(user: User) {

package/src/modules/sales/components/documents/SalesDocumentsTable.tsx

@@ -23,6 +23,7 @@ import {
   createDictionaryMap,
   normalizeDictionaryEntries,
 } from '@open-mercato/core/modules/dictionaries/components/dictionaryAppearance'
+import { SALES_DOCUMENT_NUMBER_COLUMN_META } from './salesDocumentsColumns'
 
 type SalesDocumentKind = 'order' | 'quote'
 
@@ -594,7 +595,7 @@ export function SalesDocumentsTable({ kind }: { kind: SalesDocumentKind }) {
           ) : null}
         </div>
       ),
-      meta: { sticky: true },
+      meta: SALES_DOCUMENT_NUMBER_COLUMN_META,
     },
     {
       accessorKey: 'customerName',

package/src/modules/sales/components/documents/salesDocumentsColumns.ts

@@ -0,0 +1,6 @@
+export const SALES_DOCUMENT_NUMBER_COLUMN_MAX_WIDTH = '220px'
+
+export const SALES_DOCUMENT_NUMBER_COLUMN_META = {
+  sticky: true,
+  maxWidth: SALES_DOCUMENT_NUMBER_COLUMN_MAX_WIDTH,
+} as const